@sentry/junior 0.217.0 → 0.219.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (56) hide show
  1. package/dist/{agent-CV4MPfCD.js → agent-DFeJ0yVy.js} +119 -33
  2. package/dist/{agent-hooks-BtGATjr2.js → agent-hooks-CKaIOT4I.js} +6 -6
  3. package/dist/{agent-runner-DCj_cPjl.js → agent-runner-DifJddqY.js} +5 -5
  4. package/dist/api.js +15 -15
  5. package/dist/{app-D4nNdzPG.d.ts → app-BYD2Nyji.d.ts} +1 -1
  6. package/dist/app.d.ts +2 -2
  7. package/dist/app.js +29 -29
  8. package/dist/{auth-pause-state-C7GMUpb9.js → auth-pause-state-nAyuKldT.js} +6 -6
  9. package/dist/{briefs-eG5Jo1xa.js → briefs-D2iu2JPg.js} +2 -2
  10. package/dist/{catalog-runtime-LUAIHslF.js → catalog-runtime-v3x4peOv.js} +1 -1
  11. package/dist/{checkpoint-CmkbGGiR.js → checkpoint-Cc7ba7dw.js} +6 -6
  12. package/dist/cli/chat.d.ts +1 -1
  13. package/dist/cli/chat.js +13 -13
  14. package/dist/cli/check.js +3 -3
  15. package/dist/cli/main.js +1 -1
  16. package/dist/cli/plugins.d.ts +1 -1
  17. package/dist/cli/plugins.js +3 -3
  18. package/dist/cli/snapshot-create.js +3 -3
  19. package/dist/cli/upgrade.d.ts +1 -1
  20. package/dist/cli/upgrade.js +3 -3
  21. package/dist/{client-ciJRmcY5.js → client-DVKLZG01.js} +2 -2
  22. package/dist/{config-BMwzCmw-.js → config-BXIOxlCK.js} +2 -2
  23. package/dist/{conversation-privacy-CLkpzAlt.js → conversation-privacy-8-WR4KBo.js} +1 -1
  24. package/dist/{credential-sync-BoWHpDBP.js → credential-sync-BOcckr3l.js} +20 -20
  25. package/dist/{execution-stats-C-E5FIsT.js → execution-stats-G61-pwq6.js} +3 -3
  26. package/dist/{executor-D0xETqi8.js → executor-D_aAfzGp.js} +1 -1
  27. package/dist/instrumentation.js +2 -2
  28. package/dist/{job-queue-C8FZ3LSY.js → job-queue-DjgMEeqJ.js} +1 -1
  29. package/dist/{logging-CHZ0aJXO.js → logging-1iHJtqBM.js} +1 -1
  30. package/dist/nitro.d.ts +2 -2
  31. package/dist/nitro.js +3 -3
  32. package/dist/{oauth-callback-server-D2JPUvY4.js → oauth-callback-server-wwYSbTaU.js} +2 -2
  33. package/dist/{pending-auth-HNSPyxoN.js → pending-auth-B2qOCIx1.js} +2 -2
  34. package/dist/{plugins-BI9A1vKA.d.ts → plugins-BT2l4We3.d.ts} +2 -1
  35. package/dist/{profile-6veboDue.js → profile-B4e6XN37.js} +4 -4
  36. package/dist/{registry-DR6TJe4J.js → registry-C0DT9wqc.js} +62 -18
  37. package/dist/{resolve-DprAzyQN.js → resolve-DugfbPdI.js} +2 -2
  38. package/dist/{runner-CV9Wahh9.js → runner-RE9Lp-M8.js} +9 -9
  39. package/dist/{sandbox-egress-signals-BpRsWlQP.js → sandbox-egress-signals-BqkV7azF.js} +1 -1
  40. package/dist/{short-title-XUBD7AYC.js → short-title-C7tWtQQy.js} +2 -2
  41. package/dist/{skills-DeUBvhdn.js → skills-B6OcxCOp.js} +2 -2
  42. package/dist/{spawn-BFzlrZae.js → spawn-BmZvmNYc.js} +2 -2
  43. package/dist/{stats-BvNqVRdB.js → stats-BtMLD1n8.js} +5 -5
  44. package/dist/{task-queue-CbxNVEAg.js → task-queue-a2aXjkx2.js} +3 -3
  45. package/dist/{task-runner-BH5M3JHb.js → task-runner-Bg2trvKT.js} +7 -7
  46. package/dist/{thread-state-Db98GdYL.js → thread-state-D4zlHEq1.js} +5 -5
  47. package/dist/{turn-execution-mZIWtngI.js → turn-execution-CgCTt4YP.js} +3 -3
  48. package/dist/{turn-lifecycle-CNsgouon.js → turn-lifecycle-ClF1kY55.js} +1 -1
  49. package/dist/{validation-Dy7SUhLv.js → validation-CGkLLzS9.js} +1 -1
  50. package/dist/{version-Es4nurl1.js → version-CZfM8Kly.js} +1 -1
  51. package/dist/version.js +1 -1
  52. package/dist/{web-authorization-DG2K_bpi.js → web-authorization-DCSwmiua.js} +1 -1
  53. package/dist/{web-input-CZjYeCFh.js → web-input-CQrFGEv9.js} +4 -4
  54. package/dist/{work-DTqDMGeD.js → work-lRFwhKJe.js} +9 -9
  55. package/dist/{worker-BvuVxS4T.js → worker-BV4FekSX.js} +5 -5
  56. package/package.json +4 -4
@@ -1,11 +1,11 @@
1
- import { i as completeText, m as escapeXml, o as resolveGatewayModel, p as unwrapCurrentInstruction } from "./client-ciJRmcY5.js";
2
- import { _ as setSpanAttributes, f as logWarn, o as getActiveTraceId, t as buildTurnFailureResponse, u as logException } from "./logging-CHZ0aJXO.js";
3
- import { n as botConfig } from "./config-BMwzCmw-.js";
1
+ import { i as completeText, m as escapeXml, o as resolveGatewayModel, p as unwrapCurrentInstruction } from "./client-DVKLZG01.js";
2
+ import { _ as setSpanAttributes, f as logWarn, o as getActiveTraceId, t as buildTurnFailureResponse, u as logException } from "./logging-1iHJtqBM.js";
3
+ import { n as botConfig } from "./config-BXIOxlCK.js";
4
4
  import { _ as parseSlackMessageTs, f as toStoredSlackActor } from "./context-Bplcgypl.js";
5
- import { Bt as authenticationUnlinkedEvent, Ht as getConversationEventStore, Jt as withConversationEventLock, Kt as getSqlExecutor, Lt as JUNIOR_NATIVE_EVENT_NAMESPACE, Qt as bindProviderConversation, Rt as agentsInstructionsUpdatedEvent, Wt as getConversationStore, Yt as sanitizePostgresJson, en as addAgentTurnUsage, qt as createSqlConversationEventStore, zt as authenticationLinkedEvent } from "./agent-hooks-BtGATjr2.js";
5
+ import { Bt as authenticationUnlinkedEvent, Ht as getConversationEventStore, Jt as withConversationEventLock, Kt as getSqlExecutor, Lt as JUNIOR_NATIVE_EVENT_NAMESPACE, Qt as bindProviderConversation, Rt as agentsInstructionsUpdatedEvent, Wt as getConversationStore, Yt as sanitizePostgresJson, en as addAgentTurnUsage, qt as createSqlConversationEventStore, zt as authenticationLinkedEvent } from "./agent-hooks-CKaIOT4I.js";
6
6
  import { F as agentHistoryItemSchema, H as contextProvenance, U as instructionActors, W as instructionProvenanceFor } from "./conversation-BpqLg4MM.js";
7
- import { n as generateShortTitle, t as fallbackShortTitle } from "./short-title-XUBD7AYC.js";
8
- import { A as sleep, D as fenceLock, T as MUTATION_LOCK_TTL_MS, k as withLock, w as getStateAdapter } from "./profile-6veboDue.js";
7
+ import { n as generateShortTitle, t as fallbackShortTitle } from "./short-title-C7tWtQQy.js";
8
