@sentry/junior 0.257.0 → 0.259.0

package/dist/{agent-runner-D7OboVb3.js → agent-runner-CPSd7rKm.js}

@@ -1,39 +1,40 @@
-import { b as getGatewayApiKey, c as hasCompactedConversationContext, d as unwrapCurrentInstruction, f as escapeXml, g as getProviderErrorAttributes, h as findProviderError, i as completeText, l as isCompactionSummaryText, m as createProviderError, n as GEN_AI_SERVER_ADDRESS, o as resolveGatewayModel, p as ProviderError, r as completeObject, s as COMPACTION_SUMMARY_PREFIX, t as GEN_AI_PROVIDER_NAME, u as renderCurrentInstruction, v as isProviderRetryError, x as resolveGatewayCredential, y as MISSING_GATEWAY_CREDENTIALS_ERROR } from "./client-D8HnkOQX.js";
-import { R as normalizeIdentityEmail, S as summarizeMessageText, T as withSpan, V as toOptionalString, _ as serializeGenAiAttribute, a as extractGenAiUsageSummary, b as setSpanStatus, c as getLogContextAttributesForSpan, d as logError, f as logException, h as normalizeGenAiFinishReason, i as extractGenAiUsageAttributes, l as getTracePropagationHeaders, m as logWarn, p as logInfo, u as logAudit, w as withLogContext, x as setTags, y as setSpanAttributes, z as isRecord$4 } from "./logging-CWxiIuCF.js";
-import { m as startInactiveSpan, v as withActiveSpan } from "./sentry-CgWZM_kV.js";
-import { a as toCanonicalInputMessage, c as toGenAiPayloadMetadata, i as runWithConversationPrivacy, l as toGenAiPayloadTraceAttributes, o as toCanonicalOutputMessage, r as resolveConversationPrivacy, s as toGenAiMessagesTraceAttributes, t as canExposeConversationPayload } from "./conversation-privacy-C8b1nphZ.js";
-import { n as botConfig, v as normalizeSlackEmojiName } from "./config-CJRnWK9H.js";
-import { a as formatModelProfiles, c as profileConfig, i as formatModelProfile, l as TURN_REASONING_LEVELS, n as ModelProfileNotConfiguredError, o as modelIdForProfile, s as modelProfileSchema } from "./model-profile-BwU8mqwD.js";
-import { a as isUserActor, d as parseSlackTeamId, f as parseSlackUserId, g as parseSlackMessageTs, l as parseSlackChannelId, u as parseSlackChannelReferenceId } from "./actor-BTtLaeWy.js";
-import { O as hasAgentTurnUsage, T as agentTurnCostUsd, V as parseDestination, d as getConversationStore, f as getDb, i as readActorIdentity, l as getConversationEventStore, p as getSqlExecutor, u as getConversationMessageSearchStore, w as addAgentTurnUsage } from "./viewer-DSZXygMU.js";
-import { a as juniorAgentInvocations, c as juniorIdentities, d as juniorDestinations, i as juniorAgentBindings, n as AGENT_INVOCATION_PARENT_MAILBOX_STATUSES, s as juniorConversations, t as AGENT_INVOCATION_MAILBOX_STATUSES } from "./agent-invocations-Bdu3ROfo.js";
-import { _ as juniorConversationAnnotations, a as juniorAutomationRuns, b as juniorAttachments, c as juniorStats, f as juniorConversationBriefs, x as juniorArtifacts } from "./executor-Do0THDRR.js";
-import { d as contextProvenance, f as instructionActors, m as sameActorIdentity, p as instructionProvenanceFor, t as KNOWN_CONVERSATION_EVENT_TYPES, u as agentInstructionProvenance } from "./history-9pO1Zd4Y.js";
-import { a as listReferenceFiles, c as soulPathCandidates, l as worldPathCandidates } from "./package-discovery-BVvSnQBB.js";
-import { _ as CredentialUnavailableError, a as resolveAuthTokenPlaceholder, c as fetchWithBoundedOAuthErrorBodies, d as actorLogContext, f as credentialContextForActor, g as credentialUserSubjectId, i as resolvePluginHeaderEnvRefs, l as getOAuthProviderErrorAttributes, o as resolvePluginCommandEnv, p as credentialContextSchema, s as OAuthProviderError } from "./registry-sLTr-sV9.js";
-import { n as pluginCatalogRuntime } from "./catalog-runtime-CZzhGQ7F.js";
-import { a as parseSkillInvocation, i as parseSkillFile, n as findSkillByName, r as loadSkillsByName, t as discoverSkills } from "./skills-C22SLruK.js";
-import { A as escapeSlackMrkdwnText, B as postSlackMessage, Ct as ToolInputError, Dt as loadConversationProjection, Et as loadConnectedMcpProviders, G as continuableMessages, H as uploadFilesToConversation, Ht as recordTurnRoute, I as addReactionToMessage, K as loadTurnCheckpoint, L as getSlackMessagePermalink, Lt as recordAuthorizationRequested, Mt as openConversationProjection, Nt as recordAgentsInstructionsUpdated, O as automationRevision, Ot as loadLastModelProfile, P as slackMention, Pt as recordAttachmentsDelivered, R as openSlackDirectMessage, Rt as recordGuardianActionReviewed, St as TURN_CONTEXT_TAG, Vt as recordToolExecutionStarted, Xt as fallbackShortTitle, Zt as resolveTaskTitle, _t as isToolResultMessage, a as saveScheduledAutomation, bt as stripRuntimeTurnContext, ct as extractAssistantText, d as createEventAutomation, dn as getAgentContextInputLimitTokens, dt as getUserMessageInstructionText, f as deleteEventAutomation, fn as historyItemFromPiMessage, ft as hasRuntimeTurnContext, g as listEventAutomationsForTeam, gt as isToolResultError, ht as isContinuablePiBoundary, i as readScheduledAutomation, it as TurnToolCallLimitExceededError, j as formatSlackLink, jt as loadTurnRoute, ln as estimateTextTokens, lt as getPiMessageRole, m as getEventAutomation, mt as isAssistantMessage, n as listScheduledAutomationsForTeam, nt as TurnBudgetExceededError, ot as createTurnLimitGate, pn as piMessageFromHistoryItem, q as saveTurnCheckpoint, rt as TurnSliceLimitExceededError, st as isTurnExecutionLimitExceededError, t as createScheduledAutomation, tt as TURN_LIMIT_DISABLED_REASON, un as getAgentContextCompactionTriggerTokens, ut as getTerminalAssistantMessages, v as saveEventAutomation, vt as normalizeToolNameFromResult, xt as trimTrailingAssistantMessages, y as setEventAutomationStatus, yt as retainRuntimeTurnContext, z as postSlackEphemeralMessage, zt as recordMcpProviderConnected } from "./tasks-D_WIJtvO.js";
-import { A as getWorkspaceSnapshotBuilder, B as STOP_WATCHING_TOOL_NAME, Bt as getFilePermalink, C as WorkspaceValidationError, D as setWorkspaceSnapshotBuild, Dt as matchSlackAttachments, E as setWorkspaceSnapshot, F as isSlackMessageTurn, Ft as defaultTimezone, G as createWatch, Gt as normalizeSlackConversationId, H as cancelWatch, Ht as getSlackClient, I as slackMessageTurnDisabledReason, It as resolveUserTimezone, J as getWatch, K as deliverWatch, L as RESOURCE_SUBSCRIPTION_DEFAULT_TTL_MS, M as workspaceRepoCheckoutPath, Mt as createPluginAnnotations, N as resolveChannelCapabilities, O as SANDBOX_RUNTIME, P as getSlackToolContext, R as RESOURCE_SUBSCRIPTION_MAX_TTL_MS, Rt as SlackActionError, S as updateWorkspace, T as loadSnapshotsForProfile, Ut as isConversationScopedChannel, V as cancelSubscriptions, W as createTimerWatch, Wt as isDmChannel$1, Xt as JUNIOR_NATIVE_EVENT_NAMESPACE, Y as listWatches, _ as deleteWorkspace, at as getDashboardConversationLink, b as listWorkspaces, c as getPluginTools, en as conversationNoteEvent, ft as createPluginLogger, g as createWorkspace, j as tryWorkspaceRepoCheckoutPath, jt as saveObjectAnnotations, k as deleteWorkspaceSnapshotBuilders, l as getPluginUserPromptContributions, q as findMatchingWatches, qt as withSlackRetries, r as createPluginHookRunner, s as getPluginSystemPromptContributions, st as getDashboardTaskLink, u as getPlugins, v as getWorkspace, w as invalidateReadySnapshot, y as getWorkspaceByName, z as RESOURCE_WATCH_TOOL_SOURCE, zt as downloadPrivateSlackFile } from "./agent-hooks-BjtTzvru.js";
-import { B as briefLinkSchema, H as conversationBriefSchema, J as removedCardSchema, L as detectImageMediaType, R as isVisionImageMediaType, V as briefOutcomeStatusSchema } from "./conversation-CKNLYBJt.js";
-import { A as SANDBOX_DATA_ROOT, D as fenceLock, E as acquireActiveLock, F as sandboxSkillFile, I as sandboxSkillPathResolution, M as SANDBOX_SKILLS_ROOT, N as SANDBOX_WORKSPACE_ROOT, O as withLock, P as sandboxSkillDir, _ as workspaceSnapshotNotReadyUserMessage, a as isAbortError, b as buildNonInteractiveShellScript, c as isSandboxCommandStreamInterruptedError, d as isSnapshottingError, f as throwSandboxOperationError, g as isWorkspaceSnapshotNotReadyError, h as getWorkspaceSnapshotNotReadyError, i as ensureDockerDaemon, j as SANDBOX_REPOS_ROOT, k as sleep, l as isSandboxMissingError, m as WorkspaceSnapshotNotReadyError, n as hash, o as isAlreadyExistsError, p as wrapSandboxSetupError, r as isStale, s as isSandboxApiTransientError, t as create, u as isSandboxUnavailableError, v as getVercelSandboxCredentials, w as getStateAdapter, x as runNonInteractiveCommand, y as buildCommandScript } from "./profile-h-72wM78.js";
-import { n as canReusePendingAuthLink, t as abandonReplacedPendingAuth } from "./pending-auth-s_QFribU.js";
-import { c as isTurnInputCommitLostError, i as TurnInputCommitLostError, r as CooperativeTurnYieldError, t as authorizationId } from "./oauth-authorization-BA4Dt6a7.js";
-import { a as isNoReplyMarker, i as NO_REPLY_MARKER, n as getAssistantReplyText, r as sanitizeAssistantText, t as decideReply } from "./assistant-reply-CbTPebzL.js";
-import { C as pluginSupportsEvent, D as requireEventIdentifier, E as registeredResourceTypeSchema, L as readAutomationResult, N as FINISH_AUTOMATION_RUN_TOOL_NAME, O as requireSupportedEventMatch, P as automationResultSchema, R as remindMissingAutomationResult, S as hasEventCatalogEntries, T as registeredEventTypeSchema, _ as workspaceSnapshotFinishedEvent, d as requireSlackChannelMessageScope, g as WORKSPACE_SNAPSHOT_READY_EVENT, h as WORKSPACE_SNAPSHOT_FAILED_EVENT, l as getEventCatalog, n as markConversationsStopped, o as enqueueEventNotification, t as getConversationStoppedAtMs, v as workspaceSnapshotWatch, w as registeredEventMatchSchema, x as eventNamespaceSchema, y as automationEventCatalog } from "./session-stop-CQjKd4a2.js";
-import { i as isValidTimeZone, r as getZonedDateTimeParts } from "./cadence-D00SCzT1.js";
-import { a as createSandboxSession, c as postinstall, d as getSandboxResources, i as bindSandboxFileSystem, l as setSnapshotSpanAttributes, n as isMissingError, o as stopSession, r as resolve$1, s as dependencies } from "./resolve-ncQPZROQ.js";
-import { a as getVercelConversationWorkQueue, f as getTurnRequestDeadline, n as sendNextWorkspaceSnapshotJob, r as sendWorkspaceSnapshotJob } from "./job-queue-B6SV9uVa.js";
-import { E as stopConversationWork } from "./store-DXFIQy-G.js";
-import { F as taskOutcomeInputSchema, M as compileScheduleIntent, N as scheduleIntentSchema, O as automationInstructionToolSchema, T as SCHEDULED_AUTOMATION_SYSTEM_ACTOR, j as ScheduleIntentError, k as automationTitleSchema } from "./automation-CHdlHVZP.js";
-import { r as isExperimentalFeatureEnabled } from "./experimental-CQIvMUO7.js";
-import { n as privateTraceResultAttributes } from "./private-trace-result-BLvBjy_e.js";
+import { S as resolveGatewayCredential, _ as getProviderErrorAttributes, a as completeText, b as MISSING_GATEWAY_CREDENTIALS_ERROR, c as COMPACTION_SUMMARY_PREFIX, d as renderCurrentInstruction, f as unwrapCurrentInstruction, g as findProviderError, h as createProviderError, i as completeObject, l as hasCompactedConversationContext, m as ProviderError, n as GEN_AI_SERVER_ADDRESS, p as escapeXml, s as resolveGatewayModel, t as GEN_AI_PROVIDER_NAME, u as isCompactionSummaryText, x as getGatewayApiKey, y as isProviderRetryError } from "./client-BZdxgKyL.js";
+import { R as normalizeIdentityEmail, S as summarizeMessageText, T as withSpan, V as toOptionalString, _ as serializeGenAiAttribute, a as extractGenAiUsageSummary, b as setSpanStatus, c as getLogContextAttributesForSpan, d as logError, f as logException, h as normalizeGenAiFinishReason, i as extractGenAiUsageAttributes, l as getTracePropagationHeaders, m as logWarn, p as logInfo, u as logAudit, w as withLogContext, x as setTags, y as setSpanAttributes, z as isRecord$4 } from "./logging-BStXN56b.js";
+import { m as startInactiveSpan, v as withActiveSpan } from "./sentry-BBUlHih9.js";
+import { a as toCanonicalInputMessage, c as toGenAiPayloadMetadata, i as runWithConversationPrivacy, l as toGenAiPayloadTraceAttributes, o as toCanonicalOutputMessage, r as resolveConversationPrivacy, s as toGenAiMessagesTraceAttributes, t as canExposeConversationPayload } from "./conversation-privacy-CFhNKxp-.js";
+import { n as botConfig, v as normalizeSlackEmojiName } from "./config-Deqpfpg9.js";
+import { a as formatModelProfiles, c as profileConfig, i as formatModelProfile, l as TURN_REASONING_LEVELS, n as ModelProfileNotConfiguredError, o as modelIdForProfile, s as modelProfileSchema } from "./model-profile-Bg8EoCKD.js";
+import { a as isUserActor, d as parseSlackTeamId, f as parseSlackUserId, g as parseSlackMessageTs, l as parseSlackChannelId, u as parseSlackChannelReferenceId } from "./actor-tlxzqaRe.js";
+import { C as addAgentTurnUsage, D as hasAgentTurnUsage, R as parseDestination, c as getConversationEventStore, d as getDb, f as getSqlExecutor, l as getConversationMessageSearchStore, r as readActorIdentity, u as getConversationStore, w as agentTurnCostUsd } from "./viewer-B2_ABsYi.js";
+import { a as juniorAgentInvocations, c as juniorIdentities, d as juniorDestinations, i as juniorAgentBindings, n as AGENT_INVOCATION_PARENT_MAILBOX_STATUSES, s as juniorConversations, t as AGENT_INVOCATION_MAILBOX_STATUSES } from "./agent-invocations-Qfz7dWgU.js";
+import { _ as juniorConversationAnnotations, a as juniorAutomationRuns, b as juniorAttachments, c as juniorStats, f as juniorConversationBriefs, x as juniorArtifacts } from "./executor-Bb3eQb8q.js";
+import { d as contextProvenance, f as instructionActors, m as sameActorIdentity, p as instructionProvenanceFor, t as KNOWN_CONVERSATION_EVENT_TYPES, u as agentInstructionProvenance } from "./history-AY8rs-FR.js";
+import { a as listReferenceFiles, c as soulPathCandidates, l as worldPathCandidates } from "./package-discovery-DJBompdd.js";
+import { _ as CredentialUnavailableError, a as resolveAuthTokenPlaceholder, c as fetchWithBoundedOAuthErrorBodies, d as actorLogContext, f as credentialContextForActor, g as credentialUserSubjectId, i as resolvePluginHeaderEnvRefs, l as getOAuthProviderErrorAttributes, o as resolvePluginCommandEnv, p as credentialContextSchema, s as OAuthProviderError } from "./registry-B_M_x_iS.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-B8SuFPGb.js";
+import { a as parseSkillInvocation, i as parseSkillFile, n as findSkillByName, r as loadSkillsByName, t as discoverSkills } from "./skills-CiWS5_Ub.js";
+import { A as escapeSlackMrkdwnText, B as postSlackMessage, Ct as ToolInputError, Dt as loadConversationProjection, Et as loadConnectedMcpProviders, G as continuableMessages, H as uploadFilesToConversation, Ht as recordTurnRoute, I as addReactionToMessage, K as loadTurnCheckpoint, L as getSlackMessagePermalink, Lt as recordAuthorizationRequested, Mt as openConversationProjection, Nt as recordAgentsInstructionsUpdated, O as automationRevision, Ot as loadLastModelProfile, P as slackMention, Pt as recordAttachmentsDelivered, R as openSlackDirectMessage, Rt as recordGuardianActionReviewed, St as TURN_CONTEXT_TAG, Vt as recordToolExecutionStarted, Xt as fallbackShortTitle, Zt as resolveTaskTitle, _t as isToolResultMessage, a as saveScheduledAutomation, bt as stripRuntimeTurnContext, ct as extractAssistantText, d as createEventAutomation, dn as getAgentContextInputLimitTokens, dt as getUserMessageInstructionText, f as deleteEventAutomation, fn as historyItemFromPiMessage, ft as hasRuntimeTurnContext, g as listEventAutomationsForTeam, gt as isToolResultError, ht as isContinuablePiBoundary, i as readScheduledAutomation, it as TurnToolCallLimitExceededError, j as formatSlackLink, jt as loadTurnRoute, ln as estimateTextTokens, lt as getPiMessageRole, m as getEventAutomation, mt as isAssistantMessage, n as listScheduledAutomationsForTeam, nt as TurnBudgetExceededError, ot as createTurnLimitGate, pn as piMessageFromHistoryItem, q as saveTurnCheckpoint, rt as TurnSliceLimitExceededError, st as isTurnExecutionLimitExceededError, t as createScheduledAutomation, tt as TURN_LIMIT_DISABLED_REASON, un as getAgentContextCompactionTriggerTokens, ut as getTerminalAssistantMessages, v as saveEventAutomation, vt as normalizeToolNameFromResult, xt as trimTrailingAssistantMessages, y as setEventAutomationStatus, yt as retainRuntimeTurnContext, z as postSlackEphemeralMessage, zt as recordMcpProviderConnected } from "./tasks-DieKX3d4.js";
