@sentry/junior 0.264.0 → 0.266.0

package/dist/app.js

@@ -1,47 +1,46 @@
-import { C as automationVersionOf, Cn as resolveSandboxEgressProviderForHost, Dn as clearSandboxEgressSignals, En as SANDBOX_EGRESS_PROXY_PATH, Hn as slackMention, In as resolveBaseUrl, Ln as startOAuthFlow, On as consumeSandboxEgressAuthRequiredSignal, Pn as formatProviderLabel, Q as projectConversationMessages, Tn as shouldPropagateSandboxEgressTrace, Xn as slackEntitySchema, Y as appendConversationMessages, Zn as slackExternalRefIdSchema, _n as isExperimentalFeatureEnabled, ar as setConfigDefaults, b as admitEventAutomationRun, bn as createUserTokenStore, c as withScheduledAutomationLock, fn as getThreadStopDecision, gn as getExperimentalFeatures, i as readScheduledAutomation, ir as getConfigDefaults, jn as parseSandboxEgressCredentialToken, kn as consumeSandboxEgressPermissionDeniedSignal, l as blockEventAutomation, ln as SubscribedReplyReason, n as listScheduledAutomationsForTeam, o as saveScheduledAutomationInLock, p as findMatchingEventAutomations, s as scheduledRunId, tt as settleConversationTitleWork, u as collectEventAutomationMatchKeys, vn as setExperimentalFeatures, wn as normalizeSandboxEgressTracePropagationDomains, x as eventAutomationRunLimitReason, yn as executeCredentialedEgressRequest } from "./tasks-OgXmReUv.js";
-import { C as withContext, M as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, R as normalizeIdentityEmail, T as withSpan, b as setSpanStatus, f as logException, k as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE, m as logWarn, p as logInfo, r as createRequestContext, v as setSentryUser, w as withLogContext, y as setSpanAttributes } from "./logging-DNQqsQ57.js";
-import { n as captureMessage, r as continueTrace } from "./sentry-BBUlHih9.js";
-import { t as JUNIOR_VERSION } from "./version-C9f5hdHD.js";
-import { _ as snapshotRuntimeConfig, d as restoreRuntimeConfig, f as setBotModelConfig, g as setSlackReactionConfig, h as setRuntimeLimits, i as getChatConfig, m as setProfiles, n as botConfig, o as getSlackBotToken, p as setCrossActorMidRunMode, u as resetRuntimeConfig } from "./config-BxPrFVJP.js";
+import { C as automationVersionOf, Cn as getConfigDefaults, Q as projectConversationMessages, Y as appendConversationMessages, _n as isExperimentalFeatureEnabled, b as admitEventAutomationRun, c as withScheduledAutomationLock, fn as getThreadStopDecision, gn as getExperimentalFeatures, i as readScheduledAutomation, l as blockEventAutomation, ln as SubscribedReplyReason, n as listScheduledAutomationsForTeam, o as saveScheduledAutomationInLock, p as findMatchingEventAutomations, s as scheduledRunId, tt as settleConversationTitleWork, u as collectEventAutomationMatchKeys, vn as setExperimentalFeatures, wn as setConfigDefaults, x as eventAutomationRunLimitReason } from "./tasks-DDT-J3Rf.js";
+import { _ as snapshotRuntimeConfig, d as restoreRuntimeConfig, f as setBotModelConfig, g as setSlackReactionConfig, h as setRuntimeLimits, i as getChatConfig, m as setProfiles, n as botConfig, o as getSlackBotToken, p as setCrossActorMidRunMode, u as resetRuntimeConfig } from "./config-C0UwYqDK.js";
+import { C as withContext, M as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, R as normalizeIdentityEmail, T as withSpan, f as logException, k as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE, m as logWarn, p as logInfo, r as createRequestContext, w as withLogContext, y as setSpanAttributes } from "./logging-Ce0mXZ8J.js";
+import { n as captureMessage } from "./sentry-MDkYAVPV.js";
+import { t as JUNIOR_VERSION } from "./version-oaLfxxnf.js";
 import { _ as slackMessageTsSchema, d as parseSlackTeamId, f as parseSlackUserId, h as slackUserIdSchema, m as slackTeamIdSchema, o as parseActorUserId, p as slackChannelIdSchema } from "./actor-tlxzqaRe.js";
-import { N as recordGoogleSignIn, _ as withConversationMutationLock, c as getConversationEventStore, d as getDb, f as getSqlExecutor, m as withConversationEventLock, r as readActorIdentity, u as getConversationStore } from "./viewer-BuPwzOC9.js";
+import { P as recordGoogleSignIn, d as getConversationStore, f as getDb, h as withConversationEventLock, l as getConversationEventStore, p as getSqlExecutor, r as readActorIdentity, v as withConversationMutationLock } from "./viewer-BpE6Z3qf.js";
 import { a as juniorAgentInvocations, d as juniorDestinations, i as juniorAgentBindings, s as juniorConversations } from "./agent-invocations-CxKldAeB.js";
-import { a as juniorAutomationRuns, f as juniorConversationBriefs, h as juniorConversationEvents, s as juniorAutomations } from "./executor-D3WIS4vl.js";
-import { m as credentialLogContext } from "./registry-CfdUEk4N.js";
-import { n as pluginCatalogRuntime } from "./catalog-runtime-R53MWcMi.js";
