@sentry/junior 0.3.0 → 0.4.1

package/dist/{chunk-DPTR2FNH.js → chunk-OZFXD5IG.js}

@@ -7,7 +7,7 @@ import {
 import {
   discoverInstalledPluginPackageContent,
   discoverProjectRoots
-} from "./chunk-SP6LV35L.js";
+} from "./chunk-Z5E25LRN.js";
 
 // src/chat/config.ts
 var MIN_AGENT_TURN_TIMEOUT_MS = 10 * 1e3;
@@ -554,7 +554,9 @@ function getPrivateKey(envName) {
     );
   }
   if (key.asymmetricKeyType !== "rsa") {
-    throw new Error(`Invalid ${envName}: GitHub App signing requires an RSA private key`);
+    throw new Error(
+      `Invalid ${envName}: GitHub App signing requires an RSA private key`
+    );
   }
   return key;
 }
@@ -609,7 +611,14 @@ function capabilityToPermissions(capability, pluginName) {
 function createGitHubAppBroker(manifest, credentials) {
   const tokenCache = /* @__PURE__ */ new Map();
   const provider = manifest.name;
-  const { apiDomains, authTokenEnv, appIdEnv, privateKeyEnv, installationIdEnv } = credentials;
+  const {
+    apiDomains,
+    apiHeaders,
+    authTokenEnv,
+    appIdEnv,
+    privateKeyEnv,
+    installationIdEnv
+  } = credentials;
   const apiBase = `https://${apiDomains[0]}`;
   const placeholder = resolveAuthTokenPlaceholder(credentials);
   return {
@@ -640,6 +649,7 @@ function createGitHubAppBroker(manifest, credentials) {
           headerTransforms: apiDomains.map((domain) => ({
             domain,
             headers: {
+              ...apiHeaders ?? {},
               Authorization: `Bearer ${cached.token}`
             }
           })),
@@ -659,17 +669,16 @@ function createGitHubAppBroker(manifest, credentials) {
       if (repositoryName) {
         tokenRequestBody.repositories = [repositoryName];
       }
-      const accessTokenResponse = await githubRequest(
-        apiBase,
-        `/app/installations/${installationId}/access_tokens`,
-        {
-          method: "POST",
-          token: appJwt,
-          body: tokenRequestBody
-        }
-      );
+      const accessTokenResponse = await githubRequest(apiBase, `/app/installations/${installationId}/access_tokens`, {
+        method: "POST",
+        token: appJwt,
+        body: tokenRequestBody
+      });
       const providerExpiresAtMs = Date.parse(accessTokenResponse.expires_at);
-      const expiresAtMs = Math.min(providerExpiresAtMs, Date.now() + MAX_LEASE_MS);
+      const expiresAtMs = Math.min(
+        providerExpiresAtMs,
+        Date.now() + MAX_LEASE_MS
+      );
       tokenCache.set(cacheKey, {
         installationId,
         token: accessTokenResponse.token,
@@ -683,6 +692,7 @@ function createGitHubAppBroker(manifest, credentials) {
         headerTransforms: apiDomains.map((domain) => ({
           domain,
           headers: {
+            ...apiHeaders ?? {},
             Authorization: `Bearer ${accessTokenResponse.token}`
           }
         })),
@@ -710,6 +720,70 @@ var CredentialUnavailableError = class extends Error {
   }
 };
 
+// src/chat/plugins/oauth-request.ts
+var DEFAULT_TOKEN_CONTENT_TYPE = "application/x-www-form-urlencoded";
+function requireNonEmptyTokenField(data, field) {
+  const value = data[field];
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error(`OAuth token response missing ${field}`);
+  }
+  return value;
+}
+function contentTypeToBody(contentType, payload) {
+  const mediaType = contentType.split(";", 1)[0]?.trim().toLowerCase();
+  if (!mediaType || mediaType === DEFAULT_TOKEN_CONTENT_TYPE) {
+    return new URLSearchParams(payload);
+  }
+  if (mediaType === "application/json" || mediaType.endsWith("+json")) {
+    return JSON.stringify(payload);
+  }
+  throw new Error(`Unsupported OAuth token Content-Type: ${contentType}`);
+}
+function buildOAuthTokenRequest(input) {
+  const headers = new Headers({ Accept: "application/json" });
+  for (const [name, value] of Object.entries(input.tokenExtraHeaders ?? {})) {
+    headers.set(name, value);
+  }
+  if (!headers.has("Content-Type")) {
+    headers.set("Content-Type", DEFAULT_TOKEN_CONTENT_TYPE);
+  }
+  const payload = { ...input.payload };
+  if (input.tokenAuthMethod === "basic") {
+    headers.set(
+      "Authorization",
+      `Basic ${Buffer.from(`${input.clientId}:${input.clientSecret}`).toString("base64")}`
+    );
+  } else {
+    payload.client_id = input.clientId;
+    payload.client_secret = input.clientSecret;
+  }
+  const contentType = headers.get("Content-Type") ?? DEFAULT_TOKEN_CONTENT_TYPE;
+  const serializedHeaders = {};
+  headers.forEach((value, key) => {
+    serializedHeaders[key] = value;
+  });
+  return {
+    headers: serializedHeaders,
+    body: contentTypeToBody(contentType, payload)
+  };
+}
+function parseOAuthTokenResponse(data) {
+  const accessToken = requireNonEmptyTokenField(data, "access_token");
+  const refreshToken = requireNonEmptyTokenField(data, "refresh_token");
+  const expiresIn = data.expires_in;
+  if (expiresIn === void 0) {
+    return { accessToken, refreshToken };
+  }
+  if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || expiresIn <= 0) {
+    throw new Error("OAuth token response returned invalid expires_in");
+  }
+  return {
+    accessToken,
+    refreshToken,
+    expiresAt: Date.now() + expiresIn * 1e3
+  };
+}
+
