@sentry/junior 0.203.0 → 0.204.0

package/dist/profile-CrT5nXbw.js

@@ -0,0 +1,861 @@
+import { R as toOptionalTrimmed, i as getChatConfig } from "./config-nGCW1OTG.js";
+import { _ as setSpanAttributes, v as setSpanStatus } from "./logging-BzAk1S_s.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-BReos-D4.js";
+import { createHash } from "node:crypto";
+import { createMemoryState } from "@chat-adapter/state-memory";
+import { createRedisState } from "@chat-adapter/state-redis";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+//#region src/chat/sandbox/paths.ts
+function normalizeWorkspaceRoot(input) {
+	const candidate = (input ?? "").trim();
+	if (!candidate) return "/vercel/sandbox";
+	const normalized = candidate.replace(/\/+$/, "");
+	return normalized.startsWith("/") ? normalized : `/${normalized}`;
+}
+const SANDBOX_WORKSPACE_ROOT = normalizeWorkspaceRoot(process.env.VERCEL_SANDBOX_WORKSPACE_DIR);
+const SANDBOX_REPOS_ROOT = `${SANDBOX_WORKSPACE_ROOT}/repos`;
+const SANDBOX_SKILLS_ROOT = `${SANDBOX_WORKSPACE_ROOT}/skills`;
+const SANDBOX_DATA_ROOT = `${SANDBOX_WORKSPACE_ROOT}/data`;
+function sandboxSkillDir(skillName) {
+	return `${SANDBOX_SKILLS_ROOT}/${skillName}`;
+}
+function sandboxSkillFile(skillName) {
+	return `${sandboxSkillDir(skillName)}/SKILL.md`;
+}
+/** Explain how the agent should resolve files and commands owned by a skill. */
+function sandboxSkillPathResolution(skillName) {
+	const skillDir = sandboxSkillDir(skillName);
+	return `Resolve relative paths in this skill against ${skillDir}. For bash commands from this skill, cd to ${skillDir} first or use absolute paths.`;
+}
+//#endregion
+//#region src/chat/sleep.ts
+/** Wait for a duration, rejecting with the owning signal reason when cancelled. */
+function sleep(ms, signal) {
+	if (!signal) return new Promise((resolve) => setTimeout(resolve, ms));
+	return new Promise((resolve, reject) => {
+		if (signal.aborted) {
+			reject(signal.reason);
+			return;
+		}
+		const timeoutId = setTimeout(() => {
+			signal.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		const onAbort = () => {
+			clearTimeout(timeoutId);
+			reject(signal.reason);
+		};
+		signal.addEventListener("abort", onAbort, { once: true });
+	});
+}
+//#endregion
+//#region src/chat/state/locks.ts
+const ACTIVE_LOCK_TTL_MS = 9e4;
+const MUTATION_LOCK_TTL_MS = 1e4;
+/**
+* Acquire a lock for long-running work that the queued state adapter should
+* keep alive while the owning invocation is still making progress.
+*/
+async function acquireActiveLock(state, threadId) {
+	return await state.acquireLock(threadId, ACTIVE_LOCK_TTL_MS);
+}
+/**
+* Run work under one lock, optionally waiting for the current owner.
+* `keepAlive` is for multi-store mutations that must retain ownership until all
+* side effects finish; callers should still fence each blind write.
+*/
+async function withLock(state, key, run, options = {}) {
+	const startedAtMs = Date.now();
+	let lock;
+	while (true) {
+		lock = await state.acquireLock(key, options.ttlMs ?? 9e4);
+		if (lock) break;
+		if (Date.now() - startedAtMs >= (options.waitMs ?? 0)) return { acquired: false };
+		await setTimeout$1(options.retryMs ?? 25, void 0, { ref: false });
+	}
+	const ttlMs = options.ttlMs ?? 9e4;
+	const heartbeat = options.keepAlive ? setInterval(() => {
+		state.extendLock(lock, ttlMs);
+	}, Math.max(1, Math.floor(ttlMs / 3))) : void 0;
+	heartbeat?.unref();
+	try {
+		return {
+			acquired: true,
+			value: await run(lock)
+		};
+	} finally {
+		if (heartbeat) clearInterval(heartbeat);
+		await state.releaseLock(lock);
+	}
+}
+/**
+* Prove lock ownership immediately before a blind write.
+*
+* Whole-record mutations must stop if their lock expired rather than overwrite
+* state committed by a newer owner.