+ import { A as sleep, D as fenceLock, T as MUTATION_LOCK_TTL_MS, k as withLock, w as getStateAdapter } from "./profile-B4e6XN37.js";
9
9
  import { isDeepStrictEqual } from "node:util";
10
10
  import { z } from "zod";
11
11
  import { createHash } from "node:crypto";
@@ -1,4 +1,4 @@
1
- import { n as JuniorPluginSet } from "../plugins-BI9A1vKA.js";
1
+ import { n as JuniorPluginSet } from "../plugins-BT2l4We3.js";
2
2
  //#region src/cli/chat.d.ts
3
3
  export declare const CHAT_USAGE = "usage: junior chat\n junior chat -p <message>";
4
4
  export type ChatCommandOptions = {
package/dist/cli/chat.js CHANGED
@@ -1,5 +1,5 @@
1
- import { t as executeAgentRun } from "../agent-CV4MPfCD.js";
2
- import { t as createAgentRunner } from "../agent-runner-DCj_cPjl.js";
1
+ import { t as executeAgentRun } from "../agent-DFeJ0yVy.js";
2
+ import { t as createAgentRunner } from "../agent-runner-DifJddqY.js";
3
3
  import { t as loadAppPluginSet } from "../plugin-module-BKGOXca2.js";
4
4
  import path from "node:path";
5
5
  import { createHash, randomUUID } from "node:crypto";
@@ -101,10 +101,10 @@ async function loadLocalPluginSet() {
101
101
  async function configureLocalChatPlugins(pluginSet) {
102
102
  const [pluginsModule, agentHooksModule, catalogRuntimeModule, validationModule, databaseModule] = await Promise.all([
103
103
  import("../plugins-egKWjgue.js").then((n) => n.o),
104
- import("../agent-hooks-BtGATjr2.js").then((n) => n.t),
105
- import("../catalog-runtime-LUAIHslF.js").then((n) => n.t),
106
- import("../validation-Dy7SUhLv.js").then((n) => n.r),
107
- import("../agent-hooks-BtGATjr2.js").then((n) => n.Vt)
104
+ import("../agent-hooks-CKaIOT4I.js").then((n) => n.t),
105
+ import("../catalog-runtime-v3x4peOv.js").then((n) => n.t),
106
+ import("../validation-CGkLLzS9.js").then((n) => n.r),
107
+ import("../agent-hooks-CKaIOT4I.js").then((n) => n.Vt)
108
108
  ]);
109
109
  const resolvedPluginSet = pluginSet === void 0 ? await loadLocalPluginSet() : pluginSet ?? void 0;
110
110
  const plugins = pluginsModule.pluginRuntimeRegistrationsFromPluginSet(resolvedPluginSet);
@@ -156,16 +156,16 @@ async function prepareLocalChatRun(io, pluginSet) {
156
156
  await configureLocalChatPlugins(pluginSet);
157
157
  const { setExperimentalFeatures } = await import("../experimental-CIXf7Uye.js").then((n) => n.t);
158
158
  setExperimentalFeatures({ subagents: true });
159
- const { setBriefsConfig } = await import("../agent-hooks-BtGATjr2.js").then((n) => n.m);
159
+ const { setBriefsConfig } = await import("../agent-hooks-CKaIOT4I.js").then((n) => n.m);
160
160
  setBriefsConfig({ enabled: true });
161
- const { runLocalAgentTurn } = await import("../runner-CV9Wahh9.js");
162
- const { startLocalOAuthCallbackServer } = await import("../oauth-callback-server-D2JPUvY4.js");
161
+ const { runLocalAgentTurn } = await import("../runner-RE9Lp-M8.js");
162
+ const { startLocalOAuthCallbackServer } = await import("../oauth-callback-server-wwYSbTaU.js");
163
163
  const { createLocalOAuthState } = await import("../oauth-relay-CdCnu80W.js").then((n) => n.t);
164
- const { createLocalSandboxEgressSignalTransport } = await import("../sandbox-egress-signals-BpRsWlQP.js");
165
- const { bindSpawnAgent } = await import("../spawn-BFzlrZae.js").then((n) => n.n);
166
- const { createAgentInvocationWorker, routeAgentInvocationWork } = await import("../work-DTqDMGeD.js").then((n) => n.a);
164
+ const { createLocalSandboxEgressSignalTransport } = await import("../sandbox-egress-signals-BqkV7azF.js");
165
+ const { bindSpawnAgent } = await import("../spawn-BmZvmNYc.js").then((n) => n.n);
166
+ const { createAgentInvocationWorker, routeAgentInvocationWork } = await import("../work-lRFwhKJe.js").then((n) => n.a);
167
167
  const { createLocalConversationWork } = await import("../conversation-work-C6y3T5Hx.js");
168
- const { processConversationWork } = await import("../worker-BvuVxS4T.js").then((n) => n.n);
168
+ const { processConversationWork } = await import("../worker-BV4FekSX.js").then((n) => n.n);
169
169
  let agentRunner;
170
170
  const localConversationWork = createLocalConversationWork(async (message) => {
171
171
  if (!agentRunner) throw new Error("Local agent runner is not ready");
package/dist/cli/check.js CHANGED
@@ -1,6 +1,6 @@
1
- import { E as JUNIOR_HEARTBEAT_ROUTE, j as LEGACY_JUNIOR_CONVERSATION_WORK_FUNCTION, w as JUNIOR_CONVERSATION_WORK_CALLBACK_ROUTE } from "../logging-CHZ0aJXO.js";
2
- import { d as parseInlinePluginManifest, f as parsePluginManifest } from "../registry-DR6TJe4J.js";
3
- import { i as parseSkillFile } from "../skills-DeUBvhdn.js";
1
+ import { E as JUNIOR_HEARTBEAT_ROUTE, j as LEGACY_JUNIOR_CONVERSATION_WORK_FUNCTION, w as JUNIOR_CONVERSATION_WORK_CALLBACK_ROUTE } from "../logging-1iHJtqBM.js";
2
+ import { f as parseInlinePluginManifest, p as parsePluginManifest } from "../registry-C0DT9wqc.js";
3
+ import { i as parseSkillFile } from "../skills-B6OcxCOp.js";
4
4
  import { pathToFileURL } from "node:url";
5
5
  import path from "node:path";
6
6
  import fs from "node:fs/promises";
package/dist/cli/main.js CHANGED
@@ -25,7 +25,7 @@ async function runChat(argv, pluginSet) {
25
25
  return await (await import("./chat.js")).runChat(argv, void 0, { pluginSet });
26
26
  }
27
27
  async function runBriefs(argv) {
28
- return await (await import("../briefs-eG5Jo1xa.js")).runBriefs(argv);
28
+ return await (await import("../briefs-D2iu2JPg.js")).runBriefs(argv);
29
29
  }
30
30
  function topLevelCommand(argv) {
31
31
  return (argv[0] === "--" ? argv.slice(1) : argv)[0];
@@ -1,4 +1,4 @@
1
- import { n as JuniorPluginSet } from "../plugins-BI9A1vKA.js";
1
+ import { n as JuniorPluginSet } from "../plugins-BT2l4We3.js";
2
2
  import { PluginCliIo } from "@sentry/junior-plugin-api";
3
3
  //#region src/cli/plugins.d.ts
4
4
  export type PluginCommandIo = PluginCliIo;
@@ -1,6 +1,6 @@
1