-import { B as stopConversationSession, C as requestAttachmentDeletion, J as ingestEvent, L as effectiveTaskOutcomes, M as logScheduledAutomationRunSkipped, N as scheduledAutomationRunAttributes, T as parseSlackThreadId, V as recordSubagentEnded, _ as unpublishedArtifactHeaders, g as readPublicArtifact, h as publicArtifactHeaders, n as executeAgentRun, q as processWorkspaceSnapshotJob, t as createAgentRunner, v as lookupSlackUserProfile, x as collectAttachmentGarbage } from "./agent-runner-CvRxb09K.js";
-import { $ as bindSlackDirectCredentialSubject, $t as createCache, Ct as createPluginState, Dt as readConversationAccessFromSql, Et as createPluginLogger, Q as bindScheduledAutomationCredentialSubject, Qt as createPluginCache, U as collectEventMatchKeys, Wt as resolveRootVisibility, X as takeDueTimerWatches, Z as bindEventAutomationCredentialSubject, _t as getDashboardConversationLink, a as getPluginRoutes, bt as setDashboardConversationLinkOptions, ct as getSlackClient, d as setPlugins, et as verifyEventAutomationCredentialSubject, f as validatePlugins, h as setBriefsConfig, ht as runWithWorkspaceTeamId, i as getPluginApiRoutes, mt as getWorkspaceTeamId, nt as verifySlackDirectCredentialSubject, q as findMatchingWatches, qt as listConversationAnnotations, tt as verifyScheduledAutomationCredentialSubject, u as getPlugins, ut as isDmChannel, yt as getDashboardTaskLink } from "./agent-hooks-D_PbluRX.js";
-import { r as getStateAdapter, s as withLock$1 } from "./adapter-BIbMSKlG.js";
+import { a as juniorAutomationRuns, f as juniorConversationBriefs, h as juniorConversationEvents, s as juniorAutomations } from "./executor-TnWbvL09.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-DAJjAbSx.js";
+import { C as requestAttachmentDeletion, H as recordSubagentEnded, J as processWorkspaceSnapshotJob, L as effectiveTaskOutcomes, M as logScheduledAutomationRunSkipped, N as scheduledAutomationRunAttributes, T as parseSlackThreadId, V as stopConversationSession, Y as ingestEvent, _ as unpublishedArtifactHeaders, g as readPublicArtifact, h as publicArtifactHeaders, n as executeAgentRun, t as createAgentRunner, v as lookupSlackUserProfile, x as collectAttachmentGarbage } from "./agent-runner-BtYK7bht.js";
+import { An as createPluginLogger, Dn as createPluginState, Ft as collectEventMatchKeys, G as isVercelSandboxEgressRequest, Gt as bindSlackDirectCredentialSubject, Ht as takeDueTimerWatches, J as consumeSandboxEgressAuthRequiredSignal, Jn as resolveRootVisibility, Jt as verifySlackDirectCredentialSubject, K as proxyVercelSandboxEgressRequest, Kt as verifyEventAutomationCredentialSubject, St as slackExternalRefIdSchema, Ut as bindEventAutomationCredentialSubject, Wt as bindScheduledAutomationCredentialSubject, Y as consumeSandboxEgressPermissionDeniedSignal, Z as parseSandboxEgressCredentialToken, Zn as listConversationAnnotations, at as formatProviderLabel, c as getPluginRoutes, cn as runWithWorkspaceTeamId, ct as startOAuthFlow, en as getSlackClient, fn as getDashboardTaskLink, h as validatePlugins, jn as readConversationAccessFromSql, m as setPlugins, n as createUserTokenStore, nn as isDmChannel, nr as createPluginCache, p as getPlugins, pn as setDashboardConversationLinkOptions, pt as slackMention, q as clearSandboxEgressSignals, qt as verifyScheduledAutomationCredentialSubject, rr as createCache, rt as normalizeSandboxEgressTracePropagationDomains, s as getPluginApiRoutes, sn as getWorkspaceTeamId, st as resolveBaseUrl, un as getDashboardConversationLink, v as setBriefsConfig, xt as slackEntitySchema, zt as findMatchingWatches } from "./credentialed-enF5Bf3y.js";
+import { r as getStateAdapter, s as withLock$1 } from "./adapter-eRFA_naf.js";
 import { n as getNextRunAtMs } from "./cadence-R7Em4RjE.js";
-import { M as annotationCard } from "./conversation-B0baEwoA.js";
-import { b as listPendingAgentInvocationMailboxAppends, x as listPendingAgentInvocationResults } from "./store-BvolNnx4.js";
-import { M as renderTaskInput, S as eventGuidance, d as getEventCatalog, f as SLACK_EVENT_NAMESPACE, g as slackChannelMessageRunsAutomation, h as slackChannelMessageReplyThreadTs, m as slackChannelMessageEvent } from "./session-stop-B9RRGC-P.js";
-import { f as setSandboxResourceConfig, u as getSandboxResourceConfig } from "./resolve-BXShI336.js";
-import { a as getVercelConversationWorkQueue, g as isConversationQueueMessageRejectedError, h as conversationQueueMessageSchema, i as verifyWorkspaceSnapshotJobMessage, o as resolveConversationWorkQueueTopic, s as verifyConversationQueueMessage, t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-BYHonCAH.js";