+*/
+async function fenceLock(state, lock, ttlMs = MUTATION_LOCK_TTL_MS) {
+	if (!await state.extendLock(lock, ttlMs)) throw new Error(`Lock ownership was lost before write for ${lock.threadId}`);
+}
+/** Run work under the active lock, reporting contention without ambiguity. */
+async function withActiveLock(state, key, run) {
+	return await withLock(state, key, run);
+}
+//#endregion
+//#region src/chat/state/adapter.ts
+const ACTIVE_LOCK_HEARTBEAT_MS = 3e4;
+let stateAdapter;
+let redisStateAdapter;
+/** Lazily connect state operations, including queued-adapter lock heartbeats. */
+function createConnectingStateAdapter(base) {
+	const connected = async (operation) => {
+		await base.connect();
+		return await operation();
+	};
+	return {
+		appendToList: (key, value, options) => connected(() => base.appendToList(key, value, options)),
+		connect: () => base.connect(),
+		disconnect: () => base.disconnect(),
+		subscribe: (threadId) => connected(() => base.subscribe(threadId)),
+		unsubscribe: (threadId) => connected(() => base.unsubscribe(threadId)),
+		isSubscribed: (threadId) => connected(() => base.isSubscribed(threadId)),
+		acquireLock: (threadId, ttlMs) => connected(() => base.acquireLock(threadId, ttlMs)),
+		releaseLock: (lock) => connected(() => base.releaseLock(lock)),
+		extendLock: (lock, ttlMs) => connected(() => base.extendLock(lock, ttlMs)),
+		forceReleaseLock: (threadId) => connected(() => base.forceReleaseLock(threadId)),
+		enqueue: (threadId, entry, maxSize) => connected(() => base.enqueue(threadId, entry, maxSize)),
+		dequeue: (threadId) => connected(() => base.dequeue(threadId)),
+		queueDepth: (threadId) => connected(() => base.queueDepth(threadId)),
+		get: (key) => connected(() => base.get(key)),
+		getList: (key) => connected(() => base.getList(key)),
+		set: (key, value, ttlMs) => connected(() => base.set(key, value, ttlMs)),
+		setIfNotExists: (key, value, ttlMs) => connected(() => base.setIfNotExists(key, value, ttlMs)),
+		delete: (key) => connected(() => base.delete(key))
+	};
+}
+function createPrefixedStateAdapter(base, prefix) {
+	const prefixed = (value) => `${prefix}:${value}`;
+	const unprefixed = (value) => value.startsWith(`${prefix}:`) ? value.slice(prefix.length + 1) : value;
+	const prefixLock = (lock) => ({
+		...lock,
+		threadId: prefixed(lock.threadId)
+	});
+	const unprefixLock = (lock) => ({
+		...lock,
+		threadId: unprefixed(lock.threadId)
+	});
+	return {
+		appendToList: (key, value, options) => base.appendToList(prefixed(key), value, options),
+		connect: () => base.connect(),
+		disconnect: () => base.disconnect(),
+		subscribe: (threadId) => base.subscribe(prefixed(threadId)),
+		unsubscribe: (threadId) => base.unsubscribe(prefixed(threadId)),
+		isSubscribed: (threadId) => base.isSubscribed(prefixed(threadId)),
+		acquireLock: async (threadId, ttlMs) => {
+			const lock = await base.acquireLock(prefixed(threadId), ttlMs);
+			return lock ? unprefixLock(lock) : null;
+		},
+		releaseLock: (lock) => base.releaseLock(prefixLock(lock)),
+		extendLock: async (lock, ttlMs) => {
+			const prefixedLock = prefixLock(lock);
+			const extended = await base.extendLock(prefixedLock, ttlMs);
+			if (extended) lock.expiresAt = prefixedLock.expiresAt;
+			return extended;
+		},
+		forceReleaseLock: (threadId) => base.forceReleaseLock(prefixed(threadId)),
+		enqueue: (threadId, entry, maxSize) => base.enqueue(prefixed(threadId), entry, maxSize),
+		dequeue: (threadId) => base.dequeue(prefixed(threadId)),
+		queueDepth: (threadId) => base.queueDepth(prefixed(threadId)),
+		get: (key) => base.get(prefixed(key)),
+		getList: (key) => base.getList(prefixed(key)),
+		set: (key, value, ttlMs) => base.set(prefixed(key), value, ttlMs),
+		setIfNotExists: (key, value, ttlMs) => base.setIfNotExists(prefixed(key), value, ttlMs),
+		delete: (key) => base.delete(prefixed(key))
+	};
+}
+function createQueuedStateAdapter(base, options) {
+	const heartbeats = /* @__PURE__ */ new Map();
+	const shouldHeartbeatLock = (ttlMs) => ttlMs === ACTIVE_LOCK_TTL_MS;
+	const heartbeatKey = (lock) => `${lock.threadId}:${lock.token}`;
+	const stopHeartbeatByKey = (key) => {
+		const heartbeat = heartbeats.get(key);
+		if (!heartbeat) return;
+		clearInterval(heartbeat.timer);
+		heartbeats.delete(key);
+	};
+	const stopHeartbeat = (lock) => {
+		stopHeartbeatByKey(heartbeatKey(lock));
+	};
+	const stopHeartbeatsForThread = (threadId) => {
+		for (const [key, heartbeat] of heartbeats) if (heartbeat.lock.threadId === threadId) stopHeartbeatByKey(key);
+	};
+	const stopAllHeartbeats = () => {
+		for (const key of heartbeats.keys()) stopHeartbeatByKey(key);
+	};
+	const runHeartbeat = async (key) => {
+		const heartbeat = heartbeats.get(key);
+		if (!heartbeat || heartbeat.inFlight) return;
+		heartbeat.inFlight = true;
+		try {