- import { Gt as getDb, bt as createPluginLogger, d as setPlugins, f as validatePlugins } from "../agent-hooks-BtGATjr2.js";
2
- import { n as pluginCatalogRuntime } from "../catalog-runtime-LUAIHslF.js";
3
- import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "../validation-Dy7SUhLv.js";
1
+ import { Gt as getDb, bt as createPluginLogger, d as setPlugins, f as validatePlugins } from "../agent-hooks-CKaIOT4I.js";
2
+ import { n as pluginCatalogRuntime } from "../catalog-runtime-v3x4peOv.js";
3
+ import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "../validation-CGkLLzS9.js";
4
4
  import { a as pluginRuntimeRegistrationsFromPluginSet, i as pluginCliRegistrationsFromPluginSet, r as pluginCatalogConfigFromPluginSet } from "../plugins-egKWjgue.js";
5
5
  import { t as loadAppPluginSet } from "../plugin-module-BKGOXca2.js";
6
6
  import { stderr, stdout } from "node:process";
@@ -1,6 +1,6 @@
1
- import { n as pluginCatalogRuntime } from "../catalog-runtime-LUAIHslF.js";
2
- import { S as disconnectStateAdapter, t as create } from "../profile-6veboDue.js";
3
- import { r as resolve } from "../resolve-DprAzyQN.js";
1
+ import { n as pluginCatalogRuntime } from "../catalog-runtime-v3x4peOv.js";
2
+ import { S as disconnectStateAdapter, t as create } from "../profile-B4e6XN37.js";
3
+ import { r as resolve } from "../resolve-DugfbPdI.js";
4
4
  //#region src/cli/snapshot-create.ts
5
5
  const DEFAULT_RUNTIME = "node22";
6
6
  const DEFAULT_TIMEOUT_MS = 6e5;
@@ -1,5 +1,5 @@
1
1
  import "../db-Ca9Nt5ci.js";
2
- import { n as JuniorPluginSet } from "../plugins-BI9A1vKA.js";
2
+ import { n as JuniorPluginSet } from "../plugins-BT2l4We3.js";
3
3
  //#region src/cli/upgrade/types.d.ts
4
4
  interface UpgradeIo {
5
5
  info: (line: string) => void;
@@ -1,6 +1,6 @@
1
- import { a as getChatConfig } from "../config-BMwzCmw-.js";
2
- import { t as createJuniorSqlExecutor } from "../executor-D0xETqi8.js";
3
- import { t as createPluginCatalogRuntime } from "../registry-DR6TJe4J.js";
1
+ import { a as getChatConfig } from "../config-BXIOxlCK.js";
2
+ import { t as createJuniorSqlExecutor } from "../executor-D_aAfzGp.js";
3
+ import { t as createPluginCatalogRuntime } from "../registry-C0DT9wqc.js";
4
4
  import { n as pluginCatalogConfigFromEnv, r as pluginCatalogConfigFromPluginSet, t as defineJuniorPlugins } from "../plugins-egKWjgue.js";
5
5
  import { t as loadAppPluginSet } from "../plugin-module-BKGOXca2.js";
6
6
  import { fileURLToPath } from "node:url";
@@ -1,5 +1,5 @@
1
- import { C as withSpan, f as logWarn, h as serializeGenAiAttribute, i as extractGenAiUsageAttributes, p as normalizeGenAiFinishReason, u as logException } from "./logging-CHZ0aJXO.js";
2
- import { a as toCanonicalInputMessage, n as getCurrentConversationPrivacy, o as toCanonicalOutputMessage, s as toGenAiMessagesTraceAttributes } from "./conversation-privacy-CLkpzAlt.js";
1
+ import { C as withSpan, f as logWarn, h as serializeGenAiAttribute, i as extractGenAiUsageAttributes, p as normalizeGenAiFinishReason, u as logException } from "./logging-1iHJtqBM.js";
2
+ import { a as toCanonicalInputMessage, n as getCurrentConversationPrivacy, o as toCanonicalOutputMessage, s as toGenAiMessagesTraceAttributes } from "./conversation-privacy-8-WR4KBo.js";
3
3
  import { calculateCost, completeSimple, getEnvApiKey, getModels, registerApiProvider } from "@earendil-works/pi-ai/compat";
4
4
  import { stream as streamAnthropic, streamSimple as streamSimpleAnthropic } from "@earendil-works/pi-ai/api/anthropic-messages";
5
5
  import { createGatewayProvider } from "@ai-sdk/gateway";
@@ -1,6 +1,6 @@
1
1
  import { t as __exportAll } from "./rolldown-runtime-B4FMCO8f.js";
2
- import { o as resolveGatewayModel, w as toOptionalTrimmed } from "./client-ciJRmcY5.js";
3
- import { f as logWarn } from "./logging-CHZ0aJXO.js";
2
+ import { o as resolveGatewayModel, w as toOptionalTrimmed } from "./client-DVKLZG01.js";
3
+ import { f as logWarn } from "./logging-1iHJtqBM.js";
4
4
  import { c as TURN_REASONING_LEVELS, l as parseTurnReasoningLevel, o as modelProfileSchema } from "./model-profile-CZmVoGdX.js";
5
5
  import { getModel } from "@earendil-works/pi-ai/compat";
6
6
  //#region src/chat/slack/emoji.ts
@@ -1,4 +1,4 @@
1
- import { f as logWarn } from "./logging-CHZ0aJXO.js";
1
+ import { f as logWarn } from "./logging-1iHJtqBM.js";
2
2
  import { AsyncLocalStorage } from "node:async_hooks";
3
3
  //#region src/chat/conversation-privacy.ts
4
4
  const SAFE_METADATA_KEY_LIMIT = 20;
@@ -1,28 +1,28 @@
1
- import { N as getMcpProviderErrorAttributes, X as createUserTokenStore, a as deleteMcpAuthSession, d as putMcpStoredOAuthCredentials, h as resolvePluginOAuthAccount, i as finalizeMcpAuthorization, l as getMcpAuthSession, u as getMcpStoredOAuthCredentials, y as lookupSlackUserProfile } from "./agent-CV4MPfCD.js";
2
- import { m as escapeXml } from "./client-ciJRmcY5.js";
3
- import { L as toOptionalString, S as withLogContext, d as logInfo, f as logWarn, m as runBestEffort, u as logException, y as setTags } from "./logging-CHZ0aJXO.js";
4
- import { a as getChatConfig, h as normalizeSlackEmojiName, n as botConfig, o as getRuntimeMetadata } from "./config-BMwzCmw-.js";
1
+ import { N as getMcpProviderErrorAttributes, X as createUserTokenStore, a as deleteMcpAuthSession, d as putMcpStoredOAuthCredentials, h as resolvePluginOAuthAccount, i as finalizeMcpAuthorization, l as getMcpAuthSession, u as getMcpStoredOAuthCredentials, y as lookupSlackUserProfile } from "./agent-DFeJ0yVy.js";
2
+ import { m as escapeXml } from "./client-DVKLZG01.js";
3
+ import { L as toOptionalString, S as withLogContext, d as logInfo, f as logWarn, m as runBestEffort, u as logException, y as setTags } from "./logging-1iHJtqBM.js";
4
+ import { a as getChatConfig, h as normalizeSlackEmojiName, n as botConfig, o as getRuntimeMetadata } from "./config-BXIOxlCK.js";
5
5