+import { A as getWorkspaceSnapshotBuilder, B as STOP_WATCHING_TOOL_NAME, Bt as getFilePermalink, C as WorkspaceValidationError, D as setWorkspaceSnapshotBuild, Dt as matchSlackAttachments, E as setWorkspaceSnapshot, F as isSlackMessageTurn, Ft as defaultTimezone, G as createWatch, Gt as normalizeSlackConversationId, H as cancelWatch, Ht as getSlackClient, I as slackMessageTurnDisabledReason, It as resolveUserTimezone, J as getWatch, K as deliverWatch, L as RESOURCE_SUBSCRIPTION_DEFAULT_TTL_MS, M as workspaceRepoCheckoutPath, Mt as createPluginAnnotations, N as resolveChannelCapabilities, O as SANDBOX_RUNTIME, P as getSlackToolContext, R as RESOURCE_SUBSCRIPTION_MAX_TTL_MS, Rt as SlackActionError, S as updateWorkspace, T as loadSnapshotsForProfile, Ut as isConversationScopedChannel, V as cancelSubscriptions, W as createTimerWatch, Wt as isDmChannel$1, Xt as JUNIOR_NATIVE_EVENT_NAMESPACE, Y as listWatches, _ as deleteWorkspace, at as getDashboardConversationLink, b as listWorkspaces, c as getPluginTools, en as conversationNoteEvent, ft as createPluginLogger, g as createWorkspace, j as tryWorkspaceRepoCheckoutPath, jt as saveObjectAnnotations, k as deleteWorkspaceSnapshotBuilders, l as getPluginUserPromptContributions, q as findMatchingWatches, qt as withSlackRetries, r as createPluginHookRunner, s as getPluginSystemPromptContributions, st as getDashboardTaskLink, u as getPlugins, v as getWorkspace, w as invalidateReadySnapshot, y as getWorkspaceByName, z as RESOURCE_WATCH_TOOL_SOURCE, zt as downloadPrivateSlackFile } from "./agent-hooks-B00FaKdP.js";
+import { B as briefLinkSchema, H as conversationBriefSchema, J as removedCardSchema, L as detectImageMediaType, R as isVisionImageMediaType, V as briefOutcomeStatusSchema } from "./conversation-DjN3mlog.js";
+import { C as SANDBOX_DATA_ROOT, D as sandboxSkillDir, E as SANDBOX_WORKSPACE_ROOT, O as sandboxSkillFile, S as sleep, T as SANDBOX_SKILLS_ROOT, _ as workspaceSnapshotNotReadyUserMessage, a as isAbortError, b as buildNonInteractiveShellScript, c as isSandboxCommandStreamInterruptedError, d as isSnapshottingError, f as throwSandboxOperationError, g as isWorkspaceSnapshotNotReadyError, h as getWorkspaceSnapshotNotReadyError, i as ensureDockerDaemon, k as sandboxSkillPathResolution, l as isSandboxMissingError, m as WorkspaceSnapshotNotReadyError, n as hash, o as isAlreadyExistsError, p as wrapSandboxSetupError, r as isStale, s as isSandboxApiTransientError, t as create, u as isSandboxUnavailableError, v as getVercelSandboxCredentials, w as SANDBOX_REPOS_ROOT, x as runNonInteractiveCommand, y as buildCommandScript } from "./profile-qBM6B_-V.js";
+import { n as canReusePendingAuthLink, t as abandonReplacedPendingAuth } from "./pending-auth-rG5U_QS1.js";
+import { c as isTurnInputCommitLostError, i as TurnInputCommitLostError, r as CooperativeTurnYieldError, t as authorizationId } from "./oauth-authorization-djQn5Nhy.js";
+import { a as isNoReplyMarker, i as NO_REPLY_MARKER, n as getAssistantReplyText, r as sanitizeAssistantText, t as decideReply } from "./assistant-reply-CqthTerd.js";
+import { C as pluginSupportsEvent, D as requireEventIdentifier, E as registeredResourceTypeSchema, L as readAutomationResult, N as FINISH_AUTOMATION_RUN_TOOL_NAME, O as requireSupportedEventMatch, P as automationResultSchema, R as remindMissingAutomationResult, S as hasEventCatalogEntries, T as registeredEventTypeSchema, _ as workspaceSnapshotFinishedEvent, d as requireSlackChannelMessageScope, g as WORKSPACE_SNAPSHOT_READY_EVENT, h as WORKSPACE_SNAPSHOT_FAILED_EVENT, l as getEventCatalog, n as markConversationsStopped, o as enqueueEventNotification, t as getConversationStoppedAtMs, v as workspaceSnapshotWatch, w as registeredEventMatchSchema, x as eventNamespaceSchema, y as automationEventCatalog } from "./session-stop-CV65ZlU3.js";
+import { a as acquireActiveLock, o as fenceLock, r as getStateAdapter, s as withLock } from "./adapter-Bn0gFVSF.js";
+import { i as isValidTimeZone, r as getZonedDateTimeParts } from "./cadence-R7Em4RjE.js";
+import { a as createSandboxSession, c as postinstall, d as getSandboxResources, i as bindSandboxFileSystem, l as setSnapshotSpanAttributes, n as isMissingError, o as stopSession, r as resolve$1, s as dependencies } from "./resolve-BzpuLh8c.js";
+import { a as getVercelConversationWorkQueue, f as getTurnRequestDeadline, n as sendNextWorkspaceSnapshotJob, r as sendWorkspaceSnapshotJob } from "./job-queue-vdGU-5ge.js";
+import { E as stopConversationWork } from "./store-B1GES4gC.js";
+import { _ as getMcpProviderErrorAttributes, a as serviceAccountOnly, c as createMcpServiceAccountClientProvider, d as PluginMcpClient, f as McpProviderError, g as getMcpAwareTelemetryMessage, h as getMcpAwareErrorType, i as serviceAccountAllows, l as getMcpServiceAccountCredentials, m as McpToolError, p as McpServiceAccountRequiredError, u as McpAuthorizationRequiredError, v as toMcpProviderError } from "./service-account-BzhW7kXu.js";
+import { F as taskOutcomeInputSchema, M as compileScheduleIntent, N as scheduleIntentSchema, O as automationInstructionToolSchema, T as SCHEDULED_AUTOMATION_SYSTEM_ACTOR, j as ScheduleIntentError, k as automationTitleSchema } from "./automation-DWBFBenG.js";
+import { r as isExperimentalFeatureEnabled } from "./experimental-BNK1l1jv.js";
+import { n as privateTraceResultAttributes } from "./private-trace-result-CE7_lEdq.js";
 import { streamSimple } from "@earendil-works/pi-ai/compat";
 import { createGatewayProvider } from "@ai-sdk/gateway";
 import { generateText } from "ai";
 import path from "node:path";
 import { isDeepStrictEqual } from "node:util";
-import { AsyncLocalStorage } from "node:async_hooks";
 import { z } from "zod";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { and, asc, count, countDistinct, desc, eq, gt, gte, inArray, isNotNull, isNull, lt, lte, ne, notExists, or, sql } from "drizzle-orm";
@@ -47,9 +48,7 @@ import { Kind } from "@sinclair/typebox";
 import { Sandbox } from "@vercel/sandbox";
 import { Bash, defineCommand } from "just-bash";
 import { structuredPatch } from "diff";
-import { Client } from "@modelcontextprotocol/sdk/client";
-import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
-import { StreamableHTTPClientTransport, StreamableHTTPError } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import dns from "node:dns/promises";
 import http from "node:http";
 import https from "node:https";
@@ -57,7 +56,7 @@ import net from "node:net";
 import { NodeHtmlMarkdown } from "node-html-markdown";
 import { Value } from "@sinclair/typebox/value";
 import { SignJWT, importPKCS8 } from "jose";
-//#region src/chat/configuration/defaults.ts
+// src/chat/configuration/defaults.ts
 let installDefaults = {};
 function cloneDefaults(defaults) {
 	return structuredClone(defaults);
@@ -78,8 +77,7 @@ function setConfigDefaults(defaults) {
 function getConfigDefaults() {
 	return cloneDefaults(installDefaults);
 }
-//#endregion
-//#region src/chat/sandbox/skill-sandbox.ts
+// src/chat/sandbox/skill-sandbox.ts
 const MAX_SKILL_FILE_BYTES = 262144;
 const DEFAULT_MAX_SKILL_FILE_CHARS = 2e4;
 const DEFAULT_MAX_SKILL_LIST_ENTRIES = 200;
@@ -219,12 +217,12 @@ var SkillSandbox = class {
 		}
 		const active = this.getActiveSkill();
 		if (active) return active;
-		if (this.loadedSkills.size === 1) return [...this.loadedSkills.values()][0];
+		const [onlySkill, ...otherSkills] = this.loadedSkills.values();
+		if (onlySkill && otherSkills.length === 0) return onlySkill;
 		throw new Error("No active skill is loaded. Call loadSkill first or pass skill_name explicitly.");
 	}
 };
-//#endregion
-//#region src/chat/tools/sandbox/file-utils.ts
+// src/chat/tools/sandbox/file-utils.ts
 const MAX_TEXT_CHARS = 6e4;
 const RIPGREP_EXCLUDED_GLOBS = ["!**/.git/**", "!**/node_modules/**"];
 const DEFAULT_SEARCH_COMMAND_TIMEOUT_MS = 3e4;
@@ -269,7 +267,7 @@ function escapeRegExp(value) {
 function globToRegExp(pattern) {
 	let source = "";
 	for (let index = 0; index < pattern.length; index += 1) {
-		const char = pattern[index];
+		const char = pattern.charAt(index);
 		const next = pattern[index + 1];
 		if (char === "*" && next === "*") {
 			if (pattern[index + 2] === "/") {
@@ -390,8 +388,7 @@ async function collectFiles(params) {
 		missingRoot: missingPath === params.root
 	};
 }
-//#endregion
-//#region src/chat/repository-instructions.ts
+// src/chat/repository-instructions.ts
 const AGENTS_FILENAME = "AGENTS.md";
 const MAX_REPOSITORY_INSTRUCTIONS_BYTES = 32768;
 /** Repository skill directories, in priority order, relative to the Git root. */
@@ -649,8 +646,7 @@ function findVisibleAgentsInstructions(messages) {
 		}
 	}
 }
-//#endregion
-//#region src/chat/agent/repository-context.ts
+// src/chat/agent/repository-context.ts
 function findRestoredInstructions(messages, provenance) {
 	const restoredContext = messages?.map((message, index) => ({
 		message,
@@ -691,8 +687,7 @@ function createRepositoryInstructionsContext(options) {
 		};
 	} };
 }
-//#endregion
-//#region src/chat/pi/traced-stream.ts
+// src/chat/pi/traced-stream.ts
 function attributeModeForPrivacy(conversationPrivacy) {
 	return conversationPrivacy === "public" ? "content" : "metadata";
 }
@@ -800,13 +795,11 @@ function createTracedStreamFn(baseOrOptions = streamSimple) {
 		}
 	};
 }
-//#endregion
-//#region src/chat/runtime/dev-agent-trace.ts
+// src/chat/runtime/dev-agent-trace.ts
 function shouldEmitDevAgentTrace() {
 	return process.env.NODE_ENV === "development";
 }
-//#endregion
-//#region src/chat/agent-invocations/blocked-report.ts
+// src/chat/agent-invocations/blocked-report.ts
 /** Blocked report of a child agent. See "Blocked Reports" in README.md. */
 /** Model-facing tool that ends a child agent run as blocked. */
 const REPORT_BLOCKED_TOOL_NAME = "reportBlocked";
@@ -825,8 +818,7 @@ function readBlockedReport(messages) {
 		if (parsed.success) return parsed.data;
 	}
 }
-//#endregion
-//#region src/chat/services/turn-result.ts
+// src/chat/services/turn-result.ts
 /** Process raw agent messages into a structured AgentRunResult. */
 function buildTurnResult(input) {
 	if (input.requireAutomationResult) return buildAutomationTurnResult(input);
@@ -939,8 +931,7 @@ function buildAutomationTurnResult(input) {
 		})
 	};
 }
-//#endregion
-//#region src/chat/services/provider-retry.ts
+// src/chat/services/provider-retry.ts
 const PROVIDER_RETRY_DELAYS_MS = [
 	2e3,
 	4e3,
@@ -965,8 +956,7 @@ function nextProviderRetry(args) {
 		providerError
 	};
 }
-//#endregion
-//#region src/chat/services/empty-output-continuation.ts
+// src/chat/services/empty-output-continuation.ts
 /**
 * Decide whether empty assistant output gets one continuation after a
 * history replacement.
@@ -987,8 +977,7 @@ function nextEmptyOutputContinuation(args) {
 		messages
 	} : { kind: "exhausted" };
 }
-//#endregion
-//#region src/chat/agent/retry-usage.ts
+// src/chat/agent/retry-usage.ts
 /**
 * Return usage discarded when a retry keeps an exact prefix of agent history.
 *
@@ -999,8 +988,7 @@ function getDiscardedRetryUsage(messages, retryMessages) {
 	const usage = extractGenAiUsageSummary(...messages.slice(retryMessages.length).filter(isAssistantMessage));
 	return hasAgentTurnUsage(usage) ? usage : void 0;
 }
-//#endregion
-//#region src/chat/tool-support/structured-result.ts
+// src/chat/tool-support/structured-result.ts
 const juniorToolContinuationSchema = z.object({
 	arguments: z.record(z.string(), z.unknown()),
 	reason: z.string().min(1).optional()
@@ -1042,8 +1030,7 @@ function makeStructuredToolOutput(details, options = {}) {
 		details
 	};
 }
-//#endregion
-//#region src/chat/tool-support/timed-out-tool-result.ts
+// src/chat/tool-support/timed-out-tool-result.ts
 /**
 * Project a host-preempted tool attempt onto the normal tool-result shape.
 *
@@ -1068,8 +1055,7 @@ function projectTimedOutToolResult(result) {
 		isError: false
 	};
 }
-//#endregion
-//#region src/chat/services/turn-router.ts
+// src/chat/services/turn-router.ts
 const CLASSIFIER_CONFIDENCE_THRESHOLD = .75;
 const MAX_ROUTER_CONTEXT_CHARS = 8e3;
 const ROUTER_CONTEXT_HEAD_CHARS = 3e3;
@@ -1304,8 +1290,7 @@ function toPiReasoningLevel(level) {
 		case "xhigh": return "xhigh";
 	}
 }
-//#endregion
-//#region src/chat/services/auth-pause.ts
+// src/chat/services/auth-pause.ts
 /**
 * Runtime-owned signal that the current turn must park until the user
 * completes an external authorization step.
@@ -1344,8 +1329,7 @@ var AuthorizationFlowDisabledError = class extends Error {
 		this.provider = provider;
 	}
 };
-//#endregion
-//#region src/chat/tools/definition.ts
+// src/chat/tools/definition.ts
 /** Distinguish legacy TypeBox schemas from JSON Schema projected from Zod. */
 function isTypeBoxInputSchema(schema) {
 	return typeof schema === "object" && schema !== null && Kind in schema;
@@ -1367,8 +1351,7 @@ function disableTools(tools, reason) {
 		disabledReason: reason
 	}]));
 }
-//#endregion
-//#region src/chat/agent/types.ts
+// src/chat/agent/types.ts
 /** Resume the agent turn after a transient or ambiguous delivery failure. */
 var RetryableDeliveryError = class extends Error {
 	constructor(cause) {
@@ -1434,8 +1417,7 @@ function surfaceFromRun(run) {
 	if (run.source.kind === "web") return "api";
 	return "internal";
 }
-//#endregion
-//#region src/chat/tool-support/action-review-history.ts
+// src/chat/tool-support/action-review-history.ts
 const MAX_VISIBLE_HISTORY_CHARS = 12e3;
 const priorRejectionSchema = z.object({
 	decision: z.enum(["ask", "deny"]),
@@ -1537,8 +1519,7 @@ function restoreToolActionRejections(messages) {
 	}
 	return priorRejections;
 }
-//#endregion
-//#region src/chat/agent/action-confirmation-retry.ts
+// src/chat/agent/action-confirmation-retry.ts
 const RUN_ENDING_TOOL_NAMES = /* @__PURE__ */ new Set([FINISH_AUTOMATION_RUN_TOOL_NAME, REPORT_BLOCKED_TOOL_NAME]);
 function endsRun(message) {
 	return isToolResultMessage(message) && !isToolResultError(message) && RUN_ENDING_TOOL_NAMES.has(normalizeToolNameFromResult(message) ?? "");
@@ -1567,8 +1548,7 @@ function actionConfirmationRetryMessages(messages) {
 	if (getPiMessageRole(retryMessages.at(-1)) !== "toolResult") return;
 	return retryMessages;
 }
-//#endregion
-//#region src/chat/tool-support/action-review.ts
+// src/chat/tool-support/action-review.ts
 /**
 * Owns the execution gate for reviewable tool actions.
