@sentry/junior 0.3.0 → 0.4.1

package/dist/{chunk-L745IWNK.js → chunk-RFUE5VBK.js}

@@ -10,6 +10,7 @@ import {
   getPluginOAuthConfig,
   getPluginProviders,
   getPluginSkillRoots,
+  getRuntimeDependencyProfileHash,
   getSlackBotToken,
   getSlackClientId,
   getSlackClientSecret,
@@ -25,7 +26,7 @@ import {
   skillRoots,
   soulPathCandidates,
   upsertAgentTurnSessionCheckpoint
-} from "./chunk-DPTR2FNH.js";
+} from "./chunk-OZFXD5IG.js";
 import {
   logError,
   logException,
@@ -656,22 +657,34 @@ function normalizeForSlack(text) {
   normalized = ensureBlockSpacing(normalized);
   return normalized.replace(/\n{3,}/g, "\n\n").trim();
 }
-function buildSlackOutputMessage(text, options = {}) {
+function buildSlackOutputMessage(text, files) {
   const normalized = normalizeForSlack(text);
+  const fileCount = files?.length ?? 0;
   if (!normalized) {
-    logWarn("slack_output_normalized_empty", {}, {
-      "app.output.original_length": text.length,
-      "app.output.parsed_length": normalized.length,
-      "app.output.file_count": options.files?.length ?? 0
-    }, "Slack output normalized to empty content");
+    if (fileCount > 0) {
+      return {
+        raw: "",
+        files
+      };
+    }
+    logWarn(
+      "slack_output_normalized_empty",
+      {},
+      {
+        "app.output.original_length": text.length,
+        "app.output.parsed_length": normalized.length,
+        "app.output.file_count": fileCount
+      },
+      "Slack output normalized to empty content"
+    );
     return {
       markdown: "I couldn't produce a response.",
-      files: options.files
+      files
     };
   }
   return {
     markdown: normalized,
-    files: options.files
+    files
   };
 }
 var slackOutputPolicy = {
@@ -759,10 +772,14 @@ function formatAvailableSkillsForPrompt(skills) {
     const skillLocation = `${workspaceSkillDir(skill.name)}/SKILL.md`;
     lines.push("  <skill>");
     lines.push(`    <name>${escapeXml(skill.name)}</name>`);
-    lines.push(`    <description>${escapeXml(skill.description)}</description>`);
+    lines.push(
+      `    <description>${escapeXml(skill.description)}</description>`
+    );
     lines.push(`    <location>${escapeXml(skillLocation)}</location>`);
     if (skill.usesConfig && skill.usesConfig.length > 0) {
-      lines.push(`    <uses_config>${escapeXml(skill.usesConfig.join(" "))}</uses_config>`);
+      lines.push(
+        `    <uses_config>${escapeXml(skill.usesConfig.join(" "))}</uses_config>`
+      );
     }
     lines.push("  </skill>");
   }
@@ -776,10 +793,14 @@ function formatLoadedSkillsForPrompt(skills) {
   const lines = ["<loaded_skills>"];
   for (const skill of skills) {
     const skillDir = workspaceSkillDir(skill.name);
-    lines.push(`  <skill name="${escapeXml(skill.name)}" location="${escapeXml(`${skillDir}/SKILL.md`)}">`);
+    lines.push(
+      `  <skill name="${escapeXml(skill.name)}" location="${escapeXml(`${skillDir}/SKILL.md`)}">`
+    );
     lines.push(`References are relative to ${escapeXml(skillDir)}.`);
     if (skill.usesConfig && skill.usesConfig.length > 0) {
-      lines.push(`Uses config keys: ${escapeXml(skill.usesConfig.join(", "))}.`);
+      lines.push(
+        `Uses config keys: ${escapeXml(skill.usesConfig.join(", "))}.`
+      );
     }
     lines.push("");
     lines.push(skill.body);
@@ -859,12 +880,20 @@ function buildSystemPrompt(params) {
     "Loaded skills for this turn:",
     formatLoadedSkillsForPrompt(activeSkills)
   ].join("\n");
-  const configurationKeys = Object.keys(configuration ?? {}).sort((a, b) => a.localeCompare(b));
+  const configurationKeys = Object.keys(configuration ?? {}).sort(
+    (a, b) => a.localeCompare(b)
+  );
   const relevantConfigSet = new Set(
-    (relevantConfigurationKeys ?? []).filter((key) => Object.prototype.hasOwnProperty.call(configuration ?? {}, key))
+    (relevantConfigurationKeys ?? []).filter(
+      (key) => Object.prototype.hasOwnProperty.call(configuration ?? {}, key)
+    )
+  );
+  const relevantConfigLines = configurationKeys.filter((key) => relevantConfigSet.has(key)).map(
+    (key) => `  - ${escapeXml(key)}: ${formatConfigurationValue(configuration?.[key])}`
+  );
+  const otherConfigLines = configurationKeys.filter((key) => !relevantConfigSet.has(key)).map(
+    (key) => `  - ${escapeXml(key)}: ${formatConfigurationValue(configuration?.[key])}`
   );
-  const relevantConfigLines = configurationKeys.filter((key) => relevantConfigSet.has(key)).map((key) => `  - ${escapeXml(key)}: ${formatConfigurationValue(configuration?.[key])}`);
-  const otherConfigLines = configurationKeys.filter((key) => !relevantConfigSet.has(key)).map((key) => `  - ${escapeXml(key)}: ${formatConfigurationValue(configuration?.[key])}`);
   const configurationSection = [
     "Use these conversation-scoped defaults when the user has not provided explicit values in this turn.",
     "If explicit user input conflicts with configuration, follow explicit user input.",
@@ -936,6 +965,10 @@ function buildSystemPrompt(params) {
         "- For factual or external questions, run tools/skills first, then answer from evidence.",
         "- Use tool descriptions as the source of truth for when each tool should or should not be called.",
         "- Use `bash` to inspect skill files from `skill_dir` and run shell commands inside the sandbox workspace.",
+        "- Use `attachFile` to attach files from the sandbox (for example screenshots, PDFs, logs) to the Slack reply.",
+        "- If the user asks to see/share/show a screenshot or file, attach the file with `attachFile` instead of only reporting its path.",
+        "- Never claim a screenshot/file is attached unless `attachFile` succeeded in this turn.",
+        "- If `attachFile` fails, explain the failure and do not say the file was shared.",
         "- Use `imageGenerate` when the user asks for image creation.",
         "- Use `slackCanvasCreate` for long-form docs/specs and `slackCanvasUpdate` for doc follow-ups.",
         "- `slackCanvasUpdate` targets the active artifact-context canvas automatically; do not ask the user for `canvas_id`.",
@@ -946,7 +979,7 @@ function buildSystemPrompt(params) {
         "- Use `slackMessageAddReaction` for rare lightweight acknowledgements. It reacts to the current inbound message via runtime context; never pick a target message yourself.",
         "- If the user explicitly asks for an emoji reaction instead of text, use `slackMessageAddReaction` with a Slack emoji alias name (for example `thumbsup`, not unicode emoji), and avoid redundant acknowledgment text.",
         "- Suggested acknowledgement reactions include \u{1F44B}, \u2705, \u{1F44D}, and \u{1F440}, but choose what best fits the request.",
-        "- To enable provider credentials for this turn, run `jr-rpc issue-credential <capability> [--repo <owner/repo>]` as a bash command before commands that need authenticated API calls.",
+        "- To enable provider credentials for this turn, run `jr-rpc issue-credential <capability> [--repo <owner/repo>]` as a bash command before commands that need authenticated API calls. GitHub capabilities need repository context, which can come from `--repo` or a configured `github.repo` default.",
         "- To persist or read conversation defaults (for example `github.repo`), run `jr-rpc config get|set|unset|list ...` as a bash command.",
         "- Capabilities are provider-qualified (for example `github.issues.write`).",
         "- When your work is complete, provide the exact user-facing markdown response.",
@@ -958,10 +991,10 @@ function buildSystemPrompt(params) {
     renderTag(
       "skills",
       [
-        "- For explicit slash commands, treat `/skill-name` as authoritative intent for that skill.",
-        "- If slash-invoked skill instructions are already present in <loaded_skills>, apply them immediately.",
-        "- Otherwise, for slash-invoked skills, call `loadSkill` for that exact skill before applying skill-specific behavior.",
-        "- For non-slash requests where a skill clearly matches, call `loadSkill` before applying skill-specific behavior.",
+        "- Explicit skill triggers may appear as `/skillname` or `!skillname`.",
+        "- If explicitly invoked skill instructions are already present in <loaded_skills>, apply them immediately.",
+        "- Otherwise, for an explicitly invoked skill, call `loadSkill` for that exact skill before applying skill-specific behavior.",
+        "- For requests without an explicit trigger where a skill clearly matches, call `loadSkill` before applying skill-specific behavior.",
         "- Do not claim to have used a skill unless it is present in <loaded_skills> or `loadSkill` succeeded in this turn.",
         "- Never apply skill-specific behavior unless the skill is present in <loaded_skills> or `loadSkill` succeeded in this turn.",
         "- Load only the best matching skill first; do not load multiple skills upfront.",
@@ -987,7 +1020,7 @@ function buildSystemPrompt(params) {
     activeSkillsSection,
     renderTag(
       "invocation-context",
-      invocation ? `Slash invocation detected: /${invocation.skillName}` : "No slash invocation detected."
+      invocation ? invocation.source === "hard_bang" ? `Explicit skill trigger detected: !${invocation.skillName}` : `Legacy slash hint detected: /${invocation.skillName} (non-authoritative)` : "No explicit skill trigger detected."
     )
   ];
   return sections.join("\n\n");
@@ -1278,6 +1311,7 @@ var SkillCapabilityRuntime = class {
 // src/chat/credentials/state-adapter-token-store.ts
 var KEY_PREFIX = "oauth-token";
 var BUFFER_MS = 24 * 60 * 60 * 1e3;
+var LONG_LIVED_TTL_MS = 365 * 24 * 60 * 60 * 1e3;
 function tokenKey(userId, provider) {
   return `${KEY_PREFIX}:${userId}:${provider}`;
 }
@@ -1287,11 +1321,13 @@ var StateAdapterTokenStore = class {
     this.state = stateAdapter;
   }
   async get(userId, provider) {
-    const stored = await this.state.get(tokenKey(userId, provider));
+    const stored = await this.state.get(
+      tokenKey(userId, provider)
+    );
     return stored ?? void 0;
   }
   async set(userId, provider, tokens) {
-    const ttlMs = Math.max(tokens.expiresAt - Date.now() + BUFFER_MS, BUFFER_MS);
+    const ttlMs = tokens.expiresAt ? Math.max(tokens.expiresAt - Date.now() + BUFFER_MS, BUFFER_MS) : LONG_LIVED_TTL_MS;
     await this.state.set(tokenKey(userId, provider), tokens, ttlMs);
   }
   async delete(userId, provider) {
@@ -1319,6 +1355,7 @@ var TestCredentialBroker = class {
       headerTransforms: this.config.domains.map((domain) => ({
         domain,
         headers: {
+          ...this.config.apiHeaders ?? {},
           Authorization: `Bearer ${token}`
         }
       })),
@@ -1350,7 +1387,13 @@ function createSkillCapabilityRuntime(options = {}) {
       continue;
     }
     const placeholder = resolveAuthTokenPlaceholder(credentials);
-    brokersByProvider[name] = useTestBroker ? new TestCredentialBroker({ provider: name, domains: credentials.apiDomains, envKey: credentials.authTokenEnv, placeholder }) : createPluginBroker(name, { userTokenStore });
+    brokersByProvider[name] = useTestBroker ? new TestCredentialBroker({
+      provider: name,
+      domains: credentials.apiDomains,
+      apiHeaders: credentials.apiHeaders,
+      envKey: credentials.authTokenEnv,
+      placeholder
+    }) : createPluginBroker(name, { userTokenStore });
   }
   const router = new ProviderCredentialRouter({ brokersByProvider });
   return new SkillCapabilityRuntime({
@@ -1362,9 +1405,11 @@ function createSkillCapabilityRuntime(options = {}) {
 }
 
 // src/chat/capabilities/jr-rpc-command.ts
-import { randomBytes } from "crypto";
 import { Bash, defineCommand } from "just-bash";
 
+// src/chat/oauth-flow.ts
+import { randomBytes } from "crypto";
+
 // src/chat/slack-actions/client.ts
 import { WebClient } from "@slack/web-api";
 var SlackActionError = class extends Error {
@@ -1620,19 +1665,36 @@ async function downloadPrivateSlackFile(url) {
   return Buffer.from(await response.arrayBuffer());
 }
 
