@sentry/junior 0.263.0 → 0.265.0

package/dist/{agent-hooks-CqnZfuCt.js → credentialed-C6pKlB1p.js}

@@ -1,29 +1,30 @@
 import { t as __exportAll } from "./rolldown-runtime-nwUcYXjP.js";
-import { i as completeObject, o as embedTexts } from "./client-DZBCBj1M.js";
-import { T as withSpan, a as extractGenAiUsageSummary, b as setSpanStatus, f as logException, m as logWarn, p as logInfo, y as setSpanAttributes, z as isRecord$1 } from "./logging-Dk_FpF36.js";
-import { a as getClient$1 } from "./sentry-BBUlHih9.js";
-import { t as canExposeConversationPayload } from "./conversation-privacy-FY8yc2q3.js";
-import { i as getChatConfig, n as botConfig, o as getSlackBotToken } from "./config-Dnv8KmNs.js";
+import { C as toOptionalTrimmed, i as completeObject, o as embedTexts } from "./client-DX34VNtH.js";
+import { i as getChatConfig, n as botConfig, o as getSlackBotToken, v as normalizeSlackEmojiName } from "./config-BayQ9hHH.js";
+import { T as withSpan, a as extractGenAiUsageSummary, f as logException, m as logWarn, p as logInfo, s as getLogContextAttributes, u as logAudit, v as setSentryUser, y as setSpanAttributes, z as isRecord$2 } from "./logging-D2QBriUo.js";
+import { a as getClient$1, n as captureMessage, r as continueTrace } from "./sentry-MDkYAVPV.js";
+import { t as canExposeConversationPayload } from "./conversation-privacy-frjQCJa9.js";
 import { r as defaultModelId } from "./model-profile-Bg8EoCKD.js";
-import { d as parseSlackTeamId, g as parseSlackMessageTs, i as isActorUserId, o as parseActorUserId, u as parseSlackChannelReferenceId } from "./actor-tlxzqaRe.js";
-import { D as hasAgentTurnUsage, M as readUserTimezone, P as saveUserTimezone, c as getConversationEventStore, d as getDb, f as getSqlExecutor, g as createSqlStore, i as resolveViewerUser, r as readActorIdentity } from "./viewer-DmNRM88V.js";
+import { d as parseSlackTeamId, f as parseSlackUserId, g as parseSlackMessageTs, i as isActorUserId, o as parseActorUserId, u as parseSlackChannelReferenceId } from "./actor-tlxzqaRe.js";
+import { F as saveUserTimezone, N as readUserTimezone, O as hasAgentTurnUsage, _ as createSqlStore, a as resolveViewerUser, f as getDb, i as readIdentityById, l as getConversationEventStore, p as getSqlExecutor, r as readActorIdentity, z as parseDestination } from "./viewer-B2wXNspU.js";
 import { c as juniorIdentities, d as juniorDestinations, l as juniorUsers, s as juniorConversations } from "./agent-invocations-CxKldAeB.js";
-import { _ as juniorConversationAnnotations, b as juniorAttachments, f as juniorConversationBriefs, h as juniorConversationEvents, i as juniorWorkspaces, n as juniorSnapshots, r as juniorWorkspaceRepos, u as juniorConversationParticipants, v as juniorCodeChanges, y as juniorCodeRepositories } from "./executor-J9k2sp9m.js";
+import { _ as juniorConversationAnnotations, b as juniorAttachments, f as juniorConversationBriefs, h as juniorConversationEvents, i as juniorWorkspaces, n as juniorSnapshots, r as juniorWorkspaceRepos, u as juniorConversationParticipants, v as juniorCodeChanges, y as juniorCodeRepositories } from "./executor-CAr7xQr2.js";
 import { o as decodeStoredConversationEvent } from "./history-AY8rs-FR.js";
-import { h as credentialSubjectSchema } from "./registry-BFzQFV_y.js";
-import { n as getDefaultRedisStateAdapterFor, r as getStateAdapter, s as withLock } from "./adapter-BIacI0Bt.js";
+import { _ as CredentialUnavailableError, a as resolveAuthTokenPlaceholder, h as credentialSubjectSchema, m as credentialLogContext, o as resolvePluginCommandEnv, p as credentialContextSchema } from "./registry-COTeZ2cV.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-D3qbJlYz.js";
+import { a as acquireActiveLock, n as getDefaultRedisStateAdapterFor, r as getStateAdapter, s as withLock } from "./adapter-cUkPH3Om.js";
 import { i as isValidTimeZone } from "./cadence-R7Em4RjE.js";
 import { B as readMessageAttachments, C as conversationReportEventSchema, F as readMessageCardRefs, J as parseBriefInput, q as conversationBriefSchema, w as conversationReportMessageEventSchema } from "./conversation-B0baEwoA.js";
-import { n as briefEntriesFromReportEvents, s as generateBrief, t as BRIEF_PROMPT } from "./prompt-CxatQVaj.js";
-import { D as SANDBOX_WORKSPACE_ROOT, S as runNonInteractiveCommand, l as isSandboxMissingError, n as hash, v as getVercelSandboxCredentials, y as sleep$1 } from "./profile-Dq5I7TV1.js";
+import { n as briefEntriesFromReportEvents, s as generateBrief, t as BRIEF_PROMPT } from "./prompt-CvaDdSX3.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { z } from "zod";
-import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
+import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { and, arrayContains, asc, desc, eq, exists, getTableColumns, gte, inArray, isNotNull, isNull, lt, lte, max, ne, notExists, or, sql } from "drizzle-orm";
-import { codeChangeInputSchema, conversationAnnotationInputSchema, conversationEventPresentationSchema, defineConversationEvent, eventInputSchema, eventMatchSchema, eventMatches, eventTypeSchema, missingToolAnnotationKeys, normalizeEventIdentifier, objectAnnotationSchema, objectIconPath, objectTypeSchema, pluginEventsSchema, promptContextSchema, promptMessageSchema, stableEventMatchKey } from "@sentry/junior-plugin-api";
+import { EgressAuthRequired, EgressPolicyDenied, actorSchema, codeChangeInputSchema, conversationAnnotationInputSchema, conversationEventPresentationSchema, defineConversationEvent, eventInputSchema, eventMatchSchema, eventMatches, eventTypeSchema, missingToolAnnotationKeys, normalizeEventIdentifier, objectAnnotationSchema, objectIconPath, objectTypeSchema, pluginAuthorizationSchema, pluginCredentialHeaderTransformSchema, pluginCredentialResultSchema, pluginEventsSchema, pluginGrantSchema, pluginProviderAccountSchema, pluginStoredTokensSchema, promptContextSchema, promptMessageSchema, sourceSchema, stableEventMatchKey } from "@sentry/junior-plugin-api";
 import { alias, union } from "drizzle-orm/pg-core";
 import { WebClient } from "@slack/web-api";
-import { Sandbox } from "@vercel/sandbox";
+import { FileSystem, Sandbox } from "@vercel/sandbox";
+import { createRemoteJWKSet, decodeJwt, jwtVerify } from "jose";
 // src/chat/conversations/structured-events.ts
 /** Reserved namespace for Junior-owned conversation metadata events. */
 const JUNIOR_NATIVE_EVENT_NAMESPACE = "junior";
@@ -394,8 +395,8 @@ async function saveObjectAnnotations(conversationId, plugin, value) {
 }
 /** Save annotations from a successful plugin tool result and attach their cards. */
 async function annotateToolResult(conversationId, plugin, result) {
-	if (!isRecord$1(result) || result.isError === true) return result;
-	const details = isRecord$1(result.details) ? result.details : result;
+	if (!isRecord$2(result) || result.isError === true) return result;
+	const details = isRecord$2(result.details) ? result.details : result;
 	if (details.timed_out === true || details.isError === true || !Array.isArray(details.objectAnnotations)) return result;
 	const cards = await saveObjectAnnotations(conversationId, plugin, details.objectAnnotations);
 	const { objectAnnotations: _annotations, ...rest } = details;
@@ -403,7 +404,7 @@ async function annotateToolResult(conversationId, plugin, result) {
 		...rest,
 		objectCards: cards
 	};
-	if (isRecord$1(result.details)) return {
+	if (isRecord$2(result.details)) return {
 		...result,
 		details: annotated
 	};
@@ -1832,6 +1833,100 @@ function createPluginState(plugin, adapter) {
 		}
 	};
 }
+// src/chat/sandbox/paths.ts
+function normalizeWorkspaceRoot(input) {
+	const candidate = (input ?? "").trim();
+	if (!candidate) return "/vercel/sandbox";
+	const normalized = candidate.replace(/\/+$/, "");
+	return normalized.startsWith("/") ? normalized : `/${normalized}`;
+}
+const SANDBOX_WORKSPACE_ROOT = normalizeWorkspaceRoot(process.env.VERCEL_SANDBOX_WORKSPACE_DIR);
+const SANDBOX_REPOS_ROOT = `${SANDBOX_WORKSPACE_ROOT}/repos`;
+const SANDBOX_SKILLS_ROOT = `${SANDBOX_WORKSPACE_ROOT}/skills`;
+const SANDBOX_DATA_ROOT = `${SANDBOX_WORKSPACE_ROOT}/data`;
+/**
+* PATH for sandbox commands. Plugin runtime binaries come last so they never
+* shadow repo or Workspace tools with the same name. Repo tools often start
+* child processes through PATH, so only PATH order can protect them. Plugin
+* binaries stay reachable by name or by absolute path.
+*/
+const SANDBOX_COMMAND_PATH = `$PATH:${`${SANDBOX_WORKSPACE_ROOT}/.junior/bin`}`;
+function sandboxSkillDir(skillName) {
+	return `${SANDBOX_SKILLS_ROOT}/${skillName}`;
+}
+function sandboxSkillFile(skillName) {
+	return `${sandboxSkillDir(skillName)}/SKILL.md`;
+}
+/** Explain how the agent should resolve files and commands owned by a skill. */
+function sandboxSkillPathResolution(skillName) {
+	const skillDir = sandboxSkillDir(skillName);
+	return `Resolve relative paths in this skill against ${skillDir}. For bash commands from this skill, cd to ${skillDir} first or use absolute paths.`;
+}
+// src/chat/sandbox/noninteractive-command.ts
+const NON_INTERACTIVE_ENV = {
+	CI: "1",
+	TERM: "dumb",
+	NO_COLOR: "1",
+	PAGER: "cat",
+	GIT_PAGER: "cat",
+	GH_PROMPT_DISABLED: "1",
+	GH_NO_UPDATE_NOTIFIER: "1",
+	GH_NO_EXTENSION_UPDATE_NOTIFIER: "1",
+	GH_SPINNER_DISABLED: "1",
+	GIT_TERMINAL_PROMPT: "0",
+	GCM_INTERACTIVE: "never",
+	DEBIAN_FRONTEND: "noninteractive",
+	GIT_ASKPASS: "/bin/true",
+	GIT_CONFIG_NOSYSTEM: "1",
+	GIT_CONFIG_COUNT: "2",
+	GIT_CONFIG_KEY_0: "credential.helper",
+	GIT_CONFIG_VALUE_0: "",
+	GIT_CONFIG_KEY_1: "http.emptyAuth",
+	GIT_CONFIG_VALUE_1: "true"
+};
+function shellQuote(value) {
+	return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function buildEnvExports(options) {
+	const lines = [];
+	if (options.path) lines.push(`export PATH="${options.path}"`);
+	for (const [key, value] of Object.entries(NON_INTERACTIVE_ENV)) lines.push(`export ${key}=${shellQuote(value)}`);
+	for (const [key, value] of Object.entries(options.env ?? {})) lines.push(`export ${key}=${shellQuote(value)}`);
+	return lines;
+}
+/** Render one argv command as a safely quoted shell script. */
+function buildCommandScript(input) {
+	return [shellQuote(input.cmd), ...(input.args ?? []).map(shellQuote)].join(" ");
+}
+/** Build one shell entrypoint that never waits on terminal input. */
+function buildNonInteractiveShellScript(script, options = {}) {
+	return [
+		...buildEnvExports(options),
+		"exec </dev/null",
+		script
+	].join(" && ");
+}
+/** Wrap argv-style commands so every sandbox subprocess runs in non-interactive mode. */
+function buildNonInteractiveCommand(input) {
+	return {
+		cmd: "bash",
+		args: [input.login ? "-lc" : "-c", buildNonInteractiveShellScript(buildCommandScript(input), {
+			env: input.env,
+			path: input.path
+		})]
+	};
+}
+/** Run a subprocess through one enforced non-interactive entrypoint. */
+async function runNonInteractiveCommand(sandbox, input) {
+	const command = {
+		...buildNonInteractiveCommand(input),
+		...input.cwd ? { cwd: input.cwd } : void 0,
+		...input.signal ? { signal: input.signal } : void 0,
+		...input.sudo !== void 0 ? { sudo: input.sudo } : void 0,
+		...input.timeoutMs !== void 0 ? { timeoutMs: input.timeoutMs } : void 0
+	};
+	return await sandbox.runCommand(command);
+}
 // src/chat/tools/execution/plugin-tool-denied-error.ts
 const PLUGIN_DENIAL_INSTRUCTIONS = [
 	"This action was blocked by policy and was not executed.",
@@ -1988,6 +2083,26 @@ function runWithWorkspaceTeamId(teamId, fn) {
 function getWorkspaceTeamId() {
 	return workspaceTeamIdStorage.getStore();
 }
+// src/chat/sleep.ts
+/** Wait for a duration, rejecting with the owning signal reason when cancelled. */
+function sleep$1(ms, signal) {
+	if (!signal) return new Promise((resolve) => setTimeout(resolve, ms));
+	return new Promise((resolve, reject) => {
+		if (signal.aborted) {
+			reject(signal.reason);
+			return;
+		}
+		const timeoutId = setTimeout(() => {
+			signal.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		const onAbort = () => {
+			clearTimeout(timeoutId);
+			reject(signal.reason);
+		};
+		signal.addEventListener("abort", onAbort, { once: true });
+	});
+}
 // src/chat/slack/client.ts
 var SlackActionError = class extends Error {
 	code;
@@ -2209,7 +2324,6 @@ async function withSlackRetries(task, maxAttempts = 3, context = {}) {
 						if (mapped.retryAfterSeconds) errorAttrs["app.slack.retry_after_ms"] = mapped.retryAfterSeconds * 1e3;
 					} else if (mapped.statusCode != null) errorAttrs["http.response.status_code"] = mapped.statusCode;
 					setSpanAttributes(errorAttrs);
-					setSpanStatus("error");
 					throw error;
 				}
 			}, {
@@ -2310,21 +2424,9 @@ async function getFilePermalink(fileId) {
 }
 async function downloadPrivateSlackFile(url) {
 	const token = resolveSlackToken();
-	return withSpan("GET files.slack.com", "http.client", {}, async () => {
-		const response = await fetch(url, { headers: { Authorization: `Bearer ${token}` } });
-		setSpanAttributes({ "http.response.status_code": response.status });
-		if (!response.ok) {
-			setSpanAttributes({ "error.type": String(response.status) });
-			setSpanStatus("error");
-			throw new Error(`Slack file download failed: ${response.status}`);
-		}
-		return Buffer.from(await response.arrayBuffer());
-	}, {
-		"http.request.method": "GET",
-		"server.address": "files.slack.com",
-		"url.scheme": "https",
-		"app.slack.method": "files.download"
-	});
+	const response = await fetch(url, { headers: { Authorization: `Bearer ${token}` } });
+	if (!response.ok) throw new Error(`Slack file download failed: ${response.status}`);
+	return Buffer.from(await response.arrayBuffer());
 }
 // src/chat/credentials/subject.ts
 const CREDENTIAL_SUBJECT_HMAC_CONTEXT = "junior.credential_subject.v1";
@@ -2336,11 +2438,11 @@ function getCredentialSubjectSecret() {
 function buildPayload(parts) {
 	return [CREDENTIAL_SUBJECT_HMAC_CONTEXT, ...parts].join("\0");
 }
-function signPayload(secret, payload) {
+function signPayload$1(secret, payload) {
 	const digest = createHmac("sha256", secret).update(payload).digest("hex");
 	return `${CREDENTIAL_SUBJECT_SIGNATURE_VERSION}=${digest}`;
 }
-function timingSafeMatch(expected, actual) {
+function timingSafeMatch$1(expected, actual) {
 	const expectedBuffer = Buffer.from(expected);
 	const actualBuffer = Buffer.from(actual);
 	if (expectedBuffer.length !== actualBuffer.length) return false;
@@ -2374,7 +2476,7 @@ function bindSlackDirectCredentialSubject(input) {
 			type: "slack-direct-conversation",
 			teamId,
 			channelId,
-			signature: signPayload(secret, buildPayload([
+			signature: signPayload$1(secret, buildPayload([
 				subject.allowedWhen,
 				teamId,
 				channelId,
@@ -2391,7 +2493,7 @@ function verifySlackDirectCredentialSubject(input) {
 	const { subject } = input;
 	const binding = subject.binding;
 	if (subject.type !== "user" || !isActorUserId(subject.userId) || subject.allowedWhen !== "private-direct-conversation" || !binding || binding.type !== "slack-direct-conversation" || typeof binding.signature !== "string" || !binding.signature || binding.teamId !== input.teamId || binding.channelId !== channelId) return false;
-	return timingSafeMatch(signPayload(secret, buildPayload([
+	return timingSafeMatch$1(signPayload$1(secret, buildPayload([
 		subject.allowedWhen,
 		binding.teamId,
 		binding.channelId,
@@ -2415,7 +2517,7 @@ function bindScheduledAutomationCredentialSubject(input) {
 			type: "scheduled-automation",
 			plugin,
 			taskId,
-			signature: signPayload(secret, buildPayload([
+			signature: signPayload$1(secret, buildPayload([
 				"scheduled-automation",
 				plugin,
 				taskId,
@@ -2430,7 +2532,7 @@ function verifyScheduledAutomationCredentialSubject(input) {
 	const { subject } = input;
 	const binding = subject.binding;
 	if (!secret || input.plugin !== "scheduler" || subject.type !== "user" || !isActorUserId(subject.userId) || subject.allowedWhen !== "scheduled-automation" || !subject.taskId || binding.type !== "scheduled-automation" || binding.plugin !== input.plugin || binding.taskId !== subject.taskId) return false;
-	return timingSafeMatch(signPayload(secret, buildPayload([
+	return timingSafeMatch$1(signPayload$1(secret, buildPayload([
 		"scheduled-automation",
 		binding.plugin,
 		binding.taskId,
@@ -2454,7 +2556,7 @@ function bindEventAutomationCredentialSubject(input) {
 			type: "event-automation",
 			plugin,
 			taskId,
-			signature: signPayload(secret, buildPayload([
+			signature: signPayload$1(secret, buildPayload([
 				"event-automation",
 				plugin,
 				taskId,
@@ -2469,7 +2571,7 @@ function verifyEventAutomationCredentialSubject(input) {
 	const { subject } = input;
 	const binding = subject.binding;
 	if (!secret || input.plugin !== "junior" || subject.type !== "user" || !isActorUserId(subject.userId) || subject.allowedWhen !== "event-automation" || !subject.taskId || binding.type !== "event-automation" || binding.plugin !== input.plugin || binding.taskId !== subject.taskId) return false;
-	return timingSafeMatch(signPayload(secret, buildPayload([
+	return timingSafeMatch$1(signPayload$1(secret, buildPayload([
 		"event-automation",
 		binding.plugin,
 		binding.taskId,
@@ -2490,7 +2592,7 @@ function bindTimerWatchCredentialSubject(input) {
 			type: "timer-watch",
 			conversationId,
 			watchId,
-			signature: signPayload(secret, buildPayload([
+			signature: signPayload$1(secret, buildPayload([
 				"timer-watch",
 				conversationId,
 				watchId,
@@ -2505,7 +2607,7 @@ function verifyTimerWatchCredentialSubject(input) {
 	const { subject } = input;
 	const binding = subject.binding;
 	if (!secret || subject.type !== "user" || !isActorUserId(subject.userId) || subject.allowedWhen !== "timer-watch" || binding.type !== "timer-watch" || binding.conversationId !== input.conversationId || binding.watchId !== input.watchId) return false;
-	return timingSafeMatch(signPayload(secret, buildPayload([
+	return timingSafeMatch$1(signPayload$1(secret, buildPayload([
 		"timer-watch",
 		binding.conversationId,
 		binding.watchId,
@@ -2970,36 +3072,2143 @@ function workspaceRepoCheckoutPath(repo) {
 	if (!path) throw new Error(`Invalid repository name for checkout path: ${repo}`);
 	return path;
 }
-// src/chat/sandbox/snapshot/builder-sandbox.ts
+// src/chat/sandbox/vercel/credentials.ts
+/**
+* Resolve explicit Vercel Sandbox credentials, or return undefined to let
+* the SDK read ambient Vercel auth from its own environment detection.