 // src/chat/plugins/oauth-bearer-broker.ts
 var MAX_LEASE_MS2 = 60 * 60 * 1e3;
 var REFRESH_BUFFER_MS = 5 * 60 * 1e3;
@@ -717,35 +791,38 @@ async function refreshAccessToken(refreshToken, oauth) {
   const clientId = process.env[oauth.clientIdEnv]?.trim();
   const clientSecret = process.env[oauth.clientSecretEnv]?.trim();
   if (!clientId || !clientSecret) {
-    throw new Error(`Missing ${oauth.clientIdEnv} or ${oauth.clientSecretEnv} for token refresh`);
+    throw new Error(
+      `Missing ${oauth.clientIdEnv} or ${oauth.clientSecretEnv} for token refresh`
+    );
   }
+  const request = buildOAuthTokenRequest({
+    clientId,
+    clientSecret,
+    payload: {
+      grant_type: "refresh_token",
+      refresh_token: refreshToken
+    },
+    tokenAuthMethod: oauth.tokenAuthMethod,
+    tokenExtraHeaders: oauth.tokenExtraHeaders
+  });
   const response = await fetch(oauth.tokenEndpoint, {
     method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      refresh_token: refreshToken,
-      client_id: clientId,
-      client_secret: clientSecret
-    })
+    headers: request.headers,
+    body: request.body
   });
   if (!response.ok) {
     throw new Error(`Token refresh failed: ${response.status}`);
   }
   const data = await response.json();
-  if (!data.access_token || !data.refresh_token || typeof data.expires_in !== "number") {
-    throw new Error("Token refresh returned malformed response");
-  }
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresIn: data.expires_in
-  };
+  return parseOAuthTokenResponse(data);
+}
+function getLeaseExpiry(expiresAt) {
+  return expiresAt ? Math.min(expiresAt, Date.now() + MAX_LEASE_MS2) : Date.now() + MAX_LEASE_MS2;
 }
 function createOAuthBearerBroker(manifest, credentials, deps) {
   const provider = manifest.name;
   const supportedCapabilities = new Set(manifest.capabilities);
-  const { apiDomains, authTokenEnv } = credentials;
+  const { apiDomains, apiHeaders, authTokenEnv } = credentials;
   const authTokenPlaceholder = resolveAuthTokenPlaceholder(credentials);
   function buildLease(token, capability, expiresAtMs, reason) {
     return {
@@ -755,7 +832,7 @@ function createOAuthBearerBroker(manifest, credentials, deps) {
       env: { [authTokenEnv]: authTokenPlaceholder },
       headerTransforms: apiDomains.map((domain) => ({
         domain,
-        headers: { Authorization: `Bearer ${token}` }
+        headers: { ...apiHeaders ?? {}, Authorization: `Bearer ${token}` }
       })),
       expiresAt: new Date(expiresAtMs).toISOString(),
       metadata: { reason }
@@ -764,27 +841,58 @@ function createOAuthBearerBroker(manifest, credentials, deps) {
   return {
     async issue(input) {
       if (!supportedCapabilities.has(input.capability)) {
-        throw new Error(`Unsupported ${provider} capability: ${input.capability}`);
+        throw new Error(
+          `Unsupported ${provider} capability: ${input.capability}`
+        );
+      }
+      const envToken = process.env[authTokenEnv]?.trim();
+      const oauth = manifest.oauth;
+      if (!oauth) {
+        if (envToken) {
+          return buildLease(
+            envToken,
+            input.capability,
+            Date.now() + MAX_LEASE_MS2,
+            input.reason
+          );
+        }
+        throw new CredentialUnavailableError(
+          provider,
+          `No ${provider} credentials available.`
+        );
       }
-      if (input.requesterId && deps.userTokenStore) {
-        const stored = await deps.userTokenStore.get(input.requesterId, provider);
+      if (input.requesterId) {
+        const stored = await deps.userTokenStore.get(
+          input.requesterId,
+          provider
+        );
         if (stored) {
           const now = Date.now();
-          if (stored.expiresAt - now < REFRESH_BUFFER_MS && stored.refreshToken && manifest.oauth) {
+          if (stored.expiresAt !== void 0 && stored.expiresAt - now < REFRESH_BUFFER_MS) {
             try {
-              const refreshed = await refreshAccessToken(stored.refreshToken, manifest.oauth);
-              const expiresAt = Date.now() + refreshed.expiresIn * 1e3;
-              await deps.userTokenStore.set(input.requesterId, provider, {
-                accessToken: refreshed.accessToken,
-                refreshToken: refreshed.refreshToken,
-                expiresAt
-              });
-              const leaseExpiry = Math.min(expiresAt, Date.now() + MAX_LEASE_MS2);
-              return buildLease(refreshed.accessToken, input.capability, leaseExpiry, input.reason);
+              const refreshed = await refreshAccessToken(
+                stored.refreshToken,
+                oauth
+              );
+              await deps.userTokenStore.set(
+                input.requesterId,
+                provider,
+                refreshed
+              );
+              return buildLease(
+                refreshed.accessToken,
+                input.capability,
+                getLeaseExpiry(refreshed.expiresAt),
+                input.reason
+              );
             } catch {
               if (stored.expiresAt > Date.now()) {
-                const leaseExpiry = Math.min(stored.expiresAt, Date.now() + MAX_LEASE_MS2);