+			if (Date.now() - heartbeat.startedAtMs >= options.activeLockMaxAgeMs) {
+				stopHeartbeatByKey(key);
+				return;
+			}
+			if (!await base.extendLock(heartbeat.lock, heartbeat.ttlMs)) {
+				stopHeartbeatByKey(key);
+				return;
+			}
+			heartbeat.lock.expiresAt = Date.now() + heartbeat.ttlMs;
+		} catch {} finally {
+			const current = heartbeats.get(key);
+			if (current === heartbeat) current.inFlight = false;
+		}
+	};
+	const startOrUpdateHeartbeat = (lock, ttlMs) => {
+		const key = heartbeatKey(lock);
+		const existing = heartbeats.get(key);
+		if (existing) {
+			existing.ttlMs = ttlMs;
+			return;
+		}
+		const timer = setInterval(() => {
+			runHeartbeat(key);
+		}, ACTIVE_LOCK_HEARTBEAT_MS);
+		timer.unref?.();
+		heartbeats.set(key, {
+			inFlight: false,
+			lock,
+			startedAtMs: Date.now(),
+			timer,
+			ttlMs
+		});
+	};
+	const acquireLock = async (threadId, ttlMs) => {
+		const lock = await base.acquireLock(threadId, ttlMs);
+		if (lock && shouldHeartbeatLock(ttlMs)) startOrUpdateHeartbeat(lock, ttlMs);
+		return lock;
+	};
+	return {
+		appendToList: (key, value, options) => base.appendToList(key, value, options),
+		connect: () => base.connect(),
+		disconnect: async () => {
+			stopAllHeartbeats();
+			await base.disconnect();
+		},
+		subscribe: (threadId) => base.subscribe(threadId),
+		unsubscribe: (threadId) => base.unsubscribe(threadId),
+		isSubscribed: (threadId) => base.isSubscribed(threadId),
+		acquireLock,
+		releaseLock: async (lock) => {
+			stopHeartbeat(lock);
+			await base.releaseLock(lock);
+		},
+		extendLock: async (lock, ttlMs) => {
+			const extended = await base.extendLock(lock, ttlMs);
+			if (extended) {
+				lock.expiresAt = Date.now() + ttlMs;
+				if (shouldHeartbeatLock(ttlMs)) startOrUpdateHeartbeat(lock, ttlMs);
+				else stopHeartbeat(lock);
+			} else stopHeartbeat(lock);
+			return extended;
+		},
+		forceReleaseLock: async (threadId) => {
+			stopHeartbeatsForThread(threadId);
+			await base.forceReleaseLock(threadId);
+		},
+		enqueue: (threadId, entry, maxSize) => base.enqueue(threadId, entry, maxSize),
+		dequeue: (threadId) => base.dequeue(threadId),
+		queueDepth: (threadId) => base.queueDepth(threadId),
+		get: (key) => base.get(key),
+		getList: (key) => base.getList(key),
+		set: (key, value, ttlMs) => base.set(key, value, ttlMs),
+		setIfNotExists: (key, value, ttlMs) => base.setIfNotExists(key, value, ttlMs),
+		delete: (key) => base.delete(key)
+	};
+}
+function withOptionalPrefix(base, prefix) {
+	return prefix ? createPrefixedStateAdapter(base, prefix) : base;
+}
+function createStateAdapter() {
+	const config = getChatConfig();
+	const activeLockMaxAgeMs = config.bot.turnTimeoutMs + ACTIVE_LOCK_TTL_MS;
+	if (config.state.adapter === "memory") {
+		redisStateAdapter = void 0;
+		return createQueuedStateAdapter(createConnectingStateAdapter(withOptionalPrefix(createMemoryState(), config.state.keyPrefix)), { activeLockMaxAgeMs });
+	}
+	if (!config.state.redisUrl) throw new Error("REDIS_URL is required for durable Slack thread state");
+	const redisState = createRedisState({ url: config.state.redisUrl });
+	redisStateAdapter = redisState;
+	return createQueuedStateAdapter(createConnectingStateAdapter(withOptionalPrefix(redisState, config.state.keyPrefix)), { activeLockMaxAgeMs });
+}
+function getOptionalRedisStateAdapter() {
+	getStateAdapter();
+	return redisStateAdapter;
+}
+async function getConnectedStateContext() {
+	const adapter = getStateAdapter();
+	await adapter.connect();
+	return {
+		redisStateAdapter: getOptionalRedisStateAdapter(),
+		stateAdapter: adapter
+	};
+}
+/** Return the Redis adapter only when the caller is using the default state adapter. */
+async function getDefaultRedisStateAdapterFor(adapter) {
+	if (adapter !== stateAdapter) return;
+	const context = await getConnectedStateContext();
+	return context.stateAdapter === adapter ? context.redisStateAdapter : void 0;
+}
+function getStateAdapter() {
+	if (!stateAdapter) stateAdapter = createStateAdapter();
+	return stateAdapter;
+}
+async function disconnectStateAdapter() {
+	if (!stateAdapter) return;
+	try {
+		await stateAdapter.disconnect();
+	} finally {
+		stateAdapter = void 0;
+		redisStateAdapter = void 0;
+	}
+}
+//#endregion
+//#region src/chat/sandbox/noninteractive-command.ts
+const NON_INTERACTIVE_ENV = {
+	CI: "1",
+	TERM: "dumb",
+	NO_COLOR: "1",
+	PAGER: "cat",
+	GIT_PAGER: "cat",
+	GH_PROMPT_DISABLED: "1",
+	GH_NO_UPDATE_NOTIFIER: "1",
+	GH_NO_EXTENSION_UPDATE_NOTIFIER: "1",
+	GH_SPINNER_DISABLED: "1",
+	GIT_TERMINAL_PROMPT: "0",
+	GCM_INTERACTIVE: "never",
+	DEBIAN_FRONTEND: "noninteractive",
+	GIT_ASKPASS: "/bin/true",
+	GIT_CONFIG_NOSYSTEM: "1",
+	GIT_CONFIG_COUNT: "2",
+	GIT_CONFIG_KEY_0: "credential.helper",
+	GIT_CONFIG_VALUE_0: "",
+	GIT_CONFIG_KEY_1: "http.emptyAuth",
+	GIT_CONFIG_VALUE_1: "true"
+};