-import { A as hasRunnableConversationWork$1, M as isInvalidConversationRecordError, O as CONVERSATION_WORK_STALE_ENQUEUE_MS, S as removeActiveConversation, _ as hasRunnableConversationWork, c as clearExpiredConversationLease, g as getConversationWorkState, h as getConversation, m as ensureConversationWake, r as appendAndEnqueueInboundMessage, v as listActiveConversationIds } from "./store-C_mHwAnR.js";
-import { D as scheduledRunSchema } from "./automation-CWX0qL8U.js";
-import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "./validation-XOFldwvE.js";
+import { M as annotationCard } from "./conversation-DF4rUcjb.js";
+import { b as listPendingAgentInvocationMailboxAppends, x as listPendingAgentInvocationResults } from "./store-DcKkzrdt.js";
+import { C as eventGuidance, N as renderTaskInput, d as getEventCatalog, f as SLACK_EVENT_NAMESPACE, g as slackChannelMessageRunsAutomation, h as slackChannelMessageReplyThreadTs, m as slackChannelMessageEvent } from "./session-stop-tZOw9AJD.js";
+import { c as setSandboxResourceConfig, o as getSandboxResourceConfig } from "./resolve-BSHHkEGE.js";
+import { a as getVercelConversationWorkQueue, d as getQueueProvider, g as isConversationQueueMessageRejectedError, h as conversationQueueMessageSchema, i as verifyWorkspaceSnapshotJobMessage, o as resolveConversationWorkQueueTopic, s as verifyConversationQueueMessage, t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-DBpHmKnd.js";
+import { A as hasRunnableConversationWork$1, M as isInvalidConversationRecordError, O as CONVERSATION_WORK_STALE_ENQUEUE_MS, S as removeActiveConversation, _ as hasRunnableConversationWork, c as clearExpiredConversationLease, g as getConversationWorkState, h as getConversation, m as ensureConversationWake, r as appendAndEnqueueInboundMessage, v as listActiveConversationIds } from "./store-FALy-JQb.js";
+import { D as scheduledRunSchema } from "./automation-BKpY9LPa.js";
+import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "./validation-C2lllinq.js";
 import { a as pluginRuntimeRegistrationsFromPluginSet, n as pluginCatalogConfigFromEnv, r as pluginCatalogConfigFromPluginSet, t as defineJuniorPlugins } from "./plugins-DOm9Y6qI.js";
-import { A as THREAD_OPTOUT_ACK, C as buildSlackInboundMessage, D as normalizeIncomingSlackThreadId, E as stopSlackThread, F as renderSlackObjectCard, I as createVercelAttachmentStorage, M as parseContent, N as runWithSlackInstallation, O as withNormalizedThreadId, P as verifySlackSignature, R as enqueueAgentDispatch, S as recordSkippedConversationMessage, T as isSlackMessageStopped, a as recordWebConversationActivity, c as createProductionSlackWebhookServices, f as createSlackWebApiStatusSender, j as startProcessingReaction, k as stopConversationTurn, l as getProductionSlackAdapter, n as conversationTurnIdForMessage, o as webActorFromEmail, s as createProductionConversationWorkOptions, t as appendAndEnqueueWebMessage, v as readViewerAutomationSummary, w as clearSlackPendingReactions, z as GET$3 } from "./web-input-4t7TYLsY.js";
-import { C as existingConversationId, N as recordAutomationExecution, c as getDispatchConversationId, d as getDispatchRecord, h as listPendingDispatchMailboxAppends, i as buildDispatchId, m as isTerminalDispatchStatus, o as confirmDispatchMailboxAppend, p as getPluginDispatchProjection, s as createOrGetDispatch, t as processPluginTask, x as notifyAutomationBlocked, y as markDispatchFailed } from "./task-runner-CiQj5M_9.js";
-import { o as getAuthPausedConversationTurnId, t as enqueueAgentInvocationResult } from "./result-R35jcahx.js";
-import { r as enqueueAgentInvocation } from "./work-C_aF6JN5.js";
-import { s as coerceThreadConversationState } from "./thread-state-XFvpWXE9.js";
-import { o as unlinkProvider } from "./connections-BnTM1nRf.js";
-import { a as GET$4, i as publishAppHomeView, r as GET$5, t as receiveLocalOAuthCredential } from "./credential-sync-DeDkof_D.js";
-import { a as registerVercelPluginTaskDevConsumer, n as createVercelPluginTaskCallback, s as queueCallback } from "./task-queue-BcEyPhtX.js";
-import { t as processConversationWork } from "./worker-DR633sA-.js";
-import { t as bindMessageAgent } from "./message-CDTJISxL.js";
-import { t as bindSpawnAgent } from "./spawn-DkVYGfSY.js";
+import { A as THREAD_OPTOUT_ACK, C as buildSlackInboundMessage, D as normalizeIncomingSlackThreadId, E as stopSlackThread, F as renderSlackObjectCard, I as getAttachmentStorage, M as parseContent, N as runWithSlackInstallation, O as withNormalizedThreadId, P as verifySlackSignature, R as enqueueAgentDispatch, S as recordSkippedConversationMessage, T as isSlackMessageStopped, a as recordWebConversationActivity, c as createProductionSlackWebhookServices, f as createSlackWebApiStatusSender, j as startProcessingReaction, k as stopConversationTurn, l as getProductionSlackAdapter, n as conversationTurnIdForMessage, o as webActorFromEmail, s as createProductionConversationWorkOptions, t as appendAndEnqueueWebMessage, v as readViewerAutomationSummary, w as clearSlackPendingReactions, z as GET$3 } from "./web-input-B-bMjD1V.js";
