@sentry/junior 0.265.0 → 0.267.0

package/dist/{credentialed-C6pKlB1p.js → credentialed-CIGwoLU2.js}

@@ -1,28 +1,36 @@
 import { t as __exportAll } from "./rolldown-runtime-nwUcYXjP.js";
-import { C as toOptionalTrimmed, i as completeObject, o as embedTexts } from "./client-DX34VNtH.js";
-import { i as getChatConfig, n as botConfig, o as getSlackBotToken, v as normalizeSlackEmojiName } from "./config-BayQ9hHH.js";
-import { T as withSpan, a as extractGenAiUsageSummary, f as logException, m as logWarn, p as logInfo, s as getLogContextAttributes, u as logAudit, v as setSentryUser, y as setSpanAttributes, z as isRecord$2 } from "./logging-D2QBriUo.js";
+import { C as toOptionalTrimmed, i as completeObject, o as embedTexts } from "./client-BjgbMawj.js";
+import { i as getChatConfig, n as botConfig, o as getSlackBotToken, v as normalizeSlackEmojiName } from "./config-CdB6yJj5.js";
+import { B as isRecord$2, E as withSpan, a as extractGenAiUsageSummary, b as setSpanAttributes, c as getLogContextAttributes, d as logAudit, h as logWarn, m as logInfo, p as logException, y as setSentryUser } from "./logging-DuZ1A4ab.js";
 import { a as getClient$1, n as captureMessage, r as continueTrace } from "./sentry-MDkYAVPV.js";
-import { t as canExposeConversationPayload } from "./conversation-privacy-frjQCJa9.js";
+import { t as canExposeConversationPayload } from "./conversation-privacy-BzgJC5k0.js";
 import { r as defaultModelId } from "./model-profile-Bg8EoCKD.js";
-import { d as parseSlackTeamId, f as parseSlackUserId, g as parseSlackMessageTs, i as isActorUserId, o as parseActorUserId, u as parseSlackChannelReferenceId } from "./actor-tlxzqaRe.js";
-import { F as saveUserTimezone, N as readUserTimezone, O as hasAgentTurnUsage, _ as createSqlStore, a as resolveViewerUser, f as getDb, i as readIdentityById, l as getConversationEventStore, p as getSqlExecutor, r as readActorIdentity, z as parseDestination } from "./viewer-B2wXNspU.js";
+import { d as parseSlackTeamId, f as parseSlackUserId, i as isActorUserId, o as parseActorUserId, p as parseSlackMessageTs, u as parseSlackChannelReferenceId } from "./actor-DZSokpwj.js";
+import { B as parseDestination, I as saveUserTimezone, P as readUserTimezone, a as resolveViewerUser, i as readIdentityById, k as hasAgentTurnUsage, m as getSqlExecutor, p as getDb, r as readActorIdentity, u as getConversationEventStore, v as createSqlStore } from "./viewer-DrN3oC2X.js";
 import { c as juniorIdentities, d as juniorDestinations, l as juniorUsers, s as juniorConversations } from "./agent-invocations-CxKldAeB.js";
-import { _ as juniorConversationAnnotations, b as juniorAttachments, f as juniorConversationBriefs, h as juniorConversationEvents, i as juniorWorkspaces, n as juniorSnapshots, r as juniorWorkspaceRepos, u as juniorConversationParticipants, v as juniorCodeChanges, y as juniorCodeRepositories } from "./executor-CAr7xQr2.js";
-import { o as decodeStoredConversationEvent } from "./history-AY8rs-FR.js";
-import { _ as CredentialUnavailableError, a as resolveAuthTokenPlaceholder, h as credentialSubjectSchema, m as credentialLogContext, o as resolvePluginCommandEnv, p as credentialContextSchema } from "./registry-COTeZ2cV.js";
-import { n as pluginCatalogRuntime } from "./catalog-runtime-D3qbJlYz.js";
-import { a as acquireActiveLock, n as getDefaultRedisStateAdapterFor, r as getStateAdapter, s as withLock } from "./adapter-cUkPH3Om.js";
+import { _ as juniorConversationAnnotations, b as juniorAttachments, f as juniorConversationBriefs, h as juniorConversationEvents, i as juniorWorkspaces, n as juniorSnapshots, r as juniorWorkspaceRepos, u as juniorConversationParticipants, v as juniorCodeChanges, y as juniorCodeRepositories } from "./executor-VYrx_K4w.js";
+import { o as decodeStoredConversationEvent } from "./history-C84mlAwO.js";
+import { _ as CredentialUnavailableError, a as resolveAuthTokenPlaceholder, h as credentialSubjectSchema, m as credentialLogContext, o as resolvePluginCommandEnv, p as credentialContextSchema } from "./registry-FQutO926.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-cMlAI5LY.js";
+import { c as withLock, i as getStateAdapter, o as acquireActiveLock, r as getDefaultRedisStateAdapterFor } from "./adapter-BybMEezj.js";
 import { i as isValidTimeZone } from "./cadence-R7Em4RjE.js";
-import { B as readMessageAttachments, C as conversationReportEventSchema, F as readMessageCardRefs, J as parseBriefInput, q as conversationBriefSchema, w as conversationReportMessageEventSchema } from "./conversation-B0baEwoA.js";
-import { n as briefEntriesFromReportEvents, s as generateBrief, t as BRIEF_PROMPT } from "./prompt-CvaDdSX3.js";
+import { C as conversationReportEventSchema, Q as parseBriefInput, W as readMessageAttachments, Z as conversationBriefSchema, w as conversationReportMessageEventSchema, z as readMessageCardRefs } from "./conversation-DSo310Ps.js";
+import { n as briefEntriesFromReportEvents, s as generateBrief, t as BRIEF_PROMPT } from "./prompt-BW9jFsqZ.js";
+import path from "node:path";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { z } from "zod";
-import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { createHash, createHmac, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, randomUUID, sign, timingSafeEqual } from "node:crypto";
 import { and, arrayContains, asc, desc, eq, exists, getTableColumns, gte, inArray, isNotNull, isNull, lt, lte, max, ne, notExists, or, sql } from "drizzle-orm";
-import { EgressAuthRequired, EgressPolicyDenied, actorSchema, codeChangeInputSchema, conversationAnnotationInputSchema, conversationEventPresentationSchema, defineConversationEvent, eventInputSchema, eventMatchSchema, eventMatches, eventTypeSchema, missingToolAnnotationKeys, normalizeEventIdentifier, objectAnnotationSchema, objectIconPath, objectTypeSchema, pluginAuthorizationSchema, pluginCredentialHeaderTransformSchema, pluginCredentialResultSchema, pluginEventsSchema, pluginGrantSchema, pluginProviderAccountSchema, pluginStoredTokensSchema, promptContextSchema, promptMessageSchema, sourceSchema, stableEventMatchKey } from "@sentry/junior-plugin-api";
+import { EgressAuthRequired, EgressPolicyDenied, actorSchema, codeChangeInputSchema, conversationAnnotationInputSchema, conversationEventPresentationSchema, defineConversationEvent, eventDataSchema, eventInputSchema, eventMatchSchema, eventMatches, eventTypeSchema, missingToolAnnotationKeys, normalizeEventIdentifier, objectAnnotationSchema, objectIconPath, objectTypeSchema, pluginAuthorizationSchema, pluginCredentialHeaderTransformSchema, pluginCredentialResultSchema, pluginEventsSchema, pluginGrantSchema, pluginProviderAccountSchema, pluginStoredTokensSchema, promptContextSchema, promptMessageSchema, sourceSchema, stableEventMatchKey } from "@sentry/junior-plugin-api";
 import { alias, union } from "drizzle-orm/pg-core";
+import fs from "node:fs/promises";
 import { WebClient } from "@slack/web-api";
+import http from "node:http";
+import os from "node:os";
+import dns from "node:dns/promises";
+import net from "node:net";
+import { Duplex, Readable } from "node:stream";
+import tls from "node:tls";
 import { FileSystem, Sandbox } from "@vercel/sandbox";
 import { createRemoteJWKSet, decodeJwt, jwtVerify } from "jose";
 // src/chat/conversations/structured-events.ts
@@ -794,6 +802,12 @@ function reportMessageEvents(meta) {
 	const parsed = storedMessageEventsSchema.safeParse(meta?.events);
 	return parsed.success ? { events: parsed.data } : void 0;
 }
+const TURN_COMPLETED_STATES = {
+	success: "succeeded",
+	no_reply: "no_reply",
+	cancelled: "no_reply",
+	blocked: "blocked"
+};
 function reportEventData(args) {
 	const { data } = args;
 	if (data.type === "structured_event") {
@@ -879,7 +893,7 @@ function reportEventData(args) {
 		case "turn_completed": return {
 			type: "turn_lifecycle",
 			turnId: data.turnId,
-			state: data.outcome === "success" ? "succeeded" : "no_reply"
+			state: TURN_COMPLETED_STATES[data.outcome]
 		};
 		case "turn_failed": {
 			const eventId = data.eventId;
@@ -1211,7 +1225,7 @@ async function briefInputFromSql(executor, conversationId, throughSeq) {
 	});
 }
 // src/chat/briefs/operational-report.ts
-const DAY_MS$1 = 864e5;
+const DAY_MS$2 = 864e5;
 const WINDOWS = [
 	7,
 	30,
@@ -1241,8 +1255,8 @@ function formatUsd(value) {
 */
 async function buildBriefsOperationalReport(args) {
 	const newestDay = startOfUtcDay$1(args.nowMs);
-	const windowStart = /* @__PURE__ */ new Date(newestDay.getTime() - 29 * DAY_MS$1);
-	const windowEnd = new Date(newestDay.getTime() + DAY_MS$1);
+	const windowStart = /* @__PURE__ */ new Date(newestDay.getTime() - 29 * DAY_MS$2);
+	const windowEnd = new Date(newestDay.getTime() + DAY_MS$2);
 	const [[counts], recentCounts] = await Promise.all([args.db.select({
 		conversations: sql`count(distinct ${juniorConversationBriefs.conversationId})`.mapWith(Number),
 		stored: sql`count(*)`.mapWith(Number)
@@ -1632,7 +1646,7 @@ function createPluginConversationEventReader(plugin) {
 	} };
 }
 // src/chat/plugins/conversation-event-stats.ts
-const DAY_MS = 864e5;
+const DAY_MS$1 = 864e5;
 const costRowSchema = z.object({
 	costUsd: z.number().finite().nonnegative(),
 	date: z.string().regex(/^\d{4}-\d{2}-\d{2}(T\d{2})?$/),
@@ -1684,8 +1698,8 @@ function createPluginConversationEventStats(plugin, now = Date.now) {
 		async costsByDay(input) {
 			const eventName = registeredEventName(plugin, input.eventName);
 			const end = startOfUtcDay(now());
-			const start = /* @__PURE__ */ new Date(end.getTime() - (input.days - 1) * DAY_MS);
-			const endExclusive = new Date(end.getTime() + DAY_MS);
+			const start = /* @__PURE__ */ new Date(end.getTime() - (input.days - 1) * DAY_MS$1);
+			const endExclusive = new Date(end.getTime() + DAY_MS$1);
 			const date = sql`TO_CHAR(
         ${juniorConversationEvents.createdAt} AT TIME ZONE 'UTC',
         'YYYY-MM-DD'
@@ -1702,7 +1716,7 @@ function createPluginConversationEventStats(plugin, now = Date.now) {
 			}).from(juniorConversationEvents).where(and(eq(juniorConversationEvents.type, "structured_event"), sql`${juniorConversationEvents.payload}->>'namespace' = ${plugin.manifest.name}`, sql`${juniorConversationEvents.payload}->>'name' = ${eventName}`, gte(juniorConversationEvents.createdAt, start), lt(juniorConversationEvents.createdAt, endExclusive))).groupBy(date);
 			const byDate = new Map(z.array(costRowSchema).parse(rows).map((row) => [row.date, row]));
 			return Array.from({ length: input.days }, (_, index) => {
-				const date = new Date(start.getTime() + index * DAY_MS).toISOString().slice(0, 10);
+				const date = new Date(start.getTime() + index * DAY_MS$1).toISOString().slice(0, 10);
 				return byDate.get(date) ?? {
 					costUsd: 0,
 					date,
@@ -1844,13 +1858,15 @@ const SANDBOX_WORKSPACE_ROOT = normalizeWorkspaceRoot(process.env.VERCEL_SANDBOX
 const SANDBOX_REPOS_ROOT = `${SANDBOX_WORKSPACE_ROOT}/repos`;
 const SANDBOX_SKILLS_ROOT = `${SANDBOX_WORKSPACE_ROOT}/skills`;
 const SANDBOX_DATA_ROOT = `${SANDBOX_WORKSPACE_ROOT}/data`;
+/** Runtime-owned files inside the sandbox, outside every repository. */
+const SANDBOX_JUNIOR_ROOT = `${SANDBOX_WORKSPACE_ROOT}/.junior`;
 /**
 * PATH for sandbox commands. Plugin runtime binaries come last so they never
 * shadow repo or Workspace tools with the same name. Repo tools often start
 * child processes through PATH, so only PATH order can protect them. Plugin
 * binaries stay reachable by name or by absolute path.
 */
-const SANDBOX_COMMAND_PATH = `$PATH:${`${SANDBOX_WORKSPACE_ROOT}/.junior/bin`}`;
+const SANDBOX_COMMAND_PATH = `$PATH:${`${SANDBOX_JUNIOR_ROOT}/bin`}`;
 function sandboxSkillDir(skillName) {
 	return `${SANDBOX_SKILLS_ROOT}/${skillName}`;
 }
@@ -1877,21 +1893,44 @@ const NON_INTERACTIVE_ENV = {
 	GCM_INTERACTIVE: "never",
 	DEBIAN_FRONTEND: "noninteractive",
 	GIT_ASKPASS: "/bin/true",
-	GIT_CONFIG_NOSYSTEM: "1",
-	GIT_CONFIG_COUNT: "2",
-	GIT_CONFIG_KEY_0: "credential.helper",
-	GIT_CONFIG_VALUE_0: "",
-	GIT_CONFIG_KEY_1: "http.emptyAuth",
-	GIT_CONFIG_VALUE_1: "true"
+	GIT_CONFIG_NOSYSTEM: "1"
 };
+/** Git config the runtime always applies through `GIT_CONFIG_COUNT`. */
+const RUNTIME_GIT_CONFIG = [["credential.helper", ""], ["http.emptyAuth", "true"]];
+/**
+* Combine command Git config env entries with the runtime entries.
+*
+* Plugin hooks can add Git config with `GIT_CONFIG_COUNT`. Their entries keep
+* their order, and the runtime entries come last so credential isolation
+* always wins.
+*/
+function gitConfigEnv(env) {
+	const count = Number.parseInt(env.GIT_CONFIG_COUNT ?? "0", 10) || 0;
+	const entries = [];
+	for (let index = 0; index < count; index++) {
+		const key = env[`GIT_CONFIG_KEY_${index}`];
+		if (key) entries.push([key, env[`GIT_CONFIG_VALUE_${index}`] ?? ""]);
+	}
+	entries.push(...RUNTIME_GIT_CONFIG);
+	const result = { GIT_CONFIG_COUNT: String(entries.length) };
+	entries.forEach(([key, value], index) => {
+		result[`GIT_CONFIG_KEY_${index}`] = key;
+		result[`GIT_CONFIG_VALUE_${index}`] = value;
+	});
+	return result;
+}
 function shellQuote(value) {
 	return `'${value.replace(/'/g, "'\\''")}'`;
 }
 function buildEnvExports(options) {
 	const lines = [];
 	if (options.path) lines.push(`export PATH="${options.path}"`);
-	for (const [key, value] of Object.entries(NON_INTERACTIVE_ENV)) lines.push(`export ${key}=${shellQuote(value)}`);
-	for (const [key, value] of Object.entries(options.env ?? {})) lines.push(`export ${key}=${shellQuote(value)}`);
+	const env = {
+		...NON_INTERACTIVE_ENV,
+		...options.env,
+		...gitConfigEnv(options.env ?? {})
+	};
+	for (const [key, value] of Object.entries(env)) lines.push(`export ${key}=${shellQuote(value)}`);
 	return lines;
 }
 /** Render one argv command as a safely quoted shell script. */
@@ -3072,849 +3111,1112 @@ function workspaceRepoCheckoutPath(repo) {
 	if (!path) throw new Error(`Invalid repository name for checkout path: ${repo}`);
 	return path;
 }
-// src/chat/sandbox/vercel/credentials.ts
-/**
-* Resolve explicit Vercel Sandbox credentials, or return undefined to let
-* the SDK read ambient Vercel auth from its own environment detection.
-*/
-function getVercelSandboxCredentials() {
-	const token = toOptionalTrimmed(process.env.VERCEL_TOKEN);
-	const teamId = toOptionalTrimmed(process.env.VERCEL_TEAM_ID);
-	const projectId = toOptionalTrimmed(process.env.VERCEL_PROJECT_ID);
-	if (token && teamId && projectId) return {
-		token,
-		teamId,
-		projectId
+// src/chat/sandbox/docker/api.ts
+const API_VERSION = "v1.43";
+const DEFAULT_SOCKET_PATH = "/var/run/docker.sock";
+/** Error response from the Docker Engine API. */
+var DockerApiError = class extends Error {
+	statusCode;
+	constructor(statusCode, message) {
+		super(`Docker API error status=${statusCode}: ${message}`);
+		this.name = "DockerApiError";
+		this.statusCode = statusCode;
+	}
+};
+/** Return the unix socket path of the Docker daemon from `DOCKER_HOST`. */
+function dockerSocketPath() {
+	const host = process.env.DOCKER_HOST?.trim();
+	if (!host) return DEFAULT_SOCKET_PATH;
+	if (!host.startsWith("unix://")) throw new Error(`The Docker sandbox provider supports only unix sockets. DOCKER_HOST is ${host}`);
+	return host.slice(7);
+}
+function requestPath(input) {
+	const params = new URLSearchParams();
+	for (const [key, value] of Object.entries(input.query ?? {})) if (value !== void 0) params.set(key, String(value));
+	const query = params.toString();
+	return `/${API_VERSION}${input.path}${query ? `?${query}` : ""}`;
+}
+/** Send one request and return the response stream with its status. */
+function dockerStream(input) {
+	input.signal?.throwIfAborted();
+	const raw = input.body instanceof Uint8Array ? Buffer.from(input.body) : void 0;
+	const json = input.body !== void 0 && !raw ? JSON.stringify(input.body) : void 0;
+	return new Promise((resolve, reject) => {
+		const request = http.request({
+			socketPath: dockerSocketPath(),
+			agent: false,
+			path: requestPath(input),
+			method: input.method ?? "GET",
+			headers: {
+				...json ? { "content-type": "application/json" } : void 0,
+				...raw ? { "content-type": "application/x-tar" } : void 0
+			},
+			signal: input.signal
+		});
+		request.on("response", resolve);
+		request.on("error", reject);
+		request.end(raw ?? json);
+	});
+}
+/** Read a whole response stream into one buffer. */
+async function readStream(stream) {
+	const chunks = [];
+	for await (const chunk of stream) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+	return Buffer.concat(chunks);
+}
+async function errorFrom(response) {
+	const body = (await readStream(response)).toString("utf8");
+	let message = body.trim() || response.statusMessage || "request failed";
+	try {
+		const parsed = JSON.parse(body);
+		if (typeof parsed.message === "string") message = parsed.message;
+	} catch {}
+	throw new DockerApiError(response.statusCode ?? 0, message);
+}
+/** Send one request and return its body. Error statuses throw `DockerApiError`. */
+async function dockerRequest(input) {
+	const response = await dockerStream(input);
+	if ((response.statusCode ?? 0) >= 400) return await errorFrom(response);
+	return await readStream(response);
+}
+/** Send one request and parse its JSON body. */
+async function dockerJson(input) {
+	const body = await dockerRequest(input);
+	return body.length > 0 ? JSON.parse(body.toString("utf8")) : {};
+}
+/** Send one request and return the response stream. Error statuses throw. */
+async function dockerOkStream(input) {
+	const response = await dockerStream(input);
+	if ((response.statusCode ?? 0) >= 400) return await errorFrom(response);
+	return response;
+}
+// src/chat/sandbox/docker/exec.ts
+/** Directory for command state in each sandbox. The runtime image creates it. */
+const COMMAND_STATE_DIR = "/var/tmp/junior-commands";
+/** User for commands without `sudo`. It matches Vercel Sandbox. */
+const SANDBOX_USER = "vercel-sandbox";
+const KILL_GRACE_MS = 2e3;
+const EXIT_POLL_MS = 250;
+function timeoutArgs(timeoutMs) {
+	if (!timeoutMs || timeoutMs <= 0) return [];
+	return [
+		"timeout",
+		"-k",
+		"5",
+		`${Math.ceil(timeoutMs / 1e3)}s`
+	];
+}
+function envList(env) {
+	return Object.entries(env ?? {}).map(([key, value]) => `${key}=${value}`);
+}
+async function createExec(containerId, input, signal) {
+	return (await dockerJson({
+		method: "POST",
+		path: `/containers/${encodeURIComponent(containerId)}/exec`,
+		body: {
+			AttachStdout: input.attach,
+			AttachStderr: input.attach,
+			Cmd: input.cmd,
+			Env: envList(input.env),
+			User: input.root ? "root" : SANDBOX_USER,
+			...input.cwd ? { WorkingDir: input.cwd } : void 0
+		},
+		signal
+	})).Id;
+}
+/** Split Docker's multiplexed exec stream into stdout and stderr. */
+async function demux(stream) {
+	const stdout = [];
+	const stderr = [];
+	let pending = Buffer.alloc(0);
+	for await (const chunk of stream) {
+		pending = Buffer.concat([pending, Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)]);
+		while (pending.length >= 8) {
+			const size = pending.readUInt32BE(4);
+			if (pending.length < 8 + size) break;
+			const frame = pending.subarray(8, 8 + size);
+			if (pending[0] === 2) stderr.push(frame);
+			else stdout.push(frame);
+			pending = pending.subarray(8 + size);
+		}
+	}
+	return {
+		stdout: Buffer.concat(stdout).toString("utf8"),
+		stderr: Buffer.concat(stderr).toString("utf8")
 	};
 }
-// src/chat/slack/post-warning.ts
-const codes = /* @__PURE__ */ new Set([
-	"invalid_metadata_format",
-	"invalid_metadata_schema",
-	"metadata_too_large",
-	"invalid_arguments",
-	"invalid_blocks",
-	"missing_scope",
-	"missing_charset",
-	"superfluous_charset",
-	"message_truncated"
-]);
-const pathFields = /* @__PURE__ */ new Set([
-	"metadata",
-	"event_type",
-	"event_payload",
-	"entities",
-	"entity_type",
-	"entity_payload",
-	"external_ref",
-	"id",
-	"type",
-	"url",
-	"attributes",
-	"title",
-	"text",
-	"display_id",
-	"display_type",
-	"product_name",
-	"fields",
-	"status",
-	"custom_fields",
-	"key",
-	"label",
-	"value",
-	"long",
-	"format",
-	"link",
-	"display_order",
-	"app_unfurl_url",
-	"app_id",
-	"created_by",
-	"created_at",
-	"updated_by",
-	"updated_at",
-	"full_size_preview",
-	"preview_url",
-	"mime_type"
-]);
-const diagnosticWords = new Set(`WARN ERROR Message message metadata was incorrectly formatted The the will be
-  ignored as a result For for event entity refer to following errors error
-  missing required field fields property properties additional unexpected unknown
-  unsupported invalid expected received actual type types must should match matches
-  matching does not is are has have of at in on and or an only allowed allow
-  value values string number integer boolean object array null minimum maximum
-  length min max items item empty nonempty too long short large small size limit
-  exceeded exceeds less greater than equal valid format schema validation failed
-  failure cannot contain contains found one any all none enum pattern definition
-  defined constraint constraints satisfy satisfies with without provided specified
-  unrecognized unrecognised recognized recognised extraneous disallowed duplicate
-  unique malformed nested root exactly needs need requires requirement supported