-// src/chat/capabilities/jr-rpc-command.ts
+// src/chat/oauth-flow.ts
+var OAUTH_STATE_TTL_MS = 10 * 60 * 1e3;
+function formatProviderLabel(provider) {
+  return provider.charAt(0).toUpperCase() + provider.slice(1);
+}
+function resolveBaseUrl() {
+  const explicit = process.env.JUNIOR_BASE_URL?.trim();
+  if (explicit) return explicit;
+  const vercelProd = process.env.VERCEL_PROJECT_PRODUCTION_URL?.trim();
+  if (vercelProd) return `https://${vercelProd}`;
+  const vercelUrl = process.env.VERCEL_URL?.trim();
+  if (vercelUrl) return `https://${vercelUrl}`;
+  return void 0;
+}
 async function deliverPrivateMessage(input) {
   let client2;
   try {
     client2 = getSlackClient();
   } catch {
-    logWarn("oauth_private_delivery_skip", {}, { "app.reason": "missing_bot_token" }, "Skipped private message delivery \u2014 no SLACK_BOT_TOKEN");
+    logWarn(
+      "oauth_private_delivery_skip",
+      {},
+      { "app.reason": "missing_bot_token" },
+      "Skipped private message delivery \u2014 no SLACK_BOT_TOKEN"
+    );
     return false;
   }
   if (input.channelId) {
-    const isDm = isDmChannel(input.channelId);
     try {
-      if (isDm) {
+      if (isDmChannel(input.channelId)) {
         await client2.chat.postMessage({
           channel: input.channelId,
           text: input.text,
@@ -1648,35 +1710,113 @@ async function deliverPrivateMessage(input) {
       }
       return "in_context";
     } catch (error) {
-      const slackError = error instanceof Error ? error.message : String(error);
       logWarn(
         "oauth_private_delivery_failed",
         {},
-        { "app.slack.error": slackError, "app.slack.channel": input.channelId },
-        `${isDm ? "DM" : "Ephemeral"} message delivery failed, falling back to DM`
+        {
+          "app.slack.error": error instanceof Error ? error.message : String(error),
+          "app.slack.channel": input.channelId
+        },
+        "Private message delivery failed, falling back to DM"
       );
     }
   }
   try {
-    const openResult = await client2.conversations.open({ users: input.userId });
-    const dmChannelId = openResult.channel?.id;
+    const dmChannelId = (await client2.conversations.open({ users: input.userId })).channel?.id;
     if (!dmChannelId) {
-      logWarn("oauth_dm_fallback_failed", {}, { "app.reason": "no_dm_channel_id" }, "conversations.open returned no channel ID");
+      logWarn(
+        "oauth_dm_fallback_failed",
+        {},
+        { "app.reason": "no_dm_channel_id" },
+        "conversations.open returned no channel ID"
+      );
       return false;
     }
     await client2.chat.postMessage({ channel: dmChannelId, text: input.text });
     return "fallback_dm";
   } catch (error) {
-    const slackError = error instanceof Error ? error.message : String(error);
     logWarn(
       "oauth_dm_fallback_failed",
       {},
-      { "app.slack.error": slackError },
+      {
+        "app.slack.error": error instanceof Error ? error.message : String(error)
+      },
       "DM fallback delivery failed"
     );
     return false;
   }
 }
+async function startOAuthFlow(provider, input) {
+  const providerConfig = getPluginOAuthConfig(provider);
+  if (!providerConfig) {
+    return {
+      ok: false,
+      error: `Provider "${provider}" does not support OAuth authorization`
+    };
+  }
+  const clientId = process.env[providerConfig.clientIdEnv]?.trim();
+  if (!clientId) {
+    return {
+      ok: false,
+      error: `Missing ${providerConfig.clientIdEnv} environment variable`
+    };
+  }
+  const baseUrl = resolveBaseUrl();
+  if (!baseUrl) {
+    return {
+      ok: false,
+      error: "Cannot determine base URL (set JUNIOR_BASE_URL or deploy to Vercel)"
+    };
+  }
+  const configuration = input.userMessage && input.channelConfiguration ? await input.channelConfiguration.resolveValues() : void 0;
+  const state = randomBytes(32).toString("hex");
+  await getStateAdapter().set(
+    `oauth-state:${state}`,
+    {
+      userId: input.requesterId,
+      provider,
+      ...input.channelId ? { channelId: input.channelId } : {},
+      ...input.threadTs ? { threadTs: input.threadTs } : {},
+      ...input.userMessage ? { pendingMessage: input.userMessage } : {},
+      ...configuration && Object.keys(configuration).length > 0 ? { configuration } : {}
+    },
+    OAUTH_STATE_TTL_MS
+  );
+  const authorizeParams = new URLSearchParams({
+    client_id: clientId,
+    state,
+    redirect_uri: `${baseUrl}${providerConfig.callbackPath}`,
+    response_type: "code"
+  });
+  if (providerConfig.scope) {
+    authorizeParams.set("scope", providerConfig.scope);
+  }
+  for (const [key, value] of Object.entries(
+    providerConfig.authorizeParams ?? {}
+  )) {
+    authorizeParams.set(key, value);
+  }
+  logInfo(
+    "jr_rpc_oauth_start",
+    {},
+    {
+      "app.credential.provider": provider,
+      ...input.activeSkillName ? { "app.skill.name": input.activeSkillName } : {}
+    },
+    "Initiated OAuth authorization code flow"
+  );
+  return {
+    ok: true,
+    delivery: await deliverPrivateMessage({
+      channelId: input.channelId,
+      threadTs: input.threadTs,
+      userId: input.requesterId,
+      text: `<${providerConfig.authorizeEndpoint}?${authorizeParams.toString()}|Click here to link your ${formatProviderLabel(provider)} account>. Once you've authorized, you'll see a confirmation in Slack.`
+    })
+  };
+}
+
+// src/chat/capabilities/jr-rpc-command.ts
 function commandResult(input) {
   let stdout = "";
   if (typeof input.stdout === "string") {
@@ -1759,7 +1899,7 @@ async function handleIssueCredentialCommand(args, deps) {
       reason: `skill:${deps.activeSkill?.name ?? "unknown"}:jr-rpc:issue-credential`
     });
   } catch (error) {
-    if (error instanceof CredentialUnavailableError && getOAuthProviderConfig(error.provider) && deps.requesterId) {
+    if (error instanceof CredentialUnavailableError && getPluginOAuthConfig(error.provider) && deps.requesterId) {
       const oauthResult = await startOAuthFlow(error.provider, {
         requesterId: deps.requesterId,
         channelId: deps.channelId,
@@ -1769,14 +1909,14 @@ async function handleIssueCredentialCommand(args, deps) {
         activeSkillName: deps.activeSkill?.name ?? void 0
       });
       if (oauthResult.ok) {
-        const providerLabel2 = error.provider.charAt(0).toUpperCase() + error.provider.slice(1);
+        const providerLabel = formatProviderLabel(error.provider);
         return commandResult({
           stdout: {
             credential_unavailable: true,
             oauth_started: true,
             provider: error.provider,
             private_delivery_sent: !!oauthResult.delivery,
-            message: oauthResult.delivery ? `I need to connect your ${providerLabel2} account first. I've sent you a private authorization link.` : `I need to connect your ${providerLabel2} account first, but I wasn't able to send you a private authorization link. Please send me a direct message and try your command again.`
+            message: oauthResult.delivery ? `I need to connect your ${providerLabel} account first. I've sent you a private authorization link.` : `I need to connect your ${providerLabel} account first, but I wasn't able to send you a private authorization link. Please send me a direct message and try your command again.`
           },
           exitCode: 1
         });
@@ -1986,75 +2126,6 @@ ${usage}
 function isKnownProvider(provider) {
   return listCapabilityProviders().some((p) => p.provider === provider);
 }
-function getOAuthProviderConfig(provider) {
-  return getPluginOAuthConfig(provider);
-}
-var OAUTH_STATE_TTL_MS = 10 * 60 * 1e3;
-function resolveBaseUrl() {
-  const explicit = process.env.JUNIOR_BASE_URL?.trim();
-  if (explicit) return explicit;
-  const vercelProd = process.env.VERCEL_PROJECT_PRODUCTION_URL?.trim();
-  if (vercelProd) return `https://${vercelProd}`;
-  const vercelUrl = process.env.VERCEL_URL?.trim();
-  if (vercelUrl) return `https://${vercelUrl}`;
-  return void 0;
-}
-async function startOAuthFlow(provider, input) {
-  const providerConfig = getOAuthProviderConfig(provider);
-  if (!providerConfig) {
-    return { ok: false, error: `Provider "${provider}" does not support OAuth authorization` };
-  }
-  const clientId = process.env[providerConfig.clientIdEnv]?.trim();
-  if (!clientId) {
-    return { ok: false, error: `Missing ${providerConfig.clientIdEnv} environment variable` };
-  }
-  const baseUrl = resolveBaseUrl();
-  if (!baseUrl) {
-    return { ok: false, error: "Cannot determine base URL (set JUNIOR_BASE_URL or deploy to Vercel)" };
-  }
-  let configuration;
-  if (input.userMessage && input.channelConfiguration) {
-    configuration = await input.channelConfiguration.resolveValues();
-  }
-  const state = randomBytes(32).toString("hex");
-  const stateKey = `oauth-state:${state}`;
-  const stateAdapter = getStateAdapter();
-  const statePayload = {
-    userId: input.requesterId,
-    provider,
-    ...input.channelId ? { channelId: input.channelId } : {},
-    ...input.threadTs ? { threadTs: input.threadTs } : {},
-    ...input.userMessage ? { pendingMessage: input.userMessage } : {},
-    ...configuration && Object.keys(configuration).length > 0 ? { configuration } : {}
-  };
-  await stateAdapter.set(stateKey, statePayload, OAUTH_STATE_TTL_MS);
-  const redirectUri = `${baseUrl}${providerConfig.callbackPath}`;
-  const params = new URLSearchParams({
-    client_id: clientId,
-    scope: providerConfig.scope,
-    state,
-    redirect_uri: redirectUri,
-    response_type: "code"
-  });
-  const authorizeUrl = `${providerConfig.authorizeEndpoint}?${params.toString()}`;
-  logInfo(
-    "jr_rpc_oauth_start",
-    {},
-    {
-      "app.credential.provider": provider,
-      ...input.activeSkillName ? { "app.skill.name": input.activeSkillName } : {}
-    },
-    "Initiated OAuth authorization code flow"
-  );
-  const providerLabel2 = provider.charAt(0).toUpperCase() + provider.slice(1);
-  const delivery = await deliverPrivateMessage({
-    channelId: input.channelId,
-    threadTs: input.threadTs,
-    userId: input.requesterId,
-    text: `<${authorizeUrl}|Click here to link your ${providerLabel2} account>. Once you've authorized, you'll see a confirmation in Slack.`
-  });
-  return { ok: true, delivery };
-}
 async function handleOAuthStartCommand(args, deps) {
   const provider = (args[0] ?? "").trim();
   if (!provider) {
@@ -2071,14 +2142,14 @@ async function handleOAuthStartCommand(args, deps) {
   }
   if (deps.requesterId && deps.userTokenStore) {
     const stored = await deps.userTokenStore.get(deps.requesterId, provider);
-    if (stored && stored.expiresAt > Date.now()) {
-      const providerLabel2 = provider.charAt(0).toUpperCase() + provider.slice(1);
+    if (stored && (stored.expiresAt === void 0 || stored.expiresAt > Date.now())) {
+      const providerLabel = formatProviderLabel(provider);
       return commandResult({
         stdout: {
           ok: true,
           already_connected: true,
           provider,
-          message: `Your ${providerLabel2} account is already connected.`
+          message: `Your ${providerLabel} account is already connected.`
         },
         exitCode: 0
       });
@@ -2233,6 +2304,38 @@ function isExplicitChannelPostIntent(text) {
 }
 
 // src/chat/delivery/plan.ts
+var REACTION_ONLY_ACK_RE = /^(?::[a-z0-9_+-]+:|[\p{Extended_Pictographic}\uFE0F\u200D]+)$/u;
+var REDUNDANT_REACTION_ACK_TEXT = ["done", "got it", "ok", "okay"];
+var REACTION_ALIAS_PREFIX_RE = /^:[a-z0-9_+-]*$/i;
+function normalizeReactionAckText(text) {
+  return text.trim().toLowerCase().replace(/[!.]+$/g, "");
+}
+function isRedundantReactionAckText(text) {
+  const trimmed = text.trim();
+  if (!trimmed) {
+    return false;
+  }
+  if (REACTION_ONLY_ACK_RE.test(trimmed)) {
+    return true;
+  }
+  const normalized = normalizeReactionAckText(text);
+  return REDUNDANT_REACTION_ACK_TEXT.includes(
+    normalized
+  );
+}
+function isPotentialRedundantReactionAckText(text) {
+  const trimmed = text.trim();
+  if (!trimmed) {
+    return true;
+  }
+  if (REACTION_ONLY_ACK_RE.test(trimmed) || REACTION_ALIAS_PREFIX_RE.test(trimmed)) {
+    return true;
+  }
+  const normalized = normalizeReactionAckText(text);
+  return REDUNDANT_REACTION_ACK_TEXT.some(
+    (candidate) => candidate.startsWith(normalized)
+  );
+}
 function buildReplyDeliveryPlan(args) {
   const mode = args.explicitChannelPostIntent && args.channelPostPerformed ? "channel_only" : "thread";
   let attachFiles = "none";
@@ -2501,19 +2604,31 @@ async function discoverSkills(options) {
 }
 function parseSkillInvocation(messageText, availableSkills) {
   const trimmed = messageText.trim();
-  const match = /(?:^|\s)\/([a-z0-9]+(?:-[a-z0-9]+)*)(?:\s+([\s\S]*))?/i.exec(trimmed);
-  if (!match) {
-    return null;
-  }
-  const skillName = match[1].toLowerCase();
-  if (!availableSkills.some((s) => s.name === skillName)) {
-    return null;
-  }
-  const args = (match[2] ?? "").trim();
-  return {
-    skillName,
-    args
+  const toInvocation = (match, source) => {
+    if (!match) {
+      return null;
+    }
+    const skillName = match[1].toLowerCase();
+    if (!availableSkills.some((skill) => skill.name === skillName)) {
+      return null;
+    }
+    return {
+      skillName,
+      args: (match[2] ?? "").trim(),
+      source
+    };
   };
+  const hardBangInvocation = toInvocation(
+    /(?:^|\s)!([a-z0-9]+(?:-[a-z0-9]+)*)(?:\s+([\s\S]*))?/i.exec(trimmed),
+    "hard_bang"
+  );
+  if (hardBangInvocation) {
+    return hardBangInvocation;
+  }
+  return toInvocation(
+    /(?:^|\s)\/([a-z0-9]+(?:-[a-z0-9]+)*)(?:\s+([\s\S]*))?/i.exec(trimmed),
+    "legacy_slash"
+  );
 }
 function findSkillByName(skillName, available) {
   return available.find((skill) => skill.name === skillName) ?? null;
@@ -2736,8 +2851,135 @@ function createBashTool() {
   });
 }
 
