@sentry/junior 0.38.0 → 0.40.0

package/dist/app.js

@@ -3,7 +3,7 @@ import {
   findSkillByName,
   loadSkillsByName,
   parseSkillInvocation
-} from "./chunk-LAD5O3RX.js";
+} from "./chunk-SPNY2HJJ.js";
 import {
   GEN_AI_PROVIDER_NAME,
   MISSING_GATEWAY_CREDENTIALS_ERROR,
@@ -30,10 +30,11 @@ import {
   runNonInteractiveCommand,
   sandboxSkillDir,
   sandboxSkillFile
-} from "./chunk-ERH4OYNB.js";
+} from "./chunk-SY4ULGUN.js";
 import {
   CredentialUnavailableError,
   buildOAuthTokenRequest,
+  buildTurnFailureResponse,
   createChatSdkLogger,
   createPluginBroker,
   createRequestContext,
@@ -57,7 +58,6 @@ import {
   mergeHeaderTransforms,
   parseOAuthTokenResponse,
   resolveAuthTokenPlaceholder,
-  resolveErrorReference,
   serializeGenAiAttribute,
   setSpanAttributes,
   setSpanStatus,
@@ -66,8 +66,10 @@ import {
   toOptionalString,
   withContext,
   withSpan
-} from "./chunk-QZRPUFO6.js";
-import "./chunk-Z3YD6NHK.js";
+} from "./chunk-EU6E7QU2.js";
+import {
+  sentry_exports
+} from "./chunk-Z3YD6NHK.js";
 import {
   discoverInstalledPluginPackageContent,
   homeDir,
@@ -2772,20 +2774,9 @@ function buildSlackOutputMessage(text, files) {
         files
       };
     }
-    logWarn(
-      "slack_output_normalized_empty",
-      {},
-      {
-        "app.output.original_length": text.length,
-        "app.output.parsed_length": normalized.length,
-        "app.output.file_count": fileCount
-      },
-      "Slack output normalized to empty content"
+    throw new Error(
+      `Slack output normalized to empty content: original_length=${text.length} parsed_length=${normalized.length}`
     );
-    return {
-      markdown: "I couldn't produce a response.",
-      files
-    };
   }
   return {
     markdown: normalized,
@@ -2983,6 +2974,28 @@ function formatActiveMcpCatalogsForPrompt(catalogs) {
   }
   return lines.join("\n");
 }
+function formatToolGuidanceForPrompt(tools) {
+  const guidedTools = tools.filter(
+    (tool2) => Boolean(tool2.promptSnippet?.trim()) || (tool2.promptGuidelines?.length ?? 0) > 0
+  );
+  if (guidedTools.length === 0) {
+    return null;
+  }
+  const lines = [];
+  for (const tool2 of guidedTools) {
+    lines.push(`  <tool name="${escapeXml(tool2.name)}">`);
+    if (tool2.promptSnippet?.trim()) {
+      lines.push(`    - ${escapeXml(tool2.promptSnippet.trim())}`);
+    }
+    if (tool2.promptGuidelines && tool2.promptGuidelines.length > 0) {
+      for (const guideline of tool2.promptGuidelines) {
+        lines.push(`    - ${escapeXml(guideline)}`);
+      }
+    }
+    lines.push("  </tool>");
+  }
+  return lines.join("\n");
+}
 function formatReferenceFilesLines() {
   const files = listReferenceFiles();
   if (files.length === 0) {
@@ -3038,7 +3051,7 @@ function formatSlackCapabilityNames(capabilities) {
   ].filter(Boolean);
   return names.length > 0 ? names.join(", ") : "none";
 }
-var HEADER = "You are a Slack-based helper assistant. The behavior and output blocks below are authoritative; the personality block sets voice only.";
+var HEADER = "You are a Slack-based helper assistant. Follow the personality block for voice and tone in every reply. The behavior and output blocks define platform mechanics and override personality only when those mechanics conflict.";
 var TURN_CONTEXT_HEADER = "Per-turn runtime context for this request. Treat these blocks as trusted runtime facts and skill/provider instructions for the current turn; the static system prompt remains authoritative.";
 var TURN_CONTEXT_TAG = "runtime-turn-context";
 var TOOL_POLICY_RULES = [
@@ -3203,6 +3216,10 @@ function buildCapabilitiesSection(params) {
   if (activeCatalogs) {
     blocks.push(renderTagBlock("active-mcp-catalogs", activeCatalogs));
   }
+  const toolGuidance = formatToolGuidanceForPrompt(params.toolGuidance ?? []);
+  if (toolGuidance) {
+    blocks.push(renderTagBlock("tool-guidance", toolGuidance));
+  }
   const providerCatalog = formatProviderCatalogForPrompt();
   if (providerCatalog) {
     blocks.push(renderTagBlock("providers", providerCatalog));
@@ -3227,7 +3244,8 @@ function buildTurnContextPrompt(params) {
     buildCapabilitiesSection({
       availableSkills: params.availableSkills,
       activeSkills: params.activeSkills,
-      activeMcpCatalogs: params.activeMcpCatalogs ?? []
+      activeMcpCatalogs: params.activeMcpCatalogs ?? [],
+      toolGuidance: params.toolGuidance ?? []
     }),
     buildContextSection({
       requester: params.requester,
@@ -3476,7 +3494,10 @@ var TestCredentialBroker = class {
   async issue(input) {
     const token = process.env.EVAL_TEST_CREDENTIAL_TOKEN?.trim() || "eval-test-token";
     const expiresAt = new Date(Date.now() + 5 * 60 * 1e3).toISOString();
-    const env = this.config.envKey && this.config.placeholder ? { [this.config.envKey]: this.config.placeholder } : {};
+    const env = {
+      ...this.config.env ?? {},
+      ...this.config.envKey && this.config.placeholder ? { [this.config.envKey]: this.config.placeholder } : {}
+    };
     const tokenTransforms = this.config.domains?.map((domain) => ({
       domain,
       headers: {
@@ -3533,7 +3554,8 @@ function createSkillCapabilityRuntime(options = {}) {
     if (!credentials) {
       brokersByProvider[name] = useTestBroker ? new TestCredentialBroker({
         provider: name,
-        headerTransforms: () => resolveTestApiHeaderTransforms(plugin.manifest)
+        headerTransforms: () => resolveTestApiHeaderTransforms(plugin.manifest),
+        ...plugin.manifest.commandEnv ? { env: plugin.manifest.commandEnv } : {}
       }) : createPluginBroker(name, { userTokenStore });
       continue;
     }
@@ -3545,6 +3567,7 @@ function createSkillCapabilityRuntime(options = {}) {
       ...apiHeaders ? {
         headerTransforms: () => resolveTestApiHeaderTransforms(plugin.manifest)
       } : {},
+      ...plugin.manifest.commandEnv ? { env: plugin.manifest.commandEnv } : {},
       envKey: credentials.authTokenEnv,
       placeholder
     }) : createPluginBroker(name, { userTokenStore });
@@ -4591,7 +4614,13 @@ function createBashTool() {
         command: Type.String({
           minLength: 1,
           description: "Bash command to run inside the sandbox."
-        })
+        }),
+        timeoutMs: Type.Optional(
+          Type.Integer({
+            minimum: 1e3,
+            description: "Optional command timeout in milliseconds. Use for commands that may hang."
+          })
+        )
       },
       { additionalProperties: false }
     ),
@@ -4601,9 +4630,635 @@ function createBashTool() {
   });
 }
 