 *
@@ -1843,8 +1823,7 @@ async function reviewToolAction(toolCallId, toolName, tool, input, review, signa
 	if (!review) throw new ToolActionReviewUnavailableError();
 	return review.review(toolCallId, toolName, tool, input, signal);
 }
-//#endregion
-//#region src/chat/agent/skills.ts
+// src/chat/agent/skills.ts
 /** Run-scoped skill discovery and explicit invocation. */
 let startupDiscoveryLogged = false;
 /** Upsert a skill into the active skills list by name. */
@@ -1894,8 +1873,7 @@ async function loadRunSkill(args) {
 	if (loadedSkill) upsertActiveSkill(args.activeSkills, loadedSkill);
 	return loadedSkill;
 }
-//#endregion
-//#region src/chat/prompt.ts
+// src/chat/prompt.ts
 /**
 * Prompt assembly.
 *
@@ -2378,8 +2356,7 @@ function buildTurnContextPrompt(params) {
 		`</${TURN_CONTEXT_TAG}>`
 	].filter((section) => Boolean(section)).join("\n\n");
 }
-//#endregion
-//#region src/chat/conversations/notes.ts
+// src/chat/conversations/notes.ts
 /**
 * Conversation notes: short facts that core attaches to a Conversation without
 * starting a Turn. The next Turn shows them to the model in its runtime turn
@@ -2436,8 +2413,7 @@ async function loadTurnConversationNotes(input) {
 	}
 	return newestFirst.reverse();
 }
-//#endregion
-//#region src/chat/agent/prompt.ts
+// src/chat/agent/prompt.ts
 /**
 * Per-run prompt assembly.
 *
@@ -2812,8 +2788,7 @@ async function assemblePrompt(args) {
 		userContentParts
 	};
 }
-//#endregion
-//#region src/chat/capabilities/router.ts
+// src/chat/capabilities/router.ts
 var ProviderCredentialRouter = class {
 	brokersByProvider;
 	constructor(input) {
@@ -2828,11 +2803,9 @@ var ProviderCredentialRouter = class {
 		});
 	}
 };
-//#endregion
-//#region src/chat/credentials/user-token-store.ts
+// src/chat/credentials/user-token-store.ts
 const storedTokensSchema = pluginStoredTokensSchema;
-//#endregion
-//#region src/chat/credentials/state-adapter-token-store.ts
+// src/chat/credentials/state-adapter-token-store.ts
 const KEY_PREFIX = "oauth-token";
 const BUFFER_MS = 864e5;
 const LONG_LIVED_TTL_MS = 31536e6;
@@ -2878,8 +2851,7 @@ var StateAdapterTokenStore = class {
 		}
 	}
 };
-//#endregion
-//#region src/chat/capabilities/factory.ts
+// src/chat/capabilities/factory.ts
 const sandboxEgressRouters = /* @__PURE__ */ new WeakMap();
 /** Create the user token store used by OAuth-backed credential brokers. */
 function createUserTokenStore() {
@@ -2907,8 +2879,7 @@ function getSandboxEgressRouter() {
 async function issueProviderCredentialLease(input) {
 	return await getSandboxEgressRouter().issue(input);
 }
-//#endregion
-//#region src/chat/capabilities/jr-rpc-command.ts
+// src/chat/capabilities/jr-rpc-command.ts
 function commandResult(input) {
 	let stdout = "";
 	if (typeof input.stdout === "string") stdout = input.stdout;
@@ -2941,7 +2912,7 @@ function parsePrefixFlag(extras) {
 			...prefix ? { prefix } : void 0
 		};
 	}
-	if (extras.length === 1 && extras[0].startsWith("--prefix=")) {
+	if (extras.length === 1 && extras[0]?.startsWith("--prefix=")) {
 		const prefix = extras[0].slice(9).trim();
 		return {
 			ok: true,
@@ -3163,8 +3134,7 @@ async function maybeExecuteJrRpcCustomCommand(command, deps) {
 		}
 	};
 }
-//#endregion
-//#region src/chat/sandbox/command-result.ts
+// src/chat/sandbox/command-result.ts
 /** Format one shell command outcome as Junior's structured tool result. */
 function formatSandboxCommandResult(params) {
 	return makeStructuredToolOutput({
@@ -3184,8 +3154,7 @@ function formatSandboxCommandResult(params) {
 		...params.permission_denied ? { permission_denied: params.permission_denied } : void 0
 	});
 }
-//#endregion
-//#region src/chat/slack/oauth-authorization-message.ts
+// src/chat/slack/oauth-authorization-message.ts
 const ACCOUNT_SCOPE_NOTE = "This connects only your account. Junior sees only what you can see.";
 /** Present private OAuth authorization with a clear action and text fallback. */
 function buildSlackOAuthAuthorizationMessage(args) {
@@ -3210,8 +3179,7 @@ function buildSlackOAuthAuthorizationMessage(args) {
 		}]
 	};
 }
-//#endregion
-//#region src/chat/oauth-flow.ts
+// src/chat/oauth-flow.ts
 const OAUTH_STATE_TTL_MS = 6e5;
 function optionalString(value) {
 	return typeof value === "string" ? value : void 0;
@@ -3377,8 +3345,7 @@ async function startOAuthFlow(provider, input) {
 		})
 	};
 }
-//#endregion
-//#region src/chat/sandbox/egress/schemas.ts
+// src/chat/sandbox/egress/schemas.ts
 const finiteNumberSchema = z.number().refine(Number.isFinite);
 const httpStatusSchema = z.number().int().min(100).max(599);
 const providerNameSchema = z.string().regex(/^[a-z][a-z0-9-]*$/);
@@ -3441,8 +3408,7 @@ function parseSandboxEgressPermissionDeniedSignal(value) {
 	const result = sandboxEgressPermissionDeniedSignalSchema.safeParse(value);
 	return result.success ? result.data : void 0;
 }
-//#endregion
-//#region src/chat/sandbox/egress/session.ts
+// src/chat/sandbox/egress/session.ts
 const SANDBOX_EGRESS_PROXY_PATH = "/api/internal/sandbox-egress";
 const SANDBOX_EGRESS_TOKEN_VERSION = "v1";
 const SANDBOX_EGRESS_HMAC_CONTEXT = "junior.sandbox_egress.v1";
@@ -3650,8 +3616,7 @@ async function consumeSandboxEgressPermissionDeniedSignal(egressId) {
 	await Promise.all([state.delete(permissionSignalKey(egressId, "read")), state.delete(permissionSignalKey(egressId, "write"))]);
 	return signal;
 }
-//#endregion
-//#region src/chat/sandbox/egress/tracing.ts
+// src/chat/sandbox/egress/tracing.ts
 function isValidDomainPattern(domain) {
 	if (domain.includes("*")) return domain.startsWith("*.") && domain.indexOf("*", 1) === -1;
 	return true;
@@ -3679,8 +3644,7 @@ function shouldPropagateSandboxEgressTrace(host, config = {}) {
 		return domain === normalizedHost;
 	});
 }
-//#endregion
-//#region src/chat/sandbox/egress/policy.ts
+// src/chat/sandbox/egress/policy.ts
 /** Return whether an outbound host is covered by a provider domain rule. */
 function matchesSandboxEgressDomain(host, domain) {
 	return host.toLowerCase() === domain.toLowerCase();
@@ -3749,8 +3713,7 @@ async function resolveSandboxCommandEnvironment() {
 	}
 	return env;
 }
-//#endregion
-//#region src/chat/sandbox/prepare-workspace.ts
+// src/chat/sandbox/prepare-workspace.ts
 const WORKSPACE_SETUP_FAILURE_OUTPUT_MAX_CHARS = 7e3;
 const WORKSPACE_SETUP_FAILURE_TRUNCATION_MARKER = "[earlier setup output truncated]\n";
 const WORKSPACE_SETUP_NODE_OPTIONS = "--max-old-space-size=4096";
@@ -3830,8 +3793,7 @@ async function prepareWorkspaceSnapshot(params) {
 	});
 	if (result.exitCode !== 0) throw new Error(`Workspace setup failed: ${workspaceSetupFailureDetail(result)}`);
 }
-//#endregion
-//#region src/chat/events/people.ts
+// src/chat/events/people.ts
 const linkedSlackIdentity$1 = alias(juniorIdentities, "event_people_slack");
 function personKey(person) {
 	return "email" in person ? `email:${normalizeIdentityEmail(person.email)}` : `${person.provider}:${person.handle.toLowerCase()}`;
@@ -3876,8 +3838,7 @@ async function resolveEventPeopleMentions(people, slackTeamId) {
 	}
 	return mentions;
 }
-//#endregion
-//#region src/chat/events/ingest.ts
+// src/chat/events/ingest.ts
 /** Match a normalized event and enqueue notifications into conversations. */
 async function ingestEvent(input, options) {
 	const event = eventSchema.parse(input);
@@ -3929,8 +3890,7 @@ async function ingestEvent(input, options) {
 	if (errors.length > 0) throw new AggregateError(errors, "Failed to deliver one or more watches");
 	return { enqueued };
 }
-//#endregion
-//#region src/chat/sandbox/snapshot/workspace.ts
+// src/chat/sandbox/snapshot/workspace.ts
 const BUILD_TIMEOUT_MS = 36e5;
 const BUILD_TIMEOUT_ERROR = "Workspace snapshot build timed out after 1 hour";
 const BUILD_LOCK_TTL_MS = 12e4;
@@ -4312,8 +4272,7 @@ async function resolveWorkspaceSnapshot(params) {
 		await sleep(WAIT_POLL_MS, params.signal);
 	}
 }
-//#endregion
-//#region src/chat/sandbox/snapshot/job-runner.ts
+// src/chat/sandbox/snapshot/job-runner.ts
 /** Build Workspace snapshots in a background job. */
 const SNAPSHOT_BUILD_SYSTEM_ACTOR = {
 	platform: "system",
@@ -4437,8 +4396,7 @@ async function ensureWorkspaceSnapshotBuild(input) {
 	else await sendWorkspaceSnapshotJob(message);
 	return "building";
 }
-//#endregion
-//#region src/chat/sandbox/skill-sync.ts
+// src/chat/sandbox/skill-sync.ts
 const DIRECTORY_CREATE_CONCURRENCY = 8;
 function toPosixRelative(base, absolute) {
 	return path.relative(base, absolute).split(path.sep).join("/");
@@ -4567,8 +4525,7 @@ async function syncSkillsToSandbox(params) {
 		});
 	});
 }
-//#endregion
-//#region src/chat/sandbox/session.ts
+// src/chat/sandbox/session.ts
 const DEFAULT_MAX_OUTPUT_LENGTH = 3e4;
 const DEFAULT_BASH_COMMAND_TIMEOUT_MS = 3e5;
 const SANDBOX_RUNTIME_BIN_DIR = `${SANDBOX_WORKSPACE_ROOT}/.junior/bin`;
@@ -5158,8 +5115,7 @@ function createSandboxRuntime(options) {
 		}
 	};
 }
-//#endregion
-//#region src/chat/tools/sandbox/text-edits.ts
+// src/chat/tools/sandbox/text-edits.ts
 const MAX_DIFF_LINE_CHARS = 4e3;
 /** Preserve a text artifact's dominant line-ending style across rewrites. */
 function detectLineEnding(value) {
@@ -5279,8 +5235,7 @@ function validateAndApplyTextEdits(content, edits, targetName) {
 		};
 	});
 	const matchedEdits = [];
-	for (let index = 0; index < normalizedEdits.length; index += 1) {
-		const edit = normalizedEdits[index];
+	for (const [index, edit] of normalizedEdits.entries()) {
 		const matchIndex = content.indexOf(edit.oldText);
 		if (matchIndex === -1) throw new ToolInputError(`Could not find edits[${index}] in ${targetName}. oldText must match exactly including whitespace and newlines.`);
 		const occurrences = countOccurrences(content, edit.oldText);
@@ -5293,24 +5248,20 @@ function validateAndApplyTextEdits(content, edits, targetName) {
 		});
 	}
 	matchedEdits.sort((a, b) => a.matchIndex - b.matchIndex);
-	for (let index = 1; index < matchedEdits.length; index += 1) {
+	for (const [index, current] of matchedEdits.entries()) {
 		const previous = matchedEdits[index - 1];
-		const current = matchedEdits[index];
+		if (!previous) continue;
 		if (previous.matchIndex + previous.matchLength > current.matchIndex) throw new ToolInputError(`edits[${previous.editIndex}] and edits[${current.editIndex}] overlap in ${targetName}. Merge overlapping replacements into one edit.`);
 	}
 	let newContent = content;
-	for (let index = matchedEdits.length - 1; index >= 0; index -= 1) {
-		const edit = matchedEdits[index];
-		newContent = newContent.slice(0, edit.matchIndex) + edit.newText + newContent.slice(edit.matchIndex + edit.matchLength);
-	}
+	for (const edit of [...matchedEdits].reverse()) newContent = newContent.slice(0, edit.matchIndex) + edit.newText + newContent.slice(edit.matchIndex + edit.matchLength);
 	if (newContent === content) throw new ToolInputError(`No changes made to ${targetName}.`);
 	return {
 		baseContent: content,
 		newContent
 	};
 }
-//#endregion
-//#region src/chat/tool-support/zod-tool.ts
+// src/chat/tool-support/zod-tool.ts
 function isContentOnlyToolResult(value) {
 	return value !== null && typeof value === "object" && Array.isArray(value.content) && !("details" in value);
 }
@@ -5367,8 +5318,7 @@ function zodTool(definition) {
 		} } : void 0
 	};
 }
-//#endregion
-//#region src/chat/tools/sandbox/edit-file.ts
+// src/chat/tools/sandbox/edit-file.ts
 /** Accept common edit argument variants before Pi validates the canonical schema. */
 function prepareEditFileArguments(input) {
 	return prepareTextReplacementArguments(input);
@@ -5423,8 +5373,7 @@ function createEditFileTool() {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/sandbox/find-files.ts
+// src/chat/tools/sandbox/find-files.ts
 const DEFAULT_FIND_LIMIT = 100;
 /** Find workspace files with structured limits instead of ad hoc shell output. */
 async function findFiles(params) {
@@ -5571,8 +5520,7 @@ function createFindFilesTool() {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/sandbox/grep.ts
+// src/chat/tools/sandbox/grep.ts
 const DEFAULT_GREP_LIMIT = 100;
 const MAX_GREP_LINE_CHARS = 500;
 const booleanInput$2 = (description) => z.preprocess((value) => value === "true" ? true : value === "false" ? false : value, z.boolean()).describe(description);
@@ -5645,10 +5593,10 @@ async function grepFiles(params) {
 		const lines = normalizeToLf$1(content).split("\n");
 		const relativePath = files.length === 1 && filePath === root ? path.posix.basename(filePath) : path.posix.relative(root, filePath);
 		const matchedLines = [];
-		for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
+		for (const [lineIndex, line] of lines.entries()) {
 			if (!lineMatches({
 				ignoreCase: params.ignoreCase,
-				line: lines[lineIndex],
+				line,
 				literal: params.literal,
 				pattern: params.pattern,
 				regex
@@ -5668,7 +5616,7 @@ async function grepFiles(params) {
 			for (let current = start; current <= end; current += 1) {
 				if (emittedLines.has(current)) continue;
 				emittedLines.add(current);
-				const truncated = truncateGrepLine(lines[current]);
+				const truncated = truncateGrepLine(lines[current] ?? "");
 				lineTruncated ||= truncated.truncated;
 				const separator = matchedLineSet.has(current) ? ":" : "-";
 				output.push(`${relativePath}${separator}${current + 1}${separator} ${truncated.line}`);
@@ -5850,8 +5798,7 @@ function createGrepTool() {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/sandbox/list-dir.ts
+// src/chat/tools/sandbox/list-dir.ts
 const DEFAULT_LIST_LIMIT = 500;
 /** List workspace directories without forcing the model through shell output. */
 async function listDir(params) {
@@ -5926,8 +5873,7 @@ function createListDirTool() {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tool-support/text-range-result.ts
+// src/chat/tool-support/text-range-result.ts
 const DEFAULT_READ_LIMIT = 1e3;
 const MAX_READ_CHARS = 6e4;
 function positiveInteger(value) {
@@ -6001,8 +5947,7 @@ function sliceFileContent(params) {
 function missingFileResult(path) {
 	throw new ToolInputError(`File not found: ${path}`);
 }
-//#endregion
-//#region src/chat/tools/sandbox/read-file.ts
+// src/chat/tools/sandbox/read-file.ts
 /** Create the sandbox read tool definition exposed to the agent. */
 function createReadFileTool() {
 	return zodTool({
@@ -6024,8 +5969,7 @@ function createReadFileTool() {
 		}
 	});
 }
-//#endregion
-//#region src/chat/sandbox/sandbox.ts
+// src/chat/sandbox/sandbox.ts
 /** Create the safe expected tool error for an unavailable sandbox operation. */
 function createSandboxUnavailableToolError(operation, cause) {
 	return new ToolInputError(`The temporary sandbox became unavailable during ${operation}, so the operation did not complete reliably. The next sandbox operation will use a fresh session. It may have produced side effects; retry only if it is safe.`, { cause });
@@ -6436,8 +6380,7 @@ function createSandbox(options) {
 		}
 	};
 }
-//#endregion
-//#region src/chat/tools/sandbox/file-uploads.ts
+// src/chat/tools/sandbox/file-uploads.ts
 /** Maximum single file size accepted by model-facing upload tools. */
 const MAX_SANDBOX_FILE_UPLOAD_BYTES = 10485760;
 /** Sandbox directory for generated files that later tools can consume. */
@@ -6539,8 +6482,7 @@ async function readSandboxFileUpload(workspace, input) {
 		path: targetPath
 	};
 }
-//#endregion
-//#region src/chat/tools/sandbox/generated-artifacts.ts
+// src/chat/tools/sandbox/generated-artifacts.ts
 async function fileUploadDataToBuffer(data) {
 	if (Buffer.isBuffer(data)) return data;
 	if (data instanceof ArrayBuffer) return Buffer.from(data);
@@ -6572,8 +6514,7 @@ async function writeSandboxGeneratedArtifacts(workspace, files) {
 	})));
 	return artifacts.map((artifact) => artifact.ref);
 }
-//#endregion
-//#region src/chat/tool-support/normalize-result.ts
+// src/chat/tool-support/normalize-result.ts
 function isToolContent(value) {
 	return Array.isArray(value) && value.every((part) => {
 		if (!part || typeof part !== "object") return false;
@@ -6714,8 +6655,7 @@ function normalizeToolResult(result, options = {}) {
 		details: normalized.details
 	};
 }
-//#endregion
-//#region src/chat/agent/sandbox.ts
+// src/chat/agent/sandbox.ts
 function record(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
@@ -6824,284 +6764,7 @@ function createAgentSandbox(options) {
 		}
 	};
 }
-//#endregion
-//#region src/chat/mcp/errors.ts
-/** Safe failure at an MCP network or OAuth boundary. */
-var McpProviderError = class extends Error {
-	phase;
-	provider;
-	missingSession;
-	resourceHost;
-	status;
-	constructor(details) {
-		super(`MCP provider ${details.phase.replace("_", " ")} failed`);
-		this.name = "McpProviderError";
-		this.phase = details.phase;
-		this.provider = details.provider;
-		this.missingSession = details.missingSession;
-		this.resourceHost = details.resourceHost;