-// src/chat/tools/image-generate.ts
+// src/chat/tools/attach-file.ts
+import path3 from "path";
 import { Type as Type2 } from "@sinclair/typebox";
+var MAX_ATTACH_FILE_BYTES = 10 * 1024 * 1024;
+var MIME_BY_EXTENSION = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".svg": "image/svg+xml",
+  ".pdf": "application/pdf",
+  ".txt": "text/plain",
+  ".md": "text/markdown",
+  ".json": "application/json",
+  ".csv": "text/csv",
+  ".log": "text/plain"
+};
+function normalizeSandboxPath(inputPath) {
+  const trimmed = inputPath.trim();
+  if (!trimmed) {
+    throw new Error("path is required");
+  }
+  if (path3.posix.isAbsolute(trimmed)) {
+    return trimmed;
+  }
+  return path3.posix.join(SANDBOX_WORKSPACE_ROOT, trimmed);
+}
+function sanitizeFilename(value, fallbackPath) {
+  const candidate = (value ?? "").trim();
+  if (candidate) {
+    const base = path3.posix.basename(candidate);
+    if (base && base !== "." && base !== "..") {
+      return base;
+    }
+  }
+  const derived = path3.posix.basename(fallbackPath);
+  if (derived && derived !== "." && derived !== "..") {
+    return derived;
+  }
+  return "attachment.bin";
+}
+function inferMimeType(filename, explicitMimeType) {
+  const explicit = explicitMimeType?.trim();
+  if (explicit) {
+    return explicit;
+  }
+  const ext = path3.extname(filename).toLowerCase();
+  return MIME_BY_EXTENSION[ext] ?? "application/octet-stream";
+}
+async function detectMimeType(sandbox, targetPath) {
+  try {
+    const result = await sandbox.runCommand({
+      cmd: "file",
+      args: ["--mime-type", "-b", targetPath]
+    });
+    if (result.exitCode !== 0) {
+      return void 0;
+    }
+    const value = (await result.stdout()).trim();
+    return value || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function createAttachFileTool(sandbox, hooks = {}) {
+  return tool({
+    description: "Attach a file from the sandbox to the Slack reply. Use this immediately after creating screenshots/reports when the user asks to see/share the actual file, not just its path.",
+    inputSchema: Type2.Object(
+      {
+        path: Type2.String({
+          minLength: 1,
+          description: "Absolute path (for example /tmp/screenshot.png) or workspace-relative path."
+        }),
+        filename: Type2.Optional(
+          Type2.String({
+            minLength: 1,
+            description: "Optional filename override shown in Slack."
+          })
+        ),
+        mimeType: Type2.Optional(
+          Type2.String({
+            minLength: 1,
+            description: "Optional MIME type override (for example image/png)."
+          })
+        )
+      },
+      { additionalProperties: false }
+    ),
+    execute: async ({ path: requestedPath, filename, mimeType }) => {
+      const targetPath = normalizeSandboxPath(requestedPath);
+      const fileBuffer = await sandbox.readFileToBuffer({ path: targetPath });
+      if (!fileBuffer) {
+        throw new Error(`failed to read file: ${targetPath}`);
+      }
+      if (fileBuffer.byteLength === 0) {
+        throw new Error(`file is empty: ${targetPath}`);
+      }
+      if (fileBuffer.byteLength > MAX_ATTACH_FILE_BYTES) {
+        throw new Error(
+          `file exceeds ${MAX_ATTACH_FILE_BYTES} bytes: ${targetPath} (${fileBuffer.byteLength} bytes)`
+        );
+      }
+      const resolvedFilename = sanitizeFilename(filename, targetPath);
+      const detectedMimeType = await detectMimeType(sandbox, targetPath);
+      const resolvedMimeType = inferMimeType(
+        resolvedFilename,
+        mimeType ?? detectedMimeType
+      );
+      const upload = {
+        data: fileBuffer,
+        filename: resolvedFilename,
+        mimeType: resolvedMimeType
+      };
+      hooks.onGeneratedFiles?.([upload]);
+      return {
+        ok: true,
+        attached: true,
+        path: targetPath,
+        filename: resolvedFilename,
+        mime_type: resolvedMimeType,
+        bytes: fileBuffer.byteLength
+      };
+    }
+  });
+}
+
+// src/chat/tools/image-generate.ts
+import { Type as Type3 } from "@sinclair/typebox";
 
 // src/chat/pi/client.ts
 import { completeSimple, getEnvApiKey, getModels } from "@mariozechner/pi-ai";
@@ -3018,8 +3260,8 @@ function parseImageGenerationError(status, body, model) {
 function createImageGenerateTool(hooks) {
   return tool({
     description: "Generate images from a prompt. Use when the user wants to visually show or represent something \u2014 feelings, concepts, art, humor, or any visual idea. Also use for explicit image creation requests.",
-    inputSchema: Type2.Object({
-      prompt: Type2.String({
+    inputSchema: Type3.Object({
+      prompt: Type3.String({
         minLength: 1,
         maxLength: 4e3,
         description: "Image generation prompt."
@@ -3095,7 +3337,7 @@ function createImageGenerateTool(hooks) {
 }
 
 // src/chat/tools/load-skill.ts
-import { Type as Type3 } from "@sinclair/typebox";
+import { Type as Type4 } from "@sinclair/typebox";
 function toLoadedSkill(result) {
   if (result.ok !== true || typeof result.skill_name !== "string" || typeof result.description !== "string" || typeof result.skill_dir !== "string" || typeof result.instructions !== "string") {
     return null;
@@ -3144,9 +3386,9 @@ async function loadSkillFromSandbox(sandbox, availableSkills, skillName) {
 }
 function createLoadSkillTool(sandbox, availableSkills, options) {
   return tool({
-    description: "Load a skill by name so its instructions are available for this turn. Use when a request clearly matches a known skill or a slash command references one. Do not use when no skill is relevant.",
-    inputSchema: Type3.Object({
-      skill_name: Type3.String({
+    description: "Load a skill by name so its instructions are available for this turn. Use when a request clearly matches a known skill. Do not use when no skill is relevant.",
+    inputSchema: Type4.Object({
+      skill_name: Type4.String({
         minLength: 1,
         description: "Skill name to load, without the leading slash."
       })
@@ -3163,12 +3405,12 @@ function createLoadSkillTool(sandbox, availableSkills, options) {
 }
 
 // src/chat/tools/read-file.ts
-import { Type as Type4 } from "@sinclair/typebox";
+import { Type as Type5 } from "@sinclair/typebox";
 function createReadFileTool() {
   return tool({
     description: "Read a file from the sandbox workspace. Use when you need exact file contents to verify facts or make edits safely. Do not use for broad discovery when search tools are better.",
-    inputSchema: Type4.Object({
-      path: Type4.String({
+    inputSchema: Type5.Object({
+      path: Type5.String({
         minLength: 1,
         description: "Path to the file in the sandbox workspace."
       })
@@ -3180,7 +3422,7 @@ function createReadFileTool() {
 }
 
 // src/chat/tools/slack-channel-list-messages.ts
-import { Type as Type5 } from "@sinclair/typebox";
+import { Type as Type6 } from "@sinclair/typebox";
 
 // src/chat/slack-actions/channel.ts
 async function postMessageToChannel(input) {
@@ -3353,39 +3595,39 @@ async function listThreadReplies(input) {
 function createSlackChannelListMessagesTool(context) {
   return tool({
     description: "List channel messages from Slack history in the active channel context. Use when the user asks for recent or historical channel context outside this thread. Do not use for live monitoring or when current thread context already answers the question.",
-    inputSchema: Type5.Object({
-      limit: Type5.Optional(
-        Type5.Integer({
+    inputSchema: Type6.Object({
+      limit: Type6.Optional(
+        Type6.Integer({
           minimum: 1,
           maximum: 1e3,
           description: "Maximum number of messages to return across pages."
         })
       ),
-      cursor: Type5.Optional(
-        Type5.String({
+      cursor: Type6.Optional(
+        Type6.String({
           minLength: 1,
           description: "Optional cursor to continue from a prior call."
         })
       ),
-      oldest: Type5.Optional(
-        Type5.String({
+      oldest: Type6.Optional(
+        Type6.String({
           minLength: 1,
           description: "Optional oldest message timestamp (Slack ts) for range filtering."
         })
       ),
-      latest: Type5.Optional(
-        Type5.String({
+      latest: Type6.Optional(
+        Type6.String({
           minLength: 1,
           description: "Optional latest message timestamp (Slack ts) for range filtering."
         })
       ),
-      inclusive: Type5.Optional(
-        Type5.Boolean({
+      inclusive: Type6.Optional(
+        Type6.Boolean({
           description: "Whether oldest/latest bounds should be inclusive."
         })
       ),
-      max_pages: Type5.Optional(
-        Type5.Integer({
+      max_pages: Type6.Optional(
+        Type6.Integer({
           minimum: 1,
           maximum: 10,
           description: "Maximum number of API pages to traverse in a single call."
@@ -3418,7 +3660,7 @@ function createSlackChannelListMessagesTool(context) {
 }
 
 // src/chat/tools/slack-channel-post-message.ts
-import { Type as Type6 } from "@sinclair/typebox";
+import { Type as Type7 } from "@sinclair/typebox";
 
 // src/chat/tools/idempotency.ts
 function stableSerialize(value) {
@@ -3440,8 +3682,8 @@ function createOperationKey(toolName, input) {
 function createSlackChannelPostMessageTool(context, state) {
   return tool({
     description: "Post a message in the active Slack channel context (outside the thread). Use this when the user explicitly asks to post/send/share/say something in the channel. Do not use for normal thread replies or speculative broadcasts. Do not claim a channel message was posted unless this tool succeeds in this turn.",
-    inputSchema: Type6.Object({
-      text: Type6.String({
+    inputSchema: Type7.Object({
+      text: Type7.String({
         minLength: 1,
         maxLength: 4e4,
         description: "Slack mrkdwn text to post."
@@ -3480,13 +3722,13 @@ function createSlackChannelPostMessageTool(context, state) {
 }
 
 // src/chat/tools/slack-message-add-reaction.ts
-import { Type as Type7 } from "@sinclair/typebox";
+import { Type as Type8 } from "@sinclair/typebox";
 var SLACK_EMOJI_NAME_RE = /^[a-z0-9_+-]+$/;
 function createSlackMessageAddReactionTool(context, state) {
   return tool({
     description: "Add an emoji reaction to the current inbound Slack message. Use sparingly for lightweight acknowledgements. Provide a Slack emoji alias name (for example `thumbsup` or `white_check_mark`), not a unicode emoji glyph. The target message is injected by runtime context; do not use this for arbitrary historical messages.",
-    inputSchema: Type7.Object({
-      emoji: Type7.String({
+    inputSchema: Type8.Object({
+      emoji: Type8.String({
         minLength: 1,
         maxLength: 64,
         description: "Slack emoji alias name to react with (for example `thumbsup` or `white_check_mark`). Optional surrounding colons are allowed."
@@ -3541,7 +3783,7 @@ function createSlackMessageAddReactionTool(context, state) {
 }
 
 // src/chat/tools/slack-canvas-create.ts
-import { Type as Type8 } from "@sinclair/typebox";
+import { Type as Type9 } from "@sinclair/typebox";
 