+*/
+function getVercelSandboxCredentials() {
+	const token = toOptionalTrimmed(process.env.VERCEL_TOKEN);
+	const teamId = toOptionalTrimmed(process.env.VERCEL_TEAM_ID);
+	const projectId = toOptionalTrimmed(process.env.VERCEL_PROJECT_ID);
+	if (token && teamId && projectId) return {
+		token,
+		teamId,
+		projectId
+	};
+}
+// src/chat/slack/post-warning.ts
+const codes = /* @__PURE__ */ new Set([
+	"invalid_metadata_format",
+	"invalid_metadata_schema",
+	"metadata_too_large",
+	"invalid_arguments",
+	"invalid_blocks",
+	"missing_scope",
+	"missing_charset",
+	"superfluous_charset",
+	"message_truncated"
+]);
+const pathFields = /* @__PURE__ */ new Set([
+	"metadata",
+	"event_type",
+	"event_payload",
+	"entities",
+	"entity_type",
+	"entity_payload",
+	"external_ref",
+	"id",
+	"type",
+	"url",
+	"attributes",
+	"title",
+	"text",
+	"display_id",
+	"display_type",
+	"product_name",
+	"fields",
+	"status",
+	"custom_fields",
+	"key",
+	"label",
+	"value",
+	"long",
+	"format",
+	"link",
+	"display_order",
+	"app_unfurl_url",
+	"app_id",
+	"created_by",
+	"created_at",
+	"updated_by",
+	"updated_at",
+	"full_size_preview",
+	"preview_url",
+	"mime_type"
+]);
+const diagnosticWords = new Set(`WARN ERROR Message message metadata was incorrectly formatted The the will be
+  ignored as a result For for event entity refer to following errors error
+  missing required field fields property properties additional unexpected unknown
+  unsupported invalid expected received actual type types must should match matches
+  matching does not is are has have of at in on and or an only allowed allow
+  value values string number integer boolean object array null minimum maximum
+  length min max items item empty nonempty too long short large small size limit
+  exceeded exceeds less greater than equal valid format schema validation failed
+  failure cannot contain contains found one any all none enum pattern definition
+  defined constraint constraints satisfy satisfies with without provided specified
+  unrecognized unrecognised recognized recognised extraneous disallowed duplicate
+  unique malformed nested root exactly needs need requires requirement supported
+  json-pointer input different schema_uri schema_id schemas additionalProperties
+  minLength maxLength minItems maxItems anyOf oneOf allOf`.split(/\s+/));
+function summarizeDiagnostic(value) {
+	return value.slice(0, 2e3).replace(/\b(?:https?:\/\/|www\.)[^\s"'`<>]+/gi, "[value]").replace(/\/[^\s"'`[\],;()]*|[\p{L}\p{N}\p{M}_]+(?:[-./:@=+%~][\p{L}\p{N}\p{M}_]+)*|[^\s\w[\]{}():,;."'`/*=<>!?+-]/gu, (token) => {
+		if (token.startsWith("/")) return token.split("/").slice(0, 17).map((part, index) => index === 0 ? "" : pathFields.has(part) ? part : "*").join("/");
+		return codes.has(token) || pathFields.has(token) || diagnosticWords.has(token) ? token : "[value]";
+	}).replace(/\s+/g, " ").slice(0, 2e3);
+}
+/** Report Slack warnings once, on the request span, without retrying the post. */
+function captureSlackPostWarning(response, attributes) {
+	const warnings = response.response_metadata?.warnings ?? [];
+	const messages = response.response_metadata?.messages ?? [];
+	const knownCodes = [...new Set(warnings.slice(0, 20).filter((code) => codes.has(code)))].sort();
+	const diagnostics = {
+		"app.slack.warning_count": warnings.length,
+		"app.slack.response_message_count": messages.length,
+		"app.slack.diagnostic_codes": knownCodes
+	};
+	setSpanAttributes(diagnostics);
+	if (!warnings.length && !messages.length) return;
+	captureMessage("Slack chat.postMessage returned warnings", {
+		level: "warning",
+		fingerprint: ["slack.chat.postMessage.warning", ...knownCodes.length ? knownCodes : ["unknown"]],
+		tags: { "app.slack.method": "chat.postMessage" },
+		extra: {
+			...getLogContextAttributes(),
+			...attributes,
+			...diagnostics,
+			"app.slack.response_diagnostics": {
+				warnings: warnings.slice(0, 20).map(summarizeDiagnostic),
+				messages: messages.slice(0, 20).map(summarizeDiagnostic)
+			}
+		}
+	});
+}
+// src/chat/slack/work-object.ts
+const url = z.url({ protocol: /^https?$/ });
+const textField = z.strictObject({
+	type: z.literal("string"),
+	key: z.string().min(1),
+	label: z.string().min(1),
+	value: z.string(),
+	long: z.boolean().optional(),
+	format: z.literal("markdown").optional(),
+	link: url.optional()
+}).refine((field) => !field.format || !field.link, { message: "Slack string fields cannot combine format and link" });
+const customField = z.discriminatedUnion("type", [textField, z.strictObject({
+	type: z.literal("slack#/types/timestamp"),
+	key: z.string().min(1),
+	label: z.string().min(1),
+	value: z.number().int(),
+	link: url.optional()
+})]);
+const payload = z.strictObject({
+	attributes: z.strictObject({
+		title: z.strictObject({ text: z.string().min(1) }),
+		display_id: z.string().optional(),
+		display_type: z.string().optional(),
+		product_name: z.string().optional(),
+		product_icon: z.strictObject({
+			url,
+			alt_text: z.string().min(1)
+		}).optional()
+	}),
+	custom_fields: z.array(customField).optional(),
+	display_order: z.array(z.string()).optional()
+});
+/** Limit IDs to Junior's safe subset; Slack silently rejects JSON punctuation. */
+const slackExternalRefIdSchema = z.string().min(1).regex(/^[A-Za-z0-9_-]+$/, "Unsupported Slack external reference ID");
+const entity = z.strictObject({
+	external_ref: z.strictObject({
+		id: slackExternalRefIdSchema,
+		type: z.string().min(1).optional()
+	}),
+	url
+});
+/** Validate notification and detail metadata before Slack can ignore bad fields. */
+const slackEntitySchema = z.discriminatedUnion("entity_type", [entity.extend({
+	entity_type: z.literal("slack#/entities/item"),
+	entity_payload: payload.extend({ fields: z.never().optional() })
+}), entity.extend({
+	entity_type: z.literal("slack#/entities/task"),
+	entity_payload: payload.extend({ fields: z.strictObject({ status: z.strictObject({ value: z.string() }).optional() }).optional() })
+})]);
+// src/chat/slack/outbound.ts
+const MAX_SLACK_MESSAGE_TEXT_CHARS = 4e4;
+function requireSlackConversationId(channelId, action) {
+	const normalized = normalizeSlackConversationId(channelId);
+	if (!normalized) throw new Error(`${action} requires a valid channel ID`);
+	return normalized;
+}
+function requireSlackThreadTimestamp(threadTs, action) {
+	const normalized = threadTs.trim();
+	if (!normalized) throw new Error(`${action} requires a thread timestamp`);
+	return normalized;
+}
+function requireSlackMessageTimestamp(timestamp, action) {
+	const normalized = parseSlackMessageTs(timestamp);
+	if (!normalized) throw new Error(`${action} requires a target message timestamp`);
+	return normalized;
+}
+function requireSlackMessageText(text, action) {
+	if (text.trim().length === 0) throw new Error(`${action} requires non-empty text`);
+	if (text.length > MAX_SLACK_MESSAGE_TEXT_CHARS) throw new Error(`${action} text exceeds Slack's 40000 character truncation limit`);
+	return text;
+}
+/** Resolve a Slack message permalink without making read-only workflows fail on lookup errors. */
+async function getSlackMessagePermalink(args) {
+	try {
+		return (await withSlackRetries(() => getSlackClient().chat.getPermalink({
+			channel: args.channelId,
+			message_ts: args.messageTs
+		}), 3, {
+			action: "chat.getPermalink",
+			idempotent: true,
+			spanAttributes: {
+				"app.slack.channel_id": args.channelId,
+				"app.slack.message_ts": args.messageTs
+			}
+		})).permalink;
+	} catch {
+		return;
+	}
+}
+/** Open the bot's direct message with one Slack user and return its channel ID. */
+async function openSlackDirectMessage(userId) {
+	const channelId = (await withSlackRetries(() => getSlackClient().conversations.open({ users: userId }), 3, { action: "conversations.open" })).channel?.id;
+	if (!channelId) throw new Error("Slack did not return a direct message channel.");
+	return channelId;
+}
+/** Post Slack `mrkdwn` text to a conversation or thread via the shared outbound boundary. */
+async function postSlackMessage(input) {
+	const channelId = requireSlackConversationId(input.channelId, "Slack message posting");
+	const text = requireSlackMessageText(input.text, "Slack message posting");
+	const entities = input.entities?.length ? slackEntitySchema.array().parse(input.entities) : void 0;
+	const threadTs = input.threadTs ? requireSlackThreadTimestamp(input.threadTs, "Slack thread message posting") : void 0;
+	const attributes = {
+		"app.slack.channel_id": channelId,
+		...threadTs ? { "app.slack.thread_ts": threadTs } : void 0,
+		"app.slack.work_object.count": entities?.length ?? 0
+	};
+	const response = await withSlackRetries(async () => {
+		const response = await getSlackClient().chat.postMessage({
+			channel: channelId,
+			text,
+			unfurl_links: false,
+			unfurl_media: false,
+			...input.blocks?.length ? { blocks: input.blocks } : void 0,
+			...entities ? { metadata: { entities } } : void 0,
+			...threadTs ? { thread_ts: threadTs } : void 0
+		});
+		const messageId = parseSlackMessageTs(response.ts);
+		setSpanAttributes({ "messaging.message.id": messageId });
+		captureSlackPostWarning(response, {
+			...attributes,
+			"messaging.message.id": messageId
+		});
+		return response;
+	}, 3, {
+		action: "chat.postMessage",
+		attributes
+	});
+	const messageTs = parseSlackMessageTs(response.ts);
+	if (!messageTs) throw new Error("Slack message posted without ts");
+	return {
+		ts: messageTs,
+		...input.includePermalink ? { permalink: await getSlackMessagePermalink({
+			channelId,
+			messageTs
+		}) } : void 0
+	};
+}
+/**
+* Post an ephemeral Slack message. Delivery is best-effort on Slack's side, but
+* request validation and Web API behavior are centralized here.
+*/
+async function postSlackEphemeralMessage(input) {
+	const channelId = requireSlackConversationId(input.channelId, "Slack ephemeral message posting");
+	const userId = parseSlackUserId(input.userId);
+	if (!userId) throw new Error("Slack ephemeral message posting requires a user ID");
+	const text = requireSlackMessageText(input.text, "Slack ephemeral message posting");
+	const threadTs = input.threadTs ? requireSlackThreadTimestamp(input.threadTs, "Slack ephemeral thread message posting") : void 0;
+	return { messageTs: (await withSlackRetries(() => getSlackClient().chat.postEphemeral({
+		channel: channelId,
+		user: userId,
+		text,
+		...input.blocks?.length ? { blocks: input.blocks } : void 0,
+		...threadTs ? { thread_ts: threadTs } : void 0
+	}), 3, {
+		action: "chat.postEphemeral",
+		spanAttributes: {
+			"app.slack.channel_id": channelId,
+			"app.slack.user_id": userId,
+			...threadTs ? { "app.slack.thread_ts": threadTs } : void 0
+		}
+	})).message_ts };
+}
+/** Upload files into a Slack conversation or thread via the shared outbound file boundary. */
+async function uploadFilesToConversation(input) {
+	const channelId = requireSlackConversationId(input.channelId, "Slack file upload");
+	const threadTs = input.threadTs ? requireSlackThreadTimestamp(input.threadTs, "Slack file upload") : void 0;
+	if (input.files.length === 0) throw new Error("Slack file upload requires at least one file");
+	const fileUploads = input.files.map((file) => {
+		const filename = file.filename.trim();
+		if (!filename) throw new Error("Slack file upload requires every file to have a filename");
+		return {
+			file: file.data,
+			filename
+		};
+	});
+	return { files: ((await withSlackRetries(() => getSlackClient().filesUploadV2({
+		channel_id: channelId,
+		...threadTs ? { thread_ts: threadTs } : void 0,
+		file_uploads: fileUploads
+	}), 3, {
+		action: "filesUploadV2",
+		spanAttributes: {
+			"app.slack.channel_id": channelId,
+			...threadTs ? { "app.slack.thread_ts": threadTs } : void 0
+		}
+	})).files ?? []).flatMap((completion) => (completion.files ?? []).map((file) => file.id ? { id: file.id } : {})) };
+}
+/** Add a reaction to a Slack message, treating `already_reacted` as idempotent success. */
+async function addReactionToMessage(input) {
+	const channelId = requireSlackConversationId(input.channelId, "Slack reaction");
+	const timestamp = requireSlackMessageTimestamp(input.timestamp, "Slack reaction");
+	const emoji = normalizeSlackEmojiName(input.emoji);
+	if (!emoji) throw new Error("Slack reaction requires a valid emoji alias name");
+	try {
+		await withSlackRetries(() => getSlackClient(input.timeoutMs === void 0 ? void 0 : { timeoutMs: input.timeoutMs }).reactions.add({
+			channel: channelId,
+			timestamp,
+			name: emoji
+		}), input.timeoutMs === void 0 ? 3 : 1, {
+			action: "reactions.add",
+			idempotent: true,
+			spanAttributes: {
+				"app.slack.channel_id": channelId,
+				"app.slack.message_ts": timestamp,
+				"app.slack.reaction": emoji
+			}
+		});
+	} catch (error) {
+		if (error instanceof SlackActionError && error.code === "already_reacted") return { ok: true };
+		throw error;
+	}
+	return { ok: true };
+}
+/** Remove a reaction from a Slack message, treating `no_reaction` as idempotent success. */
+async function removeReactionFromMessage(input) {
+	const channelId = requireSlackConversationId(input.channelId, "Slack reaction removal");
+	const timestamp = requireSlackMessageTimestamp(input.timestamp, "Slack reaction removal");
+	const emoji = normalizeSlackEmojiName(input.emoji);
+	if (!emoji) throw new Error("Slack reaction removal requires a valid emoji alias name");
+	try {
+		await withSlackRetries(() => getSlackClient().reactions.remove({
+			channel: channelId,
+			timestamp,
+			name: emoji
+		}), 3, {
+			action: "reactions.remove",
+			idempotent: true,
+			spanAttributes: {
+				"app.slack.channel_id": channelId,
+				"app.slack.message_ts": timestamp,
+				"app.slack.reaction": emoji
+			}
+		});
+	} catch (error) {
+		if (error instanceof SlackActionError && error.code === "no_reaction") return { ok: true };
+		throw error;
+	}
+	return { ok: true };
+}
+// src/chat/slack/status-format.ts
+const SLACK_STATUS_MAX_LENGTH = 50;
+/** Truncate a status string to fit Slack's 50-char assistant status limit. */
+function truncateStatusText(text) {
+	const trimmed = text.trim();
+	if (!trimmed) return "";
+	if (trimmed.length <= SLACK_STATUS_MAX_LENGTH) return trimmed;
+	return `${trimmed.slice(0, 47).trimEnd()}...`;
+}
+// src/chat/slack/mrkdwn.ts
+/** Escape dynamic text for Slack mrkdwn without changing intended formatting. */
+function escapeSlackMrkdwnText(text) {
+	return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+}
+/** Escape a URL for Slack explicit link syntax while preserving query semantics. */
+function escapeSlackLinkUrl(url) {
+	return url.replaceAll("&", "&amp;").replaceAll("<", "%3C").replaceAll(">", "%3E");
+}
+/** Build a Slack explicit link from dynamic URL and label values. */
+function formatSlackLink(url, label) {
+	return `<${escapeSlackLinkUrl(url)}|${escapeSlackMrkdwnText(label)}>`;
+}
+function readInlineCodeSpan(line, start) {
+	if (line[start] !== "`") return;
+	let n = 1;
+	while (line[start + n] === "`") n++;
+	const marker = "`".repeat(n);
+	let search = start + n;
+	while (search < line.length) {
+		const close = line.indexOf(marker, search);
+		if (close === -1) return;
+		const after = close + n;
+		if (line[after] !== "`") return {
+			text: line.slice(start, after),
+			end: after
+		};
+		search = after + 1;
+	}
+}
+function readExistingSlackAngleToken(line, start) {
+	if (line[start] !== "<") return;
+	const close = line.indexOf(">", start + 1);
+	if (close === -1) return;
+	const body = line.slice(start + 1, close);
+	if (/^(?:https?:\/\/|@|#|!)/.test(body)) return {
+		text: line.slice(start, close + 1),
+		end: close + 1
+	};
+}
+function readMarkdownLink(line, start) {
+	if (line[start] !== "[") return;
+	const labelEnd = line.indexOf("](", start + 1);
+	if (labelEnd === -1) return;
+	const destStart = labelEnd + 2;
+	if (!line.startsWith("http://", destStart) && !line.startsWith("https://", destStart)) return;
+	const closeParens = line.indexOf(")", destStart);
+	if (closeParens === -1) return;
+	return {
+		text: line.slice(start, closeParens + 1),
+		end: closeParens + 1
+	};
+}
+function hasUnmatchedClosingParen(text) {
+	let balance = 0;
+	for (const ch of text) if (ch === "(") balance++;
+	else if (ch === ")") balance--;
+	return balance < 0;
+}
+function readBareUrl(line, start) {
+	let end = start;
+	while (end < line.length) {
+		const ch = line.charAt(end);
+		if (/\s/.test(ch) || ch === "<" || ch === ">" || ch === "\"" || ch === "`" || ch === "|" || ch === "*") break;
+		end++;
+	}
+	if (end === start) return;
+	let raw = line.slice(start, end);
+	let suffix = "";
+	const peel = () => {
+		suffix = raw.slice(-1) + suffix;
+		raw = raw.slice(0, -1);
+	};
+	const shouldPeel = () => raw.endsWith("_") || /[.,!?;:]$/.test(raw) || raw.endsWith(")") && hasUnmatchedClosingParen(raw);
+	while (raw.length > 0 && shouldPeel()) peel();
+	if (!/^https?:\/\/.+/.test(raw)) return;
+	return {
+		url: raw,
+		suffix,
+		end
+	};
+}
+const BARE_SLACK_USER_ID_RE = /^@([UW](?=[A-Z0-9]*\d)[A-Z0-9]{8,})(?![\w])/;
+function readBareSlackUserMention(line, start) {
+	if (line[start] !== "@" || /\w/.test(line[start - 1] ?? "")) return;
+	const match = BARE_SLACK_USER_ID_RE.exec(line.slice(start));
+	if (!match) return;
+	return {
+		text: `<@${match[1]}>`,
+		end: start + match[0].length
+	};
+}
+/**
+* Wrap bare http(s) URLs and bare `@U123` Slack user IDs on a single line as
+* Slack explicit `<url>` links and `<@U123>` mentions.
+*/
+function wrapBareReferencesOnLine(line) {
+	let result = "";
+	let i = 0;
+	while (i < line.length) {
+		const codeSpan = readInlineCodeSpan(line, i);
+		if (codeSpan) {
+			result += codeSpan.text;
+			i = codeSpan.end;
+			continue;
+		}
+		const angleToken = readExistingSlackAngleToken(line, i);
+		if (angleToken) {
+			result += angleToken.text;
+			i = angleToken.end;
+			continue;
+		}
+		const mdLink = readMarkdownLink(line, i);
+		if (mdLink) {
+			result += mdLink.text;
+			i = mdLink.end;
+			continue;
+		}
+		const userMention = readBareSlackUserMention(line, i);
+		if (userMention) {
+			result += userMention.text;
+			i = userMention.end;
+			continue;
+		}
+		if (line.startsWith("https://", i) || line.startsWith("http://", i)) {
+			const parsed = readBareUrl(line, i);
+			if (parsed) {
+				result += `<${parsed.url}>${parsed.suffix}`;
+				i = parsed.end;
+				continue;
+			}
+		}
+		result += line[i];
+		i++;
+	}
+	return result;
+}
+/**
+* Pre-wrap bare http(s) URLs outside fenced code blocks as Slack explicit
+* links, preventing Slack's auto-linker from consuming adjacent formatting
+* markers into the URL. Bare `@U123` user IDs become `<@U123>` mentions,
+* because Slack shows a bare ID as literal text.
+*
+* Uses the same fence-toggle rule as `ensureBlockSpacing` so both passes
+* agree on which lines are code.
+*/
+function wrapBareReferences(text) {
+	const lines = text.split("\n");
+	const out = [];
+	let inCodeBlock = false;
+	for (const line of lines) {
+		if (line.trimStart().startsWith("```")) {
+			inCodeBlock = !inCodeBlock;
+			out.push(line);
+			continue;
+		}
+		out.push(inCodeBlock ? line : wrapBareReferencesOnLine(line));
+	}
+	return out.join("\n");
+}
+const LIST_ITEM_PATTERN = /^[-*•]\s|^\d+\.\s/;
+/**
+* Turn a follow-up paragraph inside a list item into a bullet at the same
+* indent.
+*
+* Slack's `markdown` block keeps only one paragraph per list item. It joins
+* the other paragraphs to the top-level item's text with no space and renders
+* nested lists after them. As a bullet, the paragraph keeps its place and
+* nesting.