-// src/chat/tools/sandbox/attach-file.ts
+// src/chat/tools/sandbox/file-utils.ts
 import path4 from "path";
+var MAX_TEXT_CHARS = 6e4;
+var SKIPPED_DIRECTORIES = /* @__PURE__ */ new Set([".git", "node_modules"]);
+function positiveInteger(value) {
+  if (typeof value !== "number" || !Number.isFinite(value)) {
+    return void 0;
+  }
+  const integer = Math.floor(value);
+  return integer > 0 ? integer : void 0;
+}
+function normalizeToLf(value) {
+  return value.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+}
+function truncateText(value, maxChars = MAX_TEXT_CHARS) {
+  if (value.length <= maxChars) {
+    return { content: value, truncated: false };
+  }
+  const removed = value.length - maxChars;
+  return {
+    content: `${value.slice(0, maxChars)}
+
+[output truncated: ${removed} characters removed]`,
+    truncated: true
+  };
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function globToRegExp(pattern) {
+  let source = "";
+  for (let index = 0; index < pattern.length; index += 1) {
+    const char = pattern[index];
+    const next = pattern[index + 1];
+    if (char === "*" && next === "*") {
+      if (pattern[index + 2] === "/") {
+        source += "(?:.*/)?";
+        index += 2;
+        continue;
+      }
+      source += ".*";
+      index += 1;
+      continue;
+    }
+    if (char === "*") {
+      source += "[^/]*";
+      continue;
+    }
+    if (char === "?") {
+      source += "[^/]";
+      continue;
+    }
+    source += escapeRegExp(char);
+  }
+  return new RegExp(`^${source}$`);
+}
+function matchesGlob(relativePath, pattern) {
+  const matcher = globToRegExp(pattern);
+  if (matcher.test(relativePath)) {
+    return true;
+  }
+  if (pattern.startsWith("**/") && matchesGlob(relativePath, pattern.slice(3))) {
+    return true;
+  }
+  return !pattern.includes("/") && matcher.test(path4.posix.basename(relativePath));
+}
+function resolveWorkspacePath(input, fallback = ".") {
+  const requested = (input ?? "").trim() || fallback;
+  const absolute = requested.startsWith("/") ? requested : path4.posix.join(SANDBOX_WORKSPACE_ROOT, requested);
+  const normalized = path4.posix.normalize(absolute);
+  if (normalized !== SANDBOX_WORKSPACE_ROOT && !normalized.startsWith(`${SANDBOX_WORKSPACE_ROOT}/`)) {
+    throw new Error(
+      `Path must stay within ${SANDBOX_WORKSPACE_ROOT}: ${requested}`
+    );
+  }
+  return normalized;
+}
+async function collectFiles(params) {
+  const files = [];
+  let limitReached = false;
+  const visit = async (dirPath) => {
+    const entries = (await params.fs.readdir(dirPath)).sort(
+      (a, b) => a.toLowerCase().localeCompare(b.toLowerCase())
+    );
+    for (const entry of entries) {
+      const fullPath = path4.posix.join(dirPath, entry);
+      const stat2 = await params.fs.stat(fullPath);
+      if (stat2.isDirectory()) {
+        if (!SKIPPED_DIRECTORIES.has(entry)) {
+          await visit(fullPath);
+        }
+        if (limitReached) return;
+        continue;
+      }
+      const relativePath = path4.posix.relative(params.root, fullPath);
+      if (!params.pattern || matchesGlob(relativePath, params.pattern)) {
+        files.push(fullPath);
+        if (params.limit && files.length >= params.limit) {
+          limitReached = true;
+          return;
+        }
+      }
+    }
+  };
+  const stat = await params.fs.stat(params.root);
+  if (!stat.isDirectory()) {
+    const relativePath = path4.posix.basename(params.root);
+    return {
+      files: !params.pattern || matchesGlob(relativePath, params.pattern) ? [params.root] : [],
+      limitReached: false
+    };
+  }
+  await visit(params.root);
+  return { files, limitReached };
+}
+
+// src/chat/tools/sandbox/edit-file.ts
 import { Type as Type2 } from "@sinclair/typebox";
+function detectLineEnding(value) {
+  return value.includes("\r\n") ? "\r\n" : "\n";
+}
+function restoreLineEndings(value, lineEnding) {
+  return lineEnding === "\r\n" ? value.replace(/\n/g, "\r\n") : value;
+}
+function stripBom(value) {
+  return value.startsWith("\uFEFF") ? { bom: "\uFEFF", text: value.slice(1) } : { bom: "", text: value };
+}
+function countOccurrences(content, target) {
+  let count = 0;
+  let start = 0;
+  while (target.length > 0) {
+    const index = content.indexOf(target, start);
+    if (index === -1) break;
+    count += 1;
+    start = index + target.length;
+  }
+  return count;
+}
+function firstChangedLine(oldContent, newContent) {
+  const oldLines = oldContent.split("\n");
+  const newLines = newContent.split("\n");
+  const count = Math.max(oldLines.length, newLines.length);
+  for (let index = 0; index < count; index += 1) {
+    if (oldLines[index] !== newLines[index]) {
+      return index + 1;
+    }
+  }
+  return void 0;
+}
+function buildCompactDiff(oldContent, newContent) {
+  const oldLines = oldContent.split("\n");
+  const newLines = newContent.split("\n");
+  let prefix = 0;
+  while (prefix < oldLines.length && prefix < newLines.length && oldLines[prefix] === newLines[prefix]) {
+    prefix += 1;
+  }
+  let oldSuffix = oldLines.length - 1;
+  let newSuffix = newLines.length - 1;
+  while (oldSuffix >= prefix && newSuffix >= prefix && oldLines[oldSuffix] === newLines[newSuffix]) {
+    oldSuffix -= 1;
+    newSuffix -= 1;
+  }
+  const contextStart = Math.max(0, prefix - 3);
+  const newContextEnd = Math.min(newLines.length - 1, newSuffix + 3);
+  const oldContextEnd = Math.min(oldLines.length - 1, oldSuffix + 3);
+  const width = String(Math.max(oldLines.length, newLines.length)).length;
+  const output = [];
+  if (contextStart > 0) {
+    output.push(` ${"".padStart(width)} ...`);
+  }
+  for (let index = contextStart; index < prefix; index += 1) {
+    output.push(` ${String(index + 1).padStart(width)} ${oldLines[index]}`);
+  }
+  for (let index = prefix; index <= oldSuffix; index += 1) {
+    output.push(`-${String(index + 1).padStart(width)} ${oldLines[index]}`);
+  }
+  for (let index = prefix; index <= newSuffix; index += 1) {
+    output.push(`+${String(index + 1).padStart(width)} ${newLines[index]}`);
+  }
+  for (let index = newSuffix + 1; index <= newContextEnd; index += 1) {
+    output.push(` ${String(index + 1).padStart(width)} ${newLines[index]}`);
+  }
+  if (newContextEnd < newLines.length - 1 || oldContextEnd < oldLines.length - 1) {
+    output.push(` ${"".padStart(width)} ...`);
+  }
+  return {
+    diff: output.join("\n"),
+    firstChangedLine: firstChangedLine(oldContent, newContent)
+  };
+}
+function validateAndApplyEdits(content, edits, filePath) {
+  if (!Array.isArray(edits) || edits.length === 0) {
+    throw new Error("editFile requires at least one edit.");
+  }
+  const normalizedEdits = edits.map((edit, index) => {
+    if (typeof edit.oldText !== "string" || edit.oldText.length === 0) {
+      throw new Error(
+        `edits[${index}].oldText must not be empty in ${filePath}.`
+      );
+    }
+    if (typeof edit.newText !== "string") {
+      throw new Error(
+        `edits[${index}].newText must be a string in ${filePath}.`
+      );
+    }
+    return {
+      oldText: normalizeToLf(edit.oldText),
+      newText: normalizeToLf(edit.newText)
+    };
+  });
+  const matchedEdits = [];
+  for (let index = 0; index < normalizedEdits.length; index += 1) {
+    const edit = normalizedEdits[index];
+    const matchIndex = content.indexOf(edit.oldText);
+    if (matchIndex === -1) {
+      throw new Error(
+        `Could not find edits[${index}] in ${filePath}. oldText must match exactly including whitespace and newlines.`
+      );
+    }
+    const occurrences = countOccurrences(content, edit.oldText);
+    if (occurrences > 1) {
+      throw new Error(
+        `Found ${occurrences} occurrences of edits[${index}] in ${filePath}. Each oldText must be unique.`
+      );
+    }
+    matchedEdits.push({
+      editIndex: index,
+      matchIndex,
+      matchLength: edit.oldText.length,
+      newText: edit.newText
+    });
+  }
+  matchedEdits.sort((a, b) => a.matchIndex - b.matchIndex);
+  for (let index = 1; index < matchedEdits.length; index += 1) {
+    const previous = matchedEdits[index - 1];
+    const current = matchedEdits[index];
+    if (previous.matchIndex + previous.matchLength > current.matchIndex) {
+      throw new Error(
+        `edits[${previous.editIndex}] and edits[${current.editIndex}] overlap in ${filePath}. Merge overlapping replacements into one edit.`
+      );
+    }
+  }
+  let newContent = content;
+  for (let index = matchedEdits.length - 1; index >= 0; index -= 1) {
+    const edit = matchedEdits[index];
+    newContent = newContent.slice(0, edit.matchIndex) + edit.newText + newContent.slice(edit.matchIndex + edit.matchLength);
+  }
+  if (newContent === content) {
+    throw new Error(`No changes made to ${filePath}.`);
+  }
+  return { baseContent: content, newContent };
+}
+function prepareEditFileArguments(input) {
+  if (!input || typeof input !== "object") {
+    return input;
+  }
+  const raw = { ...input };
+  if (typeof raw.edits === "string") {
+    try {
+      raw.edits = JSON.parse(raw.edits);
+    } catch {
+      return raw;
+    }
+  }
+  const edits = Array.isArray(raw.edits) ? [...raw.edits] : [];
+  const oldText = raw.oldText ?? raw.old_text;
+  const newText = raw.newText ?? raw.new_text;
+  if (typeof oldText === "string" && typeof newText === "string") {
+    edits.push({ oldText, newText });
+  }
+  if (edits.length > 0) {
+    raw.edits = edits.map((edit) => {
+      if (!edit || typeof edit !== "object") {
+        return edit;
+      }
+      const record = edit;
+      const { old_text, new_text, ...rest } = record;
+      return {
+        ...rest,
+        oldText: record.oldText ?? old_text,
+        newText: record.newText ?? new_text
+      };
+    });
+  }
+  delete raw.oldText;
+  delete raw.old_text;
+  delete raw.newText;
+  delete raw.new_text;
+  return raw;
+}
+async function editFile(params) {
+  const filePath = resolveWorkspacePath(params.path);
+  const rawContent = await params.fs.readFile(filePath, { encoding: "utf8" });
+  const { bom, text } = stripBom(rawContent);
+  const lineEnding = detectLineEnding(text);
+  const normalizedContent = normalizeToLf(text);
+  const { baseContent, newContent } = validateAndApplyEdits(
+    normalizedContent,
+    params.edits,
+    params.path
+  );
+  await params.fs.writeFile(
+    filePath,
+    bom + restoreLineEndings(newContent, lineEnding),
+    { encoding: "utf8" }
+  );
+  const diff = buildCompactDiff(baseContent, newContent);
+  return {
+    content: [
+      {
+        type: "text",
+        text: `Successfully replaced ${params.edits.length} block(s) in ${params.path}.`
+      }
+    ],
+    details: {
+      diff: diff.diff,
+      first_changed_line: diff.firstChangedLine,
+      ok: true,
+      path: params.path,
+      replacements: params.edits.length
+    }
+  };
+}
+var editReplacementSchema = Type2.Object(
+  {
+    oldText: Type2.String({
+      minLength: 1,
+      description: "Exact text to replace. It must be unique in the original file and must not overlap another edit."
+    }),
+    newText: Type2.String({
+      description: "Replacement text for this edit."
+    })
+  },
+  { additionalProperties: false }
+);
+function createEditFileTool() {
+  return tool({
+    description: "Edit one sandbox workspace file with exact text replacements. Use for precise changes to existing files. Each oldText must match exactly, be unique, and not overlap another edit. Returns a diff.",
+    promptSnippet: "existing-file exact edits; returns diff",
+    promptGuidelines: [
+      "prefer over writeFile for targeted changes",
+      "oldText exact, unique, non-overlapping",
+      "multiple same-file changes: one edits[] call"
+    ],
+    prepareArguments: prepareEditFileArguments,
+    executionMode: "sequential",