-  json-pointer input different schema_uri schema_id schemas additionalProperties
-  minLength maxLength minItems maxItems anyOf oneOf allOf`.split(/\s+/));
-function summarizeDiagnostic(value) {
-	return value.slice(0, 2e3).replace(/\b(?:https?:\/\/|www\.)[^\s"'`<>]+/gi, "[value]").replace(/\/[^\s"'`[\],;()]*|[\p{L}\p{N}\p{M}_]+(?:[-./:@=+%~][\p{L}\p{N}\p{M}_]+)*|[^\s\w[\]{}():,;."'`/*=<>!?+-]/gu, (token) => {
-		if (token.startsWith("/")) return token.split("/").slice(0, 17).map((part, index) => index === 0 ? "" : pathFields.has(part) ? part : "*").join("/");
-		return codes.has(token) || pathFields.has(token) || diagnosticWords.has(token) ? token : "[value]";
-	}).replace(/\s+/g, " ").slice(0, 2e3);
+async function waitForExit(execId) {
+	for (;;) {
+		const inspect = await dockerJson({ path: `/exec/${execId}/json` });
+		if (!inspect.Running) return inspect.ExitCode ?? -1;
+		await sleep$1(EXIT_POLL_MS);
+	}
 }
-/** Report Slack warnings once, on the request span, without retrying the post. */
-function captureSlackPostWarning(response, attributes) {
-	const warnings = response.response_metadata?.warnings ?? [];
-	const messages = response.response_metadata?.messages ?? [];
-	const knownCodes = [...new Set(warnings.slice(0, 20).filter((code) => codes.has(code)))].sort();
-	const diagnostics = {
-		"app.slack.warning_count": warnings.length,
-		"app.slack.response_message_count": messages.length,
-		"app.slack.diagnostic_codes": knownCodes
+async function killGroup(containerId, id, signalName) {
+	const pidFile = `${COMMAND_STATE_DIR}/${id}.pid`;
+	await runRawExec(containerId, {
+		cmd: [
+			"sh",
+			"-c",
+			`[ -f ${pidFile} ] && kill -${signalName} -- -"$(cat ${pidFile})" 2>/dev/null; true`
+		],
+		root: true
+	});
+}
+/** Run one exec without the process-group wrapper. Used for internal steps. */
+async function runRawExec(containerId, input, signal) {
+	const execId = await createExec(containerId, {
+		...input,
+		attach: true
+	}, signal);
+	const output = await demux(await dockerOkStream({
+		method: "POST",
+		path: `/exec/${execId}/start`,
+		body: {
+			Detach: false,
+			Tty: false
+		},
+		signal
+	}));
+	return {
+		exitCode: await waitForExit(execId),
+		...output
 	};
-	setSpanAttributes(diagnostics);
-	if (!warnings.length && !messages.length) return;
-	captureMessage("Slack chat.postMessage returned warnings", {
-		level: "warning",
-		fingerprint: ["slack.chat.postMessage.warning", ...knownCodes.length ? knownCodes : ["unknown"]],
-		tags: { "app.slack.method": "chat.postMessage" },
-		extra: {
-			...getLogContextAttributes(),
-			...attributes,
-			...diagnostics,
-			"app.slack.response_diagnostics": {
-				warnings: warnings.slice(0, 20).map(summarizeDiagnostic),
-				messages: messages.slice(0, 20).map(summarizeDiagnostic)
-			}
+}
+/** Run one command in a sandbox container. Abort kills its process group. */
+async function runSandboxCommand(containerId, input) {
+	input.signal?.throwIfAborted();
+	const id = randomUUID();
+	const pidFile = `${COMMAND_STATE_DIR}/${id}.pid`;
+	const execId = await createExec(containerId, {
+		cmd: [
+			"setsid",
+			"-w",
+			"sh",
+			"-c",
+			`echo $$ > ${pidFile}; exec "$@"`,
+			"sh",
+			...timeoutArgs(input.timeoutMs),
+			input.cmd,
+			...input.args ?? []
+		],
+		cwd: input.cwd,
+		env: input.env,
+		root: input.sudo,
+		attach: true
+	});
+	const stream = await dockerOkStream({
+		method: "POST",
+		path: `/exec/${execId}/start`,
+		body: {
+			Detach: false,
+			Tty: false
 		}
 	});
+	const signal = input.signal;
+	const onAbort = () => {
+		(async () => {
+			await killGroup(containerId, id, "TERM");
+			await sleep$1(KILL_GRACE_MS);
+			await killGroup(containerId, id, "KILL");
+		})().catch(() => {});
+	};
+	signal?.addEventListener("abort", onAbort, { once: true });
+	try {
+		const output = await demux(stream);
+		signal?.throwIfAborted();
+		return {
+			exitCode: await waitForExit(execId),
+			...output
+		};
+	} finally {
+		signal?.removeEventListener("abort", onAbort);
+		runRawExec(containerId, {
+			cmd: [
+				"rm",
+				"-f",
+				pidFile
+			],
+			root: true
+		}).catch(() => {});
+	}
 }
-// src/chat/slack/work-object.ts
-const url = z.url({ protocol: /^https?$/ });
-const textField = z.strictObject({
-	type: z.literal("string"),
-	key: z.string().min(1),
-	label: z.string().min(1),
-	value: z.string(),
-	long: z.boolean().optional(),
-	format: z.literal("markdown").optional(),
-	link: url.optional()
-}).refine((field) => !field.format || !field.link, { message: "Slack string fields cannot combine format and link" });
-const customField = z.discriminatedUnion("type", [textField, z.strictObject({
-	type: z.literal("slack#/types/timestamp"),
-	key: z.string().min(1),
-	label: z.string().min(1),
-	value: z.number().int(),
-	link: url.optional()
-})]);
-const payload = z.strictObject({
-	attributes: z.strictObject({
-		title: z.strictObject({ text: z.string().min(1) }),
-		display_id: z.string().optional(),
-		display_type: z.string().optional(),
-		product_name: z.string().optional(),
-		product_icon: z.strictObject({
-			url,
-			alt_text: z.string().min(1)
-		}).optional()
-	}),
-	custom_fields: z.array(customField).optional(),
-	display_order: z.array(z.string()).optional()
-});
-/** Limit IDs to Junior's safe subset; Slack silently rejects JSON punctuation. */
-const slackExternalRefIdSchema = z.string().min(1).regex(/^[A-Za-z0-9_-]+$/, "Unsupported Slack external reference ID");
-const entity = z.strictObject({
-	external_ref: z.strictObject({
-		id: slackExternalRefIdSchema,
-		type: z.string().min(1).optional()
-	}),
-	url
-});
-/** Validate notification and detail metadata before Slack can ignore bad fields. */
-const slackEntitySchema = z.discriminatedUnion("entity_type", [entity.extend({
-	entity_type: z.literal("slack#/entities/item"),
-	entity_payload: payload.extend({ fields: z.never().optional() })
-}), entity.extend({
-	entity_type: z.literal("slack#/entities/task"),
-	entity_payload: payload.extend({ fields: z.strictObject({ status: z.strictObject({ value: z.string() }).optional() }).optional() })
-})]);
-// src/chat/slack/outbound.ts
-const MAX_SLACK_MESSAGE_TEXT_CHARS = 4e4;
-function requireSlackConversationId(channelId, action) {
-	const normalized = normalizeSlackConversationId(channelId);
-	if (!normalized) throw new Error(`${action} requires a valid channel ID`);
-	return normalized;
+/** Start a command that keeps running after this request. Return its id. */
+async function startDetachedCommand(containerId, input) {
+	const id = randomUUID();
+	const dir = `${COMMAND_STATE_DIR}/${id}`;
+	await dockerJson({
+		method: "POST",
+		path: `/exec/${await createExec(containerId, {
+			cmd: [
+				"sh",
+				"-c",
+				[
+					`mkdir -p ${dir}`,
+					`"$@" >${dir}/stdout 2>${dir}/stderr`,
+					`echo $? >${dir}/exit.tmp`,
+					`mv ${dir}/exit.tmp ${dir}/exit`
+				].join("; "),
+				"sh",
+				...timeoutArgs(input.timeoutMs),
+				input.cmd,
+				...input.args ?? []
+			],
+			cwd: input.cwd,
+			env: input.env,
+			root: input.sudo,
+			attach: false
+		}, input.signal)}/start`,
+		body: {
+			Detach: true,
+			Tty: false
+		},
+		signal: input.signal
+	});
+	return id;
 }
-function requireSlackThreadTimestamp(threadTs, action) {
-	const normalized = threadTs.trim();
-	if (!normalized) throw new Error(`${action} requires a thread timestamp`);
-	return normalized;
+async function readCommandFile(containerId, id, name, signal) {
+	const result = await runRawExec(containerId, {
+		cmd: ["cat", `${COMMAND_STATE_DIR}/${id}/${name}`],
+		root: true
+	}, signal);
+	return result.exitCode === 0 ? result.stdout : null;
 }
-function requireSlackMessageTimestamp(timestamp, action) {
-	const normalized = parseSlackMessageTs(timestamp);
-	if (!normalized) throw new Error(`${action} requires a target message timestamp`);
-	return normalized;
+/**
+* Wait until a detached command writes its exit code.
+*
+* The state lives in files in the container, so any process can wait for a
+* command that another process started.
+*/
+async function waitForDetachedCommand(containerId, id, signal) {
+	for (;;) {
+		signal.throwIfAborted();
+		const exit = await readCommandFile(containerId, id, "exit", signal);
+		if (exit !== null) return {
+			exitCode: Number.parseInt(exit.trim(), 10),
+			stdout: async () => await readCommandFile(containerId, id, "stdout") ?? "",
+			stderr: async () => await readCommandFile(containerId, id, "stderr") ?? ""
+		};
+		await sleep$1(EXIT_POLL_MS, signal);
+	}
 }
-function requireSlackMessageText(text, action) {
-	if (text.trim().length === 0) throw new Error(`${action} requires non-empty text`);
-	if (text.length > MAX_SLACK_MESSAGE_TEXT_CHARS) throw new Error(`${action} text exceeds Slack's 40000 character truncation limit`);
-	return text;
+// src/chat/sandbox/docker/settings.ts
+/** Label on every container, network, and image that this provider owns. */
+const DOCKER_SANDBOX_LABEL = "dev.junior.sandbox";
+/**
+* Directory for machine-wide provider files, such as the egress CA key.
+* `JUNIOR_DOCKER_SANDBOX_DIR` overrides the default.
+*/
+function dockerSandboxDir() {
+	const configured = process.env.JUNIOR_DOCKER_SANDBOX_DIR?.trim();
+	if (configured) return configured;
+	return path.join(os.homedir(), ".cache", "junior", "docker-sandbox");
 }
-/** Resolve a Slack message permalink without making read-only workflows fail on lookup errors. */
-async function getSlackMessagePermalink(args) {
-	try {
-		return (await withSlackRetries(() => getSlackClient().chat.getPermalink({
-			channel: args.channelId,
-			message_ts: args.messageTs
-		}), 3, {
-			action: "chat.getPermalink",
-			idempotent: true,
-			spanAttributes: {
-				"app.slack.channel_id": args.channelId,
-				"app.slack.message_ts": args.messageTs
-			}
-		})).permalink;
-	} catch {
-		return;
+/**
+* Optional PEM file with more CA certificates for each sandbox to trust.
+*
+* Use this when the Docker host itself sits behind a TLS proxy, such as the
+* network proxy of a Vercel Sandbox. Without it, sandbox containers cannot
+* verify the certificates that this proxy shows.
+*/
+function dockerSandboxExtraCaFile() {
+	return process.env.JUNIOR_DOCKER_SANDBOX_EXTRA_CA_CERTS?.trim() || void 0;
+}
+// src/chat/sandbox/docker/tar.ts
+const BLOCK = 512;
+function writeString(header, value, offset, length) {
+	header.write(value, offset, Math.min(Buffer.byteLength(value), length));
+}
+function writeOctal(header, value, offset, length) {
+	writeString(header, `${value.toString(8).padStart(length - 1, "0")}\0`, offset, length);
+}
+function header(input) {
+	const block = Buffer.alloc(BLOCK);
+	writeString(block, input.name, 0, 100);
+	writeOctal(block, input.mode & 4095, 100, 8);
+	writeOctal(block, input.uid, 108, 8);
+	writeOctal(block, input.gid, 116, 8);
+	writeOctal(block, input.size, 124, 12);
+	writeOctal(block, Math.floor(Date.now() / 1e3), 136, 12);
+	block.fill(" ", 148, 156);
+	writeString(block, input.type, 156, 1);
+	writeString(block, "ustar\0", 257, 6);
+	writeString(block, "00", 263, 2);
+	let checksum = 0;
+	for (const byte of block) checksum += byte;
+	writeString(block, `${checksum.toString(8).padStart(6, "0")}\0 `, 148, 8);
+	return block;
+}
+function padding(size) {
+	const remainder = size % BLOCK;
+	return Buffer.alloc(remainder === 0 ? 0 : BLOCK - remainder);
+}
+/** A PAX record such as `30 path=some/long/name\n`. */
+function paxRecord(key, value) {
+	const body = ` ${key}=${value}\n`;
+	let length = Buffer.byteLength(body);
+	length += String(length).length;
+	if (String(length).length !== String(length - 1).length) length += 1;
+	return Buffer.from(`${length}${body}`);
+}
+/** Write regular files into one uncompressed tar archive. */
+function packTar(files) {
+	const parts = [];
+	for (const file of files) {
+		const content = Buffer.from(file.content);
+		let name = file.path;
+		if (Buffer.byteLength(name) > 99) {
+			const pax = paxRecord("path", name);
+			parts.push(header({
+				...file,
+				name: "PaxHeader",
+				size: pax.length,
+				type: "x"
+			}), pax, padding(pax.length));
+			name = name.slice(-99);
+		}
+		parts.push(header({
+			...file,
+			name,
+			size: content.length,
+			type: "0"
+		}), content, padding(content.length));
 	}
+	parts.push(Buffer.alloc(BLOCK * 2));
+	return Buffer.concat(parts);
 }
-/** Open the bot's direct message with one Slack user and return its channel ID. */
-async function openSlackDirectMessage(userId) {
-	const channelId = (await withSlackRetries(() => getSlackClient().conversations.open({ users: userId }), 3, { action: "conversations.open" })).channel?.id;
-	if (!channelId) throw new Error("Slack did not return a direct message channel.");
-	return channelId;
+function readOctal(block, offset, length) {
+	const text = block.subarray(offset, offset + length).toString("ascii").replace(/\0.*$/s, "").trim();
+	return text ? Number.parseInt(text, 8) : 0;
 }
-/** Post Slack `mrkdwn` text to a conversation or thread via the shared outbound boundary. */
-async function postSlackMessage(input) {
-	const channelId = requireSlackConversationId(input.channelId, "Slack message posting");
-	const text = requireSlackMessageText(input.text, "Slack message posting");
-	const entities = input.entities?.length ? slackEntitySchema.array().parse(input.entities) : void 0;
-	const threadTs = input.threadTs ? requireSlackThreadTimestamp(input.threadTs, "Slack thread message posting") : void 0;
-	const attributes = {
-		"app.slack.channel_id": channelId,
-		...threadTs ? { "app.slack.thread_ts": threadTs } : void 0,
-		"app.slack.work_object.count": entities?.length ?? 0
-	};
-	const response = await withSlackRetries(async () => {
-		const response = await getSlackClient().chat.postMessage({
-			channel: channelId,
-			text,
-			unfurl_links: false,
-			unfurl_media: false,
-			...input.blocks?.length ? { blocks: input.blocks } : void 0,
-			...entities ? { metadata: { entities } } : void 0,
-			...threadTs ? { thread_ts: threadTs } : void 0
-		});
-		const messageId = parseSlackMessageTs(response.ts);
-		setSpanAttributes({ "messaging.message.id": messageId });
-		captureSlackPostWarning(response, {
-			...attributes,
-			"messaging.message.id": messageId
+/** Return the content of the first regular file in a tar archive. */
+function unpackFirstFile(archive) {
+	let offset = 0;
+	while (offset + BLOCK <= archive.length) {
+		const block = archive.subarray(offset, offset + BLOCK);
+		if (block.every((byte) => byte === 0)) return null;
+		const size = readOctal(block, 124, 12);
+		const type = String.fromCharCode(block[156] ?? 0);
+		const start = offset + BLOCK;
+		if (type === "0" || type === "\0") return archive.subarray(start, start + size);
+		offset = start + size + padding(size).length;
+	}
+	return null;
+}
+// src/chat/sandbox/docker/container.ts
+const SUBNET_PREFIX = "10.213";
+const CA_ANCHOR = "/etc/pki/ca-trust/source/anchors/junior-docker-sandbox.pem";
+/** Amazon Linux's combined CA bundle, rebuilt by `update-ca-trust`. */
+const SYSTEM_CA_BUNDLE = "/etc/pki/tls/certs/ca-bundle.crt";
+/** Runtimes that ignore the system trust store but read these env vars. */
+const CA_BUNDLE_ENV = [
+	"NODE_EXTRA_CA_CERTS",
+	"REQUESTS_CA_BUNDLE",
+	"SSL_CERT_FILE",
+	"CURL_CA_BUNDLE",
+	"AWS_CA_BUNDLE"
+];
+const READY_TIMEOUT_MS = 3e4;
+const READY_POLL_MS = 100;
+/**
+* PID 1 script of every sandbox container. `docker-init` runs it.
+*
+* It clears state that a snapshot or restart leaves behind, then stops the
+* container when its deadline passes. `extendTimeout` moves the deadline.
+* The ready file holds the start time of PID 1, so a check never sees the
+* ready file of an earlier start.
+*/
+const INIT_SCRIPT = `set -u
+rm -f /var/run/docker.pid /run/junior/ready
+mkdir -p /run/junior
+echo $(( $(date +%s) + JUNIOR_SANDBOX_TIMEOUT_SECONDS )) > /run/junior/deadline
+cut -d' ' -f22 /proc/1/stat > /run/junior/ready
+trap 'exit 0' TERM INT
+while :; do
+  deadline=$(cat /run/junior/deadline 2>/dev/null || echo 0)
+  [ "$(date +%s)" -ge "$deadline" ] && exit 0
+  sleep 2 & wait $!
+done
+`;
+function isStatus(error, status) {
+	return error instanceof DockerApiError && error.statusCode === status;
+}
+/** Return the name of a sandbox's egress relay container. See `relay.ts`. */
+function egressRelayName(name) {
+	return `${name}-egress`;
+}
+/** Return a sandbox name for a sandbox that the caller did not name. */
+function newSandboxName() {
+	return `junior-${randomUUID()}`;
+}
+async function listSandboxResources(kind) {
+	return await dockerJson({
+		path: kind === "containers" ? "/containers/json" : "/networks",
+		query: {
+			...kind === "containers" ? { all: true } : void 0,
+			filters: JSON.stringify({ label: [DOCKER_SANDBOX_LABEL] })
+		}
+	});
+}
+/** Remove sandbox networks whose container no longer exists. */
+async function pruneNetworks() {
+	const containers = await listSandboxResources("containers");
+	const used = new Set(containers.map((container) => container.Labels[DOCKER_SANDBOX_LABEL]));
+	const networks = await listSandboxResources("networks");
+	for (const network of networks) {
+		if (used.has(network.Labels["dev.junior.sandbox"])) continue;
+		await forceRemove(egressRelayName(network.Name));
+		await removeNetwork(network.Name);
+	}
+}
+async function createNetwork(name, signal) {
+	await pruneNetworks();
+	const networks = await listSandboxResources("networks");
+	const taken = new Set(networks.flatMap((network) => (network.IPAM.Config ?? []).map((config) => config.Subnet)));
+	for (let index = 0; index < 256; index += 1) {
+		const subnet = `${SUBNET_PREFIX}.${index}.0/24`;
+		if (taken.has(subnet)) continue;
+		try {
+			await dockerJson({
+				method: "POST",
+				path: "/networks/create",
+				body: {
+					Name: name,
+					Driver: "bridge",
+					CheckDuplicate: true,
+					IPAM: { Config: [{ Subnet: subnet }] },
+					Labels: { [DOCKER_SANDBOX_LABEL]: name }
+				},
+				signal
+			});
+			return;
+		} catch (error) {
+			if (error instanceof DockerApiError && /overlap/i.test(error.message)) continue;
+			throw error;
+		}
+	}
+	throw new Error(`No free ${SUBNET_PREFIX}.x.0/24 subnet for sandbox ${name}`);
+}
+async function removeNetwork(name) {
+	try {
+		await dockerRequest({
+			method: "DELETE",
+			path: `/networks/${encodeURIComponent(name)}`
 		});
-		return response;
-	}, 3, {
-		action: "chat.postMessage",
-		attributes
+	} catch (error) {
+		if (!isStatus(error, 404)) throw error;
+	}
+}
+async function inspect(name, signal) {
+	return await dockerJson({
+		path: `/containers/${encodeURIComponent(name)}/json`,
+		signal
 	});
-	const messageTs = parseSlackMessageTs(response.ts);
-	if (!messageTs) throw new Error("Slack message posted without ts");
+}
+function toContainer(details) {
+	const name = details.Name.replace(/^\//, "");
+	const network = details.NetworkSettings.Networks[name];
+	if (!network?.IPAddress) throw new Error(`Sandbox container ${name} has no address on its network`);
 	return {
-		ts: messageTs,
-		...input.includePermalink ? { permalink: await getSlackMessagePermalink({
-			channelId,
-			messageTs
-		}) } : void 0
+		id: details.Id,
+		name,
+		ip: network.IPAddress,
+		gateway: network.Gateway
 	};
 }
+async function waitUntilReady(id, signal) {
+	const deadline = Date.now() + READY_TIMEOUT_MS;
+	while (Date.now() < deadline) {
+		if ((await runRawExec(id, {
+			cmd: [
+				"sh",
+				"-c",
+				`[ "$(cat /run/junior/ready 2>/dev/null)" = "$(cut -d' ' -f22 /proc/1/stat)" ]`
+			],
+			root: true
+		}, signal)).exitCode === 0) return;
+		await sleep$1(READY_POLL_MS, signal);
+	}
+	throw new Error(`Sandbox container ${id} did not become ready`);
+}
+async function caCertificates(egressCaPem) {
+	const extraFile = dockerSandboxExtraCaFile();
+	const extra = extraFile ? await fs.readFile(extraFile, "utf8") : "";
+	return `${egressCaPem.trim()}\n${extra.trim()}\n`;
+}
+/** Put the egress CA into the sandbox's system trust store. */
+async function trustEgressCa(id, egressCaPem) {
+	await dockerRequest({
+		method: "PUT",
+		path: `/containers/${id}/archive`,
+		query: { path: "/" },
+		body: packTar([{
+			path: `${CA_ANCHOR.slice(1)}.new`,
+			content: Buffer.from(await caCertificates(egressCaPem)),
+			mode: 420,
+			uid: 0,
+			gid: 0
+		}])
+	});
+	const result = await runRawExec(id, {
+		cmd: [
+			"sh",
+			"-c",
+			[
+				"set -eu",
+				`if cmp -s ${CA_ANCHOR}.new ${CA_ANCHOR}; then rm ${CA_ANCHOR}.new; exit 0; fi`,
+				`mv ${CA_ANCHOR}.new ${CA_ANCHOR}`,
+				"update-ca-trust extract"
+			].join("\n")
+		],
+		root: true
+	});
+	if (result.exitCode !== 0) throw new Error(`Could not trust the egress CA: ${result.stderr}`);
+}
+async function start(name, signal) {
+	try {
+		await dockerRequest({
+			method: "POST",
+			path: `/containers/${encodeURIComponent(name)}/start`,
+			signal
+		});
+	} catch (error) {
+		if (!isStatus(error, 304)) throw error;
+	}
+}
 /**
-* Post an ephemeral Slack message. Delivery is best-effort on Slack's side, but
-* request validation and Web API behavior are centralized here.
+* Create and start one sandbox container, then wait until it is ready.
+*
+* A container that is not persistent removes itself when it stops, like a
+* Vercel Sandbox that is not persistent.