+*/
+function bulletListFollowUpParagraphs(text) {
+	const lines = text.split("\n");
+	let inCodeBlock = false;
+	let inList = false;
+	for (const [i, line] of lines.entries()) {
+		const trimmed = line.trimStart();
+		const isFence = trimmed.startsWith("```");
+		if (!inCodeBlock && trimmed && trimmed.length === line.length) inList = LIST_ITEM_PATTERN.test(line);
+		else if (!inCodeBlock && inList && trimmed && !isFence && lines[i - 1]?.trim() === "" && !LIST_ITEM_PATTERN.test(trimmed)) lines[i] = `${line.slice(0, line.length - trimmed.length)}- ${trimmed}`;
+		if (isFence) inCodeBlock = !inCodeBlock;
+	}
+	return lines.join("\n");
+}
+/** Insert blank lines between content blocks so Slack renders them with visual separation. */
+function ensureBlockSpacing(text) {
+	const codeBlockPattern = /^```/;
+	const lines = text.split("\n");
+	const result = [];
+	let inCodeBlock = false;
+	for (const line of lines) {
+		if (codeBlockPattern.test(line.trimStart())) {
+			if (!inCodeBlock) {
+				const prev = result.length > 0 ? result[result.length - 1] : void 0;
+				if (prev !== void 0 && prev.trim() !== "") result.push("");
+			}
+			inCodeBlock = !inCodeBlock;
+			result.push(line);
+			continue;
+		}
+		if (inCodeBlock) {
+			result.push(line);
+			continue;
+		}
+		const prev = result.length > 0 ? result[result.length - 1] : void 0;
+		const isListItem = LIST_ITEM_PATTERN.test(line.trimStart());
+		const isListContinuation = prev !== void 0 && !isListItem && /^\s/.test(line) && (/^\s/.test(prev) || LIST_ITEM_PATTERN.test(prev));
+		if (prev !== void 0 && prev.trim() !== "" && line.trim() !== "" && !isListContinuation && !(LIST_ITEM_PATTERN.test(prev.trimStart()) && isListItem)) result.push("");
+		result.push(line);
+	}
+	return result.join("\n");
+}
+/**
+* Normalize model-authored Slack markdown for delivery via `markdown_text`
+* or `{ type: "markdown" }` blocks.
+*
+* Plugins may first rewrite ordinary Markdown. Core then applies Slack-only
+* delivery shaping: bare URL wrapping, block spacing, and list follow-up
+* paragraph bullets. Slack reply delivery owns chunking and continuation
+* markers separately.
+*/
+function normalizeSlackReplyMarkdown(text) {
+	let normalized = applyPluginFormatMarkdown(text).replace(/\r\n?/g, "\n").replace(/[ \t]+$/gm, "");
+	normalized = wrapBareReferences(normalized);
+	normalized = ensureBlockSpacing(normalized);
+	normalized = bulletListFollowUpParagraphs(normalized);
+	return normalized.replace(/\n{3,}/g, "\n\n").trim();
+}
+/** Normalize assistant status text before handing it to Slack. */
+function normalizeSlackStatusText(text) {
+	const trimmed = text.trim();
+	if (!trimmed) return "";
+	return truncateStatusText(trimmed.replace(/(?:\.\s*)+$/, "").trim());
+}
+/** Render a Slack user mention, which Slack shows as the person's name. */
+function slackMention(userId) {
+	return `<@${userId}>`;
+}
+// src/chat/slack/oauth-authorization-message.ts
+const ACCOUNT_SCOPE_NOTE = "This connects only your account. I can see only what you can see.";
+/** Present private OAuth authorization with a clear action and text fallback. */
+function buildSlackOAuthAuthorizationMessage(args) {
+	return {
+		text: `${formatSlackLink(args.authorizationUrl, args.label)}. ${ACCOUNT_SCOPE_NOTE} ${args.completionText}`,
+		blocks: [{
+			type: "section",
+			text: {
+				type: "mrkdwn",
+				text: `*${escapeSlackMrkdwnText(args.label)}*\n${ACCOUNT_SCOPE_NOTE}\n${escapeSlackMrkdwnText(args.completionText)}`
+			},
+			accessory: {
+				type: "button",
+				text: {
+					type: "plain_text",
+					text: "Connect"
+				},
+				style: "primary",
+				url: args.authorizationUrl,
+				action_id: "oauth_connect"
+			}
+		}]
+	};
+}
+// src/chat/oauth-flow.ts
+const OAUTH_STATE_TTL_MS = 6e5;
+function optionalString(value) {
+	return typeof value === "string" ? value : void 0;
+}
+/** Parse OAuth callback state that was persisted before a provider redirect. */
+function parseOAuthStatePayload(value) {
+	if (!isRecord$2(value)) return;
+	if (typeof value.userId !== "string" || typeof value.provider !== "string") return;
+	const actor = value.actor === void 0 ? void 0 : actorSchema.safeParse(value.actor);
+	if (value.actor !== void 0 && (!actor || !actor.success)) return;
+	const destination = parseDestination(value.destination);
+	if (value.destination !== void 0 && !destination) return;
+	const source = value.source === void 0 ? void 0 : sourceSchema.safeParse(value.source);
+	if (value.source !== void 0 && (!source || !source.success)) return;
+	return {
+		userId: value.userId,
+		provider: value.provider,
+		...actor?.success ? { actor: actor.data } : void 0,
+		...optionalString(value.channelId) ? { channelId: optionalString(value.channelId) } : void 0,
+		...destination ? { destination } : void 0,
+		...source?.success ? { source: source.data } : void 0,
+		...optionalString(value.threadTs) ? { threadTs: optionalString(value.threadTs) } : void 0,
+		...optionalString(value.resumeConversationId) ? { resumeConversationId: optionalString(value.resumeConversationId) } : void 0,
+		...optionalString(value.resumeSessionId) ? { resumeSessionId: optionalString(value.resumeSessionId) } : void 0,
+		...optionalString(value.scope) ? { scope: optionalString(value.scope) } : void 0
+	};
+}
+/** Return the manifest-owned display label for a provider. */
+function formatProviderLabel(provider) {
+	const displayName = pluginCatalogRuntime.getDisplayName(provider);
+	if (!displayName) throw new Error(`Unknown plugin provider display name: "${provider}"`);
+	return displayName;
+}
+/** Resolve the public base URL from environment variables (JUNIOR_BASE_URL or Vercel). */
+function resolveBaseUrl() {
+	const explicit = process.env.JUNIOR_BASE_URL?.trim();
+	if (explicit) return explicit;
+	const vercelProd = process.env.VERCEL_PROJECT_PRODUCTION_URL?.trim();
+	if (vercelProd) return `https://${vercelProd}`;
+	const vercelUrl = process.env.VERCEL_URL?.trim();
+	if (vercelUrl) return `https://${vercelUrl}`;
+}
+/**
+* Authorization links must only be visible to the requesting user.
+* Try in-context private delivery first, then fall back to a DM.
+*/
+async function deliverPrivateMessage(input) {
+	let client;
+	try {
+		client = getSlackClient();
+	} catch {
+		logWarn("oauth.private_delivery.skipped", { "app.reason": "missing_bot_token" });
+		return false;
+	}
+	if (input.channelId) try {
+		if (isDmChannel(input.channelId)) await postSlackMessage({
+			channelId: input.channelId,
+			text: input.text,
+			blocks: input.blocks,
+			threadTs: input.threadTs
+		});
+		else await postSlackEphemeralMessage({
+			channelId: input.channelId,
+			userId: input.userId,
+			text: input.text,
+			blocks: input.blocks,
+			threadTs: input.threadTs
+		});
+		return "in_context";
+	} catch (error) {
+		logWarn("oauth.private_delivery.failed", {
+			"app.slack.error": error instanceof Error ? error.message : String(error),
+			"app.slack.channel": input.channelId
+		});
+	}
+	try {
+		const dmChannelId = (await withSlackRetries(() => client.conversations.open({ users: input.userId }), 3, {
+			action: "conversations.open",
+			spanAttributes: { "app.slack.user_id": input.userId }
+		})).channel?.id;
+		if (!dmChannelId) {
+			logWarn("oauth.dm.fallback.failed", { "app.reason": "no_dm_channel_id" });
+			return false;
+		}
+		await postSlackMessage({
+			channelId: dmChannelId,
+			text: input.text,
+			blocks: input.blocks
+		});
+		return "fallback_dm";
+	} catch (error) {
+		logWarn("oauth.dm.fallback.failed", { "app.slack.error": error instanceof Error ? error.message : String(error) });
+		return false;
+	}
+}
+/** Present one OAuth request through the active surface's private delivery. */
+async function deliverOAuthAuthorization(request, input) {
+	if (input.authorization) {
+		await input.authorization.deliver(request);
+		return "in_context";
+	}
+	return await deliverPrivateMessage({
+		channelId: input.channelId,
+		threadTs: input.threadTs,
+		userId: input.userId,
+		...buildSlackOAuthAuthorizationMessage(request)
+	});
+}
+/** Initiate an OAuth authorization code flow for a provider and deliver the auth link to the user. */
+async function startOAuthFlow(provider, input) {
+	const providerConfig = pluginCatalogRuntime.getOAuthConfig(provider);
+	if (!providerConfig) return {
+		ok: false,
+		error: `Provider "${provider}" does not support OAuth authorization`
+	};
+	const clientId = process.env[providerConfig.clientIdEnv]?.trim();
+	if (!clientId) return {
+		ok: false,
+		error: `Missing ${providerConfig.clientIdEnv} environment variable`
+	};
+	const baseUrl = resolveBaseUrl();
+	if (!baseUrl) return {
+		ok: false,
+		error: "Cannot determine base URL (set JUNIOR_BASE_URL or deploy to Vercel)"
+	};
+	const state = input.authorization ? await input.authorization.createState() : randomBytes(32).toString("hex");
+	const requestedScope = input.scope ?? providerConfig.scope;
+	await getStateAdapter().set(`oauth-state:${state}`, {
+		userId: input.actorId,
+		provider,
+		...input.actor ? { actor: input.actor } : void 0,
+		...input.channelId ? { channelId: input.channelId } : void 0,
+		...input.destination ? { destination: input.destination } : void 0,
+		...input.source ? { source: input.source } : void 0,
+		...input.threadTs ? { threadTs: input.threadTs } : void 0,
+		...input.resumeConversationId ? { resumeConversationId: input.resumeConversationId } : void 0,
+		...input.resumeSessionId ? { resumeSessionId: input.resumeSessionId } : void 0,
+		...requestedScope ? { scope: requestedScope } : void 0
+	}, OAUTH_STATE_TTL_MS);
+	const authorizeParams = new URLSearchParams({
+		client_id: clientId,
+		state,
+		redirect_uri: `${baseUrl}${providerConfig.callbackPath}`,
+		response_type: "code"
+	});
+	if (requestedScope) authorizeParams.set("scope", requestedScope);
+	for (const [key, value] of Object.entries(providerConfig.authorizeParams ?? {})) authorizeParams.set(key, value);
+	logInfo("jr_rpc.oauth.started", {
+		"app.credential.provider": provider,
+		...input.activeSkillName ? { "app.skill.name": input.activeSkillName } : void 0
+	});
+	return {
+		ok: true,
+		delivery: await deliverOAuthAuthorization({
+			authorizationUrl: `${providerConfig.authorizeEndpoint}?${authorizeParams.toString()}`,
+			label: `Connect your ${formatProviderLabel(provider)} account`,
+			completionText: input.resumeSessionId ? "Once you've authorized, I'll continue automatically." : "Once you've authorized, you'll see a confirmation in Slack."
+		}, {
+			authorization: input.authorization,
+			channelId: input.channelId,
+			threadTs: input.threadTs,
+			userId: input.actorId
+		})
+	};
+}
+// src/chat/sandbox/egress/oidc.ts
+const OIDC_DISCOVERY_CACHE_TTL_MS = 36e5;
+const OIDC_DISCOVERY_CACHE_MAX_ENTRIES = 8;
+const jwksByIssuer = /* @__PURE__ */ new Map();
+function buildDiscoveryUrl(issuer) {
+	const url = new URL(issuer);
+	if (url.protocol !== "https:" || url.hostname !== "oidc.vercel.com") throw new Error("Unexpected Vercel OIDC issuer");
+	url.pathname = `${url.pathname.replace(/\/$/, "")}/.well-known/openid-configuration`;
+	url.search = "";
+	url.hash = "";
+	return url;
+}
+function buildJwksUrl(value) {
+	const url = new URL(value);
+	if (url.protocol !== "https:") throw new Error("Vercel OIDC discovery jwks_uri must use HTTPS");
+	return url;
+}
+async function getJwks(issuer) {
+	const now = Date.now();
+	const cached = jwksByIssuer.get(issuer);
+	if (cached && cached.expiresAtMs > now) return cached.jwks;
+	if (cached) jwksByIssuer.delete(issuer);
+	const response = await fetch(buildDiscoveryUrl(issuer), { redirect: "error" });
+	if (!response.ok) throw new Error("Unable to load Vercel OIDC discovery metadata");
+	const config = await response.json();
+	if (!config.jwks_uri) throw new Error("Vercel OIDC discovery metadata did not include jwks_uri");
+	const jwks = createRemoteJWKSet(buildJwksUrl(config.jwks_uri));
+	if (!jwksByIssuer.has(issuer) && jwksByIssuer.size >= OIDC_DISCOVERY_CACHE_MAX_ENTRIES) {
+		const oldestIssuer = jwksByIssuer.keys().next().value;
+		if (oldestIssuer) jwksByIssuer.delete(oldestIssuer);
+	}
+	jwksByIssuer.set(issuer, {
+		jwks,
+		expiresAtMs: now + OIDC_DISCOVERY_CACHE_TTL_MS
+	});
+	return jwks;
+}
+/**
+* Verify Vercel signed this Sandbox firewall proxy request for the active VM session.
+*
+* `currentDate` is the time for the `exp` and `nbf` checks. It defaults to
+* now. Evals pass the real time because they replace `Date`.
+*/
+async function verifyVercelSandboxOidcToken(token, options = {}) {
+	const unverified = decodeJwt(token);
+	if (typeof unverified.iss !== "string") throw new Error("Vercel OIDC token did not include an issuer");
+	const jwks = await getJwks(unverified.iss);
+	return (await jwtVerify(token, jwks, {
+		issuer: unverified.iss,
+		...options.currentDate ? { currentDate: options.currentDate } : void 0
+	})).payload;
+}
+// src/chat/sandbox/egress/tracing.ts
+function isValidDomainPattern(domain) {
+	if (domain.includes("*")) return domain.startsWith("*.") && domain.indexOf("*", 1) === -1;
+	return true;
+}
+/** Normalize exact and leading-wildcard sandbox egress trace domains. */
+function normalizeSandboxEgressTracePropagationDomains(domains) {
+	if (domains === void 0) return [];
+	if (!Array.isArray(domains)) throw new Error("sandbox.egressTracePropagationDomains must be an array");
+	return [...new Set(domains.map((domain) => {
+		if (typeof domain !== "string") throw new Error("sandbox.egressTracePropagationDomains entries must be strings");
+		const normalized = domain.trim().toLowerCase();
+		if (!normalized) throw new Error("sandbox.egressTracePropagationDomains entries must be non-empty");
+		if (!isValidDomainPattern(normalized)) throw new Error("sandbox.egressTracePropagationDomains entries must be exact domains or leading wildcard domains");
+		return normalized;
+	}))].sort((left, right) => left.localeCompare(right));
+}
+/** Return whether a host may carry sandbox egress trace propagation headers. */
+function shouldPropagateSandboxEgressTrace(host, config = {}) {
+	const normalizedHost = host.trim().toLowerCase();
+	return (config.domains ?? []).some((domain) => {
+		if (domain.startsWith("*.")) {
+			const suffix = domain.slice(1);
+			return normalizedHost.endsWith(suffix) && normalizedHost !== domain.slice(2);
+		}
+		return domain === normalizedHost;
+	});
+}
+// src/chat/sandbox/egress/policy.ts
+/** Return whether an outbound host is covered by a provider domain rule. */
+function matchesSandboxEgressDomain(host, domain) {
+	return host.toLowerCase() === domain.toLowerCase();
+}
+function manifestDomains(manifest) {
+	return [.../* @__PURE__ */ new Set([...manifest.credentials?.domains ?? [], ...manifest.domains ?? []])].sort((left, right) => left.localeCompare(right));
+}
+function providerEntries() {
+	return pluginCatalogRuntime.getProviders().map((plugin) => ({
+		provider: plugin.manifest.name,
+		domains: manifestDomains(plugin.manifest)
+	})).filter((entry) => entry.domains.length > 0).sort((left, right) => left.provider.localeCompare(right.provider));
+}
+/**
+* Resolve the plugin provider responsible for an outbound sandbox host.
+*
+* Only plugin-declared provider domains are eligible for credentialed sandbox
+* egress. Hosts without a matching provider are blocked by the proxy even if a
+* malformed or stale network policy tried to forward them.
+*/
+function resolveSandboxEgressProviderForHost(host) {
+	return providerEntries().find((entry) => entry.domains.some((domain) => matchesSandboxEgressDomain(host, domain)))?.provider;
+}
+/**
+* Build the provider-neutral egress policy for one sandbox command context.
+*
+* Provider domains go through Junior's credentialed egress when a signed
+* credential token is given. The token binds each request to the actor and
+* sandbox VM that created the command. Configured trace-only domains get trace
+* headers in place. The sandbox receives placeholder env vars, not provider
+* credentials.
+*/
+function buildSandboxEgressNetworkPolicy(input) {
+	const credentialToken = input?.credentialToken;
+	const credentialDomains = credentialToken ? [...new Set(providerEntries().flatMap((entry) => entry.domains))].sort((left, right) => left.localeCompare(right)) : [];
+	const traceHeaders = Object.fromEntries(Object.entries(input?.traceHeaders ?? {}).filter(([, value]) => typeof value === "string" && value.trim()));
+	const traceDomains = Object.keys(traceHeaders).length > 0 ? [...new Set(input?.traceConfig?.domains ?? [])].filter((domain) => !credentialDomains.includes(domain) && shouldPropagateSandboxEgressTrace(domain, input?.traceConfig)).sort((left, right) => left.localeCompare(right)) : [];
+	return {
+		...credentialToken && credentialDomains.length > 0 ? { credentialEgress: {
+			credentialToken,
+			domains: credentialDomains
+		} } : void 0,
+		...traceDomains.length > 0 ? { traceHeaders: {
+			domains: traceDomains,
+			headers: traceHeaders
+		} } : void 0
+	};
+}
+/**
+* Resolve non-secret command environment values for registered sandbox providers.
+*
+* Credential env vars are placeholders that tell tools which auth variable name
+* exists; real credential headers are issued lazily by host egress.
+*/
+async function resolveSandboxCommandEnvironment() {
+	const env = {};
+	for (const plugin of pluginCatalogRuntime.getProviders().sort((left, right) => left.manifest.name.localeCompare(right.manifest.name))) {
+		Object.assign(env, resolvePluginCommandEnv(plugin.manifest));
+		const credentials = plugin.manifest.credentials;
+		if (credentials?.authTokenEnv) env[credentials.authTokenEnv] = resolveAuthTokenPlaceholder(credentials);
+	}
+	return env;
+}
+// src/chat/sandbox/egress/schemas.ts
+const finiteNumberSchema = z.number().refine(Number.isFinite);
+const httpStatusSchema = z.number().int().min(100).max(599);
+const providerNameSchema = z.string().regex(/^[a-z][a-z0-9-]*$/);
+const credentialSignalKindSchema = z.enum(["auth_required", "unavailable"]);
+const sandboxEgressGrantSchema = pluginGrantSchema;
+const sandboxEgressCredentialContextSchema = z.object({
+	credentials: credentialContextSchema,
+	/** Conversation that the credentials act for. Telemetry only; it grants nothing. */
+	conversationId: z.string().min(1).optional(),
+	egressId: z.string().min(1),
+	expiresAtMs: finiteNumberSchema,
+	contextId: z.string().min(1)
+}).strict();
+const sandboxEgressCredentialLeaseSchema = z.object({
+	account: pluginProviderAccountSchema.optional(),
+	authorization: pluginAuthorizationSchema.optional(),
+	grant: sandboxEgressGrantSchema,
+	provider: providerNameSchema,
+	expiresAt: z.string().min(1),
+	headerTransforms: z.array(pluginCredentialHeaderTransformSchema).min(1)
+}).strict();
+const sandboxEgressAuthRequiredSignalSchema = z.object({
+	authorization: pluginAuthorizationSchema.optional(),
+	grant: sandboxEgressGrantSchema,
+	kind: credentialSignalKindSchema.default("auth_required"),
+	provider: providerNameSchema,
+	message: z.string().optional(),
+	createdAtMs: finiteNumberSchema
+}).strict().superRefine((signal, ctx) => {
+	if (signal.authorization && signal.authorization.provider !== signal.provider) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: "Auth signal authorization provider must match provider",
+		path: ["authorization", "provider"]
+	});
+});
+const sandboxEgressPermissionDeniedSignalSchema = z.object({
+	account: pluginProviderAccountSchema.optional(),
+	grant: sandboxEgressGrantSchema,
+	message: z.string().min(1),
+	provider: providerNameSchema,
+	source: z.literal("upstream"),
+	status: httpStatusSchema,
+	upstreamHost: z.string().min(1),
+	upstreamPath: z.string().min(1),
+	createdAtMs: finiteNumberSchema
+}).strict();
+const sandboxEgressSignalsResponseSchema = z.object({
+	auth_required: sandboxEgressAuthRequiredSignalSchema.optional(),
+	permission_denied: sandboxEgressPermissionDeniedSignalSchema.optional()
+}).strict();
+/** Parse a host-owned sandbox egress auth signal from state or tool results. */
+function parseSandboxEgressAuthRequiredSignal(value) {
+	const result = sandboxEgressAuthRequiredSignalSchema.safeParse(value);
+	return result.success ? result.data : void 0;
+}
+/** Parse a host-owned sandbox egress permission-denied signal from state or tool results. */
+function parseSandboxEgressPermissionDeniedSignal(value) {
+	const result = sandboxEgressPermissionDeniedSignalSchema.safeParse(value);
+	return result.success ? result.data : void 0;
+}
+// src/chat/sandbox/egress/session.ts
+const SANDBOX_EGRESS_PROXY_PATH = "/api/internal/sandbox-egress";
+const SANDBOX_EGRESS_TOKEN_VERSION = "v1";
+const SANDBOX_EGRESS_HMAC_CONTEXT = "junior.sandbox_egress.v1";
+const SANDBOX_EGRESS_AUTH_SIGNAL_PREFIX = "sandbox-egress-auth-required";
+const SANDBOX_EGRESS_PERMISSION_SIGNAL_PREFIX = "sandbox-egress-permission-denied";
+const SANDBOX_EGRESS_LEASE_PREFIX = "sandbox-egress-lease";
+const DEFAULT_SESSION_TTL_MS = 18e5;
+/** Treat a cached lease as expired this long before its provider expiry. */
+const LEASE_REFRESH_BUFFER_MS = 3e5;
+/** True when this grant may keep shared auth headers on the host. */
+function isSharedInstallationGrant(grant) {
+	return grant.name.startsWith("installation-");
+}
+/**
+* Build the host key for a shared installation grant.