+import { C as existingConversationId, N as recordAutomationExecution, c as getDispatchConversationId, d as getDispatchRecord, h as listPendingDispatchMailboxAppends, i as buildDispatchId, m as isTerminalDispatchStatus, o as confirmDispatchMailboxAppend, p as getPluginDispatchProjection, s as createOrGetDispatch, t as processPluginTask, x as notifyAutomationBlocked, y as markDispatchFailed } from "./task-runner-8N5LIkSg.js";
+import { o as getAuthPausedConversationTurnId, t as enqueueAgentInvocationResult } from "./result-CwOpzqdh.js";
+import { r as enqueueAgentInvocation } from "./work-VX1SHWha.js";
+import { s as coerceThreadConversationState } from "./thread-state-cprEaxgl.js";
+import { o as unlinkProvider } from "./connections-Bwu3VORi.js";
+import { a as GET$4, i as publishAppHomeView, r as GET$5, t as receiveLocalOAuthCredential } from "./credential-sync-VGAMUTGp.js";
+import { a as registerVercelPluginTaskDevConsumer, n as createVercelPluginTaskCallback, s as queueCallback } from "./task-queue-Bg4RS2Gy.js";
+import { t as processConversationWork } from "./worker-hook-y_Y.js";
+import { t as bindMessageAgent } from "./message-VZ3DFpGb.js";
+import { t as bindSpawnAgent } from "./spawn-6rokq7l_.js";
 import { createRequire } from "node:module";
 import { Hono } from "hono";
 import { z } from "zod";
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { and, asc, eq, inArray, isNotNull, isNull, lte, or, sql } from "drizzle-orm";
-import { EVENT_SUMMARY_MAX_LENGTH, EVENT_TEXT_MAX_LENGTH, dispatchOptionsSchema, eventSchema, isSlackDestination, userSchema } from "@sentry/junior-plugin-api";
+import { EVENT_SUMMARY_MAX_LENGTH, EVENT_TEXT_MAX_LENGTH, dispatchOptionsSchema, eventSchema, eventTriggerFiltersText, isSlackDestination, userSchema } from "@sentry/junior-plugin-api";
 import { pathToFileURL } from "node:url";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
-import { createRemoteJWKSet, decodeJwt, jwtVerify } from "jose";
+import { decodeJwt } from "jose";
 import { ChannelImpl, ThreadImpl } from "chat";
 import * as acp from "@agentclientprotocol/sdk";
 import { createAuthMiddleware } from "better-auth/api";
@@ -1414,7 +1413,7 @@ async function GET$1(request, options = {}) {
 	if (!verifyRetentionRequest(request)) return new Response("Unauthorized", { status: 401 });
 	try {
 		const result = await runRetentionPurge(getSqlExecutor(), {
-			attachmentStorage: options.attachmentStorage ?? createVercelAttachmentStorage(),
+			attachmentStorage: options.attachmentStorage ?? getAttachmentStorage(),
 			nowMs: Date.now()
 		});
 		return Response.json(result, { status: 200 });
@@ -1423,317 +1422,10 @@ async function GET$1(request, options = {}) {
 		return new Response("Retention purge failed", { status: 500 });
 	}
 }
-// src/chat/sandbox/egress/oidc.ts
-const OIDC_DISCOVERY_CACHE_TTL_MS = 36e5;
-const OIDC_DISCOVERY_CACHE_MAX_ENTRIES = 8;
-const jwksByIssuer = /* @__PURE__ */ new Map();
-function buildDiscoveryUrl(issuer) {
-	const url = new URL(issuer);
-	if (url.protocol !== "https:" || url.hostname !== "oidc.vercel.com") throw new Error("Unexpected Vercel OIDC issuer");
-	url.pathname = `${url.pathname.replace(/\/$/, "")}/.well-known/openid-configuration`;
-	url.search = "";
-	url.hash = "";
-	return url;
-}
-function buildJwksUrl(value) {
-	const url = new URL(value);
-	if (url.protocol !== "https:") throw new Error("Vercel OIDC discovery jwks_uri must use HTTPS");
-	return url;
-}
-async function getJwks(issuer) {
-	const now = Date.now();
-	const cached = jwksByIssuer.get(issuer);
-	if (cached && cached.expiresAtMs > now) return cached.jwks;
-	if (cached) jwksByIssuer.delete(issuer);
-	const response = await fetch(buildDiscoveryUrl(issuer), { redirect: "error" });
-	if (!response.ok) throw new Error("Unable to load Vercel OIDC discovery metadata");
-	const config = await response.json();
-	if (!config.jwks_uri) throw new Error("Vercel OIDC discovery metadata did not include jwks_uri");
-	const jwks = createRemoteJWKSet(buildJwksUrl(config.jwks_uri));
-	if (!jwksByIssuer.has(issuer) && jwksByIssuer.size >= OIDC_DISCOVERY_CACHE_MAX_ENTRIES) {
-		const oldestIssuer = jwksByIssuer.keys().next().value;
-		if (oldestIssuer) jwksByIssuer.delete(oldestIssuer);
-	}
-	jwksByIssuer.set(issuer, {
-		jwks,
-		expiresAtMs: now + OIDC_DISCOVERY_CACHE_TTL_MS
-	});
-	return jwks;
-}
-/**
-* Verify Vercel signed this Sandbox firewall proxy request for the active VM session.
-*
-* `currentDate` is the time for the `exp` and `nbf` checks. It defaults to
-* now. Evals pass the real time because they replace `Date`.