-                return buildLease(stored.accessToken, input.capability, leaseExpiry, input.reason);
+                return buildLease(
+                  stored.accessToken,
+                  input.capability,
+                  getLeaseExpiry(stored.expiresAt),
+                  input.reason
+                );
               }
               throw new CredentialUnavailableError(
                 provider,
@@ -792,9 +900,13 @@ function createOAuthBearerBroker(manifest, credentials, deps) {
               );
             }
           }
-          if (stored.expiresAt > Date.now()) {
-            const leaseExpiry = Math.min(stored.expiresAt, Date.now() + MAX_LEASE_MS2);
-            return buildLease(stored.accessToken, input.capability, leaseExpiry, input.reason);
+          if (stored.expiresAt === void 0 || stored.expiresAt > Date.now()) {
+            return buildLease(
+              stored.accessToken,
+              input.capability,
+              getLeaseExpiry(stored.expiresAt),
+              input.reason
+            );
           }
           throw new CredentialUnavailableError(
             provider,
@@ -806,10 +918,13 @@ function createOAuthBearerBroker(manifest, credentials, deps) {
           `No ${provider} credentials available.`
         );
       }
-      const envToken = process.env[authTokenEnv]?.trim();
       if (envToken) {
-        const expiresAtMs = Date.now() + MAX_LEASE_MS2;
-        return buildLease(envToken, input.capability, expiresAtMs, input.reason);
+        return buildLease(
+          envToken,
+          input.capability,
+          getLeaseExpiry(),
+          input.reason
+        );
       }
       throw new CredentialUnavailableError(
         provider,
@@ -826,6 +941,15 @@ var SHORT_CONFIG_KEY_RE = /^[a-z0-9]+(\.[a-z0-9-]+)*$/;
 var AUTH_TOKEN_ENV_RE = /^[A-Z][A-Z0-9_]*$/;
 var API_DOMAIN_RE = /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 var RUNTIME_POSTINSTALL_CMD_RE = /^[A-Za-z0-9._/-]+$/;
+var RESERVED_AUTHORIZE_PARAM_KEYS = /* @__PURE__ */ new Set([
+  "client_id",
+  "scope",
+  "state",
+  "redirect_uri",
+  "response_type"
+]);
+var FORBIDDEN_API_HEADER_NAMES = /* @__PURE__ */ new Set(["authorization"]);
+var FORBIDDEN_TOKEN_HEADER_NAMES = /* @__PURE__ */ new Set(["authorization"]);
 function toRecord(value, errorMessage) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw new Error(errorMessage);
@@ -840,14 +964,24 @@ function requireStringField(record, field, errorMessage) {
   return value.trim();
 }
 function requireEnvVarField(record, field, pluginName) {
-  const value = requireStringField(record, field, `Plugin ${pluginName} ${field} must be a non-empty string`);
+  const value = requireStringField(
+    record,
+    field,
+    `Plugin ${pluginName} ${field} must be a non-empty string`
+  );
   if (!AUTH_TOKEN_ENV_RE.test(value)) {
-    throw new Error(`Plugin ${pluginName} ${field} must be an uppercase env var name`);
+    throw new Error(
+      `Plugin ${pluginName} ${field} must be an uppercase env var name`
+    );
   }
   return value;
 }
 function requireHttpsUrlField(record, field, pluginName) {
-  const value = requireStringField(record, field, `Plugin ${pluginName} oauth.${field} must be a non-empty string`);
+  const value = requireStringField(
+    record,
+    field,
+    `Plugin ${pluginName} oauth.${field} must be a non-empty string`
+  );
   let parsed;
   try {
     parsed = new URL(value);
@@ -862,26 +996,79 @@ function requireHttpsUrlField(record, field, pluginName) {
 function normalizeApiDomain(rawDomain, name) {
   const domain = typeof rawDomain === "string" ? rawDomain.trim().toLowerCase() : "";
   if (!domain) {
-    throw new Error(`Plugin ${name} credentials.api-domains entries must be non-empty strings`);
+    throw new Error(
+      `Plugin ${name} credentials.api-domains entries must be non-empty strings`
+    );
   }
   if (!API_DOMAIN_RE.test(domain)) {
-    throw new Error(`Plugin ${name} credentials.api-domains entries must be valid domain names`);
+    throw new Error(
+      `Plugin ${name} credentials.api-domains entries must be valid domain names`
+    );
   }
   return domain;
 }
+function parseStringMap(data, errorLabel, options = {}) {
+  if (data === void 0) {
+    return void 0;
+  }
+  const record = toRecord(
+    data,
+    `${errorLabel} must be an object when provided`
+  );
+  const entries = Object.entries(record);
+  if (entries.length === 0) {
+    return void 0;
+  }
+  const result = {};
+  const seen = /* @__PURE__ */ new Set();
+  for (const [rawKey, rawValue] of entries) {
+    const key = rawKey.trim();
+    if (!key) {
+      throw new Error(`${errorLabel} keys must be non-empty strings`);
+    }
+    if (typeof rawValue !== "string" || !rawValue.trim()) {
+      throw new Error(`${errorLabel}.${key} must be a non-empty string`);
+    }
+    const normalizedKey = key.toLowerCase();
+    if (options.reservedKeys?.has(normalizedKey)) {
+      throw new Error(`${errorLabel}.${key} is reserved by the runtime`);
+    }
+    if (options.forbiddenKeys?.has(normalizedKey)) {
+      throw new Error(`${errorLabel}.${key} is not allowed`);
+    }
+    if (seen.has(normalizedKey)) {
+      throw new Error(`${errorLabel}.${key} is duplicated`);