+*
+* Only installation grants are remembered. User and other grants issue live
+* headers each time, so they never write a host key.
+*/
+function leaseKey(provider, grant) {
+	return `${SANDBOX_EGRESS_LEASE_PREFIX}:${provider}:${grant.name}:shared`;
+}
+/**
+* Build the command signal key for credential issuance failures by access level.
+*/
+function authSignalKey(egressId, access) {
+	return `${SANDBOX_EGRESS_AUTH_SIGNAL_PREFIX}:${egressId}:${access}`;
+}
+/**
+* Build the command signal key for upstream permission denials by access level.
+*/
+function permissionSignalKey(egressId, access) {
+	return `${SANDBOX_EGRESS_PERMISSION_SIGNAL_PREFIX}:${egressId}:${access}`;
+}
+function base64Url(input) {
+	return Buffer.from(input, "utf8").toString("base64url");
+}
+function fromBase64Url(input) {
+	return Buffer.from(input, "base64url").toString("utf8");
+}
+/**
+* Sign a versioned context payload in the sandbox egress HMAC domain.
+*
+* `JUNIOR_SECRET` is the shared secret so proxy URLs cannot be forged by code
+* running inside the sandbox.
+*/
+function signPayload(payload) {
+	return createHmac("sha256", getSandboxEgressSecret()).update(`${SANDBOX_EGRESS_HMAC_CONTEXT}:${payload}`).digest("base64url");
+}
+function timingSafeMatch(expected, actual) {
+	const expectedBuffer = Buffer.from(expected);
+	const actualBuffer = Buffer.from(actual);
+	if (expectedBuffer.length !== actualBuffer.length) return false;
+	return timingSafeEqual(expectedBuffer, actualBuffer);
+}
+function parseSandboxEgressContext(value) {
+	const result = sandboxEgressCredentialContextSchema.safeParse(value);
+	if (!result.success) return;
+	if (result.data.expiresAtMs <= Date.now()) return;
+	return result.data;
+}
+function parseLease(value) {
+	const result = sandboxEgressCredentialLeaseSchema.safeParse(value);
+	if (!result.success) return;
+	const expiresAtMs = Date.parse(result.data.expiresAt);
+	if (!Number.isFinite(expiresAtMs) || expiresAtMs <= Date.now() + LEASE_REFRESH_BUFFER_MS) return;
+	return result.data;
+}
+function getSandboxEgressSecret() {
+	const secret = process.env.JUNIOR_SECRET?.trim();
+	if (secret) return secret;
+	throw new Error("Cannot determine sandbox egress secret (set JUNIOR_SECRET)");
+}
+/**
+* Create the signed Junior credential context embedded in the proxy URL.
+*
+* The token binds actor credentials to a specific sandbox egress id and a
+* short expiry. Vercel OIDC proves which VM sent a request; this token proves
+* which Junior actor and credential context that VM is allowed to use.
+*/
+function createSandboxEgressCredentialToken(input) {
+	const ttlMs = Math.max(1, input.ttlMs ?? DEFAULT_SESSION_TTL_MS);
+	const now = Date.now();
+	const context = {
+		...input.conversationId ? { conversationId: input.conversationId } : void 0,
+		credentials: input.credentials,
+		egressId: input.egressId,
+		expiresAtMs: now + ttlMs,
+		contextId: randomUUID()
+	};
+	const payload = `${SANDBOX_EGRESS_TOKEN_VERSION}.${base64Url(JSON.stringify(context))}`;
+	return `${payload}.${signPayload(payload)}`;
+}
+/**
+* Verify the signed Junior credential context from the proxy URL.
+*
+* Returning `undefined` means the token is missing, expired, malformed, or not
+* signed with the current `JUNIOR_SECRET`.
+*/
+function parseSandboxEgressCredentialToken(token) {
+	if (!token) return;
+	const parts = token.split(".");
+	if (parts.length !== 3 || parts[0] !== SANDBOX_EGRESS_TOKEN_VERSION) return;
+	const encodedSession = parts[1];
+	const signature = parts[2];
+	if (!encodedSession || !signature) return;
+	if (!timingSafeMatch(signPayload(`${parts[0]}.${encodedSession}`), signature)) return;
+	try {
+		return parseSandboxEgressContext(JSON.parse(fromBase64Url(encodedSession)));
+	} catch {
+		return;
+	}
+}
+/**
+* Remember auth headers for a shared installation grant.
+*
+* User and other grants are ignored here. TTL follows the provider expiry.
+* Sandbox context expiry still decides whether a request may use the headers;
+* it does not shorten a shared installation grant for other sandboxes.
+*/
+async function setSandboxEgressCredentialLease(_context, lease) {
+	if (!isSharedInstallationGrant(lease.grant)) return;
+	const leaseExpiresAtMs = Date.parse(lease.expiresAt);
+	if (!Number.isFinite(leaseExpiresAtMs) || leaseExpiresAtMs <= Date.now()) return;
+	const ttlMs = Math.max(1, leaseExpiresAtMs - Date.now());
+	const state = getStateAdapter();
+	await state.connect();
+	await state.set(leaseKey(lease.provider, lease.grant), lease, ttlMs);
+}
+/** Load remembered auth headers for a shared installation grant. */
+async function getSandboxEgressCredentialLease(provider, grant, _context) {
+	if (!isSharedInstallationGrant(grant)) return;
+	const state = getStateAdapter();
+	await state.connect();
+	return parseLease(await state.get(leaseKey(provider, grant)));
+}
+/** Drop remembered installation headers after the upstream rejects them. */
+async function clearSandboxEgressCredentialLease(provider, grant, _context) {
+	if (!isSharedInstallationGrant(grant)) return;
+	const state = getStateAdapter();
+	await state.connect();
+	await state.delete(leaseKey(provider, grant));
+}
+/**
+* Record that credential issuance needs user authorization for this command.
+*
+* The command runner consumes this after the sandbox tool finishes so the agent
+* can present a normal authorization-required response instead of a raw proxy
+* failure.
+*/
+async function setSandboxEgressAuthRequiredSignal(context, signal) {
+	const ttlMs = Math.max(1, context.expiresAtMs - Date.now());
+	const state = getStateAdapter();
+	await state.connect();
+	await state.set(authSignalKey(context.egressId, signal.grant.access), {
+		...signal,
+		createdAtMs: Date.now()
+	}, ttlMs);
+}
+/**
+* Record that the provider rejected an issued credential with permission denial.
+*/
+async function setSandboxEgressPermissionDeniedSignal(context, signal) {
+	const ttlMs = Math.max(1, context.expiresAtMs - Date.now());
+	const state = getStateAdapter();
+	await state.connect();
+	await state.set(permissionSignalKey(context.egressId, signal.grant.access), {
+		...signal,
+		createdAtMs: Date.now()
+	}, ttlMs);
+}
+/** Remove pending auth/permission signals before or after a sandbox command. */
+async function clearSandboxEgressSignals(egressId) {
+	if (!egressId) return;
+	const state = getStateAdapter();
+	await state.connect();
+	await Promise.all([
+		state.delete(authSignalKey(egressId, "read")),
+		state.delete(authSignalKey(egressId, "write")),
+		state.delete(permissionSignalKey(egressId, "read")),
+		state.delete(permissionSignalKey(egressId, "write"))
+	]);
+}
+/**
+* Consume the auth signal produced during a sandbox command, preferring writes.
+*/
+async function consumeSandboxEgressAuthRequiredSignal(egressId) {
+	if (!egressId) return;
+	const state = getStateAdapter();
+	await state.connect();
+	const [writeSignal, readSignal] = await Promise.all([state.get(authSignalKey(egressId, "write")), state.get(authSignalKey(egressId, "read"))]);
+	const signal = parseSandboxEgressAuthRequiredSignal(writeSignal) ?? parseSandboxEgressAuthRequiredSignal(readSignal);
+	await Promise.all([state.delete(authSignalKey(egressId, "read")), state.delete(authSignalKey(egressId, "write"))]);
+	return signal;
+}
+/**
+* Consume the permission signal produced during a sandbox command, preferring writes.
+*/
+async function consumeSandboxEgressPermissionDeniedSignal(egressId) {
+	if (!egressId) return;
+	const state = getStateAdapter();
+	await state.connect();
+	const [writeSignal, readSignal] = await Promise.all([state.get(permissionSignalKey(egressId, "write")), state.get(permissionSignalKey(egressId, "read"))]);
+	const signal = parseSandboxEgressPermissionDeniedSignal(writeSignal) ?? parseSandboxEgressPermissionDeniedSignal(readSignal);
+	await Promise.all([state.delete(permissionSignalKey(egressId, "read")), state.delete(permissionSignalKey(egressId, "write"))]);
+	return signal;
+}
+// src/chat/sandbox/egress/proxy.ts
+function jsonError$1(message, status) {
+	return Response.json({ error: message }, { status });
+}
+/** Return log attributes that identify one sandbox egress request. */
+function sandboxEgressAttributes(input) {
+	return {
+		...input.egressId ? { "app.sandbox.egress_id": input.egressId } : void 0,
+		...input.provider ? { "app.provider.name": input.provider } : void 0,
+		...input.host ? { "server.address": input.host } : void 0,
+		...input.method ? { "http.request.method": input.method } : void 0,
+		...input.path ? { "url.path": input.path } : void 0,
+		...input.status ? { "http.response.status_code": input.status } : void 0
+	};
+}
+/** Hide the credential token in a sandbox egress proxy path before logging. */
+function redactSandboxEgressProxyPath(pathname) {
+	if (pathname.startsWith(`/api/internal/sandbox-egress/`)) return `${SANDBOX_EGRESS_PROXY_PATH}/<token>`;
+	return pathname;
+}
+/** Return log attributes for the proxy route and the upstream path. */
+function sandboxEgressRoutingAttributes(request, upstreamUrl) {
+	const attributes = { "app.sandbox.egress.proxy_path": redactSandboxEgressProxyPath(new URL(request.url).pathname) };
+	if (upstreamUrl) {
+		attributes["app.sandbox.egress.upstream_path"] = upstreamUrl.pathname;
+		const gitService = upstreamUrl.searchParams.get("service");
+		if (upstreamUrl.hostname.toLowerCase() === "github.com" && (gitService === "git-upload-pack" || gitService === "git-receive-pack")) attributes["app.sandbox.egress.git_service"] = gitService;
+	}
+	return attributes;
+}
+/**
+* Name the Conversation and the accountable person from the verified token.
+* Each proxy request is a new HTTP request with no run log context, so the
+* proxy binds the same fields that the run binds.
+*/
+function sandboxEgressLogContext(context) {
+	return {
+		...context.conversationId ? { conversationId: context.conversationId } : void 0,
+		...credentialLogContext(context.credentials)
+	};
+}
+/** Continue inbound trace context only after sandbox egress verification succeeds. */
+function continueSandboxEgressTrace(request, upstreamHost, tracePropagation, credentialContext, callback) {
+	const sentryTrace = request.headers.get("sentry-trace") ?? void 0;
+	const baggage = request.headers.get("baggage") ?? void 0;
+	const logContext = sandboxEgressLogContext(credentialContext);
+	const run = () => withSpan("sandbox.egress", "http.server", logContext, async () => {
+		setSentryUser(logContext.userId ? { id: logContext.userId } : void 0);
+		return await callback();
+	}, {
+		"http.request.method": request.method,
+		"url.path": redactSandboxEgressProxyPath(new URL(request.url).pathname)
+	});
+	if (!shouldPropagateSandboxEgressTrace(upstreamHost, tracePropagation) || !sentryTrace && !baggage) return run();
+	return continueTrace({
+		sentryTrace,
+		baggage
+	}, run);
+}
+/**
+* Run one sandbox egress request that its sandbox provider authenticated.
+*
+* This is the shared authorization boundary. It rejects upstream hosts that no
+* plugin owns, rejects signed credential contexts that do not match the
+* verified VM id, and only then asks the credentialed egress engine to issue
+* credentials and contact the upstream provider.
+*/
+async function executeSandboxEgressRequest(input, deps = {}) {
+	const { request, upstreamUrl } = input;
+	const activeEgressId = input.egressId;
+	const provider = resolveSandboxEgressProviderForHost(upstreamUrl.hostname);
+	if (!provider) {
+		logWarn("sandbox.egress.provider.unresolved", {
+			...sandboxEgressAttributes({
+				egressId: activeEgressId,
+				host: upstreamUrl.hostname,
+				method: request.method,
+				path: upstreamUrl.pathname,
+				status: 403
+			}),
+			...sandboxEgressRoutingAttributes(request, upstreamUrl)
+		});
+		return jsonError$1("No provider owns forwarded host", 403);
+	}
+	const credentialContext = parseSandboxEgressCredentialToken(input.credentialToken);
+	if (!credentialContext || credentialContext.egressId !== activeEgressId) {
+		logWarn("sandbox.egress.credential_context.unauthorized", {
+			...sandboxEgressAttributes({
+				egressId: activeEgressId,
+				host: upstreamUrl.hostname,
+				method: request.method,
+				path: upstreamUrl.pathname,
+				provider,
+				status: 403
+			}),
+			...sandboxEgressRoutingAttributes(request, upstreamUrl)
+		});
+		return jsonError$1("Sandbox egress credential context is not authorized", 403);
+	}
+	return await continueSandboxEgressTrace(request, upstreamUrl.hostname, deps.tracePropagation ?? {}, credentialContext, async () => await executeCredentialedEgressRequest({
+		activeEgressId,
+		credentialContext,
+		deps,
+		provider,
+		request,
+		upstreamUrl
+	}));
+}
+// src/chat/sandbox/egress/vercel.ts
+const OIDC_TOKEN_HEADER = "vercel-sandbox-oidc-token";
+const FORWARDED_HOST_HEADER = "vercel-forwarded-host";
+const FORWARDED_SCHEME_HEADER = "vercel-forwarded-scheme";
+const FORWARDED_PORT_HEADER = "vercel-forwarded-port";
+const FORWARDED_PATH_HEADER = "vercel-forwarded-path";
+function jsonError(message, status) {
+	return Response.json({ error: message }, { status });
+}
+function forwardUrl(credentialToken) {
+	const baseUrl = resolveBaseUrl();
+	if (!baseUrl) throw new Error("Cannot determine base URL for sandbox credential egress (set JUNIOR_BASE_URL or deploy to Vercel)");
+	return new URL(`${SANDBOX_EGRESS_PROXY_PATH}/${credentialToken}`, baseUrl).toString();
+}
+/**
+* Turn Junior's network policy into Vercel Sandbox network rules.
+*
+* Every other domain stays open through the `*` rule. Credentialed domains
+* forward to Junior's egress route, and trace domains get a header transform.
+*/
+function toVercelNetworkPolicy(policy) {
+	if (policy === "allow-all") return policy;
+	const rules = /* @__PURE__ */ new Map();
+	const credentialEgress = policy.credentialEgress;
+	if (credentialEgress && credentialEgress.domains.length > 0) {
+		const forwardURL = forwardUrl(credentialEgress.credentialToken);
+		for (const domain of credentialEgress.domains) rules.set(domain, [{ forwardURL }]);
+	}
+	const traceHeaders = policy.traceHeaders;
+	if (traceHeaders) for (const domain of traceHeaders.domains) rules.set(domain, [{ transform: [{ headers: traceHeaders.headers }] }]);
+	return { allow: {
+		"*": [],
+		...Object.fromEntries([...rules.entries()].sort(([left], [right]) => left.localeCompare(right)))
+	} };
+}
+/** Read the signed credential token from the forward URL path. */
+function credentialTokenFromRequest(request) {
+	const pathname = new URL(request.url).pathname;
+	const prefix = `${SANDBOX_EGRESS_PROXY_PATH}/`;
+	if (!pathname.startsWith(prefix)) return;
+	const token = pathname.slice(prefix.length).split("/")[0];
+	if (!token) return;
+	try {
+		return decodeURIComponent(token);
+	} catch {
+		return;
+	}
+}
+function normalizeHost(value) {
+	const trimmed = value.trim().toLowerCase();
+	if (!trimmed || trimmed.includes("/") || trimmed.includes("\\") || trimmed.includes(":")) return;
+	return trimmed.replace(/\.$/, "");
+}
+function normalizeScheme(value) {
+	return value.trim().toLowerCase() === "https" ? "https" : void 0;
+}
+function normalizePort(value) {
+	if (!value) return;
+	const trimmed = value.trim();
+	if (!/^\d{1,5}$/.test(trimmed)) return;
+	const port = Number.parseInt(trimmed, 10);
+	return port >= 1 && port <= 65535 ? trimmed : void 0;
+}
+function sandboxIdFromPayload(payload) {
+	return typeof payload.sandbox_id === "string" ? payload.sandbox_id : void 0;
+}
+function normalizedForwardedPath(path) {
+	if (!path.startsWith("/") || path.startsWith("//") || path.includes("#") || /[\r\n]/.test(path)) return {
+		ok: false,
+		error: "Invalid forwarded path"
+	};
+	try {
+		const url = new URL(path, "https://sandbox-forwarded.local");
+		return {
+			ok: true,
+			path: `${url.pathname}${url.search}`
+		};
+	} catch {
+		return {
+			ok: false,
+			error: "Invalid forwarded path"
+		};
+	}
+}
+function upstreamPath(request) {
+	const forwardedPath = request.headers.get(FORWARDED_PATH_HEADER);
+	if (!forwardedPath?.trim()) return {
+		ok: false,
+		error: "Missing forwarded path"
+	};
+	return normalizedForwardedPath(forwardedPath.trim());
+}
+/**
+* Rebuild the HTTPS upstream URL from Vercel forwarding headers.
+*
+* This is the proxy's wire-format boundary for forwarded requests: host, path,
+* scheme, and port must normalize before the request can reach provider egress.
+*/
+function buildUpstreamUrl(request) {
+	const forwardedHost = request.headers.get(FORWARDED_HOST_HEADER);
+	if (!forwardedHost?.trim()) return {
+		ok: false,
+		error: "Missing forwarded host"
+	};
+	const host = normalizeHost(forwardedHost);
+	if (!host) return {
+		ok: false,
+		error: "Invalid forwarded host"
+	};
+	const forwardedScheme = request.headers.get(FORWARDED_SCHEME_HEADER);
+	if (!forwardedScheme?.trim()) return {
+		ok: false,
+		error: "Missing forwarded scheme"
+	};
+	const scheme = normalizeScheme(forwardedScheme);
+	if (!scheme) return {
+		ok: false,
+		error: "Forwarded scheme must be https"
+	};
+	const forwardedPort = request.headers.get(FORWARDED_PORT_HEADER);
+	const port = normalizePort(forwardedPort);
+	if (forwardedPort && !port) return {
+		ok: false,
+		error: "Invalid forwarded port"
+	};
+	const path = upstreamPath(request);
+	if (!path.ok) return {
+		ok: false,
+		error: path.error
+	};
+	try {
+		return {
+			ok: true,
+			url: new URL(`${scheme}://${host}${port ? `:${port}` : ""}${path.path}`)
+		};
+	} catch {
+		return {
+			ok: false,
+			error: "Invalid forwarded URL"
+		};
+	}
+}
+/**
+* Return whether a request carries the forwarding headers expected from Vercel.