-*/
-async function verifyVercelSandboxOidcToken(token, options = {}) {
-	const unverified = decodeJwt(token);
-	if (typeof unverified.iss !== "string") throw new Error("Vercel OIDC token did not include an issuer");
-	const jwks = await getJwks(unverified.iss);
-	return (await jwtVerify(token, jwks, {
-		issuer: unverified.iss,
-		...options.currentDate ? { currentDate: options.currentDate } : void 0
-	})).payload;
-}
-// src/chat/sandbox/egress/proxy.ts
-const OIDC_TOKEN_HEADER = "vercel-sandbox-oidc-token";
-const FORWARDED_HOST_HEADER = "vercel-forwarded-host";
-const FORWARDED_SCHEME_HEADER = "vercel-forwarded-scheme";
-const FORWARDED_PORT_HEADER = "vercel-forwarded-port";
-const FORWARDED_PATH_HEADER = "vercel-forwarded-path";
-function jsonError(message, status) {
-	return Response.json({ error: message }, { status });
-}
-function egressAttributes(input) {
-	return {
-		...input.egressId ? { "app.sandbox.egress_id": input.egressId } : void 0,
-		...input.provider ? { "app.provider.name": input.provider } : void 0,
-		...input.host ? { "server.address": input.host } : void 0,
-		...input.method ? { "http.request.method": input.method } : void 0,
-		...input.path ? { "url.path": input.path } : void 0,
-		...input.status ? { "http.response.status_code": input.status } : void 0
-	};
-}
-function credentialTokenFromRequest(request) {
-	const pathname = new URL(request.url).pathname;
-	const prefix = `${SANDBOX_EGRESS_PROXY_PATH}/`;
-	if (!pathname.startsWith(prefix)) return;
-	const token = pathname.slice(prefix.length).split("/")[0];
-	if (!token) return;
-	try {
-		return decodeURIComponent(token);
-	} catch {
-		return;
-	}
-}
-function redactedProxyPath(pathname) {
-	if (pathname.startsWith(`/api/internal/sandbox-egress/`)) return `${SANDBOX_EGRESS_PROXY_PATH}/<token>`;
-	return pathname;
-}
-function routingAttributes(request, upstreamUrl) {
-	const attributes = { "app.sandbox.egress.proxy_path": redactedProxyPath(new URL(request.url).pathname) };
-	if (upstreamUrl) {
-		attributes["app.sandbox.egress.upstream_path"] = upstreamUrl.pathname;
-		const gitService = upstreamUrl.searchParams.get("service");
-		if (upstreamUrl.hostname.toLowerCase() === "github.com" && (gitService === "git-upload-pack" || gitService === "git-receive-pack")) attributes["app.sandbox.egress.git_service"] = gitService;
-	}
-	return attributes;
-}
-function normalizeHost(value) {
-	const trimmed = value.trim().toLowerCase();
-	if (!trimmed || trimmed.includes("/") || trimmed.includes("\\") || trimmed.includes(":")) return;
-	return trimmed.replace(/\.$/, "");
-}
-function normalizeScheme(value) {
-	return value.trim().toLowerCase() === "https" ? "https" : void 0;
-}
-function normalizePort(value) {
-	if (!value) return;
-	const trimmed = value.trim();
-	if (!/^\d{1,5}$/.test(trimmed)) return;
-	const port = Number.parseInt(trimmed, 10);
-	return port >= 1 && port <= 65535 ? trimmed : void 0;
-}
-function sandboxIdFromPayload(payload) {
-	return typeof payload.sandbox_id === "string" ? payload.sandbox_id : void 0;
-}
-function normalizedForwardedPath(path) {
-	if (!path.startsWith("/") || path.startsWith("//") || path.includes("#") || /[\r\n]/.test(path)) return {
-		ok: false,
-		error: "Invalid forwarded path"
-	};
-	try {
-		const url = new URL(path, "https://sandbox-forwarded.local");
-		return {
-			ok: true,
-			path: `${url.pathname}${url.search}`
-		};
-	} catch {
-		return {
-			ok: false,
-			error: "Invalid forwarded path"
-		};
-	}
-}
-function upstreamPath(request) {
-	const forwardedPath = request.headers.get(FORWARDED_PATH_HEADER);
-	if (!forwardedPath?.trim()) return {
-		ok: false,
-		error: "Missing forwarded path"
-	};
-	return normalizedForwardedPath(forwardedPath.trim());
-}
-/**
-* Rebuild the HTTPS upstream URL from Vercel forwarding headers.
-*
-* This is the proxy's wire-format boundary for forwarded requests: host, path,
-* scheme, and port must normalize before the request can reach provider egress.
-*/
-function buildUpstreamUrl(request) {
-	const forwardedHost = request.headers.get(FORWARDED_HOST_HEADER);
-	if (!forwardedHost?.trim()) return {
-		ok: false,
-		error: "Missing forwarded host"
-	};
-	const host = normalizeHost(forwardedHost);
-	if (!host) return {
-		ok: false,
-		error: "Invalid forwarded host"
-	};
-	const forwardedScheme = request.headers.get(FORWARDED_SCHEME_HEADER);
-	if (!forwardedScheme?.trim()) return {
-		ok: false,
-		error: "Missing forwarded scheme"
-	};
-	const scheme = normalizeScheme(forwardedScheme);
-	if (!scheme) return {
-		ok: false,
-		error: "Forwarded scheme must be https"
-	};
-	const forwardedPort = request.headers.get(FORWARDED_PORT_HEADER);
-	const port = normalizePort(forwardedPort);
-	if (forwardedPort && !port) return {
-		ok: false,
-		error: "Invalid forwarded port"
-	};
-	const path = upstreamPath(request);
-	if (!path.ok) return {
-		ok: false,
-		error: path.error
-	};
-	try {
-		return {
-			ok: true,
-			url: new URL(`${scheme}://${host}${port ? `:${port}` : ""}${path.path}`)
-		};
-	} catch {
-		return {
-			ok: false,
-			error: "Invalid forwarded URL"
-		};
-	}
-}
-/**
-* Name the Conversation and the accountable person from the verified token.