-		this.status = details.status;
-	}
-};
-function providerStatus(error) {
-	if (!error || typeof error !== "object") return;
-	const value = error;
-	const status = typeof value.status === "number" ? value.status : typeof value.code === "number" ? value.code : void 0;
-	return status !== void 0 && status >= 100 && status <= 599 ? status : void 0;
-}
-/** Replace an external MCP failure without retaining its provider-controlled cause. */
-function toMcpProviderError(error, details) {
-	if (error instanceof McpProviderError) return error;
-	return new McpProviderError({
-		...details,
-		status: details.status ?? providerStatus(error)
-	});
-}
-/** Return safe MCP provider fields for logs and spans. */
-function getMcpProviderErrorAttributes(error) {
-	if (!(error instanceof McpProviderError)) return {};
-	return {
-		"app.credential.provider": error.provider,
-		"app.mcp.error.phase": error.phase,
-		...error.status !== void 0 ? { "http.response.status_code": error.status } : void 0,
-		...error.resourceHost ? { "server.address": error.resourceHost } : void 0
-	};
-}
-/** Thrown when an MCP failure should be returned as a model-visible tool error. */
-var McpToolError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "McpToolError";
-	}
-};
-/** Return the OpenTelemetry error.type value for MCP-aware tool failures. */
-function getMcpAwareErrorType(error, fallback) {
-	if (error instanceof McpToolError) return "tool_error";
-	if (error instanceof McpProviderError) return "mcp_provider_error";
-	return error instanceof Error ? error.name : fallback;
-}
-/** Return the display-safe error message for MCP-aware tool failures. */
-function getMcpAwareErrorMessage(error) {
-	return error instanceof Error ? error.message : String(error);
-}
-/** Return an error message safe for logs and span attributes. */
-function getMcpAwareTelemetryMessage(error, _privacy) {
-	if (error instanceof McpToolError) return "MCP tool call failed";
-	if (error instanceof McpProviderError) return error.message;
-	return getMcpAwareErrorMessage(error);
-}
-//#endregion
-//#region src/chat/mcp/client.ts
-const MCP_CLIENT_INFO = {
-	name: "junior-mcp-client",
-	version: "1.0.0"
-};
-const MCP_TOOLS_CALL_METHOD = "tools/call";
-function getDefaultPort(url) {
-	if (url.protocol === "https:") return 443;
-	if (url.protocol === "http:") return 80;
-}
-function getMcpNetworkAttributes(url) {
-	const port = url.port ? Number(url.port) : getDefaultPort(url);
-	return {
-		"server.address": url.hostname,
-		...port !== void 0 ? { "server.port": port } : void 0,
-		...url.protocol === "http:" || url.protocol === "https:" ? {
-			"network.protocol.name": "http",
-			"network.transport": "tcp"
-		} : void 0
-	};
-}
-var McpAuthorizationRequiredError = class extends Error {
-	provider;
-	constructor(provider, message) {
-		super(message);
-		this.name = "McpAuthorizationRequiredError";
-		this.provider = provider;
-	}
-};
-function isMissingSessionError(error) {
-	return error instanceof StreamableHTTPError && (error.code === 404 || /Session not found/i.test(error.message));
-}
-var PluginMcpClient = class {
-	plugin;
-	options;
-	client;
-	clientPromise;
-	lastAttemptedTransportSessionId;
-	providerStatusStore = new AsyncLocalStorage();
-	transport;
-	listedTools;
-	resourceHost;
-	constructor(plugin, options = {}) {
-		this.plugin = plugin;
-		this.options = options;
-		const url = plugin.manifest.mcp?.url;
-		this.resourceHost = url ? new URL(url).hostname : void 0;
-	}
-	async listTools() {
-		if (this.listedTools) return [...this.listedTools];
-		return await this.withSessionRecovery(async () => {
-			const client = await this.getClient();
-			const discovered = [];
-			const seen = /* @__PURE__ */ new Set();
-			let cursor;
-			do {
-				const result = await this.wrapAuth(() => client.listTools(cursor ? { cursor } : void 0), "list_tools");
-				await this.syncTransportSessionId();
-				for (const tool of result.tools) {
-					if (seen.has(tool.name)) continue;
-					seen.add(tool.name);
-					discovered.push(tool);
-				}
-				cursor = result.nextCursor;
-			} while (cursor);
-			this.listedTools = discovered.sort((left, right) => left.name.localeCompare(right.name));
-			return [...this.listedTools];
-		});
-	}
-	async callTool(name, args, signal) {
-		return await this.withSessionRecovery(async () => {
-			const client = await this.getClient();
-			const mcp = this.plugin.manifest.mcp;
-			if (mcp) {
-				const url = new URL(mcp.url);
-				setSpanAttributes({
-					"mcp.method.name": MCP_TOOLS_CALL_METHOD,
-					"gen_ai.operation.name": "execute_tool",
-					...this.transport?.sessionId ? { "mcp.session.id": this.transport.sessionId } : void 0,
-					...this.transport?.protocolVersion ? { "mcp.protocol.version": this.transport.protocolVersion } : void 0,
-					...getMcpNetworkAttributes(url)
-				});
-			}
-			const result = await this.wrapAuth(() => client.callTool({
-				name,
-				arguments: args ?? {}
-			}, void 0, signal ? { signal } : void 0), "call_tool");
-			await this.syncTransportSessionId();
-			return result;
-		});
-	}
-	async close() {
-		await this.disposeClient();
-	}
-	async withSessionRecovery(operation) {
-		try {
-			return await operation();
-		} catch (error) {
-			await this.syncTransportSessionId();
-			if (!await this.shouldResetMissingSession(error)) throw error;
-			await this.clearStoredTransportSessionId();
-			await this.cleanupClientAfterFailure();
-			return await operation();
-		}
-	}
-	async getClient() {
-		if (this.client) return this.client;
-		if (this.clientPromise) return await this.clientPromise;
-		const clientPromise = this.connectClient();
-		this.clientPromise = clientPromise;
-		try {
-			return await clientPromise;
-		} finally {
-			if (this.clientPromise === clientPromise) this.clientPromise = void 0;
-		}
-	}
-	async connectClient() {
-		const mcp = this.plugin.manifest.mcp;
-		if (!mcp) throw new Error(`Plugin "${this.plugin.manifest.name}" does not declare MCP config`);
-		const headers = mcp.headers ? resolvePluginHeaderEnvRefs(this.plugin.manifest.name, mcp.headers, "MCP header") : void 0;
-		const sessionId = await this.getStoredTransportSessionId();
-		this.lastAttemptedTransportSessionId = sessionId;
-		const transport = new StreamableHTTPClientTransport(new URL(mcp.url), {
-			...headers ? { requestInit: { headers } } : void 0,
-			fetch: fetchWithBoundedOAuthErrorBodies(this.options.fetch, (status) => {
-				const store = this.providerStatusStore.getStore();
-				if (store) store.status = status;
-			}),
-			...this.options.authProvider ? { authProvider: this.options.authProvider } : void 0,
-			...sessionId ? { sessionId } : void 0
-		});
-		const client = new Client(MCP_CLIENT_INFO, { capabilities: {} });
-		this.transport = transport;
-		try {
-			await this.wrapAuth(() => client.connect(transport), "connect");
-			this.client = client;
-			await this.syncTransportSessionId();
-			return client;
-		} catch (error) {
-			await this.syncTransportSessionId();
-			await this.cleanupClientAfterFailure();
-			throw error;
-		}
-	}
-	async wrapAuth(operation, phase) {
-		const store = {};
-		return await this.providerStatusStore.run(store, async () => {
-			try {
-				return await operation();
-			} catch (error) {
-				if (error instanceof McpAuthorizationRequiredError) throw error;
-				if (error instanceof UnauthorizedError) throw new McpAuthorizationRequiredError(this.plugin.manifest.name, `MCP authorization required for plugin "${this.plugin.manifest.name}"`);
-				throw toMcpProviderError(error, {
-					phase,
-					provider: this.plugin.manifest.name,
-					missingSession: isMissingSessionError(error) || void 0,
-					resourceHost: this.resourceHost,
-					status: store.status
-				});
-			}
-		});
-	}
-	async shouldResetMissingSession(error) {
-		if (!(error instanceof McpProviderError && error.missingSession || isMissingSessionError(error))) return false;
-		return Boolean(this.transport?.sessionId ?? this.lastAttemptedTransportSessionId ?? await this.getStoredTransportSessionId());
-	}
-	resetClientState() {
-		const transport = this.transport;
-		this.listedTools = void 0;
-		this.transport = void 0;
-		this.client = void 0;
-		this.clientPromise = void 0;
-		return transport;
-	}
-	async cleanupClientAfterFailure() {
-		const transport = this.resetClientState();
-		if (!transport) return;
-		try {
-			await transport.close();
-		} catch {}
-	}
-	async disposeClient() {
-		const transport = this.resetClientState();
-		if (transport) try {
-			await transport.close();
-		} catch (error) {
-			throw toMcpProviderError(error, {
-				phase: "close",
-				provider: this.plugin.manifest.name,
-				resourceHost: this.resourceHost
-			});
-		}
-	}
-	async getStoredTransportSessionId() {
-		return await this.options.authProvider?.getMcpServerSessionId?.();
-	}
-	async clearStoredTransportSessionId() {
-		const provider = this.options.authProvider;
-		this.lastAttemptedTransportSessionId = void 0;
-		await provider?.saveMcpServerSessionId?.(void 0);
-	}
-	async syncTransportSessionId() {
-		const provider = this.options.authProvider;
-		const sessionId = this.transport?.sessionId;
-		if (!provider?.saveMcpServerSessionId || !sessionId) return;
-		this.lastAttemptedTransportSessionId = sessionId;
-		await provider.saveMcpServerSessionId(sessionId);
-	}
-};
-//#endregion
-//#region src/chat/mcp/tool-manager.ts
+// src/chat/mcp/tool-manager.ts
 const MAX_TOOL_RESULT_TOKENS = 1e4;
 const MAX_TOOL_RESULT_BYTES = 32768;
 const CHARS_PER_ESTIMATED_TOKEN = 4;
@@ -7233,13 +6896,16 @@ function extractMcpErrorMessage(result) {
 	return "MCP tool call failed";
 }
 var McpToolManager = class {
-	options;
 	pluginsByProvider = /* @__PURE__ */ new Map();
 	activeProviders = /* @__PURE__ */ new Set();
 	authorizationPendingProviders = /* @__PURE__ */ new Set();
 	clientsByProvider = /* @__PURE__ */ new Map();
+	/** Actor clients for tools that a provider's service account may not call. */
+	actorClientsByProvider = /* @__PURE__ */ new Map();
+	serviceAccountProviders = /* @__PURE__ */ new Set();
 	clientPromisesByProvider = /* @__PURE__ */ new Map();
 	toolsByProvider = /* @__PURE__ */ new Map();
+	options;
 	constructor(plugins, options = {}) {
 		this.options = options;
 		for (const plugin of plugins) if (plugin.manifest.mcp) this.pluginsByProvider.set(plugin.manifest.name, plugin);
@@ -7262,8 +6928,9 @@ var McpToolManager = class {
 		if (!plugin?.manifest.mcp) return false;
 		try {
 			const client = await this.getClient(plugin);
-			const tools = this.filterListedTools(plugin, await client.listTools());
-			this.assertWrappedToolsAvailable(plugin, tools);
+			const listedTools = this.filterListedTools(plugin, await client.listTools());
+			this.assertWrappedToolsAvailable(plugin, listedTools);
+			const tools = this.filterServiceAccountOnlyTools(plugin, listedTools);
 			this.toolsByProvider.set(provider, tools.map((tool) => this.toManagedTool(plugin, client, tool)));
 			this.activeProviders.add(provider);
 			return true;
@@ -7274,12 +6941,14 @@ var McpToolManager = class {
 	}
 	async close() {
 		let firstError;
-		for (const client of this.clientsByProvider.values()) try {
+		for (const client of [...this.clientsByProvider.values(), ...this.actorClientsByProvider.values()]) try {
 			await client.close();
 		} catch (error) {
 			firstError ??= error;
 		}
 		this.clientsByProvider.clear();
+		this.actorClientsByProvider.clear();
+		this.serviceAccountProviders.clear();
 		this.toolsByProvider.clear();
 		this.activeProviders.clear();
 		this.authorizationPendingProviders.clear();
@@ -7305,6 +6974,14 @@ var McpToolManager = class {
 		const missingTools = wrappedTools.filter((toolName) => !availableToolNames.has(toolName));
 		if (missingTools.length > 0) throw new Error(`Plugin ${plugin.manifest.name} MCP discovery missing wrapped tools: ${missingTools.join(", ")}`);
 	}
+	/**
+	* Hide tools that the service account does not list when no Actor
+	* connection exists to call them.
+	*/
+	filterServiceAccountOnlyTools(plugin, tools) {
+		if (!serviceAccountOnly(plugin.manifest)) return tools;
+		return tools.filter((tool) => serviceAccountAllows(plugin.manifest, { tool: tool.name }));
+	}
 	async getClient(plugin) {
 		const existing = this.clientsByProvider.get(plugin.manifest.name);
 		if (existing) return existing;
@@ -7319,13 +6996,30 @@ var McpToolManager = class {
 		}
 	}
 	async createClient(plugin) {
-		const authProvider = this.options.authProviderFactory ? await this.options.authProviderFactory(plugin) : void 0;
-		const client = new PluginMcpClient(plugin, {
+		const serviceAccount = await this.options.serviceAccountProviderFactory?.(plugin);
+		if (serviceAccount) this.serviceAccountProviders.add(plugin.manifest.name);
+		const client = await this.newClient(plugin, serviceAccount);
+		this.clientsByProvider.set(plugin.manifest.name, client);
+		return client;
+	}
+	async newClient(plugin, serviceAccount) {
+		if (!serviceAccount && serviceAccountOnly(plugin.manifest)) throw new McpServiceAccountRequiredError(plugin.manifest.name, plugin.manifest.displayName);
+		const authProvider = serviceAccount ?? await this.options.authProviderFactory?.(plugin);
+		return new PluginMcpClient(plugin, {
 			...authProvider ? { authProvider } : void 0,
 			...this.options.fetch ? { fetch: this.options.fetch } : void 0
 		});
-		this.clientsByProvider.set(plugin.manifest.name, client);
-		return client;
+	}
+	/** Pick the client for one call: the service account for its tools, else the actor. */
+	async clientForTool(plugin, client, toolName) {
+		const provider = plugin.manifest.name;
+		if (!this.serviceAccountProviders.has(provider) || serviceAccountAllows(plugin.manifest, { tool: toolName })) return client;
+		if (serviceAccountOnly(plugin.manifest)) throw new McpToolError(`${plugin.manifest.displayName} tool ${toolName} is not available: Junior's shared ${plugin.manifest.displayName} account cannot use it`);
+		const existing = this.actorClientsByProvider.get(provider);
+		if (existing) return existing;
+		const actorClient = await this.newClient(plugin);
+		this.actorClientsByProvider.set(provider, actorClient);
+		return actorClient;
 	}
 	toManagedTool(plugin, client, tool) {
 		const outputSchema = toOptionalRecord(tool.outputSchema);
@@ -7361,7 +7055,7 @@ var McpToolManager = class {
 				const argumentAttribute = serializeMcpPayload(resolvedArgs, conversationPrivacy, { privateMetadata: true });
 				return await withSpan(`execute_tool ${managedToolName}`, "gen_ai.execute_tool", {}, async () => {
 					try {
-						const result = await client.callTool(tool.name, resolvedArgs, options?.signal);
+						const result = await (await this.clientForTool(plugin, client, tool.name)).callTool(tool.name, resolvedArgs, options?.signal);
 						if ("isError" in result && result.isError) throw new McpToolError(extractMcpErrorMessage(result));
 						const resultAttribute = serializeMcpPayload(result, conversationPrivacy, { privateMetadata: true });
 						if (resultAttribute) setSpanAttributes({ "gen_ai.tool.call.result": resultAttribute });
@@ -7415,13 +7109,23 @@ var McpToolManager = class {
 		};
 	}
 	async handleAuthorizationRequired(provider, error, context) {
+		const plugin = this.pluginsByProvider.get(provider);
+		if (plugin && serviceAccountOnly(plugin.manifest)) {
+			this.forgetProvider(provider);
+			throw new McpServiceAccountRequiredError(provider, plugin.manifest.displayName);
+		}
 		if (!this.options.onAuthorizationRequired) return false;
 		if (!(await this.options.onAuthorizationRequired(provider, error, context) === true)) return false;
 		this.authorizationPendingProviders.add(provider);
+		this.forgetProvider(provider);
+		return true;
+	}
+	forgetProvider(provider) {
 		this.clientsByProvider.delete(provider);
+		this.actorClientsByProvider.delete(provider);
+		this.serviceAccountProviders.delete(provider);
 		this.toolsByProvider.delete(provider);
 		this.activeProviders.delete(provider);
-		return true;
 	}
 	/** Return all active ManagedMcpTool objects, optionally filtered by provider. */
 	getResolvedActiveTools(options = {}) {
@@ -7479,8 +7183,7 @@ function serializeMcpPayload(payload, privacy, options = {}) {
 	if (privacy !== "private") return serializeGenAiAttribute(payload);
 	return options.privateMetadata ? serializeGenAiAttribute(toGenAiPayloadMetadata(payload)) : void 0;
 }
-//#endregion
-//#region src/chat/tools/sandbox/bash.ts
+// src/chat/tools/sandbox/bash.ts
 /** Create the sandbox shell tool definition exposed to the agent. */
 function createBashTool() {
 	return zodTool({
@@ -7503,8 +7206,7 @@ function createBashTool() {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/sandbox/image-files.ts
+// src/chat/tools/sandbox/image-files.ts
 /**
 * Read a sandbox image for a model request. The file signature, not the file
 * name, sets the MIME type.