+*
+* This is only a cheap classifier for routing into the proxy handler. Real
+* authentication happens in `proxyVercelSandboxEgressRequest`, which verifies
+* the OIDC token, and in `executeSandboxEgressRequest`, which verifies the
+* signed Junior credential context.
+*/
+function isVercelSandboxEgressRequest(request) {
+	return Boolean(request.headers.get(OIDC_TOKEN_HEADER)?.trim() && request.headers.get(FORWARDED_HOST_HEADER)?.trim() && request.headers.get(FORWARDED_SCHEME_HEADER)?.trim());
+}
+/**
+* Handle one sandbox egress request that Vercel's network layer forwarded.
+*
+* This is the Vercel side of the proxy boundary. It rejects requests without a
+* valid Vercel Sandbox OIDC token and rejects invalid forwarded URLs. Then it
+* hands the verified VM id, upstream URL, and credential token to the shared
+* `executeSandboxEgressRequest`.
+*/
+async function proxyVercelSandboxEgressRequest(request, deps = {}) {
+	const oidcToken = request.headers.get(OIDC_TOKEN_HEADER)?.trim();
+	if (!oidcToken) return jsonError("Missing Vercel Sandbox OIDC token", 401);
+	let oidcPayload;
+	try {
+		oidcPayload = await (deps.verifyOidc ?? verifyVercelSandboxOidcToken)(oidcToken);
+	} catch (error) {
+		logWarn("sandbox.egress.oidc_verification.failed", { "app.sandbox.oidc_error": error instanceof Error ? error.message : String(error) });
+		return jsonError("Invalid Vercel Sandbox OIDC token", 401);
+	}
+	const activeEgressId = sandboxIdFromPayload(oidcPayload);
+	if (!activeEgressId) {
+		logWarn("sandbox.egress.oidc_session.missing", {
+			"http.request.method": request.method,
+			"url.path": redactSandboxEgressProxyPath(new URL(request.url).pathname)
+		});
+		return jsonError("Vercel Sandbox OIDC token did not include sandbox_id", 401);
+	}
+	const upstreamResult = buildUpstreamUrl(request);
+	if (!upstreamResult.ok) {
+		logWarn("sandbox.egress.upstream_url.invalid", {
+			...sandboxEgressAttributes({
+				egressId: activeEgressId,
+				method: request.method,
+				path: redactSandboxEgressProxyPath(new URL(request.url).pathname),
+				status: 400
+			}),
+			...sandboxEgressRoutingAttributes(request)
+		});
+		return jsonError(upstreamResult.error, 400);
+	}
+	return await executeSandboxEgressRequest({
+		request,
+		egressId: activeEgressId,
+		upstreamUrl: upstreamResult.url,
+		credentialToken: credentialTokenFromRequest(request)
+	}, deps);
+}
+// src/chat/sandbox/http-error-details.ts
+const DEFAULT_PREVIEW_LIMIT = 512;
+function toTrimmedString(value, maxChars) {
+	if (typeof value !== "string") return;
+	const normalized = value.trim();
+	if (!normalized) return;
+	return normalized.length > maxChars ? `${normalized.slice(0, maxChars)}…` : normalized;
+}
+/** Extract structured HTTP error metadata (status, headers, body preview) for logging. */
+function extractHttpErrorDetails(error, options = {}) {
+	const prefix = options.attributePrefix ?? "app.http_error";
+	const previewLimit = options.previewLimit ?? DEFAULT_PREVIEW_LIMIT;
+	const normalizedError = error instanceof Error ? error : new Error(String(error));
+	const err = error ?? {};
+	const attributes = {
+		"error.type": normalizedError.name || "Error",
+		"exception.message": toTrimmedString(normalizedError.message, previewLimit) ?? "HTTP error"
+	};
+	const response = err.response;
+	const statusCode = typeof response?.status === "number" ? response.status : void 0;
+	const statusText = toTrimmedString(response?.statusText, previewLimit);
+	const responseUrl = toTrimmedString(response?.url, previewLimit);
+	const responseText = toTrimmedString(err.text, previewLimit);
+	const responseJson = toTrimmedString(err.json && typeof err.json === "object" ? JSON.stringify(err.json) : void 0, previewLimit);
+	const contentType = toTrimmedString(response?.headers?.get?.("content-type"), previewLimit);
+	const requestIdHeader = toTrimmedString(response?.headers?.get?.("x-request-id"), previewLimit);
+	const vercelIdHeader = toTrimmedString(response?.headers?.get?.("x-vercel-id"), previewLimit);
+	const requestId = requestIdHeader ?? vercelIdHeader;
+	if (statusCode !== void 0) attributes["http.response.status_code"] = statusCode;
+	if (statusText) attributes[`${prefix}.status_text`] = statusText;
+	if (responseUrl) attributes["url.full"] = responseUrl;
+	if (contentType) attributes["http.response.header.content-type"] = [contentType];
+	if (requestIdHeader) attributes["http.response.header.x-request-id"] = [requestIdHeader];
+	if (vercelIdHeader) attributes["http.response.header.x-vercel-id"] = [vercelIdHeader];
+	if (responseText) {
+		attributes[`${prefix}.response_text_preview`] = responseText;
+		attributes[`${prefix}.response_text_length`] = responseText.length;
+	}
+	if (responseJson) attributes[`${prefix}.response_json_preview`] = responseJson;
+	const summaryParts = [];
+	if (statusCode !== void 0) summaryParts.push(`status=${statusCode}`);
+	if (statusText) summaryParts.push(`statusText=${statusText}`);
+	if (responseUrl) summaryParts.push(`url=${responseUrl}`);
+	if (requestId) summaryParts.push(`requestId=${requestId}`);
+	for (const field of options.extraFields ?? []) {
+		const value = toTrimmedString(err[field.sourceKey], previewLimit);
+		if (!value) continue;
+		attributes[`${prefix}.${field.attributeKey}`] = value;
+		summaryParts.push(`${field.summaryKey ?? field.attributeKey}=${value}`);
+	}
+	if (responseJson) summaryParts.push(`json=${responseJson}`);
+	else if (responseText) summaryParts.push(`text=${responseText}`);
+	const searchableText = `${normalizedError.message} ${responseText ?? ""} ${responseJson ?? ""}`.toLowerCase();
+	return {
+		attributes,
+		summary: summaryParts.join(", "),
+		searchableText
+	};
+}
+// src/chat/sandbox/snapshot/not-ready-error.ts
+/** Report that a Workspace snapshot is not ready to use. */
+var WorkspaceSnapshotNotReadyError = class extends Error {
+	workspaceName;
+	constructor(workspaceName) {
+		super(`Workspace ${workspaceName} snapshot is not ready`);
+		this.name = "WorkspaceSnapshotNotReadyError";
+		this.workspaceName = workspaceName;
+	}
+};
+/** Return WorkspaceSnapshotNotReadyError from this error or its causes. */
+function getWorkspaceSnapshotNotReadyError(error) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	while (current instanceof Error && !seen.has(current)) {
+		if (current instanceof WorkspaceSnapshotNotReadyError) return current;
+		seen.add(current);
+		current = current.cause;
+	}
+}
+/** True when this error or a cause is WorkspaceSnapshotNotReadyError. */
+function isWorkspaceSnapshotNotReadyError(error) {
+	return getWorkspaceSnapshotNotReadyError(error) !== void 0;
+}
+/** User message when a Workspace sandbox is still preparing. */
+function workspaceSnapshotNotReadyUserMessage(error) {
+	return `The ${error.workspaceName} workspace is still preparing its sandbox. Wait for that preparation to finish, then try again.`;
+}
+// src/chat/sandbox/errors.ts
+const SANDBOX_ERROR_FIELDS = [{
+	sourceKey: "sandboxId",
+	attributeKey: "sandbox_id",
+	summaryKey: "sandboxId"
+}];
+/** Extract HTTP error details from a sandbox error for span data and checks. */
+function getSandboxErrorDetails(error) {
+	return extractHttpErrorDetails(error, {
+		attributePrefix: "app.sandbox.api_error",
+		extraFields: [...SANDBOX_ERROR_FIELDS]
+	});
+}
+/** Return true when any error in the `cause` chain matches the predicate. */
+function findInErrorChain(error, predicate) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	while (current && !seen.has(current)) {
+		if (predicate(current)) return true;
+		seen.add(current);
+		current = typeof current === "object" ? current.cause : void 0;
+	}
+	return false;
+}
+function getFirstErrorMessage(error) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	while (current && !seen.has(current)) {
+		if (current instanceof Error) {
+			const message = current.message.trim();
+			if (message) return message;
+		}
+		seen.add(current);
+		current = typeof current === "object" ? current.cause : void 0;
+	}
+}
+/** Detect sandbox filesystem operations that can safely ignore existing directories. */
+function isAlreadyExistsError(error) {
+	const details = getSandboxErrorDetails(error);
+	return details.searchableText.includes("already exists") || details.searchableText.includes("file exists") || details.searchableText.includes("eexist");
+}
+/** Detect cancellation so a durable builder stays available for check-in. */
+function isAbortError(error) {
+	return findInErrorChain(error, (candidate) => {
+		if (typeof DOMException !== "undefined" && candidate instanceof DOMException) return candidate.name === "AbortError";
+		return candidate instanceof Error && candidate.name === "AbortError";
+	});
+}
+/** Wrap setup failures. Keep WorkspaceSnapshotNotReadyError as-is. */
+function wrapSandboxSetupError(error) {
+	const notReady = getWorkspaceSnapshotNotReadyError(error);
+	if (notReady) return notReady;
+	try {
+		const details = getSandboxErrorDetails(error);
+		if (details.summary) return new Error(`sandbox setup failed (${details.summary})`, { cause: error });
+	} catch {}
+	let causeMessage;
+	try {
+		causeMessage = getFirstErrorMessage(error);
+	} catch (cause) {
+		causeMessage = cause instanceof Error ? cause.message : void 0;
+	}
+	if (causeMessage && causeMessage.trim() && causeMessage !== "sandbox setup failed") {
+		const oneLine = causeMessage.replace(/\s+/g, " ").trim();
+		return new Error(`sandbox setup failed (${oneLine})`, { cause: error });
+	}
+	return new Error("sandbox setup failed", { cause: error });
+}
+/** Record span data and throw one stable sandbox operation error. */
+function throwSandboxOperationError(action, error, includeMissingPath = false) {
+	const details = getSandboxErrorDetails(error);
+	setSpanAttributes({
+		...details.attributes,
+		...includeMissingPath ? { "app.sandbox.api_error.missing_path": details.searchableText.includes("no such file") || details.searchableText.includes("enoent") } : void 0,
+		"app.sandbox.success": false
+	});
+	throw new Error(details.summary ? `${action} failed (${details.summary})` : `${action} failed`, { cause: error });
+}
+// src/chat/sandbox/vercel/errors.ts
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null;
+}
+function searchableText(error) {
+	const details = getSandboxErrorDetails(error);
+	return `${details.searchableText} ${details.summary}`.toLowerCase();
+}
+function isInvalidSandboxSessionError(error) {
+	if (!isRecord$1(error)) return false;
+	if (isRecord$1(error.json) && error.json.invalidToken === true) return true;
+	const response = error.response;
+	return isRecord$1(response) && response.status === 403 && typeof response.url === "string" && response.url.includes("/sandboxes/sessions");
+}
+function isUnavailable(error) {
+	return findInErrorChain(error, (candidate) => {
+		if (isInvalidSandboxSessionError(candidate)) return true;
+		const searchable = searchableText(candidate);
+		return searchable.includes("sandbox_stopped") || searchable.includes("status=410") || searchable.includes("status code 410") || searchable.includes("no longer available") || searchable.includes("stream was closed and is not accepting commands");
+	});
+}
+function isMissing(error) {
+	return findInErrorChain(error, (candidate) => {
+		const searchable = searchableText(candidate);
+		return searchable.includes("status=404") || searchable.includes("status code 404") || searchable.includes("snapshot_not_found");
+	});
+}
+function isSnapshotMissing(error) {
+	const searchable = error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase();
+	return searchable.includes("snapshot") && (searchable.includes("not found") || searchable.includes("unknown") || searchable.includes("404"));
+}
+function isSnapshotting(error) {
+	return findInErrorChain(error, (candidate) => {
+		const searchable = searchableText(candidate);
+		return searchable.includes("sandbox_snapshotting") || searchable.includes("creating a snapshot") || searchable.includes("stopped shortly");
+	});
+}
+function isTransient(error) {
+	return findInErrorChain(error, (candidate) => {
+		const searchable = searchableText(candidate);
+		if (searchable.includes("internal_server_error") || searchable.includes("status=500") || searchable.includes("status code 500") || searchable.includes("status=502") || searchable.includes("status code 502") || searchable.includes("status=503") || searchable.includes("status code 503") || searchable.includes("status=504") || searchable.includes("status code 504")) return true;
+		if (!isRecord$1(candidate)) return false;
+		const response = candidate.response;
+		return isRecord$1(response) && typeof response.status === "number" && response.status >= 500 && response.status < 600;
+	});
+}
+function isCommandStreamInterrupted(error) {
+	return findInErrorChain(error, (candidate) => {
+		if (!(candidate instanceof Error)) return false;
+		return candidate.name === "StreamError" && candidate.message.toLowerCase().includes("stream ended before command finished");
+	});
+}
+/** Map Vercel Sandbox API and SDK errors to the shared sandbox error cases. */
+const vercelSandboxErrors = {
+	isUnavailable,
+	isMissing,
+	isSnapshotMissing,
+	isSnapshotting,
+	isTransient,
+	isCommandStreamInterrupted
+};
+// src/chat/sandbox/vercel/provider.ts
+function credentialOptions() {
+	return getVercelSandboxCredentials() ?? {};
+}
+/** Bind one abort signal to every API request made by a Sandbox client. */
+function scopedFetchOptions(signal) {
+	if (!signal) return {};
+	return { fetch: (input, init) => {
+		const requestSignal = init?.signal ?? (input instanceof Request ? input.signal : void 0);
+		return globalThis.fetch(input, {
+			...init,
+			signal: requestSignal ? AbortSignal.any([requestSignal, signal]) : signal
+		});
+	} };
+}
+/** Pin Junior's sandbox contract to one Vercel session without SDK replay. */
+function adaptSession(sandbox, options) {
+	const session = sandbox.currentSession();
+	const fileSystem = new FileSystem(session);
+	const run = async (operation) => {
+		try {
+			return await operation();
+		} catch (error) {
+			if (vercelSandboxErrors.isUnavailable(error)) options?.onUnavailable?.(session.sessionId);
+			throw error;
+		}
+	};
+	return {
+		sandboxId: sandbox.name,
+		sessionId: session.sessionId,
+		fs: {
+			readFile: async (filePath, readOptions) => await run(async () => await fileSystem.readFile(filePath, readOptions)),
+			writeFile: async (filePath, content, writeOptions) => await run(async () => await fileSystem.writeFile(filePath, content, writeOptions)),
+			readdir: async (filePath, readOptions) => await run(async () => await fileSystem.readdir(filePath, readOptions)),
+			stat: async (filePath, statOptions) => await run(async () => await fileSystem.stat(filePath, statOptions))
+		},
+		extendTimeout(duration) {
+			return run(async () => await session.extendTimeout(duration));
+		},
+		mkDir(path) {
+			return run(async () => await session.mkDir(path));
+		},
+		readFileToBuffer(input) {
+			return run(async () => await session.readFileToBuffer(input));
+		},
+		async runCommand(input) {
+			const result = await run(async () => await session.runCommand(input));
+			const [stdout, stderr] = await Promise.all([run(async () => await result.stdout()), run(async () => await result.stderr())]);
+			return {
+				exitCode: result.exitCode,
+				stdout,
+				stderr
+			};
+		},
+		snapshot(snapshotOptions) {
+			return run(async () => {
+				return { snapshotId: (await session.snapshot(snapshotOptions)).snapshotId };
+			});
+		},
+		stop() {
+			return run(async () => await session.stop());
+		},
+		update(params) {
+			return run(async () => await session.update(params.networkPolicy ? { networkPolicy: toVercelNetworkPolicy(params.networkPolicy) } : {}));
+		},
+		writeFiles(files) {
+			return run(async () => await session.writeFiles(files));
+		}
+	};
+}
+/** Create a Sandbox and return a session pinned to its first VM session. */
+async function createSandboxSession(input) {
+	const shared = {
+		timeout: input.timeoutMs,
+		...input.name ? { name: input.name } : void 0,
+		...input.persistent !== void 0 ? { persistent: input.persistent } : void 0,
+		...input.networkPolicy ? { networkPolicy: toVercelNetworkPolicy(input.networkPolicy) } : void 0,
+		...input.resources ? { resources: input.resources } : void 0,
+		...input.signal ? { signal: input.signal } : void 0,
+		...credentialOptions(),
+		...scopedFetchOptions(input.scopeSignal)
+	};
+	return adaptSession(await Sandbox.create(input.snapshotId ? {
+		...shared,
+		source: {
+			type: "snapshot",
+			snapshotId: input.snapshotId
+		}
+	} : {
+		...shared,
+		...input.runtime ? { runtime: input.runtime } : void 0
+	}), input);
+}
+/** Resume a named Sandbox and return a session pinned to its VM session. */
+async function getSandboxSession(input) {
+	return adaptSession(await Sandbox.get({
+		name: input.name,
+		resume: true,
+		...credentialOptions(),
+		...scopedFetchOptions(input.scopeSignal)
+	}), input);
+}
+/** Create the named, persistent Sandbox that owns one Workspace snapshot build. */
+async function createWorkspaceSnapshotBuilder(input) {
+	await Sandbox.create({
+		name: input.name,
+		persistent: true,
+		timeout: input.timeoutMs,
+		runtime: input.runtime,
+		signal: input.signal,
+		...credentialOptions(),
+		...input.resources ? { resources: input.resources } : void 0
+	});
+}
 /** Resume the named Sandbox that owns one Workspace snapshot build. */
 async function getWorkspaceSnapshotBuilder(name, signal) {
-	const credentials = getVercelSandboxCredentials();
-	return await Sandbox.get({
+	const sandbox = await Sandbox.get({
 		name,
 		resume: true,
 		signal,
-		...credentials ?? {}
+		...credentialOptions()
 	});
+	return {
+		session: () => adaptSession(sandbox),
+		async startDetachedCommand(input) {
+			return (await sandbox.runCommand({
+				...input,
+				detached: true
+			})).cmdId;
+		},
+		getCommand: (commandId, options) => sandbox.getCommand(commandId, options),
+		async snapshot(options) {
+			const snapshot = await sandbox.snapshot(options);
+			return {
+				snapshotId: snapshot.snapshotId,
+				...typeof snapshot.sizeBytes === "number" ? { sizeBytes: snapshot.sizeBytes } : void 0
+			};
+		}
+	};
 }
 /** Permanently delete named Workspace snapshot builders without resuming them. */
 async function deleteWorkspaceSnapshotBuilders(names) {
-	const credentials = getVercelSandboxCredentials();
 	let hasError = false;
 	let firstError;
 	for (const name of new Set(names)) try {
 		await (await Sandbox.get({
 			name,
 			resume: false,
-			...credentials ?? {}
+			...credentialOptions()
 		})).delete();
 	} catch (error) {
-		if (!isSandboxMissingError(error)) {
+		if (!vercelSandboxErrors.isMissing(error)) {
 			if (!hasError) firstError = error;
 			hasError = true;
 		}
 	}
 	if (hasError) throw firstError;
 }
+/** Vercel Sandbox implementation of the sandbox provider contract. */
+const vercelSandboxProvider = {
+	errors: vercelSandboxErrors,
+	createSession: createSandboxSession,
+	getSession: getSandboxSession,
+	createWorkspaceSnapshotBuilder,
+	getWorkspaceSnapshotBuilder,
+	deleteWorkspaceSnapshotBuilders
+};
+// src/chat/sandbox/provider.ts
+/** Return the sandbox provider for this deployment. */
+function getSandboxProvider() {
+	return vercelSandboxProvider;
+}
+// src/chat/sandbox/guest-docker.ts
+/** Docker daemon config for Vercel sandbox guests (nested containers). */
+const DOCKER_DAEMON_JSON = `{
+  "storage-driver": "overlay2",
+  "live-restore": false
+}
+`;
+/**
+* Start dockerd when the socket is missing and wait until `docker info` works.
+* Re-execs through sudo so the sandbox user can call it without root.