  import { n as defaultModelId } from "./model-profile-CZmVoGdX.js";
6
6
  import { _ as parseSlackMessageTs, g as parseSlackUserId, l as isUserActor, s as createSlackResumeActor } from "./context-Bplcgypl.js";
7
- import { G as isDmChannel, H as getHeaderString, K as normalizeSlackConversationId, Kt as getSqlExecutor, Nt as buildSentryConversationUrl, U as getSlackClient, Wt as getConversationStore, cn as upsertLinkedIdentity, dn as requireSlackDestination, mt as getDashboardConversationLink, o as getPluginSlackConversationLink, sn as upsertIdentity, z as SlackActionError } from "./agent-hooks-BtGATjr2.js";
7
+ import { G as isDmChannel, H as getHeaderString, K as normalizeSlackConversationId, Kt as getSqlExecutor, Nt as buildSentryConversationUrl, U as getSlackClient, Wt as getConversationStore, cn as upsertLinkedIdentity, dn as requireSlackDestination, mt as getDashboardConversationLink, o as getPluginSlackConversationLink, sn as upsertIdentity, z as SlackActionError } from "./agent-hooks-CKaIOT4I.js";
8
8
  import { i as homeDir } from "./package-discovery-7a9YqLhE.js";
9
- import { l as hasRequiredOAuthScope, n as buildOAuthTokenRequest, r as parseOAuthTokenResponse } from "./registry-DR6TJe4J.js";
10
- import { n as pluginCatalogRuntime } from "./catalog-runtime-LUAIHslF.js";
11
- import { t as discoverSkills } from "./skills-DeUBvhdn.js";
12
- import { B as recordAuthenticationLinked, F as loadProjection, V as recordAuthorizationCompleted, Y as hydrateConversationMessages, ct as recordDeliveredAssistantMessage, d as persistWithRetry, i as abandonTurnRecord, j as commitAcceptedReply, lt as turnHasReply, m as buildTurnErrorResponse, n as loadTurnCheckpoint, o as failTurnRecord, ot as markConversationMessage, r as saveTurnCheckpoint, s as getTurnRecord, tt as buildConversationContext, u as recordTurnSummary } from "./checkpoint-CmkbGGiR.js";
13
- import { E as acquireActiveLock, w as getStateAdapter } from "./profile-6veboDue.js";
14
- import { Pt as requestConversationWork, c as parseSlackThreadId, d as resolveSlackChannelIdFromThreadId, l as readSlackRawMessageContext, u as resolveSlackChannelIdFromMessage, wt as ensureConversationWake } from "./stats-BvNqVRdB.js";
15
- import { a as isPendingAuthLatestRequest, f as CooperativeTurnYieldError, g as isCooperativeTurnYieldError, i as getConversationPendingAuth, r as clearPendingAuth, s as getAssistantReplyText, x as markTurnFailed } from "./pending-auth-HNSPyxoN.js";
16
- import { a as parseOAuthStatePayload, c as escapeSlackMrkdwnText, d as normalizeSlackStatusText, f as truncateStatusText, g as removeReactionFromMessage, h as postSlackMessage, i as formatProviderLabel, l as formatSlackLink, o as resolveBaseUrl, p as addReactionToMessage, u as normalizeSlackReplyMarkdown, v as RetryableDeliveryError } from "./agent-runner-DCj_cPjl.js";
9
+ import { n as buildOAuthTokenRequest, r as parseOAuthTokenResponse, u as hasRequiredOAuthScope } from "./registry-C0DT9wqc.js";
10
+ import { n as pluginCatalogRuntime } from "./catalog-runtime-v3x4peOv.js";
11
+ import { t as discoverSkills } from "./skills-B6OcxCOp.js";
12
+ import { B as recordAuthenticationLinked, F as loadProjection, V as recordAuthorizationCompleted, Y as hydrateConversationMessages, ct as recordDeliveredAssistantMessage, d as persistWithRetry, i as abandonTurnRecord, j as commitAcceptedReply, lt as turnHasReply, m as buildTurnErrorResponse, n as loadTurnCheckpoint, o as failTurnRecord, ot as markConversationMessage, r as saveTurnCheckpoint, s as getTurnRecord, tt as buildConversationContext, u as recordTurnSummary } from "./checkpoint-Cc7ba7dw.js";
13
+ import { E as acquireActiveLock, w as getStateAdapter } from "./profile-B4e6XN37.js";
14
+ import { Pt as requestConversationWork, c as parseSlackThreadId, d as resolveSlackChannelIdFromThreadId, l as readSlackRawMessageContext, u as resolveSlackChannelIdFromMessage, wt as ensureConversationWake } from "./stats-BtMLD1n8.js";
15
+ import { a as isPendingAuthLatestRequest, f as CooperativeTurnYieldError, g as isCooperativeTurnYieldError, i as getConversationPendingAuth, r as clearPendingAuth, s as getAssistantReplyText, x as markTurnFailed } from "./pending-auth-B2qOCIx1.js";
16
+ import { a as parseOAuthStatePayload, c as escapeSlackMrkdwnText, d as normalizeSlackStatusText, f as truncateStatusText, g as removeReactionFromMessage, h as postSlackMessage, i as formatProviderLabel, l as formatSlackLink, o as resolveBaseUrl, p as addReactionToMessage, u as normalizeSlackReplyMarkdown, v as RetryableDeliveryError } from "./agent-runner-DifJddqY.js";
17
17
  import { t as getVercelConversationWorkQueue } from "./vercel-queue-DIkVcfK4.js";
18
- import { a as getTurnRequestDeadline } from "./job-queue-C8FZ3LSY.js";
19
- import { i as resolveTurnSessionRouting, n as scheduleSessionCompletedPluginTasks } from "./task-runner-BH5M3JHb.js";
20
- import { n as getTurnLifecycle } from "./turn-lifecycle-CNsgouon.js";
21
- import { n as executeTurn, t as AgentRunError } from "./turn-execution-mZIWtngI.js";
22
- import { c as configValueSchema, n as getPersistedSandboxState, o as persistThreadStateById, r as getPersistedThreadState, s as coerceThreadConversationState, t as getLocationConfigurationService } from "./thread-state-Db98GdYL.js";
23
- import { a as requireTurnFailureEventId, c as getTurnUserMessageId, d as buildDeliveredTurnStatePatch, l as getTurnUserReplyAttachmentContext, n as persistAuthPauseTurnState, o as getInterruptionMarker, r as finalizeFailedTurnReplyWithEvent, s as getTurnUserMessage, u as getTurnUserSlackMessageTs } from "./auth-pause-state-C7GMUpb9.js";
18
+ import { a as getTurnRequestDeadline } from "./job-queue-DjgMEeqJ.js";
19
+ import { i as resolveTurnSessionRouting, n as scheduleSessionCompletedPluginTasks } from "./task-runner-Bg2trvKT.js";
20
+ import { n as getTurnLifecycle } from "./turn-lifecycle-ClF1kY55.js";