+    }
+    seen.add(normalizedKey);
+    result[key] = rawValue.trim();
+  }
+  return Object.keys(result).length > 0 ? result : void 0;
+}
 function parseBaseCredentialFields(data, name) {
   const rawDomains = data["api-domains"];
   if (!Array.isArray(rawDomains) || rawDomains.length === 0) {
-    throw new Error(`Plugin ${name} credentials.api-domains must be a non-empty array of strings`);
+    throw new Error(
+      `Plugin ${name} credentials.api-domains must be a non-empty array of strings`
+    );
   }
-  const apiDomains = rawDomains.map((rawDomain) => normalizeApiDomain(rawDomain, name));
+  const apiDomains = rawDomains.map(
+    (rawDomain) => normalizeApiDomain(rawDomain, name)
+  );
+  const apiHeaders = parseStringMap(
+    data["api-headers"],
+    `Plugin ${name} credentials.api-headers`,
+    { forbiddenKeys: FORBIDDEN_API_HEADER_NAMES }
+  );
   const authTokenEnv = requireEnvVarField(data, "auth-token-env", name);
   const authTokenPlaceholderRaw = data["auth-token-placeholder"];
   if (authTokenPlaceholderRaw !== void 0 && (typeof authTokenPlaceholderRaw !== "string" || !authTokenPlaceholderRaw.trim())) {
-    throw new Error(`Plugin ${name} credentials.auth-token-placeholder must be a non-empty string when provided`);
+    throw new Error(
+      `Plugin ${name} credentials.auth-token-placeholder must be a non-empty string when provided`
+    );
   }
   return {
     apiDomains,
+    ...apiHeaders ? { apiHeaders } : {},
     authTokenEnv,
     ...typeof authTokenPlaceholderRaw === "string" ? { authTokenPlaceholder: authTokenPlaceholderRaw.trim() } : {}
   };
@@ -896,8 +1083,18 @@ function parseCredentials(data, name) {
     const base = parseBaseCredentialFields(data, name);
     const appIdEnv = requireEnvVarField(data, "app-id-env", name);
     const privateKeyEnv = requireEnvVarField(data, "private-key-env", name);
-    const installationIdEnv = requireEnvVarField(data, "installation-id-env", name);
-    return { type: "github-app", ...base, appIdEnv, privateKeyEnv, installationIdEnv };
+    const installationIdEnv = requireEnvVarField(
+      data,
+      "installation-id-env",
+      name
+    );
+    return {
+      type: "github-app",
+      ...base,
+      appIdEnv,
+      privateKeyEnv,
+      installationIdEnv
+    };
   }
   throw new Error(`Plugin ${name} has unsupported credentials.type: "${type}"`);
 }
@@ -912,7 +1109,9 @@ function parseRuntimeDependencies(data, name) {
   const seen = /* @__PURE__ */ new Set();
   for (const entry of data) {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
-      throw new Error(`Plugin ${name} runtime-dependencies entries must be objects`);
+      throw new Error(
+        `Plugin ${name} runtime-dependencies entries must be objects`
+      );
     }
     const record = entry;
     const type = record.type;
@@ -921,20 +1120,28 @@ function parseRuntimeDependencies(data, name) {
     const version = record.version;
     const sha256 = record.sha256;
     if (typeof type !== "string" || type !== "npm" && type !== "system") {
-      throw new Error(`Plugin ${name} runtime dependency type must be "npm" or "system"`);
+      throw new Error(
+        `Plugin ${name} runtime dependency type must be "npm" or "system"`
+      );
     }
     const normalizedPackage = typeof packageName === "string" ? packageName.trim() : "";
     const normalizedUrl = typeof packageUrl === "string" ? packageUrl.trim() : "";
     if (type === "npm") {
       if (!normalizedPackage) {
-        throw new Error(`Plugin ${name} runtime dependency package must be a non-empty string`);
+        throw new Error(
+          `Plugin ${name} runtime dependency package must be a non-empty string`
+        );
       }
       if (packageUrl !== void 0 || sha256 !== void 0) {
-        throw new Error(`Plugin ${name} npm runtime dependencies must only include package/version fields`);
+        throw new Error(
+          `Plugin ${name} npm runtime dependencies must only include package/version fields`
+        );
       }
       const normalizedVersion = typeof version === "string" ? version.trim() : "latest";
       if (!normalizedVersion) {
-        throw new Error(`Plugin ${name} runtime dependency version must be a non-empty string when provided`);
+        throw new Error(
+          `Plugin ${name} runtime dependency version must be a non-empty string when provided`
+        );
       }
       const dedupeKey2 = `${type}:${normalizedPackage}:${normalizedVersion}`;
       if (seen.has(dedupeKey2)) {
@@ -949,17 +1156,25 @@ function parseRuntimeDependencies(data, name) {
       continue;
     }
     if (version !== void 0) {
-      throw new Error(`Plugin ${name} system runtime dependencies must not include a version`);
+      throw new Error(
+        `Plugin ${name} system runtime dependencies must not include a version`
+      );
     }
     if (normalizedPackage && normalizedUrl) {
-      throw new Error(`Plugin ${name} system runtime dependencies must specify either package or url, not both`);
+      throw new Error(
+        `Plugin ${name} system runtime dependencies must specify either package or url, not both`
+      );
     }
     if (!normalizedPackage && !normalizedUrl) {