+*/
+const DOCKER_ENSURE_SCRIPT = `#!/bin/sh
+set -eu
+
+if [ "$(id -u)" -ne 0 ]; then
+  exec sudo -n "$0" "$@"
+fi
+
+SOCK=/var/run/docker.sock
+PIDFILE=/var/run/docker.pid
+LOG=/var/log/junior-dockerd.log
+
+is_ready() {
+  [ -S "$SOCK" ] && /usr/bin/docker info >/dev/null 2>&1
+}
+
+if is_ready; then
+  chmod 666 "$SOCK" 2>/dev/null || true
+  exit 0
+fi
+
+mkdir -p /etc/docker /var/lib/docker /var/run /var/log
+if [ ! -f /etc/docker/daemon.json ]; then
+  cat > /etc/docker/daemon.json <<'EOF'
+{
+  "storage-driver": "overlay2",
+  "live-restore": false
+}
+EOF
+fi
+
+if [ -f "$PIDFILE" ]; then
+  oldpid="$(cat "$PIDFILE" 2>/dev/null || true)"
+  if [ -n "\${oldpid:-}" ] && ! kill -0 "$oldpid" 2>/dev/null; then
+    rm -f "$PIDFILE"
+  fi
+fi
+
+if [ ! -f "$PIDFILE" ] || ! kill -0 "$(cat "$PIDFILE" 2>/dev/null)" 2>/dev/null; then
+  # dockerd must outlive this helper; nohup + background is intentional.
+  nohup dockerd --host="unix://$SOCK" --pidfile="$PIDFILE" >"$LOG" 2>&1 &
+fi
+
+i=0
+while [ "$i" -lt 50 ]; do
+  if is_ready; then
+    chmod 666 "$SOCK" 2>/dev/null || true
+    exit 0
+  fi
+  i=$((i + 1))
+  sleep 0.1
+done
+
+echo "junior-ensure-docker: dockerd failed to become ready" >&2
+if [ -f "$LOG" ]; then
+  tail -n 50 "$LOG" >&2 || true
+fi
+exit 1
+`;
+/** PATH wrapper so plain `docker` starts the daemon on first use. */
+const DOCKER_CLI_WRAPPER_SCRIPT = `#!/bin/sh
+set -eu
+if command -v junior-ensure-docker >/dev/null 2>&1; then
+  junior-ensure-docker
+fi
+exec /usr/bin/docker "$@"
+`;
+/** PATH wrapper so plain `docker-compose` starts the daemon on first use. */
+const DOCKER_COMPOSE_CLI_WRAPPER_SCRIPT = `#!/bin/sh
+set -eu
+if command -v junior-ensure-docker >/dev/null 2>&1; then
+  junior-ensure-docker
+fi
+exec /usr/local/libexec/junior-docker-compose "$@"
+`;
+/**
+* Best-effort dockerd start during sandbox prepare.
+* Missing helper is a no-op so tests and base sandboxes stay green.
+*/
+async function ensureDockerDaemon(sandbox, signal) {
+	await runNonInteractiveCommand(sandbox, {
+		cmd: "sh",
+		args: ["-c", "command -v junior-ensure-docker >/dev/null 2>&1 && junior-ensure-docker || true"],
+		signal
+	});
+}
+// src/chat/sandbox/runtime-dependencies.ts
+const GLOBAL_RUNTIME_DEPENDENCIES = [
+	{
+		type: "system",
+		package: "docker"
+	},
+	{
+		type: "system",
+		package: "spal-release"
+	},
+	{
+		type: "system",
+		package: "ripgrep"
+	}
+];
+function writeFileCommand(path, contents, mode = "0644") {
+	return [`printf '%s' '${Buffer.from(contents, "utf8").toString("base64")}' | base64 -d > ${path}`, `chmod ${mode} ${path}`].join("\n");
+}
+function writeExecutableCommand(path, contents) {
+	return writeFileCommand(path, contents, "0755");
+}
+const GLOBAL_RUNTIME_POSTINSTALL = [{
+	cmd: "sh",
+	args: ["-c", [
+		"set -eu",
+		"case \"$(uname -m)\" in",
+		"  x86_64) asset=\"x86_64\"; sha256=\"7af95166a730b87e172d4fc9aefea8725d3c6c7327d59149267b452114ddb7d4\" ;;",
+		"  aarch64) asset=\"aarch64\"; sha256=\"49082844b87f03cdcd5f5bbef1ba8c9c897b7a2dfb80cea18d61ec8ca6117e0c\" ;;",
+		"  *) echo \"unsupported Docker Compose architecture: $(uname -m)\" >&2; exit 1 ;;",
+		"esac",
+		"tmp=\"$(mktemp)\"",
+		"trap 'rm -f \"$tmp\"' EXIT",
+		"curl --fail --location --silent --show-error \"https://github.com/docker/compose/releases/download/v2.39.4/docker-compose-linux-${asset}\" --output \"$tmp\"",
+		"echo \"${sha256}  ${tmp}\" | sha256sum --check --status",
+		"install -D -m 0755 \"$tmp\" /usr/local/libexec/junior-docker-compose",
+		"mkdir -p /usr/local/lib/docker/cli-plugins /usr/local/libexec /etc/docker /usr/local/bin",
+		`mkdir -p ${SANDBOX_WORKSPACE_ROOT}/.junior/bin`,
+		writeFileCommand("/etc/docker/daemon.json", DOCKER_DAEMON_JSON),
+		writeExecutableCommand("/usr/local/bin/junior-ensure-docker", DOCKER_ENSURE_SCRIPT),
+		"ln -sfn /usr/local/libexec/junior-docker-compose /usr/local/lib/docker/cli-plugins/docker-compose",
+		writeExecutableCommand("/usr/local/bin/docker-compose", DOCKER_COMPOSE_CLI_WRAPPER_SCRIPT),
+		writeExecutableCommand(`${SANDBOX_WORKSPACE_ROOT}/.junior/bin/docker`, DOCKER_CLI_WRAPPER_SCRIPT),
+		writeExecutableCommand(`${SANDBOX_WORKSPACE_ROOT}/.junior/bin/docker-compose`, DOCKER_COMPOSE_CLI_WRAPPER_SCRIPT),
+		writeExecutableCommand("/usr/local/bin/docker", DOCKER_CLI_WRAPPER_SCRIPT)
+	].join("\n")],
+	sudo: true
+}];
+// src/chat/sandbox/snapshot/profile.ts
+const VERSION = 1;
+const DEFAULT_FLOATING_MAX_AGE_MS = 6048e5;
+function isExactNpmVersion(version) {
+	return /^\d+\.\d+\.\d+(?:[-+][a-z0-9.]+)?$/i.test(version.trim());
+}
+function isFloating(dep) {
+	return dep.type === "npm" && !isExactNpmVersion(dep.version);
+}
+/**
+* Merge dependencies for one global install, rejecting competing npm versions.
+*/
+function mergeDependencies(dependencies) {
+	const seen = /* @__PURE__ */ new Set();
+	const npmVersions = /* @__PURE__ */ new Map();
+	const merged = [];
+	for (const dependency of dependencies) {
+		const key = dependency.type === "npm" ? `${dependency.type}:${dependency.package}:${dependency.version}` : "package" in dependency ? `${dependency.type}:package:${dependency.package}` : `${dependency.type}:url:${dependency.url}:${dependency.sha256}`;
+		if (seen.has(key)) continue;
+		seen.add(key);
+		if (dependency.type === "npm") {
+			const version = npmVersions.get(dependency.package);
+			if (version !== void 0 && version !== dependency.version) throw new Error(`Conflicting runtime dependency versions for ${dependency.package}: ${version} and ${dependency.version}`);
+			npmVersions.set(dependency.package, dependency.version);
+		}
+		merged.push(dependency);
+	}
+	return merged;
+}
+function floatingMaxAgeMs() {
+	const raw = process.env.SANDBOX_SNAPSHOT_FLOATING_MAX_AGE_MS;
+	if (!raw?.trim()) return DEFAULT_FLOATING_MAX_AGE_MS;
+	const parsed = Number.parseInt(raw, 10);
+	return Number.isFinite(parsed) && parsed >= 0 ? parsed : DEFAULT_FLOATING_MAX_AGE_MS;
+}
+/** Locale-independent string order for stable profile hashes. */
+function compareCodePoints(left, right) {
+	if (left < right) return -1;
+	if (left > right) return 1;
+	return 0;
+}
+function workspaceRecipe(workspace) {
+	const repos = [...workspace.repos].map(({ provider, repo }) => ({
+		provider,
+		repo
+	})).sort((left, right) => {
+		const provider = compareCodePoints(left.provider, right.provider);
+		if (provider !== 0) return provider;
+		return compareCodePoints(left.repo, right.repo);
+	});
+	return {
+		id: workspace.id,
+		repos,
+		setupScript: workspace.setupScript
+	};
+}
+/** Build the complete profile that selects one reusable sandbox snapshot. */
+function create(runtime, workspace) {
+	const dependencies = mergeDependencies([...GLOBAL_RUNTIME_DEPENDENCIES, ...pluginCatalogRuntime.getRuntimeDependencies()]);
+	const pluginPostinstall = pluginCatalogRuntime.getRuntimePostinstall();
+	const postinstall = [...GLOBAL_RUNTIME_POSTINSTALL, ...pluginPostinstall];
+	if (dependencies.length === 0 && postinstall.length === 0 && !workspace) return null;
+	const rebuildEpoch = process.env.SANDBOX_SNAPSHOT_REBUILD_EPOCH?.trim() ?? "";
+	const floating = dependencies.some((dependency) => isFloating(dependency)) || pluginPostinstall.length > 0 || Boolean(workspace);
+	return {
+		hash: createHash("sha256").update(JSON.stringify({
+			version: VERSION,
+			runtime,
+			rebuildEpoch,
+			dependencies,
+			postinstall,
+			...workspace ? { workspace: workspaceRecipe(workspace) } : void 0
+		})).digest("hex"),
+		dependencyCount: dependencies.length,
+		floating,
+		dependencies,
+		postinstall
+	};
+}
+/** Return the current dependency profile hash without building its snapshot. */
+function hash(runtime, workspace) {
+	return create(runtime, workspace)?.hash;
+}
+/** Decide whether a cached snapshot has outlived a floating profile. */
+function isStale(profile, createdAtMs) {
+	if (!profile.floating) return false;
+	const maxAgeMs = floatingMaxAgeMs();
+	return maxAgeMs === 0 || Date.now() - createdAtMs > maxAgeMs;
+}
 // src/chat/sandbox/snapshot/runtime.ts
 /** Runtime used to build and start reusable Sandbox snapshots. */
 const SANDBOX_RUNTIME = "node22";
@@ -3244,7 +5453,7 @@ function isUniqueViolation(error) {
 async function cleanupSnapshotBuilders(workspaceId, names) {
 	if (names.length === 0) return;
 	try {
-		await deleteWorkspaceSnapshotBuilders(names);
+		await getSandboxProvider().deleteWorkspaceSnapshotBuilders(names);
 	} catch (error) {
 		logException(error, "sandbox.workspace_snapshot.builder.delete_failed", {
 			"app.workspace.id": workspaceId,
@@ -3497,7 +5706,7 @@ const systemPromptMessageArraySchema = z.array(promptMessageSchema);
 function isRecord(value) {
 	return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
-function basePluginContext(plugin) {
+function basePluginContext$1(plugin) {
 	const name = plugin.manifest.name;
 	return {
 		plugin: { name },
@@ -3512,7 +5721,7 @@ function pluginToolNamespace(pluginName) {
 	return `${first}${rest.map((part) => `${part[0]?.toUpperCase() ?? ""}${part.slice(1)}`).join("")}`;
 }
 function systemPromptPluginContext(plugin) {
-	return { ...basePluginContext(plugin) };
+	return { ...basePluginContext$1(plugin) };
 }
 /** Bind Source, Destination, and Actor for one plugin invocation. */
 function pluginInvocationContext(context) {
@@ -3557,7 +5766,7 @@ function pluginInvocationContext(context) {
 }
 function invocationPluginContext(plugin, context, turnId) {
 	return {
-		...basePluginContext(plugin),
+		...basePluginContext$1(plugin),
 		conversationId: context.conversationId,
 		locationId: context.locationId,
 		embedder: createPluginEmbedder(plugin.manifest.name),
@@ -3832,7 +6041,7 @@ function getPluginTools(context, sandbox = createSandboxCapability(context.works
 		const resolveActor = context.resolveActorIdentity ?? (async () => void 0);
 		const automationUrl = (context.source.kind === "event_automation" || context.source.kind === "scheduled_automation") && context.source.automationId ? getDashboardTaskLink(context.source.automationId) : void 0;
 		const common = {
-			...basePluginContext(plugin),
+			...basePluginContext$1(plugin),
 			annotations,
 			...automationUrl ? { automationLink: { url: automationUrl } } : void 0,
 			conversationId: context.conversationId,
@@ -3969,13 +6178,14 @@ function getPluginRoutes(options) {
 		const hook = plugin.hooks?.routes;
 		if (!hook) continue;
 		const pluginRoutes = hook({
-			...basePluginContext(plugin),
+			...basePluginContext$1(plugin),
 			annotations: { forConversation: (conversationId) => createPluginAnnotations({
 				conversationId,
 				db: getDb(),
 				plugin: pluginName
 			}) },
 			codeChanges: createCodeChangePublisher(pluginName),
+			users: { readIdentity: readIdentityById },
 			events: {
 				async hasMatch(event) {
 					if (!options.events.hasMatch) return false;
@@ -4039,7 +6249,7 @@ function getPluginApiRoutes() {
 		const hook = plugin.hooks?.apiRoutes;
 		if (!hook) continue;
 		const app = hook({
-			...basePluginContext(plugin),
+			...basePluginContext$1(plugin),
 			conversationEvents: createPluginConversationEventReader(plugin),
 			eventStats: createPluginConversationEventStats(plugin),
 			users: { resolve: resolveViewerUser }
@@ -4073,7 +6283,7 @@ function getPluginSlackConversationLink(conversationId) {
 		const hook = plugin.hooks?.slackConversationLink;
 		if (!hook) continue;
 		const url = trustedSlackConversationUrl(pluginName, hook({
-			...basePluginContext(plugin),
+			...basePluginContext$1(plugin),
 			conversationId
 		}));
 		if (url) return { url };
@@ -4211,7 +6421,7 @@ async function getPluginOperationalReports(nowMs) {
 		try {
 			const state = createPluginState(pluginName);
 			const report = await hook({
-				...basePluginContext(plugin),
+				...basePluginContext$1(plugin),
 				eventStats: createPluginConversationEventStats(plugin, () => nowMs),
 				nowMs,
 				state: pluginReadState(state)
@@ -4241,7 +6451,7 @@ async function getPluginProfileReports(args) {
 		try {
 			const state = createPluginState(pluginName);
 			const report = await hook({
-				...basePluginContext(plugin),
+				...basePluginContext$1(plugin),
 				nowMs: args.nowMs,
 				state: pluginReadState(state),
 				subject: args.subject,
@@ -4314,7 +6524,7 @@ function createPluginHookRunner(input = {}) {
 				}) : void 0;
 				try {
 					const result = await hook({
-						...basePluginContext(plugin),
+						...basePluginContext$1(plugin),
 						...tool.conversationId ? { conversationId: tool.conversationId } : void 0,
 						...annotations ? { annotations } : void 0,
 						result: {
@@ -4363,7 +6573,7 @@ function createPluginHookRunner(input = {}) {
 				}));
 				if (selected.length === 0) continue;
 				const finalize = await hook({
-					...basePluginContext(plugin),
+					...basePluginContext$1(plugin),
 					repos: selected,
 					sandbox: sandboxCapability
 				});
@@ -4381,7 +6591,7 @@ function createPluginHookRunner(input = {}) {
 				if (!hook) continue;
 				logInfo("agent.plugin.sandbox_preparation.started", { "app.plugin.name": pluginName });
 				await hook({
-					...basePluginContext(plugin),
+					...basePluginContext$1(plugin),
 					actor: input.actor,
 					sandbox: sandboxCapability
 				});
@@ -4398,7 +6608,7 @@ function createPluginHookRunner(input = {}) {
 				let replacement;
 				let blocked;
 				await hook({
-					...basePluginContext(plugin),
+					...basePluginContext$1(plugin),
 					actor: input.actor,
 					actors,
 					tool: {
@@ -4439,4 +6649,925 @@ function createPluginHookRunner(input = {}) {
 		}
 	};
 }
-export { bindSlackDirectCredentialSubject as $, createCache as $t, getWorkspaceSnapshotBuilder as A, conversationArchivedForUser as At, STOP_WATCHING_TOOL_NAME as B, getSlackFileId as Bt, WorkspaceValidationError as C, createPluginState as Ct, setWorkspaceSnapshotBuild as D, readConversationAccessFromSql as Dt, setWorkspaceSnapshot as E, createPluginLogger as Et, isSlackMessageTurn as F, viewerConversationMembership as Ft, createWatch as G, saveObjectAnnotations as Gt, cancelWatch as H, readAttachmentVisionSummary as Ht, slackMessageTurnDisabledReason as I, createPluginConversationEvents as It, getWatch as J, listConversationAnnotationsById as Jt, deliverWatch as K, createPluginAnnotations as Kt, RESOURCE_SUBSCRIPTION_DEFAULT_TTL_MS as L, readLatestConversationBrief as Lt, workspaceRepoCheckoutPath as M, conversationIsMemberRoot as Mt, resolveChannelCapabilities as N, conversationNotArchivedForEmail as Nt, SANDBOX_RUNTIME as O, conversationArchiveTimes as Ot, getSlackToolContext as P, conversationNotArchivedForUser as Pt, bindScheduledAutomationCredentialSubject as Q, createPluginCache as Qt, RESOURCE_SUBSCRIPTION_MAX_TTL_MS as R, readConversationEventPage as Rt, updateWorkspace as S, PluginToolDeniedError as St, loadSnapshotsForProfile as T, createPluginModel as Tt, collectEventMatchKeys as U, recordSlackAttachment as Ut, cancelSubscriptions as V, matchSlackAttachments as Vt, createTimerWatch as W, resolveRootVisibility as Wt, takeDueTimerWatches as X, resolveUserTimezone as Xt, listWatches as Y, defaultTimezone as Yt, bindEventAutomationCredentialSubject as Z, lookupSlackUser as Zt, deleteWorkspace as _, getDashboardConversationLink as _t, getPluginRoutes as a, downloadPrivateSlackFile as at, listWorkspaces as b, setDashboardConversationLinkOptions as bt, getPluginTools as c, getSlackClient as ct, setPlugins as d, normalizeSlackConversationId as dt, JUNIOR_NATIVE_EVENT_NAMESPACE as en, verifyEventAutomationCredentialSubject as et, validatePlugins as f, runWithSlackInstallationToken as ft, createWorkspace as g, JUNIOR_THREAD_STATE_TTL_MS as gt, setBriefsConfig as h, runWithWorkspaceTeamId as ht, getPluginApiRoutes as i, conversationNoteEvent as in, SlackActionError as it, tryWorkspaceRepoCheckoutPath as j, conversationHasParticipantUser as jt, deleteWorkspaceSnapshotBuilders as k, conversationArchivedForEmail as kt, getPluginUserPromptContributions as l, isConversationScopedChannel as lt, registration_exports as m, getWorkspaceTeamId as mt, applyPluginFormatMarkdown as n, authenticationLinkedEvent as nn, verifySlackDirectCredentialSubject as nt, getPluginSlackConversationLink as o, getFilePermalink as ot, coreTaskRegistrations as p, withSlackRetries as pt, findMatchingWatches as q, listConversationAnnotations as qt, createPluginHookRunner as r, authenticationUnlinkedEvent as rn, verifyTimerWatchCredentialSubject as rt, getPluginSystemPromptContributions as s, getHeaderString as st, agent_hooks_exports as t, agentsInstructionsUpdatedEvent as tn, verifyScheduledAutomationCredentialSubject as tt, getPlugins as u, isDmChannel as ut, getWorkspace as v, getDashboardObjectIconLink as vt, invalidateReadySnapshot as w, createPluginEmbedder as wt, listWorkspacesByRepository as x, ToolInputError as xt, getWorkspaceByName as y, getDashboardTaskLink as yt, RESOURCE_WATCH_TOOL_SOURCE as z, buildSentryConversationUrl as zt };
+// src/chat/plugins/credential-hooks.ts
+function parseSchema(schema, value, message) {
+	const result = schema.safeParse(value);
+	if (!result.success) throw new Error(message);
+	return result.data;
+}
+function parseAuthorization(value, pluginName) {
+	if (value === void 0) return;
+	const authorization = parseSchema(pluginAuthorizationSchema, value, `Plugin "${pluginName}" grant authorization is invalid`);
+	if (authorization.provider !== pluginName) throw new Error(`Plugin "${pluginName}" grant authorization provider must match the issuing plugin`);
+	return authorization;
+}
+function parseGrant(value, pluginName) {
+	return parseSchema(pluginGrantSchema, value, `Plugin "${pluginName}" grantForEgress returned an invalid grant`);
+}
+function pluginFor(provider) {
+	return getPlugins().find((candidate) => candidate.manifest.name === provider);
+}
+function basePluginContext(plugin) {
+	const pluginName = plugin.manifest.name;
+	return {
+		plugin: { name: pluginName },
+		cache: createPluginCache(pluginName),
+		log: createPluginLogger(pluginName),
+		db: getDb()
+	};
+}
+function parseCredentialResult(value, pluginName) {
+	const result = parseSchema(pluginCredentialResultSchema, value, `Plugin "${pluginName}" issueCredential result is invalid`);
+	if (result.type === "lease") {
+		parseAuthorization(result.lease.authorization, pluginName);
+		return result;
+	}
+	if (result.type === "unavailable") return result;
+	parseAuthorization(result.authorization, pluginName);
+	return result;
+}
+/** Ask a plugin which grant an outbound request needs. */
+async function selectPluginGrant(input) {
+	const plugin = pluginFor(input.provider);
+	const hook = plugin?.hooks?.grantForEgress;
+	if (!plugin || !hook) return;
+	const result = await hook({
+		...basePluginContext(plugin),
+		request: {
+			...input.bodyText !== void 0 ? { bodyText: input.bodyText } : void 0,