@@ -7522,8 +7224,7 @@ async function readSandboxImage(path, readFile, maxBytes) {
 		mimeType
 	};
 }
-//#endregion
-//#region src/chat/tools/web/image-generate.ts
+// src/chat/tools/web/image-generate.ts
 const MAX_REQUEST_IMAGE_BYTES = 3145728;
 const MAX_SOURCE_IMAGE_BYTES = 26214400;
 const RESIZE_LONGEST_EDGES = [
@@ -7762,8 +7463,7 @@ function createImageGenerateTool(hooks, options, deps = {}) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/mcp/tool-name.ts
+// src/chat/mcp/tool-name.ts
 /** Extract the provider from canonical `mcp__<provider>__<tool>` names. */
 function parseMcpProviderFromToolName(toolName) {
 	if (!toolName.startsWith("mcp__")) return void 0;
@@ -7771,8 +7471,7 @@ function parseMcpProviderFromToolName(toolName) {
 	const delimiterIndex = afterPrefix.indexOf("__");
 	return delimiterIndex > 0 ? afterPrefix.slice(0, delimiterIndex) : void 0;
 }
-//#endregion
-//#region src/chat/tools/skill/call-mcp-tool.ts
+// src/chat/tools/skill/call-mcp-tool.ts
 function resolveMcpArguments(input) {
 	const extraKeys = Object.keys(input).filter((key) => key !== "tool_name" && key !== "arguments" && key !== "intent");
 	if (extraKeys.length > 0) throw new ToolInputError(`callMcpTool MCP arguments must be nested under arguments, not top-level fields: ${extraKeys.join(", ")}`);
@@ -7852,8 +7551,7 @@ function createCallMcpToolTool(mcpToolManager) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/skill/load-skill.ts
+// src/chat/tools/skill/load-skill.ts
 function toLoadedSkill(result, availableSkills) {
 	if (typeof result.skill_name !== "string" || typeof result.description !== "string" || typeof result.skill_dir !== "string" || typeof result.instructions !== "string") return null;
 	const metadata = availableSkills.find((skill) => skill.name === result.skill_name) ?? null;
@@ -7904,8 +7602,7 @@ function createLoadSkillTool(availableSkills, options) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tool-support/skill/mcp-tool-summary.ts
+// src/chat/tool-support/skill/mcp-tool-summary.ts
 /** Convert a managed MCP tool descriptor into agent-visible search output. */
 function toExposedToolSummary(toolDef) {
 	return {
@@ -7928,8 +7625,7 @@ function toActiveMcpCatalogSummaries(toolDefs) {
 		available_tool_count: availableToolCount
 	})).sort((left, right) => left.provider.localeCompare(right.provider));
 }
-//#endregion
-//#region src/chat/tools/skill/search-mcp-tools.ts
+// src/chat/tools/skill/search-mcp-tools.ts
 const DEFAULT_MAX_RESULTS$1 = 5;
 const MAX_RESULTS$2 = 20;
 const providerSummarySchema = z.object({
@@ -8078,8 +7774,7 @@ function createSearchMcpToolsTool(mcpToolManager) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/sandbox/view-image.ts
+// src/chat/tools/sandbox/view-image.ts
 const MAX_VIEW_IMAGE_BYTES = 5242880;
 const viewImageInputSchema = z.object({ path: z.string().min(1).describe("Path to an image file in the sandbox workspace.") }).strict();
 /** Create a tool that loads a sandbox image into the active model context. */
@@ -8105,8 +7800,7 @@ function createViewImageTool(sandbox, supportsImageInput, deps = {}) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/runtime/report-progress.ts
+// src/chat/tools/runtime/report-progress.ts
 /** Create the internal tool the model uses for sparse progress updates. */
 function createReportProgressTool() {
 	return zodTool({
@@ -8122,8 +7816,7 @@ function createReportProgressTool() {
 		execute: async () => ({})
 	});
 }
-//#endregion
-//#region src/chat/tools/runtime/update-plan.ts
+// src/chat/tools/runtime/update-plan.ts
 const planItemSchema = z.object({
 	step: z.string().describe("Task step text."),
 	status: z.enum([
@@ -8157,8 +7850,7 @@ function createUpdatePlanTool() {
 		}] })
 	});
 }
-//#endregion
-//#region src/chat/conversations/sql/subtree.ts
+// src/chat/conversations/sql/subtree.ts
 /** Columns of the `conversation_subtree` table that `conversationSubtree` returns. */
 const conversationSubtreeColumns = {
 	conversationId: sql`conversation_subtree.conversation_id`,
@@ -8190,8 +7882,7 @@ function conversationSubtree(conversationIds) {
     select scope_conversation_id, conversation_id from tree
   ) conversation_subtree`;
 }
-//#endregion
-//#region src/chat/agent-invocations/types.ts
+// src/chat/agent-invocations/types.ts
 const exactStringSchema = z.string().min(1).refine((value) => value === value.trim());
 const agentNameSchema = exactStringSchema.max(64);
 /** `messageAgent` target for the parent of a child agent. */
@@ -8263,8 +7954,7 @@ const CHILD_AGENT_RESULTS = [
 	"blocked",
 	"failed"
 ];
-//#endregion
-//#region src/chat/agent-invocations/errors.ts
+// src/chat/agent-invocations/errors.ts
 /** A child agent already uses this name in the parent Conversation. */
 var AgentNameInUseError = class extends Error {
 	constructor(name) {
@@ -8293,8 +7983,7 @@ var AgentMessageTargetError = class extends Error {
 		this.name = "AgentMessageTargetError";
 	}
 };
-//#endregion
-//#region src/chat/agent-invocations/store.ts
+// src/chat/agent-invocations/store.ts
 const CREATE_LOCK_PREFIX = "junior:agent_invocation:create";
 /**
 * Return the SQL lock that one parent Conversation takes to start, message,
@@ -8720,8 +8409,7 @@ async function markAgentInvocationSteered(invocationId, nowMs = Date.now()) {
 function isTerminalAgentInvocation(invocation) {
 	return TERMINAL_AGENT_INVOCATION_STATUSES.includes(invocation.status);
 }
-//#endregion
-//#region src/chat/agent-invocations/list.ts
+// src/chat/agent-invocations/list.ts
 function isChildAgentResult(status) {
 	return CHILD_AGENT_RESULTS.includes(status);
 }
@@ -8813,8 +8501,7 @@ async function listAgentRelatives(input) {
 		siblings: family.filter((agent) => agent.childConversationId !== conversationId)
 	};
 }
-//#endregion
-//#region src/chat/tools/runtime/list-agents.ts
+// src/chat/tools/runtime/list-agents.ts
 const TASK_MAX_LENGTH = 1e3;
 const ERROR_MAX_LENGTH = 500;
 /** How a listed agent relates to the conversation that lists it. */
@@ -8909,8 +8596,7 @@ function createListAgentsTool(context) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/runtime/message-agent.ts
+// src/chat/tools/runtime/message-agent.ts
 /** Bound the text of one message so a loop cannot fill a mailbox quickly. */
 const MESSAGE_AGENT_TEXT_MAX_LENGTH = 8e3;
 const messageAgentOutputSchema = juniorToolOutputSchema.extend({
@@ -8956,8 +8642,7 @@ function createMessageAgentTool(messageAgent) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/runtime/spawn-agent.ts
+// src/chat/tools/runtime/spawn-agent.ts
 const spawnAgentOutputSchema = juniorToolOutputSchema.extend({ conversation_id: z.string().min(1).describe("Child conversation ID. Pass it to searchConversationEvents to read the child's history.") });
 /** Create the asynchronous child-agent tool for one parent run. */
 function createSpawnAgentTool(spawnAgent, profileControl) {
@@ -9014,8 +8699,7 @@ function createSpawnAgentTool(spawnAgent, profileControl) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/agent-invocations/markers.ts
+// src/chat/agent-invocations/markers.ts
 /**
 * Dashboard records for agent invocations. The parent Conversation gets one
 * `subagent_started` and one `subagent_ended` event for each agent invocation.
@@ -9098,8 +8782,7 @@ async function recordSubagentEnded(invocation) {
 		createdAtMs: invocation.terminalAtMs
 	}]);
 }
-//#endregion
-//#region src/chat/agent-invocations/stop.ts
+// src/chat/agent-invocations/stop.ts
 /**
 * Stop one child agent of a parent Conversation and every child agent below
 * it. The parent gets no result. SQL stops the work first. Then each
@@ -9208,8 +8891,7 @@ async function stopLockedAgentInvocationTree(conversationId, nowMs) {
 		stopped: stopped.map(invocationFromRow).filter(isTerminalAgentInvocation)
 	};
 }
-//#endregion
-//#region src/chat/tools/runtime/stop-agent.ts
+// src/chat/tools/runtime/stop-agent.ts
 const stopAgentOutputSchema = juniorToolOutputSchema.extend({
 	conversation_id: z.string().min(1).describe("Stopped child conversation ID"),
 	stopped: z.boolean().describe("True when work was stopped. False when the child agent had already stopped.")
@@ -9239,8 +8921,7 @@ function createStopAgentTool(conversationId) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/runtime/finish-automation-run.ts
+// src/chat/tools/runtime/finish-automation-run.ts
 const RESULT_GUIDANCE = ["Use `no_action` when the run worked and nothing should be posted, such as when a condition in the instruction is not met, or when a temporary failure stopped the work.", "Use `misconfigured` when the run cannot do its job until its creator changes the automation: a provider, tool, account, or access that the job needs is missing, a target no longer exists, or the instruction cannot be done. Do not use it for a temporary failure or a condition that is not met."].join(" ");
 /** Create the tool that ends one Automation run with a declared result. */
 function createFinishAutomationRunTool(options) {
@@ -9277,8 +8958,7 @@ function createFinishAutomationRunTool(options) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/runtime/report-blocked.ts
+// src/chat/tools/runtime/report-blocked.ts
 /** Create the tool that ends a child agent run as blocked. */
 function createReportBlockedTool() {
 	return zodTool({
@@ -9294,8 +8974,7 @@ function createReportBlockedTool() {
 		execute: async (input) => ({ missing: input.missing })
 	});
 }
-//#endregion
-//#region src/chat/events/owned-watches.ts
+// src/chat/events/owned-watches.ts
 /**
 * Watch ownership for the watch tools. A Conversation owns its own watches and
 * the watches of every child agent below it, at any depth. A child agent still
@@ -9341,8 +9020,7 @@ async function stopOwnedWatch(input) {
 	});
 	return stopped;
 }
-//#endregion
-//#region src/chat/tools/list-watches.ts
+// src/chat/tools/list-watches.ts
 const listedResourceWatchSchema = z.object({
 	id: z.string().min(1),
 	label: z.string().min(1),
@@ -9395,8 +9073,7 @@ function createListWatchesTool(context) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/search-event-types.ts
+// src/chat/tools/search-event-types.ts
 const DEFAULT_SEARCH_RESULTS = 10;
 const MAX_SEARCH_RESULTS = 20;
 const searchedResourceTypeSchema = z.object({
@@ -9476,8 +9153,7 @@ function createSearchEventTypesTool(catalog) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/stop-watches.ts
+// src/chat/tools/stop-watches.ts
 const resultDataSchema$1 = z.object({
 	watching_status: z.literal("stopped"),
 	stoppedIds: z.array(z.string().min(1))
@@ -9533,8 +9209,7 @@ function createStopWatchingResourcesTool(context) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/watch-timer.ts
+// src/chat/tools/watch-timer.ts
 /** Create one heartbeat-backed Watch in the current Conversation. */
 function createWatchTimerTool(context) {
 	return zodTool({
@@ -9569,8 +9244,7 @@ function createWatchTimerTool(context) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/watch-events.ts
+// src/chat/tools/watch-events.ts
 function inputSchema(catalog) {
 	return z.object({
 		identifier: z.string().trim().min(1).describe("Plugin-defined resource identifier."),
@@ -9675,8 +9349,7 @@ function createWatchEventsTool(context, catalog) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/events.ts
+// src/chat/tools/events.ts
 /** Build the complete resource-watch tool set for this runtime context. */
 function createEventTools(context, catalog) {
 	const enabled = hasEventCatalogEntries(catalog);
@@ -9690,8 +9363,7 @@ function createEventTools(context, catalog) {
 		stopWatchingResources: createStopWatchingResourcesTool(context)
 	};
 }
-//#endregion
-//#region src/chat/automations/requester-mention.ts
+// src/chat/automations/requester-mention.ts
 function namesPerson(text, name) {
 	const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 	return new RegExp(`(?<![\\p{L}\\p{N}])${escaped}(?![\\p{L}\\p{N}])`, "iu").test(text);
@@ -9708,8 +9380,7 @@ function requireRequesterMention(instruction, actor) {
 	if (instruction.includes(mention)) return;
 	if (namesPerson(instruction, actor.fullName)) throw new ToolInputError(`The instruction names ${actor.fullName} without a Slack mention. Write ${mention} for this person.`);
 }
-//#endregion
-//#region src/chat/task-outcomes.ts
+// src/chat/task-outcomes.ts
 /** Resolve explicit message outcomes to the Slack Destinations stored on an Automation. */
 async function resolveTaskOutcomes(outcomes, currentDestination, creatorSlackUserId) {
 	if (outcomes === void 0) return [];
@@ -9751,8 +9422,7 @@ function moveTaskOutcomes(outcomes, currentDestination, nextDestination) {
 		destination: nextDestination
 	} : outcome);
 }
-//#endregion
-//#region src/chat/event-automations/tool-support.ts
+// src/chat/event-automations/tool-support.ts
 const compactEventAutomationResultSchema = z.object({
 	id: z.string().min(1),
 	status: z.enum([
@@ -9915,8 +9585,7 @@ async function eventAutomationToolResult(conversationId, task, catalog, requeste
 		}])
 	};
 }
-//#endregion
-//#region src/chat/tools/create-event-automation.ts
+// src/chat/tools/create-event-automation.ts
 /** Build a retry-stable automation id scoped to actor, destination, and tool call. */
 function buildEventAutomationId(args) {
 	const toolCallId = args.toolCallId?.trim();
@@ -10008,8 +9677,7 @@ function createEventAutomationTool(context, catalog) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/delete-event-automation.ts
+// src/chat/tools/delete-event-automation.ts
 /** Create the core tool that deletes an event automation. */
 function createDeleteEventAutomationTool(context, catalog) {
 	return zodTool({
@@ -10044,8 +9712,7 @@ function createDeleteEventAutomationTool(context, catalog) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/list-event-automations.ts
+// src/chat/tools/list-event-automations.ts
 const MAX_LISTED_EVENT_AUTOMATIONS = 50;
 /** Create the core tool that lists event automations for this destination. */
 function createListEventAutomationsTool(context, catalog) {
@@ -10070,8 +9737,7 @@ function createListEventAutomationsTool(context, catalog) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/automations/edit-rules.ts
+// src/chat/automations/edit-rules.ts
 /** Shared edit rules. Transport access checks run before these rules. */
 var AutomationEditError = class extends ToolInputError {
 	field;
@@ -10106,8 +9772,7 @@ async function editAutomationFields(current, input, isCreator, changesExecution)
 		outcomes
 	};
 }
-//#endregion
-//#region src/chat/event-automations/edit.ts
+// src/chat/event-automations/edit.ts
 function changesEventAutomationTrigger(current, next) {
 	const currentEvents = [...current.events].sort();
 	const nextEvents = [...next.events].sort();
@@ -10147,8 +9812,7 @@ async function editEventAutomation(current, input, isCreator, catalog) {
 		throw error;
 	}
 }
-//#endregion
-//#region src/chat/tools/update-event-automation.ts
+// src/chat/tools/update-event-automation.ts
 /** Create the core tool that updates an event automation. */
 function createUpdateEventAutomationTool(context, catalog) {
 	return zodTool({
@@ -10212,8 +9876,7 @@ function createUpdateEventAutomationTool(context, catalog) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/event-automations.ts
+// src/chat/tools/event-automations.ts
 /** Build event automation tools for a Conversation with a Slack Location. */
 function createEventAutomationTools(context, catalog) {
 	if (!getSlackToolContext(context)) return {};
@@ -10224,8 +9887,7 @@ function createEventAutomationTools(context, catalog) {
 		deleteEventAutomation: createDeleteEventAutomationTool(context, catalog)
 	}, slackMessageTurnDisabledReason(context));
 }
-//#endregion
-//#region src/chat/scheduled-automations/telemetry.ts
+// src/chat/scheduled-automations/telemetry.ts
 /** Safe structured telemetry attributes for scheduled-automation lifecycle events. */
 /** Correlation attributes shared by scheduled-automation create and run events. */