21
+ import { n as executeTurn, t as AgentRunError } from "./turn-execution-CgCTt4YP.js";
22
+ import { c as configValueSchema, n as getPersistedSandboxState, o as persistThreadStateById, r as getPersistedThreadState, s as coerceThreadConversationState, t as getLocationConfigurationService } from "./thread-state-D4zlHEq1.js";
23
+ import { a as requireTurnFailureEventId, c as getTurnUserMessageId, d as buildDeliveredTurnStatePatch, l as getTurnUserReplyAttachmentContext, n as persistAuthPauseTurnState, o as getInterruptionMarker, r as finalizeFailedTurnReplyWithEvent, s as getTurnUserMessage, u as getTurnUserSlackMessageTs } from "./auth-pause-state-nAyuKldT.js";
24
24
  import { n as relayLocalOAuthCallback } from "./oauth-relay-CdCnu80W.js";
25
- import { n as deleteWebAuthorization } from "./web-authorization-DG2K_bpi.js";
25
+ import { n as deleteWebAuthorization } from "./web-authorization-DCSwmiua.js";
26
26
  import path from "node:path";
27
27
  import { z } from "zod";
28
28
  import { createHmac, createSecretKey, timingSafeEqual } from "node:crypto";
@@ -1,6 +1,6 @@
1
- import { f as logWarn } from "./logging-CHZ0aJXO.js";
2
- import { Gt as getDb, nn as agentTurnTotalTokens, tn as agentTurnCostUsd } from "./agent-hooks-BtGATjr2.js";
3
- import { E as juniorConversations, s as juniorAutomationExecutions } from "./executor-D0xETqi8.js";
1
+ import { f as logWarn } from "./logging-1iHJtqBM.js";
2
+ import { Gt as getDb, nn as agentTurnTotalTokens, tn as agentTurnCostUsd } from "./agent-hooks-CKaIOT4I.js";
3
+ import { E as juniorConversations, s as juniorAutomationExecutions } from "./executor-D_aAfzGp.js";
4
4
  import { and, asc, count, desc, eq, gte, inArray, lte, max, or, sql } from "drizzle-orm";
5
5
  //#region src/api/conversations/aggregate.ts
6
6
  function usageTokenValue(source, field) {
@@ -1,5 +1,5 @@
1
1
  import { g as startSpanManual } from "./sentry-CgWZM_kV.js";
2
- import "./config-BMwzCmw-.js";
2
+ import "./config-BXIOxlCK.js";
3
3
  import { n as juniorDestinations, r as timestamptz } from "./destinations-BeBiJeEM.js";
4
4
  import { AsyncLocalStorage } from "node:async_hooks";
5
5
  import { getTableColumns, sql } from "drizzle-orm";
@@ -1,6 +1,6 @@
1
- import { M as getDeploymentServiceVersion, N as getDeploymentTelemetryAttributes } from "./logging-CHZ0aJXO.js";
1
+ import { M as getDeploymentServiceVersion, N as getDeploymentTelemetryAttributes } from "./logging-1iHJtqBM.js";
2
2
  import { _ as vercelAIIntegration, a as getClient, b as withStreamedSpan, c as init, o as getGlobalScope } from "./sentry-CgWZM_kV.js";
3
- import { n as getCurrentConversationPrivacy } from "./conversation-privacy-CLkpzAlt.js";
3
+ import { n as getCurrentConversationPrivacy } from "./conversation-privacy-8-WR4KBo.js";
4
4
  import { t as consumePrivateTraceResultMarker } from "./private-trace-result-BLvBjy_e.js";
5
5
  //#region src/chat/sentry-payload-filter.ts
6
6
  const PAYLOAD_ATTRIBUTE_KEYS = /* @__PURE__ */ new Set([
@@ -1,4 +1,4 @@
1
- import { a as getChatConfig } from "./config-BMwzCmw-.js";
1
+ import { a as getChatConfig } from "./config-BXIOxlCK.js";
2
2
  import { a as signQueueMessage, i as QUEUE_SIGNATURE_MAX_AGE_MS, o as verifyQueueMessage, s as createVercelQueueClient } from "./vercel-queue-DIkVcfK4.js";
3
3
  import { AsyncLocalStorage } from "node:async_hooks";
4
4
  import { z } from "zod";
@@ -1,5 +1,5 @@
1
1
  import { d as setTag, f as setUser, h as startSpan, i as getActiveSpan, l as logger, n as captureMessage, p as spanToJSON, s as getTraceData, t as captureException, y as withScope } from "./sentry-CgWZM_kV.js";
2
- import { t as JUNIOR_VERSION } from "./version-Es4nurl1.js";
2
+ import { t as JUNIOR_VERSION } from "./version-CZfM8Kly.js";
3
3
  import path from "node:path";
4
4
  import { styleText } from "node:util";
5
5
  import { ConfigError, configureSync, getConfig, getLogger } from "@logtape/logtape";
package/dist/nitro.d.ts CHANGED
@@ -1,5 +1,5 @@
1
- import { n as JuniorDashboardOptions } from "./app-D4nNdzPG.js";
2
- import { n as JuniorPluginSet } from "./plugins-BI9A1vKA.js";
1
+ import { n as JuniorDashboardOptions } from "./app-BYD2Nyji.js";
2
+ import { n as JuniorPluginSet } from "./plugins-BT2l4We3.js";
3
3
  //#region src/nitro.d.ts
4
4
  export type JuniorNitroDashboardOptions = JuniorDashboardOptions;
5
5
  export interface JuniorPluginModuleReference {
package/dist/nitro.js CHANGED
@@ -1,9 +1,9 @@
1
- import { A as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, D as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE, E as JUNIOR_HEARTBEAT_ROUTE, O as JUNIOR_RETENTION_CRON_SCHEDULE, T as JUNIOR_HEARTBEAT_CRON_SCHEDULE, k as JUNIOR_RETENTION_ROUTE, w as JUNIOR_CONVERSATION_WORK_CALLBACK_ROUTE } from "./logging-CHZ0aJXO.js";
1
+ import { A as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, D as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE, E as JUNIOR_HEARTBEAT_ROUTE, O as JUNIOR_RETENTION_CRON_SCHEDULE, T as JUNIOR_HEARTBEAT_CRON_SCHEDULE, k as JUNIOR_RETENTION_ROUTE, w as JUNIOR_CONVERSATION_WORK_CALLBACK_ROUTE } from "./logging-1iHJtqBM.js";
2
2
  import { d as resolvePackageDir, t as discoverInstalledPluginPackageContent, u as isValidPackageName } from "./package-discovery-7a9YqLhE.js";
3
3
  import { n as resolveConversationWorkQueueTopic } from "./vercel-queue-DIkVcfK4.js";
4
- import { t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-C8FZ3LSY.js";
4
+ import { t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-DjgMEeqJ.js";
5
5
  import { a as pluginRuntimeRegistrationsFromPluginSet, r as pluginCatalogConfigFromPluginSet } from "./plugins-egKWjgue.js";
6
- import { t as PLUGIN_TASK_QUEUE_TOPIC } from "./task-queue-CbxNVEAg.js";
6
+ import { t as PLUGIN_TASK_QUEUE_TOPIC } from "./task-queue-a2aXjkx2.js";
7
7
  import { n as loadPluginSetFromModule, r as resolvePluginModule } from "./plugin-module-BKGOXca2.js";