-* Each proxy request is a new HTTP request with no run log context, so the
-* proxy binds the same fields that the run binds.
-*/
-function sandboxEgressLogContext(context) {
-	return {
-		...context.conversationId ? { conversationId: context.conversationId } : void 0,
-		...credentialLogContext(context.credentials)
-	};
-}
-/** Continue inbound trace context only after sandbox egress verification succeeds. */
-function continueSandboxEgressTrace(request, upstreamHost, tracePropagation, credentialContext, callback) {
-	const sentryTrace = request.headers.get("sentry-trace") ?? void 0;
-	const baggage = request.headers.get("baggage") ?? void 0;
-	const logContext = sandboxEgressLogContext(credentialContext);
-	const run = () => withSpan("sandbox.egress", "http.server", logContext, async () => {
-		setSentryUser(logContext.userId ? { id: logContext.userId } : void 0);
-		return await callback();
-	}, {
-		"http.request.method": request.method,
-		"url.path": redactedProxyPath(new URL(request.url).pathname)
-	});
-	if (!shouldPropagateSandboxEgressTrace(upstreamHost, tracePropagation) || !sentryTrace && !baggage) return run();
-	return continueTrace({
-		sentryTrace,
-		baggage
-	}, run);
-}
-/**
-* Return whether a request carries the forwarding headers expected from Vercel.
-*
-* This is only a cheap classifier for routing into the proxy handler. Real
-* authentication happens in `proxySandboxEgressRequest` by verifying the OIDC
-* token and signed Junior credential context.
-*/
-function isSandboxEgressForwardedRequest(request) {
-	return Boolean(request.headers.get(OIDC_TOKEN_HEADER)?.trim() && request.headers.get(FORWARDED_HOST_HEADER)?.trim() && request.headers.get(FORWARDED_SCHEME_HEADER)?.trim());
-}
-/**
-* Handle one forwarded sandbox egress request.
-*
-* This is the public proxy boundary: it rejects unauthenticated VM requests,
-* rejects forwarded URLs outside plugin-owned provider domains, rejects signed
-* credential contexts that do not match the active VM id, and only then asks
-* `execute.ts` to issue credentials and contact the upstream provider.
-*/
-async function proxySandboxEgressRequest(request, deps = {}) {
-	const oidcToken = request.headers.get(OIDC_TOKEN_HEADER)?.trim();
-	if (!oidcToken) return jsonError("Missing Vercel Sandbox OIDC token", 401);
-	let oidcPayload;
-	try {
-		oidcPayload = await (deps.verifyOidc ?? verifyVercelSandboxOidcToken)(oidcToken);
-	} catch (error) {
-		logWarn("sandbox.egress.oidc_verification.failed", { "app.sandbox.oidc_error": error instanceof Error ? error.message : String(error) });
-		return jsonError("Invalid Vercel Sandbox OIDC token", 401);
-	}
-	const activeEgressId = sandboxIdFromPayload(oidcPayload);
-	if (!activeEgressId) {
-		logWarn("sandbox.egress.oidc_session.missing", {
-			"http.request.method": request.method,
-			"url.path": redactedProxyPath(new URL(request.url).pathname)
-		});
-		return jsonError("Vercel Sandbox OIDC token did not include sandbox_id", 401);
-	}
-	const upstreamResult = buildUpstreamUrl(request);
-	if (!upstreamResult.ok) {
-		logWarn("sandbox.egress.upstream_url.invalid", {
-			...egressAttributes({
-				egressId: activeEgressId,
-				method: request.method,
-				path: redactedProxyPath(new URL(request.url).pathname),
-				status: 400
-			}),
-			...routingAttributes(request)
-		});
-		return jsonError(upstreamResult.error, 400);
-	}
-	const upstreamUrl = upstreamResult.url;
-	const provider = resolveSandboxEgressProviderForHost(upstreamUrl.hostname);
-	if (!provider) {
-		logWarn("sandbox.egress.provider.unresolved", {
-			...egressAttributes({
-				egressId: activeEgressId,
-				host: upstreamUrl.hostname,
-				method: request.method,
-				path: upstreamUrl.pathname,
-				status: 403
-			}),
-			...routingAttributes(request, upstreamUrl)
-		});
-		return jsonError("No provider owns forwarded host", 403);
-	}
-	const credentialContext = parseSandboxEgressCredentialToken(credentialTokenFromRequest(request));
-	if (!credentialContext || credentialContext.egressId !== activeEgressId) {
-		logWarn("sandbox.egress.credential_context.unauthorized", {
-			...egressAttributes({
-				egressId: activeEgressId,
-				host: upstreamUrl.hostname,
-				method: request.method,
-				path: upstreamUrl.pathname,
-				provider,
-				status: 403
-			}),
-			...routingAttributes(request, upstreamUrl)
-		});
-		return jsonError("Sandbox egress credential context is not authorized", 403);
-	}
-	return await continueSandboxEgressTrace(request, upstreamUrl.hostname, deps.tracePropagation ?? {}, credentialContext, async () => await executeCredentialedEgressRequest({
-		activeEgressId,
-		credentialContext,
-		deps,
-		provider,
-		request,
-		upstreamUrl
-	}));
-}
 // src/handlers/sandbox-egress-proxy.ts
 /** Handles Vercel Sandbox firewall egress proxy requests. */
 async function ALL(request, options = {}) {
-	return await proxySandboxEgressRequest(request, {
+	return await proxyVercelSandboxEgressRequest(request, {
 		interceptHttp: options.interceptHttp,
 		tracePropagation: options.tracePropagation,