 function scheduledAutomationAttributes(task, extras = {}) {
@@ -10260,8 +9922,7 @@ function scheduledAutomationRunAttributes(task, run, extras = {}) {
 function logScheduledAutomationRunSkipped(task, run, extras = {}) {
 	logInfo("scheduled_automation.run.skipped", scheduledAutomationRunAttributes(task, run, extras));
 }
-//#endregion
-//#region src/chat/scheduled-automations/identity.ts
+// src/chat/scheduled-automations/identity.ts
 const SLACK_USER_ID_PATTERN = /^[UW][A-Z0-9]{5,}$/;
 function clean(value) {
 	const normalized = value?.trim();
@@ -10288,8 +9949,7 @@ function sanitizeScheduledAutomationPrincipal(principal) {
 		...userName ? { userName } : void 0
 	};
 }
-//#endregion
-//#region src/chat/scheduled-automations/tool-support.ts
+// src/chat/scheduled-automations/tool-support.ts
 const TASK_ID_PREFIX = "sched";
 const compactTaskResultSchema = z.object({
 	id: z.string(),
@@ -10507,8 +10167,7 @@ function buildTaskId(args) {
 function normalizeStatus(value) {
 	if (value === "active" || value === "blocked") return value;
 }
-//#endregion
-//#region src/chat/scheduled-automations/tools/create.ts
+// src/chat/scheduled-automations/tools/create.ts
 /** Create a tool that stores a scheduled automation for the active Slack context. */
 function createSlackScheduleCreateAutomationTool(context) {
 	return zodTool({
@@ -10606,8 +10265,7 @@ function createSlackScheduleCreateAutomationTool(context) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/scheduled-automations/tools/delete.ts
+// src/chat/scheduled-automations/tools/delete.ts
 /** Create a tool that removes a scheduled automation from the active Slack conversation. */
 function createSlackScheduleDeleteAutomationTool(context) {
 	return zodTool({
@@ -10650,8 +10308,7 @@ function createSlackScheduleDeleteAutomationTool(context) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/slack/id-param.ts
+// src/chat/slack/id-param.ts
 /** Define a model-facing Slack channel ID parameter. */
 function slackChannelIdParam(description) {
 	return z.string().min(1).describe(description);
@@ -10684,8 +10341,7 @@ function parseRequiredSlackUserIdParam(field, value) {
 		error: `Invalid \`${field}\` Slack user ID. Use a Slack user ID like \`U123\` or \`W123\`.`
 	};
 }
-//#endregion
-//#region src/chat/scheduled-automations/tools/list.ts
+// src/chat/scheduled-automations/tools/list.ts
 function taskMatchesQuery(task, query) {
 	const normalized = query.toLowerCase();
 	return [
@@ -10740,8 +10396,7 @@ function createSlackScheduleListAutomationsTool(context) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/scheduled-automations/tools/run-now.ts
+// src/chat/scheduled-automations/tools/run-now.ts
 /** Create a tool that marks an existing scheduled automation due immediately. */
 function createSlackScheduleRunAutomationNowTool(context) {
 	return zodTool({
@@ -10773,8 +10428,7 @@ function createSlackScheduleRunAutomationNowTool(context) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/scheduled-automations/edit.ts
+// src/chat/scheduled-automations/edit.ts
 /** Build an edit without restarting completed work or changing creator identity. */
 async function editScheduledAutomation(current, input, isCreator, nowMs) {
 	if (current.status === "completed" || current.status === "deleted") throw new AutomationEditError("Completed scheduled automations cannot be updated. Create a new automation instead.");
@@ -10807,8 +10461,7 @@ async function editScheduledAutomation(current, input, isCreator, nowMs) {
 		status
 	};
 }
-//#endregion
-//#region src/chat/scheduled-automations/tools/update.ts
+// src/chat/scheduled-automations/tools/update.ts
 /** Create a tool that edits a scheduled automation, including moving it here. */
 function createSlackScheduleUpdateAutomationTool(context) {
 	return zodTool({
@@ -10878,8 +10531,7 @@ function createSlackScheduleUpdateAutomationTool(context) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/scheduled-automations.ts
+// src/chat/tools/scheduled-automations.ts
 function scheduledAutomationToolContext(context) {
 	const slackMessageTurn = isSlackMessageTurn(context) ? {
 		actor: context.actor,
@@ -10904,8 +10556,7 @@ function createScheduledAutomationTools(context) {
 		slackScheduleRunAutomationNow: createSlackScheduleRunAutomationNowTool(taskContext)
 	}, slackMessageTurnDisabledReason(context));
 }
-//#endregion
-//#region src/chat/slack/channel.ts
+// src/chat/slack/channel.ts
 const replySubtypeSchema = z.object({ subtype: z.string().optional() });
 /** List channel history using Slack-native, pre-validated timestamp bounds. */
 async function listChannelMessages(input) {
@@ -10994,8 +10645,7 @@ async function joinPublicChannel(channelId) {
 		idempotent: true
 	});
 }
-//#endregion
-//#region src/chat/slack/tool-support/channel-access.ts
+// src/chat/slack/tool-support/channel-access.ts
 const DENIED_PRIVATE = "Cannot read this Slack conversation because it is private. Only the current conversation or public channels are readable.";
 const DENIED_NOT_FOUND = "Cannot read this Slack conversation because the channel was not found or the bot cannot see it.";
 const DENIED_NOT_IN_CHANNEL = "Cannot read this Slack conversation because the bot is not in the channel.";
@@ -11118,8 +10768,7 @@ async function resolveOptionalSlackChannelRef(input) {
 	if (input.defaultChannelId) return { channelId: input.defaultChannelId };
 	throw new ToolInputError("Provide `channel_id`, or use this tool in an active Slack channel context.");
 }
-//#endregion
-//#region src/chat/slack/tools/channel-join.ts
+// src/chat/slack/tools/channel-join.ts
 /** Create a tool that joins one public Slack channel. */
 function createSlackChannelJoinTool(context) {
 	return zodTool({
@@ -11168,8 +10817,7 @@ function createSlackChannelJoinTool(context) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/slack/context.ts
+// src/chat/slack/context.ts
 function toTrimmedSlackString(value) {
 	return toOptionalString(value)?.trim() || void 0;
 }
@@ -11235,8 +10883,7 @@ function resolveSlackChannelIdFromMessage(message) {
 	}
 	return resolveSlackChannelIdFromThreadId(toTrimmedSlackString(message.threadId));
 }
-//#endregion
-//#region src/chat/slack/timestamp-param.ts
+// src/chat/slack/timestamp-param.ts
 /** Define a model-facing Slack timestamp, normalizing numeric model args to strings. */
 function slackTimestampParam(description) {
 	return z.preprocess((value) => typeof value === "number" && Number.isFinite(value) ? String(value) : value, z.string().min(1)).describe(description);
@@ -11269,8 +10916,7 @@ function parseRequiredSlackTimestampParam(field, value) {
 		error: `Invalid \`${field}\` Slack timestamp. Use a numeric Slack ts like \`1712345678.123456\`.`
 	};
 }
-//#endregion
-//#region src/chat/slack/tools/channel-list-messages.ts
+// src/chat/slack/tools/channel-list-messages.ts
 const booleanInput$1 = (description) => z.preprocess((value) => value === "true" ? true : value === "false" ? false : value, z.boolean()).describe(description);
 /**
 * Accept numeric Slack ts bounds and recover matching
@@ -11384,8 +11030,7 @@ function createSlackChannelListMessagesTool(context) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/slack/tools/conversation-brief-search.ts
+// src/chat/slack/tools/conversation-brief-search.ts
 /** Create Slack-owned filtering and match details for Brief search. */
 function createSlackConversationBriefSearchPort(teamId) {
 	return {
@@ -11412,15 +11057,13 @@ function createSlackConversationBriefSearchPort(teamId) {
 		}
 	};
 }
-//#endregion
-//#region src/chat/conversations/tool-source.ts
+// src/chat/conversations/tool-source.ts
 /** Deferred tool catalog source for retained Junior conversations. */
 const CONVERSATIONS_TOOL_SOURCE = {
 	id: "conversations",
 	description: "Search messages and events in retained Junior conversations."
 };
-//#endregion
-//#region src/chat/slack/tools/conversation-message-search.ts
+// src/chat/slack/tools/conversation-message-search.ts
 const DEFAULT_LIMIT$3 = 20;
 const MAX_LIMIT$2 = 50;
 const conversationMessageSearchOutputSchema = juniorToolOutputSchema.extend({
@@ -11534,8 +11177,7 @@ function createSlackConversationMessageSearchTool(scope, currentConversationId)
 		}
 	});
 }
-//#endregion
-//#region src/chat/slack/tools/public-search.ts
+// src/chat/slack/tools/public-search.ts
 const DEFAULT_LIMIT$2 = 10;
 const DEFAULT_CONTENT_TYPES = ["messages"];
 const CONTENT_TYPES = [
@@ -11833,8 +11475,7 @@ function createSlackPublicSearchTool(actionToken) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/idempotency.ts
+// src/chat/tools/idempotency.ts
 function stableSerialize(value) {
 	if (Array.isArray(value)) return `[${value.map((entry) => stableSerialize(entry)).join(",")}]`;
 	if (value && typeof value === "object") return `{${Object.entries(value).sort((a, b) => a[0].localeCompare(b[0])).map(([key, entry]) => `${JSON.stringify(key)}:${stableSerialize(entry)}`).join(",")}}`;
@@ -11844,8 +11485,7 @@ function stableSerialize(value) {
 function createOperationKey(toolName, input) {
 	return `${toolName}:${stableSerialize(input)}`;
 }
-//#endregion
-//#region src/chat/slack/tools/message-add-reaction.ts
+// src/chat/slack/tools/message-add-reaction.ts
 /** Create the tool that reacts to the current inbound Slack message. */
 function createSlackMessageAddReactionTool(context, state) {
 	return zodTool({
@@ -11890,8 +11530,7 @@ function createSlackMessageAddReactionTool(context, state) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/attachments/store.ts
+// src/chat/attachments/store.ts
 const DAY_MS = 864e5;
 const ATTACHMENT_GC_BATCH_LIMIT = 200;
 /** Time that Junior keeps attachment bytes after the file is stored. */
@@ -12182,8 +11821,7 @@ async function collectAttachmentGarbage(args) {
 	if (stillEligible.length === 0) return { deleted: 0 };
 	return { deleted: (await args.db.db().delete(juniorAttachments).where(inArray(juniorAttachments.id, stillEligible.map((row) => row.id))).returning({ id: juniorAttachments.id })).length };
 }
-//#endregion
-//#region src/chat/tools/send-files.ts
+// src/chat/tools/send-files.ts
 const sendFilesResultSchema = juniorToolOutputSchema.extend({
 	deduplicated: z.boolean().optional(),
 	attachment_refs: z.array(z.object({
@@ -12267,8 +11905,7 @@ function createSendFilesTool(state, materializeFile, output) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/slack/tools/send-files.ts
+// src/chat/slack/tools/send-files.ts
 /** Deliver files to the active Slack Location and retain Conversation attachments. */
 function createSlackSendFilesTool(context, state, materializeFile, attachments) {
 	const channelId = context.locationChannelId;
@@ -12291,8 +11928,7 @@ function createSlackSendFilesTool(context, state, materializeFile, attachments)
 		}
 	});
 }
-//#endregion
-//#region src/chat/slack/canvas-references.ts
+// src/chat/slack/canvas-references.ts
 const SLACK_FILE_ID_PATTERN = /^F[A-Z0-9]{4,}$/i;
 const SLACK_CANVAS_PATH_PATTERN = /^\/(?:docs|canvas|files)\/(?:T[A-Z0-9]+\/)?(?:U[A-Z0-9]+\/)?(F[A-Z0-9]{4,})(?:\/|$)/i;
 function isSlackHost(hostname) {
@@ -12316,8 +11952,7 @@ function extractCanvasId(input) {
 		return;
 	}
 }
-//#endregion
-//#region src/chat/slack/tool-support/canvas/markdown.ts
+// src/chat/slack/tool-support/canvas/markdown.ts
 function getListType(marker) {
 	return /^\d/.test(marker) ? "numbered" : "bullet";
 }
@@ -12445,8 +12080,7 @@ function normalizeCanvasMarkdown(markdown) {
 		unwrappedBlockquoteCount
 	};
 }
-//#endregion
-//#region src/chat/slack/tool-support/canvas/api.ts
+// src/chat/slack/tool-support/canvas/api.ts
 /**
 * Create a standalone Slack canvas owned by the bot and best-effort grant write
 * access to the active channel. Standalone canvases (`canvases.create`) are not
@@ -12575,8 +12209,7 @@ async function readCanvas(canvasIdOrUrl) {
 		byteLength: buffer.byteLength
 	};
 }
-//#endregion
-//#region src/chat/slack/tools/canvas/create.ts
+// src/chat/slack/tools/canvas/create.ts
 /** Create a tool that provisions a new Slack canvas in the active channel. */
 function createSlackCanvasCreateTool(context, state) {
 	return zodTool({
@@ -12627,8 +12260,7 @@ function createSlackCanvasCreateTool(context, state) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/slack/tool-support/canvas/context.ts
+// src/chat/slack/tool-support/canvas/context.ts
 /** Model-facing Slack canvas ID or docs URL parameter. */
 const slackCanvasRefParam = z.string().min(1).describe("Slack canvas/file ID or canvas/docs URL.");
 /** Resolve model-provided canvas references before Slack API calls. */
@@ -12643,8 +12275,7 @@ function resolveCanvasTarget(canvas) {
 		canvasId
 	};
 }
-//#endregion
-//#region src/chat/slack/tools/canvas/edit.ts
+// src/chat/slack/tools/canvas/edit.ts
 function prepareCanvasEditArguments(input) {
 	return prepareTextReplacementArguments(input);
 }
@@ -12714,8 +12345,7 @@ function createSlackCanvasEditTool(state) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/slack/tools/canvas/read.ts
+// src/chat/slack/tools/canvas/read.ts
 const slackCanvasReadOutputSchema = juniorToolOutputSchema.extend({
 	canvas_id: z.string().optional(),
 	title: z.string().optional(),
@@ -12777,8 +12407,7 @@ function createSlackCanvasReadTool() {
 		}
 	});
 }
-//#endregion
-//#region src/chat/slack/tools/canvas/write.ts
+// src/chat/slack/tools/canvas/write.ts
 /** Create a tool that deliberately replaces a Slack canvas body. */
 function createSlackCanvasWriteTool(state) {
 	return zodTool({
@@ -12821,8 +12450,7 @@ function createSlackCanvasWriteTool(state) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/slack/tool-support/list/api.ts
+// src/chat/slack/tool-support/list/api.ts
 function normalizeKey(value) {
 	return (value ?? "").toLowerCase().replace(/[^a-z0-9]+/g, "_");
 }
@@ -12981,14 +12609,12 @@ async function updateListItem(input) {
 		cells
 	}), 3, { action: "slackLists.items.update" });
 }
-//#endregion
-//#region src/chat/slack/tool-support/list/params.ts
+// src/chat/slack/tool-support/list/params.ts
 /** Model-facing Slack list ID parameter. */
 const slackListIdParam = z.string().min(1).describe("Slack list ID.");
 /** Model-facing Slack list item ID parameter. */
 const slackListItemIdParam = z.string().min(1).describe("Slack list item ID.");
-//#endregion
-//#region src/chat/slack/tools/list/add-items.ts
+// src/chat/slack/tools/list/add-items.ts
 /** Create a tool that appends items to an explicit Slack list. */
 function createSlackListAddItemsTool(state) {
 	return zodTool({
@@ -13036,8 +12662,7 @@ function createSlackListAddItemsTool(state) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/slack/tools/list/create.ts
+// src/chat/slack/tools/list/create.ts
 /** Create a tool that provisions a new Slack todo list. */
 function createSlackListCreateTool(state) {
 	return zodTool({
@@ -13068,8 +12693,7 @@ function createSlackListCreateTool(state) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/slack/tools/list/get-items.ts
+// src/chat/slack/tools/list/get-items.ts
 /** Create a tool that reads items from an explicit Slack list. */
 function createSlackListGetItemsTool() {
 	return zodTool({
@@ -13096,8 +12720,7 @@ function createSlackListGetItemsTool() {
 		}
 	});
 }
-//#endregion
-//#region src/chat/slack/tools/list/update-item.ts
+// src/chat/slack/tools/list/update-item.ts
 const booleanInput = (description) => z.preprocess((value) => value === "true" ? true : value === "false" ? false : value, z.boolean()).describe(description);
 const updateListItemInputSchema = z.union([z.object({
 	list_id: slackListIdParam,
@@ -13152,8 +12775,7 @@ function createSlackListUpdateItemTool(state) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/slack/tool-support/slack-message-url.ts
+// src/chat/slack/tool-support/slack-message-url.ts
 /** Parse Slack archive URLs into structured message references. */