 */
-async function postSlackEphemeralMessage(input) {
-	const channelId = requireSlackConversationId(input.channelId, "Slack ephemeral message posting");
-	const userId = parseSlackUserId(input.userId);
-	if (!userId) throw new Error("Slack ephemeral message posting requires a user ID");
-	const text = requireSlackMessageText(input.text, "Slack ephemeral message posting");
-	const threadTs = input.threadTs ? requireSlackThreadTimestamp(input.threadTs, "Slack ephemeral thread message posting") : void 0;
-	return { messageTs: (await withSlackRetries(() => getSlackClient().chat.postEphemeral({
-		channel: channelId,
-		user: userId,
-		text,
-		...input.blocks?.length ? { blocks: input.blocks } : void 0,
-		...threadTs ? { thread_ts: threadTs } : void 0
-	}), 3, {
-		action: "chat.postEphemeral",
-		spanAttributes: {
-			"app.slack.channel_id": channelId,
-			"app.slack.user_id": userId,
-			...threadTs ? { "app.slack.thread_ts": threadTs } : void 0
-		}
-	})).message_ts };
+async function createContainer(input, egressCaPem) {
+	await createNetwork(input.name, input.signal);
+	try {
+		await dockerJson({
+			method: "POST",
+			path: "/containers/create",
+			query: { name: input.name },
+			body: {
+				Image: input.image,
+				Cmd: [
+					"sh",
+					"-c",
+					INIT_SCRIPT
+				],
+				User: "root",
+				WorkingDir: SANDBOX_WORKSPACE_ROOT,
+				Env: [`JUNIOR_SANDBOX_TIMEOUT_SECONDS=${Math.ceil(input.timeoutMs / 1e3)}`, ...CA_BUNDLE_ENV.map((name) => `${name}=${SYSTEM_CA_BUNDLE}`)],
+				Labels: { [DOCKER_SANDBOX_LABEL]: input.name },
+				HostConfig: {
+					Init: true,
+					Privileged: true,
+					AutoRemove: !input.persistent,
+					NetworkMode: input.name,
+					Mounts: [{
+						Type: "volume",
+						Target: "/var/lib/docker"
+					}],
+					...input.vcpus ? { NanoCpus: input.vcpus * 1e9 } : void 0
+				}
+			},
+			signal: input.signal
+		});
+	} catch (error) {
+		await removeNetwork(input.name).catch(() => void 0);
+		throw error;
+	}
+	try {
+		await start(input.name, input.signal);
+		const details = await inspect(input.name, input.signal);
+		await waitUntilReady(details.Id, input.signal);
+		await trustEgressCa(details.Id, egressCaPem);
+		return toContainer(details);
+	} catch (error) {
+		await removeContainer(input.name).catch(() => void 0);
+		throw error;
+	}
 }
-/** Upload files into a Slack conversation or thread via the shared outbound file boundary. */
-async function uploadFilesToConversation(input) {
-	const channelId = requireSlackConversationId(input.channelId, "Slack file upload");
-	const threadTs = input.threadTs ? requireSlackThreadTimestamp(input.threadTs, "Slack file upload") : void 0;
-	if (input.files.length === 0) throw new Error("Slack file upload requires at least one file");
-	const fileUploads = input.files.map((file) => {
-		const filename = file.filename.trim();
-		if (!filename) throw new Error("Slack file upload requires every file to have a filename");
-		return {
-			file: file.data,
-			filename
-		};
-	});
-	return { files: ((await withSlackRetries(() => getSlackClient().filesUploadV2({
-		channel_id: channelId,
-		...threadTs ? { thread_ts: threadTs } : void 0,
-		file_uploads: fileUploads
-	}), 3, {
-		action: "filesUploadV2",
-		spanAttributes: {
-			"app.slack.channel_id": channelId,
-			...threadTs ? { "app.slack.thread_ts": threadTs } : void 0
-		}
-	})).files ?? []).flatMap((completion) => (completion.files ?? []).map((file) => file.id ? { id: file.id } : {})) };
+/**
+* Return a running sandbox container. Start it again when it stopped.
+* A missing container throws a 404 `DockerApiError`.
+*/
+async function getContainer(name, egressCaPem, signal) {
+	let details = await inspect(name, signal);
+	if (!details.State.Running) {
+		await start(name, signal);
+		details = await inspect(name, signal);
+	}
+	await waitUntilReady(details.Id, signal);
+	await trustEgressCa(details.Id, egressCaPem);
+	return toContainer(details);
 }
-/** Add a reaction to a Slack message, treating `already_reacted` as idempotent success. */
-async function addReactionToMessage(input) {
-	const channelId = requireSlackConversationId(input.channelId, "Slack reaction");
-	const timestamp = requireSlackMessageTimestamp(input.timestamp, "Slack reaction");
-	const emoji = normalizeSlackEmojiName(input.emoji);
-	if (!emoji) throw new Error("Slack reaction requires a valid emoji alias name");
+async function forceRemove(name) {
 	try {
-		await withSlackRetries(() => getSlackClient(input.timeoutMs === void 0 ? void 0 : { timeoutMs: input.timeoutMs }).reactions.add({
-			channel: channelId,
-			timestamp,
-			name: emoji
-		}), input.timeoutMs === void 0 ? 3 : 1, {
-			action: "reactions.add",
-			idempotent: true,
-			spanAttributes: {
-				"app.slack.channel_id": channelId,
-				"app.slack.message_ts": timestamp,
-				"app.slack.reaction": emoji
+		await dockerRequest({
+			method: "DELETE",
+			path: `/containers/${encodeURIComponent(name)}`,
+			query: {
+				force: true,
+				v: true
 			}
 		});
 	} catch (error) {
-		if (error instanceof SlackActionError && error.code === "already_reacted") return { ok: true };
-		throw error;
+		if (!isStatus(error, 404) && !isStatus(error, 409)) throw error;
 	}
-	return { ok: true };
 }
-/** Remove a reaction from a Slack message, treating `no_reaction` as idempotent success. */
-async function removeReactionFromMessage(input) {
-	const channelId = requireSlackConversationId(input.channelId, "Slack reaction removal");
-	const timestamp = requireSlackMessageTimestamp(input.timestamp, "Slack reaction removal");
-	const emoji = normalizeSlackEmojiName(input.emoji);
-	if (!emoji) throw new Error("Slack reaction removal requires a valid emoji alias name");
+/**
+* Remove a sandbox container, its inner Docker volume, its egress relay, and
+* its network.
+*/
+async function removeContainer(name) {
+	await forceRemove(name);
+	await forceRemove(egressRelayName(name));
+	await removeNetwork(name);
+}
+/**
+* Stop a sandbox container and remove its egress relay. A container that is
+* not persistent goes away. The next policy update starts a new relay.
+*/
+async function stopContainer(container) {
 	try {
-		await withSlackRetries(() => getSlackClient().reactions.remove({
-			channel: channelId,
-			timestamp,
-			name: emoji
-		}), 3, {
-			action: "reactions.remove",
-			idempotent: true,
-			spanAttributes: {
-				"app.slack.channel_id": channelId,
-				"app.slack.message_ts": timestamp,
-				"app.slack.reaction": emoji
-			}
+		await dockerRequest({
+			method: "POST",
+			path: `/containers/${container.id}/stop`,
+			query: { t: 5 }
 		});
 	} catch (error) {
-		if (error instanceof SlackActionError && error.code === "no_reaction") return { ok: true };
-		throw error;
+		if (!isStatus(error, 304) && !isStatus(error, 404)) throw error;
 	}
-	return { ok: true };
+	await forceRemove(egressRelayName(container.name));
+}
+/** Move the container's stop deadline later by `durationMs`. */
+async function extendDeadline(id, durationMs) {
+	const result = await runRawExec(id, {
+		cmd: [
+			"sh",
+			"-c",
+			`d=$(cat /run/junior/deadline); echo $((d + ${Math.ceil(durationMs / 1e3)})) > /run/junior/deadline`
+		],
+		root: true
+	});
+	if (result.exitCode !== 0) throw new Error(`Could not extend sandbox timeout: ${result.stderr}`);
 }
-// src/chat/slack/status-format.ts
-const SLACK_STATUS_MAX_LENGTH = 50;
-/** Truncate a status string to fit Slack's 50-char assistant status limit. */
-function truncateStatusText(text) {
-	const trimmed = text.trim();
-	if (!trimmed) return "";
-	if (trimmed.length <= SLACK_STATUS_MAX_LENGTH) return trimmed;
-	return `${trimmed.slice(0, 47).trimEnd()}...`;
+/** The uid and gid of the sandbox user, for files that Junior writes. */
+const SANDBOX_FILE_OWNER = {
+	uid: 1e3,
+	gid: 1e3,
+	user: SANDBOX_USER
+};
+// src/chat/sandbox/docker/certificates.ts
+const CA_COMMON_NAME = "Junior Docker Sandbox Egress CA";
+const CA_VALID_DAYS = 3650;
+/** Clients reject long-lived leaf certificates, so keep them short. */
+const LEAF_VALID_DAYS = 365;
+const DAY_MS = 864e5;
+const OID = {
+	ecdsaWithSha256: "1.2.840.10045.4.3.2",
+	commonName: "2.5.4.3",
+	subjectKeyIdentifier: "2.5.29.14",
+	keyUsage: "2.5.29.15",
+	subjectAltName: "2.5.29.17",
+	basicConstraints: "2.5.29.19",
+	authorityKeyIdentifier: "2.5.29.35",
+	extKeyUsage: "2.5.29.37",
+	serverAuth: "1.3.6.1.5.5.7.3.1",
+	clientAuth: "1.3.6.1.5.5.7.3.2"
+};
+function tlv(tag, content) {
+	const length = content.length;
+	if (length < 128) return Buffer.concat([Buffer.from([tag, length]), content]);
+	const bytes = [];
+	for (let value = length; value > 0; value >>= 8) bytes.unshift(value & 255);
+	return Buffer.concat([Buffer.from([
+		tag,
+		128 | bytes.length,
+		...bytes
+	]), content]);
+}
+const sequence = (...parts) => tlv(48, Buffer.concat(parts));
+const set = (...parts) => tlv(49, Buffer.concat(parts));
+const octetString = (value) => tlv(4, value);
+const bitString = (value) => tlv(3, Buffer.concat([Buffer.from([0]), value]));
+const explicit = (index, value) => tlv(160 + index, value);
+const booleanTrue = () => tlv(1, Buffer.from([255]));
+function integer$1(value) {
+	return tlv(2, (value[0] ?? 0) & 128 ? Buffer.concat([Buffer.from([0]), value]) : value);
+}
+function oid(value) {
+	const [first = 0, second = 0, ...rest] = value.split(".").map(Number);
+	const bytes = [first * 40 + second];
+	for (const part of rest) {
+		const chunk = [part & 127];
+		for (let remaining = part >> 7; remaining > 0; remaining >>= 7) chunk.unshift(remaining & 127 | 128);
+		bytes.push(...chunk);
+	}
+	return tlv(6, Buffer.from(bytes));
 }
-// src/chat/slack/mrkdwn.ts
-/** Escape dynamic text for Slack mrkdwn without changing intended formatting. */
-function escapeSlackMrkdwnText(text) {
-	return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+function time(date) {
+	const iso = date.toISOString().replace(/[-:T]/g, "").slice(0, 14);
+	return date.getUTCFullYear() < 2050 ? tlv(23, Buffer.from(`${iso.slice(2)}Z`)) : tlv(24, Buffer.from(`${iso}Z`));
 }
-/** Escape a URL for Slack explicit link syntax while preserving query semantics. */
-function escapeSlackLinkUrl(url) {
-	return url.replaceAll("&", "&amp;").replaceAll("<", "%3C").replaceAll(">", "%3E");
+function name(commonName) {
+	return sequence(set(sequence(oid(OID.commonName), tlv(12, Buffer.from(commonName)))));
 }
-/** Build a Slack explicit link from dynamic URL and label values. */
-function formatSlackLink(url, label) {
-	return `<${escapeSlackLinkUrl(url)}|${escapeSlackMrkdwnText(label)}>`;
+function extension(id, critical, value) {
+	return sequence(oid(id), ...critical ? [booleanTrue()] : [], octetString(value));
 }
-function readInlineCodeSpan(line, start) {
-	if (line[start] !== "`") return;
-	let n = 1;
-	while (line[start + n] === "`") n++;
-	const marker = "`".repeat(n);
-	let search = start + n;
-	while (search < line.length) {
-		const close = line.indexOf(marker, search);
-		if (close === -1) return;
-		const after = close + n;
-		if (line[after] !== "`") return {
-			text: line.slice(start, after),
-			end: after
-		};
-		search = after + 1;
-	}
+function publicKeyInfo(key) {
+	return createPublicKey(key).export({
+		type: "spki",
+		format: "der"
+	});
 }
-function readExistingSlackAngleToken(line, start) {
-	if (line[start] !== "<") return;
-	const close = line.indexOf(">", start + 1);
-	if (close === -1) return;
-	const body = line.slice(start + 1, close);
-	if (/^(?:https?:\/\/|@|#|!)/.test(body)) return {
-		text: line.slice(start, close + 1),
-		end: close + 1
-	};
+function keyIdentifier(key) {
+	return createHash("sha1").update(publicKeyInfo(key)).digest();
 }
-function readMarkdownLink(line, start) {
-	if (line[start] !== "[") return;
-	const labelEnd = line.indexOf("](", start + 1);
-	if (labelEnd === -1) return;
-	const destStart = labelEnd + 2;
-	if (!line.startsWith("http://", destStart) && !line.startsWith("https://", destStart)) return;
-	const closeParens = line.indexOf(")", destStart);
-	if (closeParens === -1) return;
+function certificate(input) {
+	const serial = randomBytes(16);
+	serial[0] = (serial[0] ?? 0) & 127;
+	const algorithm = sequence(oid(OID.ecdsaWithSha256));
+	const now = Date.now();
+	const tbs = sequence(explicit(0, integer$1(Buffer.from([2]))), integer$1(serial), algorithm, input.issuer, sequence(time(/* @__PURE__ */ new Date(now - DAY_MS)), time(new Date(now + input.validDays * DAY_MS))), input.subject, publicKeyInfo(input.publicKey), explicit(3, sequence(...input.extensions)));
+	const signature = sign("sha256", tbs, {
+		key: input.signingKey,
+		dsaEncoding: "der"
+	});
+	return `-----BEGIN CERTIFICATE-----\n${sequence(tbs, algorithm, bitString(signature)).toString("base64").replace(/(.{64})/g, "$1\n").trim()}\n-----END CERTIFICATE-----\n`;
+}
+function newKey() {
+	return generateKeyPairSync("ec", { namedCurve: "prime256v1" }).privateKey;
+}
+function createCa() {
+	const key = newKey();
+	const subject = name(CA_COMMON_NAME);
 	return {
-		text: line.slice(start, closeParens + 1),
-		end: closeParens + 1
+		certPem: certificate({
+			subject,
+			issuer: subject,
+			publicKey: key,
+			signingKey: key,
+			validDays: CA_VALID_DAYS,
+			extensions: [
+				extension(OID.basicConstraints, true, sequence(booleanTrue())),
+				extension(OID.keyUsage, true, tlv(3, Buffer.from([1, 6]))),
+				extension(OID.subjectKeyIdentifier, false, octetString(keyIdentifier(key)))
+			]
+		}),
+		keyPem: key.export({
+			type: "pkcs8",
+			format: "pem"
+		}).toString()
 	};
 }
-function hasUnmatchedClosingParen(text) {
-	let balance = 0;
-	for (const ch of text) if (ch === "(") balance++;
-	else if (ch === ")") balance--;
-	return balance < 0;
-}
-function readBareUrl(line, start) {
-	let end = start;
-	while (end < line.length) {
-		const ch = line.charAt(end);
-		if (/\s/.test(ch) || ch === "<" || ch === ">" || ch === "\"" || ch === "`" || ch === "|" || ch === "*") break;
-		end++;
+async function readOrCreate(file, create) {
+	try {
+		return await fs.readFile(file, "utf8");
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
 	}
-	if (end === start) return;
-	let raw = line.slice(start, end);
-	let suffix = "";
-	const peel = () => {
-		suffix = raw.slice(-1) + suffix;
-		raw = raw.slice(0, -1);
-	};
-	const shouldPeel = () => raw.endsWith("_") || /[.,!?;:]$/.test(raw) || raw.endsWith(")") && hasUnmatchedClosingParen(raw);
-	while (raw.length > 0 && shouldPeel()) peel();
-	if (!/^https?:\/\/.+/.test(raw)) return;
-	return {
-		url: raw,
-		suffix,
-		end
-	};
+	try {
+		await fs.writeFile(file, create(), {
+			flag: "wx",
+			mode: 384
+		});
+	} catch (error) {
+		if (error.code !== "EEXIST") throw error;
+	}
+	return await fs.readFile(file, "utf8");
 }
-const BARE_SLACK_USER_ID_RE = /^@([UW](?=[A-Z0-9]*\d)[A-Z0-9]{8,})(?![\w])/;
-function readBareSlackUserMention(line, start) {
-	if (line[start] !== "@" || /\w/.test(line[start - 1] ?? "")) return;
-	const match = BARE_SLACK_USER_ID_RE.exec(line.slice(start));
-	if (!match) return;
+/**
+* Load this machine's egress CA from `dir`, or create it.
+*
+* Every Junior process on the machine shares one CA, so a sandbox trusts the
+* proxy of any process that applies its network policy.
+*/
+async function loadEgressCa(dir) {
+	await fs.mkdir(dir, {
+		recursive: true,
+		mode: 448
+	});
+	const keyFile = path.join(dir, "egress-ca-key.pem");
+	const certFile = path.join(dir, "egress-ca.pem");
+	let created;
+	const make = () => created ??= createCa();
+	const keyPem = await readOrCreate(keyFile, () => make().keyPem);
+	const certPem = await readOrCreate(certFile, () => {
+		if (!created) throw new Error(`${keyFile} exists without ${certFile}. Delete it.`);
+		return created.certPem;
+	});
+	const key = createPrivateKey(keyPem);
 	return {
-		text: `<@${match[1]}>`,
-		end: start + match[0].length
+		certPem,
+		key,
+		keyId: keyIdentifier(key),
+		subject: name(CA_COMMON_NAME)
 	};
 }
 /**
-* Wrap bare http(s) URLs and bare `@U123` Slack user IDs on a single line as
-* Slack explicit `<url>` links and `<@U123>` mentions.
+* Issue a TLS certificate for one name, signed by the egress CA.
+* It works as a server certificate and as an egress relay client certificate.
 */
-function wrapBareReferencesOnLine(line) {
-	let result = "";
-	let i = 0;
-	while (i < line.length) {
-		const codeSpan = readInlineCodeSpan(line, i);
-		if (codeSpan) {
-			result += codeSpan.text;
-			i = codeSpan.end;
-			continue;
-		}
-		const angleToken = readExistingSlackAngleToken(line, i);
-		if (angleToken) {
-			result += angleToken.text;
-			i = angleToken.end;
-			continue;
-		}
-		const mdLink = readMarkdownLink(line, i);
-		if (mdLink) {
-			result += mdLink.text;
-			i = mdLink.end;
-			continue;
-		}
-		const userMention = readBareSlackUserMention(line, i);
-		if (userMention) {
-			result += userMention.text;
-			i = userMention.end;
-			continue;
-		}
-		if (line.startsWith("https://", i) || line.startsWith("http://", i)) {
-			const parsed = readBareUrl(line, i);
-			if (parsed) {
-				result += `<${parsed.url}>${parsed.suffix}`;
-				i = parsed.end;
-				continue;
-			}
-		}
-		result += line[i];
-		i++;
+function issueLeafCertificate(ca, host, key) {
+	return certificate({
+		subject: name(host),
+		issuer: ca.subject,
+		publicKey: key,
+		signingKey: ca.key,
+		validDays: LEAF_VALID_DAYS,
+		extensions: [
+			extension(OID.basicConstraints, true, sequence()),
+			extension(OID.keyUsage, true, tlv(3, Buffer.from([7, 128]))),
+			extension(OID.extKeyUsage, false, sequence(oid(OID.serverAuth), oid(OID.clientAuth))),
+			extension(OID.subjectAltName, false, sequence(tlv(130, Buffer.from(host)))),
+			extension(OID.authorityKeyIdentifier, false, sequence(tlv(128, ca.keyId)))
+		]
+	});
+}
+/** Create the private key that this process uses for every leaf certificate. */
+function createLeafKey() {
+	return newKey();
+}
+// src/chat/sandbox/docker/runtime-image.ts
+const BASE_IMAGE = {
+	name: "amazonlinux",
+	tag: "2023"
+};
+const RUNTIME_REPOSITORY = "junior-sandbox-runtime";
+/** System packages for each runtime, installed on top of the base image. */
+const RUNTIME_PACKAGES = { node22: ["nodejs22", "nodejs22-npm"] };
+const COMMON_PACKAGES = [
+	"coreutils",
+	"diffutils",
+	"findutils",
+	"git",
+	"gzip",
+	"iptables-nft",
+	"openssl",
+	"procps-ng",
+	"shadow-utils",
+	"socat",
+	"sudo",
+	"tar",
+	"unzip",
+	"util-linux",
+	"which"
+];
+function buildScript(runtime) {
+	const packages = RUNTIME_PACKAGES[runtime];
+	if (!packages) throw new Error(`The Docker sandbox provider has no runtime ${runtime}`);
+	return [
+		"set -eu",
+		`dnf install -y --allowerasing ${[...packages, ...COMMON_PACKAGES].join(" ")}`,
+		"dnf clean all",
+		`useradd --create-home --uid 1000 ${SANDBOX_USER}`,
+		`echo '${SANDBOX_USER} ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/${SANDBOX_USER}`,
+		`chmod 0440 /etc/sudoers.d/${SANDBOX_USER}`,
+		`mkdir -p ${SANDBOX_WORKSPACE_ROOT}`,
+		`chown ${SANDBOX_USER}:${SANDBOX_USER} ${SANDBOX_WORKSPACE_ROOT}`,
+		`mkdir -p -m 1777 ${COMMAND_STATE_DIR}`
+	].join("\n");
+}
+function runtimeTag(runtime) {
+	return `${runtime}-${createHash("sha256").update(`${BASE_IMAGE.name}:${BASE_IMAGE.tag}\n${buildScript(runtime)}`).digest("hex").slice(0, 12)}`;
+}
+async function imageExists(reference) {
+	try {
+		await dockerRequest({ path: `/images/${encodeURIComponent(reference)}/json` });
+		return true;
+	} catch (error) {
+		if (error instanceof DockerApiError && error.statusCode === 404) return false;
+		throw error;
 	}
-	return result;
 }
-/**
-* Pre-wrap bare http(s) URLs outside fenced code blocks as Slack explicit
-* links, preventing Slack's auto-linker from consuming adjacent formatting
-* markers into the URL. Bare `@U123` user IDs become `<@U123>` mentions,
-* because Slack shows a bare ID as literal text.
-*
-* Uses the same fence-toggle rule as `ensureBlockSpacing` so both passes
-* agree on which lines are code.
-*/
-function wrapBareReferences(text) {
-	const lines = text.split("\n");
-	const out = [];
-	let inCodeBlock = false;
+async function pullBaseImage(signal) {
+	const lines = (await readStream(await dockerOkStream({
+		method: "POST",
+		path: "/images/create",
+		query: {
+			fromImage: BASE_IMAGE.name,
+			tag: BASE_IMAGE.tag
+		},
+		signal
+	}))).toString("utf8").split("\n");
 	for (const line of lines) {
-		if (line.trimStart().startsWith("```")) {
-			inCodeBlock = !inCodeBlock;
-			out.push(line);
-			continue;
-		}
-		out.push(inCodeBlock ? line : wrapBareReferencesOnLine(line));
+		if (!line.trim()) continue;
+		const event = JSON.parse(line);
+		if (event.error) throw new Error(`Docker pull failed: ${event.error}`);
 	}
-	return out.join("\n");
 }
-const LIST_ITEM_PATTERN = /^[-*•]\s|^\d+\.\s/;
 /**
-* Turn a follow-up paragraph inside a list item into a bullet at the same
-* indent.
+* Return the local image for a sandbox runtime. Build it on first use.
 *
-* Slack's `markdown` block keeps only one paragraph per list item. It joins
-* the other paragraphs to the top-level item's text with no space and renders
-* nested lists after them. As a bullet, the paragraph keeps its place and
-* nesting.
+* The tag holds a hash of the build script, so a changed script builds a new
+* image. Two processes may build the same image at once. The last commit wins,
+* and both images work.