 		verifyOidc: options.verifyOidc
@@ -1741,7 +1433,7 @@ async function ALL(request, options = {}) {
 }
 /** Return whether a request should be routed through sandbox egress proxying. */
 function isSandboxEgressRequest(request) {
-	return isSandboxEgressForwardedRequest(request);
+	return isVercelSandboxEgressRequest(request);
 }
 // src/handlers/sandbox-egress-route.ts
 /**
@@ -2454,7 +2146,7 @@ function dateField(key, label, value, empty) {
 function renderAutomationDetails(automation) {
 	const url = getDashboardTaskLink(automation.id);
 	if (!url) return void 0;
-	const fields = [textField("status", "Status", automation.kind === "scheduled" ? automation.status : automation.triggerAvailable ? "ready" : "unavailable"), {
+	const fields = [textField("status", "Status", automation.kind === "scheduled" ? automation.status : automation.trigger.problems.length === 0 ? "ready" : "unavailable"), {
 		...textField("description", "Instruction", automation.instruction),
 		format: "markdown",
 		long: true
@@ -2464,15 +2156,19 @@ function renderAutomationDetails(automation) {
 		long: true
 	}, dateField("next_run", "Next run", automation.nextRunAt, "None"));
 	else {
+		const { trigger } = automation;
 		fields.push(textField("source", "Source", automation.source), {
 			...textField("resource", "Resource", automation.resource),
 			long: true
 		}, {
-			...textField("events", "Events", automation.events.join(", ")),
+			...textField("events", "Events", trigger.events.join(", ")),
+			long: true
+		}, {
+			...textField("filters", "Filters", trigger.filters.length > 0 ? eventTriggerFiltersText(trigger.filters) : "No filters. Runs on every selected event."),
 			long: true
 		});
-		if (!automation.triggerAvailable) fields.push({
-			...textField("warning", "Needs attention", "Trigger unavailable. This automation cannot receive events."),
+		if (trigger.problems.length > 0) fields.push({
+			...textField("warning", "Needs attention", ["Trigger unavailable.", ...trigger.problems].join(" ")),
 			long: true
 		});
 	}
@@ -3013,40 +2709,27 @@ async function handleSlackWebhook(args) {
 	return new Response("ok", { status: 200 });
 }
 // src/handlers/webhooks.ts
-/** Run a platform webhook with shared request tracing and error logging. */
+/** Run a platform webhook with shared request log context and error logging. */
 async function handleWebhookRequest(request, platform, run) {
 	const requestContext = createRequestContext(request, { platform });
-	const requestUrl = new URL(request.url);
 	return await withContext(requestContext, async () => {
 		try {
-			return await withSpan("http.server.request", "http.server", requestContext, async () => {
+			const response = await run();
+			if (response.status >= 400) {
+				let responseBodySnippet;
 				try {
-					const response = await run();
-					if (response.status >= 400) {
-						let responseBodySnippet;
-						try {
-							responseBodySnippet = (await response.clone().text()).slice(0, 300);
-						} catch {
-							responseBodySnippet = void 0;
-						}
-						logWarn("webhook.response.unsuccessful", {
-							"http.response.status_code": response.status,
-							"http.request.header.x_slack_signature": request.headers.get("x-slack-signature") ?? void 0,
-							"http.request.header.x_slack_request_timestamp": request.headers.get("x-slack-request-timestamp") ?? void 0,
-							...responseBodySnippet ? { "app.webhook.response_body": responseBodySnippet } : void 0
-						});
-					}
-					setSpanAttributes({ "http.response.status_code": response.status });
-					setSpanStatus(response.status >= 500 ? "error" : "ok");
-					return response;
-				} catch (error) {
-					setSpanStatus("error");
-					throw error;
+					responseBodySnippet = (await response.clone().text()).slice(0, 300);
+				} catch {
+					responseBodySnippet = void 0;
 				}
-			}, {
-				"http.request.method": request.method,
-				"url.path": requestUrl.pathname
-			});
+				logWarn("webhook.response.unsuccessful", {
+					"http.response.status_code": response.status,
+					"http.request.header.x_slack_signature": request.headers.get("x-slack-signature") ?? void 0,
+					"http.request.header.x_slack_request_timestamp": request.headers.get("x-slack-request-timestamp") ?? void 0,
+					...responseBodySnippet ? { "app.webhook.response_body": responseBodySnippet } : void 0
+				});
+			}
+			return response;
 		} catch (error) {
 			logException(error, "webhook.handler.failed");
 			throw error;
@@ -3073,22 +2756,29 @@ function parseConversationQueueMessage(message) {
 function resolveConversationWorkVisibilityTimeoutSeconds(functionMaxDurationSeconds = getChatConfig().functionMaxDurationSeconds) {
 	return functionMaxDurationSeconds + 30;
 }
-/** Queue lag and redelivery attributes for the worker span. */
-function queueMetadataAttributes(metadata, nowMs) {
-	if (!metadata) return {};
+/**
+* Sentry queue attributes for the worker span. The span always sets the
+* messaging system and destination so the inherited Slack values do not win.