 const SLACK_HOST_PATTERN = /^[a-z0-9-]+\.slack(?:-gov)?\.com$/;
 const ARCHIVE_PATH_PATTERN = /^\/archives\/([CDG][A-Z0-9]+)\/p(\d{10})(\d{6})$/;
@@ -13228,8 +12850,7 @@ function parseSlackMessageReference(input) {
 		}
 	};
 }
-//#endregion
-//#region src/chat/slack/message/blocks.ts
+// src/chat/slack/message/blocks.ts
 const MAX_BLOCKS = 50;
 const MAX_CHILDREN = 50;
 const MAX_DEPTH = 16;
@@ -13310,8 +12931,7 @@ function renderBlockText(value) {
 	const budget = { remainingNodes: MAX_NODES };
 	return value.slice(0, MAX_BLOCKS).flatMap((block) => parseElement(block, budget, 0)).join("\n");
 }
-//#endregion
-//#region src/chat/slack/message/attachments.ts
+// src/chat/slack/message/attachments.ts
 const MAX_ATTACHMENTS = 10;
 const MAX_FIELDS_PER_ATTACHMENT = 20;
 const MAX_FIELD_CHARS = 1e3;
@@ -13414,8 +13034,7 @@ function renderAttachment(raw) {
 function renderAttachmentText(input) {
 	return getAttachmentPayload(input).slice(0, MAX_ATTACHMENTS).map(renderAttachment).filter((line) => line.length > 0).map((line) => `[attachment] ${line}`).join("\n").slice(0, MAX_ATTACHMENT_TEXT_CHARS);
 }
-//#endregion
-//#region src/chat/slack/tools/thread-read.ts
+// src/chat/slack/tools/thread-read.ts
 const MAX_THREAD_READ_CHARS = 4e4;
 /**
 * Combine top-level `files` with files nested inside `attachments`
@@ -13611,8 +13230,7 @@ function createSlackThreadReadTool(context, attachmentDeps) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/slack/users.ts
+// src/chat/slack/users.ts
 const profileFieldsSchema = z.object({ fields: z.record(z.string(), z.object({
 	value: z.string().optional(),
 	alt: z.string().optional(),
@@ -13765,8 +13383,7 @@ async function searchSlackUsers(options) {
 		truncated: listed.truncated
 	};
 }
-//#endregion
-//#region src/chat/tools/user-lookup.ts
+// src/chat/tools/user-lookup.ts
 const linkedSlackIdentity = alias(juniorIdentities, "user_lookup_slack_identity");
 function explicitUserLookupError(error) {
 	if (error.apiError === "user_not_found" || error.code === "not_found") return "No Slack user found for the supplied user ID.";
@@ -13899,8 +13516,7 @@ function createUserLookupTool(teamId, providers) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/system-time.ts
+// src/chat/tools/system-time.ts
 const systemTimeInputSchema = z.object({ timezone: z.string().trim().min(1).optional().describe("Optional IANA timezone, for example America/Los_Angeles. When set, iso_local and timezone_offset_minutes are for that zone.") });
 const systemTimeOutputSchema = juniorToolOutputSchema.extend({
 	unix_ms: z.number(),
@@ -13971,8 +13587,7 @@ function getTimeZoneOffsetMinutes(timestampMs, timezone) {
 	const asUtcMs = Date.UTC(parts.year, parts.month - 1, parts.day, parts.hour, parts.minute, parts.second);
 	return Math.round((timestampMs - asUtcMs) / 6e4);
 }
-//#endregion
-//#region src/chat/tools/operator-sql.ts
+// src/chat/tools/operator-sql.ts
 /** Deferred tool catalog source for operator tools. */
 const OPERATOR_TOOL_SOURCE = {
 	id: "operator",
@@ -14052,8 +13667,7 @@ function createOperatorTools(context) {
 		}
 	}) };
 }
-//#endregion
-//#region src/chat/artifacts/store.ts
+// src/chat/artifacts/store.ts
 const MAX_IMAGE_BYTES = 10485760;
 const IMAGE_EXTENSIONS = {
 	"image/gif": "gif",
@@ -14194,8 +13808,7 @@ function unpublishedArtifactHeaders() {
 		"x-content-type-options": "nosniff"
 	});
 }
-//#endregion
-//#region src/chat/tools/publish-image.ts
+// src/chat/tools/publish-image.ts
 const outputSchema$1 = juniorToolOutputSchema.extend({
 	bytes: z.number().int().positive(),
 	content_type: z.string().min(1),
@@ -14239,8 +13852,7 @@ function createPublishImageTool(args) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/unpublish-image.ts
+// src/chat/tools/unpublish-image.ts
 const outputSchema = juniorToolOutputSchema.extend({
 	filename: z.string().min(1),
 	unpublished: z.literal(true)
@@ -14272,8 +13884,7 @@ function createUnpublishImageTool(args) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/load-attachment.ts
+// src/chat/tools/load-attachment.ts
 const ATTACHMENT_DIR = ".junior/attachments";
 async function readStream(stream) {
 	const chunks = [];
@@ -14328,8 +13939,7 @@ function createLoadAttachmentTool(args) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/search-conversation-events.ts
+// src/chat/tools/search-conversation-events.ts
 const DEFAULT_LIMIT$1 = 25;
 const MAX_LIMIT$1 = 100;
 const MAX_EVENT_DATA_BYTES = 4e3;
@@ -14539,8 +14149,7 @@ function stripReplacementHistoryField(value) {
 		replacement_history_count: Array.isArray(replacementHistory) ? replacementHistory.length : 0
 	};
 }
-//#endregion
-//#region src/chat/briefs/search.ts
+// src/chat/briefs/search.ts
 /** Search the latest Brief of each public root Conversation in one scope. */
 async function searchConversationBriefs(db, args) {
 	const query = args.filters.query?.trim() || void 0;
@@ -14604,8 +14213,7 @@ async function searchConversationBriefs(db, args) {
 		};
 	});
 }
-//#endregion
-//#region src/chat/tools/search-conversation-briefs.ts
+// src/chat/tools/search-conversation-briefs.ts
 const DEFAULT_LIMIT = 10;
 const MAX_LIMIT = 25;
 const conversationBriefSearchOutputSchema = juniorToolOutputSchema.extend({
@@ -14716,8 +14324,7 @@ function createSearchConversationBriefsTool(scope, currentConversationId, provid
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/handoff/tool.ts
+// src/chat/tools/handoff/tool.ts
 const HANDOFF_TOOL_NAME = "handoff";
 function formatHandoffProfiles(handoff) {
 	return handoff.profiles.map((profile) => `- ${formatModelProfile(profile.name, profile.description)}`).join("\n");
@@ -14758,8 +14365,7 @@ function createHandoffTool(handoff) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/plugins/credential-hooks.ts
+// src/chat/plugins/credential-hooks.ts
 function parseSchema(schema, value, message) {
 	const result = schema.safeParse(value);
 	if (!result.success) throw new Error(message);
@@ -14887,31 +14493,30 @@ async function issuePluginCredential(input) {
 		}
 	}), plugin.manifest.name);
 }
-//#endregion
-//#region src/chat/tools/web/constants.ts
+// src/chat/tools/web/constants.ts
 const USER_AGENT = "junior-bot/0.1";
 const FETCH_TIMEOUT_MS = 8e3;
 const DEFAULT_MAX_CHARS = 6e3;
 const MAX_FETCH_CHARS = 12e3;
 const MAX_FETCH_BYTES = 1e6;
-//#endregion
-//#region src/chat/tools/web/network.ts
+// src/chat/tools/web/network.ts
 function isPrivateIpv4(ip) {
 	const parts = ip.split(".").map((chunk) => Number.parseInt(chunk, 10));
-	if (parts.length !== 4 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255)) return true;
-	if (parts[0] === 10 || parts[0] === 127) return true;
-	if (parts[0] === 169 && parts[1] === 254) return true;
-	if (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31) return true;
-	if (parts[0] === 192 && parts[1] === 168) return true;
-	if (parts[0] === 0) return true;
+	const [first, second] = parts;
+	if (parts.length !== 4 || first === void 0 || second === void 0 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255)) return true;
+	if (first === 10 || first === 127) return true;
+	if (first === 169 && second === 254) return true;
+	if (first === 172 && second >= 16 && second <= 31) return true;
+	if (first === 192 && second === 168) return true;
+	if (first === 0) return true;
 	return false;
 }
 function parseMappedIpv4FromIpv6(mapped) {
 	if (net.isIP(mapped) === 4) return mapped;
-	const hexMatch = mapped.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
-	if (!hexMatch) return;
-	const high = Number.parseInt(hexMatch[1], 16);
-	const low = Number.parseInt(hexMatch[2], 16);
+	const [, highHex, lowHex] = mapped.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i) ?? [];
+	if (!highHex || !lowHex) return;
+	const high = Number.parseInt(highHex, 16);
+	const low = Number.parseInt(lowHex, 16);
 	return `${high >> 8 & 255}.${high & 255}.${low >> 8 & 255}.${low & 255}`;
 }
 function isPrivateIpv6(ip) {
@@ -14937,7 +14542,6 @@ async function resolvePublicHostname(hostname) {
 		all: true,
 		verbatim: true
 	});
-	if (records.length === 0) throw new ToolInputError("Could not resolve hostname");
 	const deduped = /* @__PURE__ */ new Map();
 	for (const record of records) {
 		const family = record.family === 6 ? 6 : 4;
@@ -14948,7 +14552,9 @@ async function resolvePublicHostname(hostname) {
 			family
 		});
 	}
-	return [...deduped.values()];
+	const [first, ...rest] = deduped.values();
+	if (!first) throw new ToolInputError("Could not resolve hostname");
+	return [first, ...rest];
 }
 async function resolvePinnedAddresses(url) {
 	const hostname = normalizeHostname(url.hostname);
@@ -14956,7 +14562,7 @@ async function resolvePinnedAddresses(url) {
 	return resolvePublicHostname(hostname);
 }
 function createPinnedLookup(resolved) {
-	const fallback = resolved[0];
+	const [fallback] = resolved;
 	return (_hostname, options, callback) => {
 		if (options?.all) {
 			callback(null, resolved.map((entry) => ({
@@ -15003,7 +14609,7 @@ async function fetchWithPinnedLookup(url, resolved, signal) {
 					signal.removeEventListener("abort", onAbort);
 					const headers = new Headers();
 					const rawHeaders = response.rawHeaders;
-					for (let i = 0; i < rawHeaders.length; i += 2) headers.append(rawHeaders[i], rawHeaders[i + 1]);
+					for (let i = 0; i + 1 < rawHeaders.length; i += 2) headers.append(rawHeaders[i] ?? "", rawHeaders[i + 1] ?? "");
 					const rawStatus = response.statusCode ?? 500;
 					const status = rawStatus >= 200 && rawStatus <= 599 ? rawStatus : 502;
 					resolve(new Response(Buffer.concat(chunks), {
@@ -15078,8 +14684,7 @@ async function readResponseBody(response, maxBytes) {
 	}
 	return new TextDecoder().decode(Buffer.concat(chunks));
 }
-//#endregion
-//#region src/chat/tools/web/fetch-content.ts
+// src/chat/tools/web/fetch-content.ts
 const htmlToMarkdownConverter = new NodeHtmlMarkdown({
 	bulletMarker: "-",
 	codeBlockStyle: "fenced",
@@ -15122,7 +14727,7 @@ function decodeHtmlEntities(value) {
 }
 function extractTitle(html) {
 	const match = html.match(/<title\b[^>]*>([\s\S]*?)<\/title>/i);
-	const title = match ? normalizeWhitespace(decodeHtmlEntities(match[1])) : "";
+	const title = match?.[1] !== void 0 ? normalizeWhitespace(decodeHtmlEntities(match[1])) : "";
 	return title.length > 0 ? title : void 0;
 }
 function escapeRegex(value) {
@@ -15220,8 +14825,7 @@ async function extractWebFetchResponse(url, response, maxChars = DEFAULT_MAX_CHA
 		truncated: extracted.truncated
 	};
 }
-//#endregion
-//#region src/chat/tools/web/fetch-tool.ts
+// src/chat/tools/web/fetch-tool.ts
 function extensionForMediaType(mediaType) {
 	if (mediaType === "image/png") return "png";
 	if (mediaType === "image/jpeg") return "jpg";
@@ -15279,8 +14883,7 @@ function createWebFetchTool(hooks, options = {}) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/web/search.ts
+// src/chat/tools/web/search.ts
 const SEARCH_TIMEOUT_MS = 6e4;
 const MAX_RESULTS$1 = 5;
 const SEARCH_TOOL_NAME = "parallelSearch";
@@ -15352,8 +14955,7 @@ function createWebSearchTool(modelId, override) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tools/sandbox/write-file.ts
+// src/chat/tools/sandbox/write-file.ts
 /** Create the sandbox full-file write tool definition exposed to the agent. */
 function createWriteFileTool() {
 	return zodTool({
@@ -15375,8 +14977,7 @@ function createWriteFileTool() {
 		}
 	});
 }
-//#endregion
-//#region src/stats.ts
+// src/stats.ts
 function utcDate(nowMs) {
 	return new Date(nowMs).toISOString().slice(0, 10);
 }
@@ -15401,8 +15002,7 @@ async function incrementStat(key, options = {}) {
 async function readStats(start, end) {
 	return await getDb().select().from(juniorStats).where(and(gte(juniorStats.date, start), lte(juniorStats.date, end))).orderBy(asc(juniorStats.date), asc(juniorStats.namespace), asc(juniorStats.metric), asc(juniorStats.name));
 }
-//#endregion
-//#region src/chat/workspaces/tools.ts
+// src/chat/workspaces/tools.ts
 /** Record optional reporting without changing the switchWorkspace outcome. */
 async function tryRecordWorkspaceSwitchStat(workspace) {
 	if (!process.env.DATABASE_URL) return;
@@ -15677,8 +15277,7 @@ function createWorkspaceTools(context) {
 		})
 	};
 }
-//#endregion
-//#region src/chat/tools/index.ts
+// src/chat/tools/index.ts
 function createToolState() {
 	const operationResultCache = /* @__PURE__ */ new Map();
 	return {
@@ -15811,8 +15410,7 @@ function createTools(availableSkills, hooks = {}, context, options = {}) {
 	}
 	return tools;
 }
-//#endregion
-//#region src/chat/runtime/report-progress.ts
+// src/chat/runtime/report-progress.ts
 function isActivePlanItem(value) {
 	if (!value || typeof value !== "object") return false;
 	const item = value;
@@ -15853,8 +15451,7 @@ function latestProgressStatus(messages) {
 		}
 	}
 }
-//#endregion
-//#region src/chat/tool-support/catalog-tool-call.ts
+// src/chat/tool-support/catalog-tool-call.ts
 function schemaErrorText(schema, value) {
 	const firstError = [...Value.Errors(schema, value)][0];
 	if (!firstError) return "invalid arguments";
@@ -15892,8 +15489,7 @@ function prepareCatalogToolCall(call) {
 		toolName: call.toolName
 	};
 }
-//#endregion
-//#region src/chat/tools/execution/build-sandbox-input.ts
+// src/chat/tools/execution/build-sandbox-input.ts
 /** Normalize LLM tool params into the shape expected by the sandbox executor. */
 function buildSandboxInput(toolName, params) {
 	const optionalNumber = (value) => typeof value === "number" && Number.isFinite(value) ? value : void 0;
@@ -15936,8 +15532,7 @@ function buildSandboxInput(toolName, params) {
 	};
 	return params;
 }
-//#endregion
-//#region src/chat/services/plugin-auth-orchestration.ts
+// src/chat/services/plugin-auth-orchestration.ts
 var PluginAuthorizationPauseError = class extends AuthorizationPauseError {
 	constructor(provider, providerDisplayName, disposition, requestText) {
 		super("plugin", provider, providerDisplayName, disposition, requestText);
@@ -16050,8 +15645,7 @@ function createPluginAuthOrchestration(input) {
 		getPendingPause: () => pendingPause
 	};
 }
-//#endregion
-//#region src/chat/tools/execution/tool-error-handler.ts
+// src/chat/tools/execution/tool-error-handler.ts
 function isPluginToolInputError(error) {
 	return error instanceof PluginToolInputError || error instanceof Error && error.name === "PluginToolInputError";
 }
@@ -16112,8 +15706,7 @@ function handleToolExecutionError(error, toolName, toolCallId, shouldTrace, conv
 	});
 	throw error;
 }
-//#endregion
-//#region src/chat/tools/execute-tool.ts
+// src/chat/tools/execute-tool.ts
 const EXECUTE_TOOL_NAME = "executeTool";
 /** Create the model-visible dispatcher schema for catalog tools. */
 function createExecuteToolTool() {
@@ -16136,8 +15729,7 @@ function createExecuteToolTool() {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tool-exposure.ts
+// src/chat/tool-exposure.ts
 /** Return the runtime exposure for a tool, preserving direct compatibility. */
 function effectiveToolExposure(definition) {
 	return definition.exposure ?? "direct";
@@ -16164,8 +15756,7 @@ function planToolExposure(tools) {
 		excludedTools
 	};
 }
-//#endregion
-//#region src/chat/tools/search-tools.ts
+// src/chat/tools/search-tools.ts
 const SEARCH_TOOLS_NAME = "searchTools";
 const DEFAULT_MAX_RESULTS = 5;
 const MAX_RESULTS = 20;
@@ -16422,8 +16013,7 @@ function createSearchToolsTool(catalogTools) {
 		}
 	});
 }
-//#endregion
-//#region src/chat/tool-support/pi-tool-adapter.ts
+// src/chat/tool-support/pi-tool-adapter.ts
 /**
 * How long a preempted tool may take to return its own aborted result. Keep it
 * below the agent's abort settle grace, so the parked turn sees the result.
@@ -16655,8 +16245,7 @@ function createPiAgentTools(tools, sandbox, spanContext, onStatus, sandboxTools,
 		}
 	}));
 }
-//#endregion
-//#region src/chat/mcp/jwt-bearer-provider.ts
+// src/chat/mcp/jwt-bearer-provider.ts
 /**
 * Non-interactive MCP auth for bot plugins.