 */
-function bulletListFollowUpParagraphs(text) {
-	const lines = text.split("\n");
-	let inCodeBlock = false;
-	let inList = false;
-	for (const [i, line] of lines.entries()) {
-		const trimmed = line.trimStart();
-		const isFence = trimmed.startsWith("```");
-		if (!inCodeBlock && trimmed && trimmed.length === line.length) inList = LIST_ITEM_PATTERN.test(line);
-		else if (!inCodeBlock && inList && trimmed && !isFence && lines[i - 1]?.trim() === "" && !LIST_ITEM_PATTERN.test(trimmed)) lines[i] = `${line.slice(0, line.length - trimmed.length)}- ${trimmed}`;
-		if (isFence) inCodeBlock = !inCodeBlock;
-	}
-	return lines.join("\n");
-}
-/** Insert blank lines between content blocks so Slack renders them with visual separation. */
-function ensureBlockSpacing(text) {
-	const codeBlockPattern = /^```/;
-	const lines = text.split("\n");
-	const result = [];
-	let inCodeBlock = false;
-	for (const line of lines) {
-		if (codeBlockPattern.test(line.trimStart())) {
-			if (!inCodeBlock) {
-				const prev = result.length > 0 ? result[result.length - 1] : void 0;
-				if (prev !== void 0 && prev.trim() !== "") result.push("");
+async function ensureRuntimeImage(runtime, signal) {
+	const reference = `${RUNTIME_REPOSITORY}:${runtimeTag(runtime)}`;
+	if (await imageExists(reference)) return reference;
+	const base = `${BASE_IMAGE.name}:${BASE_IMAGE.tag}`;
+	if (!await imageExists(base)) await pullBaseImage(signal);
+	const name = `junior-runtime-build-${randomUUID()}`;
+	const created = await dockerJson({
+		method: "POST",
+		path: "/containers/create",
+		query: { name },
+		body: {
+			Image: base,
+			Cmd: ["sleep", "infinity"],
+			Labels: { [DOCKER_SANDBOX_LABEL]: name }
+		},
+		signal
+	});
+	try {
+		await dockerRequest({
+			method: "POST",
+			path: `/containers/${created.Id}/start`,
+			signal
+		});
+		const result = await runRawExec(created.Id, {
+			cmd: [
+				"sh",
+				"-c",
+				buildScript(runtime)
+			],
+			root: true
+		}, signal);
+		if (result.exitCode !== 0) throw new Error(`Docker sandbox runtime ${runtime} build failed (exit ${result.exitCode}): ${result.stderr.slice(-2e3)}`);
+		const [repo, tag] = reference.split(":");
+		await dockerRequest({
+			method: "POST",
+			path: "/commit",
+			query: {
+				container: created.Id,
+				repo,
+				tag,
+				changes: `LABEL ${DOCKER_SANDBOX_LABEL}=runtime`
+			},
+			signal
+		});
+		return reference;
+	} finally {
+		await dockerRequest({
+			method: "DELETE",
+			path: `/containers/${created.Id}`,
+			query: {
+				force: true,
+				v: true
 			}
-			inCodeBlock = !inCodeBlock;
-			result.push(line);
-			continue;
-		}
-		if (inCodeBlock) {
-			result.push(line);
-			continue;
-		}
-		const prev = result.length > 0 ? result[result.length - 1] : void 0;
-		const isListItem = LIST_ITEM_PATTERN.test(line.trimStart());
-		const isListContinuation = prev !== void 0 && !isListItem && /^\s/.test(line) && (/^\s/.test(prev) || LIST_ITEM_PATTERN.test(prev));
-		if (prev !== void 0 && prev.trim() !== "" && line.trim() !== "" && !isListContinuation && !(LIST_ITEM_PATTERN.test(prev.trimStart()) && isListItem)) result.push("");
-		result.push(line);
+		}).catch(() => {});
 	}
-	return result.join("\n");
 }
+// src/chat/sandbox/snapshot/runtime.ts
+/** Runtime used to build and start reusable Sandbox snapshots. */
+const SANDBOX_RUNTIME = "node22";
+// src/chat/sandbox/docker/relay.ts
+/** Host name of the Docker host as seen from a container. */
+const RELAY_PROXY_HOST = "host.docker.internal";
+const RELAY_PORT = 15080;
+const RELAY_DIR = "/run/junior-relay";
+/** Label with the proxy port that the relay sends to. */
+const TARGET_LABEL = "dev.junior.sandbox.relay-target";
 /**
-* Normalize model-authored Slack markdown for delivery via `markdown_text`
-* or `{ type: "markdown" }` blocks.
+* Return whether sandboxes reach the proxy through a relay.
 *
-* Plugins may first rewrite ordinary Markdown. Core then applies Slack-only
-* delivery shaping: bare URL wrapping, block spacing, and list follow-up
-* paragraph bullets. Slack reply delivery owns chunking and continuation
-* markers separately.
+* On Linux, the Docker daemon runs on this host, and the sandbox network
+* gateway is a host address. Other systems run the daemon in a VM.
 */
-function normalizeSlackReplyMarkdown(text) {
-	let normalized = applyPluginFormatMarkdown(text).replace(/\r\n?/g, "\n").replace(/[ \t]+$/gm, "");
-	normalized = wrapBareReferences(normalized);
-	normalized = ensureBlockSpacing(normalized);
-	normalized = bulletListFollowUpParagraphs(normalized);
-	return normalized.replace(/\n{3,}/g, "\n\n").trim();
+function usesEgressRelay() {
+	return process.platform !== "linux";
 }
-/** Normalize assistant status text before handing it to Slack. */
-function normalizeSlackStatusText(text) {
-	const trimmed = text.trim();
-	if (!trimmed) return "";
-	return truncateStatusText(trimmed.replace(/(?:\.\s*)+$/, "").trim());
+async function inspectRelay(name) {
+	try {
+		return await dockerJson({ path: `/containers/${encodeURIComponent(name)}/json` });
+	} catch (error) {
+		if (error instanceof DockerApiError && error.statusCode === 404) return;
+		throw error;
+	}
 }
-/** Render a Slack user mention, which Slack shows as the person's name. */
-function slackMention(userId) {
-	return `<@${userId}>`;
+function relayAddress(container, relay) {
+	const ip = relay.NetworkSettings.Networks[container.name]?.IPAddress;
+	if (!ip) throw new Error(`Egress relay of ${container.name} has no address`);
+	return `${ip}:${RELAY_PORT}`;
+}
+function relayFiles(ca, container) {
+	const key = createLeafKey();
+	const files = {
+		"client.pem": issueLeafCertificate(ca, container.id, key),
+		"client-key.pem": key.export({
+			type: "pkcs8",
+			format: "pem"
+		}).toString(),
+		"ca.pem": ca.certPem
+	};
+	return packTar(Object.entries(files).map(([file, content]) => ({
+		path: `${RELAY_DIR.slice(1)}/${file}`,
+		content: Buffer.from(content),
+		mode: 384,
+		uid: 0,
+		gid: 0
+	})));
 }
-// src/chat/slack/oauth-authorization-message.ts
-const ACCOUNT_SCOPE_NOTE = "This connects only your account. I can see only what you can see.";
-/** Present private OAuth authorization with a clear action and text fallback. */
-function buildSlackOAuthAuthorizationMessage(args) {
-	return {
-		text: `${formatSlackLink(args.authorizationUrl, args.label)}. ${ACCOUNT_SCOPE_NOTE} ${args.completionText}`,
-		blocks: [{
-			type: "section",
-			text: {
-				type: "mrkdwn",
-				text: `*${escapeSlackMrkdwnText(args.label)}*\n${ACCOUNT_SCOPE_NOTE}\n${escapeSlackMrkdwnText(args.completionText)}`
+/**
+* Start the egress relay of one sandbox, or reuse it, and return the address
+* that the sandbox's redirect rules send traffic to.
+*
+* A relay sends to one proxy port. When another process applies the policy,
+* this replaces the relay so that it sends to that process's proxy.
+*/
+async function ensureEgressRelay(container, ca, proxyPort) {
+	const name = egressRelayName(container.name);
+	const existing = await inspectRelay(name);
+	if (existing?.State.Running && existing.Config.Labels[TARGET_LABEL] === String(proxyPort)) return relayAddress(container, existing);
+	if (existing) await dockerRequest({
+		method: "DELETE",
+		path: `/containers/${existing.Id}`,
+		query: { force: true }
+	});
+	const created = await dockerJson({
+		method: "POST",
+		path: "/containers/create",
+		query: { name },
+		body: {
+			Image: await ensureRuntimeImage(SANDBOX_RUNTIME),
+			Cmd: [
+				"socat",
+				`TCP-LISTEN:${RELAY_PORT},fork,reuseaddr`,
+				`OPENSSL:${RELAY_PROXY_HOST}:${proxyPort},cert=${RELAY_DIR}/client.pem,key=${RELAY_DIR}/client-key.pem,cafile=${RELAY_DIR}/ca.pem`
+			],
+			User: "root",
+			Labels: {
+				[DOCKER_SANDBOX_LABEL]: `relay:${container.name}`,
+				[TARGET_LABEL]: String(proxyPort)
 			},
-			accessory: {
-				type: "button",
-				text: {
-					type: "plain_text",
-					text: "Connect"
-				},
-				style: "primary",
-				url: args.authorizationUrl,
-				action_id: "oauth_connect"
+			HostConfig: {
+				NetworkMode: container.name,
+				ExtraHosts: [`${RELAY_PROXY_HOST}:host-gateway`]
 			}
-		}]
-	};
+		}
+	});
+	await dockerRequest({
+		method: "PUT",
+		path: `/containers/${created.Id}/archive`,
+		query: { path: "/" },
+		body: relayFiles(ca, container)
+	});
+	await dockerRequest({
+		method: "POST",
+		path: `/containers/${created.Id}/start`
+	});
+	const started = await inspectRelay(created.Id);
+	if (!started?.State.Running) throw new Error(`Egress relay of ${container.name} did not start`);
+	return relayAddress(container, started);
 }
-// src/chat/oauth-flow.ts
-const OAUTH_STATE_TTL_MS = 6e5;
-function optionalString(value) {
-	return typeof value === "string" ? value : void 0;
-}
-/** Parse OAuth callback state that was persisted before a provider redirect. */
-function parseOAuthStatePayload(value) {
-	if (!isRecord$2(value)) return;
-	if (typeof value.userId !== "string" || typeof value.provider !== "string") return;
-	const actor = value.actor === void 0 ? void 0 : actorSchema.safeParse(value.actor);
-	if (value.actor !== void 0 && (!actor || !actor.success)) return;
-	const destination = parseDestination(value.destination);
-	if (value.destination !== void 0 && !destination) return;
-	const source = value.source === void 0 ? void 0 : sourceSchema.safeParse(value.source);
-	if (value.source !== void 0 && (!source || !source.success)) return;
-	return {
-		userId: value.userId,
-		provider: value.provider,
-		...actor?.success ? { actor: actor.data } : void 0,
-		...optionalString(value.channelId) ? { channelId: optionalString(value.channelId) } : void 0,
-		...destination ? { destination } : void 0,
-		...source?.success ? { source: source.data } : void 0,
-		...optionalString(value.threadTs) ? { threadTs: optionalString(value.threadTs) } : void 0,
-		...optionalString(value.resumeConversationId) ? { resumeConversationId: optionalString(value.resumeConversationId) } : void 0,
-		...optionalString(value.resumeSessionId) ? { resumeSessionId: optionalString(value.resumeSessionId) } : void 0,
-		...optionalString(value.scope) ? { scope: optionalString(value.scope) } : void 0
-	};
-}
-/** Return the manifest-owned display label for a provider. */
-function formatProviderLabel(provider) {
-	const displayName = pluginCatalogRuntime.getDisplayName(provider);
-	if (!displayName) throw new Error(`Unknown plugin provider display name: "${provider}"`);
-	return displayName;
-}
-/** Resolve the public base URL from environment variables (JUNIOR_BASE_URL or Vercel). */
-function resolveBaseUrl() {
-	const explicit = process.env.JUNIOR_BASE_URL?.trim();
-	if (explicit) return explicit;
-	const vercelProd = process.env.VERCEL_PROJECT_PRODUCTION_URL?.trim();
-	if (vercelProd) return `https://${vercelProd}`;
-	const vercelUrl = process.env.VERCEL_URL?.trim();
-	if (vercelUrl) return `https://${vercelUrl}`;
-}
-/**
-* Authorization links must only be visible to the requesting user.
-* Try in-context private delivery first, then fall back to a DM.
-*/
-async function deliverPrivateMessage(input) {
-	let client;
-	try {
-		client = getSlackClient();
-	} catch {
-		logWarn("oauth.private_delivery.skipped", { "app.reason": "missing_bot_token" });
-		return false;
-	}
-	if (input.channelId) try {
-		if (isDmChannel(input.channelId)) await postSlackMessage({
-			channelId: input.channelId,
-			text: input.text,
-			blocks: input.blocks,
-			threadTs: input.threadTs
-		});
-		else await postSlackEphemeralMessage({
-			channelId: input.channelId,
-			userId: input.userId,
-			text: input.text,
-			blocks: input.blocks,
-			threadTs: input.threadTs
-		});
-		return "in_context";
-	} catch (error) {
-		logWarn("oauth.private_delivery.failed", {
-			"app.slack.error": error instanceof Error ? error.message : String(error),
-			"app.slack.channel": input.channelId
-		});
-	}
-	try {
-		const dmChannelId = (await withSlackRetries(() => client.conversations.open({ users: input.userId }), 3, {
-			action: "conversations.open",
-			spanAttributes: { "app.slack.user_id": input.userId }
-		})).channel?.id;
-		if (!dmChannelId) {
-			logWarn("oauth.dm.fallback.failed", { "app.reason": "no_dm_channel_id" });
-			return false;
-		}
-		await postSlackMessage({
-			channelId: dmChannelId,
-			text: input.text,
-			blocks: input.blocks
-		});
-		return "fallback_dm";
-	} catch (error) {
-		logWarn("oauth.dm.fallback.failed", { "app.slack.error": error instanceof Error ? error.message : String(error) });
-		return false;
-	}
-}
-/** Present one OAuth request through the active surface's private delivery. */
-async function deliverOAuthAuthorization(request, input) {
-	if (input.authorization) {
-		await input.authorization.deliver(request);
-		return "in_context";
-	}
-	return await deliverPrivateMessage({
-		channelId: input.channelId,
-		threadTs: input.threadTs,
-		userId: input.userId,
-		...buildSlackOAuthAuthorizationMessage(request)
-	});
-}
-/** Initiate an OAuth authorization code flow for a provider and deliver the auth link to the user. */
-async function startOAuthFlow(provider, input) {
-	const providerConfig = pluginCatalogRuntime.getOAuthConfig(provider);
-	if (!providerConfig) return {
-		ok: false,
-		error: `Provider "${provider}" does not support OAuth authorization`
-	};
-	const clientId = process.env[providerConfig.clientIdEnv]?.trim();
-	if (!clientId) return {
-		ok: false,
-		error: `Missing ${providerConfig.clientIdEnv} environment variable`
-	};
-	const baseUrl = resolveBaseUrl();
-	if (!baseUrl) return {
-		ok: false,
-		error: "Cannot determine base URL (set JUNIOR_BASE_URL or deploy to Vercel)"
-	};
-	const state = input.authorization ? await input.authorization.createState() : randomBytes(32).toString("hex");
-	const requestedScope = input.scope ?? providerConfig.scope;
-	await getStateAdapter().set(`oauth-state:${state}`, {
-		userId: input.actorId,
-		provider,
-		...input.actor ? { actor: input.actor } : void 0,
-		...input.channelId ? { channelId: input.channelId } : void 0,
-		...input.destination ? { destination: input.destination } : void 0,
-		...input.source ? { source: input.source } : void 0,
-		...input.threadTs ? { threadTs: input.threadTs } : void 0,
-		...input.resumeConversationId ? { resumeConversationId: input.resumeConversationId } : void 0,
-		...input.resumeSessionId ? { resumeSessionId: input.resumeSessionId } : void 0,
-		...requestedScope ? { scope: requestedScope } : void 0
-	}, OAUTH_STATE_TTL_MS);
-	const authorizeParams = new URLSearchParams({
-		client_id: clientId,
-		state,
-		redirect_uri: `${baseUrl}${providerConfig.callbackPath}`,
-		response_type: "code"
-	});
-	if (requestedScope) authorizeParams.set("scope", requestedScope);
-	for (const [key, value] of Object.entries(providerConfig.authorizeParams ?? {})) authorizeParams.set(key, value);
-	logInfo("jr_rpc.oauth.started", {
-		"app.credential.provider": provider,
-		...input.activeSkillName ? { "app.skill.name": input.activeSkillName } : void 0
-	});
-	return {
-		ok: true,
-		delivery: await deliverOAuthAuthorization({
-			authorizationUrl: `${providerConfig.authorizeEndpoint}?${authorizeParams.toString()}`,
-			label: `Connect your ${formatProviderLabel(provider)} account`,
-			completionText: input.resumeSessionId ? "Once you've authorized, I'll continue automatically." : "Once you've authorized, you'll see a confirmation in Slack."
-		}, {
-			authorization: input.authorization,
-			channelId: input.channelId,
-			threadTs: input.threadTs,
-			userId: input.actorId
-		})
-	};
-}
-// src/chat/sandbox/egress/oidc.ts
-const OIDC_DISCOVERY_CACHE_TTL_MS = 36e5;
-const OIDC_DISCOVERY_CACHE_MAX_ENTRIES = 8;
-const jwksByIssuer = /* @__PURE__ */ new Map();
-function buildDiscoveryUrl(issuer) {
-	const url = new URL(issuer);
-	if (url.protocol !== "https:" || url.hostname !== "oidc.vercel.com") throw new Error("Unexpected Vercel OIDC issuer");
-	url.pathname = `${url.pathname.replace(/\/$/, "")}/.well-known/openid-configuration`;
-	url.search = "";
-	url.hash = "";
-	return url;
-}
-function buildJwksUrl(value) {
-	const url = new URL(value);
-	if (url.protocol !== "https:") throw new Error("Vercel OIDC discovery jwks_uri must use HTTPS");
-	return url;
-}
-async function getJwks(issuer) {
-	const now = Date.now();
-	const cached = jwksByIssuer.get(issuer);
-	if (cached && cached.expiresAtMs > now) return cached.jwks;
-	if (cached) jwksByIssuer.delete(issuer);
-	const response = await fetch(buildDiscoveryUrl(issuer), { redirect: "error" });
-	if (!response.ok) throw new Error("Unable to load Vercel OIDC discovery metadata");
-	const config = await response.json();
-	if (!config.jwks_uri) throw new Error("Vercel OIDC discovery metadata did not include jwks_uri");
-	const jwks = createRemoteJWKSet(buildJwksUrl(config.jwks_uri));
-	if (!jwksByIssuer.has(issuer) && jwksByIssuer.size >= OIDC_DISCOVERY_CACHE_MAX_ENTRIES) {
-		const oldestIssuer = jwksByIssuer.keys().next().value;
-		if (oldestIssuer) jwksByIssuer.delete(oldestIssuer);
-	}
-	jwksByIssuer.set(issuer, {
-		jwks,
-		expiresAtMs: now + OIDC_DISCOVERY_CACHE_TTL_MS
-	});
-	return jwks;
-}
-/**
-* Verify Vercel signed this Sandbox firewall proxy request for the active VM session.
-*
-* `currentDate` is the time for the `exp` and `nbf` checks. It defaults to
-* now. Evals pass the real time because they replace `Date`.
-*/
-async function verifyVercelSandboxOidcToken(token, options = {}) {
-	const unverified = decodeJwt(token);
-	if (typeof unverified.iss !== "string") throw new Error("Vercel OIDC token did not include an issuer");
-	const jwks = await getJwks(unverified.iss);
-	return (await jwtVerify(token, jwks, {
-		issuer: unverified.iss,
-		...options.currentDate ? { currentDate: options.currentDate } : void 0
-	})).payload;
-}
-// src/chat/sandbox/egress/tracing.ts
-function isValidDomainPattern(domain) {
-	if (domain.includes("*")) return domain.startsWith("*.") && domain.indexOf("*", 1) === -1;
-	return true;
+// src/chat/sandbox/egress/tracing.ts
+function isValidDomainPattern(domain) {
+	if (domain.includes("*")) return domain.startsWith("*.") && domain.indexOf("*", 1) === -1;
+	return true;
 }
 /** Normalize exact and leading-wildcard sandbox egress trace domains. */
 function normalizeSandboxEgressTracePropagationDomains(domains) {
@@ -4325,60 +4627,1811 @@ function continueSandboxEgressTrace(request, upstreamHost, tracePropagation, cre
 		"http.request.method": request.method,
 		"url.path": redactSandboxEgressProxyPath(new URL(request.url).pathname)
 	});
-	if (!shouldPropagateSandboxEgressTrace(upstreamHost, tracePropagation) || !sentryTrace && !baggage) return run();
-	return continueTrace({
-		sentryTrace,
-		baggage
-	}, run);
+	if (!shouldPropagateSandboxEgressTrace(upstreamHost, tracePropagation) || !sentryTrace && !baggage) return run();
+	return continueTrace({
+		sentryTrace,
+		baggage
+	}, run);
+}
+/**
+* Run one sandbox egress request that its sandbox provider authenticated.
+*
+* This is the shared authorization boundary. It rejects upstream hosts that no
+* plugin owns, rejects signed credential contexts that do not match the
+* verified VM id, and only then asks the credentialed egress engine to issue
+* credentials and contact the upstream provider.
+*/
+async function executeSandboxEgressRequest(input, deps = {}) {
+	const { request, upstreamUrl } = input;
+	const activeEgressId = input.egressId;
+	const provider = resolveSandboxEgressProviderForHost(upstreamUrl.hostname);
+	if (!provider) {
+		logWarn("sandbox.egress.provider.unresolved", {
+			...sandboxEgressAttributes({
+				egressId: activeEgressId,
+				host: upstreamUrl.hostname,
+				method: request.method,
+				path: upstreamUrl.pathname,
+				status: 403
+			}),
+			...sandboxEgressRoutingAttributes(request, upstreamUrl)
+		});
+		return jsonError$1("No provider owns forwarded host", 403);
+	}
+	const credentialContext = parseSandboxEgressCredentialToken(input.credentialToken);
+	if (!credentialContext || credentialContext.egressId !== activeEgressId) {
+		logWarn("sandbox.egress.credential_context.unauthorized", {
+			...sandboxEgressAttributes({
+				egressId: activeEgressId,
+				host: upstreamUrl.hostname,
+				method: request.method,
+				path: upstreamUrl.pathname,
+				provider,
+				status: 403
+			}),
+			...sandboxEgressRoutingAttributes(request, upstreamUrl)
+		});
+		return jsonError$1("Sandbox egress credential context is not authorized", 403);
+	}
+	return await continueSandboxEgressTrace(request, upstreamUrl.hostname, deps.tracePropagation ?? {}, credentialContext, async () => await executeCredentialedEgressRequest({
+		activeEgressId,
+		credentialContext,
+		deps,
+		provider,
+		request,
+		upstreamUrl
+	}));
+}
+// src/chat/sandbox/docker/egress.ts
+const CHAIN = "JUNIOR_EGRESS";
+/** Private destinations never go to the proxy. Provider domains are public. */
+const DIRECT_RANGES = [
+	"127.0.0.0/8",
+	"10.0.0.0/8",
+	"172.16.0.0/12",
+	"192.168.0.0/16"
+];
+/**
+* Pass-through connections start in the Junior process, so a sandbox could
+* name a host-local or internal service in SNI or `Host`. Block every
+* address that is not public.