+function shellQuote(value) {
+	return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function buildEnvExports(options) {
+	const lines = [];
+	if (options.pathPrefix) lines.push(`export PATH="${options.pathPrefix}"`);
+	for (const [key, value] of Object.entries(NON_INTERACTIVE_ENV)) lines.push(`export ${key}=${shellQuote(value)}`);
+	for (const [key, value] of Object.entries(options.env ?? {})) lines.push(`export ${key}=${shellQuote(value)}`);
+	return lines;
+}
+/** Render one argv command as a safely quoted shell script. */
+function buildCommandScript(input) {
+	return [shellQuote(input.cmd), ...(input.args ?? []).map(shellQuote)].join(" ");
+}
+/** Build one shell entrypoint that never waits on terminal input. */
+function buildNonInteractiveShellScript(script, options = {}) {
+	return [
+		...buildEnvExports(options),
+		"exec </dev/null",
+		script
+	].join(" && ");
+}
+/** Wrap argv-style commands so every sandbox subprocess runs in non-interactive mode. */
+function buildNonInteractiveCommand(input) {
+	return {
+		cmd: "bash",
+		args: [input.login ? "-lc" : "-c", buildNonInteractiveShellScript(buildCommandScript(input), {
+			env: input.env,
+			pathPrefix: input.pathPrefix
+		})]
+	};
+}
+/** Run a subprocess through one enforced non-interactive entrypoint. */
+async function runNonInteractiveCommand(sandbox, input) {
+	const command = {
+		...buildNonInteractiveCommand(input),
+		...input.cwd ? { cwd: input.cwd } : void 0,
+		...input.signal ? { signal: input.signal } : void 0,
+		...input.sudo !== void 0 ? { sudo: input.sudo } : void 0,
+		...input.timeoutMs !== void 0 ? { timeoutMs: input.timeoutMs } : void 0
+	};
+	return await sandbox.runCommand(command);
+}
+//#endregion
+//#region src/chat/sandbox/credentials.ts
+/**
+* Resolve explicit Vercel Sandbox credentials, or return undefined to let
+* the SDK read ambient Vercel auth from its own environment detection.
+*/
+function getVercelSandboxCredentials() {
+	const token = toOptionalTrimmed(process.env.VERCEL_TOKEN);
+	const teamId = toOptionalTrimmed(process.env.VERCEL_TEAM_ID);
+	const projectId = toOptionalTrimmed(process.env.VERCEL_PROJECT_ID);
+	if (token && teamId && projectId) return {
+		token,
+		teamId,
+		projectId
+	};
+}
+//#endregion
+//#region src/chat/sandbox/http-error-details.ts
+const DEFAULT_PREVIEW_LIMIT = 512;
+function toTrimmedString(value, maxChars) {
+	if (typeof value !== "string") return;
+	const normalized = value.trim();
+	if (!normalized) return;
+	return normalized.length > maxChars ? `${normalized.slice(0, maxChars)}…` : normalized;
+}
+/** Extract structured HTTP error metadata (status, headers, body preview) for logging. */
+function extractHttpErrorDetails(error, options = {}) {
+	const prefix = options.attributePrefix ?? "app.http_error";
+	const previewLimit = options.previewLimit ?? DEFAULT_PREVIEW_LIMIT;
+	const normalizedError = error instanceof Error ? error : new Error(String(error));
+	const err = error ?? {};
+	const attributes = {
+		"error.type": normalizedError.name || "Error",
+		"exception.message": toTrimmedString(normalizedError.message, previewLimit) ?? "HTTP error"
+	};
+	const response = err.response;
+	const statusCode = typeof response?.status === "number" ? response.status : void 0;
+	const statusText = toTrimmedString(response?.statusText, previewLimit);
+	const responseUrl = toTrimmedString(response?.url, previewLimit);
+	const responseText = toTrimmedString(err.text, previewLimit);
+	const responseJson = toTrimmedString(err.json && typeof err.json === "object" ? JSON.stringify(err.json) : void 0, previewLimit);
+	const contentType = toTrimmedString(response?.headers?.get?.("content-type"), previewLimit);
+	const requestIdHeader = toTrimmedString(response?.headers?.get?.("x-request-id"), previewLimit);
+	const vercelIdHeader = toTrimmedString(response?.headers?.get?.("x-vercel-id"), previewLimit);
+	const requestId = requestIdHeader ?? vercelIdHeader;
+	if (statusCode !== void 0) attributes["http.response.status_code"] = statusCode;
+	if (statusText) attributes[`${prefix}.status_text`] = statusText;
+	if (responseUrl) attributes["url.full"] = responseUrl;
+	if (contentType) attributes["http.response.header.content-type"] = [contentType];
+	if (requestIdHeader) attributes["http.response.header.x-request-id"] = [requestIdHeader];
+	if (vercelIdHeader) attributes["http.response.header.x-vercel-id"] = [vercelIdHeader];
+	if (responseText) {
+		attributes[`${prefix}.response_text_preview`] = responseText;
+		attributes[`${prefix}.response_text_length`] = responseText.length;
+	}
+	if (responseJson) attributes[`${prefix}.response_json_preview`] = responseJson;
+	const summaryParts = [];
+	if (statusCode !== void 0) summaryParts.push(`status=${statusCode}`);
+	if (statusText) summaryParts.push(`statusText=${statusText}`);