+			method: input.method,
+			...input.operation ? { operation: input.operation } : void 0,
+			url: input.upstreamUrl.toString()
+		}
+	});
+	return result === void 0 ? void 0 : parseGrant(result, plugin.manifest.name);
+}
+/** Let the owning plugin inspect an upstream response without changing pass-through behavior. */
+async function onPluginEgressResponse(input) {
+	const plugin = pluginFor(input.provider);
+	const hook = plugin?.hooks?.onEgressResponse;
+	if (!plugin || !hook) return {};
+	let permissionDenied;
+	await hook({
+		...basePluginContext(plugin),
+		grant: input.grant,
+		permissionDenied(message) {
+			const trimmed = message.trim();
+			if (!trimmed) throw new Error(`Plugin "${plugin.manifest.name}" onEgressResponse permissionDenied message is empty`);
+			permissionDenied = { message: trimmed };
+		},
+		request: {
+			method: input.method,
+			...input.operation ? { operation: input.operation } : void 0,
+			url: input.upstreamUrl.toString()
+		},
+		response: input.response
+	});
+	return permissionDenied ? { permissionDenied } : {};
+}
+/** Return whether a plugin owns credential issuance for egress. */
+function hasEgressCredentialHooks(provider) {
+	const hooks = pluginFor(provider)?.hooks;
+	return Boolean(hooks?.grantForEgress || hooks?.issueCredential);
+}
+/** Return providers that can verify an OAuth account for identity storage. */
+function getOAuthAccountProviders() {
+	return getPlugins().filter((plugin) => Boolean(plugin.hooks?.resolveOAuthAccount)).map((plugin) => plugin.manifest.name);
+}
+/** Ask a plugin which provider account belongs to an OAuth token. */
+async function resolvePluginOAuthAccount(input) {
+	const plugin = pluginFor(input.provider);
+	const hook = plugin?.hooks?.resolveOAuthAccount;
+	if (!plugin || !hook) return;
+	const account = await hook({
+		...basePluginContext(plugin),
+		tokenResponse: input.tokenResponse,
+		tokens: input.tokens
+	});
+	return account === void 0 ? void 0 : parseSchema(pluginProviderAccountSchema, account, `Plugin "${plugin.manifest.name}" resolveOAuthAccount returned an invalid account`);
+}
+/** Ask a plugin to issue headers or describe why the selected grant is unavailable. */
+async function issuePluginCredential(input) {
+	const plugin = pluginFor(input.provider);
+	const hook = plugin?.hooks?.issueCredential;
+	if (!plugin || !hook) throw new Error(`Plugin "${input.provider}" has no issueCredential hook`);
+	const currentUserId = "type" in input.actor ? input.actor.userId : void 0;
+	const credentialSubjectUserId = input.credentialSubject?.userId;
+	return parseCredentialResult(await hook({
+		...basePluginContext(plugin),
+		actor: input.actor,
+		grant: input.grant,
+		...input.credentialSubject ? { credentialSubject: input.credentialSubject } : void 0,
+		tokens: {
+			...currentUserId ? { currentUser: {
+				userId: currentUserId,
+				get: async () => await input.userTokenStore.get(currentUserId, plugin.manifest.name),
+				set: async (tokens) => {
+					await input.userTokenStore.set(currentUserId, plugin.manifest.name, tokens);
+				},
+				withRefresh: async (callback) => await input.userTokenStore.withRefresh(currentUserId, plugin.manifest.name, callback)
+			} } : void 0,
+			...credentialSubjectUserId ? { credentialSubject: {
+				userId: credentialSubjectUserId,
+				get: async () => await input.userTokenStore.get(credentialSubjectUserId, plugin.manifest.name),
+				set: async (tokens) => {
+					await input.userTokenStore.set(credentialSubjectUserId, plugin.manifest.name, tokens);
+				},
+				withRefresh: async (callback) => await input.userTokenStore.withRefresh(credentialSubjectUserId, plugin.manifest.name, callback)
+			} } : void 0
+		}
+	}), plugin.manifest.name);
+}
+// src/chat/capabilities/router.ts
+var ProviderCredentialRouter = class {
+	brokersByProvider;
+	constructor(input) {
+		this.brokersByProvider = input.brokersByProvider;
+	}
+	async issue(input) {
+		const broker = this.brokersByProvider[input.provider];
+		if (!broker) throw new Error(`No credential broker registered for provider: ${input.provider}`);
+		return await broker.issue({
+			context: input.context,
+			reason: input.reason
+		});
+	}
+};
+// src/chat/credentials/user-token-store.ts
+const storedTokensSchema = pluginStoredTokensSchema;
+// src/chat/credentials/state-adapter-token-store.ts
+const KEY_PREFIX = "oauth-token";
+const BUFFER_MS = 864e5;
+const LONG_LIVED_TTL_MS = 31536e6;
+const REFRESH_LOCK_WAIT_MS = 3e4;
+const REFRESH_LOCK_RETRY_MS = 100;
+function tokenKey(userId, provider) {
+	return `${KEY_PREFIX}:${userId}:${provider}`;
+}
+function refreshLockKey(userId, provider) {
+	return `${tokenKey(userId, provider)}:refresh`;
+}
+var StateAdapterTokenStore = class {
+	state;
+	constructor(stateAdapter) {
+		this.state = stateAdapter;
+	}
+	async get(userId, provider) {
+		const stored = await this.state.get(tokenKey(userId, provider));
+		return stored === null || stored === void 0 ? void 0 : storedTokensSchema.parse(stored);
+	}
+	async set(userId, provider, tokens) {
+		const parsed = storedTokensSchema.parse(tokens);
+		const expiresAt = parsed.refreshTokenExpiresAt ?? parsed.expiresAt;
+		const ttlMs = expiresAt ? Math.max(expiresAt - Date.now() + BUFFER_MS, BUFFER_MS) : LONG_LIVED_TTL_MS;
+		await this.state.set(tokenKey(userId, provider), parsed, ttlMs);
+	}
+	async delete(userId, provider) {
+		await this.state.delete(tokenKey(userId, provider));
+	}
+	/** Wait for the per-slot refresh gate so rotated refresh tokens are used once. */
+	async withRefresh(userId, provider, callback) {
+		const lockKey = refreshLockKey(userId, provider);
+		const deadline = Date.now() + REFRESH_LOCK_WAIT_MS;
+		while (true) {
+			const lock = await acquireActiveLock(this.state, lockKey);
+			if (lock) try {
+				return await callback();
+			} finally {
+				await this.state.releaseLock(lock);
+			}
+			if (Date.now() >= deadline) throw new Error(`Could not acquire OAuth token refresh lock`);
+			await sleep$1(REFRESH_LOCK_RETRY_MS);
+		}
+	}
+};
+// src/chat/capabilities/factory.ts
+const sandboxEgressRouters = /* @__PURE__ */ new WeakMap();
+/** Create the user token store used by OAuth-backed credential brokers. */
+function createUserTokenStore() {
+	return new StateAdapterTokenStore(getStateAdapter());
+}
+function createProviderCredentialRouter(userTokenStore) {
+	const brokersByProvider = {};
+	for (const plugin of pluginCatalogRuntime.getProviders()) {
+		const { name } = plugin.manifest;
+		if (!plugin.manifest.credentials && !plugin.manifest.apiHeaders) continue;
+		brokersByProvider[name] = pluginCatalogRuntime.createBroker(name, { userTokenStore });
+	}
+	return new ProviderCredentialRouter({ brokersByProvider });
+}
+function getSandboxEgressRouter() {
+	const stateAdapter = getStateAdapter();
+	let router = sandboxEgressRouters.get(stateAdapter);
+	if (!router) {
+		router = createProviderCredentialRouter(new StateAdapterTokenStore(stateAdapter));
+		sandboxEgressRouters.set(stateAdapter, router);
+	}
+	return router;
+}
+/** Issue one provider credential lease for host-side sandbox egress proxying. */
+async function issueProviderCredentialLease(input) {
+	return await getSandboxEgressRouter().issue(input);
+}
+// src/chat/sandbox/egress/credentials.ts
+const HTTP_READ_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS"
+]);
+/**
+* Signals that egress selected a grant but could not issue credential headers.
+*
+* Callers convert this into command-level auth-required state so the agent can
+* request authorization without exposing provider-specific lease internals.
+*/
+var SandboxEgressCredentialError = class extends Error {
+	authorization;
+	grant;
+	kind;
+	provider;
+	constructor(input) {
+		super(input.message);
+		this.name = "SandboxEgressCredentialError";
+		this.authorization = input.authorization;
+		this.grant = input.grant;
+		this.kind = input.kind;
+		this.provider = input.provider;
+	}
+};
+function defaultGrantForProvider(input) {
+	const access = HTTP_READ_METHODS.has(input.method.toUpperCase()) ? "read" : "write";
+	return {
+		source: "broker",
+		grant: {
+			name: "default",
+			access,
+			reason: `sandbox-egress:${input.provider}:${access}`
+		}
+	};
+}
+function hasGenericCredentials(provider) {
+	const manifest = pluginCatalogRuntime.getDefinition(provider)?.manifest;
+	return Boolean(manifest?.credentials || manifest?.apiHeaders);
+}
+function oauthAuthorizationForProvider(provider) {
+	const oauth = pluginCatalogRuntime.getOAuthConfig(provider);
+	return oauth ? {
+		type: "oauth",
+		provider,
+		...oauth.scope ? { scope: oauth.scope } : void 0
+	} : void 0;
+}
+function credentialSubjectFromContext(context) {
+	return "subject" in context.credentials && context.credentials.subject ? {
+		type: "user",
+		userId: context.credentials.subject.userId
+	} : void 0;
+}
+function assertLeaseTransformsOwnedByProvider(provider, lease) {
+	for (const transform of lease.headerTransforms) if (resolveSandboxEgressProviderForHost(transform.domain) !== provider) throw new Error(`Credential lease for ${provider} included header transform for unowned domain ${transform.domain}`);
+}
+/**
+* Select the grant needed for one outbound request.
+*
+* GitHub GraphQL and other plugin-owned APIs may need body-aware grant choices;
+* providers without hooks use a simple read/write default based on HTTP method.
+* A hook plugin that also declares generic credentials can return no grant to
+* use that default for one request.
+*/
+async function selectSandboxEgressGrant(input) {
+	if (!hasEgressCredentialHooks(input.provider)) return defaultGrantForProvider(input);
+	const pluginGrant = await selectPluginGrant({
+		...input.bodyText !== void 0 ? { bodyText: input.bodyText } : void 0,
+		...input.operation ? { operation: input.operation } : void 0,
+		provider: input.provider,
+		method: input.method,
+		upstreamUrl: input.upstreamUrl
+	});
+	if (!pluginGrant) {
+		if (hasGenericCredentials(input.provider)) return defaultGrantForProvider(input);
+		throw new Error(`Plugin "${input.provider}" grantForEgress must return a grant for sandbox egress`);
+	}
+	return {
+		source: "plugin",
+		grant: pluginGrant
+	};
+}
+/**
+* Resolve the authorization flow attached to a broker-selected egress grant.
+*
+* Plugin-selected grants can return their own authorization metadata when
+* issuing credentials; broker defaults use the provider OAuth config.
+*/
+function authorizationForSandboxEgressGrant(provider, selection) {
+	return selection.source === "broker" ? oauthAuthorizationForProvider(provider) : void 0;
+}
+/**
+* Return credential header transforms for a selected grant.
+*
+* Only shared installation grants are remembered on the host. User and other
+* grants always issue from the live credential source so a saved login change
+* cannot leave stale auth headers in place. The sandbox context only authorizes
+* the request.
+*/
+async function sandboxEgressCredentialLease(provider, selection, context) {
+	const { grant } = selection;
+	const cached = await getSandboxEgressCredentialLease(provider, grant, context);
+	if (cached) {
+		if (selection.source === "plugin" && cached.grant.access !== grant.access) throw new Error(`Cached credential lease for ${provider}/${grant.name} has ${cached.grant.access} access, but ${grant.access} was selected`);
+		return {
+			...cached,
+			grant
+		};
+	}
+	let lease;
+	if (selection.source === "plugin") {
+		const credentialSubject = credentialSubjectFromContext(context);
+		const pluginResult = await issuePluginCredential({
+			provider,
+			grant,
+			actor: context.credentials.actor,
+			...credentialSubject ? { credentialSubject } : void 0,
+			userTokenStore: createUserTokenStore()
+		});
+		if (pluginResult.type === "needed") throw new SandboxEgressCredentialError({
+			provider,
+			grant,
+			kind: "auth_required",
+			authorization: pluginResult.authorization,
+			message: pluginResult.message
+		});
+		if (pluginResult.type === "unavailable") throw new SandboxEgressCredentialError({
+			provider,
+			grant,
+			kind: "unavailable",
+			message: pluginResult.message
+		});
+		lease = pluginResult.lease;
+	} else try {
+		lease = await issueProviderCredentialLease({
+			context: context.credentials,
+			provider,
+			reason: grant.reason ?? `sandbox-egress:${provider}:default`
+		});
+	} catch (error) {
+		if (error instanceof CredentialUnavailableError) throw new SandboxEgressCredentialError({
+			provider,
+			grant,
+			kind: "auth_required",
+			authorization: authorizationForSandboxEgressGrant(provider, selection),
+			message: error.message
+		});
+		throw error;
+	}
+	const headerTransforms = lease.headerTransforms ?? [];
+	if (headerTransforms.length === 0) throw new Error(`Credential lease for ${provider} did not include header transforms`);
+	const leaseExpiresAtMs = Date.parse(lease.expiresAt);
+	if (!Number.isFinite(leaseExpiresAtMs) || leaseExpiresAtMs <= Date.now()) throw new Error(`Credential lease for ${provider} is expired`);
+	const authorization = selection.source === "broker" ? oauthAuthorizationForProvider(provider) : lease.authorization;
+	const issuedLease = {
+		provider,
+		grant,
+		...lease.account ? { account: lease.account } : void 0,
+		...authorization ? { authorization } : void 0,
+		expiresAt: lease.expiresAt,
+		headerTransforms
+	};
+	assertLeaseTransformsOwnedByProvider(provider, issuedLease);
+	await setSandboxEgressCredentialLease(context, issuedLease);
+	return issuedLease;
+}
+/** Return whether a credential lease can modify requests to the target host. */
+function hasSandboxEgressLeaseTransformForHost(lease, host) {
+	return lease.headerTransforms.some((transform) => matchesSandboxEgressDomain(host, transform.domain));
+}
+// src/chat/egress/credentialed.ts
+const HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
+	"connection",
+	"host",
+	"keep-alive",
+	"proxy-authenticate",
+	"proxy-authorization",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade"
+]);
+const PROXY_ONLY_HEADERS = /* @__PURE__ */ new Set([
+	"vercel-sandbox-oidc-token",
+	"vercel-forwarded-host",
+	"vercel-forwarded-scheme",
+	"vercel-forwarded-port",
+	"vercel-forwarded-path"
+]);
+const TRACE_PROPAGATION_HEADERS = /* @__PURE__ */ new Set([
+	"baggage",
+	"sentry-trace",
+	"traceparent"
+]);
+const DECODED_RESPONSE_HEADERS = /* @__PURE__ */ new Set(["content-encoding", "content-length"]);
+const UPSTREAM_TOKEN_REJECTION_STATUS = 401;
+const UPSTREAM_PERMISSION_REJECTION_STATUS = 403;
+const GRANT_SELECTION_BODY_TEXT_LIMIT_BYTES = 65536;
+const RESPONSE_BODY_TEXT_LIMIT_BYTES = 65536;
+function authRequiredResponse(input) {
+	return new Response(`junior-auth-required provider=${input.provider} grant=${input.grant.name} access=${input.grant.access} 401 unauthorized\n${input.message}`, {
+		status: 401,
+		headers: {
+			"content-type": "text/plain; charset=utf-8",
+			"cache-control": "no-store"
+		}
+	});
+}
+function policyDeniedResponse(error) {
+	return Response.json({ error: error.message }, {
+		status: 403,
+		headers: { "cache-control": "no-store" }
+	});
+}
+function shouldLogSandboxEgressInfo() {
+	return (process.env.SENTRY_ENVIRONMENT ?? process.env.VERCEL_ENV ?? process.env.NODE_ENV ?? "").trim().toLowerCase() !== "production";
+}
+function egressAttributes(input) {
+	return {
+		...input.egressId ? { "app.sandbox.egress_id": input.egressId } : void 0,
+		...input.provider ? { "app.provider.name": input.provider } : void 0,
+		...input.grantName ? { "app.grant.name": input.grantName } : void 0,
+		...input.grantAccess ? { "app.grant.access": input.grantAccess } : void 0,
+		...input.grantReason ? { "app.grant.reason": input.grantReason } : void 0,
+		...input.host ? { "server.address": input.host } : void 0,
+		...input.method ? { "http.request.method": input.method } : void 0,
+		...input.path ? { "url.path": input.path } : void 0,
+		...input.status ? { "http.response.status_code": input.status } : void 0
+	};
+}
+function redactedProxyPath(pathname) {
+	if (pathname.startsWith(`/api/internal/sandbox-egress/`)) return `${SANDBOX_EGRESS_PROXY_PATH}/<token>`;
+	return pathname;
+}
+function routingAttributes(request, upstreamUrl) {
+	const attributes = { "app.sandbox.egress.proxy_path": redactedProxyPath(new URL(request.url).pathname) };
+	if (upstreamUrl) {
+		attributes["app.sandbox.egress.upstream_path"] = upstreamUrl.pathname;
+		const gitService = upstreamUrl.searchParams.get("service");
+		if (upstreamUrl.hostname.toLowerCase() === "github.com" && (gitService === "git-upload-pack" || gitService === "git-receive-pack")) attributes["app.sandbox.egress.git_service"] = gitService;
+	}
+	return attributes;
+}
+function displayedUpstreamPath(upstreamUrl) {
+	const gitService = upstreamUrl.searchParams.get("service");
+	if (upstreamUrl.hostname.toLowerCase() === "github.com" && (gitService === "git-upload-pack" || gitService === "git-receive-pack")) return `${upstreamUrl.pathname}?service=${gitService}`;
+	return upstreamUrl.pathname;
+}
+function permissionDeniedMessage(provider, grant) {
+	return `${provider} returned HTTP 403 after the runtime injected the ${grant.name} grant. The request was forwarded; this is not a local runtime block.`;
+}
+function isEgressAuthRequired(error) {
+	return error instanceof EgressAuthRequired || error instanceof Error && error.name === "EgressAuthRequired";
+}
+function isEgressPolicyDenied(error) {
+	return error instanceof EgressPolicyDenied || error instanceof Error && error.name === "EgressPolicyDenied";
+}
+/**
+* Record one forwarded provider request. Write-grant requests are audit
+* events, so they reach Sentry in production. Other requests log only outside
+* production.
+*/
+function logSandboxEgressUpstreamRequest(input) {
+	const isWrite = input.grantAccess === "write";
+	if (!isWrite && !shouldLogSandboxEgressInfo()) return;
+	(isWrite ? logAudit : logInfo)("sandbox.egress.upstream.requested", {
+		...egressAttributes({
+			egressId: input.egressId,
+			grantAccess: input.grantAccess,
+			grantName: input.grantName,
+			grantReason: input.grantReason,
+			host: input.upstreamUrl.hostname,
+			method: input.request.method,
+			path: input.upstreamUrl.pathname,
+			provider: input.provider,
+			status: input.upstream.status
+		}),
+		...routingAttributes(input.request, input.upstreamUrl),
+		"app.sandbox.egress.upstream_ok": input.upstream.ok
+	});
+}
+async function requestBodyBytes(request) {
+	if (request.method === "GET" || request.method === "HEAD" || request.method === "OPTIONS" || request.body === null) return;
+	return await request.arrayBuffer();
+}
+/**
+* Explain a request body that the runtime delivered already used.
+*
+* The forwarded headers cannot show whether the body was empty, so the proxy
+* does not send a credentialed write upstream without its payload.