8
8
  import path from "node:path";
9
9
  import { cpSync, existsSync, mkdirSync, readdirSync, statSync } from "node:fs";
@@ -1,5 +1,5 @@
1
- import { X as createUserTokenStore } from "./agent-CV4MPfCD.js";
2
- import { a as GET, n as syncLocalOAuthCredential, r as GET$1 } from "./credential-sync-BoWHpDBP.js";
1
+ import { X as createUserTokenStore } from "./agent-DFeJ0yVy.js";
2
+ import { a as GET, n as syncLocalOAuthCredential, r as GET$1 } from "./credential-sync-BOcckr3l.js";
3
3
  import { createServer } from "node:http";
4
4
  //#region src/chat/local/oauth-callback-server.ts
5
5
  const LOCAL_OAUTH_TIMEOUT_MS = 6e5;
@@ -1,5 +1,5 @@
1
- import { g as extractAssistantText, i as abandonTurnRecord } from "./checkpoint-CmkbGGiR.js";
2
- import { qt as buildDeterministicTurnId } from "./stats-BvNqVRdB.js";
1
+ import { g as extractAssistantText, i as abandonTurnRecord } from "./checkpoint-Cc7ba7dw.js";
2
+ import { qt as buildDeterministicTurnId } from "./stats-BtMLD1n8.js";
3
3
  //#region src/chat/runtime/turn.ts
4
4
  /** Classified Slack turn failure carrying the owning Sentry capture outward. */
5
5
  var ConversationTurnBoundaryError = class extends Error {
@@ -1,4 +1,4 @@
1
- import { PluginRegistration, PluginRuntimePostinstallCommand } from "@sentry/junior-plugin-api";
1
+ import { PluginMcpConfig, PluginRegistration, PluginRuntimePostinstallCommand } from "@sentry/junior-plugin-api";
2
2
  //#region src/chat/plugins/types.d.ts
3
3
  interface PluginOAuthConfig {
4
4
  clientIdEnv: string;
@@ -63,6 +63,7 @@ interface PluginManifestConfig {
63
63
  transport?: "http";
64
64
  url?: string;
65
65
  headers?: Record<string, string | null> | null;
66
+ auth?: PluginMcpConfig["auth"];
66
67
  allowedTools?: string[] | null;
67
68
  wrappedTools?: string[] | null;
68
69
  } | null;
@@ -1,7 +1,7 @@
1
- import { w as toOptionalTrimmed } from "./client-ciJRmcY5.js";
2
- import { _ as setSpanAttributes, v as setSpanStatus } from "./logging-CHZ0aJXO.js";
3
- import { a as getChatConfig } from "./config-BMwzCmw-.js";
4
- import { n as pluginCatalogRuntime } from "./catalog-runtime-LUAIHslF.js";
1
+ import { w as toOptionalTrimmed } from "./client-DVKLZG01.js";
2
+ import { _ as setSpanAttributes, v as setSpanStatus } from "./logging-1iHJtqBM.js";
3
+ import { a as getChatConfig } from "./config-BXIOxlCK.js";
4
+ import { n as pluginCatalogRuntime } from "./catalog-runtime-v3x4peOv.js";
5
5
  import { createHash } from "node:crypto";
6
6
  import { createMemoryState } from "@chat-adapter/state-memory";
7
7
  import { createRedisState } from "@chat-adapter/state-redis";
@@ -1,4 +1,4 @@
1
- import { _ as setSpanAttributes, d as logInfo, f as logWarn } from "./logging-CHZ0aJXO.js";
1
+ import { _ as setSpanAttributes, d as logInfo, f as logWarn } from "./logging-1iHJtqBM.js";
2
2
  import { i as credentialUserSubjectId } from "./context-Bplcgypl.js";
3
3
  import { n as normalizePluginPackageNames, o as pluginRoots, t as discoverInstalledPluginPackageContent } from "./package-discovery-7a9YqLhE.js";
4
4
  import path from "node:path";
@@ -31,12 +31,21 @@ function inlineCredentialsSource(credentials) {
31
31
  setDefined$1(result, "auth-token-placeholder", credentials.authTokenPlaceholder);
32
32
  return result;
33
33
  }
34
+ /** Convert a camelCase `mcp.auth` block to its plugin.yaml source keys. */
35
+ function mcpAuthSource(auth) {
36
+ return {
37
+ issuer: auth.issuer,
38
+ "key-id": auth.keyId,
39
+ "private-key-env": auth.privateKeyEnv
40
+ };
41
+ }
34
42
  function inlineMcpSource(mcp) {
35
43
  if (mcp === void 0 || !isRecord(mcp)) return mcp;
36
44
  const result = {};
37
45
  setDefined$1(result, "transport", mcp.transport);
38
46
  setDefined$1(result, "url", mcp.url);
39
47
  setDefined$1(result, "headers", mcp.headers);
48
+ setDefined$1(result, "auth", mcp.auth && mcpAuthSource(mcp.auth));
40
49
  setDefined$1(result, "allowed-tools", mcp.allowedTools);
41
50
  setDefined$1(result, "wrapped-tools", mcp.wrappedTools);
42
51
  return result;
@@ -219,9 +228,15 @@ const oauthSourceSchema = z.object({
219
228
  "token-auth-method": nonEmptyTrimmedString.refine((value) => value === "body" || value === "basic", { error: "must be \"body\" or \"basic\"" }).optional(),
220
229
  "treat-empty-scope-as-unreported": z.boolean().optional()
221
230
  }).passthrough();
231
+ const mcpAuthSourceSchema = z.object({
232
+ issuer: nonEmptyTrimmedString,
233
+ "key-id": nonEmptyTrimmedString,
234
+ "private-key-env": envVarString
235
+ }).passthrough();
222
236
  const mcpSourceSchema = z.object({
223
237
  transport: nonEmptyTrimmedString.refine((value) => value === "http", { error: "must be \"http\"" }).optional(),
224
238
  url: httpsUrlString,
239
+ auth: mcpAuthSourceSchema.optional(),
225
240
  headers: stringMapSchema.optional(),
226
241
  "allowed-tools": nonEmptyStringArraySchema("allowed-tools").optional(),
227
242
  "wrapped-tools": nonEmptyStringArraySchema("wrapped-tools").optional()
@@ -280,6 +295,7 @@ function manifestConfigPatch(config) {
280
295
  setDefined(mcp, "transport", config.mcp.transport);
281
296
  setDefined(mcp, "url", config.mcp.url);
282
297
  setDefined(mcp, "headers", config.mcp.headers);
298
+ setDefined(mcp, "auth", config.mcp.auth && mcpAuthSource(config.mcp.auth));
283
299
  setDefined(mcp, "allowed-tools", config.mcp.allowedTools);
284
300
  setDefined(mcp, "wrapped-tools", config.mcp.wrappedTools);
285
301
  result.mcp = mcp;
@@ -368,13 +384,20 @@ function envReferences(value) {
368
384
  function assertDeclaredEnvReferences(value, envVars, context) {
369
385
  for (const name of envReferences(value)) {
370
386
  if (!Object.prototype.hasOwnProperty.call(envVars, name)) throw new Error(`${context} references env var ${name} which is not declared in env-vars`);
371