 // src/chat/slack-actions/canvases.ts
 function normalizeCanvasMarkdown(markdown) {
@@ -3669,13 +3911,13 @@ function mergeRecentCanvases(existing, created) {
 function createSlackCanvasCreateTool(context, state) {
   return tool({
     description: "Create a Slack canvas for long-form output in the active assistant context channel. Use when content is too long for a thread reply or needs a persistent document. Do not use for short answers that fit in-thread.",
-    inputSchema: Type8.Object({
-      title: Type8.String({
+    inputSchema: Type9.Object({
+      title: Type9.String({
         minLength: 1,
         maxLength: 160,
         description: "Canvas title."
       }),
-      markdown: Type8.String({
+      markdown: Type9.String({
         minLength: 1,
         description: "Canvas markdown body content."
       })
@@ -3737,29 +3979,29 @@ function createSlackCanvasCreateTool(context, state) {
 }
 
 // src/chat/tools/slack-canvas-update.ts
-import { Type as Type9 } from "@sinclair/typebox";
+import { Type as Type10 } from "@sinclair/typebox";
 function createSlackCanvasUpdateTool(state, _context) {
   return tool({
     description: "Update the active Slack canvas tracked in artifact context. Use when continuing or correcting a document already tracked in this thread. Do not use to create a brand-new long-form artifact.",
-    inputSchema: Type9.Object({
-      markdown: Type9.String({
+    inputSchema: Type10.Object({
+      markdown: Type10.String({
         minLength: 1,
         description: "Markdown content to insert or use as replacement text."
       }),
-      operation: Type9.Optional(
-        Type9.Union(
-          [Type9.Literal("insert_at_end"), Type9.Literal("insert_at_start"), Type9.Literal("replace")],
+      operation: Type10.Optional(
+        Type10.Union(
+          [Type10.Literal("insert_at_end"), Type10.Literal("insert_at_start"), Type10.Literal("replace")],
           { description: "Canvas update mode." }
         )
       ),
-      section_id: Type9.Optional(
-        Type9.String({
+      section_id: Type10.Optional(
+        Type10.String({
           minLength: 1,
           description: "Optional section ID required for targeted replace operations."
         })
       ),
-      section_contains_text: Type9.Optional(
-        Type9.String({
+      section_contains_text: Type10.Optional(
+        Type10.String({
           minLength: 1,
           description: "Optional helper text used to find the target section when section_id is not provided."
         })
@@ -3819,7 +4061,7 @@ function createSlackCanvasUpdateTool(state, _context) {
 }
 
 // src/chat/tools/slack-list-add-items.ts
-import { Type as Type10 } from "@sinclair/typebox";
+import { Type as Type11 } from "@sinclair/typebox";
 
 // src/chat/slack-actions/lists.ts
 function normalizeKey(value) {
@@ -3984,20 +4226,20 @@ async function updateListItem(input) {
 function createSlackListAddItemsTool(state) {
   return tool({
     description: "Add tasks to the active Slack list tracked in artifact context. Use when the user wants actionable items recorded in the current thread list. Do not use when no list exists and list creation was not requested.",
-    inputSchema: Type10.Object({
-      items: Type10.Array(Type10.String({ minLength: 1 }), {
+    inputSchema: Type11.Object({
+      items: Type11.Array(Type11.String({ minLength: 1 }), {
         minItems: 1,
         maxItems: 25,
         description: "List item titles to create."
       }),
-      assignee_user_id: Type10.Optional(
-        Type10.String({
+      assignee_user_id: Type11.Optional(
+        Type11.String({
           minLength: 1,
           description: "Optional Slack user ID assigned to all created items."
         })
       ),
-      due_date: Type10.Optional(
-        Type10.String({
+      due_date: Type11.Optional(
+        Type11.String({
           pattern: "^\\d{4}-\\d{2}-\\d{2}$",
           description: "Optional due date in YYYY-MM-DD format."
         })
@@ -4045,12 +4287,12 @@ function createSlackListAddItemsTool(state) {
 }
 
 // src/chat/tools/slack-list-create.ts
-import { Type as Type11 } from "@sinclair/typebox";
+import { Type as Type12 } from "@sinclair/typebox";
 function createSlackListCreateTool(state) {
   return tool({
     description: "Create a Slack todo list for action tracking. Use when the user needs structured tasks with ownership/completion tracking. Do not use for one-off notes without task management needs.",
-    inputSchema: Type11.Object({
-      name: Type11.String({
+    inputSchema: Type12.Object({
+      name: Type12.String({
         minLength: 1,
         maxLength: 160,
         description: "Name for the new Slack list."
@@ -4084,13 +4326,13 @@ function createSlackListCreateTool(state) {
 }
 
 // src/chat/tools/slack-list-get-items.ts
-import { Type as Type12 } from "@sinclair/typebox";
+import { Type as Type13 } from "@sinclair/typebox";
 function createSlackListGetItemsTool(state) {
   return tool({
     description: "Read items from the active Slack list tracked in artifact context. Use when the user asks for task status, open items, or list contents. Do not use when list state is already known from the immediately prior result.",
-    inputSchema: Type12.Object({
-      limit: Type12.Optional(
-        Type12.Integer({
+    inputSchema: Type13.Object({
+      limit: Type13.Optional(
+        Type13.Integer({
           minimum: 1,
           maximum: 200,
           description: "Maximum number of list items to return."
@@ -4114,23 +4356,23 @@ function createSlackListGetItemsTool(state) {
 }
 
 // src/chat/tools/slack-list-update-item.ts
-import { Type as Type13 } from "@sinclair/typebox";
+import { Type as Type14 } from "@sinclair/typebox";
 function createSlackListUpdateItemTool(state) {
   return tool({
     description: "Update an item in the active Slack list tracked in artifact context (title/completion). Use when the user asks to mark progress or rename a tracked task. Do not use to add new tasks.",
-    inputSchema: Type13.Object(
+    inputSchema: Type14.Object(
       {
-        item_id: Type13.String({
+        item_id: Type14.String({
           minLength: 1,
           description: "ID of the Slack list item to update."
         }),
-        completed: Type13.Optional(
-          Type13.Boolean({
+        completed: Type14.Optional(
+          Type14.Boolean({
             description: "Optional completion status update."
           })
         ),
-        title: Type13.Optional(
-          Type13.String({
+        title: Type14.Optional(
+          Type14.String({
             minLength: 1,
             description: "Optional new item title."
           })
@@ -4180,11 +4422,11 @@ function createSlackListUpdateItemTool(state) {
 }
 
 // src/chat/tools/system-time.ts
-import { Type as Type14 } from "@sinclair/typebox";
+import { Type as Type15 } from "@sinclair/typebox";
 function createSystemTimeTool() {
   return tool({
     description: "Return current system time in UTC and local ISO formats. Use when the user asks for current time/date context. Do not use as a substitute for historical or timezone-conversion research.",
-    inputSchema: Type14.Object({}),
+    inputSchema: Type15.Object({}),
     execute: async () => {
       const now = /* @__PURE__ */ new Date();
       return {
@@ -4199,7 +4441,7 @@ function createSystemTimeTool() {
 }
 
 // src/chat/tools/web-fetch.ts
-import { Type as Type15 } from "@sinclair/typebox";
+import { Type as Type16 } from "@sinclair/typebox";
 
 // src/chat/tools/constants.ts
 var USER_AGENT = "junior-bot/0.1";
@@ -4528,13 +4770,13 @@ function extractHttpStatusFromMessage(message) {
 function createWebFetchTool(hooks) {
   return tool({
     description: "Fetch and extract readable content from a specific URL. Use when you need details from a known page or document. Do not use for discovery when search is the first step.",
-    inputSchema: Type15.Object({
-      url: Type15.String({
+    inputSchema: Type16.Object({
+      url: Type16.String({
         minLength: 1,
         description: "HTTP(S) URL to fetch."
       }),
-      max_chars: Type15.Optional(
-        Type15.Integer({
+      max_chars: Type16.Optional(
+        Type16.Integer({
           minimum: 500,
           maximum: MAX_FETCH_CHARS,
           description: "Optional maximum number of extracted characters to return."
@@ -4587,7 +4829,7 @@ function createWebFetchTool(hooks) {
 // src/chat/tools/web-search.ts
 import { generateText } from "ai";
 import { createGatewayProvider } from "@ai-sdk/gateway";
-import { Type as Type16 } from "@sinclair/typebox";
+import { Type as Type17 } from "@sinclair/typebox";
 var SEARCH_TIMEOUT_MS = 1e4;
 var MAX_RESULTS = 5;
 var DEFAULT_SEARCH_MODEL = "xai/grok-4-fast-reasoning";
@@ -4638,14 +4880,14 @@ function isTimeoutSearchFailure(message) {
 function createWebSearchTool() {
   return tool({
     description: "Search public web sources and return top snippets/URLs. Use when you need discovery or source candidates. Do not use when the user already provided a specific URL to inspect.",
-    inputSchema: Type16.Object({
-      query: Type16.String({
+    inputSchema: Type17.Object({
+      query: Type17.String({
         minLength: 1,
         maxLength: 500,
         description: "Search query."
       }),
-      max_results: Type16.Optional(
-        Type16.Integer({
+      max_results: Type17.Optional(
+        Type17.Integer({
           minimum: 1,
           maximum: MAX_RESULTS,
           description: "Max results to return."
@@ -4710,16 +4952,16 @@ function createWebSearchTool() {
 }
 
 // src/chat/tools/write-file.ts
-import { Type as Type17 } from "@sinclair/typebox";
+import { Type as Type18 } from "@sinclair/typebox";
 function createWriteFileTool() {
   return tool({
     description: "Write UTF-8 content to a file in the sandbox workspace. Use for intentional file creation or replacement after validation. Do not use for exploratory analysis-only turns.",
-    inputSchema: Type17.Object({
-      path: Type17.String({
+    inputSchema: Type18.Object({
+      path: Type18.String({
         minLength: 1,
         description: "Path to write in the sandbox workspace."
       }),
-      content: Type17.String({
+      content: Type18.String({
         description: "UTF-8 file content to write."
       })
     }, { additionalProperties: false }),
@@ -4793,15 +5035,40 @@ function createTools(availableSkills, hooks = {}, context) {
     ),
     systemTime: wrapToolExecution("systemTime", createSystemTimeTool(), hooks),
     bash: wrapToolExecution("bash", createBashTool(), hooks),
+    attachFile: wrapToolExecution(
+      "attachFile",
+      createAttachFileTool(context.sandbox, hooks),
+      hooks
+    ),
     readFile: wrapToolExecution("readFile", createReadFileTool(), hooks),
     writeFile: wrapToolExecution("writeFile", createWriteFileTool(), hooks),
     webSearch: wrapToolExecution("webSearch", createWebSearchTool(), hooks),
     webFetch: wrapToolExecution("webFetch", createWebFetchTool(hooks), hooks),
-    imageGenerate: wrapToolExecution("imageGenerate", createImageGenerateTool(hooks), hooks),
-    slackCanvasUpdate: wrapToolExecution("slackCanvasUpdate", createSlackCanvasUpdateTool(state, context), hooks),
-    slackListCreate: wrapToolExecution("slackListCreate", createSlackListCreateTool(state), hooks),
-    slackListAddItems: wrapToolExecution("slackListAddItems", createSlackListAddItemsTool(state), hooks),
-    slackListGetItems: wrapToolExecution("slackListGetItems", createSlackListGetItemsTool(state), hooks),
+    imageGenerate: wrapToolExecution(
+      "imageGenerate",
+      createImageGenerateTool(hooks),
+      hooks
+    ),
+    slackCanvasUpdate: wrapToolExecution(
+      "slackCanvasUpdate",
+      createSlackCanvasUpdateTool(state, context),
+      hooks
+    ),
+    slackListCreate: wrapToolExecution(
+      "slackListCreate",
+      createSlackListCreateTool(state),
+      hooks
+    ),
+    slackListAddItems: wrapToolExecution(
+      "slackListAddItems",
+      createSlackListAddItemsTool(state),
+      hooks
+    ),
+    slackListGetItems: wrapToolExecution(
+      "slackListGetItems",
+      createSlackListGetItemsTool(state),
+      hooks
+    ),
     slackListUpdateItem: wrapToolExecution(
       "slackListUpdateItem",
       createSlackListUpdateItemTool(state),
@@ -4839,7 +5106,7 @@ function createTools(availableSkills, hooks = {}, context) {
 
 // src/chat/sandbox/sandbox.ts
 import fs4 from "fs/promises";
-import path3 from "path";
+import path4 from "path";
 import { Sandbox } from "@vercel/sandbox";
 import { createBashTool as createBashTool2 } from "bash-tool";
 