-      throw new Error(`Plugin ${name} system runtime dependencies must specify package or url`);
+      throw new Error(
+        `Plugin ${name} system runtime dependencies must specify package or url`
+      );
     }
     if (normalizedPackage) {
       if (sha256 !== void 0) {
-        throw new Error(`Plugin ${name} system runtime dependency package entries must not include sha256`);
+        throw new Error(
+          `Plugin ${name} system runtime dependency package entries must not include sha256`
+        );
       }
       const dedupeKey2 = `${type}:package:${normalizedPackage}`;
       if (seen.has(dedupeKey2)) {
@@ -973,11 +1188,15 @@ function parseRuntimeDependencies(data, name) {
       continue;
     }
     if (!/^https:\/\//i.test(normalizedUrl)) {
-      throw new Error(`Plugin ${name} system runtime dependency url must be an https URL`);
+      throw new Error(
+        `Plugin ${name} system runtime dependency url must be an https URL`
+      );
     }
     const normalizedSha256 = typeof sha256 === "string" ? sha256.trim().toLowerCase() : "";
     if (!/^[a-f0-9]{64}$/.test(normalizedSha256)) {
-      throw new Error(`Plugin ${name} system runtime dependency url entries must include a valid sha256`);
+      throw new Error(
+        `Plugin ${name} system runtime dependency url entries must include a valid sha256`
+      );
     }
     const dedupeKey = `${type}:url:${normalizedUrl}:${normalizedSha256}`;
     if (seen.has(dedupeKey)) {
@@ -1002,12 +1221,16 @@ function parseRuntimePostinstall(data, name) {
   const parsed = [];
   for (const entry of data) {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
-      throw new Error(`Plugin ${name} runtime-postinstall entries must be objects`);
+      throw new Error(
+        `Plugin ${name} runtime-postinstall entries must be objects`
+      );
     }
     const record = entry;
     const cmd = typeof record.cmd === "string" ? record.cmd.trim() : "";
     if (!cmd) {
-      throw new Error(`Plugin ${name} runtime-postinstall cmd must be a non-empty string`);
+      throw new Error(
+        `Plugin ${name} runtime-postinstall cmd must be a non-empty string`
+      );
     }
     if (!RUNTIME_POSTINSTALL_CMD_RE.test(cmd)) {
       throw new Error(
@@ -1016,11 +1239,15 @@ function parseRuntimePostinstall(data, name) {
     }
     const argsRaw = record.args;
     if (argsRaw !== void 0 && (!Array.isArray(argsRaw) || !argsRaw.every((arg) => typeof arg === "string"))) {
-      throw new Error(`Plugin ${name} runtime-postinstall args must be an array of strings when provided`);
+      throw new Error(
+        `Plugin ${name} runtime-postinstall args must be an array of strings when provided`
+      );
     }
     const sudoRaw = record.sudo;
     if (sudoRaw !== void 0 && typeof sudoRaw !== "boolean") {
-      throw new Error(`Plugin ${name} runtime-postinstall sudo must be a boolean when provided`);
+      throw new Error(
+        `Plugin ${name} runtime-postinstall sudo must be a boolean when provided`
+      );
     }
     const normalizedArgs = Array.isArray(argsRaw) ? argsRaw.map((arg) => arg.trim()).filter((arg) => arg.length > 0) : void 0;
     parsed.push({
@@ -1032,7 +1259,10 @@ function parseRuntimePostinstall(data, name) {
   return parsed.length > 0 ? parsed : void 0;
 }
 function parseManifest(raw, dir) {
-  const data = toRecord(parseYaml(raw), `Invalid plugin manifest in ${dir}: expected an object`);
+  const data = toRecord(
+    parseYaml(raw),
+    `Invalid plugin manifest in ${dir}: expected an object`
+  );
   const rawName = data.name;
   if (typeof rawName !== "string" || !PLUGIN_NAME_RE.test(rawName)) {
     throw new Error(`Invalid plugin name in ${dir}: "${rawName}"`);
@@ -1045,7 +1275,9 @@ function parseManifest(raw, dir) {
   const description = rawDescription;
   const rawCapabilities = data.capabilities;
   if (rawCapabilities !== void 0 && !Array.isArray(rawCapabilities)) {
-    throw new Error(`Plugin ${name} capabilities must be an array when provided`);
+    throw new Error(
+      `Plugin ${name} capabilities must be an array when provided`
+    );
   }
   const capabilities = [];
   for (const cap of rawCapabilities ?? []) {
@@ -1056,7 +1288,9 @@ function parseManifest(raw, dir) {
   }
   const rawConfigKeys = data["config-keys"];
   if (rawConfigKeys !== void 0 && !Array.isArray(rawConfigKeys)) {
-    throw new Error(`Plugin ${name} config-keys must be an array when provided`);
+    throw new Error(
+      `Plugin ${name} config-keys must be an array when provided`
+    );
   }
   const configKeys = [];
   for (const key of rawConfigKeys ?? []) {
@@ -1067,11 +1301,20 @@ function parseManifest(raw, dir) {
   }
   const credentialsRaw = data.credentials;
   if (credentialsRaw !== void 0) {
-    toRecord(credentialsRaw, `Plugin ${name} credentials must be an object when provided`);
+    toRecord(
+      credentialsRaw,
+      `Plugin ${name} credentials must be an object when provided`
+    );
   }
   const credentials = credentialsRaw ? parseCredentials(credentialsRaw, name) : void 0;
-  const runtimeDependencies = parseRuntimeDependencies(data["runtime-dependencies"], name);