+    inputSchema: Type2.Object(
+      {
+        path: Type2.String({
+          minLength: 1,
+          description: "Path to edit in the sandbox workspace."
+        }),
+        edits: Type2.Array(editReplacementSchema, {
+          minItems: 1,
+          description: "Exact replacements matched against the original file, not incrementally."
+        })
+      },
+      { additionalProperties: false }
+    ),
+    execute: async () => {
+      throw new Error(
+        "editFile can only run when sandbox execution is enabled."
+      );
+    }
+  });
+}
+
+// src/chat/tools/sandbox/find-files.ts
+import path5 from "path";
+import { Type as Type3 } from "@sinclair/typebox";
+var DEFAULT_FIND_LIMIT = 1e3;
+async function findFiles(params) {
+  if (!params.pattern.trim()) {
+    throw new Error("pattern is required");
+  }
+  const root = resolveWorkspacePath(params.path);
+  const limit = positiveInteger(params.limit) ?? DEFAULT_FIND_LIMIT;
+  const { files, limitReached } = await collectFiles({
+    fs: params.fs,
+    root,
+    pattern: params.pattern,
+    limit
+  });
+  const relativePaths = files.map(
+    (filePath) => path5.posix.relative(root, filePath)
+  );
+  const bounded = truncateText(
+    relativePaths.length > 0 ? relativePaths.join("\n") : "No files found matching pattern"
+  );
+  const notices = [];
+  if (limitReached) {
+    notices.push(
+      `${limit} results limit reached. Refine pattern or raise limit.`
+    );
+  }
+  if (bounded.truncated) {
+    notices.push(`${MAX_TEXT_CHARS} character output limit reached.`);
+  }
+  return {
+    content: [
+      {
+        type: "text",
+        text: notices.length > 0 ? `${bounded.content}
+
+[${notices.join(" ")}]` : bounded.content
+      }
+    ],
+    details: {
+      ok: true,
+      path: params.path ?? ".",
+      truncated: limitReached || bounded.truncated,
+      ...limitReached ? { result_limit_reached: limit } : {}
+    }
+  };
+}
+function createFindFilesTool() {
+  return tool({
+    description: "Find sandbox workspace files by glob pattern. Returns bounded paths relative to the search root and skips dependency/cache directories.",
+    annotations: { readOnlyHint: true, destructiveHint: false },
+    inputSchema: Type3.Object(
+      {
+        pattern: Type3.String({
+          minLength: 1,
+          description: "Glob pattern to match, for example '*.ts', '**/*.json', or 'src/**/*.test.ts'."
+        }),
+        path: Type3.Optional(
+          Type3.String({
+            minLength: 1,
+            description: "Directory or file path in the sandbox workspace. Defaults to the workspace root."
+          })
+        ),
+        limit: Type3.Optional(
+          Type3.Integer({
+            minimum: 1,
+            description: "Maximum number of file paths to return. Defaults to 1000."
+          })
+        )
+      },
+      { additionalProperties: false }
+    ),
+    execute: async () => {
+      throw new Error(
+        "findFiles can only run when sandbox execution is enabled."
+      );
+    }
+  });
+}
+
+// src/chat/tools/sandbox/grep.ts
+import path6 from "path";
+import { Type as Type4 } from "@sinclair/typebox";
+var DEFAULT_GREP_LIMIT = 100;
+var MAX_GREP_LINE_CHARS = 500;
+function truncateGrepLine(value) {
+  if (value.length <= MAX_GREP_LINE_CHARS) {
+    return { line: value, truncated: false };
+  }
+  return {
+    line: `${value.slice(0, MAX_GREP_LINE_CHARS)}... [line truncated]`,
+    truncated: true
+  };
+}
+function lineMatches(params) {
+  if (!params.literal) {
+    return Boolean(params.regex?.test(params.line));
+  }
+  if (params.ignoreCase) {
+    return params.line.toLowerCase().includes(params.pattern.toLowerCase());
+  }
+  return params.line.includes(params.pattern);
+}
+async function grepFiles(params) {
+  if (!params.pattern) {
+    throw new Error("pattern is required");
+  }
+  const root = resolveWorkspacePath(params.path);
+  const limit = positiveInteger(params.limit) ?? DEFAULT_GREP_LIMIT;
+  const context = positiveInteger(params.context) ?? 0;
+  const regex = params.literal ? void 0 : new RegExp(params.pattern, params.ignoreCase ? "i" : "");
+  const { files } = await collectFiles({
+    fs: params.fs,
+    root,
+    pattern: params.glob
+  });
+  const output = [];
+  let matchCount = 0;
+  let matchLimitReached = false;
+  let lineTruncated = false;
+  for (const filePath of files) {
+    if (matchLimitReached) break;
+    let content;
+    try {
+      content = await params.fs.readFile(filePath, { encoding: "utf8" });
+    } catch {
+      continue;
+    }
+    if (content.includes("\0")) {
+      continue;
+    }
+    const lines = normalizeToLf(content).split("\n");
+    const relativePath = files.length === 1 && filePath === root ? path6.posix.basename(filePath) : path6.posix.relative(root, filePath);
+    const matchedLines = [];
+    for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
+      if (!lineMatches({
+        ignoreCase: params.ignoreCase,
+        line: lines[lineIndex],
+        literal: params.literal,
+        pattern: params.pattern,
+        regex
+      })) {
+        continue;
+      }
+      if (matchCount >= limit) {
+        matchLimitReached = true;
+        break;
+      }
+      matchCount += 1;
+      matchedLines.push(lineIndex);
+    }
+    const matchedLineSet = new Set(matchedLines);
+    const emittedLines = /* @__PURE__ */ new Set();
+    for (const lineIndex of matchedLines) {
+      const start = Math.max(0, lineIndex - context);
+      const end = Math.min(lines.length - 1, lineIndex + context);
+      for (let current = start; current <= end; current += 1) {
+        if (emittedLines.has(current)) {
+          continue;
+        }
+        emittedLines.add(current);
+        const truncated = truncateGrepLine(lines[current]);
+        lineTruncated ||= truncated.truncated;
+        const separator = matchedLineSet.has(current) ? ":" : "-";
+        output.push(
+          `${relativePath}${separator}${current + 1}${separator} ${truncated.line}`
+        );
+      }
+    }
+  }
+  const bounded = truncateText(
+    output.length > 0 ? output.join("\n") : "No matches found"
+  );
+  const notices = [];
+  if (matchLimitReached) {
+    notices.push(
+      `${limit} matches limit reached. Refine pattern or raise limit.`
+    );
+  }
+  if (lineTruncated) {
+    notices.push(
+      `Some lines were truncated to ${MAX_GREP_LINE_CHARS} characters.`
+    );
+  }
+  if (bounded.truncated) {
+    notices.push(`${MAX_TEXT_CHARS} character output limit reached.`);
+  }
+  return {
+    content: [
+      {
+        type: "text",
+        text: notices.length > 0 ? `${bounded.content}
+
+[${notices.join(" ")}]` : bounded.content
+      }
+    ],
+    details: {
+      ok: true,
+      path: params.path ?? ".",
+      truncated: matchLimitReached || lineTruncated || bounded.truncated,
+      ...matchLimitReached ? { match_limit_reached: limit } : {},
+      ...lineTruncated ? { line_truncated: true } : {}
+    }
+  };
+}
+function createGrepTool() {
+  return tool({
+    description: "Search sandbox workspace file contents. Returns bounded matching lines with file paths and line numbers. Respects path/glob filters and includes truncation notices.",
+    annotations: { readOnlyHint: true, destructiveHint: false },
+    inputSchema: Type4.Object(
+      {
+        pattern: Type4.String({
+          minLength: 1,
+          description: "Regex pattern or literal text to search for."
+        }),
+        path: Type4.Optional(
+          Type4.String({
+            minLength: 1,
+            description: "Directory or file path in the sandbox workspace. Defaults to the workspace root."
+          })
+        ),
+        glob: Type4.Optional(
+          Type4.String({
+            minLength: 1,
+            description: "Optional glob filter such as '*.ts' or '**/*.test.ts'."
+          })
+        ),
+        ignoreCase: Type4.Optional(
+          Type4.Boolean({
+            description: "Whether matching should ignore case."
+          })
+        ),
+        literal: Type4.Optional(
+          Type4.Boolean({
+            description: "Treat pattern as literal text instead of regex."
+          })
+        ),
+        context: Type4.Optional(
+          Type4.Integer({
+            minimum: 0,
+            description: "Number of surrounding context lines to include."
+          })
+        ),
+        limit: Type4.Optional(
+          Type4.Integer({
+            minimum: 1,
+            description: "Maximum matches to return. Defaults to 100."
+          })
+        )
+      },
+      { additionalProperties: false }
+    ),
+    execute: async () => {
+      throw new Error("grep can only run when sandbox execution is enabled.");
+    }
+  });
+}
+
+// src/chat/tools/sandbox/attach-file.ts
+import path7 from "path";
+import { Type as Type5 } from "@sinclair/typebox";
 var MAX_ATTACH_FILE_BYTES = 10 * 1024 * 1024;
 var MIME_BY_EXTENSION = {
   ".png": "image/png",
@@ -4624,20 +5279,20 @@ function normalizeSandboxPath(inputPath) {
   if (!trimmed) {
     throw new Error("path is required");
   }
-  if (path4.posix.isAbsolute(trimmed)) {
+  if (path7.posix.isAbsolute(trimmed)) {
     return trimmed;
   }
-  return path4.posix.join(SANDBOX_WORKSPACE_ROOT, trimmed);
+  return path7.posix.join(SANDBOX_WORKSPACE_ROOT, trimmed);
 }
 function sanitizeFilename(value, fallbackPath) {
   const candidate = (value ?? "").trim();
   if (candidate) {
-    const base = path4.posix.basename(candidate);
+    const base = path7.posix.basename(candidate);
     if (base && base !== "." && base !== "..") {
       return base;
     }
   }
-  const derived = path4.posix.basename(fallbackPath);
+  const derived = path7.posix.basename(fallbackPath);
   if (derived && derived !== "." && derived !== "..") {
     return derived;
   }
@@ -4648,7 +5303,7 @@ function inferMimeType(filename, explicitMimeType) {
   if (explicit) {
     return explicit;
   }
-  const ext = path4.extname(filename).toLowerCase();
+  const ext = path7.extname(filename).toLowerCase();
   return MIME_BY_EXTENSION[ext] ?? "application/octet-stream";
 }
 async function detectMimeType(sandbox, targetPath) {
@@ -4669,20 +5324,20 @@ async function detectMimeType(sandbox, targetPath) {
 function createAttachFileTool(sandbox, hooks = {}) {
   return tool({
     description: "Attach a file to the Slack reply. Use this for files that exist in the sandbox, such as screenshots, PDFs, or logs, or for generated image `attachment_path` values returned earlier in the turn.",
-    inputSchema: Type2.Object(
+    inputSchema: Type5.Object(
       {
-        path: Type2.String({
+        path: Type5.String({
           minLength: 1,
           description: "Absolute path (for example /tmp/screenshot.png) or workspace-relative path."
         }),
-        filename: Type2.Optional(
-          Type2.String({
+        filename: Type5.Optional(
+          Type5.String({
             minLength: 1,
             description: "Optional filename override shown in Slack."
           })
         ),
-        mimeType: Type2.Optional(
-          Type2.String({
+        mimeType: Type5.Optional(
+          Type5.String({
             minLength: 1,
             description: "Optional MIME type override (for example image/png)."
           })
@@ -4695,7 +5350,7 @@ function createAttachFileTool(sandbox, hooks = {}) {
       const fileBuffer = await sandbox.readFileToBuffer({ path: targetPath });
       if (!fileBuffer) {
         const generatedFile = hooks.getGeneratedFile?.(
-          path4.posix.basename(targetPath)
+          path7.posix.basename(targetPath)
         );
         if (generatedFile) {
           hooks.onGeneratedFiles?.([generatedFile]);
@@ -4742,8 +5397,95 @@ function createAttachFileTool(sandbox, hooks = {}) {
   });
 }
 