@@ -4939,20 +5206,32 @@ function extractHttpErrorDetails(error, options = {}) {
 // src/chat/sandbox/sandbox.ts
 var SANDBOX_TOOL_NAMES = /* @__PURE__ */ new Set(["bash", "readFile", "writeFile"]);
 var DEFAULT_MAX_OUTPUT_LENGTH = 3e4;
+var SANDBOX_RUNTIME = "node22";
 var SANDBOX_RUNTIME_BIN_DIR = `${SANDBOX_WORKSPACE_ROOT}/.junior/bin`;
-var SANDBOX_ERROR_FIELDS = [{ sourceKey: "sandboxId", attributeKey: "sandbox_id", summaryKey: "sandboxId" }];
+var SANDBOX_ERROR_FIELDS = [
+  {
+    sourceKey: "sandboxId",
+    attributeKey: "sandbox_id",
+    summaryKey: "sandboxId"
+  }
+];
 function mergeNetworkPolicyWithHeaderTransforms(networkPolicy, headerTransforms) {
   const basePolicy = networkPolicy && typeof networkPolicy === "object" && !Array.isArray(networkPolicy) ? { ...networkPolicy } : {};
   const existingAllowRaw = basePolicy.allow;
   const existingAllow = existingAllowRaw && typeof existingAllowRaw === "object" && !Array.isArray(existingAllowRaw) ? Object.fromEntries(
-    Object.entries(existingAllowRaw).map(([domain, rules]) => [
-      domain,
-      Array.isArray(rules) ? [...rules] : []
-    ])
+    Object.entries(existingAllowRaw).map(
+      ([domain, rules]) => [
+        domain,
+        Array.isArray(rules) ? [...rules] : []
+      ]
+    )
   ) : { "*": [] };
   for (const transform of headerTransforms) {
     const currentRules = existingAllow[transform.domain] ?? [];
-    existingAllow[transform.domain] = [...currentRules, { transform: [{ headers: transform.headers }] }];
+    existingAllow[transform.domain] = [
+      ...currentRules,
+      { transform: [{ headers: transform.headers }] }
+    ];
   }
   return {
     ...basePolicy,
@@ -4972,7 +5251,7 @@ function truncateOutput(output, maxLength) {
   };
 }
 function toPosixRelative(base, absolute) {
-  return path3.relative(base, absolute).split(path3.sep).join("/");
+  return path4.relative(base, absolute).split(path4.sep).join("/");
 }
 async function listFilesRecursive(root) {
   const queue = [root];
@@ -4982,7 +5261,7 @@ async function listFilesRecursive(root) {
     const entries = await fs4.readdir(dir, { withFileTypes: true });
     entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      const absolute = path3.join(dir, entry.name);
+      const absolute = path4.join(dir, entry.name);
       if (entry.isDirectory()) {
         queue.push(absolute);
       } else if (entry.isFile()) {
@@ -5024,7 +5303,7 @@ async function buildSkillSyncFiles(availableSkills) {
 function collectDirectories(filesToWrite) {
   const directoriesToEnsure = /* @__PURE__ */ new Set();
   for (const file of filesToWrite) {
-    const normalizedPath = path3.posix.normalize(file.path);
+    const normalizedPath = path4.posix.normalize(file.path);
     const parts = normalizedPath.split("/").filter(Boolean);
     let current = "";
     for (let index = 0; index < parts.length - 1; index += 1) {
@@ -5032,7 +5311,9 @@ function collectDirectories(filesToWrite) {
       directoriesToEnsure.add(current);
     }
   }
-  return Array.from(directoriesToEnsure).filter((directory) => directory === SANDBOX_WORKSPACE_ROOT || directory.startsWith(`${SANDBOX_WORKSPACE_ROOT}/`)).sort((a, b) => a.length - b.length);
+  return Array.from(directoriesToEnsure).filter(
+    (directory) => directory === SANDBOX_WORKSPACE_ROOT || directory.startsWith(`${SANDBOX_WORKSPACE_ROOT}/`)
+  ).sort((a, b) => a.length - b.length);
 }
 function getSandboxErrorDetails(error) {
   return extractHttpErrorDetails(error, {
@@ -5086,7 +5367,9 @@ function wrapSandboxSetupError(error) {
   try {
     const details = getSandboxErrorDetails(error);
     if (details.summary) {
-      return new Error(`sandbox setup failed (${details.summary})`, { cause: error });
+      return new Error(`sandbox setup failed (${details.summary})`, {
+        cause: error
+      });
     }
   } catch {
   }
@@ -5112,9 +5395,12 @@ function throwSandboxOperationError(action, error, includeMissingPath = false) {
     "app.sandbox.success": false
   });
   setSpanStatus("error");
-  throw new Error(details.summary ? `${action} failed (${details.summary})` : `${action} failed`, {
-    cause: error
-  });
+  throw new Error(
+    details.summary ? `${action} failed (${details.summary})` : `${action} failed`,
+    {
+      cause: error
+    }
+  );
 }
 function createSandboxExecutor(options) {
   let sandbox = null;
@@ -5124,6 +5410,7 @@ function createSandboxExecutor(options) {
   const timeoutMs = options?.timeoutMs ?? 1e3 * 60 * 30;
   const traceContext = options?.traceContext ?? {};
   const emitStatus = options?.onStatus;
+  const dependencyProfileHash = getRuntimeDependencyProfileHash(SANDBOX_RUNTIME);
   const withSandboxSpan = (name, op, attributes, callback) => withSpan(name, op, traceContext, callback, attributes);
   const invalidateSandboxInstance = async (targetSandbox, reason) => {
     if (sandbox === targetSandbox) {
@@ -5153,7 +5440,10 @@ function createSandboxExecutor(options) {
       },
       async () => {
         const filesToWrite = await buildSkillSyncFiles(availableSkills);
-        const bytesWritten = filesToWrite.reduce((total, file) => total + file.content.length, 0);
+        const bytesWritten = filesToWrite.reduce(
+          (total, file) => total + file.content.length,
+          0
+        );
         const directories = collectDirectories(filesToWrite);
         await withSandboxSpan(
           "sandbox.sync_writeFiles",
@@ -5204,7 +5494,7 @@ function createSandboxExecutor(options) {
           throw wrapSandboxSetupError(error);
         };
         const createFreshSandbox = async () => {
-          const runtime = "node22";
+          const runtime = SANDBOX_RUNTIME;
           let statusCount = 0;
           const sentStatuses = /* @__PURE__ */ new Set();
           const emitSandboxStatus = async (status) => {
@@ -5253,9 +5543,13 @@ function createSandboxExecutor(options) {
                   "app.sandbox.source": snapshot.snapshotId ? "snapshot" : "created",
                   "app.sandbox.snapshot.cache_hit": snapshot.cacheHit,
                   "app.sandbox.snapshot.resolve_outcome": snapshot.resolveOutcome,
-                  ...snapshot.profileHash ? { "app.sandbox.snapshot.profile_hash": snapshot.profileHash } : {},
+                  ...snapshot.profileHash ? {
+                    "app.sandbox.snapshot.profile_hash": snapshot.profileHash
+                  } : {},
                   "app.sandbox.snapshot.dependency_count": snapshot.dependencyCount,
-                  ...snapshot.rebuildReason ? { "app.sandbox.snapshot.rebuild_reason": snapshot.rebuildReason } : {}
+                  ...snapshot.rebuildReason ? {
+                    "app.sandbox.snapshot.rebuild_reason": snapshot.rebuildReason
+                  } : {}
                 });
                 if (!snapshot.snapshotId) {
                   await emitSandboxStatus("Starting sandbox...");
@@ -5290,7 +5584,9 @@ function createSandboxExecutor(options) {
                   if (!rebuiltSnapshot.snapshotId) {
                     throw error;
                   }
-                  await emitSandboxStatus("Retrying sandbox startup with a fresh snapshot...");
+                  await emitSandboxStatus(
+                    "Retrying sandbox startup with a fresh snapshot..."
+                  );
                   return await Sandbox.create({
                     timeout: timeoutMs,
                     source: {
@@ -5311,6 +5607,17 @@ function createSandboxExecutor(options) {
           }
           return assignSandbox(createdSandbox);
         };
+        if (!sandbox && sandboxIdHint && dependencyProfileHash !== options?.sandboxDependencyProfileHash) {
+          setSpanAttributes({
+            "app.sandbox.reused": false,
+            "app.sandbox.recreate.reason": "dependency_profile_mismatch",
+            ...options?.sandboxDependencyProfileHash ? {
+              "app.sandbox.previous_profile_hash": options.sandboxDependencyProfileHash
+            } : {},
+            ...dependencyProfileHash ? { "app.sandbox.current_profile_hash": dependencyProfileHash } : {}
+          });
+          sandboxIdHint = void 0;
+        }
         const recoverUnavailableSandbox = async (source) => {
           setSpanAttributes({
             "app.sandbox.recovery.attempted": true,
@@ -5405,11 +5712,16 @@ function createSandboxExecutor(options) {
         const restoreNetworkPolicy = activeSandbox.networkPolicy ?? "allow-all";
         const headerTransforms = input.headerTransforms;
         if (headerTransforms && headerTransforms.length > 0) {
-          const policy = mergeNetworkPolicyWithHeaderTransforms(restoreNetworkPolicy, headerTransforms);
+          const policy = mergeNetworkPolicyWithHeaderTransforms(
+            restoreNetworkPolicy,
+            headerTransforms
+          );
           await activeSandbox.updateNetworkPolicy(policy);
         }
         const pathPrefix = `${SANDBOX_RUNTIME_BIN_DIR}:$PATH`;
-        const envExports = input.env ? Object.entries(input.env).map(([key, value]) => `export ${key}='${value.replace(/'/g, "'\\''")}'`).join(" && ") : "";
+        const envExports = input.env ? Object.entries(input.env).map(
+          ([key, value]) => `export ${key}='${value.replace(/'/g, "'\\''")}'`
+        ).join(" && ") : "";
         const preamble = envExports ? `export PATH="${pathPrefix}" && ${envExports}` : `export PATH="${pathPrefix}"`;
         let commandError;
         try {
@@ -5418,7 +5730,10 @@ function createSandboxExecutor(options) {
             args: ["-c", `${preamble} && ${input.command}`],
             cwd: SANDBOX_WORKSPACE_ROOT
           });
-          const maxOutputLength = Number.parseInt(process.env.SANDBOX_BASH_MAX_OUTPUT_CHARS ?? "", 10);
+          const maxOutputLength = Number.parseInt(
+            process.env.SANDBOX_BASH_MAX_OUTPUT_CHARS ?? "",
+            10
+          );
           const boundedOutputLength = Number.isFinite(maxOutputLength) && maxOutputLength > 0 ? maxOutputLength : DEFAULT_MAX_OUTPUT_LENGTH;
           const stdoutRaw = await commandResult2.stdout();
           const stderrRaw = await commandResult2.stderr();
@@ -5473,7 +5788,10 @@ function createSandboxExecutor(options) {
       }
     }
     const activeSandbox = await createSandbox();
-    const keepAliveMs = Number.parseInt(process.env.VERCEL_SANDBOX_KEEPALIVE_MS ?? "0", 10);
+    const keepAliveMs = Number.parseInt(
+      process.env.VERCEL_SANDBOX_KEEPALIVE_MS ?? "0",
+      10
+    );
     if (Number.isFinite(keepAliveMs) && keepAliveMs > 0) {
       try {
         await withSandboxSpan(
@@ -5492,12 +5810,18 @@ function createSandboxExecutor(options) {
     if (params.toolName === "bash") {
       const command = bashCommand;
       const headerTransformsInput = rawInput.headerTransforms;
-      const headerTransforms = Array.isArray(headerTransformsInput) ? headerTransformsInput.filter((value) => Boolean(value && typeof value === "object")).map((transform) => ({
+      const headerTransforms = Array.isArray(headerTransformsInput) ? headerTransformsInput.filter(
+        (value) => Boolean(value && typeof value === "object")
+      ).map((transform) => ({
         domain: String(transform.domain ?? "").trim(),
         headers: transform.headers && typeof transform.headers === "object" && !Array.isArray(transform.headers) ? Object.fromEntries(
-          Object.entries(transform.headers).filter(([, value]) => typeof value === "string").map(([key, value]) => [key, value])
+          Object.entries(
+            transform.headers
+          ).filter(([, value]) => typeof value === "string").map(([key, value]) => [key, value])
         ) : {}
-      })).filter((transform) => transform.domain.length > 0 && Object.keys(transform.headers).length > 0) : void 0;
+      })).filter(
+        (transform) => transform.domain.length > 0 && Object.keys(transform.headers).length > 0
+      ) : void 0;
       const envInput = rawInput.env;
       const env = envInput && typeof envInput === "object" && !Array.isArray(envInput) ? Object.fromEntries(
         Object.entries(envInput).filter(([, value]) => typeof value === "string").map(([key, value]) => [key, value])
@@ -5511,11 +5835,21 @@ function createSandboxExecutor(options) {
         },
         async () => {
           try {
-            const response = await executeBash({ command, ...headerTransforms ? { headerTransforms } : {}, ...env ? { env } : {} });
+            const response = await executeBash({
+              command,
+              ...headerTransforms ? { headerTransforms } : {},
+              ...env ? { env } : {}
+            });
             setSpanAttributes({
               "process.exit.code": response.exitCode,
-              "app.sandbox.stdout_bytes": Buffer.byteLength(response.stdout ?? "", "utf8"),
-              "app.sandbox.stderr_bytes": Buffer.byteLength(response.stderr ?? "", "utf8"),
+              "app.sandbox.stdout_bytes": Buffer.byteLength(
+                response.stdout ?? "",
+                "utf8"
+              ),
+              "app.sandbox.stderr_bytes": Buffer.byteLength(
+                response.stderr ?? "",
+                "utf8"
+              ),
               ...response.exitCode !== 0 ? { "error.type": "nonzero_exit" } : {}
             });
             setSpanStatus(response.exitCode === 0 ? "ok" : "error");
@@ -5630,6 +5964,9 @@ function createSandboxExecutor(options) {
     getSandboxId() {
       return sandbox?.sandboxId ?? sandboxIdHint;
     },
+    getDependencyProfileHash() {
+      return dependencyProfileHash;
+    },
     canExecute(toolName) {
       return SANDBOX_TOOL_NAMES.has(toolName);
     },
@@ -5742,6 +6079,35 @@ function isRetryableTurnError(error, reason) {
   return error.reason === reason;
 }
 