+	if (responseUrl) summaryParts.push(`url=${responseUrl}`);
+	if (requestId) summaryParts.push(`requestId=${requestId}`);
+	for (const field of options.extraFields ?? []) {
+		const value = toTrimmedString(err[field.sourceKey], previewLimit);
+		if (!value) continue;
+		attributes[`${prefix}.${field.attributeKey}`] = value;
+		summaryParts.push(`${field.summaryKey ?? field.attributeKey}=${value}`);
+	}
+	if (responseJson) summaryParts.push(`json=${responseJson}`);
+	else if (responseText) summaryParts.push(`text=${responseText}`);
+	const searchableText = `${normalizedError.message} ${responseText ?? ""} ${responseJson ?? ""}`.toLowerCase();
+	return {
+		attributes,
+		summary: summaryParts.join(", "),
+		searchableText
+	};
+}
+//#endregion
+//#region src/chat/sandbox/snapshot/not-ready-error.ts
+/** Report that a Workspace snapshot is not ready to use. */
+var WorkspaceSnapshotNotReadyError = class extends Error {
+	workspaceName;
+	constructor(workspaceName) {
+		super(`Workspace ${workspaceName} snapshot is not ready`);
+		this.name = "WorkspaceSnapshotNotReadyError";
+		this.workspaceName = workspaceName;
+	}
+};
+/** Return WorkspaceSnapshotNotReadyError from this error or its causes. */
+function getWorkspaceSnapshotNotReadyError(error) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	while (current instanceof Error && !seen.has(current)) {
+		if (current instanceof WorkspaceSnapshotNotReadyError) return current;
+		seen.add(current);
+		current = current.cause;
+	}
+}
+/** True when this error or a cause is WorkspaceSnapshotNotReadyError. */
+function isWorkspaceSnapshotNotReadyError(error) {
+	return getWorkspaceSnapshotNotReadyError(error) !== void 0;
+}
+/** User message when a Workspace sandbox is still preparing. */
+function workspaceSnapshotNotReadyUserMessage(error) {
+	return `The ${error.workspaceName} workspace is still preparing its sandbox. Wait for that preparation to finish, then try again.`;
+}
+//#endregion
+//#region src/chat/sandbox/errors.ts
+const SANDBOX_ERROR_FIELDS = [{
+	sourceKey: "sandboxId",
+	attributeKey: "sandbox_id",
+	summaryKey: "sandboxId"
+}];
+function getSandboxErrorDetails(error) {
+	return extractHttpErrorDetails(error, {
+		attributePrefix: "app.sandbox.api_error",
+		extraFields: [...SANDBOX_ERROR_FIELDS]
+	});
+}
+function findInErrorChain(error, predicate) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	while (current && !seen.has(current)) {
+		if (predicate(current)) return true;
+		seen.add(current);
+		current = typeof current === "object" ? current.cause : void 0;
+	}
+	return false;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+function isInvalidSandboxSessionError(error) {
+	if (!isRecord(error)) return false;
+	if (isRecord(error.json) && error.json.invalidToken === true) return true;
+	const response = error.response;
+	return isRecord(response) && response.status === 403 && typeof response.url === "string" && response.url.includes("/sandboxes/sessions");
+}
+function getFirstErrorMessage(error) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	while (current && !seen.has(current)) {
+		if (current instanceof Error) {
+			const message = current.message.trim();
+			if (message) return message;
+		}
+		seen.add(current);
+		current = typeof current === "object" ? current.cause : void 0;
+	}
+}
+/** Detect sandbox filesystem operations that can safely ignore existing directories. */
+function isAlreadyExistsError(error) {
+	const details = getSandboxErrorDetails(error);
+	return details.searchableText.includes("already exists") || details.searchableText.includes("file exists") || details.searchableText.includes("eexist");
+}
+/** Detect when the current sandbox session is unavailable and must be reacquired. */
+function isSandboxUnavailableError(error) {
+	return findInErrorChain(error, (candidate) => {
+		if (isInvalidSandboxSessionError(candidate)) return true;
+		const details = getSandboxErrorDetails(candidate);
+		const searchable = `${details.searchableText} ${details.summary}`.toLowerCase();
+		return searchable.includes("sandbox_stopped") || searchable.includes("status=410") || searchable.includes("status code 410") || searchable.includes("no longer available") || searchable.includes("stream was closed and is not accepting commands");
+	});
+}
+/** Detect a durable sandbox reference that can no longer be restored. */
+function isSandboxMissingError(error) {
+	return findInErrorChain(error, (candidate) => {
+		const details = getSandboxErrorDetails(candidate);
+		const searchable = `${details.searchableText} ${details.summary}`.toLowerCase();
+		return searchable.includes("status=404") || searchable.includes("status code 404") || searchable.includes("snapshot_not_found");
+	});
+}
+/** Detect transient snapshot boot races so sandbox creation can retry. */
+function isSnapshottingError(error) {