+*/
+const BLOCKED_PASS_THROUGH = new net.BlockList();
+for (const [address, prefix] of [
+	["0.0.0.0", 8],
+	["10.0.0.0", 8],
+	["100.64.0.0", 10],
+	["127.0.0.0", 8],
+	["169.254.0.0", 16],
+	["172.16.0.0", 12],
+	["192.0.0.0", 24],
+	["192.168.0.0", 16],
+	["198.18.0.0", 15],
+	["224.0.0.0", 3]
+]) BLOCKED_PASS_THROUGH.addSubnet(address, prefix, "ipv4");
+for (const [address, prefix] of [
+	["::", 128],
+	["::1", 128],
+	["64:ff9b::", 96],
+	["fc00::", 7],
+	["fe80::", 10],
+	["ff00::", 8]
+]) BLOCKED_PASS_THROUGH.addSubnet(address, prefix, "ipv6");
+const MAX_PEEK_BYTES = 65536;
+const PEEK_TIMEOUT_MS = 1e4;
+const HOP_BY_HOP = /* @__PURE__ */ new Set([
+	"connection",
+	"host",
+	"keep-alive",
+	"proxy-authenticate",
+	"proxy-authorization",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade"
+]);
+let proxyPromise;
+/** Load the egress CA. Each sandbox trusts it. */
+async function egressCaPem() {
+	return (await loadEgressCa(dockerSandboxDir())).certPem;
+}
+/**
+* Return how the proxy handles a host, and the policy domain that it matched.
+* Upstream URLs use that domain, not the host name that the sandbox sent.
+*/
+function interceptMode(route, host) {
+	const policy = route?.policy;
+	const find = (domains) => (domains ?? []).find((domain) => matchesSandboxEgressDomain(host, domain));
+	const credentialDomain = find(policy?.credentialEgress?.domains);
+	if (credentialDomain) return {
+		mode: "credential",
+		domain: credentialDomain
+	};
+	const traceDomain = find(policy?.traceHeaders?.domains);
+	if (traceDomain) return {
+		mode: "trace",
+		domain: traceDomain
+	};
+}
+/**
+* Return the path and query of an origin-form request target.
+* An absolute or `//` target could name another host, so it is rejected.
+*/
+function originFormPath(target) {
+	if (!target?.startsWith("/") || target.startsWith("//") || /[\r\n#]/.test(target)) return;
+	const url = new URL(target, "http://sandbox-request.local");
+	return `${url.pathname}${url.search}`;
+}
+/** Return the SNI host name of a complete TLS ClientHello record. */
+function parseSni(record) {
+	let offset = 43;
+	const read = (bytes) => {
+		const value = record.readUIntBE(offset, bytes);
+		offset += bytes;
+		return value;
+	};
+	const skip = (lengthBytes) => {
+		const length = read(lengthBytes);
+		offset += length;
+	};
+	try {
+		skip(1);
+		skip(2);
+		skip(1);
+		const extensionsLength = read(2);
+		const end = offset + extensionsLength;
+		while (offset + 4 <= end) {
+			const type = read(2);
+			const length = read(2);
+			if (type === 0) {
+				offset += 3;
+				const nameLength = read(2);
+				return record.toString("ascii", offset, offset + nameLength);
+			}
+			offset += length;
+		}
+	} catch {}
+}
+/** Read until the first TLS record or HTTP request head is complete. */
+function peek(socket) {
+	return new Promise((resolve, reject) => {
+		let data = Buffer.alloc(0);
+		const timer = setTimeout(() => finish(/* @__PURE__ */ new Error("peek timeout")), PEEK_TIMEOUT_MS);
+		const finish = (error, host) => {
+			clearTimeout(timer);
+			socket.off("data", onData);
+			socket.off("error", finish);
+			socket.pause();
+			if (error) reject(error);
+			else resolve({
+				data,
+				host,
+				scheme: data[0] === 22 ? "https" : "http"
+			});
+		};
+		const onData = (chunk) => {
+			data = Buffer.concat([data, chunk]);
+			if (data[0] === 22) {
+				if (data.length < 5) return;
+				const end = 5 + data.readUInt16BE(3);
+				if (data.length >= end) return finish(void 0, parseSni(data.subarray(0, end)));
+			} else {
+				const head = data.indexOf("\r\n\r\n");
+				if (head >= 0) {
+					const match = /^host:[ \t]*([^\r\n:]+)/im.exec(data.toString("latin1", 0, head));
+					return finish(void 0, match?.[1]?.trim());
+				}
+			}
+			if (data.length > MAX_PEEK_BYTES) finish(/* @__PURE__ */ new Error("request head too large"));
+		};
+		socket.on("data", onData);
+		socket.once("error", finish);
+	});
+}
+function requestHeaders$1(rawHeaders) {
+	const headers = new Headers();
+	for (let index = 0; index + 1 < rawHeaders.length; index += 2) {
+		const name = rawHeaders[index] ?? "";
+		if (HOP_BY_HOP.has(name.toLowerCase())) continue;
+		headers.append(name, rawHeaders[index + 1] ?? "");
+	}
+	return headers;
+}
+async function writeResponse(response, res) {
+	const headers = {};
+	response.headers.forEach((value, name) => {
+		if (name !== "set-cookie" && !HOP_BY_HOP.has(name)) headers[name] = value;
+	});
+	const cookies = response.headers.getSetCookie();
+	if (cookies.length > 0) headers["set-cookie"] = cookies;
+	res.writeHead(response.status, headers);
+	if (!response.body) return void res.end();
+	Readable.fromWeb(response.body).pipe(res);
+}
+/** Send a trace-domain request upstream with the policy's trace headers. */
+async function forwardWithTraceHeaders(request, route) {
+	const headers = new Headers(request.headers);
+	for (const [name, value] of Object.entries(route.policy.traceHeaders?.headers ?? {})) headers.set(name, value);
+	const upstream = await fetch(request.url, {
+		method: request.method,
+		headers,
+		body: request.body,
+		redirect: "manual",
+		duplex: "half"
+	});
+	const responseHeaders = new Headers(upstream.headers);
+	responseHeaders.delete("content-encoding");
+	responseHeaders.delete("content-length");
+	return new Response(upstream.body, {
+		status: upstream.status,
+		statusText: upstream.statusText,
+		headers: responseHeaders
+	});
+}
+async function handleRequest(proxy, connection, req, res) {
+	const route = proxy.routes.get(connection.sourceIp);
+	const host = req.headers.host?.split(":")[0]?.toLowerCase();
+	if (host !== connection.host) {
+		res.writeHead(421).end("Host does not match the TLS server name");
+		return;
+	}
+	const intercept = interceptMode(route, host);
+	if (!route || !intercept) {
+		res.writeHead(403).end("Sandbox egress route is gone");
+		return;
+	}
+	if (intercept.mode === "credential" && connection.scheme !== "https") {
+		res.writeHead(403).end("Credentialed egress requires HTTPS");
+		return;
+	}
+	const path = originFormPath(req.url);
+	if (!path) {
+		res.writeHead(400).end("Request target must be a path");
+		return;
+	}
+	const upstreamUrl = new URL(`${connection.scheme}://${intercept.domain}${path}`);
+	const hasBody = req.method !== "GET" && req.method !== "HEAD";
+	const request = new Request(upstreamUrl, {
+		method: req.method,
+		headers: requestHeaders$1(req.rawHeaders),
+		...hasBody ? {
+			body: Readable.toWeb(req),
+			duplex: "half"
+		} : void 0
+	});
+	await writeResponse(intercept.mode === "credential" ? await executeSandboxEgressRequest({
+		request,
+		egressId: route.egressId,
+		upstreamUrl,
+		credentialToken: route.policy.credentialEgress?.credentialToken
+	}) : await forwardWithTraceHeaders(request, route), res);
+}
+function secureContext(proxy, host) {
+	let context = proxy.contexts.get(host);
+	if (!context) {
+		context = tls.createSecureContext({
+			key: proxy.leafKey.export({
+				type: "pkcs8",
+				format: "pem"
+			}),
+			cert: issueLeafCertificate(proxy.ca, host, proxy.leafKey)
+		});
+		proxy.contexts.set(host, context);
+	}
+	return context;
+}
+/**
+* Check that the route's container still has this address on its own network.
+* A removed sandbox's address can come back on a new sandbox network.
+*/
+async function ownsAddress(route, sourceIp) {
+	try {
+		const details = await dockerJson({ path: `/containers/${route.egressId}/json` });
+		return details.State.Running && details.NetworkSettings.Networks[route.name]?.IPAddress === sourceIp;
+	} catch {
+		return false;
+	}
+}
+/**
+* Wrap a socket in a stream that first replays the bytes that `peek` read.
+* TLS and HTTP servers read a net.Socket's handle directly, so they would skip
+* bytes put back with `unshift`.
+*/
+function replay(socket, data) {
+	const stream = new Duplex({
+		read() {
+			socket.resume();
+		},
+		write(chunk, encoding, callback) {
+			socket.write(chunk, encoding, callback);
+		},
+		final(callback) {
+			socket.end(callback);
+		},
+		destroy(error, callback) {
+			socket.destroy(error ?? void 0);
+			callback(error);
+		}
+	});
+	stream.push(data);
+	socket.on("data", (chunk) => {
+		if (!stream.push(chunk)) socket.pause();
+	});
+	socket.on("end", () => stream.push(null));
+	socket.on("error", (error) => stream.destroy(error));
+	return stream;
+}
+/**
+* Resolve a pass-through host once and return its address. Return undefined
+* when any address is not public. The caller connects to this address, so a
+* second DNS answer cannot change the target.
+*/
+async function publicAddress(host) {
+	const records = await dns.lookup(host, {
+		all: true,
+		verbatim: true
+	}).catch(() => []);
+	return records.some((record) => BLOCKED_PASS_THROUGH.check(record.address, record.family === 6 ? "ipv6" : "ipv4")) ? void 0 : records[0]?.address;
+}
+function passThrough(socket, data, host, port) {
+	const upstream = net.connect({
+		host,
+		port
+	}, () => {
+		upstream.write(data);
+		socket.pipe(upstream);
+		upstream.pipe(socket);
+		socket.resume();
+	});
+	upstream.on("error", () => socket.destroy());
+	socket.on("error", () => upstream.destroy());
+}
+/** Return the sandbox address of a direct connection from a sandbox. */
+function directSource(socket) {
+	return (socket.remoteAddress ?? "").replace(/^::ffff:/, "");
+}
+/**
+* Return the sandbox address of a relay connection. The client certificate
+* names the sandbox's container id.
+*/
+function relaySource(proxy, socket) {
+	const egressId = socket.getPeerCertificate().subject?.CN;
+	for (const [sourceIp, route] of proxy.routes) if (route.egressId === egressId) return sourceIp;
+	return "";
+}
+async function handleConnection(proxy, server, connections, socket, sourceIp) {
+	const route = proxy.routes.get(sourceIp);
+	if (!route || !await ownsAddress(route, sourceIp)) {
+		logWarn("sandbox.egress.docker.unknown_source", { "client.address": socket.remoteAddress ?? "" });
+		socket.destroy();
+		return;
+	}
+	const { data, host: rawHost, scheme } = await peek(socket);
+	const host = rawHost?.toLowerCase();
+	if (!host) {
+		socket.destroy();
+		return;
+	}
+	if (!interceptMode(route, host)) {
+		const address = await publicAddress(host);
+		if (!address) {
+			logWarn("sandbox.egress.docker.pass_through_blocked", { "server.address": host });
+			socket.destroy();
+			return;
+		}
+		passThrough(socket, data, address, scheme === "https" ? 443 : 80);
+		return;
+	}
+	const replayed = replay(socket, data);
+	const target = scheme === "https" ? new tls.TLSSocket(replayed, {
+		isServer: true,
+		secureContext: secureContext(proxy, host),
+		ALPNProtocols: ["http/1.1"]
+	}) : replayed;
+	connections.set(target, {
+		sourceIp,
+		host,
+		scheme
+	});
+	target.on("error", () => socket.destroy());
+	server.emit("connection", target);
+}
+async function startProxy() {
+	const proxy = {
+		port: 0,
+		ca: await loadEgressCa(dockerSandboxDir()),
+		leafKey: createLeafKey(),
+		contexts: /* @__PURE__ */ new Map(),
+		routes: /* @__PURE__ */ new Map()
+	};
+	const connections = /* @__PURE__ */ new WeakMap();
+	const server = http.createServer((req, res) => {
+		const connection = connections.get(req.socket);
+		if (!connection) return void res.writeHead(500).end();
+		handleRequest(proxy, connection, req, res).catch((error) => {
+			logWarn("sandbox.egress.docker.request_failed", { "error.message": error instanceof Error ? error.message : String(error) });
+			if (!res.headersSent) res.writeHead(502);
+			res.end();
+		});
+	});
+	const handle = (socket, sourceIp) => handleConnection(proxy, server, connections, socket, sourceIp).catch(() => socket.destroy());
+	const listener = usesEgressRelay() ? tls.createServer({
+		key: proxy.leafKey.export({
+			type: "pkcs8",
+			format: "pem"
+		}),
+		cert: issueLeafCertificate(proxy.ca, RELAY_PROXY_HOST, proxy.leafKey),
+		ca: proxy.ca.certPem,
+		requestCert: true,
+		rejectUnauthorized: true
+	}, (socket) => void handle(socket, relaySource(proxy, socket))) : net.createServer((socket) => void handle(socket, directSource(socket)));
+	await new Promise((resolve, reject) => {
+		listener.once("error", reject);
+		listener.listen(0, "0.0.0.0", () => resolve());
+	});
+	listener.unref();
+	proxy.port = listener.address().port;
+	return proxy;
+}
+function getProxy() {
+	proxyPromise ??= startProxy().catch((error) => {
+		proxyPromise = void 0;
+		throw error;
+	});
+	return proxyPromise;
+}
+function rulesScript(target) {
+	const lines = [
+		"set -eu",
+		`iptables -t nat -N ${CHAIN} 2>/dev/null || iptables -t nat -F ${CHAIN}`,
+		`iptables -t nat -C OUTPUT -j ${CHAIN} 2>/dev/null || iptables -t nat -A OUTPUT -j ${CHAIN}`,
+		`iptables -t nat -C PREROUTING ! -i eth0 -j ${CHAIN} 2>/dev/null || iptables -t nat -A PREROUTING ! -i eth0 -j ${CHAIN}`
+	];
+	if (target) {
+		for (const range of DIRECT_RANGES) lines.push(`iptables -t nat -A ${CHAIN} -d ${range} -j RETURN`);
+		for (const port of [80, 443]) lines.push(`iptables -t nat -A ${CHAIN} -p tcp --dport ${port} -j DNAT --to-destination ${target}`);
+	}
+	return lines.join("\n");
+}
+function hasDomains(policy) {
+	return Boolean(policy.credentialEgress?.domains.length || policy.traceHeaders?.domains.length);
+}
+/**
+* Apply one network policy to a sandbox container.
+*
+* A policy with credentialed or trace domains sends the container's web
+* traffic to this process's proxy. `allow-all` removes the redirect.
+*/
+async function applyEgressPolicy(container, policy) {
+	let target;
+	if (policy !== "allow-all" && hasDomains(policy)) {
+		const proxy = await getProxy();
+		proxy.routes.set(container.ip, {
+			egressId: container.id,
+			name: container.name,
+			policy
+		});
+		target = usesEgressRelay() ? await ensureEgressRelay(container, proxy.ca, proxy.port) : `${container.gateway}:${proxy.port}`;
+	} else if (proxyPromise) (await proxyPromise).routes.delete(container.ip);
+	const result = await runRawExec(container.id, {
+		cmd: [
+			"sh",
+			"-c",
+			rulesScript(target)
+		],
+		root: true
+	});
+	if (result.exitCode !== 0) throw new Error(`Could not apply the sandbox network policy: ${result.stderr.trim()}`);
+}
+// src/chat/sandbox/http-error-details.ts
+const DEFAULT_PREVIEW_LIMIT = 512;
+function toTrimmedString(value, maxChars) {
+	if (typeof value !== "string") return;
+	const normalized = value.trim();
+	if (!normalized) return;
+	return normalized.length > maxChars ? `${normalized.slice(0, maxChars)}…` : normalized;
+}
+/** Extract structured HTTP error metadata (status, headers, body preview) for logging. */
+function extractHttpErrorDetails(error, options = {}) {
+	const prefix = options.attributePrefix ?? "app.http_error";
+	const previewLimit = options.previewLimit ?? DEFAULT_PREVIEW_LIMIT;
+	const normalizedError = error instanceof Error ? error : new Error(String(error));
+	const err = error ?? {};
+	const attributes = {
+		"error.type": normalizedError.name || "Error",
+		"exception.message": toTrimmedString(normalizedError.message, previewLimit) ?? "HTTP error"
+	};
+	const response = err.response;
+	const statusCode = typeof response?.status === "number" ? response.status : void 0;
+	const statusText = toTrimmedString(response?.statusText, previewLimit);
+	const responseUrl = toTrimmedString(response?.url, previewLimit);
+	const responseText = toTrimmedString(err.text, previewLimit);
+	const responseJson = toTrimmedString(err.json && typeof err.json === "object" ? JSON.stringify(err.json) : void 0, previewLimit);
+	const contentType = toTrimmedString(response?.headers?.get?.("content-type"), previewLimit);
+	const requestIdHeader = toTrimmedString(response?.headers?.get?.("x-request-id"), previewLimit);
+	const vercelIdHeader = toTrimmedString(response?.headers?.get?.("x-vercel-id"), previewLimit);
+	const requestId = requestIdHeader ?? vercelIdHeader;
+	if (statusCode !== void 0) attributes["http.response.status_code"] = statusCode;
+	if (statusText) attributes[`${prefix}.status_text`] = statusText;
+	if (responseUrl) attributes["url.full"] = responseUrl;
+	if (contentType) attributes["http.response.header.content-type"] = [contentType];
+	if (requestIdHeader) attributes["http.response.header.x-request-id"] = [requestIdHeader];
+	if (vercelIdHeader) attributes["http.response.header.x-vercel-id"] = [vercelIdHeader];
+	if (responseText) {
+		attributes[`${prefix}.response_text_preview`] = responseText;
+		attributes[`${prefix}.response_text_length`] = responseText.length;
+	}
+	if (responseJson) attributes[`${prefix}.response_json_preview`] = responseJson;
+	const summaryParts = [];
+	if (statusCode !== void 0) summaryParts.push(`status=${statusCode}`);
+	if (statusText) summaryParts.push(`statusText=${statusText}`);
+	if (responseUrl) summaryParts.push(`url=${responseUrl}`);
+	if (requestId) summaryParts.push(`requestId=${requestId}`);
+	for (const field of options.extraFields ?? []) {
+		const value = toTrimmedString(err[field.sourceKey], previewLimit);
+		if (!value) continue;
+		attributes[`${prefix}.${field.attributeKey}`] = value;
+		summaryParts.push(`${field.summaryKey ?? field.attributeKey}=${value}`);
+	}
+	if (responseJson) summaryParts.push(`json=${responseJson}`);
+	else if (responseText) summaryParts.push(`text=${responseText}`);
+	const searchableText = `${normalizedError.message} ${responseText ?? ""} ${responseJson ?? ""}`.toLowerCase();
+	return {
+		attributes,
+		summary: summaryParts.join(", "),
+		searchableText
+	};
+}
+// src/chat/sandbox/snapshot/not-ready-error.ts
+/** Report that a Workspace snapshot is not ready to use. */
+var WorkspaceSnapshotNotReadyError = class extends Error {
+	workspaceName;
+	constructor(workspaceName) {
+		super(`Workspace ${workspaceName} snapshot is not ready`);
+		this.name = "WorkspaceSnapshotNotReadyError";
+		this.workspaceName = workspaceName;
+	}
+};
+/** Return WorkspaceSnapshotNotReadyError from this error or its causes. */
+function getWorkspaceSnapshotNotReadyError(error) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	while (current instanceof Error && !seen.has(current)) {
+		if (current instanceof WorkspaceSnapshotNotReadyError) return current;
+		seen.add(current);
+		current = current.cause;
+	}
+}
+/** True when this error or a cause is WorkspaceSnapshotNotReadyError. */
+function isWorkspaceSnapshotNotReadyError(error) {
+	return getWorkspaceSnapshotNotReadyError(error) !== void 0;
+}
+/** User message when a Workspace sandbox is still preparing. */
+function workspaceSnapshotNotReadyUserMessage(error) {
+	return `The ${error.workspaceName} workspace is still preparing its sandbox. Wait for that preparation to finish, then try again.`;
+}
+// src/chat/sandbox/errors.ts
+const SANDBOX_ERROR_FIELDS = [{
+	sourceKey: "sandboxId",
+	attributeKey: "sandbox_id",
+	summaryKey: "sandboxId"
+}];
+/** Extract HTTP error details from a sandbox error for span data and checks. */
+function getSandboxErrorDetails(error) {
+	return extractHttpErrorDetails(error, {
+		attributePrefix: "app.sandbox.api_error",
+		extraFields: [...SANDBOX_ERROR_FIELDS]
+	});
+}
+/** Return true when any error in the `cause` chain matches the predicate. */
+function findInErrorChain(error, predicate) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	while (current && !seen.has(current)) {
+		if (predicate(current)) return true;
+		seen.add(current);
+		current = typeof current === "object" ? current.cause : void 0;
+	}
+	return false;
+}
+function getFirstErrorMessage(error) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	while (current && !seen.has(current)) {
+		if (current instanceof Error) {
+			const message = current.message.trim();
+			if (message) return message;
+		}
+		seen.add(current);
+		current = typeof current === "object" ? current.cause : void 0;
+	}
+}
+/** Detect sandbox filesystem operations that can safely ignore existing directories. */
+function isAlreadyExistsError(error) {
+	const details = getSandboxErrorDetails(error);
+	return details.searchableText.includes("already exists") || details.searchableText.includes("file exists") || details.searchableText.includes("eexist");
+}
+/** Detect cancellation so a durable builder stays available for check-in. */
+function isAbortError(error) {
+	return findInErrorChain(error, (candidate) => {
+		if (typeof DOMException !== "undefined" && candidate instanceof DOMException) return candidate.name === "AbortError";
+		return candidate instanceof Error && candidate.name === "AbortError";
+	});
+}
+/** Wrap setup failures. Keep WorkspaceSnapshotNotReadyError as-is. */
+function wrapSandboxSetupError(error) {
+	const notReady = getWorkspaceSnapshotNotReadyError(error);
+	if (notReady) return notReady;
+	try {
+		const details = getSandboxErrorDetails(error);
+		if (details.summary) return new Error(`sandbox setup failed (${details.summary})`, { cause: error });
+	} catch {}
+	let causeMessage;
+	try {
+		causeMessage = getFirstErrorMessage(error);
+	} catch (cause) {
+		causeMessage = cause instanceof Error ? cause.message : void 0;
+	}
+	if (causeMessage && causeMessage.trim() && causeMessage !== "sandbox setup failed") {
+		const oneLine = causeMessage.replace(/\s+/g, " ").trim();
+		return new Error(`sandbox setup failed (${oneLine})`, { cause: error });
+	}
+	return new Error("sandbox setup failed", { cause: error });
+}
+/** Record span data and throw one stable sandbox operation error. */
+function throwSandboxOperationError(action, error, includeMissingPath = false) {
+	const details = getSandboxErrorDetails(error);
+	setSpanAttributes({
+		...details.attributes,