+// src/chat/attachment-claims.ts
+function splitSentences(text) {
+  return text.split(/\n+/).flatMap((line) => line.split(/(?<=[.!?])\s+/)).map((part) => part.trim()).filter((part) => part.length > 0);
+}
+function sentenceClaimsAttachment(sentence) {
+  const hasAttachmentNoun = /\b(screenshot|image|file|attachment)\b/i.test(
+    sentence
+  );
+  if (!hasAttachmentNoun) {
+    return false;
+  }
+  const hasPositiveAttachmentVerb = /\b(attached|shared|uploaded|included)\b/i.test(sentence);
+  const hasDeicticSharePhrase = /\bhere(?:'s| is)\b/i.test(sentence);
+  return hasPositiveAttachmentVerb || hasDeicticSharePhrase;
+}
+function claimsAttachment(text) {
+  return splitSentences(text).some(
+    (sentence) => sentenceClaimsAttachment(sentence)
+  );
+}
+function enforceAttachmentClaimTruth(text, hasAttachedFiles) {
+  if (hasAttachedFiles || !claimsAttachment(text)) {
+    return text;
+  }
+  return `${text}
+
+Note: No file was attached in this turn. I need to attach the file before claiming it is shared.`;
+}
+
 // src/chat/respond.ts
 var MAX_INLINE_ATTACHMENT_BASE64_CHARS = 12e4;
 var startupDiscoveryLogged = false;
@@ -5809,7 +6175,8 @@ function isToolPayloadShape(payload) {
   const record = payload;
   const type = typeof record.type === "string" ? record.type.toLowerCase() : "";
   if (type.startsWith("tool-")) return true;
-  if (type === "tool_use" || type === "tool_call" || type === "tool_result" || type === "tool_error") return true;
+  if (type === "tool_use" || type === "tool_call" || type === "tool_result" || type === "tool_error")
+    return true;
   const hasToolName = typeof record.toolName === "string" || typeof record.name === "string";
   const hasToolInput = Object.prototype.hasOwnProperty.call(record, "input") || Object.prototype.hasOwnProperty.call(record, "args");
   if (hasToolName && hasToolInput) return true;
@@ -5853,7 +6220,7 @@ function formatToolStatus(toolName) {
 }
 function formatToolStatusWithInput(toolName, input) {
   const obj = input && typeof input === "object" ? input : void 0;
-  const path5 = obj ? compactStatusPath(obj.path) : void 0;
+  const path6 = obj ? compactStatusPath(obj.path) : void 0;
   const filename = obj ? compactStatusFilename(obj.path) : void 0;
   const query = obj ? compactStatusText(obj.query, 70) : void 0;
   const domain = obj ? extractStatusUrlDomain(obj.url) : void 0;
@@ -5861,8 +6228,8 @@ function formatToolStatusWithInput(toolName, input) {
   if (filename && toolName === "readFile") {
     return `Reading file ${filename}`;
   }
-  if (path5 && toolName === "writeFile") {
-    return `Writing file ${path5}`;
+  if (path6 && toolName === "writeFile") {
+    return `Writing file ${path6}`;
   }
   if (skillName && toolName === "loadSkill") {
     return `Loading skill ${skillName}`;
@@ -5902,7 +6269,7 @@ function formatToolResultStatus(toolName) {
 }
 function formatToolResultStatusWithInput(toolName, input) {
   const obj = input && typeof input === "object" ? input : void 0;
-  const path5 = obj ? compactStatusPath(obj.path) : void 0;
+  const path6 = obj ? compactStatusPath(obj.path) : void 0;
   const filename = obj ? compactStatusFilename(obj.path) : void 0;
   const query = obj ? compactStatusText(obj.query, 70) : void 0;
   const domain = obj ? extractStatusUrlDomain(obj.url) : void 0;
@@ -5910,8 +6277,8 @@ function formatToolResultStatusWithInput(toolName, input) {
   if (filename && toolName === "readFile") {
     return `Reviewed file ${filename}`;
   }
-  if (path5 && toolName === "writeFile") {
-    return `Saved file ${path5}`;
+  if (path6 && toolName === "writeFile") {
+    return `Saved file ${path6}`;
   }
   if (skillName && toolName === "loadSkill") {
     return `Loaded skill ${skillName}`;
@@ -6013,11 +6380,16 @@ function isAssistantMessage(value) {
 }
 function extractAssistantText(message) {
   const content = message.content ?? [];
-  return content.filter((part) => part.type === "text" && typeof part.text === "string").map((part) => part.text).join("\n");
+  return content.filter(
+    (part) => part.type === "text" && typeof part.text === "string"
+  ).map((part) => part.text).join("\n");
 }
 function collectRelevantConfigurationKeys(activeSkills, explicitSkill) {
   const keys = /* @__PURE__ */ new Set();
-  for (const skill of [...activeSkills, ...explicitSkill ? [explicitSkill] : []]) {
+  for (const skill of [
+    ...activeSkills,
+    ...explicitSkill ? [explicitSkill] : []
+  ]) {
     for (const key of skill.usesConfig ?? []) {
       keys.add(key);
     }
@@ -6122,7 +6494,9 @@ function createAgentTools(tools, sandbox, spanContext, onStatus, sandboxExecutor
                 ...toolResultAttribute2 ? { "gen_ai.tool.call.result": toolResultAttribute2 } : {}
               });
               setSpanStatus("ok");
-              await onStatus?.(`${formatToolResultStatusWithInput(toolName, parsed)}...`);
+              await onStatus?.(
+                `${formatToolResultStatusWithInput(toolName, parsed)}...`
+              );
               if (shouldTrace) {
                 logInfo(
                   "agent_tool_call_completed",
@@ -6150,7 +6524,9 @@ function createAgentTools(tools, sandbox, spanContext, onStatus, sandboxExecutor
             const isCustomBashCommand = toolName === "bash" && /^jr-rpc(?:\s|$)/.test(bashCommand);
             const shouldLogCredentialInjection = toolName === "bash" && !isCustomBashCommand && Boolean(injectedHeaders && injectedHeaders.length > 0);
             if (shouldLogCredentialInjection) {
-              const headerDomains = (injectedHeaders ?? []).map((transform) => transform.domain);
+              const headerDomains = (injectedHeaders ?? []).map(
+                (transform) => transform.domain
+              );
               logInfo(
                 "credential_inject_start",
                 {},
@@ -6163,7 +6539,10 @@ function createAgentTools(tools, sandbox, spanContext, onStatus, sandboxExecutor
               );
             }
             const hasBashCredentials = injectedHeaders || injectedEnv;
-            const sandboxInput = toolName === "bash" ? { command: String(parsed.command ?? "") } : toolName === "readFile" ? { path: String(parsed.path ?? "") } : toolName === "writeFile" ? { path: String(parsed.path ?? ""), content: String(parsed.content ?? "") } : parsed;
+            const sandboxInput = toolName === "bash" ? { command: String(parsed.command ?? "") } : toolName === "readFile" ? { path: String(parsed.path ?? "") } : toolName === "writeFile" ? {
+              path: String(parsed.path ?? ""),
+              content: String(parsed.content ?? "")
+            } : parsed;
             const result = sandboxExecutor?.canExecute(toolName) ? await sandboxExecutor.execute({
               toolName,
               input: toolName === "bash" && hasBashCredentials ? {
@@ -6193,7 +6572,9 @@ function createAgentTools(tools, sandbox, spanContext, onStatus, sandboxExecutor
               ...toolResultAttribute ? { "gen_ai.tool.call.result": toolResultAttribute } : {}
             });
             setSpanStatus("ok");
-            await onStatus?.(`${formatToolResultStatusWithInput(toolName, parsed)}...`);
+            await onStatus?.(
+              `${formatToolResultStatusWithInput(toolName, parsed)}...`
+            );
             if (shouldTrace) {
               logInfo(
                 "agent_tool_call_completed",
@@ -6211,7 +6592,9 @@ function createAgentTools(tools, sandbox, spanContext, onStatus, sandboxExecutor
               );
             }
             return {
-              content: [{ type: "text", text: toToolContentText(resultDetails) }],
+              content: [
+                { type: "text", text: toToolContentText(resultDetails) }
+              ],
               details: resultDetails
             };
           } catch (error) {
@@ -6272,6 +6655,8 @@ async function generateAssistantReply(messageText, context = {}) {
   let timeoutResumeSessionId;
   let timeoutResumeSliceId = 1;
   let timeoutResumeMessages = [];
+  let lastKnownSandboxId = context.sandbox?.sandboxId;
+  let lastKnownSandboxDependencyProfileHash = context.sandbox?.sandboxDependencyProfileHash;
   try {
     const shouldTrace = shouldEmitDevAgentTrace();
     const spanContext = {
@@ -6285,11 +6670,15 @@ async function generateAssistantReply(messageText, context = {}) {
       assistantUserName: context.assistant?.userName,
       modelId: botConfig.modelId
     };
-    const availableSkills = await discoverSkills({ additionalRoots: context.skillDirs });
+    const availableSkills = await discoverSkills({
+      additionalRoots: context.skillDirs
+    });
     if (!startupDiscoveryLogged) {
       startupDiscoveryLogged = true;
       const plugins = getPluginProviders();
-      const roots = [...new Set(availableSkills.map((skill) => skill.skillPath))].sort();
+      const roots = [
+        ...new Set(availableSkills.map((skill) => skill.skillPath))
+      ].sort();
       logInfo(
         "startup_discovery_summary",
         spanContext,
@@ -6321,17 +6710,18 @@ async function generateAssistantReply(messageText, context = {}) {
         "Agent message received"
       );
     }
-    const explicitInvocation = parseSkillInvocation(userInput, availableSkills);
-    const explicitSkill = explicitInvocation ? findSkillByName(explicitInvocation.skillName, availableSkills) : null;
+    const skillInvocation = parseSkillInvocation(userInput, availableSkills);
+    const invokedSkill = skillInvocation ? findSkillByName(skillInvocation.skillName, availableSkills) : null;
     const activeSkills = [];
     const skillSandbox = new SkillSandbox(availableSkills, activeSkills);
     const capabilityRuntime = createSkillCapabilityRuntime({
-      invocationArgs: explicitInvocation?.args,
+      invocationArgs: skillInvocation?.args,
       requesterId: context.requester?.userId,
       resolveConfiguration: async (key) => configurationValues[key]
     });
     const sandboxExecutor = createSandboxExecutor({
       sandboxId: context.sandbox?.sandboxId,
+      sandboxDependencyProfileHash: context.sandbox?.sandboxDependencyProfileHash,
       traceContext: spanContext,
       onStatus: context.onStatus,
       runBashCustomCommand: async (command) => {
@@ -6355,20 +6745,26 @@ async function generateAssistantReply(messageText, context = {}) {
         return result.handled ? { handled: true, result: result.result } : { handled: false };
       }
     });
+    lastKnownSandboxId = sandboxExecutor.getSandboxId();
+    lastKnownSandboxDependencyProfileHash = sandboxExecutor.getDependencyProfileHash();
     sandboxExecutor.configureSkills(availableSkills);
     const sandbox = await sandboxExecutor.createSandbox();
-    if (explicitSkill) {
-      const preloaded = await skillSandbox.loadSkill(explicitSkill.name);
+    if (invokedSkill && skillInvocation?.source === "hard_bang") {
+      const preloaded = await skillSandbox.loadSkill(invokedSkill.name);
       if (preloaded) {
         activeSkills.push(preloaded);
       }
     }
-    const userTurnText = buildUserTurnText(userInput, context.conversationContext);
+    const userTurnText = buildUserTurnText(
+      userInput,
+      context.conversationContext
+    );
     if (!getGatewayApiKey()) {
       const providerError = "Missing AI gateway credentials (AI_GATEWAY_API_KEY or VERCEL_OIDC_TOKEN)";
       return {
         text: `Error: ${providerError}`,
         sandboxId: sandboxExecutor.getSandboxId(),
+        sandboxDependencyProfileHash: sandboxExecutor.getDependencyProfileHash(),
         diagnostics: {
           outcome: "provider_error",
           modelId: botConfig.modelId,
@@ -6405,15 +6801,21 @@ async function generateAssistantReply(messageText, context = {}) {
           Object.assign(artifactStatePatch, patch);
         },
         onToolCallStart: async (toolName, input) => {
-          await context.onStatus?.(`${formatToolStatusWithInput(toolName, input)}...`);
+          await context.onStatus?.(
+            `${formatToolStatusWithInput(toolName, input)}...`
+          );
         },
         onToolCallEnd: async (toolName, input) => {
-          await context.onStatus?.(`${formatToolResultStatusWithInput(toolName, input)}...`);
+          await context.onStatus?.(
+            `${formatToolResultStatusWithInput(toolName, input)}...`
+          );
         },
         onSkillLoaded: async (loadedSkill) => {
           const resolvedSkill = await skillSandbox.loadSkill(loadedSkill.name);
           const effective = resolvedSkill ?? loadedSkill;
-          const existing = activeSkills.find((skill) => skill.name === effective.name);
+          const existing = activeSkills.find(
+            (skill) => skill.name === effective.name
+          );
           if (existing) {
             existing.body = effective.body;
             existing.description = effective.description;
@@ -6439,17 +6841,18 @@ async function generateAssistantReply(messageText, context = {}) {
     const baseInstructions = buildSystemPrompt({
       availableSkills,
       activeSkills,
-      invocation: explicitInvocation,
+      invocation: skillInvocation,
       assistant: context.assistant,
       requester: context.requester,
       artifactState: context.artifactState,
       configuration: configurationValues,
-      relevantConfigurationKeys: collectRelevantConfigurationKeys(activeSkills, explicitSkill),
+      relevantConfigurationKeys: collectRelevantConfigurationKeys(
+        activeSkills,
+        invokedSkill
+      ),
       runtimeMetadata: getRuntimeMetadata()
     });
-    const userContentParts = [
-      { type: "text", text: userTurnText }
-    ];
+    const userContentParts = [{ type: "text", text: userTurnText }];
     for (const attachment of context.userAttachments ?? []) {
       if (attachment.mediaType.startsWith("image/")) {
         userContentParts.push({
@@ -6532,7 +6935,9 @@ async function generateAssistantReply(messageText, context = {}) {
         logWarn(
           "streaming_text_delta_error",
           {},
-          { "error.message": error instanceof Error ? error.message : String(error) },
+          {
+            "error.message": error instanceof Error ? error.message : String(error)
+          },
           "Failed to deliver text delta to stream"
         );
       });
@@ -6541,9 +6946,14 @@ async function generateAssistantReply(messageText, context = {}) {
     let newMessages = [];
     try {
       if (resumedFromCheckpoint) {
-        const didReplace = await maybeReplaceAgentMessages(agent, existingTurnCheckpoint.piMessages);
+        const didReplace = await maybeReplaceAgentMessages(
+          agent,
+          existingTurnCheckpoint.piMessages
+        );
         if (!didReplace) {
-          throw new Error("Agent session resume requested but replaceMessages is unavailable");
+          throw new Error(
+            "Agent session resume requested but replaceMessages is unavailable"
+          );
         }
       }
       beforeMessageCount = agent.state.messages.length;
@@ -6592,10 +7002,16 @@ async function generateAssistantReply(messageText, context = {}) {
               clearTimeout(timeoutId);
             }
           }
-          newMessages = agent.state.messages.slice(beforeMessageCount);
+          newMessages = agent.state.messages.slice(
+            beforeMessageCount
+          );
           const outputMessages = newMessages.filter(isAssistantMessage);
           const outputMessagesAttribute = serializeGenAiAttribute(outputMessages);
-          const usageAttributes = extractGenAiUsageAttributes(promptResult, agent.state, ...outputMessages);
+          const usageAttributes = extractGenAiUsageAttributes(
+            promptResult,
+            agent.state,
+            ...outputMessages
+          );
           setSpanAttributes({
             ...outputMessagesAttribute ? { "gen_ai.output.messages": outputMessagesAttribute } : {},
             ...usageAttributes
@@ -6623,13 +7039,19 @@ async function generateAssistantReply(messageText, context = {}) {
     const toolResults = newMessages.filter(isToolResultMessage);
     const assistantMessages = newMessages.filter(isAssistantMessage);
     const primaryText = assistantMessages.map((message) => extractAssistantText(message)).join("\n\n").trim();
-    const toolErrorCount = toolResults.filter((result) => result.isError).length;
+    const toolErrorCount = toolResults.filter(
+      (result) => result.isError
+    ).length;
     const explicitChannelPostIntent = isExplicitChannelPostIntent(userInput);
     const successfulToolNames = new Set(
       toolResults.filter((result) => !isToolResultError(result)).map((result) => normalizeToolNameFromResult(result)).filter((value) => Boolean(value))
     );
-    const channelPostPerformed = successfulToolNames.has("slackChannelPostMessage");
-    const reactionPerformed = successfulToolNames.has("slackMessageAddReaction");
+    const channelPostPerformed = successfulToolNames.has(
+      "slackChannelPostMessage"
+    );
+    const reactionPerformed = successfulToolNames.has(
+      "slackMessageAddReaction"
+    );
     const deliveryPlan = buildReplyDeliveryPlan({
       explicitChannelPostIntent,
       channelPostPerformed,
@@ -6663,7 +7085,10 @@ async function generateAssistantReply(messageText, context = {}) {
     const errorMessage = typeof lastAssistant?.errorMessage === "string" ? lastAssistant.errorMessage : void 0;
     const usedPrimaryText = Boolean(primaryText);
     const outcome = primaryText ? stopReason === "error" ? "provider_error" : "success" : "execution_failure";
-    const resolvedText = primaryText || buildExecutionFailureMessage(toolErrorCount);
+    const candidateText = primaryText || buildExecutionFailureMessage(toolErrorCount);
+    const escapedOrRawPayload = isExecutionEscapeResponse(candidateText) || isRawToolPayloadResponse(candidateText);
+    const resolvedText = escapedOrRawPayload ? buildExecutionFailureMessage(toolErrorCount) : enforceAttachmentClaimTruth(candidateText, generatedFiles.length > 0);
+    const resolvedOutcome = escapedOrRawPayload ? "execution_failure" : outcome;
     if (shouldTrace) {
       logInfo(
         "agent_message_out",
@@ -6672,22 +7097,23 @@ async function generateAssistantReply(messageText, context = {}) {
           "app.message.kind": "assistant_outbound",
           "app.message.length": resolvedText.length,
           "app.message.output": summarizeMessageText(resolvedText),
-          "app.ai.outcome": outcome,
+          "app.ai.outcome": resolvedOutcome,
           "app.ai.assistant_messages": assistantMessages.length,
           ...stopReason ? { "app.ai.stop_reason": stopReason } : {}
         },
         "Agent message sent"
       );
     }
-    if (isExecutionEscapeResponse(resolvedText) || isRawToolPayloadResponse(resolvedText)) {
+    if (escapedOrRawPayload) {
       return {
-        text: buildExecutionFailureMessage(toolErrorCount),
+        text: resolvedText,
         files: generatedFiles.length > 0 ? generatedFiles : void 0,
         artifactStatePatch: Object.keys(artifactStatePatch).length > 0 ? artifactStatePatch : void 0,
         deliveryPlan,
         deliveryMode,
         ackStrategy,
         sandboxId: sandboxExecutor.getSandboxId(),
+        sandboxDependencyProfileHash: sandboxExecutor.getDependencyProfileHash(),
         diagnostics: {
           outcome: "execution_failure",
           modelId: botConfig.modelId,
@@ -6710,6 +7136,7 @@ async function generateAssistantReply(messageText, context = {}) {
       deliveryMode,
       ackStrategy,
       sandboxId: sandboxExecutor.getSandboxId(),
+      sandboxDependencyProfileHash: sandboxExecutor.getDependencyProfileHash(),
       diagnostics: {
         outcome,
         modelId: botConfig.modelId,
@@ -6747,7 +7174,10 @@ async function generateAssistantReply(messageText, context = {}) {
         "Agent turn timed out and will be resumed"
       );
       try {
-        const latestCheckpoint = await getAgentTurnSessionCheckpoint(timeoutResumeConversationId, timeoutResumeSessionId);
+        const latestCheckpoint = await getAgentTurnSessionCheckpoint(
+          timeoutResumeConversationId,
+          timeoutResumeSessionId
+        );
         const piMessages = timeoutResumeMessages.length > 0 ? timeoutResumeMessages : latestCheckpoint?.piMessages ?? [];
         await upsertAgentTurnSessionCheckpoint({
           conversationId: timeoutResumeConversationId,
@@ -6787,18 +7217,25 @@ async function generateAssistantReply(messageText, context = {}) {
     if (isRetryableTurnError(error)) {
       throw error;
     }
-    logException(error, "assistant_reply_generation_failed", {
-      slackThreadId: context.correlation?.threadId,
-      slackUserId: context.correlation?.requesterId,
-      slackChannelId: context.correlation?.channelId,
-      runId: context.correlation?.runId,
-      assistantUserName: context.assistant?.userName,
-      modelId: botConfig.modelId
-    }, {}, "generateAssistantReply failed");
+    logException(
+      error,
+      "assistant_reply_generation_failed",
+      {
+        slackThreadId: context.correlation?.threadId,
+        slackUserId: context.correlation?.requesterId,
+        slackChannelId: context.correlation?.channelId,
+        runId: context.correlation?.runId,
+        assistantUserName: context.assistant?.userName,
+        modelId: botConfig.modelId
+      },
+      {},
+      "generateAssistantReply failed"
+    );
     const message = error instanceof Error ? error.message : String(error);
     return {
       text: `Error: ${message}`,
-      sandboxId: void 0,
+      sandboxId: lastKnownSandboxId,
+      sandboxDependencyProfileHash: lastKnownSandboxDependencyProfileHash,
       diagnostics: {
         outcome: "provider_error",
         modelId: botConfig.modelId,
@@ -7812,10 +8249,11 @@ function createAppSlackRuntime(deps) {
 