-  const runtimePostinstall = parseRuntimePostinstall(data["runtime-postinstall"], name);
+  const runtimeDependencies = parseRuntimeDependencies(
+    data["runtime-dependencies"],
+    name
+  );
+  const runtimePostinstall = parseRuntimePostinstall(
+    data["runtime-postinstall"],
+    name
+  );
   const manifest = {
     name,
     description,
@@ -1087,14 +1330,54 @@ function parseManifest(raw, dir) {
       throw new Error(`Plugin ${name} oauth requires credentials`);
     }
     if (credentials.type !== "oauth-bearer") {
-      throw new Error(`Plugin ${name} oauth requires credentials.type "oauth-bearer"`);
+      throw new Error(
+        `Plugin ${name} oauth requires credentials.type "oauth-bearer"`
+      );
+    }
+    const authorizeParams = parseStringMap(
+      oauthRaw["authorize-params"],
+      `Plugin ${name} oauth.authorize-params`,
+      { reservedKeys: RESERVED_AUTHORIZE_PARAM_KEYS }
+    );
+    const tokenExtraHeaders = parseStringMap(
+      oauthRaw["token-extra-headers"],
+      `Plugin ${name} oauth.token-extra-headers`,
+      { forbiddenKeys: FORBIDDEN_TOKEN_HEADER_NAMES }
+    );
+    const tokenAuthMethodRaw = oauthRaw["token-auth-method"];
+    let tokenAuthMethod;
+    if (tokenAuthMethodRaw !== void 0) {
+      const parsedTokenAuthMethod = requireStringField(
+        oauthRaw,
+        "token-auth-method",
+        `Plugin ${name} oauth.token-auth-method must be a non-empty string`
+      );
+      if (parsedTokenAuthMethod !== "body" && parsedTokenAuthMethod !== "basic") {
+        throw new Error(
+          `Plugin ${name} oauth.token-auth-method must be "body" or "basic"`
+        );
+      }
+      tokenAuthMethod = parsedTokenAuthMethod;
     }
     manifest.oauth = {
       clientIdEnv: requireEnvVarField(oauthRaw, "client-id-env", name),
       clientSecretEnv: requireEnvVarField(oauthRaw, "client-secret-env", name),
-      authorizeEndpoint: requireHttpsUrlField(oauthRaw, "authorize-endpoint", name),
+      authorizeEndpoint: requireHttpsUrlField(
+        oauthRaw,
+        "authorize-endpoint",
+        name
+      ),
       tokenEndpoint: requireHttpsUrlField(oauthRaw, "token-endpoint", name),
-      scope: requireStringField(oauthRaw, "scope", `Plugin ${name} oauth.scope must be a non-empty string`)
+      ...oauthRaw.scope !== void 0 ? {
+        scope: requireStringField(
+          oauthRaw,
+          "scope",
+          `Plugin ${name} oauth.scope must be a non-empty string`
+        )
+      } : {},
+      ...authorizeParams ? { authorizeParams } : {},
+      ...tokenAuthMethod ? { tokenAuthMethod } : {},
+      ...tokenExtraHeaders ? { tokenExtraHeaders } : {}
     };
   }
   const targetRaw = data.target ? toRecord(data.target, `Plugin ${name} target must be an object`) : void 0;
@@ -1104,14 +1387,20 @@ function parseManifest(raw, dir) {
     }
     const rawConfigKey = targetRaw["config-key"];
     if (typeof rawConfigKey !== "string" || !rawConfigKey.trim()) {
-      throw new Error(`Plugin ${name} target.config-key must be a non-empty string`);
+      throw new Error(
+        `Plugin ${name} target.config-key must be a non-empty string`
+      );
     }
     if (!SHORT_CONFIG_KEY_RE.test(rawConfigKey)) {
-      throw new Error(`Plugin ${name} target.config-key "${rawConfigKey}" is invalid`);
+      throw new Error(
+        `Plugin ${name} target.config-key "${rawConfigKey}" is invalid`
+      );
     }
     const qualifiedKey = `${name}.${rawConfigKey}`;
     if (!configKeys.includes(qualifiedKey)) {
-      throw new Error(`Plugin ${name} target.config-key "${rawConfigKey}" must be listed in config-keys`);
+      throw new Error(
+        `Plugin ${name} target.config-key "${rawConfigKey}" must be listed in config-keys`
+      );
     }
     manifest.target = { type: "repo", configKey: qualifiedKey };
   }
@@ -1130,7 +1419,9 @@ function registerPluginManifest(raw, pluginDir) {
   }
   for (const cap of manifest.capabilities) {
     if (capabilityToPlugin.has(cap)) {
-      throw new Error(`Duplicate capability "${cap}" in plugin "${manifest.name}"`);
+      throw new Error(
+        `Duplicate capability "${cap}" in plugin "${manifest.name}"`
+      );
     }
   }
   const definition = {
@@ -1159,10 +1450,15 @@ function loadPlugins() {
     try {
       rootStat = statSync(pluginsRoot);
     } catch (error) {
-      logWarn("plugin_root_read_failed", {}, {
-        "file.directory": pluginsRoot,
-        "error.message": error instanceof Error ? error.message : String(error)
-      }, "Failed to read plugin root");
+      logWarn(
+        "plugin_root_read_failed",
+        {},
+        {
+          "file.directory": pluginsRoot,
+          "error.message": error instanceof Error ? error.message : String(error)
+        },
+        "Failed to read plugin root"
+      );
       continue;
     }
     if (rootStat.isDirectory()) {
@@ -1182,10 +1478,15 @@ function loadPlugins() {
     try {
       entries = readdirSync(pluginsRoot);
     } catch (error) {
-      logWarn("plugin_root_read_failed", {}, {
-        "file.directory": pluginsRoot,
-        "error.message": error instanceof Error ? error.message : String(error)
-      }, "Failed to read plugin root");
+      logWarn(
+        "plugin_root_read_failed",