+		...includeMissingPath ? { "app.sandbox.api_error.missing_path": details.searchableText.includes("no such file") || details.searchableText.includes("enoent") } : void 0,
+		"app.sandbox.success": false
+	});
+	throw new Error(details.summary ? `${action} failed (${details.summary})` : `${action} failed`, { cause: error });
+}
+// src/chat/sandbox/docker/errors.ts
+function apiError(error, match) {
+	return findInErrorChain(error, (candidate) => candidate instanceof DockerApiError && match(candidate));
+}
+function isMissingContainer(candidate) {
+	return candidate.statusCode === 404 && /no such container/i.test(candidate.message) || candidate.statusCode === 409 && /marked for removal|removal .*in progress/i.test(candidate.message);
+}
+function isUnavailable$1(error) {
+	return apiError(error, (candidate) => isMissingContainer(candidate) || candidate.statusCode === 409 && /is not running|is paused|restarting/i.test(candidate.message));
+}
+function isMissing$1(error) {
+	return apiError(error, isMissingContainer);
+}
+function isSnapshotMissing$1(error) {
+	return apiError(error, (candidate) => candidate.statusCode === 404 && /no such image/i.test(candidate.message));
+}
+function isTransient$1(error) {
+	return findInErrorChain(error, (candidate) => {
+		const code = candidate?.code;
+		return code === "ECONNREFUSED" || code === "ECONNRESET" || code === "EPIPE";
+	});
+}
+/** Map Docker Engine API errors to the shared sandbox error cases. */
+const dockerSandboxErrors = {
+	isUnavailable: isUnavailable$1,
+	isMissing: isMissing$1,
+	isSnapshotMissing: isSnapshotMissing$1,
+	isSnapshotting: () => false,
+	isTransient: isTransient$1,
+	isCommandStreamInterrupted: () => false
+};
+// src/chat/sandbox/docker/session.ts
+/** Image repository for every snapshot that this provider captures. */
+const SNAPSHOT_REPOSITORY = "junior-sandbox-snapshot";
+/** Go's `os.ModeDir` bit in Docker's path stat header. */
+const MODE_DIR = 2 ** 31;
+function absolute(filePath, cwd) {
+	return path.posix.resolve(cwd ?? SANDBOX_WORKSPACE_ROOT, filePath);
+}
+function notFound(filePath) {
+	return Object.assign(/* @__PURE__ */ new Error(`ENOENT: no such file or directory, '${filePath}'`), { code: "ENOENT" });
+}
+async function readFile$1(id, filePath, signal) {
+	try {
+		return unpackFirstFile(await dockerRequest({
+			path: `/containers/${id}/archive`,
+			query: { path: filePath },
+			signal
+		}));
+	} catch (error) {
+		if (error instanceof DockerApiError && error.statusCode === 404) return null;
+		throw error;
+	}
+}
+async function writeFiles(id, files, signal) {
+	const entries = files.map((file) => ({
+		path: absolute(file.path),
+		content: typeof file.content === "string" ? Buffer.from(file.content) : file.content,
+		mode: file.mode ?? 420
+	}));
+	await runRawExec(id, { cmd: [
+		"mkdir",
+		"-p",
+		...[...new Set(entries.map((entry) => path.posix.dirname(entry.path)))]
+	] }, signal);
+	await dockerRequest({
+		method: "PUT",
+		path: `/containers/${id}/archive`,
+		query: { path: "/" },
+		body: packTar(entries.map((entry) => ({
+			...entry,
+			path: entry.path.replace(/^\/+/, ""),
+			uid: SANDBOX_FILE_OWNER.uid,
+			gid: SANDBOX_FILE_OWNER.gid
+		}))),
+		signal
+	});
+}
+async function statMode(id, filePath, signal) {
+	const response = await dockerStream({
+		method: "HEAD",
+		path: `/containers/${id}/archive`,
+		query: { path: filePath },
+		signal
+	});
+	response.resume();
+	if (response.statusCode === 404) return null;
+	const header = response.headers["x-docker-container-path-stat"];
+	if ((response.statusCode ?? 0) >= 400 || typeof header !== "string") throw new DockerApiError(response.statusCode ?? 0, `stat ${filePath} failed`);
+	return JSON.parse(Buffer.from(header, "base64").toString("utf8")).mode;
+}
+function fileSystem(id) {
+	return {
+		async readFile(filePath, options) {
+			const target = absolute(filePath);
+			const content = await readFile$1(id, target, options.signal);
+			if (!content) throw notFound(target);
+			return content.toString(options.encoding);
+		},
+		async writeFile(filePath, content, options) {
+			await writeFiles(id, [{
+				path: filePath,
+				content: Buffer.from(content, options?.encoding ?? "utf8")
+			}], options?.signal);
+		},
+		async readdir(filePath, options) {
+			const target = absolute(filePath);
+			const result = await runRawExec(id, { cmd: [
+				"find",
+				target,
+				"-mindepth",
+				"1",
+				"-maxdepth",
+				"1",
+				"-printf",
+				"%f\\0"
+			] }, options?.signal);
+			if (result.exitCode !== 0) throw notFound(target);
+			return result.stdout.split("\0").filter(Boolean);
+		},
+		async stat(filePath, options) {
+			const target = absolute(filePath);
+			const mode = await statMode(id, target, options?.signal);
+			if (mode === null) throw notFound(target);
+			return { isDirectory: () => mode >= MODE_DIR };
+		}
+	};
+}
+/** Commit the container to a local image and return the image id. */
+async function commitSnapshot(id, tag, signal) {
+	return (await dockerJson({
+		method: "POST",
+		path: "/commit",
+		query: {
+			container: id,
+			repo: SNAPSHOT_REPOSITORY,
+			tag,
+			changes: `LABEL ${DOCKER_SANDBOX_LABEL}=snapshot`
+		},
+		signal
+	})).Id;
+}
+/** Junior's sandbox session contract for one running sandbox container. */
+function adaptSession$1(container, options) {
+	const { id } = container;
+	const run = async (operation) => {
+		options?.scopeSignal?.throwIfAborted();
+		try {
+			return await operation();
+		} catch (error) {
+			if (dockerSandboxErrors.isUnavailable(error)) options?.onUnavailable?.(id);
+			throw error;
+		}
+	};
+	const fs = fileSystem(id);
+	return {
+		sandboxId: container.name,
+		sessionId: id,
+		fs: {
+			readFile: (filePath, readOptions) => run(() => fs.readFile(filePath, readOptions)),
+			writeFile: (filePath, content, writeOptions) => run(() => fs.writeFile(filePath, content, writeOptions)),
+			readdir: (filePath, readOptions) => run(() => fs.readdir(filePath, readOptions)),
+			stat: (filePath, statOptions) => run(() => fs.stat(filePath, statOptions))
+		},
+		extendTimeout: (duration) => run(() => extendDeadline(id, duration)),
+		mkDir: (dirPath) => run(async () => {
+			const target = absolute(dirPath);
+			const result = await runRawExec(id, { cmd: ["mkdir", target] });
+			if (result.exitCode !== 0) throw new Error(`mkdir ${target} failed: ${result.stderr.trim()}`);
+		}),
+		readFileToBuffer: (input) => run(() => readFile$1(id, absolute(input.path, input.cwd))),
+		runCommand: (input) => run(() => runSandboxCommand(id, {
+			...input,
+			cwd: input.cwd ?? SANDBOX_WORKSPACE_ROOT,
+			signal: input.signal ?? options?.scopeSignal
+		})),
+		snapshot: (snapshotOptions) => run(async () => ({ snapshotId: await commitSnapshot(id, container.name, snapshotOptions?.signal) })),
+		stop: () => run(() => stopContainer(container)),
+		update: (params) => run(async () => {
+			if (params.networkPolicy) await applyEgressPolicy(container, params.networkPolicy);
+		}),
+		writeFiles: (files) => run(() => writeFiles(id, files))
+	};
+}
+// src/chat/sandbox/docker/provider.ts
+/** Create a sandbox container and return a session for it. */
+async function createSession(input) {
+	const image = input.snapshotId ?? await ensureRuntimeImage(input.runtime ?? "node22", input.signal);
+	const container = await createContainer({
+		name: input.name ?? newSandboxName(),
+		image,
+		timeoutMs: input.timeoutMs,
+		persistent: input.persistent ?? false,
+		vcpus: input.resources?.vcpus,
+		signal: input.signal
+	}, await egressCaPem());
+	try {
+		if (input.networkPolicy) await applyEgressPolicy(container, input.networkPolicy);
+	} catch (error) {
+		await removeContainer(container.name).catch(() => void 0);
+		throw error;
+	}
+	return adaptSession$1(container, input);
+}
+/** Return a session for a named sandbox container. Start it if it stopped. */
+async function getSession(input) {
+	return adaptSession$1(await getContainer(input.name, await egressCaPem(), input.scopeSignal), input);
+}
+/** Create the persistent container that runs one Workspace snapshot build. */
+async function createWorkspaceSnapshotBuilder$1(input) {
+	await createContainer({
+		name: input.name,
+		image: await ensureRuntimeImage(input.runtime, input.signal),
+		timeoutMs: input.timeoutMs,
+		persistent: true,
+		vcpus: input.resources?.vcpus,
+		signal: input.signal
+	}, await egressCaPem());
+}
+/**
+* Return the container that runs one Workspace snapshot build.
+*
+* A Docker snapshot is an image that does not depend on its builder. So
+* `snapshot()` removes the builder right after the commit, and the image tag
+* keeps the builder's name. Deleting the builder later removes that tag.
+*/
+async function getWorkspaceSnapshotBuilder$1(name, signal) {
+	const container = await getContainer(name, await egressCaPem(), signal);
+	return {
+		session: () => adaptSession$1(container),
+		startDetachedCommand: (input) => startDetachedCommand(container.id, input),
+		async getCommand(commandId) {
+			return { wait: ({ signal: waitSignal }) => waitForDetachedCommand(container.id, commandId, waitSignal) };
+		},
+		async snapshot(options) {
+			const snapshotId = await commitSnapshot(container.id, name, options?.signal);
+			await removeContainer(name);
+			return { snapshotId };
+		}
+	};
+}
+async function deleteSnapshotTag(name) {
+	try {
+		await dockerRequest({
+			method: "DELETE",
+			path: `/images/${encodeURIComponent(`${SNAPSHOT_REPOSITORY}:${name}`)}`,
+			query: { force: true }
+		});
+	} catch (error) {
+		if (!(error instanceof DockerApiError && error.statusCode === 404)) throw error;
+	}
+}
+/**
+* Remove Workspace builders and the snapshot images tagged with their names.
+*
+* Shared snapshot code calls this when a Workspace snapshot is no longer
+* used. Each name is tried, and the first failure is thrown at the end.
+*/
+async function deleteWorkspaceSnapshotBuilders$1(names) {
+	const failures = [];
+	for (const name of new Set(names)) for (const remove of [removeContainer, deleteSnapshotTag]) try {
+		await remove(name);
+	} catch (error) {
+		failures.push(error);
+	}
+	if (failures.length > 0) throw failures[0];
+}
+/** Local Docker implementation of the sandbox provider contract. */
+const dockerSandboxProvider = {
+	errors: dockerSandboxErrors,
+	createSession,
+	getSession,
+	createWorkspaceSnapshotBuilder: createWorkspaceSnapshotBuilder$1,
+	getWorkspaceSnapshotBuilder: getWorkspaceSnapshotBuilder$1,
+	deleteWorkspaceSnapshotBuilders: deleteWorkspaceSnapshotBuilders$1
+};
+// src/chat/sandbox/vercel/credentials.ts
+/**
+* Resolve explicit Vercel Sandbox credentials, or return undefined to let
+* the SDK read ambient Vercel auth from its own environment detection.
+*/
+function getVercelSandboxCredentials() {
+	const token = toOptionalTrimmed(process.env.VERCEL_TOKEN);
+	const teamId = toOptionalTrimmed(process.env.VERCEL_TEAM_ID);
+	const projectId = toOptionalTrimmed(process.env.VERCEL_PROJECT_ID);
+	if (token && teamId && projectId) return {
+		token,
+		teamId,
+		projectId
+	};
+}
+// src/chat/slack/post-warning.ts
+const codes = /* @__PURE__ */ new Set([
+	"invalid_metadata_format",
+	"invalid_metadata_schema",
+	"metadata_too_large",
+	"invalid_arguments",
+	"invalid_blocks",
+	"missing_scope",
+	"missing_charset",
+	"superfluous_charset",
+	"message_truncated"
+]);
+const pathFields = /* @__PURE__ */ new Set([
+	"metadata",
+	"event_type",
+	"event_payload",
+	"entities",
+	"entity_type",
+	"entity_payload",
+	"external_ref",
+	"id",
+	"type",
+	"url",
+	"attributes",
+	"title",
+	"text",
+	"display_id",
+	"display_type",
+	"product_name",
+	"fields",
+	"status",
+	"custom_fields",
+	"key",
+	"label",
+	"value",
+	"long",
+	"format",
+	"link",
+	"display_order",
+	"app_unfurl_url",
+	"app_id",
+	"created_by",
+	"created_at",
+	"updated_by",
+	"updated_at",
+	"full_size_preview",
+	"preview_url",
+	"mime_type"
+]);
+const diagnosticWords = new Set(`WARN ERROR Message message metadata was incorrectly formatted The the will be
+  ignored as a result For for event entity refer to following errors error
+  missing required field fields property properties additional unexpected unknown
+  unsupported invalid expected received actual type types must should match matches
+  matching does not is are has have of at in on and or an only allowed allow
+  value values string number integer boolean object array null minimum maximum
+  length min max items item empty nonempty too long short large small size limit
+  exceeded exceeds less greater than equal valid format schema validation failed
+  failure cannot contain contains found one any all none enum pattern definition
+  defined constraint constraints satisfy satisfies with without provided specified
+  unrecognized unrecognised recognized recognised extraneous disallowed duplicate
+  unique malformed nested root exactly needs need requires requirement supported
+  json-pointer input different schema_uri schema_id schemas additionalProperties
+  minLength maxLength minItems maxItems anyOf oneOf allOf`.split(/\s+/));
+function summarizeDiagnostic(value) {
+	return value.slice(0, 2e3).replace(/\b(?:https?:\/\/|www\.)[^\s"'`<>]+/gi, "[value]").replace(/\/[^\s"'`[\],;()]*|[\p{L}\p{N}\p{M}_]+(?:[-./:@=+%~][\p{L}\p{N}\p{M}_]+)*|[^\s\w[\]{}():,;."'`/*=<>!?+-]/gu, (token) => {
+		if (token.startsWith("/")) return token.split("/").slice(0, 17).map((part, index) => index === 0 ? "" : pathFields.has(part) ? part : "*").join("/");
+		return codes.has(token) || pathFields.has(token) || diagnosticWords.has(token) ? token : "[value]";
+	}).replace(/\s+/g, " ").slice(0, 2e3);
+}
+/** Report Slack warnings once, on the request span, without retrying the post. */
+function captureSlackPostWarning(response, attributes) {
+	const warnings = response.response_metadata?.warnings ?? [];
+	const messages = response.response_metadata?.messages ?? [];
+	const knownCodes = [...new Set(warnings.slice(0, 20).filter((code) => codes.has(code)))].sort();
+	const diagnostics = {
+		"app.slack.warning_count": warnings.length,
+		"app.slack.response_message_count": messages.length,
+		"app.slack.diagnostic_codes": knownCodes
+	};
+	setSpanAttributes(diagnostics);
+	if (!warnings.length && !messages.length) return;
+	captureMessage("Slack chat.postMessage returned warnings", {
+		level: "warning",
+		fingerprint: ["slack.chat.postMessage.warning", ...knownCodes.length ? knownCodes : ["unknown"]],
+		tags: { "app.slack.method": "chat.postMessage" },
+		extra: {
+			...getLogContextAttributes(),
+			...attributes,
+			...diagnostics,
+			"app.slack.response_diagnostics": {
+				warnings: warnings.slice(0, 20).map(summarizeDiagnostic),
+				messages: messages.slice(0, 20).map(summarizeDiagnostic)
+			}
+		}
+	});
+}
+// src/chat/slack/work-object.ts
+const url = z.url({ protocol: /^https?$/ });
+const textField = z.strictObject({
+	type: z.literal("string"),
+	key: z.string().min(1),
+	label: z.string().min(1),
+	value: z.string(),
+	long: z.boolean().optional(),
+	format: z.literal("markdown").optional(),
+	link: url.optional()
+}).refine((field) => !field.format || !field.link, { message: "Slack string fields cannot combine format and link" });
+const customField = z.discriminatedUnion("type", [textField, z.strictObject({
+	type: z.literal("slack#/types/timestamp"),
+	key: z.string().min(1),
+	label: z.string().min(1),
+	value: z.number().int(),
+	link: url.optional()
+})]);
+const payload = z.strictObject({
+	attributes: z.strictObject({
+		title: z.strictObject({ text: z.string().min(1) }),
+		display_id: z.string().optional(),
+		display_type: z.string().optional(),
+		product_name: z.string().optional(),
+		product_icon: z.strictObject({
+			url,
+			alt_text: z.string().min(1)
+		}).optional()
+	}),
+	custom_fields: z.array(customField).optional(),
+	display_order: z.array(z.string()).optional()
+});
+/** Limit IDs to Junior's safe subset; Slack silently rejects JSON punctuation. */
+const slackExternalRefIdSchema = z.string().min(1).regex(/^[A-Za-z0-9_-]+$/, "Unsupported Slack external reference ID");
+const entity = z.strictObject({
+	external_ref: z.strictObject({
+		id: slackExternalRefIdSchema,
+		type: z.string().min(1).optional()
+	}),
+	url
+});
+/** Validate notification and detail metadata before Slack can ignore bad fields. */
+const slackEntitySchema = z.discriminatedUnion("entity_type", [entity.extend({
+	entity_type: z.literal("slack#/entities/item"),
+	entity_payload: payload.extend({ fields: z.never().optional() })
+}), entity.extend({
+	entity_type: z.literal("slack#/entities/task"),
+	entity_payload: payload.extend({ fields: z.strictObject({ status: z.strictObject({ value: z.string() }).optional() }).optional() })
+})]);
+// src/chat/slack/outbound.ts
+const MAX_SLACK_MESSAGE_TEXT_CHARS = 4e4;
+function requireSlackConversationId(channelId, action) {
+	const normalized = normalizeSlackConversationId(channelId);
+	if (!normalized) throw new Error(`${action} requires a valid channel ID`);
+	return normalized;
+}
+function requireSlackThreadTimestamp(threadTs, action) {
+	const normalized = threadTs.trim();
+	if (!normalized) throw new Error(`${action} requires a thread timestamp`);
+	return normalized;
+}
+function requireSlackMessageTimestamp(timestamp, action) {
+	const normalized = parseSlackMessageTs(timestamp);
+	if (!normalized) throw new Error(`${action} requires a target message timestamp`);
+	return normalized;
+}
+function requireSlackMessageText(text, action) {
+	if (text.trim().length === 0) throw new Error(`${action} requires non-empty text`);
+	if (text.length > MAX_SLACK_MESSAGE_TEXT_CHARS) throw new Error(`${action} text exceeds Slack's 40000 character truncation limit`);
+	return text;
+}
+/** Resolve a Slack message permalink without making read-only workflows fail on lookup errors. */
+async function getSlackMessagePermalink(args) {
+	try {
+		return (await withSlackRetries(() => getSlackClient().chat.getPermalink({
+			channel: args.channelId,
+			message_ts: args.messageTs
+		}), 3, {
+			action: "chat.getPermalink",
+			idempotent: true,
+			spanAttributes: {
+				"app.slack.channel_id": args.channelId,
+				"app.slack.message_ts": args.messageTs
+			}
+		})).permalink;
+	} catch {
+		return;
+	}
+}
+/** Open the bot's direct message with one Slack user and return its channel ID. */
+async function openSlackDirectMessage(userId) {
+	const channelId = (await withSlackRetries(() => getSlackClient().conversations.open({ users: userId }), 3, { action: "conversations.open" })).channel?.id;
+	if (!channelId) throw new Error("Slack did not return a direct message channel.");
+	return channelId;
+}
+/** Post Slack `mrkdwn` text to a conversation or thread via the shared outbound boundary. */
+async function postSlackMessage(input) {
+	const channelId = requireSlackConversationId(input.channelId, "Slack message posting");
+	const text = requireSlackMessageText(input.text, "Slack message posting");
+	const entities = input.entities?.length ? slackEntitySchema.array().parse(input.entities) : void 0;
+	const threadTs = input.threadTs ? requireSlackThreadTimestamp(input.threadTs, "Slack thread message posting") : void 0;
+	const attributes = {
+		"app.slack.channel_id": channelId,
+		...threadTs ? { "app.slack.thread_ts": threadTs } : void 0,
+		"app.slack.work_object.count": entities?.length ?? 0
+	};
+	const response = await withSlackRetries(async () => {
+		const response = await getSlackClient().chat.postMessage({
+			channel: channelId,
+			text,
+			unfurl_links: false,
+			unfurl_media: false,
+			...input.blocks?.length ? { blocks: input.blocks } : void 0,
+			...entities ? { metadata: { entities } } : void 0,
+			...threadTs ? { thread_ts: threadTs } : void 0
+		});
+		const messageId = parseSlackMessageTs(response.ts);
+		setSpanAttributes({ "messaging.message.id": messageId });
+		captureSlackPostWarning(response, {
+			...attributes,
+			"messaging.message.id": messageId
+		});
+		return response;
+	}, 3, {
+		action: "chat.postMessage",
+		attributes
+	});
+	const messageTs = parseSlackMessageTs(response.ts);
+	if (!messageTs) throw new Error("Slack message posted without ts");
+	return {
+		ts: messageTs,
+		...input.includePermalink ? { permalink: await getSlackMessagePermalink({
+			channelId,
+			messageTs
+		}) } : void 0
+	};
+}
+/** Replace the text and blocks of a message that Junior posted. */
+async function updateSlackMessage(input) {
+	const channelId = requireSlackConversationId(input.channelId, "Slack message update");
+	const timestamp = requireSlackMessageTimestamp(input.timestamp, "Slack message update");
+	const text = requireSlackMessageText(input.text, "Slack message update");
+	await withSlackRetries(() => getSlackClient().chat.update({
+		blocks: input.blocks,
+		channel: channelId,
+		text,
+		ts: timestamp
+	}), 3, {
+		action: "chat.update",
+		idempotent: true,
+		spanAttributes: {
+			"app.slack.channel_id": channelId,
+			"app.slack.message_ts": timestamp
+		}
+	});
+}
+/**
+* Open a modal for the person who clicked. A `trigger_id` works once and
+* only for three seconds, so this makes one attempt.
+* https://docs.slack.dev/reference/methods/views.open
+*/
+async function openSlackModal(input) {
+	await withSlackRetries(() => getSlackClient().views.open({
+		trigger_id: input.triggerId,
+		view: input.view
+	}), 1, { action: "views.open" });
+}
+/**
+* Post an ephemeral Slack message. Delivery is best-effort on Slack's side, but
+* request validation and Web API behavior are centralized here.