+// src/chat/tools/sandbox/list-dir.ts
+import path8 from "path";
+import { Type as Type6 } from "@sinclair/typebox";
+var DEFAULT_LIST_LIMIT = 500;
+async function listDir(params) {
+  const dirPath = resolveWorkspacePath(params.path);
+  const limit = positiveInteger(params.limit) ?? DEFAULT_LIST_LIMIT;
+  const stat = await params.fs.stat(dirPath);
+  if (!stat.isDirectory()) {
+    throw new Error(`Not a directory: ${params.path ?? "."}`);
+  }
+  const entries = (await params.fs.readdir(dirPath)).sort(
+    (a, b) => a.toLowerCase().localeCompare(b.toLowerCase())
+  );
+  const output = [];
+  let entryLimitReached = false;
+  for (const entry of entries) {
+    if (output.length >= limit) {
+      entryLimitReached = true;
+      break;
+    }
+    const entryPath = path8.posix.join(dirPath, entry);
+    try {
+      const entryStat = await params.fs.stat(entryPath);
+      output.push(`${entry}${entryStat.isDirectory() ? "/" : ""}`);
+    } catch {
+      continue;
+    }
+  }
+  const bounded = truncateText(
+    output.length > 0 ? output.join("\n") : "(empty directory)"
+  );
+  const notices = [];
+  if (entryLimitReached) {
+    notices.push(
+      `${limit} entries limit reached. Use a higher limit to continue.`
+    );
+  }
+  if (bounded.truncated) {
+    notices.push(`${MAX_TEXT_CHARS} character output limit reached.`);
+  }
+  return {
+    content: [
+      {
+        type: "text",
+        text: notices.length > 0 ? `${bounded.content}
+
+[${notices.join(" ")}]` : bounded.content
+      }
+    ],
+    details: {
+      ok: true,
+      path: params.path ?? ".",
+      truncated: entryLimitReached || bounded.truncated,
+      ...entryLimitReached ? { entry_limit_reached: limit } : {}
+    }
+  };
+}
+function createListDirTool() {
+  return tool({
+    description: "List a sandbox workspace directory. Returns sorted entries with '/' suffixes for directories and bounded truncation notices.",
+    annotations: { readOnlyHint: true, destructiveHint: false },
+    inputSchema: Type6.Object(
+      {
+        path: Type6.Optional(
+          Type6.String({
+            minLength: 1,
+            description: "Directory path in the sandbox workspace. Defaults to the workspace root."
+          })
+        ),
+        limit: Type6.Optional(
+          Type6.Integer({
+            minimum: 1,
+            description: "Maximum entries to return. Defaults to 500."
+          })
+        )
+      },
+      { additionalProperties: false }
+    ),
+    execute: async () => {
+      throw new Error(
+        "listDir can only run when sandbox execution is enabled."
+      );
+    }
+  });
+}
+
 // src/chat/tools/web/image-generate.ts
-import { Type as Type3 } from "@sinclair/typebox";
+import { Type as Type7 } from "@sinclair/typebox";
 var DEFAULT_IMAGE_MODEL = "google/gemini-3-pro-image";
 var ENRICHMENT_SYSTEM_PROMPT = `You are an image prompt enrichment agent. Your job is to rewrite image generation requests to reflect a specific visual identity and mood.
 