- if (envVars[name]?.default !== void 0) throw new Error(`${context} references env var ${name}, but API header env vars must not declare defaults`);
387
+ if (envVars[name]?.default !== void 0) throw new Error(`${context} references env var ${name}, but header env vars must not declare defaults`);
372
388
  }
373
389
  }
390
+ function assertDeclaredHeaderEnvReferences(headers, envVars, prefix) {
391
+ for (const [key, headerValue] of Object.entries(headers ?? {})) assertDeclaredEnvReferences(headerValue, envVars, `${prefix}.${key}`);
392
+ }
393
+ function assertDeclaredHostSecretEnv(name, envVars, context) {
394
+ if (!Object.prototype.hasOwnProperty.call(envVars, name)) throw new Error(`${context} uses env var ${name} which is not declared in env-vars`);
395
+ if (envVars[name]?.default !== void 0) throw new Error(`${context} uses env var ${name}, but host secret env vars must not declare defaults`);
396
+ }
374
397
  function normalizeRequiredApiHeaders(value, prefix, envVars) {
375
398
  const apiHeaders = normalizeStringMap(value, prefix);
376
399
  if (!apiHeaders) throw new Error(`${prefix} must contain at least one header`);
377
- for (const [key, headerValue] of Object.entries(apiHeaders)) assertDeclaredEnvReferences(headerValue, envVars, `${prefix}.${key}`);
400
+ assertDeclaredHeaderEnvReferences(apiHeaders, envVars, prefix);
378
401
  return apiHeaders;
379
402
  }
380
403
  function assertCommandEnvReferencesDeclared(value, envVars, context) {
@@ -395,17 +418,20 @@ function normalizeCommandEnv(value, prefix, envVars) {
395
418
  }
396
419
  return Object.fromEntries(Object.entries(env).map(([key, envValue]) => [key, expandCommandEnvPlaceholders(envValue, envVars, `${prefix}.${key}`)]));
397
420
  }
398
- function assertCommandEnvDoesNotExposeHostSecretRefs(commandEnv, apiHeaders, credentials, oauth, pluginName) {
399
- if (!commandEnv) return;
400
- const hostOnlyRefs = /* @__PURE__ */ new Set();
401
- for (const value of Object.values(apiHeaders ?? {})) for (const name of envReferences(value)) hostOnlyRefs.add(name);
402
- if (credentials) {
403
- if (credentials.authTokenEnv) hostOnlyRefs.add(credentials.authTokenEnv);
404
- }
405
- if (oauth) {
406
- hostOnlyRefs.add(oauth.clientIdEnv);
407
- hostOnlyRefs.add(oauth.clientSecretEnv);
421
+ /** Collect every env var that carries a host-only secret for one plugin. */
422
+ function hostOnlyEnvNames(manifest) {
423
+ const names = /* @__PURE__ */ new Set();
424
+ if (manifest.mcp?.auth) names.add(manifest.mcp.auth.privateKeyEnv);
425
+ for (const value of [...Object.values(manifest.apiHeaders ?? {}), ...Object.values(manifest.mcp?.headers ?? {})]) for (const name of envReferences(value)) names.add(name);
426
+ if (manifest.credentials?.authTokenEnv) names.add(manifest.credentials.authTokenEnv);
427
+ if (manifest.oauth) {
428
+ names.add(manifest.oauth.clientIdEnv);
429
+ names.add(manifest.oauth.clientSecretEnv);
408
430
  }
431
+ return names;
432
+ }
433
+ function assertCommandEnvDoesNotExposeHostSecretRefs(commandEnv, hostOnlyRefs, pluginName) {
434
+ if (!commandEnv) return;
409
435
  for (const [key, value] of Object.entries(commandEnv)) for (const name of envReferences(value)) if (hostOnlyRefs.has(name)) throw new Error(`Plugin ${pluginName} command-env.${key} references env var ${name}, but credential/API header env vars must stay host-only`);
410
436
  }
411
437
  function assertCommandEnvHostRefsAreExplicitlyExposed(commandEnv, envVars, pluginName) {
@@ -544,9 +570,16 @@ function normalizeMcp(data, envVars, name) {
544
570
  const result = mcpSourceSchema.safeParse(prepared);
545
571
  if (!result.success) throw new Error(issueMessage(result.error, `Plugin ${name} mcp`));
546
572
  const headers = result.data.headers ? normalizeStringMap(result.data.headers, `Plugin ${name} mcp.headers`, { forbiddenKeys: FORBIDDEN_API_HEADER_NAMES }) : void 0;
573
+ assertDeclaredHeaderEnvReferences(headers, envVars, `Plugin ${name} mcp.headers`);
574
+ if (result.data.auth) assertDeclaredHostSecretEnv(result.data.auth["private-key-env"], envVars, `Plugin ${name} mcp.auth.private-key-env`);
547
575
  return {
548
576
  transport: "http",
549
577
  url: result.data.url,
578
+ ...result.data.auth ? { auth: {
579
+ issuer: result.data.auth.issuer,
580
+ keyId: result.data.auth["key-id"],
581
+ privateKeyEnv: result.data.auth["private-key-env"]
582
+ } } : void 0,
550
583
  ...headers ? { headers } : void 0,
551
584
  ...result.data["allowed-tools"] ? { allowedTools: result.data["allowed-tools"] } : void 0,
552
585
  ...result.data["wrapped-tools"] ? { wrappedTools: result.data["wrapped-tools"] } : void 0
@@ -620,7 +653,12 @@ function parseManifestSource(parsedSource, dir, config, options) {
620
653
  ...result.data["treat-empty-scope-as-unreported"] ? { treatEmptyScopeAsUnreported: true } : void 0
621
654
  };
622
655
  }
623
- assertCommandEnvDoesNotExposeHostSecretRefs(data["command-env"], apiHeaders, credentials, manifest.oauth, data.name);
656
+ assertCommandEnvDoesNotExposeHostSecretRefs(data["command-env"], hostOnlyEnvNames({
657
+ apiHeaders,
658
+ credentials,
659
+ oauth: manifest.oauth,
660
+ mcp
661
+ }), data.name);
624
662
  assertCommandEnvHostRefsAreExplicitlyExposed(data["command-env"], envVars, data.name);
625
663
  if (data.target) {
626
664
  const result = targetSourceSchema.safeParse(data.target);
@@ -830,12 +868,18 @@ function resolveAuthTokenPlaceholder(credentials) {
830
868
  //#region src/chat/plugins/auth/api-headers-broker.ts
831
869
  const MAX_LEASE_MS$1 = 36e5;
832
870
  const ENV_PLACEHOLDER_RE = /\$\{([A-Z_][A-Z0-9_]*)\}/g;
833
- function resolveHeaders(provider, headers) {
871
+ /**
872
+ * Fill `${NAME}` refs in plugin header values from the deployment env.
873
+ *
874
+ * Manifests keep the placeholder so secrets never reach build output, and the
875
+ * parser has already required each name to be declared without a default.