+*/
+async function postSlackEphemeralMessage(input) {
+	const channelId = requireSlackConversationId(input.channelId, "Slack ephemeral message posting");
+	const userId = parseSlackUserId(input.userId);
+	if (!userId) throw new Error("Slack ephemeral message posting requires a user ID");
+	const text = requireSlackMessageText(input.text, "Slack ephemeral message posting");
+	const threadTs = input.threadTs ? requireSlackThreadTimestamp(input.threadTs, "Slack ephemeral thread message posting") : void 0;
+	return { messageTs: (await withSlackRetries(() => getSlackClient().chat.postEphemeral({
+		channel: channelId,
+		user: userId,
+		text,
+		...input.blocks?.length ? { blocks: input.blocks } : void 0,
+		...threadTs ? { thread_ts: threadTs } : void 0
+	}), 3, {
+		action: "chat.postEphemeral",
+		spanAttributes: {
+			"app.slack.channel_id": channelId,
+			"app.slack.user_id": userId,
+			...threadTs ? { "app.slack.thread_ts": threadTs } : void 0
+		}
+	})).message_ts };
+}
+/** Upload files into a Slack conversation or thread via the shared outbound file boundary. */
+async function uploadFilesToConversation(input) {
+	const channelId = requireSlackConversationId(input.channelId, "Slack file upload");
+	const threadTs = input.threadTs ? requireSlackThreadTimestamp(input.threadTs, "Slack file upload") : void 0;
+	if (input.files.length === 0) throw new Error("Slack file upload requires at least one file");
+	const fileUploads = input.files.map((file) => {
+		const filename = file.filename.trim();
+		if (!filename) throw new Error("Slack file upload requires every file to have a filename");
+		return {
+			file: file.data,
+			filename
+		};
+	});
+	return { files: ((await withSlackRetries(() => getSlackClient().filesUploadV2({
+		channel_id: channelId,
+		...threadTs ? { thread_ts: threadTs } : void 0,
+		file_uploads: fileUploads
+	}), 3, {
+		action: "filesUploadV2",
+		spanAttributes: {
+			"app.slack.channel_id": channelId,
+			...threadTs ? { "app.slack.thread_ts": threadTs } : void 0
+		}
+	})).files ?? []).flatMap((completion) => (completion.files ?? []).map((file) => file.id ? { id: file.id } : {})) };
+}
+/** Add a reaction to a Slack message, treating `already_reacted` as idempotent success. */
+async function addReactionToMessage(input) {
+	const channelId = requireSlackConversationId(input.channelId, "Slack reaction");
+	const timestamp = requireSlackMessageTimestamp(input.timestamp, "Slack reaction");
+	const emoji = normalizeSlackEmojiName(input.emoji);
+	if (!emoji) throw new Error("Slack reaction requires a valid emoji alias name");
+	try {
+		await withSlackRetries(() => getSlackClient(input.timeoutMs === void 0 ? void 0 : { timeoutMs: input.timeoutMs }).reactions.add({
+			channel: channelId,
+			timestamp,
+			name: emoji
+		}), input.timeoutMs === void 0 ? 3 : 1, {
+			action: "reactions.add",
+			idempotent: true,
+			spanAttributes: {
+				"app.slack.channel_id": channelId,
+				"app.slack.message_ts": timestamp,
+				"app.slack.reaction": emoji
+			}
+		});
+	} catch (error) {
+		if (error instanceof SlackActionError && error.code === "already_reacted") return { ok: true };
+		throw error;
+	}
+	return { ok: true };
+}
+/** Remove a reaction from a Slack message, treating `no_reaction` as idempotent success. */
+async function removeReactionFromMessage(input) {
+	const channelId = requireSlackConversationId(input.channelId, "Slack reaction removal");
+	const timestamp = requireSlackMessageTimestamp(input.timestamp, "Slack reaction removal");
+	const emoji = normalizeSlackEmojiName(input.emoji);
+	if (!emoji) throw new Error("Slack reaction removal requires a valid emoji alias name");
+	try {
+		await withSlackRetries(() => getSlackClient().reactions.remove({
+			channel: channelId,
+			timestamp,
+			name: emoji
+		}), 3, {
+			action: "reactions.remove",
+			idempotent: true,
+			spanAttributes: {
+				"app.slack.channel_id": channelId,
+				"app.slack.message_ts": timestamp,
+				"app.slack.reaction": emoji
+			}
+		});
+	} catch (error) {
+		if (error instanceof SlackActionError && error.code === "no_reaction") return { ok: true };
+		throw error;
+	}
+	return { ok: true };
+}
+// src/chat/slack/status-format.ts
+const SLACK_STATUS_MAX_LENGTH = 50;
+/** Truncate a status string to fit Slack's 50-char assistant status limit. */
+function truncateStatusText(text) {
+	const trimmed = text.trim();
+	if (!trimmed) return "";
+	if (trimmed.length <= SLACK_STATUS_MAX_LENGTH) return trimmed;
+	return `${trimmed.slice(0, 47).trimEnd()}...`;
+}
+// src/chat/slack/mrkdwn.ts
+/** Escape dynamic text for Slack mrkdwn without changing intended formatting. */
+function escapeSlackMrkdwnText(text) {
+	return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+}
+/** Escape a URL for Slack explicit link syntax while preserving query semantics. */
+function escapeSlackLinkUrl(url) {
+	return url.replaceAll("&", "&amp;").replaceAll("<", "%3C").replaceAll(">", "%3E");
+}
+/** Build a Slack explicit link from dynamic URL and label values. */
+function formatSlackLink(url, label) {
+	return `<${escapeSlackLinkUrl(url)}|${escapeSlackMrkdwnText(label)}>`;
+}
+function readInlineCodeSpan(line, start) {
+	if (line[start] !== "`") return;
+	let n = 1;
+	while (line[start + n] === "`") n++;
+	const marker = "`".repeat(n);
+	let search = start + n;
+	while (search < line.length) {
+		const close = line.indexOf(marker, search);
+		if (close === -1) return;
+		const after = close + n;
+		if (line[after] !== "`") return {
+			text: line.slice(start, after),
+			end: after
+		};
+		search = after + 1;
+	}
+}
+function readExistingSlackAngleToken(line, start) {
+	if (line[start] !== "<") return;
+	const close = line.indexOf(">", start + 1);
+	if (close === -1) return;
+	const body = line.slice(start + 1, close);
+	if (/^(?:https?:\/\/|@|#|!)/.test(body)) return {
+		text: line.slice(start, close + 1),
+		end: close + 1
+	};
+}
+function readMarkdownLink(line, start) {
+	if (line[start] !== "[") return;
+	const labelEnd = line.indexOf("](", start + 1);
+	if (labelEnd === -1) return;
+	const destStart = labelEnd + 2;
+	if (!line.startsWith("http://", destStart) && !line.startsWith("https://", destStart)) return;
+	const closeParens = line.indexOf(")", destStart);
+	if (closeParens === -1) return;
+	return {
+		text: line.slice(start, closeParens + 1),
+		end: closeParens + 1
+	};
+}
+function hasUnmatchedClosingParen(text) {
+	let balance = 0;
+	for (const ch of text) if (ch === "(") balance++;
+	else if (ch === ")") balance--;
+	return balance < 0;
+}
+function readBareUrl(line, start) {
+	let end = start;
+	while (end < line.length) {
+		const ch = line.charAt(end);
+		if (/\s/.test(ch) || ch === "<" || ch === ">" || ch === "\"" || ch === "`" || ch === "|" || ch === "*") break;
+		end++;
+	}
+	if (end === start) return;
+	let raw = line.slice(start, end);
+	let suffix = "";
+	const peel = () => {
+		suffix = raw.slice(-1) + suffix;
+		raw = raw.slice(0, -1);
+	};
+	const shouldPeel = () => raw.endsWith("_") || /[.,!?;:]$/.test(raw) || raw.endsWith(")") && hasUnmatchedClosingParen(raw);
+	while (raw.length > 0 && shouldPeel()) peel();
+	if (!/^https?:\/\/.+/.test(raw)) return;
+	return {
+		url: raw,
+		suffix,
+		end
+	};
+}
+const BARE_SLACK_USER_ID_RE = /^@([UW](?=[A-Z0-9]*\d)[A-Z0-9]{8,})(?![\w])/;
+function readBareSlackUserMention(line, start) {
+	if (line[start] !== "@" || /\w/.test(line[start - 1] ?? "")) return;
+	const match = BARE_SLACK_USER_ID_RE.exec(line.slice(start));
+	if (!match) return;
+	return {
+		text: `<@${match[1]}>`,
+		end: start + match[0].length
+	};
+}
+/**
+* Wrap bare http(s) URLs and bare `@U123` Slack user IDs on a single line as
+* Slack explicit `<url>` links and `<@U123>` mentions.
+*/
+function wrapBareReferencesOnLine(line) {
+	let result = "";
+	let i = 0;
+	while (i < line.length) {
+		const codeSpan = readInlineCodeSpan(line, i);
+		if (codeSpan) {
+			result += codeSpan.text;
+			i = codeSpan.end;
+			continue;
+		}
+		const angleToken = readExistingSlackAngleToken(line, i);
+		if (angleToken) {
+			result += angleToken.text;
+			i = angleToken.end;
+			continue;
+		}
+		const mdLink = readMarkdownLink(line, i);
+		if (mdLink) {
+			result += mdLink.text;
+			i = mdLink.end;
+			continue;
+		}
+		const userMention = readBareSlackUserMention(line, i);
+		if (userMention) {
+			result += userMention.text;
+			i = userMention.end;
+			continue;
+		}
+		if (line.startsWith("https://", i) || line.startsWith("http://", i)) {
+			const parsed = readBareUrl(line, i);
+			if (parsed) {
+				result += `<${parsed.url}>${parsed.suffix}`;
+				i = parsed.end;
+				continue;
+			}
+		}
+		result += line[i];
+		i++;
+	}
+	return result;
+}
+/**
+* Pre-wrap bare http(s) URLs outside fenced code blocks as Slack explicit
+* links, preventing Slack's auto-linker from consuming adjacent formatting
+* markers into the URL. Bare `@U123` user IDs become `<@U123>` mentions,
+* because Slack shows a bare ID as literal text.
+*
+* Uses the same fence-toggle rule as `ensureBlockSpacing` so both passes
+* agree on which lines are code.
+*/
+function wrapBareReferences(text) {
+	const lines = text.split("\n");
+	const out = [];
+	let inCodeBlock = false;
+	for (const line of lines) {
+		if (line.trimStart().startsWith("```")) {
+			inCodeBlock = !inCodeBlock;
+			out.push(line);
+			continue;
+		}
+		out.push(inCodeBlock ? line : wrapBareReferencesOnLine(line));
+	}
+	return out.join("\n");
+}
+const LIST_ITEM_PATTERN = /^[-*•]\s|^\d+\.\s/;
+/**
+* Turn a follow-up paragraph inside a list item into a bullet at the same
+* indent.
+*
+* Slack's `markdown` block keeps only one paragraph per list item. It joins
+* the other paragraphs to the top-level item's text with no space and renders
+* nested lists after them. As a bullet, the paragraph keeps its place and
+* nesting.
+*/
+function bulletListFollowUpParagraphs(text) {
+	const lines = text.split("\n");
+	let inCodeBlock = false;
+	let inList = false;
+	for (const [i, line] of lines.entries()) {
+		const trimmed = line.trimStart();
+		const isFence = trimmed.startsWith("```");
+		if (!inCodeBlock && trimmed && trimmed.length === line.length) inList = LIST_ITEM_PATTERN.test(line);
+		else if (!inCodeBlock && inList && trimmed && !isFence && lines[i - 1]?.trim() === "" && !LIST_ITEM_PATTERN.test(trimmed)) lines[i] = `${line.slice(0, line.length - trimmed.length)}- ${trimmed}`;
+		if (isFence) inCodeBlock = !inCodeBlock;
+	}
+	return lines.join("\n");
+}
+/** Insert blank lines between content blocks so Slack renders them with visual separation. */
+function ensureBlockSpacing(text) {
+	const codeBlockPattern = /^```/;
+	const lines = text.split("\n");
+	const result = [];
+	let inCodeBlock = false;
+	for (const line of lines) {
+		if (codeBlockPattern.test(line.trimStart())) {
+			if (!inCodeBlock) {
+				const prev = result.length > 0 ? result[result.length - 1] : void 0;
+				if (prev !== void 0 && prev.trim() !== "") result.push("");
+			}
+			inCodeBlock = !inCodeBlock;
+			result.push(line);
+			continue;
+		}
+		if (inCodeBlock) {
+			result.push(line);
+			continue;
+		}
+		const prev = result.length > 0 ? result[result.length - 1] : void 0;
+		const isListItem = LIST_ITEM_PATTERN.test(line.trimStart());
+		const isListContinuation = prev !== void 0 && !isListItem && /^\s/.test(line) && (/^\s/.test(prev) || LIST_ITEM_PATTERN.test(prev));
+		if (prev !== void 0 && prev.trim() !== "" && line.trim() !== "" && !isListContinuation && !(LIST_ITEM_PATTERN.test(prev.trimStart()) && isListItem)) result.push("");
+		result.push(line);
+	}
+	return result.join("\n");
+}
+/**
+* Normalize model-authored Slack markdown for delivery via `markdown_text`
+* or `{ type: "markdown" }` blocks.
+*
+* Plugins may first rewrite ordinary Markdown. Core then applies Slack-only
+* delivery shaping: bare URL wrapping, block spacing, and list follow-up
+* paragraph bullets. Slack reply delivery owns chunking and continuation
+* markers separately.
+*/
+function normalizeSlackReplyMarkdown(text) {
+	let normalized = applyPluginFormatMarkdown(text).replace(/\r\n?/g, "\n").replace(/[ \t]+$/gm, "");
+	normalized = wrapBareReferences(normalized);
+	normalized = ensureBlockSpacing(normalized);
+	normalized = bulletListFollowUpParagraphs(normalized);
+	return normalized.replace(/\n{3,}/g, "\n\n").trim();
+}
+/** Normalize assistant status text before handing it to Slack. */
+function normalizeSlackStatusText(text) {
+	const trimmed = text.trim();
+	if (!trimmed) return "";
+	return truncateStatusText(trimmed.replace(/(?:\.\s*)+$/, "").trim());
+}
+/** Render a Slack user mention, which Slack shows as the person's name. */
+function slackMention(userId) {
+	return `<@${userId}>`;
+}
+// src/chat/slack/oauth-authorization-message.ts
+const ACCOUNT_SCOPE_NOTE = "This connects only your account. I can see only what you can see.";
+/** Present private OAuth authorization with a clear action and text fallback. */
+function buildSlackOAuthAuthorizationMessage(args) {
+	return {
+		text: `${formatSlackLink(args.authorizationUrl, args.label)}. ${ACCOUNT_SCOPE_NOTE} ${args.completionText}`,
+		blocks: [{
+			type: "section",
+			text: {
+				type: "mrkdwn",
+				text: `*${escapeSlackMrkdwnText(args.label)}*\n${ACCOUNT_SCOPE_NOTE}\n${escapeSlackMrkdwnText(args.completionText)}`
+			},
+			accessory: {
+				type: "button",
+				text: {
+					type: "plain_text",
+					text: "Connect"
+				},
+				style: "primary",
+				url: args.authorizationUrl,
+				action_id: "oauth_connect"
+			}
+		}]
+	};
+}
+// src/chat/oauth-flow.ts
+const OAUTH_STATE_TTL_MS = 6e5;
+function optionalString(value) {
+	return typeof value === "string" ? value : void 0;
+}
+/** Parse OAuth callback state that was persisted before a provider redirect. */
+function parseOAuthStatePayload(value) {
+	if (!isRecord$2(value)) return;
+	if (typeof value.userId !== "string" || typeof value.provider !== "string") return;
+	const actor = value.actor === void 0 ? void 0 : actorSchema.safeParse(value.actor);
+	if (value.actor !== void 0 && (!actor || !actor.success)) return;
+	const destination = parseDestination(value.destination);
+	if (value.destination !== void 0 && !destination) return;
+	const source = value.source === void 0 ? void 0 : sourceSchema.safeParse(value.source);
+	if (value.source !== void 0 && (!source || !source.success)) return;
+	return {
+		userId: value.userId,
+		provider: value.provider,
+		...actor?.success ? { actor: actor.data } : void 0,
+		...optionalString(value.channelId) ? { channelId: optionalString(value.channelId) } : void 0,
+		...destination ? { destination } : void 0,
+		...source?.success ? { source: source.data } : void 0,
+		...optionalString(value.threadTs) ? { threadTs: optionalString(value.threadTs) } : void 0,
+		...optionalString(value.resumeConversationId) ? { resumeConversationId: optionalString(value.resumeConversationId) } : void 0,
+		...optionalString(value.resumeSessionId) ? { resumeSessionId: optionalString(value.resumeSessionId) } : void 0,
+		...optionalString(value.scope) ? { scope: optionalString(value.scope) } : void 0
+	};
+}
+/** Return the manifest-owned display label for a provider. */
+function formatProviderLabel(provider) {
+	const displayName = pluginCatalogRuntime.getDisplayName(provider);
+	if (!displayName) throw new Error(`Unknown plugin provider display name: "${provider}"`);
+	return displayName;
+}
+/** Resolve the public base URL from environment variables (JUNIOR_BASE_URL or Vercel). */
+function resolveBaseUrl() {
+	const explicit = process.env.JUNIOR_BASE_URL?.trim();
+	if (explicit) return explicit;
+	const vercelProd = process.env.VERCEL_PROJECT_PRODUCTION_URL?.trim();
+	if (vercelProd) return `https://${vercelProd}`;
+	const vercelUrl = process.env.VERCEL_URL?.trim();
+	if (vercelUrl) return `https://${vercelUrl}`;
+}
+/**
+* Authorization links must only be visible to the requesting user.
+* Try in-context private delivery first, then fall back to a DM.
+*/
+async function deliverPrivateMessage(input) {
+	let client;
+	try {
+		client = getSlackClient();
+	} catch {
+		logWarn("oauth.private_delivery.skipped", { "app.reason": "missing_bot_token" });
+		return false;
+	}
+	if (input.channelId) try {
+		if (isDmChannel(input.channelId)) await postSlackMessage({
+			channelId: input.channelId,
+			text: input.text,
+			blocks: input.blocks,
+			threadTs: input.threadTs
+		});
+		else await postSlackEphemeralMessage({
+			channelId: input.channelId,
+			userId: input.userId,
+			text: input.text,
+			blocks: input.blocks,
+			threadTs: input.threadTs
+		});
+		return "in_context";
+	} catch (error) {
+		logWarn("oauth.private_delivery.failed", {
+			"app.slack.error": error instanceof Error ? error.message : String(error),
+			"app.slack.channel": input.channelId
+		});
+	}
+	try {
+		const dmChannelId = (await withSlackRetries(() => client.conversations.open({ users: input.userId }), 3, {
+			action: "conversations.open",
+			spanAttributes: { "app.slack.user_id": input.userId }
+		})).channel?.id;
+		if (!dmChannelId) {
+			logWarn("oauth.dm.fallback.failed", { "app.reason": "no_dm_channel_id" });
+			return false;
+		}
+		await postSlackMessage({
+			channelId: dmChannelId,
+			text: input.text,
+			blocks: input.blocks
+		});
+		return "fallback_dm";
+	} catch (error) {
+		logWarn("oauth.dm.fallback.failed", { "app.slack.error": error instanceof Error ? error.message : String(error) });
+		return false;
+	}
+}
+/** Present one OAuth request through the active surface's private delivery. */
+async function deliverOAuthAuthorization(request, input) {
+	if (input.authorization) {
+		await input.authorization.deliver(request);
+		return "in_context";
+	}
+	return await deliverPrivateMessage({
+		channelId: input.channelId,
+		threadTs: input.threadTs,
+		userId: input.userId,
+		...buildSlackOAuthAuthorizationMessage(request)
+	});
+}
+/** Initiate an OAuth authorization code flow for a provider and deliver the auth link to the user. */
+async function startOAuthFlow(provider, input) {
+	const providerConfig = pluginCatalogRuntime.getOAuthConfig(provider);
+	if (!providerConfig) return {
+		ok: false,
+		error: `Provider "${provider}" does not support OAuth authorization`
+	};
+	const clientId = process.env[providerConfig.clientIdEnv]?.trim();
+	if (!clientId) return {
+		ok: false,
+		error: `Missing ${providerConfig.clientIdEnv} environment variable`
+	};
+	const baseUrl = resolveBaseUrl();
+	if (!baseUrl) return {
+		ok: false,
+		error: "Cannot determine base URL (set JUNIOR_BASE_URL or deploy to Vercel)"
+	};
+	const state = input.authorization ? await input.authorization.createState() : randomBytes(32).toString("hex");
+	const requestedScope = input.scope ?? providerConfig.scope;
+	await getStateAdapter().set(`oauth-state:${state}`, {
+		userId: input.actorId,
+		provider,
+		...input.actor ? { actor: input.actor } : void 0,
+		...input.channelId ? { channelId: input.channelId } : void 0,
+		...input.destination ? { destination: input.destination } : void 0,
+		...input.source ? { source: input.source } : void 0,
+		...input.threadTs ? { threadTs: input.threadTs } : void 0,
+		...input.resumeConversationId ? { resumeConversationId: input.resumeConversationId } : void 0,
+		...input.resumeSessionId ? { resumeSessionId: input.resumeSessionId } : void 0,
+		...requestedScope ? { scope: requestedScope } : void 0
+	}, OAUTH_STATE_TTL_MS);
+	const authorizeParams = new URLSearchParams({
+		client_id: clientId,
+		state,
+		redirect_uri: `${baseUrl}${providerConfig.callbackPath}`,
+		response_type: "code"
+	});
+	if (requestedScope) authorizeParams.set("scope", requestedScope);
+	for (const [key, value] of Object.entries(providerConfig.authorizeParams ?? {})) authorizeParams.set(key, value);
+	logInfo("jr_rpc.oauth.started", {
+		"app.credential.provider": provider,
+		...input.activeSkillName ? { "app.skill.name": input.activeSkillName } : void 0
+	});
+	return {
+		ok: true,
+		delivery: await deliverOAuthAuthorization({
+			authorizationUrl: `${providerConfig.authorizeEndpoint}?${authorizeParams.toString()}`,
+			label: `Connect your ${formatProviderLabel(provider)} account`,
+			completionText: input.resumeSessionId ? "Once you've authorized, I'll continue automatically." : "Once you've authorized, you'll see a confirmation in Slack."
+		}, {
+			authorization: input.authorization,
+			channelId: input.channelId,
+			threadTs: input.threadTs,
+			userId: input.actorId
+		})
+	};
+}
+// src/chat/sandbox/egress/oidc.ts
+const OIDC_DISCOVERY_CACHE_TTL_MS = 36e5;
+const OIDC_DISCOVERY_CACHE_MAX_ENTRIES = 8;
+const jwksByIssuer = /* @__PURE__ */ new Map();
+function buildDiscoveryUrl(issuer) {
+	const url = new URL(issuer);
+	if (url.protocol !== "https:" || url.hostname !== "oidc.vercel.com") throw new Error("Unexpected Vercel OIDC issuer");
+	url.pathname = `${url.pathname.replace(/\/$/, "")}/.well-known/openid-configuration`;
+	url.search = "";
+	url.hash = "";
+	return url;
+}
+function buildJwksUrl(value) {
+	const url = new URL(value);
+	if (url.protocol !== "https:") throw new Error("Vercel OIDC discovery jwks_uri must use HTTPS");
+	return url;
+}
+async function getJwks(issuer) {
+	const now = Date.now();
+	const cached = jwksByIssuer.get(issuer);
+	if (cached && cached.expiresAtMs > now) return cached.jwks;
+	if (cached) jwksByIssuer.delete(issuer);
+	const response = await fetch(buildDiscoveryUrl(issuer), { redirect: "error" });
+	if (!response.ok) throw new Error("Unable to load Vercel OIDC discovery metadata");
+	const config = await response.json();
+	if (!config.jwks_uri) throw new Error("Vercel OIDC discovery metadata did not include jwks_uri");
+	const jwks = createRemoteJWKSet(buildJwksUrl(config.jwks_uri));
+	if (!jwksByIssuer.has(issuer) && jwksByIssuer.size >= OIDC_DISCOVERY_CACHE_MAX_ENTRIES) {
+		const oldestIssuer = jwksByIssuer.keys().next().value;
+		if (oldestIssuer) jwksByIssuer.delete(oldestIssuer);
+	}
+	jwksByIssuer.set(issuer, {
+		jwks,
+		expiresAtMs: now + OIDC_DISCOVERY_CACHE_TTL_MS
+	});
+	return jwks;
 }
 /**
-* Run one sandbox egress request that its sandbox provider authenticated.
+* Verify Vercel signed this Sandbox firewall proxy request for the active VM session.
 *
-* This is the shared authorization boundary. It rejects upstream hosts that no
-* plugin owns, rejects signed credential contexts that do not match the
-* verified VM id, and only then asks the credentialed egress engine to issue
-* credentials and contact the upstream provider.
+* `currentDate` is the time for the `exp` and `nbf` checks. It defaults to
+* now. Evals pass the real time because they replace `Date`.