@@ -4804,8 +5546,8 @@ function parseImageGenerationError(status, body, model) {
 function createImageGenerateTool(hooks, deps = {}) {
   return tool({
     description: "Generate images from a prompt. Use when the user wants to visually show or represent something \u2014 feelings, concepts, art, humor, or any visual idea. Also use for explicit image creation requests.",
-    inputSchema: Type3.Object({
-      prompt: Type3.String({
+    inputSchema: Type7.Object({
+      prompt: Type7.String({
         minLength: 1,
         maxLength: 4e3,
         description: "Image generation prompt."
@@ -4888,7 +5630,7 @@ function createImageGenerateTool(hooks, deps = {}) {
 }
 
 // src/chat/tools/skill/call-mcp-tool.ts
-import { Type as Type4 } from "@sinclair/typebox";
+import { Type as Type8 } from "@sinclair/typebox";
 function resolveMcpArguments(input) {
   const extraKeys = Object.keys(input).filter(
     (key) => key !== "tool_name" && key !== "arguments"
@@ -4913,14 +5655,14 @@ function resolveMcpArguments(input) {
 function createCallMcpToolTool(mcpToolManager, getActiveSkills) {
   return tool({
     description: "Call an active MCP tool by exact tool_name. Use loadSkill to activate the provider, then searchMcpTools to discover tool names and schemas; copy required provider fields into arguments. Do not call with only tool_name unless the discovered tool has no arguments. Authorization is handled by the runtime when required.",
-    inputSchema: Type4.Object(
+    inputSchema: Type8.Object(
       {
-        tool_name: Type4.String({
+        tool_name: Type8.String({
           minLength: 1,
           description: "Exact MCP tool_name from searchMcpTools."
         }),
-        arguments: Type4.Optional(
-          Type4.Record(Type4.String(), Type4.Unknown(), {
+        arguments: Type8.Optional(
+          Type8.Record(Type8.String(), Type8.Unknown(), {
             description: 'Arguments matching the disclosed MCP tool schema, for example { "query": "..." } when searchMcpTools shows query is required.'
           })
         )
@@ -4941,7 +5683,7 @@ function createCallMcpToolTool(mcpToolManager, getActiveSkills) {
 }
 