+*/
+function queueProcessAttributes(metadata, nowMs) {
 	return {
-		"app.queue.delivery_count": metadata.deliveryCount,
-		"app.queue.lag_ms": nowMs - metadata.createdAt.getTime()
+		"messaging.destination.name": metadata?.topicName ?? resolveConversationWorkQueueTopic(),
+		"messaging.system": getQueueProvider().messagingSystem,
+		...metadata && {
+			"messaging.message.id": metadata.messageId,
+			"messaging.message.receive.latency": nowMs - metadata.createdAt.getTime(),
+			"messaging.message.retry.count": metadata.deliveryCount - 1
+		}
 	};
 }
 /**
-* Process one Vercel Queue payload with the generic conversation worker.
-* Pass the queue metadata to record queue lag and redelivery on the span.
+* Process one queue payload with the generic conversation worker.
+* Pass the queue metadata to record time in queue and retries on the span.
 */
 async function processConversationQueueMessage(message, options, metadata) {
 	const parsed = parseConversationQueueMessage(message);
 	try {
-		return await withSpan("conversation.work.process", "conversation.work.process", { conversationId: parsed.conversationId }, async (setSpanAttributes) => {
+		return await withSpan("conversation.work.process", "queue.process", { conversationId: parsed.conversationId }, async (setSpanAttributes) => {
 			try {
 				const result = await processConversationWork(parsed, {
 					checkInIntervalMs: options.checkInIntervalMs,
@@ -3105,13 +2795,13 @@ async function processConversationQueueMessage(message, options, metadata) {
 				if (isConversationQueueMessageRejectedError(error)) setSpanAttributes({ "app.worker.outcome": error.reason });
 				throw error;
 			}
-		}, queueMetadataAttributes(metadata, options.nowMs?.() ?? Date.now()));
+		}, queueProcessAttributes(metadata, options.nowMs?.() ?? Date.now()));
 	} finally {
 		options.waitUntil?.(settleConversationTitleWork(parsed.conversationId));
 	}
 }
 /**
-* Run one queue message through the worker without a Vercel push callback.
+* Run one queue message through the worker without a queue push callback.
 * In-process queues use this. The callback's kill switch, request deadline,
 * and permanent rejection rules apply; signature checks do not.
 */
@@ -3121,9 +2811,7 @@ async function consumeConversationQueueMessage(message, options) {
 		consumerGroup: "in_process",
 		createdAt: new Date(nowMs),
 		deliveryCount: 1,
-		expiresAt: new Date(nowMs + 3e4),
 		messageId: options.messageId,
-		region: "local",
 		topicName: resolveConversationWorkQueueTopic(options)
 	});
 }
@@ -3172,6 +2860,7 @@ function registerVercelConversationWorkDevConsumer(options) {
 	return conversationWorkCallback(options).registerDev();
 }
 // src/chat/sandbox/snapshot/job-callback.ts
+/** Receive queue messages for Workspace snapshot builds. */
 const WORKSPACE_SNAPSHOT_JOB_DEV_CONSUMER_GROUP = "junior_workspace_snapshots_dev";
 function logWorkspaceSnapshotJobRejected(reason, metadata) {
 	logWarn("workspace.snapshot.job.queue_message.rejected", {
@@ -3207,7 +2896,7 @@ async function publicArtifactGET(args) {
 		const artifact = await readPublicArtifact({
 			db: args.db ?? getSqlExecutor(),
 			filename: args.filename,
-			storage: args.storage ?? createVercelAttachmentStorage()
+			storage: args.storage ?? getAttachmentStorage()
 		});
 		if (!artifact) return new Response("Not Found", {
 			headers: unpublishedArtifactHeaders(),
@@ -5116,6 +4805,7 @@ function createBetterAuth(config) {
 			clientSecret: required(config.googleClientSecret ?? process.env.GOOGLE_CLIENT_SECRET, "GOOGLE_CLIENT_SECRET"),
 			hd: hostedDomain,
 			prompt: "select_account",
+			disableIdTokenSignIn: true,
 			async getUserInfo(token) {
 				if (!token.idToken) return null;
 				const claims = readGoogleClaims(token.idToken);
@@ -5276,7 +4966,6 @@ function dashboardHostRoutePaths(dashboard, authenticatedRoutes = []) {
 		pagePath("settings"),
 		`${pagePath("settings")}/*`
 	];
-	if (dashboard.componentGallery) pagePaths.push(pagePath("dev"), `${pagePath("dev")}/*`);
 	const loginPath = basePath === "/" ? "/auth/login" : `${basePath}/auth/login`;
 	return [
 		...pagePaths,
@@ -5534,7 +5223,7 @@ async function createApp(options) {
 		messageId: delivery.messageId
 	})) ?? getVercelConversationWorkQueue();
 	const pluginTaskQueue = options?.pluginTaskQueue?.(processPluginTask);
-	const attachmentStorage = createVercelAttachmentStorage();
+	const attachmentStorage = getAttachmentStorage();
 	const agentRunner = createAgentRunner(executeAgentRun, {
 		attachmentStorage,
 		bindMessageAgent: (request) => bindMessageAgent(request, { queue: conversationWorkQueue }),

package/dist/{assistant-reply-BcJj_ORj.js → assistant-reply-UyzAfZQo.js}

@@ -1,4 +1,4 @@
-import { Wt as extractAssistantText } from "./tasks-OgXmReUv.js";
+import { Wt as extractAssistantText } from "./tasks-DDT-J3Rf.js";
 // src/chat/no-reply.ts
 const NO_REPLY_MARKER = "[[NO_REPLY]]";
 /**