 *
@@ -16724,8 +16313,7 @@ function createJwtBearerMcpClientProvider(subject, mcpUrl, auth) {
 		}
 	};
 }
-//#endregion
-//#region src/chat/mcp/auth-store.ts
+// src/chat/mcp/auth-store.ts
 const MCP_AUTH_SESSION_PREFIX = "junior:mcp_oauth_attempt:v2";
 const MCP_AUTH_CREDENTIALS_PREFIX = "junior:mcp_auth_credentials";
 const MCP_AUTH_SESSION_INDEX_PREFIX = "junior:mcp_oauth_attempt_index:v2";
@@ -16890,8 +16478,7 @@ async function putMcpServerSessionId(userId, provider, sessionId, ttlMs = MCP_SE
 async function deleteMcpServerSessionId(userId, provider) {
 	await (await getConnectedStateAdapter()).delete(serverSessionKey(userId, provider));
 }
-//#endregion
-//#region src/chat/mcp/oauth-provider.ts
+// src/chat/mcp/oauth-provider.ts
 function createClientMetadata(callbackUrl) {
 	return {
 		client_name: "Junior MCP Client",
@@ -16912,12 +16499,12 @@ function requireEnv(name) {
 	return value;
 }
 var StateBackedMcpOAuthClientProvider = class {
+	clientMetadata;
 	authSessionId;
 	callbackUrl;
 	sessionContext;
 	runCredentialMutation;
 	oauthClient;
-	clientMetadata;
 	constructor(authSessionId, callbackUrl, sessionContext, runCredentialMutation, oauthClient) {
 		this.authSessionId = authSessionId;
 		this.callbackUrl = callbackUrl;
@@ -17050,8 +16637,7 @@ var StateBackedMcpOAuthClientProvider = class {
 		return session;
 	}
 };
-//#endregion
-//#region src/chat/mcp/oauth.ts
+// src/chat/mcp/oauth.ts
 function getMcpOAuthCallbackPath(provider) {
 	return `/api/oauth/callback/mcp/${provider}`;
 }
@@ -17123,8 +16709,7 @@ async function finalizeMcpAuthorization(provider, authSessionId, authorizationCo
 	if (!nextSession) throw new Error(`Unknown MCP auth session: ${authSessionId}`);
 	return nextSession;
 }
-//#endregion
-//#region src/chat/services/auth-pause-response.ts
+// src/chat/services/auth-pause-response.ts
 const MAX_AUTH_REQUEST_LENGTH = 200;
 function formatAuthRequest(requestText) {
 	const normalized = requestText.replace(/\s+/g, " ").trim();
@@ -17144,8 +16729,7 @@ function buildAuthPauseResponse(slackUserId, providerDisplayName, requestText) {
 	const notice = `${mention}I need access to your ${providerDisplayName} account to continue. I sent you a private link.`;
 	return request ? `${notice}\n\n*Why:* ${request}` : notice;
 }
-//#endregion
-//#region src/chat/services/mcp-auth-orchestration.ts
+// src/chat/services/mcp-auth-orchestration.ts
 var McpAuthorizationPauseError = class extends AuthorizationPauseError {
 	constructor(provider, providerDisplayName, disposition, requestText) {
 		super("mcp", provider, providerDisplayName, disposition, requestText);
@@ -17181,6 +16765,13 @@ function createMcpAuthOrchestration(input) {
 		authSessionIdsByProvider.set(plugin.manifest.name, provider.authSessionId);
 		return provider;
 	};
+	const serviceAccountProviderFactory = async (plugin) => {
+		const provider = plugin.manifest.name;
+		if (!plugin.manifest.accounts?.serviceAccount) return;
+		if (!serviceAccountOnly(plugin.manifest) && input.actorId && (await getMcpStoredOAuthCredentials(input.actorId, provider))?.tokens) return;
+		const credentials = await getMcpServiceAccountCredentials(provider);
+		return credentials ? createMcpServiceAccountClientProvider(provider, credentials) : void 0;
+	};
 	const onAuthorizationRequired = async (provider, context) => {
 		if (botAuthProviders.has(provider)) return false;
 		if (pendingPause) return true;
@@ -17261,12 +16852,12 @@ function createMcpAuthOrchestration(input) {
 	};
 	return {
 		authProviderFactory,
+		serviceAccountProviderFactory,
 		onAuthorizationRequired,
 		getPendingPause: () => pendingPause
 	};
 }
-//#endregion
-//#region src/chat/sandbox/egress/credentials.ts
+// src/chat/sandbox/egress/credentials.ts
 const HTTP_READ_METHODS = /* @__PURE__ */ new Set([
 	"GET",
 	"HEAD",
@@ -17438,8 +17029,7 @@ async function sandboxEgressCredentialLease(provider, selection, context) {
 function hasSandboxEgressLeaseTransformForHost(lease, host) {
 	return lease.headerTransforms.some((transform) => matchesSandboxEgressDomain(host, transform.domain));
 }
-//#endregion
-//#region src/chat/egress/credentialed.ts
+// src/chat/egress/credentialed.ts
 const HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
 	"connection",
 	"host",
@@ -17566,7 +17156,7 @@ function logSandboxEgressUpstreamRequest(input) {
 	});
 }
 async function requestBodyBytes(request) {
-	if (request.method === "GET" || request.method === "HEAD" || request.body === null) return;
+	if (request.method === "GET" || request.method === "HEAD" || request.method === "OPTIONS" || request.body === null) return;
 	return await request.arrayBuffer();
 }
 /**
@@ -17986,8 +17576,7 @@ async function executeCredentialedEgressRequest(input) {
 		});
 	}
 }
-//#endregion
-//#region src/chat/egress/plugin.ts
+// src/chat/egress/plugin.ts
 function credentialContextForPluginEgress(credentialContext) {
 	return {
 		credentials: credentialContext,
@@ -18030,8 +17619,7 @@ function createPluginEgress(deps) {
 		});
 	} };
 }
-//#endregion
-//#region src/chat/services/guardian-action-policy.ts
+// src/chat/services/guardian-action-policy.ts
 /**
 * The only reasons that Guardian can block an action. Keep each rule broad
 * and free of tool or provider names. The model sees them in this order.
@@ -18157,8 +17745,7 @@ ${renderRules("deny")}
 - Rate risk and user authorization first.
 - Then set the rule to the id of the one rule that the action clearly matches. When a hard rule and a confirmation rule both match, name the hard rule. When no definition clearly fits, use \`none\`. Do not name a rule only to express general doubt.
 - Keep the reason to one concise, specific sentence. For a confirmation rule, name the exact action, target, and material side effects the user must confirm. For a hard rule, name the risk. For \`none\`, say why the action is ordinary.`;
-//#endregion
-//#region src/chat/services/guardian-action-review.ts
+// src/chat/services/guardian-action-review.ts
 const guardianAssessmentSchema = z.object({
 	riskLevel: z.enum([
 		"low",
@@ -18292,8 +17879,7 @@ function createGuardianActionReviewer(options) {
 		};
 	} };
 }
-//#endregion
-//#region src/chat/tool-support/action-review-evidence.ts
+// src/chat/tool-support/action-review-evidence.ts
 const MAX_MESSAGE_TRANSCRIPT_TOKENS = 1e4;
 const MAX_TOOL_TRANSCRIPT_TOKENS = 1e4;
 const MAX_MESSAGE_ENTRY_TOKENS = 2e3;
@@ -18437,8 +18023,7 @@ function buildToolActionEvidence(messages, options = {}) {
 		omittedEntries: included.filter((value) => !value).length
 	};
 }
-//#endregion
-//#region src/chat/agent-invocations/root-conversation.ts
+// src/chat/agent-invocations/root-conversation.ts
 /** Most root messages that Guardian reads, newest first. Codex uses 16. */
 const MAX_ROOT_MESSAGES = 16;
 /** Most characters of one root message. */
@@ -18590,8 +18175,7 @@ async function readRootConversation(args) {
 		truncated: hasOlder || orphanEdits || messages.length < all.length
 	};
 }
-//#endregion
-//#region src/chat/agent/tools.ts
+// src/chat/agent/tools.ts
 /** Record optional reporting without changing the loadSkill outcome. */
 async function tryRecordSkillLoadStat(skill) {
 	if (!process.env.DATABASE_URL) return;
@@ -18709,6 +18293,7 @@ async function wireAgentTools(args) {
 	});
 	const mcpToolManager = new McpToolManager(pluginCatalogRuntime.getMcpProviders(), {
 		authProviderFactory: mcpAuth.authProviderFactory,
+		serviceAccountProviderFactory: mcpAuth.serviceAccountProviderFactory,
 		onAuthorizationRequired: (provider, _error, context) => mcpAuth.onAuthorizationRequired(provider, context),
 		onToolSuccess: async (input) => {
 			return await pluginHooks.afterMcpTool({
@@ -18827,7 +18412,11 @@ async function wireAgentTools(args) {
 	const pendingMcpProvider = args.state.pendingAuth?.kind === "mcp" ? args.state.pendingAuth.provider : void 0;
 	if (credentialUserId) for (const provider of args.connectedMcpProviders) {
 		if (provider === pendingMcpProvider) continue;
-		if (await mcpToolManager.activateProvider(provider)) await args.recordConnectedMcpProvider(provider);
+		try {
+			if (await mcpToolManager.activateProvider(provider)) await args.recordConnectedMcpProvider(provider);
+		} catch (error) {
+			if (!(error instanceof McpServiceAccountRequiredError)) throw error;
+		}
 		if (mcpAuth.getPendingPause()) {
 			args.resume.captureHistoryBeforePrompt(args.preAgentPromptMessages());
 			throw mcpAuth.getPendingPause();
@@ -18890,8 +18479,7 @@ async function wireAgentTools(args) {
 		toolRuntimeContext
 	};
 }
-//#endregion
-//#region src/chat/agent/resume.ts
+// src/chat/agent/resume.ts
 function extractSliceUsage(messages, beforeMessageCount) {
 	const usage = extractGenAiUsageSummary(...messages.slice(beforeMessageCount).filter(isAssistantMessage));
 	return hasAgentTurnUsage(usage) ? usage : void 0;
@@ -19107,8 +18695,7 @@ function createResumeState(args) {
 		}
 	};
 }
-//#endregion
-//#region src/chat/services/plan-continuation.ts
+// src/chat/services/plan-continuation.ts
 const OPEN_PLAN_TAG = "open-plan";
 function openItems(input) {
 	const plan = input && typeof input === "object" ? input.plan : void 0;
@@ -19172,8 +18759,7 @@ function appendOpenPlan(continuation, messages) {
 	const plan = latestOpenPlanItems(messages);
 	return plan.length === 0 ? continuation : `${continuation}\n\n<${OPEN_PLAN_TAG}>\n${JSON.stringify(plan)}\n</${OPEN_PLAN_TAG}>`;
 }
-//#endregion
-//#region src/chat/services/context-compaction.ts
+// src/chat/services/context-compaction.ts
 const RETAINED_USER_MESSAGE_TOKENS = 2e4;
 const MAX_SUMMARY_CHARS = 6e3;
 /** Raised when Junior cannot compact history below the active model's hard ceiling. */
@@ -19604,8 +19190,7 @@ async function compactActiveContextIfNeeded(args, deps) {
 		piMessages: messages
 	};
 }
-//#endregion
-//#region src/chat/agent/handoff.ts
+// src/chat/agent/handoff.ts
 /** Tools that must be the only tool call in their assistant message. */
 const EXCLUSIVE_TOOL_NAMES = [
 	HANDOFF_TOOL_NAME,
@@ -19724,8 +19309,7 @@ function applyHandoff(args) {
 		thinkingLevel: args.pending.thinkingLevel
 	};
 }
-//#endregion
-//#region src/chat/agent/index.ts
+// src/chat/agent/index.ts
 /**
 * Agent executor.
 *
@@ -20720,8 +20304,7 @@ async function executeAgentRunInPrivacyContext(run, conversationPrivacy, runLogC
 		await closeTools?.();
 	}
 }
-//#endregion
-//#region src/chat/runtime/agent-runner.ts
+// src/chat/runtime/agent-runner.ts
 /** Compose the agent executor with stable host dependencies. */
 function createAgentRunner(execute, options) {
 	const attachmentStorage = options?.attachmentStorage;
@@ -20747,7 +20330,7 @@ function createAgentRunner(execute, options) {
 			} } : void 0
 		};
 		if (run.instruction.storedAttachments?.length) {
-			const { loadInputImages } = await import("./images-BN_BiBXF.js").then((n) => n.n);
+			const { loadInputImages } = await import("./images-BbSdVHC6.js").then((n) => n.n);
 			const storage = nextRun.environment?.attachmentStorage;
 			if (!storage) throw new Error("Attachment storage is unavailable.");
 			nextRun.instruction = {
@@ -20762,5 +20345,4 @@ function createAgentRunner(execute, options) {
 		return await execute(nextRun, streamFn);
 	} };
 }
-//#endregion
-export { getAgentInvocation as $, resolveSlackChannelIdFromMessage as A, consumeSandboxEgressPermissionDeniedSignal as At, effectiveTaskOutcomes as B, withoutSavedSteeringMessages as Bt, renderBlockText as C, ingestEvent as Ct, storeAttachment as D, SANDBOX_EGRESS_PROXY_PATH as Dt, requestAttachmentDeletion as E, shouldPropagateSandboxEgressTrace as Et, logScheduledAutomationRunSkipped as F, parseOAuthStatePayload as Ft, recordSubagentStarted as G, readBlockedReport as Gt, stopChildAgentsOf as H, actorFromRun as Ht, scheduledAutomationRunAttributes as I, resolveBaseUrl as It, createAgentInvocation as J, setConfigDefaults as Jt, listChildAgents as K, shouldEmitDevAgentTrace as Kt, editEventAutomation as L, startOAuthFlow as Lt, getConversationInfo as M, sandboxEgressSignalsResponseSchema as Mt, listThreadReplies as N, deliverPrivateMessage as Nt, parseSlackThreadId as O, clearSandboxEgressSignals as Ot, editScheduledAutomation as P, formatProviderLabel as Pt, getActiveAgentInvocationForConversation as Q, AutomationEditError as R, createUserTokenStore as Rt, renderAttachmentText as S, processWorkspaceSnapshotJob as St, readLiveAttachment as T, normalizeSandboxEgressTracePropagationDomains as Tt, stopConversationSession as U, toolInvocationDestination as Ut, resolveTaskOutcomes as V, RetryableDeliveryError as Vt, recordSubagentEnded as W, AuthorizationFlowDisabledError as Wt, createAgentInvocationFromLatest as X, createAgentInvocationForMessage as Y, findChildAgentConversationId as Z, resolvePluginOAuthAccount as _, AgentMessageTargetError as _t, buildAuthPauseResponse as a, getAgentInvocationTurnId as at, unpublishedArtifactHeaders as b, conversationSubtreeColumns as bt, deleteMcpAuthSessionsForUserProvider as c, isTerminalAgentInvocation as ct, getMcpAuthSession as d, markAgentInvocationMailboxAppended as dt, getAgentInvocationIdForEvents as et, getMcpStoredOAuthCredentials as f, markAgentInvocationParentMailboxAppended as ft, readStats as g, reportReplacedAgentInvocation as gt, latestProgressStatus as h, markAgentInvocationSteered as ht, executeCredentialedEgressRequest as i, getAgentInvocationResultMessageId as it, resolveSlackChannelIdFromThreadId as j, parseSandboxEgressCredentialToken as jt, readSlackRawMessageContext as k, consumeSandboxEgressAuthRequiredSignal as kt, deleteMcpServerSessionId as l, listPendingAgentInvocationMailboxAppends as lt, PluginCredentialFailureError as m, markAgentInvocationRunning as mt, executeAgentRun as n, getAgentInvocationIdForResult as nt, finalizeMcpAuthorization as o, getChildAgentLabel as ot, putMcpStoredOAuthCredentials as p, markAgentInvocationPaused as pt, completeAgentInvocation as q, getConfigDefaults as qt, createContextCompactor as r, getAgentInvocationMessageId as rt, deleteMcpAuthSession as s, getLatestAgentInvocationForConversation as st, createAgentRunner as t, getAgentInvocationIdForMessage as tt, deleteMcpStoredOAuthCredentials as u, listPendingAgentInvocationResults as ut, publicArtifactHeaders as v, PARENT_AGENT_TARGET as vt, collectAttachmentGarbage as w, resolveSandboxEgressProviderForHost as wt, lookupSlackUserProfile as x, getMcpProviderErrorAttributes as xt, readPublicArtifact as y, conversationSubtree as yt, eventAutomationTriggerAvailable as z, buildSteeringPiMessage as zt };
+export { getAgentInvocation as $, resolveSlackChannelIdFromMessage as A, parseSandboxEgressCredentialToken as At, effectiveTaskOutcomes as B, actorFromRun as Bt, renderBlockText as C, resolveSandboxEgressProviderForHost as Ct, storeAttachment as D, clearSandboxEgressSignals as Dt, requestAttachmentDeletion as E, SANDBOX_EGRESS_PROXY_PATH as Et, logScheduledAutomationRunSkipped as F, startOAuthFlow as Ft, recordSubagentStarted as G, getConfigDefaults as Gt, stopChildAgentsOf as H, AuthorizationFlowDisabledError as Ht, scheduledAutomationRunAttributes as I, createUserTokenStore as It, createAgentInvocation as J, listChildAgents as K, setConfigDefaults as Kt, editEventAutomation as L, buildSteeringPiMessage as Lt, getConversationInfo as M, formatProviderLabel as Mt, listThreadReplies as N, parseOAuthStatePayload as Nt, parseSlackThreadId as O, consumeSandboxEgressAuthRequiredSignal as Ot, editScheduledAutomation as P, resolveBaseUrl as Pt, getActiveAgentInvocationForConversation as Q, AutomationEditError as R, withoutSavedSteeringMessages as Rt, renderAttachmentText as S, ingestEvent as St, readLiveAttachment as T, shouldPropagateSandboxEgressTrace as Tt, stopConversationSession as U, readBlockedReport as Ut, resolveTaskOutcomes as V, toolInvocationDestination as Vt, recordSubagentEnded as W, shouldEmitDevAgentTrace as Wt, createAgentInvocationFromLatest as X, createAgentInvocationForMessage as Y, findChildAgentConversationId as Z, resolvePluginOAuthAccount as _, AgentMessageTargetError as _t, buildAuthPauseResponse as a, getAgentInvocationTurnId as at, unpublishedArtifactHeaders as b, conversationSubtreeColumns as bt, deleteMcpAuthSessionsForUserProvider as c, isTerminalAgentInvocation as ct, getMcpAuthSession as d, markAgentInvocationMailboxAppended as dt, getAgentInvocationIdForEvents as et, getMcpStoredOAuthCredentials as f, markAgentInvocationParentMailboxAppended as ft, readStats as g, reportReplacedAgentInvocation as gt, latestProgressStatus as h, markAgentInvocationSteered as ht, executeCredentialedEgressRequest as i, getAgentInvocationResultMessageId as it, resolveSlackChannelIdFromThreadId as j, sandboxEgressSignalsResponseSchema as jt, readSlackRawMessageContext as k, consumeSandboxEgressPermissionDeniedSignal as kt, deleteMcpServerSessionId as l, listPendingAgentInvocationMailboxAppends as lt, PluginCredentialFailureError as m, markAgentInvocationRunning as mt, executeAgentRun as n, getAgentInvocationIdForResult as nt, finalizeMcpAuthorization as o, getChildAgentLabel as ot, putMcpStoredOAuthCredentials as p, markAgentInvocationPaused as pt, completeAgentInvocation as q, createContextCompactor as r, getAgentInvocationMessageId as rt, deleteMcpAuthSession as s, getLatestAgentInvocationForConversation as st, createAgentRunner as t, getAgentInvocationIdForMessage as tt, deleteMcpStoredOAuthCredentials as u, listPendingAgentInvocationResults as ut, publicArtifactHeaders as v, PARENT_AGENT_TARGET as vt, collectAttachmentGarbage as w, normalizeSandboxEgressTracePropagationDomains as wt, lookupSlackUserProfile as x, processWorkspaceSnapshotJob as xt, readPublicArtifact as y, conversationSubtree as yt, eventAutomationTriggerAvailable as z, RetryableDeliveryError as zt };