 // src/chat/tools/skill/load-skill.ts
-import { Type as Type5 } from "@sinclair/typebox";
+import { Type as Type9 } from "@sinclair/typebox";
 function toLoadedSkill(result, availableSkills) {
   if (result.ok !== true || typeof result.skill_name !== "string" || typeof result.description !== "string" || typeof result.skill_dir !== "string" || typeof result.instructions !== "string") {
     return null;
@@ -4988,8 +5730,8 @@ async function loadSkillFromHost(availableSkills, skillName) {
 function createLoadSkillTool(availableSkills, options) {
   return tool({
     description: "Load a skill by name for this turn. The result includes working_directory; resolve skill paths there and run skill-owned bash commands from there or with absolute paths. When the result includes mcp_provider, use searchMcpTools before callMcpTool. Use when a request clearly matches a known skill.",
-    inputSchema: Type5.Object({
-      skill_name: Type5.String({
+    inputSchema: Type9.Object({
+      skill_name: Type9.String({
         minLength: 1,
         description: "Skill name to load, without the leading slash."
       })
@@ -5009,7 +5751,7 @@ function createLoadSkillTool(availableSkills, options) {
 }
 
 // src/chat/tools/skill/search-mcp-tools.ts
-import { Type as Type6 } from "@sinclair/typebox";
+import { Type as Type10 } from "@sinclair/typebox";
 
 // src/chat/tools/skill/mcp-tool-summary.ts
 function getSchemaProperties(schema) {
@@ -5199,22 +5941,22 @@ function searchMcpCatalog(tools, query) {
 function createSearchMcpToolsTool(mcpToolManager, getActiveSkills) {
   return tool({
     description: "List or search active MCP tools and return full descriptors, including input/output schemas and annotations. Use after loadSkill when choosing a provider tool or when callMcpTool arguments are unclear.",
-    inputSchema: Type6.Object(
+    inputSchema: Type10.Object(
       {
-        query: Type6.Optional(
-          Type6.String({
+        query: Type10.Optional(
+          Type10.String({
             minLength: 1,
             description: "Optional search terms describing the MCP tool or arguments needed."
           })
         ),
-        provider: Type6.Optional(
-          Type6.String({
+        provider: Type10.Optional(
+          Type10.String({
             minLength: 1,
             description: "Optional provider name to list or search within."
           })
         ),
-        max_results: Type6.Optional(
-          Type6.Integer({
+        max_results: Type10.Optional(
+          Type10.Integer({
             minimum: 1,
             maximum: MAX_RESULTS,
             description: "Maximum matching tool descriptors to return."
@@ -5245,16 +5987,55 @@ function createSearchMcpToolsTool(mcpToolManager, getActiveSkills) {
 }
 
 // src/chat/tools/sandbox/read-file.ts
-import { Type as Type7 } from "@sinclair/typebox";
+import { Type as Type11 } from "@sinclair/typebox";
+var DEFAULT_READ_LIMIT = 1e3;
+function sliceFileContent(params) {
+  const normalized = normalizeToLf(params.content);
+  const lines = normalized.length === 0 ? [] : normalized.split("\n");
+  const requestedOffset = positiveInteger(params.offset);
+  const requestedLimit = positiveInteger(params.limit);
+  const startLine = requestedOffset ?? 1;
+  const maxLines = requestedLimit ?? DEFAULT_READ_LIMIT;
+  const startIndex = Math.min(lines.length, startLine - 1);
+  const selected = lines.slice(startIndex, startIndex + maxLines);
+  const endLine = selected.length > 0 ? startLine + selected.length - 1 : startLine - 1;
+  const truncated = startIndex > 0 || endLine < lines.length;
+  const rangeRequested = requestedOffset !== void 0 || requestedLimit !== void 0;
+  return {
+    content: !rangeRequested && !truncated ? params.content : selected.join("\n"),
+    end_line: selected.length > 0 ? endLine : void 0,
+    path: params.path,
+    start_line: startLine,
+    success: true,
+    total_lines: lines.length,
+    truncated,
+    ...endLine < lines.length ? {
+      continuation: `Read more with offset=${endLine + 1} and limit=${maxLines}.`
+    } : {}
+  };
+}
 function createReadFileTool() {
   return tool({
-    description: "Read a file from the sandbox workspace. Use when you need exact file contents to verify facts or make edits safely. Do not use for broad discovery when search tools are better.",
-    inputSchema: Type7.Object(
+    description: "Read a bounded line range from a file in the sandbox workspace. Use when you need exact file contents to verify facts or make edits safely. Prefer grep/findFiles/listDir for broad discovery.",
+    annotations: { readOnlyHint: true, destructiveHint: false },
+    inputSchema: Type11.Object(
       {
-        path: Type7.String({
+        path: Type11.String({
           minLength: 1,
           description: "Path to the file in the sandbox workspace."
-        })
+        }),
+        offset: Type11.Optional(
+          Type11.Integer({
+            minimum: 1,
+            description: "1-indexed line number to start reading from."
+          })
+        ),
+        limit: Type11.Optional(
+          Type11.Integer({
+            minimum: 1,
+            description: "Maximum number of lines to read. Defaults to 1000."
+          })
+        )
       },
       { additionalProperties: false }
     ),
@@ -5267,12 +6048,12 @@ function createReadFileTool() {
 }
 