 */
-async function executeSandboxEgressRequest(input, deps = {}) {
-	const { request, upstreamUrl } = input;
-	const activeEgressId = input.egressId;
-	const provider = resolveSandboxEgressProviderForHost(upstreamUrl.hostname);
-	if (!provider) {
-		logWarn("sandbox.egress.provider.unresolved", {
-			...sandboxEgressAttributes({
-				egressId: activeEgressId,
-				host: upstreamUrl.hostname,
-				method: request.method,
-				path: upstreamUrl.pathname,
-				status: 403
-			}),
-			...sandboxEgressRoutingAttributes(request, upstreamUrl)
-		});
-		return jsonError$1("No provider owns forwarded host", 403);
-	}
-	const credentialContext = parseSandboxEgressCredentialToken(input.credentialToken);
-	if (!credentialContext || credentialContext.egressId !== activeEgressId) {
-		logWarn("sandbox.egress.credential_context.unauthorized", {
-			...sandboxEgressAttributes({
-				egressId: activeEgressId,
-				host: upstreamUrl.hostname,
-				method: request.method,
-				path: upstreamUrl.pathname,
-				provider,
-				status: 403
-			}),
-			...sandboxEgressRoutingAttributes(request, upstreamUrl)
-		});
-		return jsonError$1("Sandbox egress credential context is not authorized", 403);
-	}
-	return await continueSandboxEgressTrace(request, upstreamUrl.hostname, deps.tracePropagation ?? {}, credentialContext, async () => await executeCredentialedEgressRequest({
-		activeEgressId,
-		credentialContext,
-		deps,
-		provider,
-		request,
-		upstreamUrl
-	}));
+async function verifyVercelSandboxOidcToken(token, options = {}) {
+	const unverified = decodeJwt(token);
+	if (typeof unverified.iss !== "string") throw new Error("Vercel OIDC token did not include an issuer");
+	const jwks = await getJwks(unverified.iss);
+	return (await jwtVerify(token, jwks, {
+		issuer: unverified.iss,
+		...options.currentDate ? { currentDate: options.currentDate } : void 0
+	})).payload;
 }
 // src/chat/sandbox/egress/vercel.ts
 const OIDC_TOKEN_HEADER = "vercel-sandbox-oidc-token";
@@ -4579,171 +6632,6 @@ async function proxyVercelSandboxEgressRequest(request, deps = {}) {
 		credentialToken: credentialTokenFromRequest(request)
 	}, deps);
 }
-// src/chat/sandbox/http-error-details.ts
-const DEFAULT_PREVIEW_LIMIT = 512;
-function toTrimmedString(value, maxChars) {
-	if (typeof value !== "string") return;
-	const normalized = value.trim();
-	if (!normalized) return;
-	return normalized.length > maxChars ? `${normalized.slice(0, maxChars)}…` : normalized;
-}
-/** Extract structured HTTP error metadata (status, headers, body preview) for logging. */
-function extractHttpErrorDetails(error, options = {}) {
-	const prefix = options.attributePrefix ?? "app.http_error";
-	const previewLimit = options.previewLimit ?? DEFAULT_PREVIEW_LIMIT;
-	const normalizedError = error instanceof Error ? error : new Error(String(error));
-	const err = error ?? {};
-	const attributes = {
-		"error.type": normalizedError.name || "Error",
-		"exception.message": toTrimmedString(normalizedError.message, previewLimit) ?? "HTTP error"
-	};
-	const response = err.response;
-	const statusCode = typeof response?.status === "number" ? response.status : void 0;
-	const statusText = toTrimmedString(response?.statusText, previewLimit);
-	const responseUrl = toTrimmedString(response?.url, previewLimit);
-	const responseText = toTrimmedString(err.text, previewLimit);
-	const responseJson = toTrimmedString(err.json && typeof err.json === "object" ? JSON.stringify(err.json) : void 0, previewLimit);
-	const contentType = toTrimmedString(response?.headers?.get?.("content-type"), previewLimit);
-	const requestIdHeader = toTrimmedString(response?.headers?.get?.("x-request-id"), previewLimit);
-	const vercelIdHeader = toTrimmedString(response?.headers?.get?.("x-vercel-id"), previewLimit);
-	const requestId = requestIdHeader ?? vercelIdHeader;
-	if (statusCode !== void 0) attributes["http.response.status_code"] = statusCode;
-	if (statusText) attributes[`${prefix}.status_text`] = statusText;
-	if (responseUrl) attributes["url.full"] = responseUrl;
-	if (contentType) attributes["http.response.header.content-type"] = [contentType];
-	if (requestIdHeader) attributes["http.response.header.x-request-id"] = [requestIdHeader];
-	if (vercelIdHeader) attributes["http.response.header.x-vercel-id"] = [vercelIdHeader];
-	if (responseText) {
-		attributes[`${prefix}.response_text_preview`] = responseText;
-		attributes[`${prefix}.response_text_length`] = responseText.length;
-	}
-	if (responseJson) attributes[`${prefix}.response_json_preview`] = responseJson;
-	const summaryParts = [];
-	if (statusCode !== void 0) summaryParts.push(`status=${statusCode}`);
-	if (statusText) summaryParts.push(`statusText=${statusText}`);
-	if (responseUrl) summaryParts.push(`url=${responseUrl}`);
-	if (requestId) summaryParts.push(`requestId=${requestId}`);
-	for (const field of options.extraFields ?? []) {
-		const value = toTrimmedString(err[field.sourceKey], previewLimit);
-		if (!value) continue;
-		attributes[`${prefix}.${field.attributeKey}`] = value;
-		summaryParts.push(`${field.summaryKey ?? field.attributeKey}=${value}`);
-	}
-	if (responseJson) summaryParts.push(`json=${responseJson}`);
-	else if (responseText) summaryParts.push(`text=${responseText}`);
-	const searchableText = `${normalizedError.message} ${responseText ?? ""} ${responseJson ?? ""}`.toLowerCase();
-	return {
-		attributes,
-		summary: summaryParts.join(", "),
-		searchableText
-	};
-}
-// src/chat/sandbox/snapshot/not-ready-error.ts
-/** Report that a Workspace snapshot is not ready to use. */
-var WorkspaceSnapshotNotReadyError = class extends Error {
-	workspaceName;
-	constructor(workspaceName) {
-		super(`Workspace ${workspaceName} snapshot is not ready`);
-		this.name = "WorkspaceSnapshotNotReadyError";
-		this.workspaceName = workspaceName;
-	}
-};
-/** Return WorkspaceSnapshotNotReadyError from this error or its causes. */
-function getWorkspaceSnapshotNotReadyError(error) {
-	const seen = /* @__PURE__ */ new Set();
-	let current = error;
-	while (current instanceof Error && !seen.has(current)) {
-		if (current instanceof WorkspaceSnapshotNotReadyError) return current;
-		seen.add(current);
-		current = current.cause;
-	}
-}
-/** True when this error or a cause is WorkspaceSnapshotNotReadyError. */
-function isWorkspaceSnapshotNotReadyError(error) {
-	return getWorkspaceSnapshotNotReadyError(error) !== void 0;
-}
-/** User message when a Workspace sandbox is still preparing. */
-function workspaceSnapshotNotReadyUserMessage(error) {
-	return `The ${error.workspaceName} workspace is still preparing its sandbox. Wait for that preparation to finish, then try again.`;
-}
-// src/chat/sandbox/errors.ts
-const SANDBOX_ERROR_FIELDS = [{
-	sourceKey: "sandboxId",
-	attributeKey: "sandbox_id",
-	summaryKey: "sandboxId"
-}];
-/** Extract HTTP error details from a sandbox error for span data and checks. */
-function getSandboxErrorDetails(error) {
-	return extractHttpErrorDetails(error, {
-		attributePrefix: "app.sandbox.api_error",
-		extraFields: [...SANDBOX_ERROR_FIELDS]
-	});
-}
-/** Return true when any error in the `cause` chain matches the predicate. */
-function findInErrorChain(error, predicate) {
-	const seen = /* @__PURE__ */ new Set();
-	let current = error;
-	while (current && !seen.has(current)) {
-		if (predicate(current)) return true;
-		seen.add(current);
-		current = typeof current === "object" ? current.cause : void 0;
-	}
-	return false;
-}
-function getFirstErrorMessage(error) {
-	const seen = /* @__PURE__ */ new Set();
-	let current = error;
-	while (current && !seen.has(current)) {
-		if (current instanceof Error) {
-			const message = current.message.trim();
-			if (message) return message;
-		}
-		seen.add(current);
-		current = typeof current === "object" ? current.cause : void 0;
-	}
-}
-/** Detect sandbox filesystem operations that can safely ignore existing directories. */
-function isAlreadyExistsError(error) {
-	const details = getSandboxErrorDetails(error);
-	return details.searchableText.includes("already exists") || details.searchableText.includes("file exists") || details.searchableText.includes("eexist");
-}
-/** Detect cancellation so a durable builder stays available for check-in. */
-function isAbortError(error) {
-	return findInErrorChain(error, (candidate) => {
-		if (typeof DOMException !== "undefined" && candidate instanceof DOMException) return candidate.name === "AbortError";
-		return candidate instanceof Error && candidate.name === "AbortError";
-	});
-}
-/** Wrap setup failures. Keep WorkspaceSnapshotNotReadyError as-is. */
-function wrapSandboxSetupError(error) {
-	const notReady = getWorkspaceSnapshotNotReadyError(error);
-	if (notReady) return notReady;
-	try {
-		const details = getSandboxErrorDetails(error);
-		if (details.summary) return new Error(`sandbox setup failed (${details.summary})`, { cause: error });
-	} catch {}
-	let causeMessage;
-	try {
-		causeMessage = getFirstErrorMessage(error);
-	} catch (cause) {
-		causeMessage = cause instanceof Error ? cause.message : void 0;
-	}
-	if (causeMessage && causeMessage.trim() && causeMessage !== "sandbox setup failed") {
-		const oneLine = causeMessage.replace(/\s+/g, " ").trim();
-		return new Error(`sandbox setup failed (${oneLine})`, { cause: error });
-	}
-	return new Error("sandbox setup failed", { cause: error });
-}
-/** Record span data and throw one stable sandbox operation error. */
-function throwSandboxOperationError(action, error, includeMissingPath = false) {
-	const details = getSandboxErrorDetails(error);
-	setSpanAttributes({
-		...details.attributes,
-		...includeMissingPath ? { "app.sandbox.api_error.missing_path": details.searchableText.includes("no such file") || details.searchableText.includes("enoent") } : void 0,
-		"app.sandbox.success": false
-	});
-	throw new Error(details.summary ? `${action} failed (${details.summary})` : `${action} failed`, { cause: error });
-}
 // src/chat/sandbox/vercel/errors.ts
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null;
@@ -4975,7 +6863,7 @@ const vercelSandboxProvider = {
 // src/chat/sandbox/provider.ts
 /** Return the sandbox provider for this deployment. */
 function getSandboxProvider() {
-	return vercelSandboxProvider;
+	return getChatConfig().sandbox.provider === "docker" ? dockerSandboxProvider : vercelSandboxProvider;
 }
 // src/chat/sandbox/guest-docker.ts
 /** Docker daemon config for Vercel sandbox guests (nested containers). */
@@ -5209,9 +7097,6 @@ function isStale(profile, createdAtMs) {
 	const maxAgeMs = floatingMaxAgeMs();
 	return maxAgeMs === 0 || Date.now() - createdAtMs > maxAgeMs;
 }
-// src/chat/sandbox/snapshot/runtime.ts
-/** Runtime used to build and start reusable Sandbox snapshots. */
-const SANDBOX_RUNTIME = "node22";
 // src/chat/sandbox/snapshot/store.ts
 function builderNames(rows) {
 	return [...new Set(rows.map((row) => row.sandboxName).filter((name) => Boolean(name)))];
@@ -6202,6 +8087,7 @@ function getPluginRoutes(options) {
 					const identifiers = [...new Set(input.identifiers.map((identifier) => normalizeEventIdentifier(plugin.events, identifier)).filter(Boolean))];
 					if (identifiers.length === 0 || input.eventTypes.length === 0) return [];
 					return await options.events.neededMatchKeys({
+						...input.data ? { data: eventDataSchema.parse(input.data) } : void 0,
 						eventTypes: input.eventTypes,
 						identifiers,
 						namespace: pluginName
@@ -6482,7 +8368,7 @@ function preparationSignal(inputSignal, ownerSignal) {
 function createSandboxCapability(workspace, ownerSignal) {
 	return {
 		root: SANDBOX_WORKSPACE_ROOT,
-		juniorRoot: `${SANDBOX_WORKSPACE_ROOT}/.junior`,
+		juniorRoot: SANDBOX_JUNIOR_ROOT,
 		async readFile(filePath) {
 			return await workspace.readFileToBuffer({ path: filePath }) ?? null;
 		},
@@ -6616,6 +8502,7 @@ function createPluginHookRunner(input = {}) {
 						input: nextInput
 					},
 					users: { resolveActor: async () => input.actor ? await readActorIdentity(input.actor) : void 0 },
+					juniorRoot: SANDBOX_JUNIOR_ROOT,
 					env: {
 						get(key) {
 							return env[key] ?? normalizeEnv(nextInput.env)[key];
@@ -7570,4 +9457,4 @@ async function executeCredentialedEgressRequest(input) {
 		});
 	}
 }
-export { sandboxEgressSignalsResponseSchema as $, defaultTimezone as $n, getHeaderString as $t, setWorkspaceSnapshotBuild as A, createPluginLogger as An, RESOURCE_SUBSCRIPTION_MAX_TTL_MS as At, wrapSandboxSetupError as B, createPluginConversationEvents as Bn, getWatch as Bt, listWorkspaces as C, SANDBOX_WORKSPACE_ROOT as Cn, tryWorkspaceRepoCheckoutPath as Ct, invalidateReadySnapshot as D, createPluginState as Dn, isSlackMessageTurn as Dt, WorkspaceValidationError as E, sandboxSkillPathResolution as En, getSlackToolContext as Et, ensureDockerDaemon as F, conversationHasParticipantUser as Fn, collectEventMatchKeys as Ft, isVercelSandboxEgressRequest as G, matchSlackAttachments as Gn, bindSlackDirectCredentialSubject as Gt, getWorkspaceSnapshotNotReadyError as H, readConversationEventPage as Hn, takeDueTimerWatches as Ht, getSandboxProvider as I, conversationIsMemberRoot as In, createTimerWatch as It, consumeSandboxEgressAuthRequiredSignal as J, resolveRootVisibility as Jn, verifySlackDirectCredentialSubject as Jt, proxyVercelSandboxEgressRequest as K, readAttachmentVisionSummary as Kn, verifyEventAutomationCredentialSubject as Kt, isAbortError as L, conversationNotArchivedForEmail as Ln, createWatch as Lt, create as M, conversationArchiveTimes as Mn, STOP_WATCHING_TOOL_NAME as Mt, hash as N, conversationArchivedForEmail as Nn, cancelSubscriptions as Nt, loadSnapshotsForProfile as O, createPluginEmbedder as On, slackMessageTurnDisabledReason as Ot, isStale as P, conversationArchivedForUser as Pn, cancelWatch as Pt, parseSandboxEgressAuthRequiredSignal as Q, listConversationAnnotationsById as Qn, getFilePermalink as Qt, isAlreadyExistsError as R, conversationNotArchivedForUser as Rn, deliverWatch as Rt, getWorkspaceByName as S, SANDBOX_SKILLS_ROOT as Sn, slackExternalRefIdSchema as St, updateWorkspace as T, sandboxSkillFile as Tn, resolveChannelCapabilities as Tt, isWorkspaceSnapshotNotReadyError as U, buildSentryConversationUrl as Un, bindEventAutomationCredentialSubject as Ut, WorkspaceSnapshotNotReadyError as V, readLatestConversationBrief as Vn, listWatches as Vt, workspaceSnapshotNotReadyUserMessage as W, getSlackFileId as Wn, bindScheduledAutomationCredentialSubject as Wt, createSandboxEgressCredentialToken as X, createPluginAnnotations as Xn, SlackActionError as Xt, consumeSandboxEgressPermissionDeniedSignal as Y, saveObjectAnnotations as Yn, verifyTimerWatchCredentialSubject as Yt, parseSandboxEgressCredentialToken as Z, listConversationAnnotations as Zn, downloadPrivateSlackFile as Zt, registration_exports as _, buildNonInteractiveShellScript as _n, openSlackDirectMessage as _t, agent_hooks_exports as a, withSlackRetries as an, agentsInstructionsUpdatedEvent as ar, formatProviderLabel as at, deleteWorkspace as b, SANDBOX_DATA_ROOT as bn, uploadFilesToConversation as bt, getPluginRoutes as c, runWithWorkspaceTeamId as cn, conversationNoteEvent as cr, startOAuthFlow as ct, getPluginTools as d, getDashboardObjectIconLink as dn, normalizeSlackReplyMarkdown as dt, getSlackClient as en, resolveUserTimezone as er, buildSandboxEgressNetworkPolicy as et, getPluginUserPromptContributions as f, getDashboardTaskLink as fn, normalizeSlackStatusText as ft, coreTaskRegistrations as g, buildCommandScript as gn, getSlackMessagePermalink as gt, validatePlugins as h, PluginToolDeniedError as hn, addReactionToMessage as ht, resolvePluginOAuthAccount as i, runWithSlackInstallationToken as in, JUNIOR_NATIVE_EVENT_NAMESPACE as ir, deliverOAuthAuthorization as it, SANDBOX_RUNTIME as j, readConversationAccessFromSql as jn, RESOURCE_WATCH_TOOL_SOURCE as jt, setWorkspaceSnapshot as k, createPluginModel as kn, RESOURCE_SUBSCRIPTION_DEFAULT_TTL_MS as kt, getPluginSlackConversationLink as l, JUNIOR_THREAD_STATE_TTL_MS as ln, escapeSlackMrkdwnText as lt, setPlugins as m, ToolInputError as mn, truncateStatusText as mt, createUserTokenStore as n, isDmChannel as nn, createPluginCache as nr, resolveSandboxEgressProviderForHost as nt, createPluginHookRunner as o, sleep$1 as on, authenticationLinkedEvent as or, parseOAuthStatePayload as ot, getPlugins as p, setDashboardConversationLinkOptions as pn, slackMention as pt, clearSandboxEgressSignals as q, recordSlackAttachment as qn, verifyScheduledAutomationCredentialSubject as qt, getOAuthAccountProviders as r, normalizeSlackConversationId as rn, createCache as rr, normalizeSandboxEgressTracePropagationDomains as rt, getPluginApiRoutes as s, getWorkspaceTeamId as sn, authenticationUnlinkedEvent as sr, resolveBaseUrl as st, executeCredentialedEgressRequest as t, isConversationScopedChannel as tn, lookupSlackUser as tr, resolveSandboxCommandEnvironment as tt, getPluginSystemPromptContributions as u, getDashboardConversationLink as un, formatSlackLink as ut, setBriefsConfig as v, runNonInteractiveCommand as vn, postSlackMessage as vt, listWorkspacesByRepository as w, sandboxSkillDir as wn, workspaceRepoCheckoutPath as wt, getWorkspace as x, SANDBOX_REPOS_ROOT as xn, slackEntitySchema as xt, createWorkspace as y, SANDBOX_COMMAND_PATH as yn, removeReactionFromMessage as yt, throwSandboxOperationError as z, viewerConversationMembership as zn, findMatchingWatches as zt };
+export { postSlackMessage as $, createPluginAnnotations as $n, downloadPrivateSlackFile as $t, setWorkspaceSnapshotBuild as A, createPluginState as An, slackMessageTurnDisabledReason as At, parseOAuthStatePayload as B, conversationNotArchivedForEmail as Bn, deliverWatch as Bt, listWorkspaces as C, SANDBOX_JUNIOR_ROOT as Cn, normalizeSandboxEgressTracePropagationDomains as Ct, invalidateReadySnapshot as D, sandboxSkillDir as Dn, resolveChannelCapabilities as Dt, WorkspaceValidationError as E, SANDBOX_WORKSPACE_ROOT as En, workspaceRepoCheckoutPath as Et, getSandboxProvider as F, conversationArchiveTimes as Fn, cancelSubscriptions as Ft, normalizeSlackReplyMarkdown as G, readConversationEventPage as Gn, bindEventAutomationCredentialSubject as Gt, startOAuthFlow as H, viewerConversationMembership as Hn, getWatch as Ht, isVercelSandboxEgressRequest as I, conversationArchivedForEmail as In, cancelWatch as It, truncateStatusText as J, matchSlackAttachments as Jn, verifyEventAutomationCredentialSubject as Jt, normalizeSlackStatusText as K, buildSentryConversationUrl as Kn, bindScheduledAutomationCredentialSubject as Kt, proxyVercelSandboxEgressRequest as L, conversationArchivedForUser as Ln, collectEventMatchKeys as Lt, hash as M, createPluginModel as Mn, RESOURCE_SUBSCRIPTION_MAX_TTL_MS as Mt, isStale as N, createPluginLogger as Nn, RESOURCE_WATCH_TOOL_SOURCE as Nt, loadSnapshotsForProfile as O, sandboxSkillFile as On, getSlackToolContext as Ot, ensureDockerDaemon as P, readConversationAccessFromSql as Pn, STOP_WATCHING_TOOL_NAME as Pt, openSlackModal as Q, saveObjectAnnotations as Qn, SlackActionError as Qt, deliverOAuthAuthorization as R, conversationHasParticipantUser as Rn, createTimerWatch as Rt, getWorkspaceByName as S, SANDBOX_DATA_ROOT as Sn, resolveSandboxEgressProviderForHost as St, updateWorkspace as T, SANDBOX_SKILLS_ROOT as Tn, tryWorkspaceRepoCheckoutPath as Tt, escapeSlackMrkdwnText as U, createPluginConversationEvents as Un, listWatches as Ut, resolveBaseUrl as V, conversationNotArchivedForUser as Vn, findMatchingWatches as Vt, formatSlackLink as W, readLatestConversationBrief as Wn, takeDueTimerWatches as Wt, getSlackMessagePermalink as X, recordSlackAttachment as Xn, verifySlackDirectCredentialSubject as Xt, addReactionToMessage as Y, readAttachmentVisionSummary as Yn, verifyScheduledAutomationCredentialSubject as Yt, openSlackDirectMessage as Z, resolveRootVisibility as Zn, verifyTimerWatchCredentialSubject as Zt, registration_exports as _, PluginToolDeniedError as _n, parseSandboxEgressCredentialToken as _t, agent_hooks_exports as a, normalizeSlackConversationId as an, createPluginCache as ar, isAbortError as at, deleteWorkspace as b, runNonInteractiveCommand as bn, buildSandboxEgressNetworkPolicy as bt, getPluginRoutes as c, sleep$1 as cn, agentsInstructionsUpdatedEvent as cr, wrapSandboxSetupError as ct, getPluginTools as d, JUNIOR_THREAD_STATE_TTL_MS as dn, conversationNoteEvent as dr, isWorkspaceSnapshotNotReadyError as dt, getFilePermalink as en, listConversationAnnotations as er, removeReactionFromMessage as et, getPluginUserPromptContributions as f, getDashboardConversationLink as fn, workspaceSnapshotNotReadyUserMessage as ft, coreTaskRegistrations as g, ToolInputError as gn, createSandboxEgressCredentialToken as gt, validatePlugins as h, setDashboardConversationLinkOptions as hn, consumeSandboxEgressPermissionDeniedSignal as ht, resolvePluginOAuthAccount as i, isDmChannel as in, lookupSlackUser as ir, slackExternalRefIdSchema as it, create as j, createPluginEmbedder as jn, RESOURCE_SUBSCRIPTION_DEFAULT_TTL_MS as jt, setWorkspaceSnapshot as k, sandboxSkillPathResolution as kn, isSlackMessageTurn as kt, getPluginSlackConversationLink as l, getWorkspaceTeamId as ln, authenticationLinkedEvent as lr, WorkspaceSnapshotNotReadyError as lt, setPlugins as m, getDashboardTaskLink as mn, consumeSandboxEgressAuthRequiredSignal as mt, createUserTokenStore as n, getSlackClient as nn, defaultTimezone as nr, uploadFilesToConversation as nt, createPluginHookRunner as o, runWithSlackInstallationToken as on, createCache as or, isAlreadyExistsError as ot, getPlugins as p, getDashboardObjectIconLink as pn, clearSandboxEgressSignals as pt, slackMention as q, getSlackFileId as qn, bindSlackDirectCredentialSubject as qt, getOAuthAccountProviders as r, isConversationScopedChannel as rn, resolveUserTimezone as rr, slackEntitySchema as rt, getPluginApiRoutes as s, withSlackRetries as sn, JUNIOR_NATIVE_EVENT_NAMESPACE as sr, throwSandboxOperationError as st, executeCredentialedEgressRequest as t, getHeaderString as tn, listConversationAnnotationsById as tr, updateSlackMessage as tt, getPluginSystemPromptContributions as u, runWithWorkspaceTeamId as un, authenticationUnlinkedEvent as ur, getWorkspaceSnapshotNotReadyError as ut, setBriefsConfig as v, buildCommandScript as vn, parseSandboxEgressAuthRequiredSignal as vt, listWorkspacesByRepository as w, SANDBOX_REPOS_ROOT as wn, SANDBOX_RUNTIME as wt, getWorkspace as x, SANDBOX_COMMAND_PATH as xn, resolveSandboxCommandEnvironment as xt, createWorkspace as y, buildNonInteractiveShellScript as yn, sandboxEgressSignalsResponseSchema as yt, formatProviderLabel as z, conversationIsMemberRoot as zn, createWatch as zt };