 // src/chat/app-home.ts
 import fs5 from "fs";
-import path4 from "path";
+import path5 from "path";
 var DEFAULT_ABOUT_TEXT = "I help your team investigate, summarize, and act on work in Slack.";
 var MAX_HOME_SKILLS = 6;
 var MAX_SECTION_TEXT_CHARS = 3e3;
+var HIDDEN_HOME_SKILLS = /* @__PURE__ */ new Set(["jr-rpc"]);
 function clampSectionText(text) {
   if (text.length <= MAX_SECTION_TEXT_CHARS) {
     return text;
@@ -7823,7 +8261,7 @@ function clampSectionText(text) {
   return `${text.slice(0, MAX_SECTION_TEXT_CHARS - 1)}\u2026`;
 }
 function loadAboutText() {
-  const aboutPath = path4.join(homeDir(), "ABOUT.md");
+  const aboutPath = path5.join(homeDir(), "ABOUT.md");
   try {
     const raw = fs5.readFileSync(aboutPath, "utf8").trim();
     if (raw.length > 0) {
@@ -7834,12 +8272,12 @@ function loadAboutText() {
   return DEFAULT_ABOUT_TEXT;
 }
 async function buildSkillsSummaryText() {
-  const skills = await discoverSkills();
+  const skills = (await discoverSkills()).filter((skill) => !HIDDEN_HOME_SKILLS.has(skill.name));
   if (skills.length === 0) {
     return "No skills installed.";
   }
   const visible = skills.slice(0, MAX_HOME_SKILLS);
-  const lines = visible.map((skill) => `\u2022 \`/${skill.name}\` \u2014 ${skill.description}`);
+  const lines = visible.map((skill) => `\u2022 \`!${skill.name}\` \u2014 ${skill.description}`);
   if (skills.length > visible.length) {
     lines.push(`\u2022 \u2026and ${skills.length - visible.length} more`);
   }
@@ -7939,9 +8377,6 @@ async function publishAppHomeView(slackClient, userId, userTokenStore) {
 }
 