+	return findInErrorChain(error, (candidate) => {
+		const details = getSandboxErrorDetails(candidate);
+		const searchable = `${details.searchableText} ${details.summary}`.toLowerCase();
+		return searchable.includes("sandbox_snapshotting") || searchable.includes("creating a snapshot") || searchable.includes("stopped shortly");
+	});
+}
+/** Detect cancellation so a durable builder stays available for check-in. */
+function isAbortError(error) {
+	return findInErrorChain(error, (candidate) => {
+		if (typeof DOMException !== "undefined" && candidate instanceof DOMException) return candidate.name === "AbortError";
+		if (!(candidate instanceof Error)) return false;
+		if (candidate.name === "AbortError") return true;
+		return candidate.message.toLowerCase().startsWith("executeagentrun timed out after");
+	});
+}
+/** Detect transient Vercel Sandbox API failures that keep a job resumable. */
+function isSandboxApiTransientError(error) {
+	return findInErrorChain(error, (candidate) => {
+		const details = getSandboxErrorDetails(candidate);
+		const searchable = `${details.searchableText} ${details.summary}`.toLowerCase();
+		if (searchable.includes("internal_server_error") || searchable.includes("status=500") || searchable.includes("status code 500") || searchable.includes("status=502") || searchable.includes("status code 502") || searchable.includes("status=503") || searchable.includes("status code 503") || searchable.includes("status=504") || searchable.includes("status code 504")) return true;
+		if (!isRecord(candidate)) return false;
+		const response = candidate.response;
+		return isRecord(response) && typeof response.status === "number" && response.status >= 500 && response.status < 600;
+	});
+}
+/** Detect interrupted command streams where no reliable exit status is available. */
+function isSandboxCommandStreamInterruptedError(error) {
+	return findInErrorChain(error, (candidate) => {
+		if (!(candidate instanceof Error)) return false;
+		return candidate.name === "StreamError" && candidate.message.toLowerCase().includes("stream ended before command finished");
+	});
+}
+/** Wrap setup failures. Keep WorkspaceSnapshotNotReadyError as-is. */
+function wrapSandboxSetupError(error) {
+	const notReady = getWorkspaceSnapshotNotReadyError(error);
+	if (notReady) return notReady;
+	try {
+		const details = getSandboxErrorDetails(error);
+		if (details.summary) return new Error(`sandbox setup failed (${details.summary})`, { cause: error });
+	} catch {}
+	let causeMessage;
+	try {
+		causeMessage = getFirstErrorMessage(error);
+	} catch (cause) {
+		causeMessage = cause instanceof Error ? cause.message : void 0;
+	}
+	if (causeMessage && causeMessage.trim() && causeMessage !== "sandbox setup failed") {
+		const oneLine = causeMessage.replace(/\s+/g, " ").trim();
+		return new Error(`sandbox setup failed (${oneLine})`, { cause: error });
+	}
+	return new Error("sandbox setup failed", { cause: error });
+}
+/** Record span data and throw one stable sandbox operation error. */
+function throwSandboxOperationError(action, error, includeMissingPath = false) {
+	const details = getSandboxErrorDetails(error);
+	setSpanAttributes({
+		...details.attributes,
+		...includeMissingPath ? { "app.sandbox.api_error.missing_path": details.searchableText.includes("no such file") || details.searchableText.includes("enoent") } : void 0,
+		"app.sandbox.success": false
+	});
+	setSpanStatus("error");
+	throw new Error(details.summary ? `${action} failed (${details.summary})` : `${action} failed`, { cause: error });
+}
+//#endregion
+//#region src/chat/sandbox/docker.ts
+/** Docker daemon config for Vercel sandbox guests (nested containers). */
+const DOCKER_DAEMON_JSON = `{
+  "storage-driver": "overlay2",
+  "live-restore": false
+}
+`;
+/**
+* Start dockerd when the socket is missing and wait until `docker info` works.
+* Re-execs through sudo so the sandbox user can call it without root.
+*/
+const DOCKER_ENSURE_SCRIPT = `#!/bin/sh
+set -eu
+
+if [ "$(id -u)" -ne 0 ]; then
+  exec sudo -n "$0" "$@"
+fi
+
+SOCK=/var/run/docker.sock
+PIDFILE=/var/run/docker.pid
+LOG=/var/log/junior-dockerd.log
+
+is_ready() {
+  [ -S "$SOCK" ] && /usr/bin/docker info >/dev/null 2>&1
+}
+
+if is_ready; then
+  chmod 666 "$SOCK" 2>/dev/null || true
+  exit 0
+fi
+
+mkdir -p /etc/docker /var/lib/docker /var/run /var/log
+if [ ! -f /etc/docker/daemon.json ]; then
+  cat > /etc/docker/daemon.json <<'EOF'
+{
+  "storage-driver": "overlay2",
+  "live-restore": false
+}
+EOF
+fi
+
+if [ -f "$PIDFILE" ]; then
+  oldpid="$(cat "$PIDFILE" 2>/dev/null || true)"
+  if [ -n "\${oldpid:-}" ] && ! kill -0 "$oldpid" 2>/dev/null; then
+    rm -f "$PIDFILE"
+  fi
+fi
+
+if [ ! -f "$PIDFILE" ] || ! kill -0 "$(cat "$PIDFILE" 2>/dev/null)" 2>/dev/null; then
+  # dockerd must outlive this helper; nohup + background is intentional.