876
+ */
877
+ function resolvePluginHeaderEnvRefs(provider, headers, kind = "API header") {
834
878
  return Object.fromEntries(Object.entries(headers).map(([key, value]) => {
835
879
  return [key, value.replace(ENV_PLACEHOLDER_RE, (_match, name) => {
836
880
  const envName = name;
837
881
  const envValue = process.env[envName]?.trim();
838
- if (!envValue) throw new Error(`Missing ${envName} for API header provider "${provider}"`);
882
+ if (!envValue) throw new Error(`Missing ${envName} for ${kind} provider "${provider}"`);
839
883
  return envValue;
840
884
  })];
841
885
  }));
@@ -844,7 +888,7 @@ function resolveHeaders(provider, headers) {
844
888
  function resolveApiHeaderTransforms(manifest) {
845
889
  const { domains, apiHeaders } = manifest;
846
890
  if (!domains || !apiHeaders) return [];
847
- const resolvedHeaders = resolveHeaders(manifest.name, apiHeaders);
891
+ const resolvedHeaders = resolvePluginHeaderEnvRefs(manifest.name, apiHeaders);
848
892
  return domains.map((domain) => ({
849
893
  domain,
850
894
  headers: resolvedHeaders
@@ -1416,4 +1460,4 @@ function createPluginCatalogRuntime() {
1416
1460
  };
1417
1461
  }
1418
1462
  //#endregion
1419
- export { resolvePluginCommandEnv as a, getOAuthProviderErrorAttributes as c, parseInlinePluginManifest as d, parsePluginManifest as f, resolveAuthTokenPlaceholder as i, hasRequiredOAuthScope as l, buildOAuthTokenRequest as n, OAuthProviderError as o, parseOAuthTokenResponse as r, fetchWithBoundedOAuthErrorBodies as s, createPluginCatalogRuntime as t, CredentialUnavailableError as u };
1463
+ export { resolveAuthTokenPlaceholder as a, fetchWithBoundedOAuthErrorBodies as c, CredentialUnavailableError as d, parseInlinePluginManifest as f, resolvePluginHeaderEnvRefs as i, getOAuthProviderErrorAttributes as l, buildOAuthTokenRequest as n, resolvePluginCommandEnv as o, parsePluginManifest as p, parseOAuthTokenResponse as r, OAuthProviderError as s, createPluginCatalogRuntime as t, hasRequiredOAuthScope as u };
@@ -1,5 +1,5 @@
1
- import { C as withSpan, _ as setSpanAttributes } from "./logging-CHZ0aJXO.js";
2
- import { A as sleep, P as SANDBOX_WORKSPACE_ROOT, r as isStale, t as create, u as isSandboxUnavailableError, v as getVercelSandboxCredentials, w as getStateAdapter, x as runNonInteractiveCommand } from "./profile-6veboDue.js";
1
+ import { C as withSpan, _ as setSpanAttributes } from "./logging-1iHJtqBM.js";
2
+ import { A as sleep, P as SANDBOX_WORKSPACE_ROOT, r as isStale, t as create, u as isSandboxUnavailableError, v as getVercelSandboxCredentials, w as getStateAdapter, x as runNonInteractiveCommand } from "./profile-B4e6XN37.js";
3
3
  import { z } from "zod";
4
4
  import { FileSystem, Sandbox } from "@vercel/sandbox";
5
5
  //#region src/chat/sandbox/resources.ts
@@ -1,13 +1,13 @@
1
- import { p as authorizationId } from "./agent-CV4MPfCD.js";
2
- import { S as withLogContext, u as logException, y as setTags } from "./logging-CHZ0aJXO.js";
1
+ import { p as authorizationId } from "./agent-DFeJ0yVy.js";
2
+ import { S as withLogContext, u as logException, y as setTags } from "./logging-1iHJtqBM.js";
3
3
  import { t as credentialContextForActor } from "./context-Bplcgypl.js";
4
- import { Ht as getConversationEventStore, Wt as getConversationStore } from "./agent-hooks-BtGATjr2.js";
5
- import { F as loadProjection, V as recordAuthorizationCompleted, X as persistConversationMessages, Y as hydrateConversationMessages, ct as recordDeliveredAssistantMessage, d as persistWithRetry, j as commitAcceptedReply, ot as markConversationMessage, r as saveTurnCheckpoint, st as normalizeConversationText, tt as buildConversationContext, ut as upsertConversationMessage } from "./checkpoint-CmkbGGiR.js";
6
- import { S as startActiveTurn, s as getAssistantReplyText, x as markTurnFailed } from "./pending-auth-HNSPyxoN.js";
7
- import { n as scheduleSessionCompletedPluginTasks, t as processPluginTask } from "./task-runner-BH5M3JHb.js";
8
- import { t as ConversationTurnLifecycleService } from "./turn-lifecycle-CNsgouon.js";
9
- import { n as getPersistedSandboxState, o as persistThreadStateById, r as getPersistedThreadState, s as coerceThreadConversationState } from "./thread-state-Db98GdYL.js";
10
- import { d as buildDeliveredTurnStatePatch, r as finalizeFailedTurnReplyWithEvent, t as completeAuthPauseTurn } from "./auth-pause-state-C7GMUpb9.js";
4
+ import { Ht as getConversationEventStore, Wt as getConversationStore } from "./agent-hooks-CKaIOT4I.js";
5
+ import { F as loadProjection, V as recordAuthorizationCompleted, X as persistConversationMessages, Y as hydrateConversationMessages, ct as recordDeliveredAssistantMessage, d as persistWithRetry, j as commitAcceptedReply, ot as markConversationMessage, r as saveTurnCheckpoint, st as normalizeConversationText, tt as buildConversationContext, ut as upsertConversationMessage } from "./checkpoint-Cc7ba7dw.js";
6
+ import { S as startActiveTurn, s as getAssistantReplyText, x as markTurnFailed } from "./pending-auth-B2qOCIx1.js";
7
+ import { n as scheduleSessionCompletedPluginTasks, t as processPluginTask } from "./task-runner-Bg2trvKT.js";
8
+ import { t as ConversationTurnLifecycleService } from "./turn-lifecycle-ClF1kY55.js";
9
+ import { n as getPersistedSandboxState, o as persistThreadStateById, r as getPersistedThreadState, s as coerceThreadConversationState } from "./thread-state-D4zlHEq1.js";
10
+ import { d as buildDeliveredTurnStatePatch, r as finalizeFailedTurnReplyWithEvent, t as completeAuthPauseTurn } from "./auth-pause-state-nAyuKldT.js";
11
11
  import { randomUUID } from "node:crypto";
12
12
  import { createLocalSource, localDestinationSchema } from "@sentry/junior-plugin-api";
13
13
  //#region src/chat/local/runner.ts
@@ -1,4 +1,4 @@
1
- import { Y as sandboxEgressSignalsResponseSchema } from "./agent-CV4MPfCD.js";
1
+ import { Y as sandboxEgressSignalsResponseSchema } from "./agent-DFeJ0yVy.js";
2
2
  //#region src/chat/local/sandbox-egress-signals.ts
3
3
  const SANDBOX_EGRESS_SIGNALS_PATH = "/api/internal/sandbox-egress/signals";
4
4
  const LOCAL_DEV_SERVER_TIMEOUT_MS = 1e3;
@@ -1,5 +1,5 @@
1
- import { f as logWarn } from "./logging-CHZ0aJXO.js";
2
- import { n as botConfig } from "./config-BMwzCmw-.js";
1
+ import { f as logWarn } from "./logging-1iHJtqBM.js";
2
+ import { n as botConfig } from "./config-BXIOxlCK.js";
3
3
  const TITLE_PROMPTS = {
4
4
  conversation: [
5
5
  "Generate a concise 5-8 word conversation title from the first user message below.",
@@ -1,7 +1,7 @@
1
1
  import { t as __exportAll } from "./rolldown-runtime-B4FMCO8f.js";
2
- import { f as logWarn } from "./logging-CHZ0aJXO.js";
2
+ import { f as logWarn } from "./logging-1iHJtqBM.js";
3
3
  import { s as skillRoots } from "./package-discovery-7a9YqLhE.js";
4
- import { n as pluginCatalogRuntime } from "./catalog-runtime-LUAIHslF.js";
4
+ import { n as pluginCatalogRuntime } from "./catalog-runtime-v3x4peOv.js";
5
5
  import path from "node:path";
6
6
  import { z } from "zod";
7
7
  import fs from "node:fs/promises";
@@ -1,6 +1,6 @@
1
1
  import { t as __exportAll } from "./rolldown-runtime-B4FMCO8f.js";
2
- import { C as toolInvocationDestination, y as actorFromRun } from "./agent-runner-DCj_cPjl.js";
3
- import { n as createAndEnqueueAgentInvocation } from "./work-DTqDMGeD.js";
2
+ import { C as toolInvocationDestination, y as actorFromRun } from "./agent-runner-DifJddqY.js";
3
+ import { n as createAndEnqueueAgentInvocation } from "./work-lRFwhKJe.js";
4
4
  //#region src/chat/agent-invocations/spawn.ts
5
5
  var spawn_exports = /* @__PURE__ */ __exportAll({ bindSpawnAgent: () => bindSpawnAgent });
6
6
  /** Bind a Run's Actor and credentials to new Agent invocations. */