 // src/chat/slash-command.ts
-function providerLabel(provider) {
-  return provider.charAt(0).toUpperCase() + provider.slice(1);
-}
 async function postEphemeral(event, text) {
   await event.channel.postEphemeral(event.user, text, { fallbackToDM: false });
 }
@@ -7950,10 +8385,10 @@ async function handleLink(event, provider) {
     await postEphemeral(event, `Unknown provider: \`${provider}\``);
     return;
   }
-  if (!getOAuthProviderConfig(provider)) {
+  if (!getPluginOAuthConfig(provider)) {
     await postEphemeral(
       event,
-      `${providerLabel(provider)} doesn't support account linking.`
+      `${formatProviderLabel(provider)} doesn't support account linking.`
     );
     return;
   }
@@ -7967,7 +8402,10 @@ async function handleLink(event, provider) {
     return;
   }
   if (result.delivery === "fallback_dm") {
-    await postEphemeral(event, `Check your DMs for a ${providerLabel(provider)} authorization link.`);
+    await postEphemeral(
+      event,
+      `Check your DMs for a ${formatProviderLabel(provider)} authorization link.`
+    );
   } else if (result.delivery === false) {
     await postEphemeral(
       event,
@@ -7980,10 +8418,10 @@ async function handleUnlink(event, provider) {
     await postEphemeral(event, `Unknown provider: \`${provider}\``);
     return;
   }
-  if (!getOAuthProviderConfig(provider)) {
+  if (!getPluginOAuthConfig(provider)) {
     await postEphemeral(
       event,
-      `${providerLabel(provider)} doesn't support account unlinking.`
+      `${formatProviderLabel(provider)} doesn't support account unlinking.`
     );
     return;
   }
@@ -7993,14 +8431,20 @@ async function handleUnlink(event, provider) {
     "slash_command_unlink",
     { slackUserId: event.user.userId },
     { "app.credential.provider": provider },
-    `Unlinked ${providerLabel(provider)} account via /jr slash command`
+    `Unlinked ${formatProviderLabel(provider)} account via /jr slash command`
+  );
+  await postEphemeral(
+    event,
+    `Your ${formatProviderLabel(provider)} account has been unlinked.`
   );
-  await postEphemeral(event, `Your ${providerLabel(provider)} account has been unlinked.`);
 }
 async function handleSlashCommand(event) {
   const [subcommand, provider, ...rest] = event.text.trim().split(/\s+/);
   if (!subcommand || !["link", "unlink"].includes(subcommand)) {
-    await postEphemeral(event, "Usage: `/jr link <provider>` or `/jr unlink <provider>`");
+    await postEphemeral(
+      event,
+      "Usage: `/jr link <provider>` or `/jr unlink <provider>`"
+    );
     return;
   }
   if (!provider || rest.length > 0) {
@@ -8359,6 +8803,9 @@ async function persistThreadState(thread, patch) {
   if (patch.sandboxId) {
     payload.app_sandbox_id = patch.sandboxId;
   }
+  if (patch.sandboxDependencyProfileHash) {
+    payload.app_sandbox_dependency_profile_hash = patch.sandboxDependencyProfileHash;
+  }
   if (Object.keys(payload).length === 0) {
     return;
   }
@@ -9203,7 +9650,9 @@ async function hydrateConversationVisionContext(conversation, context) {
 
 // src/chat/turn/execute.ts
 function resolveReplyDelivery(args) {
-  const replyHasFiles = Boolean(args.reply.files && args.reply.files.length > 0);
+  const replyHasFiles = Boolean(
+    args.reply.files && args.reply.files.length > 0
+  );
   const deliveryPlan = args.reply.deliveryPlan ?? {
     mode: args.reply.deliveryMode ?? "thread",
     ack: args.reply.ackStrategy ?? "none",
@@ -9214,8 +9663,9 @@ function resolveReplyDelivery(args) {
   if (attachFiles === "followup" && !args.hasStreamedThreadReply) {
     attachFiles = "inline";
   }
+  const suppressRedundantReactionReply = deliveryPlan.ack === "reaction" && !replyHasFiles && isRedundantReactionAckText(args.reply.text);
   return {
-    shouldPostThreadReply: deliveryPlan.postThreadText,
+    shouldPostThreadReply: deliveryPlan.postThreadText && !suppressRedundantReactionReply,
     attachFiles
   };
 }
@@ -9279,7 +9729,9 @@ function createReplyToThread(deps) {
           thread,
           message,
           userText,
-          explicitMention: Boolean(options.explicitMention || message.isMention),
+          explicitMention: Boolean(
+            options.explicitMention || message.isMention
+          ),
           context: {
             threadId,
             requesterId: message.author.userId,
@@ -9324,17 +9776,22 @@ function createReplyToThread(deps) {
         await persistThreadState(thread, {
           conversation: preparedState.conversation
         });
-        const fallbackIdentity = await getBotDeps().lookupSlackUser(message.author.userId);
+        const fallbackIdentity = await getBotDeps().lookupSlackUser(
+          message.author.userId
+        );
         const resolvedUserName = message.author.userName ?? fallbackIdentity?.userName;
         if (resolvedUserName) {
           setTags({ slackUserName: resolvedUserName });
         }
-        const userAttachments = await resolveUserAttachments(message.attachments, {
-          threadId,
-          requesterId: message.author.userId,
-          channelId,
-          runId
-        });
+        const userAttachments = await resolveUserAttachments(
+          message.attachments,
+          {
+            threadId,
+            requesterId: message.author.userId,
+            channelId,
+            runId
+          }
+        );
         const progress = createProgressReporter({
           channelId,
           threadTs,
@@ -9342,6 +9799,7 @@ function createReplyToThread(deps) {
         });
         const textStream = createTextStreamBridge();
         let streamedReplyPromise;
+        let pendingStreamText = "";
         let beforeFirstResponsePostCalled = false;
         const beforeFirstResponsePost = async () => {
           if (beforeFirstResponsePostCalled) {
@@ -9354,13 +9812,24 @@ function createReplyToThread(deps) {
           if (!streamedReplyPromise) {
             const streamingReply = (async () => {
               return await postThreadReply(
-                createNormalizingStream(textStream.iterable, ensureBlockSpacing),
+                createNormalizingStream(
+                  textStream.iterable,
+                  ensureBlockSpacing
+                ),
                 "streaming_initial_post"
               );
             })();
             streamedReplyPromise = streamingReply;
           }
         };
+        const flushPendingStreamText = () => {
+          if (!pendingStreamText) {
+            return;
+          }
+          startStreamingReply();
+          textStream.push(pendingStreamText);
+          pendingStreamText = "";
+        };
         const postThreadReply = async (payload, stage) => {
           await beforeFirstResponsePost();
           try {
@@ -9411,17 +9880,28 @@ function createReplyToThread(deps) {
             },
             toolChannelId,
             sandbox: {
-              sandboxId: preparedState.sandboxId
+              sandboxId: preparedState.sandboxId,
+              sandboxDependencyProfileHash: preparedState.sandboxDependencyProfileHash
             },
             onStatus: (status) => progress.setStatus(status),
             onTextDelta: (deltaText) => {
               if (explicitChannelPostIntent) {
                 return;
               }
-              startStreamingReply();
-              textStream.push(deltaText);
+              if (streamedReplyPromise) {
+                textStream.push(deltaText);
+                return;
+              }
+              pendingStreamText += deltaText;
+              if (isPotentialRedundantReactionAckText(pendingStreamText)) {
+                return;
+              }
+              flushPendingStreamText();
             }
           });
+          if (streamedReplyPromise) {
+            flushPendingStreamText();
+          }
           textStream.end();
           const diagnosticsContext = {
             slackThreadId: threadId,
@@ -9445,7 +9925,9 @@ function createReplyToThread(deps) {
           };
           setSpanAttributes(diagnosticsAttributes);
           if (reply.diagnostics.outcome === "provider_error") {
-            const providerError = reply.diagnostics.providerError ?? new Error(reply.diagnostics.errorMessage ?? "Provider error without explicit message");
+            const providerError = reply.diagnostics.providerError ?? new Error(
+              reply.diagnostics.errorMessage ?? "Provider error without explicit message"
+            );
             logException(
               providerError,
               "agent_turn_provider_error",
@@ -9461,10 +9943,14 @@ function createReplyToThread(deps) {
               "Agent turn completed with execution failure"
             );
           }
-          markConversationMessage(preparedState.conversation, preparedState.userMessageId, {
-            replied: true,
-            skippedReason: void 0
-          });
+          markConversationMessage(
+            preparedState.conversation,
+            preparedState.userMessageId,
+            {
+              replied: true,
+              skippedReason: void 0
+            }
+          );
           upsertConversationMessage(preparedState.conversation, {
             id: generateConversationId("assistant"),
             role: "assistant",
@@ -9487,15 +9973,19 @@ function createReplyToThread(deps) {
           if (shouldPostThreadReply) {
             if (!streamedReplyPromise) {
               await postThreadReply(
-                buildSlackOutputMessage(reply.text, {
-                  files: resolvedAttachFiles === "inline" ? replyFiles : void 0
-                }),
+                buildSlackOutputMessage(
+                  reply.text,
+                  resolvedAttachFiles === "inline" ? replyFiles : void 0
+                ),
                 "thread_reply"
               );
             } else {
               await streamedReplyPromise;
               if (reply.diagnostics.outcome !== "success" && reply.text.trim().length > 0) {
-                await postThreadReply(buildSlackOutputMessage(reply.text), "thread_reply_after_stream_failure");
+                await postThreadReply(
+                  buildSlackOutputMessage(reply.text),
+                  "thread_reply_after_stream_failure"
+                );
               }
             }
           }
@@ -9509,7 +9999,8 @@ function createReplyToThread(deps) {
           await persistThreadState(thread, {
             artifacts: nextArtifacts,
             conversation: preparedState.conversation,
-            sandboxId: reply.sandboxId
+            sandboxId: reply.sandboxId,
+            sandboxDependencyProfileHash: reply.sandboxDependencyProfileHash
           });
           persistedAtLeastOnce = true;
           if (shouldEmitDevAgentTrace()) {
@@ -9525,9 +10016,13 @@ function createReplyToThread(deps) {
               "Agent turn completed"
             );
           }
-          const isFirstAssistantReply = preparedState.conversation.stats.compactedMessageCount === 0 && preparedState.conversation.messages.filter((m) => m.role === "assistant").length === 1;
+          const isFirstAssistantReply = preparedState.conversation.stats.compactedMessageCount === 0 && preparedState.conversation.messages.filter(
+            (m) => m.role === "assistant"
+          ).length === 1;
           if (isFirstAssistantReply && channelId && isDmChannel(channelId) && threadTs) {
-            void generateThreadTitle(userText, reply.text).then((title) => deps.getSlackAdapter().setAssistantTitle(channelId, threadTs, title)).catch((error) => {
+            void generateThreadTitle(userText, reply.text).then(
+              (title) => deps.getSlackAdapter().setAssistantTitle(channelId, threadTs, title)
+            ).catch((error) => {
               const slackErrorCode = getSlackApiErrorCode(error);
               const assistantTitleErrorAttributes = {
                 "app.slack.assistant_title.outcome": "permission_denied",
@@ -9560,14 +10055,16 @@ function createReplyToThread(deps) {
                   assistantUserName: botConfig.userName,
                   modelId: botConfig.fastModelId
                 },
-                { "error.message": error instanceof Error ? error.message : String(error) },
+                {
+                  "error.message": error instanceof Error ? error.message : String(error)
+                },
                 "Thread title generation failed"
               );
             });
           }
           if (shouldPostThreadReply && resolvedAttachFiles === "followup" && replyFiles) {
             await postThreadReply(
-              { files: replyFiles },
+              buildSlackOutputMessage("", replyFiles),
               "thread_reply_files_followup"
             );
           }
@@ -9610,7 +10107,12 @@ function createReplyToThread(deps) {
 // src/chat/runtime/turn-preparation.ts
 async function prepareTurnState(args) {
   const existingState = await args.thread.state;
-  const existingSandboxId = existingState ? toOptionalString(existingState.app_sandbox_id) : void 0;
+  const existingSandboxId = existingState ? toOptionalString(
+    existingState.app_sandbox_id
+  ) : void 0;
+  const existingSandboxDependencyProfileHash = existingState ? toOptionalString(
+    existingState.app_sandbox_dependency_profile_hash
+  ) : void 0;
   const artifacts = coerceThreadArtifactsState(existingState);
   const conversation = coerceThreadConversationState(existingState);
   const channelConfiguration = getChannelConfigurationService(args.thread);
@@ -9619,13 +10121,15 @@ async function prepareTurnState(args) {
     messageId: args.message.id,
     messageCreatedAtMs: args.message.metadata.dateSent.getTime()
   });
-  const messageHasPotentialImageAttachment = args.message.attachments.some((attachment) => {
-    if (attachment.type === "image") {
-      return true;
+  const messageHasPotentialImageAttachment = args.message.attachments.some(
+    (attachment) => {
+      if (attachment.type === "image") {
+        return true;
+      }
+      const mimeType = attachment.mimeType ?? "";
+      return attachment.type === "file" && mimeType.startsWith("image/");
     }
-    const mimeType = attachment.mimeType ?? "";
-    return attachment.type === "file" && mimeType.startsWith("image/");
-  });
+  );
   const normalizedUserText = normalizeConversationText(args.userText) || "[non-text message]";
   const incomingUserMessage = {
     id: args.message.id,
@@ -9644,7 +10148,10 @@ async function prepareTurnState(args) {
       imagesHydrated: !messageHasPotentialImageAttachment
     }
   };
-  const userMessageId = upsertConversationMessage(conversation, incomingUserMessage);
+  const userMessageId = upsertConversationMessage(
+    conversation,
+    incomingUserMessage
+  );
   if (messageHasPotentialImageAttachment || !conversation.vision.backfillCompletedAtMs) {
     await hydrateConversationVisionContext(conversation, {
       threadId: args.context.threadId,
@@ -9674,6 +10181,7 @@ async function prepareTurnState(args) {
     channelConfiguration,
     conversation,
     sandboxId: existingSandboxId,
+    sandboxDependencyProfileHash: existingSandboxDependencyProfileHash,
     conversationContext,
     routingContext,
     userMessageId
@@ -9766,7 +10274,7 @@ export {
   getUserTokenStore,
   getSlackClient,
   downloadPrivateSlackFile,
-  getOAuthProviderConfig,
+  formatProviderLabel,
   resolveBaseUrl,
   escapeXml,
   removeReactionFromMessage,