+  nohup dockerd --host="unix://$SOCK" --pidfile="$PIDFILE" >"$LOG" 2>&1 &
+fi
+
+i=0
+while [ "$i" -lt 50 ]; do
+  if is_ready; then
+    chmod 666 "$SOCK" 2>/dev/null || true
+    exit 0
+  fi
+  i=$((i + 1))
+  sleep 0.1
+done
+
+echo "junior-ensure-docker: dockerd failed to become ready" >&2
+if [ -f "$LOG" ]; then
+  tail -n 50 "$LOG" >&2 || true
+fi
+exit 1
+`;
+/** PATH wrapper so plain `docker` starts the daemon on first use. */
+const DOCKER_CLI_WRAPPER_SCRIPT = `#!/bin/sh
+set -eu
+if command -v junior-ensure-docker >/dev/null 2>&1; then
+  junior-ensure-docker
+fi
+exec /usr/bin/docker "$@"
+`;
+/** PATH wrapper so plain `docker-compose` starts the daemon on first use. */
+const DOCKER_COMPOSE_CLI_WRAPPER_SCRIPT = `#!/bin/sh
+set -eu
+if command -v junior-ensure-docker >/dev/null 2>&1; then
+  junior-ensure-docker
+fi
+exec /usr/local/libexec/junior-docker-compose "$@"
+`;
+/**
+* Best-effort dockerd start during sandbox prepare.
+* Missing helper is a no-op so tests and base sandboxes stay green.
+*/
+async function ensureDockerDaemon(sandbox, signal) {
+	await runNonInteractiveCommand(sandbox, {
+		cmd: "sh",
+		args: ["-c", "command -v junior-ensure-docker >/dev/null 2>&1 && junior-ensure-docker || true"],
+		signal
+	});
+}
+//#endregion
+//#region src/chat/sandbox/runtime-dependencies.ts
+const GLOBAL_RUNTIME_DEPENDENCIES = [
+	{
+		type: "system",
+		package: "docker"
+	},
+	{
+		type: "system",
+		package: "spal-release"
+	},
+	{
+		type: "system",
+		package: "ripgrep"
+	}
+];
+function writeFileCommand(path, contents, mode = "0644") {
+	return [`printf '%s' '${Buffer.from(contents, "utf8").toString("base64")}' | base64 -d > ${path}`, `chmod ${mode} ${path}`].join("\n");
+}
+function writeExecutableCommand(path, contents) {
+	return writeFileCommand(path, contents, "0755");
+}
+const GLOBAL_RUNTIME_POSTINSTALL = [{
+	cmd: "sh",
+	args: ["-c", [
+		"set -eu",
+		"case \"$(uname -m)\" in",
+		"  x86_64) asset=\"x86_64\"; sha256=\"7af95166a730b87e172d4fc9aefea8725d3c6c7327d59149267b452114ddb7d4\" ;;",
+		"  aarch64) asset=\"aarch64\"; sha256=\"49082844b87f03cdcd5f5bbef1ba8c9c897b7a2dfb80cea18d61ec8ca6117e0c\" ;;",
+		"  *) echo \"unsupported Docker Compose architecture: $(uname -m)\" >&2; exit 1 ;;",
+		"esac",
+		"tmp=\"$(mktemp)\"",
+		"trap 'rm -f \"$tmp\"' EXIT",
+		"curl --fail --location --silent --show-error \"https://github.com/docker/compose/releases/download/v2.39.4/docker-compose-linux-${asset}\" --output \"$tmp\"",
+		"echo \"${sha256}  ${tmp}\" | sha256sum --check --status",
+		"install -D -m 0755 \"$tmp\" /usr/local/libexec/junior-docker-compose",
+		"mkdir -p /usr/local/lib/docker/cli-plugins /usr/local/libexec /etc/docker /usr/local/bin",
+		`mkdir -p ${SANDBOX_WORKSPACE_ROOT}/.junior/bin`,
+		writeFileCommand("/etc/docker/daemon.json", DOCKER_DAEMON_JSON),
+		writeExecutableCommand("/usr/local/bin/junior-ensure-docker", DOCKER_ENSURE_SCRIPT),
+		"ln -sfn /usr/local/libexec/junior-docker-compose /usr/local/lib/docker/cli-plugins/docker-compose",
+		writeExecutableCommand("/usr/local/bin/docker-compose", DOCKER_COMPOSE_CLI_WRAPPER_SCRIPT),
+		writeExecutableCommand(`${SANDBOX_WORKSPACE_ROOT}/.junior/bin/docker`, DOCKER_CLI_WRAPPER_SCRIPT),
+		writeExecutableCommand(`${SANDBOX_WORKSPACE_ROOT}/.junior/bin/docker-compose`, DOCKER_COMPOSE_CLI_WRAPPER_SCRIPT),
+		writeExecutableCommand("/usr/local/bin/docker", DOCKER_CLI_WRAPPER_SCRIPT)
+	].join("\n")],
+	sudo: true
+}];
+//#endregion
+//#region src/chat/sandbox/snapshot/profile.ts
+const VERSION = 1;
+const DEFAULT_FLOATING_MAX_AGE_MS = 6048e5;
+function isExactNpmVersion(version) {
+	return /^\d+\.\d+\.\d+(?:[-+][a-z0-9.]+)?$/i.test(version.trim());
+}
+function isFloating(dep) {
+	return dep.type === "npm" && !isExactNpmVersion(dep.version);
+}
+/**
+* Merge dependencies for one global install, rejecting competing npm versions.