+        {},
+        {
+          "file.directory": pluginsRoot,
+          "error.message": error instanceof Error ? error.message : String(error)
+        },
+        "Failed to read plugin root"
+      );
       continue;
     }
     for (const entry of entries.sort()) {
@@ -1221,8 +1522,12 @@ function loadPlugins() {
     "Loaded plugins"
   );
 }
+function ensurePluginsLoaded() {
+  loadPlugins();
+}
 loadPlugins();
 function getPluginCapabilityProviders() {
+  ensurePluginsLoaded();
   return pluginDefinitions.map((plugin) => ({
     provider: plugin.manifest.name,
     capabilities: [...plugin.manifest.capabilities],
@@ -1231,9 +1536,11 @@ function getPluginCapabilityProviders() {
   }));
 }
 function getPluginProviders() {
+  ensurePluginsLoaded();
   return [...pluginDefinitions];
 }
 function getPluginRuntimeDependencies() {
+  ensurePluginsLoaded();
   const seen = /* @__PURE__ */ new Set();
   const deps = [];
   for (const plugin of pluginDefinitions) {
@@ -1262,6 +1569,7 @@ function getPluginRuntimeDependencies() {
   });
 }
 function getPluginRuntimePostinstall() {
+  ensurePluginsLoaded();
   const commands = [];
   for (const plugin of pluginDefinitions) {
     for (const command of plugin.manifest.runtimePostinstall ?? []) {
@@ -1275,6 +1583,7 @@ function getPluginRuntimePostinstall() {
   return commands;
 }
 function getPluginOAuthConfig(provider) {
+  ensurePluginsLoaded();
   const plugin = pluginsByName.get(provider);
   if (!plugin?.manifest.oauth) return void 0;
   const oauth = plugin.manifest.oauth;
@@ -1283,17 +1592,28 @@ function getPluginOAuthConfig(provider) {
     clientSecretEnv: oauth.clientSecretEnv,
     authorizeEndpoint: oauth.authorizeEndpoint,
     tokenEndpoint: oauth.tokenEndpoint,
-    scope: oauth.scope,
+    ...oauth.scope ? { scope: oauth.scope } : {},
+    ...oauth.authorizeParams ? { authorizeParams: { ...oauth.authorizeParams } } : {},
+    ...oauth.tokenAuthMethod ? { tokenAuthMethod: oauth.tokenAuthMethod } : {},
+    ...oauth.tokenExtraHeaders ? { tokenExtraHeaders: { ...oauth.tokenExtraHeaders } } : {},
     callbackPath: `/api/oauth/callback/${plugin.manifest.name}`
   };
 }
 function getPluginSkillRoots() {
-  return [.../* @__PURE__ */ new Set([...pluginDefinitions.map((plugin) => plugin.skillsDir), ...packageSkillRoots])];
+  ensurePluginsLoaded();
+  return [
+    .../* @__PURE__ */ new Set([
+      ...pluginDefinitions.map((plugin) => plugin.skillsDir),
+      ...packageSkillRoots
+    ])
+  ];
 }
 function isPluginProvider(provider) {
+  ensurePluginsLoaded();
   return pluginsByName.has(provider);
 }
 function createPluginBroker(provider, deps) {
+  ensurePluginsLoaded();
   const plugin = pluginsByName.get(provider);
   if (!plugin) {
     throw new Error(`Unknown plugin provider: "${provider}"`);
@@ -1393,6 +1713,9 @@ function buildDependencyProfile(runtime) {
     postinstall
   };
 }
+function getRuntimeDependencyProfileHash(runtime) {
+  return buildDependencyProfile(runtime)?.profileHash;
+}
 function shouldRebuildCachedSnapshot(profile, cached) {
   if (!profile.hasFloatingVersions) {
     return false;
@@ -1423,7 +1746,11 @@ async function getCachedSnapshot(profileHash) {
 async function setCachedSnapshot(entry) {
   const state = getStateAdapter();
   await state.connect();
-  await state.set(profileCacheKey(entry.profileHash), JSON.stringify(entry), SNAPSHOT_CACHE_TTL_MS);
+  await state.set(
+    profileCacheKey(entry.profileHash),
+    JSON.stringify(entry),
+    SNAPSHOT_CACHE_TTL_MS
+  );
 }
 async function withSnapshotSpan(name, op, attributes, callback) {
   return await withSpan(name, op, {}, callback, attributes);
@@ -1458,7 +1785,11 @@ async function installGhCliViaDnf(sandbox) {
   }
   const dnf5Repo = await tryRun(sandbox, {
     cmd: "dnf",
-    args: ["config-manager", "addrepo", "--from-repofile=https://cli.github.com/packages/rpm/gh-cli.repo"],
+    args: [
+      "config-manager",
+      "addrepo",
+      "--from-repofile=https://cli.github.com/packages/rpm/gh-cli.repo"
+    ],
     sudo: true
   });
   if (!dnf5Repo.ok) {
@@ -1475,7 +1806,11 @@ async function installGhCliViaDnf(sandbox) {
       sandbox,
       {
         cmd: "dnf",
-        args: ["config-manager", "--add-repo", "https://cli.github.com/packages/rpm/gh-cli.repo"],
+        args: [
+          "config-manager",
+          "--add-repo",
+          "https://cli.github.com/packages/rpm/gh-cli.repo"
+        ],
         sudo: true
       },
       "dnf config-manager --add-repo gh-cli.repo"
@@ -1506,8 +1841,12 @@ function runtimeDependencyFilePath(url, sha256) {
   return `/tmp/junior-runtime-${sha256.slice(0, 12)}-${sanitizedBasename}`;
 }
 async function installRuntimeDependencies(sandbox, deps) {
-  const systemDeps = deps.filter((dep) => dep.type === "system");
-  const npmPackages = deps.filter((dep) => dep.type === "npm").map((dep) => `${dep.package}@${dep.version}`);
+  const systemDeps = deps.filter(
+    (dep) => dep.type === "system"
+  );
+  const npmPackages = deps.filter(
+    (dep) => dep.type === "npm"
+  ).map((dep) => `${dep.package}@${dep.version}`);
   if (systemDeps.length > 0) {
     await withSnapshotSpan(
       "sandbox.snapshot.install_system",