+*/
+function unreadableBodyResponse(eventId) {
+	return Response.json({
+		source: "junior-egress",
+		error: "The sandbox egress proxy could not read the request body, so it did not send the request upstream.",
+		...eventId ? { sentryEventId: eventId } : void 0
+	}, {
+		status: 500,
+		headers: { "cache-control": "no-store" }
+	});
+}
+/** Identify GitHub writes whose body determines whether a grant is safe. */
+function githubBodyInspection(input) {
+	if (input.provider !== "github" || input.requestMethod.toUpperCase() !== "POST" || input.upstreamUrl.hostname.toLowerCase() !== "api.github.com") return;
+	const pathname = input.upstreamUrl.pathname.toLowerCase();
+	if (pathname.endsWith("/graphql")) return "graphql";
+	return /^\/repos\/[^/]+\/[^/]+\/pulls\/[^/]+\/reviews(?:\/[^/]+\/events)?$/.test(pathname) ? "pull-request-review" : void 0;
+}
+function grantSelectionBodyTooLargeMessage(inspection) {
+	return inspection === "graphql" ? "GitHub GraphQL request body is too large to inspect before issuing credentials." : "GitHub pull request review request body is too large to inspect before issuing credentials.";
+}
+function grantSelectionBodyText(input) {
+	if (input.body === void 0) return;
+	if (input.body.byteLength > GRANT_SELECTION_BODY_TEXT_LIMIT_BYTES) {
+		const inspection = githubBodyInspection({
+			provider: input.provider,
+			requestMethod: input.request.method,
+			upstreamUrl: input.upstreamUrl
+		});
+		if (inspection) throw new EgressPolicyDenied(grantSelectionBodyTooLargeMessage(inspection));
+		return;
+	}
+	return new TextDecoder().decode(input.body);
+}
+function responseContentLength(upstream) {
+	const raw = upstream.headers.get("content-length");
+	if (!raw) return;
+	const parsed = Number(raw);
+	return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : void 0;
+}
+async function responseTextWithinLimit(upstream, maxBytes) {
+	const limit = Math.min(Math.max(0, Math.floor(maxBytes)), RESPONSE_BODY_TEXT_LIMIT_BYTES);
+	if (limit <= 0) return;
+	const contentLength = responseContentLength(upstream);
+	if (contentLength !== void 0 && contentLength > limit) return;
+	let clone;
+	try {
+		clone = upstream.clone();
+	} catch {
+		return;
+	}
+	const body = clone.body;
+	if (!body) return "";
+	const reader = body.getReader();
+	const chunks = [];
+	let bytes = 0;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			if (!value) continue;
+			bytes += value.byteLength;
+			if (bytes > limit) {
+				await reader.cancel().catch(() => void 0);
+				return;
+			}
+			chunks.push(value);
+		}
+	} catch {
+		await reader.cancel().catch(() => void 0);
+		return;
+	} finally {
+		reader.releaseLock();
+	}
+	const combined = new Uint8Array(bytes);
+	let offset = 0;
+	for (const chunk of chunks) {
+		combined.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return new TextDecoder().decode(combined);
+}
+/**
+* Build the upstream request headers.
+*
+* Sandbox/proxy-only headers are stripped so they cannot leak to providers, and
+* trace headers are preserved only for hosts opted into trace propagation.
+* Credential lease transforms win last because they are the host-issued
+* authority for provider auth headers.
+*/
+function requestHeaders(request, lease, upstreamHost, tracePropagation) {
+	const headers = new Headers();
+	const mayPropagateTrace = shouldPropagateSandboxEgressTrace(upstreamHost, tracePropagation);
+	request.headers.forEach((value, key) => {
+		const normalized = key.toLowerCase();
+		if (HOP_BY_HOP_HEADERS.has(normalized) || PROXY_ONLY_HEADERS.has(normalized)) return;
+		if (TRACE_PROPAGATION_HEADERS.has(normalized) && !mayPropagateTrace) return;
+		headers.append(key, value);
+	});
+	for (const transform of lease.headerTransforms) {
+		if (!matchesSandboxEgressDomain(upstreamHost, transform.domain)) continue;
+		for (const [key, value] of Object.entries(transform.headers)) {
+			if (TRACE_PROPAGATION_HEADERS.has(key.toLowerCase()) && !mayPropagateTrace) continue;
+			headers.set(key, value);
+		}
+	}
+	return headers;
+}
+function responseHeaders(upstream) {
+	const headers = new Headers();
+	upstream.headers.forEach((value, key) => {
+		const normalized = key.toLowerCase();
+		if (!HOP_BY_HOP_HEADERS.has(normalized) && !DECODED_RESPONSE_HEADERS.has(normalized)) headers.append(key, value);
+	});
+	return headers;
+}
+function leaseLogAttributes(input) {
+	return {
+		...egressAttributes({
+			egressId: input.egressId,
+			grantAccess: input.lease.grant.access,
+			grantName: input.lease.grant.name,
+			grantReason: input.lease.grant.reason,
+			host: input.upstreamUrl.hostname,
+			method: input.request.method,
+			path: input.upstreamUrl.pathname,
+			provider: input.provider,
+			status: input.status
+		}),
+		...routingAttributes(input.request, input.upstreamUrl)
+	};
+}
+async function recordSandboxAuthRequired(input) {
+	await setSandboxEgressAuthRequiredSignal(input.credentialContext, {
+		provider: input.provider,
+		grant: input.grant,
+		kind: input.kind ?? "auth_required",
+		...input.authorization ? { authorization: input.authorization } : void 0,
+		message: input.message
+	});
+}
+async function recordSandboxPermissionDenied(input) {
+	await setSandboxEgressPermissionDeniedSignal(input.credentialContext, {
+		provider: input.provider,
+		grant: input.lease.grant,
+		...input.lease.account ? { account: input.lease.account } : void 0,
+		message: input.message,
+		source: "upstream",
+		status: input.upstream.status,
+		upstreamHost: input.upstreamUrl.hostname,
+		upstreamPath: displayedUpstreamPath(input.upstreamUrl)
+	});
+}
+/**
+* Forward one verified sandbox egress request with host-managed credentials.
+*
+* The caller must already have authenticated the sandbox VM, checked the signed
+* credential context, and resolved the provider for `upstreamUrl`. This function
+* then selects the read/write grant, issues or reuses a short-lived credential
+* lease, applies its header transforms, and maps provider auth failures into
+* command-level signals instead of throwing raw upstream details at the agent.
+*/
+async function executeCredentialedEgressRequest(input) {
+	const { activeEgressId, credentialContext, deps, operation, provider, request, upstreamUrl } = input;
+	let body;
+	try {
+		body = await requestBodyBytes(request);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return unreadableBodyResponse(logException(error, "sandbox.egress.request_body.unreadable", {
+			...egressAttributes({
+				egressId: activeEgressId,
+				host: upstreamUrl.hostname,
+				method: request.method,
+				path: upstreamUrl.pathname,
+				provider,
+				status: 500
+			}),
+			...routingAttributes(request, upstreamUrl)
+		}));
+	}
+	const bodyForGrantSelection = githubBodyInspection({
+		provider,
+		requestMethod: request.method,
+		upstreamUrl
+	}) ? body : void 0;
+	let grantSelection;
+	try {
+		grantSelection = await selectSandboxEgressGrant({
+			bodyText: grantSelectionBodyText({
+				body: bodyForGrantSelection,
+				provider,
+				request,
+				upstreamUrl
+			}),
+			...operation ? { operation } : void 0,
+			provider,
+			method: request.method,
+			upstreamUrl
+		});
+	} catch (error) {
+		if (isEgressPolicyDenied(error)) {
+			logWarn("sandbox.egress.policy.denied", {
+				...egressAttributes({
+					egressId: activeEgressId,
+					host: upstreamUrl.hostname,
+					method: request.method,
+					path: upstreamUrl.pathname,
+					provider,
+					status: 403
+				}),
+				...routingAttributes(request, upstreamUrl),
+				"app.sandbox.egress.policy.reason": error.message
+			});
+			return policyDeniedResponse(error);
+		}
+		throw error;
+	}
+	const issueCredentialLease = deps.issueCredentialLease ?? sandboxEgressCredentialLease;
+	const clearCredentialLease = deps.clearCredentialLease ?? clearSandboxEgressCredentialLease;
+	const recordAuthRequired = deps.recordAuthRequired ?? recordSandboxAuthRequired;
+	const recordPermissionDenied = deps.recordPermissionDenied ?? recordSandboxPermissionDenied;
+	async function resolveLease() {
+		try {
+			return await issueCredentialLease(provider, grantSelection, credentialContext);
+		} catch (error) {
+			if (!(error instanceof SandboxEgressCredentialError)) throw error;
+			await recordAuthRequired({
+				credentialContext,
+				provider: error.provider,
+				grant: error.grant,
+				kind: error.kind,
+				authorization: error.authorization,
+				message: error.message
+			});
+			const isAuthRequired = error.kind === "auth_required";
+			logWarn(isAuthRequired ? "sandbox.egress.credential.needed" : "sandbox.egress.credential.unavailable", {
+				...egressAttributes({
+					egressId: activeEgressId,
+					grantAccess: error.grant.access,
+					grantName: error.grant.name,
+					grantReason: error.grant.reason,
+					host: upstreamUrl.hostname,
+					method: request.method,
+					path: upstreamUrl.pathname,
+					provider: error.provider,
+					status: 401
+				}),
+				...routingAttributes(request, upstreamUrl)
+			});
+			return authRequiredResponse({
+				provider: error.provider,
+				grant: error.grant,
+				message: error.message
+			});
+		}
+	}
+	let leaseOrResponse = await resolveLease();
+	if (leaseOrResponse instanceof Response) return leaseOrResponse;
+	let lease = leaseOrResponse;
+	const attributes = (activeLease, status) => leaseLogAttributes({
+		egressId: activeEgressId,
+		lease: activeLease,
+		provider,
+		request,
+		status,
+		upstreamUrl
+	});
+	if (!hasSandboxEgressLeaseTransformForHost(lease, upstreamUrl.hostname)) {
+		logWarn("sandbox.egress.transform.missing", {
+			...attributes(lease, 403),
+			"app.sandbox.egress.transform_domains": lease.headerTransforms.map((transform) => transform.domain)
+		});
+		return Response.json({ error: "Credential lease does not cover forwarded host" }, { status: 403 });
+	}
+	const fetchImpl = deps.fetch ?? fetch;
+	let retriedAfter403 = false;
+	while (true) {
+		const headers = requestHeaders(request, lease, upstreamUrl.hostname, deps.tracePropagation ?? {});
+		const intercepted = await deps.interceptHttp?.({
+			provider,
+			request: new Request(upstreamUrl, {
+				method: request.method,
+				headers,
+				...body !== void 0 ? { body } : void 0
+			}),
+			upstreamUrl
+		});
+		if (intercepted) return intercepted;
+		const requestBody = body instanceof ArrayBuffer ? body.slice(0) : body;
+		const upstream = await fetchImpl(upstreamUrl, {
+			method: request.method,
+			headers,
+			...requestBody !== void 0 ? { body: requestBody } : void 0,
+			redirect: "manual"
+		});
+		let pluginPermissionDenied;
+		try {
+			pluginPermissionDenied = (await onPluginEgressResponse({
+				provider,
+				grant: lease.grant,
+				method: request.method,
+				...operation ? { operation } : void 0,
+				upstreamUrl,
+				response: {
+					headers: new Headers(upstream.headers),
+					readText: async (maxBytes) => await responseTextWithinLimit(upstream, maxBytes),
+					status: upstream.status
+				}
+			})).permissionDenied;
+		} catch (error) {
+			if (!isEgressAuthRequired(error)) throw error;
+			await clearCredentialLease(provider, lease.grant, credentialContext);
+			await recordAuthRequired({
+				credentialContext,
+				provider,
+				grant: lease.grant,
+				authorization: error.authorization ?? lease.authorization,
+				message: error.message
+			});
+			logWarn("sandbox.egress.upstream_auth_requirement.classified", { ...attributes(lease, upstream.status) });
+			await upstream.body?.cancel().catch(() => void 0);
+			return authRequiredResponse({
+				provider,
+				grant: lease.grant,
+				message: error.message
+			});
+		}
+		logSandboxEgressUpstreamRequest({
+			egressId: activeEgressId,
+			grantAccess: lease.grant.access,
+			grantName: lease.grant.name,
+			grantReason: lease.grant.reason,
+			provider,
+			request,
+			upstream,
+			upstreamUrl
+		});
+		if (upstream.status >= 400) logWarn("sandbox.egress.upstream_response.failed", {
+			...attributes(lease, upstream.status),
+			"error.type": `http_${upstream.status}`
+		});
+		if (upstream.status === UPSTREAM_TOKEN_REJECTION_STATUS) {
+			logWarn("sandbox.egress.upstream_auth.rejected", {
+				...attributes(lease, upstream.status),
+				"app.sandbox.egress.www_authenticate": upstream.headers.get("www-authenticate") ?? void 0
+			});
+			await clearCredentialLease(provider, lease.grant, credentialContext);
+			await recordAuthRequired({
+				credentialContext,
+				provider,
+				grant: lease.grant,
+				authorization: lease.authorization,
+				message: `Provider rejected the injected ${provider} credential.`
+			});
+			await upstream.body?.cancel().catch(() => void 0);
+			return authRequiredResponse({
+				provider,
+				grant: lease.grant,
+				message: `Provider rejected the injected ${provider} credential.\n`
+			});
+		}
+		if (upstream.status === UPSTREAM_PERMISSION_REJECTION_STATUS && !retriedAfter403) {
+			logWarn("sandbox.egress.upstream_auth.rejected", { ...attributes(lease, upstream.status) });
+			await clearCredentialLease(provider, lease.grant, credentialContext);
+			await upstream.body?.cancel().catch(() => void 0);
+			logWarn("sandbox.egress.upstream_auth.retrying", { ...attributes(lease, upstream.status) });
+			leaseOrResponse = await resolveLease();
+			if (leaseOrResponse instanceof Response) return leaseOrResponse;
+			lease = leaseOrResponse;
+			retriedAfter403 = true;
+			continue;
+		}
+		if (upstream.status === UPSTREAM_PERMISSION_REJECTION_STATUS) {
+			logWarn("sandbox.egress.upstream_auth.rejected", { ...attributes(lease, upstream.status) });
+			await clearCredentialLease(provider, lease.grant, credentialContext);
+			await recordPermissionDenied({
+				credentialContext,
+				provider,
+				lease,
+				message: pluginPermissionDenied?.message ?? permissionDeniedMessage(provider, lease.grant),
+				upstream,
+				upstreamUrl
+			});
+			if (pluginPermissionDenied) logWarn("sandbox.egress.upstream_permission.classified", { ...attributes(lease, upstream.status) });
+			return new Response(upstream.body, {
+				status: upstream.status,
+				statusText: upstream.statusText,
+				headers: responseHeaders(upstream)
+			});
+		}
+		if (pluginPermissionDenied) {
+			await recordPermissionDenied({
+				credentialContext,
+				provider,
+				lease,
+				message: pluginPermissionDenied.message,
+				upstream,
+				upstreamUrl
+			});
+			logWarn("sandbox.egress.upstream_permission.classified", { ...attributes(lease, upstream.status) });
+		}
+		return new Response(upstream.body, {
+			status: upstream.status,
+			statusText: upstream.statusText,
+			headers: responseHeaders(upstream)
+		});
+	}
+}
+export { sandboxEgressSignalsResponseSchema as $, defaultTimezone as $n, getHeaderString as $t, setWorkspaceSnapshotBuild as A, createPluginLogger as An, RESOURCE_SUBSCRIPTION_MAX_TTL_MS as At, wrapSandboxSetupError as B, createPluginConversationEvents as Bn, getWatch as Bt, listWorkspaces as C, SANDBOX_WORKSPACE_ROOT as Cn, tryWorkspaceRepoCheckoutPath as Ct, invalidateReadySnapshot as D, createPluginState as Dn, isSlackMessageTurn as Dt, WorkspaceValidationError as E, sandboxSkillPathResolution as En, getSlackToolContext as Et, ensureDockerDaemon as F, conversationHasParticipantUser as Fn, collectEventMatchKeys as Ft, isVercelSandboxEgressRequest as G, matchSlackAttachments as Gn, bindSlackDirectCredentialSubject as Gt, getWorkspaceSnapshotNotReadyError as H, readConversationEventPage as Hn, takeDueTimerWatches as Ht, getSandboxProvider as I, conversationIsMemberRoot as In, createTimerWatch as It, consumeSandboxEgressAuthRequiredSignal as J, resolveRootVisibility as Jn, verifySlackDirectCredentialSubject as Jt, proxyVercelSandboxEgressRequest as K, readAttachmentVisionSummary as Kn, verifyEventAutomationCredentialSubject as Kt, isAbortError as L, conversationNotArchivedForEmail as Ln, createWatch as Lt, create as M, conversationArchiveTimes as Mn, STOP_WATCHING_TOOL_NAME as Mt, hash as N, conversationArchivedForEmail as Nn, cancelSubscriptions as Nt, loadSnapshotsForProfile as O, createPluginEmbedder as On, slackMessageTurnDisabledReason as Ot, isStale as P, conversationArchivedForUser as Pn, cancelWatch as Pt, parseSandboxEgressAuthRequiredSignal as Q, listConversationAnnotationsById as Qn, getFilePermalink as Qt, isAlreadyExistsError as R, conversationNotArchivedForUser as Rn, deliverWatch as Rt, getWorkspaceByName as S, SANDBOX_SKILLS_ROOT as Sn, slackExternalRefIdSchema as St, updateWorkspace as T, sandboxSkillFile as Tn, resolveChannelCapabilities as Tt, isWorkspaceSnapshotNotReadyError as U, buildSentryConversationUrl as Un, bindEventAutomationCredentialSubject as Ut, WorkspaceSnapshotNotReadyError as V, readLatestConversationBrief as Vn, listWatches as Vt, workspaceSnapshotNotReadyUserMessage as W, getSlackFileId as Wn, bindScheduledAutomationCredentialSubject as Wt, createSandboxEgressCredentialToken as X, createPluginAnnotations as Xn, SlackActionError as Xt, consumeSandboxEgressPermissionDeniedSignal as Y, saveObjectAnnotations as Yn, verifyTimerWatchCredentialSubject as Yt, parseSandboxEgressCredentialToken as Z, listConversationAnnotations as Zn, downloadPrivateSlackFile as Zt, registration_exports as _, buildNonInteractiveShellScript as _n, openSlackDirectMessage as _t, agent_hooks_exports as a, withSlackRetries as an, agentsInstructionsUpdatedEvent as ar, formatProviderLabel as at, deleteWorkspace as b, SANDBOX_DATA_ROOT as bn, uploadFilesToConversation as bt, getPluginRoutes as c, runWithWorkspaceTeamId as cn, conversationNoteEvent as cr, startOAuthFlow as ct, getPluginTools as d, getDashboardObjectIconLink as dn, normalizeSlackReplyMarkdown as dt, getSlackClient as en, resolveUserTimezone as er, buildSandboxEgressNetworkPolicy as et, getPluginUserPromptContributions as f, getDashboardTaskLink as fn, normalizeSlackStatusText as ft, coreTaskRegistrations as g, buildCommandScript as gn, getSlackMessagePermalink as gt, validatePlugins as h, PluginToolDeniedError as hn, addReactionToMessage as ht, resolvePluginOAuthAccount as i, runWithSlackInstallationToken as in, JUNIOR_NATIVE_EVENT_NAMESPACE as ir, deliverOAuthAuthorization as it, SANDBOX_RUNTIME as j, readConversationAccessFromSql as jn, RESOURCE_WATCH_TOOL_SOURCE as jt, setWorkspaceSnapshot as k, createPluginModel as kn, RESOURCE_SUBSCRIPTION_DEFAULT_TTL_MS as kt, getPluginSlackConversationLink as l, JUNIOR_THREAD_STATE_TTL_MS as ln, escapeSlackMrkdwnText as lt, setPlugins as m, ToolInputError as mn, truncateStatusText as mt, createUserTokenStore as n, isDmChannel as nn, createPluginCache as nr, resolveSandboxEgressProviderForHost as nt, createPluginHookRunner as o, sleep$1 as on, authenticationLinkedEvent as or, parseOAuthStatePayload as ot, getPlugins as p, setDashboardConversationLinkOptions as pn, slackMention as pt, clearSandboxEgressSignals as q, recordSlackAttachment as qn, verifyScheduledAutomationCredentialSubject as qt, getOAuthAccountProviders as r, normalizeSlackConversationId as rn, createCache as rr, normalizeSandboxEgressTracePropagationDomains as rt, getPluginApiRoutes as s, getWorkspaceTeamId as sn, authenticationUnlinkedEvent as sr, resolveBaseUrl as st, executeCredentialedEgressRequest as t, isConversationScopedChannel as tn, lookupSlackUser as tr, resolveSandboxCommandEnvironment as tt, getPluginSystemPromptContributions as u, getDashboardConversationLink as un, formatSlackLink as ut, setBriefsConfig as v, runNonInteractiveCommand as vn, postSlackMessage as vt, listWorkspacesByRepository as w, sandboxSkillDir as wn, workspaceRepoCheckoutPath as wt, getWorkspace as x, SANDBOX_REPOS_ROOT as xn, slackEntitySchema as xt, createWorkspace as y, SANDBOX_COMMAND_PATH as yn, removeReactionFromMessage as yt, throwSandboxOperationError as z, viewerConversationMembership as zn, findMatchingWatches as zt };