 // src/chat/tools/runtime/report-progress.ts
-import { Type as Type8 } from "@sinclair/typebox";
+import { Type as Type12 } from "@sinclair/typebox";
 function createReportProgressTool() {
   return tool({
     description: "Update the user-visible assistant loading message with a short progress phase. For every non-trivial turn, call this early with the initial major work phase, then call it again only when the major phase meaningfully changes. Messages must be written in sentence case with a present-participle verb (e.g. 'Searching docs', 'Reviewing results', 'Running checks'). Skip trivial direct answers, generic filler, and minor substeps.",
-    inputSchema: Type8.Object({
-      message: Type8.String({
+    inputSchema: Type12.Object({
+      message: Type12.String({
         minLength: 1,
         description: "Short user-facing progress message."
       })
@@ -5281,7 +6062,7 @@ function createReportProgressTool() {
 }
 
 // src/chat/tools/slack/channel-list-messages.ts
-import { Type as Type9 } from "@sinclair/typebox";
+import { Type as Type13 } from "@sinclair/typebox";
 
 // src/chat/slack/channel.ts
 async function listChannelMessages(input) {
@@ -5370,39 +6151,40 @@ async function listThreadReplies(input) {
 function createSlackChannelListMessagesTool(context) {
   return tool({
     description: "List channel messages from Slack history in the active channel context. Use when the user asks for recent or historical channel context outside this thread. Do not use for live monitoring or when current thread context already answers the question.",
-    inputSchema: Type9.Object({
-      limit: Type9.Optional(
-        Type9.Integer({
+    annotations: { readOnlyHint: true, destructiveHint: false },
+    inputSchema: Type13.Object({
+      limit: Type13.Optional(
+        Type13.Integer({
           minimum: 1,
           maximum: 1e3,
           description: "Maximum number of messages to return across pages."
         })
       ),
-      cursor: Type9.Optional(
-        Type9.String({
+      cursor: Type13.Optional(
+        Type13.String({
           minLength: 1,
           description: "Optional cursor to continue from a prior call."
         })
       ),
-      oldest: Type9.Optional(
-        Type9.String({
+      oldest: Type13.Optional(
+        Type13.String({
           minLength: 1,
           description: "Optional oldest message timestamp (Slack ts) for range filtering."
         })
       ),
-      latest: Type9.Optional(
-        Type9.String({
+      latest: Type13.Optional(
+        Type13.String({
           minLength: 1,
           description: "Optional latest message timestamp (Slack ts) for range filtering."
         })
       ),
-      inclusive: Type9.Optional(
-        Type9.Boolean({
+      inclusive: Type13.Optional(
+        Type13.Boolean({
           description: "Whether oldest/latest bounds should be inclusive."
         })
       ),
-      max_pages: Type9.Optional(
-        Type9.Integer({
+      max_pages: Type13.Optional(
+        Type13.Integer({
           minimum: 1,
           maximum: 10,
           description: "Maximum number of API pages to traverse in a single call."
@@ -5456,7 +6238,7 @@ function createSlackChannelListMessagesTool(context) {
 }
 
 // src/chat/tools/slack/channel-post-message.ts
-import { Type as Type10 } from "@sinclair/typebox";
+import { Type as Type14 } from "@sinclair/typebox";
 
 // src/chat/tools/idempotency.ts
 function stableSerialize(value) {
@@ -5478,8 +6260,8 @@ function createOperationKey(toolName, input) {
 function createSlackChannelPostMessageTool(context, state) {
   return tool({
     description: "Post a message in the active Slack channel context (outside the thread). Use this only when the user explicitly asks to post/send/share/say something in the current channel. Do not use it for normal thread replies, speculative broadcasts, or requests targeting another named channel; explain that limitation instead. Do not claim a channel message was posted unless this tool succeeds in this turn.",
-    inputSchema: Type10.Object({
-      text: Type10.String({
+    inputSchema: Type14.Object({
+      text: Type14.String({
         minLength: 1,
         maxLength: 4e4,
         description: "Slack mrkdwn text to post."
@@ -5522,12 +6304,12 @@ function createSlackChannelPostMessageTool(context, state) {
 }
 
 // src/chat/tools/slack/message-add-reaction.ts
-import { Type as Type11 } from "@sinclair/typebox";
+import { Type as Type15 } from "@sinclair/typebox";
 function createSlackMessageAddReactionTool(context, state) {
   return tool({
     description: "Add an emoji reaction to the current inbound Slack message. Use sparingly for lightweight acknowledgements. Provide a Slack emoji alias name (for example `thumbsup`, `white_check_mark`, or `thumbsup::skin-tone-6`), not a unicode emoji glyph. The target message is injected by runtime context; do not use this for arbitrary historical messages.",
-    inputSchema: Type11.Object({
-      emoji: Type11.String({
+    inputSchema: Type15.Object({
+      emoji: Type15.String({
         minLength: 1,
         maxLength: 64,
         description: "Slack emoji alias name to react with (for example `thumbsup`, `white_check_mark`, or `thumbsup::skin-tone-6`). Optional surrounding colons are allowed."
@@ -5585,7 +6367,7 @@ function createSlackMessageAddReactionTool(context, state) {
 }
 
 // src/chat/tools/slack/canvas-tools.ts
-import { Type as Type12 } from "@sinclair/typebox";
+import { Type as Type16 } from "@sinclair/typebox";
 