@@ -1534,7 +1873,9 @@ async function installRuntimeDependencies(sandbox, deps) {
             const checksumStdout = (await checksumResult.stdout()).trim();
             const checksumStderr = (await checksumResult.stderr()).trim();
             if (checksumResult.exitCode !== 0) {
-              throw new Error(`sha256sum failed: ${checksumStderr || checksumStdout || "command failed"}`);
+              throw new Error(
+                `sha256sum failed: ${checksumStderr || checksumStdout || "command failed"}`
+              );
             }
             const actualChecksum = checksumStdout.split(/\s+/)[0]?.toLowerCase();
             if (!actualChecksum) {
@@ -1611,7 +1952,10 @@ async function runRuntimePostinstall(sandbox, commands) {
     },
     async () => {
       for (const command of commands) {
-        const invocation = [JSON.stringify(command.cmd), ...(command.args ?? []).map((arg) => JSON.stringify(arg))].join(" ");
+        const invocation = [
+          JSON.stringify(command.cmd),
+          ...(command.args ?? []).map((arg) => JSON.stringify(arg))
+        ].join(" ");
         const pathPrefix = `${SANDBOX_WORKSPACE_ROOT}/.junior/bin:$PATH`;
         await runOrThrow(
           sandbox,
@@ -1766,7 +2110,9 @@ async function resolveRuntimeDependencySnapshot(params) {
         };
       }
       const cached = await getCachedSnapshot(profile.profileHash);
-      const cachedNeedsRebuild = Boolean(cached?.snapshotId && shouldRebuildCachedSnapshot(profile, cached));
+      const cachedNeedsRebuild = Boolean(
+        cached?.snapshotId && shouldRebuildCachedSnapshot(profile, cached)
+      );
       if (!params.forceRebuild && cached?.snapshotId && !cachedNeedsRebuild) {
         await params.onProgress?.("cache_hit");
         return {
@@ -1792,34 +2138,50 @@ async function resolveRuntimeDependencySnapshot(params) {
         }
         return !shouldRebuildCachedSnapshot(profile, candidate);
       };
-      const lockResult = await withBuildLock(profile.profileHash, async () => {
-        const latest = await getCachedSnapshot(profile.profileHash);
-        if (latest?.snapshotId && canUseCachedSnapshot(latest)) {
-          await params.onProgress?.("cache_hit");
-          return { snapshotId: latest.snapshotId, source: "callback_cache" };
-        }
-        await params.onProgress?.("building_snapshot");
-        const nextSnapshotId = await createDependencySnapshot(profile, params.runtime, params.timeoutMs);
-        await setCachedSnapshot({
-          profileHash: profile.profileHash,
-          snapshotId: nextSnapshotId,
-          runtime: params.runtime,
-          createdAtMs: Date.now(),
-          dependencyCount: profile.dependencyCount
-        });
-        await params.onProgress?.("build_complete");
-        return { snapshotId: nextSnapshotId, source: "built" };
-      }, canUseCachedSnapshot, {
-        onWaitingForLock: async () => {
-          await params.onProgress?.("waiting_for_lock");
+      const lockResult = await withBuildLock(
+        profile.profileHash,
+        async () => {
+          const latest = await getCachedSnapshot(profile.profileHash);
+          if (latest?.snapshotId && canUseCachedSnapshot(latest)) {
+            await params.onProgress?.("cache_hit");
+            return {
+              snapshotId: latest.snapshotId,
+              source: "callback_cache"
+            };
+          }
+          await params.onProgress?.("building_snapshot");
+          const nextSnapshotId = await createDependencySnapshot(
+            profile,
+            params.runtime,
+            params.timeoutMs
+          );
+          await setCachedSnapshot({
+            profileHash: profile.profileHash,
+            snapshotId: nextSnapshotId,
+            runtime: params.runtime,
+            createdAtMs: Date.now(),
+            dependencyCount: profile.dependencyCount
+          });
+          await params.onProgress?.("build_complete");
+          return { snapshotId: nextSnapshotId, source: "built" };
+        },
+        canUseCachedSnapshot,
+        {
+          onWaitingForLock: async () => {
+            await params.onProgress?.("waiting_for_lock");
+          }
         }
-      });
+      );
       return {
         snapshotId: lockResult.snapshotId,
         profileHash: profile.profileHash,
         dependencyCount: profile.dependencyCount,
         cacheHit: lockResult.source !== "built",
-        resolveOutcome: toResolveOutcome(Boolean(params.forceRebuild), lockResult.source, lockResult.waitedForLock),
+        resolveOutcome: toResolveOutcome(
+          Boolean(params.forceRebuild),
+          lockResult.source,
+          lockResult.waitedForLock
+        ),
         ...rebuildReason ? { rebuildReason } : {}
       };
     }
@@ -1836,6 +2198,8 @@ export {
   soulPathCandidates,
   resolveAuthTokenPlaceholder,
   CredentialUnavailableError,
+  buildOAuthTokenRequest,
+  parseOAuthTokenResponse,
   getPluginCapabilityProviders,
   getPluginProviders,
   getPluginOAuthConfig,
@@ -1861,6 +2225,7 @@ export {
   SANDBOX_WORKSPACE_ROOT,
   SANDBOX_SKILLS_ROOT,
   sandboxSkillDir,
+  getRuntimeDependencyProfileHash,
   resolveRuntimeDependencySnapshot,
   isSnapshotMissingError
 };