+*/
+function mergeDependencies(dependencies) {
+	const seen = /* @__PURE__ */ new Set();
+	const npmVersions = /* @__PURE__ */ new Map();
+	const merged = [];
+	for (const dependency of dependencies) {
+		const key = dependency.type === "npm" ? `${dependency.type}:${dependency.package}:${dependency.version}` : "package" in dependency ? `${dependency.type}:package:${dependency.package}` : `${dependency.type}:url:${dependency.url}:${dependency.sha256}`;
+		if (seen.has(key)) continue;
+		seen.add(key);
+		if (dependency.type === "npm") {
+			const version = npmVersions.get(dependency.package);
+			if (version !== void 0 && version !== dependency.version) throw new Error(`Conflicting runtime dependency versions for ${dependency.package}: ${version} and ${dependency.version}`);
+			npmVersions.set(dependency.package, dependency.version);
+		}
+		merged.push(dependency);
+	}
+	return merged;
+}
+function floatingMaxAgeMs() {
+	const raw = process.env.SANDBOX_SNAPSHOT_FLOATING_MAX_AGE_MS;
+	if (!raw?.trim()) return DEFAULT_FLOATING_MAX_AGE_MS;
+	const parsed = Number.parseInt(raw, 10);
+	return Number.isFinite(parsed) && parsed >= 0 ? parsed : DEFAULT_FLOATING_MAX_AGE_MS;
+}
+/** Locale-independent string order for stable profile hashes. */
+function compareCodePoints(left, right) {
+	if (left < right) return -1;
+	if (left > right) return 1;
+	return 0;
+}
+function workspaceRecipe(workspace) {
+	const repos = [...workspace.repos].map(({ provider, repo }) => ({
+		provider,
+		repo
+	})).sort((left, right) => {
+		const provider = compareCodePoints(left.provider, right.provider);
+		if (provider !== 0) return provider;
+		return compareCodePoints(left.repo, right.repo);
+	});
+	return {
+		id: workspace.id,
+		repos,
+		setupScript: workspace.setupScript
+	};
+}
+/** Build the complete profile that selects one reusable sandbox snapshot. */
+function create(runtime, workspace) {
+	const dependencies = mergeDependencies([...GLOBAL_RUNTIME_DEPENDENCIES, ...pluginCatalogRuntime.getRuntimeDependencies()]);
+	const pluginPostinstall = pluginCatalogRuntime.getRuntimePostinstall();
+	const postinstall = [...GLOBAL_RUNTIME_POSTINSTALL, ...pluginPostinstall];
+	if (dependencies.length === 0 && postinstall.length === 0 && !workspace) return null;
+	const rebuildEpoch = process.env.SANDBOX_SNAPSHOT_REBUILD_EPOCH?.trim() ?? "";
+	const floating = dependencies.some((dependency) => isFloating(dependency)) || pluginPostinstall.length > 0 || Boolean(workspace);
+	return {
+		hash: createHash("sha256").update(JSON.stringify({
+			version: VERSION,
+			runtime,
+			rebuildEpoch,
+			dependencies,
+			postinstall,
+			...workspace ? { workspace: workspaceRecipe(workspace) } : void 0
+		})).digest("hex"),
+		dependencyCount: dependencies.length,
+		floating,
+		dependencies,
+		postinstall
+	};
+}
+/** Return the current dependency profile hash without building its snapshot. */
+function hash(runtime, workspace) {
+	return create(runtime, workspace)?.hash;
+}
+/** Decide whether a cached snapshot has outlived a floating profile. */
+function isStale(profile, createdAtMs) {
+	if (!profile.floating) return false;
+	const maxAgeMs = floatingMaxAgeMs();
+	return maxAgeMs === 0 || Date.now() - createdAtMs > maxAgeMs;
+}
+//#endregion
+export { sleep as A, getDefaultRedisStateAdapterFor as C, fenceLock as D, acquireActiveLock as E, sandboxSkillDir as F, sandboxSkillFile as I, sandboxSkillPathResolution as L, SANDBOX_REPOS_ROOT as M, SANDBOX_SKILLS_ROOT as N, withActiveLock as O, SANDBOX_WORKSPACE_ROOT as P, disconnectStateAdapter as S, MUTATION_LOCK_TTL_MS as T, workspaceSnapshotNotReadyUserMessage as _, isAbortError as a, buildNonInteractiveShellScript as b, isSandboxCommandStreamInterruptedError as c, isSnapshottingError as d, throwSandboxOperationError as f, isWorkspaceSnapshotNotReadyError as g, getWorkspaceSnapshotNotReadyError as h, ensureDockerDaemon as i, SANDBOX_DATA_ROOT as j, withLock as k, isSandboxMissingError as l, WorkspaceSnapshotNotReadyError as m, hash as n, isAlreadyExistsError as o, wrapSandboxSetupError as p, isStale as r, isSandboxApiTransientError as s, create as t, isSandboxUnavailableError as u, getVercelSandboxCredentials as v, getStateAdapter as w, runNonInteractiveCommand as x, buildCommandScript as y };