 // src/chat/tools/slack/canvases.ts
 function normalizeCanvasMarkdown(markdown) {
@@ -5801,13 +6583,13 @@ function mergeRecentCanvases(existing, created) {
 function createSlackCanvasCreateTool(context, state) {
   return tool({
     description: "Create a Slack canvas for long-form output in the active assistant context channel. Use when the answer is better as a reusable document than a thread reply: long-form research, timelines, bios/profiles, structured notes, plans, comparisons, or anything likely to exceed one compact Slack reply. After creating it, reply with one or two short sentences plus the canvas link; do not recap the canvas contents. Do not use for short answers that fit cleanly in one normal thread reply.",
-    inputSchema: Type12.Object({
-      title: Type12.String({
+    inputSchema: Type16.Object({
+      title: Type16.String({
         minLength: 1,
         maxLength: 160,
         description: "Canvas title."
       }),
-      markdown: Type12.String({
+      markdown: Type16.String({
         minLength: 1,
         description: "Canvas markdown body content."
       })
@@ -5873,29 +6655,29 @@ function createSlackCanvasCreateTool(context, state) {
 function createSlackCanvasUpdateTool(state, _context) {
   return tool({
     description: "Update the active Slack canvas tracked in artifact context. Use when continuing or correcting a document already tracked in this thread. Do not use to create a brand-new long-form artifact.",
-    inputSchema: Type12.Object({
-      markdown: Type12.String({
+    inputSchema: Type16.Object({
+      markdown: Type16.String({
         minLength: 1,
         description: "Markdown content to insert or use as replacement text."
       }),
-      operation: Type12.Optional(
-        Type12.Union(
+      operation: Type16.Optional(
+        Type16.Union(
           [
-            Type12.Literal("insert_at_end"),
-            Type12.Literal("insert_at_start"),
-            Type12.Literal("replace")
+            Type16.Literal("insert_at_end"),
+            Type16.Literal("insert_at_start"),
+            Type16.Literal("replace")
           ],
           { description: "Canvas update mode." }
         )
       ),
-      section_id: Type12.Optional(
-        Type12.String({
+      section_id: Type16.Optional(
+        Type16.String({
           minLength: 1,
           description: "Optional section ID required for targeted replace operations."
         })
       ),
-      section_contains_text: Type12.Optional(
-        Type12.String({
+      section_contains_text: Type16.Optional(
+        Type16.String({
           minLength: 1,
           description: "Optional helper text used to find the target section when section_id is not provided."
         })
@@ -5961,8 +6743,9 @@ function createSlackCanvasUpdateTool(state, _context) {
 function createSlackCanvasReadTool() {
   return tool({
     description: "Read a Slack canvas the bot has access to (including canvases the bot created) by canvas ID or Slack canvas/docs URL. Use when the user shares a Slack canvas link (https://*.slack.com/docs/... or /canvas/...) or references a canvas ID and you need its contents. Do not use for generic web pages \u2014 use webFetch for those.",
-    inputSchema: Type12.Object({
-      canvas: Type12.String({
+    annotations: { readOnlyHint: true, destructiveHint: false },
+    inputSchema: Type16.Object({
+      canvas: Type16.String({
         minLength: 1,
         description: "Canvas/file ID (e.g. `F0ABCDEF`) or Slack canvas/docs URL (e.g. `https://team.slack.com/docs/T.../F...`)."
       })
@@ -6012,7 +6795,7 @@ function createSlackCanvasReadTool() {
 }
 
 // src/chat/tools/slack/list-tools.ts
-import { Type as Type13 } from "@sinclair/typebox";
+import { Type as Type17 } from "@sinclair/typebox";
 
 // src/chat/tools/slack/lists.ts
 function normalizeKey(value) {
@@ -6186,8 +6969,8 @@ async function updateListItem(input) {
 function createSlackListCreateTool(state) {
   return tool({
     description: "Create a Slack todo list for action tracking. Use when the user needs structured tasks with ownership/completion tracking. Do not use for one-off notes without task management needs.",
-    inputSchema: Type13.Object({
-      name: Type13.String({
+    inputSchema: Type17.Object({
+      name: Type17.String({
         minLength: 1,
         maxLength: 160,
         description: "Name for the new Slack list."
@@ -6222,20 +7005,20 @@ function createSlackListCreateTool(state) {
 function createSlackListAddItemsTool(state) {
   return tool({
     description: "Add tasks to the active Slack list tracked in artifact context. Use when the user wants actionable items recorded in the current thread list. Do not use when no list exists and list creation was not requested.",
-    inputSchema: Type13.Object({
-      items: Type13.Array(Type13.String({ minLength: 1 }), {
+    inputSchema: Type17.Object({
+      items: Type17.Array(Type17.String({ minLength: 1 }), {
         minItems: 1,
         maxItems: 25,
         description: "List item titles to create."
       }),
-      assignee_user_id: Type13.Optional(
-        Type13.String({
+      assignee_user_id: Type17.Optional(
+        Type17.String({
           minLength: 1,
           description: "Optional Slack user ID assigned to all created items."
         })
       ),
-      due_date: Type13.Optional(
-        Type13.String({
+      due_date: Type17.Optional(
+        Type17.String({
           pattern: "^\\d{4}-\\d{2}-\\d{2}$",
           description: "Optional due date in YYYY-MM-DD format."
         })
@@ -6284,9 +7067,10 @@ function createSlackListAddItemsTool(state) {
 function createSlackListGetItemsTool(state) {
   return tool({
     description: "Read items from the active Slack list tracked in artifact context. Use when the user asks for task status, open items, or list contents. Do not use when list state is already known from the immediately prior result.",
-    inputSchema: Type13.Object({
-      limit: Type13.Optional(
-        Type13.Integer({
+    annotations: { readOnlyHint: true, destructiveHint: false },
+    inputSchema: Type17.Object({
+      limit: Type17.Optional(
+        Type17.Integer({
           minimum: 1,
           maximum: 200,
           description: "Maximum number of list items to return."
@@ -6311,19 +7095,19 @@ function createSlackListGetItemsTool(state) {
 function createSlackListUpdateItemTool(state) {
   return tool({
     description: "Update an item in the active Slack list tracked in artifact context (title/completion). Use when the user asks to mark progress or rename a tracked task. Do not use to add new tasks.",
-    inputSchema: Type13.Object(
+    inputSchema: Type17.Object(
       {
-        item_id: Type13.String({
+        item_id: Type17.String({
           minLength: 1,
           description: "ID of the Slack list item to update."
         }),
-        completed: Type13.Optional(
-          Type13.Boolean({
+        completed: Type17.Optional(
+          Type17.Boolean({
             description: "Optional completion status update."
           })
         ),
-        title: Type13.Optional(
-          Type13.String({
+        title: Type17.Optional(
+          Type17.String({
             minLength: 1,
             description: "Optional new item title."
           })
@@ -6373,11 +7157,12 @@ function createSlackListUpdateItemTool(state) {
 }
 
 // src/chat/tools/system-time.ts
-import { Type as Type14 } from "@sinclair/typebox";
+import { Type as Type18 } from "@sinclair/typebox";
 function createSystemTimeTool() {
   return tool({
     description: "Return current system time in UTC and local ISO formats. Use when the user asks for current time/date context. Do not use as a substitute for historical or timezone-conversion research.",
-    inputSchema: Type14.Object({}),
+    annotations: { readOnlyHint: true, destructiveHint: false },
+    inputSchema: Type18.Object({}),
     execute: async () => {
       const now = /* @__PURE__ */ new Date();
       return {
@@ -6395,7 +7180,7 @@ function createSystemTimeTool() {
 import {
   Agent
 } from "@mariozechner/pi-agent-core";
-import { Type as Type15 } from "@sinclair/typebox";
+import { Type as Type19 } from "@sinclair/typebox";
 
 // src/chat/respond-helpers.ts
 var MAX_INLINE_ATTACHMENT_BASE64_CHARS = 12e4;
@@ -6533,12 +7318,6 @@ function encodeNonImageAttachmentForPrompt(attachment) {
     "</attachment>"
   ].join("\n");
 }
-function buildExecutionFailureMessage(toolErrorCount) {
-  if (toolErrorCount > 0) {
-    return "I couldn't complete this because one or more required tools failed in this turn. I've logged the failure details.";
-  }
-  return "I couldn't complete this request in this turn due to an execution failure. I've logged the details for debugging.";
-}
 function isToolResultMessage(value) {
   return typeof value === "object" && value !== null && value.role === "toolResult";
 }
@@ -6635,23 +7414,13 @@ function createStateAdvisorSessionStore() {
 }
 
 // src/chat/tools/advisor/tool.ts
-var ADVISOR_ALLOWED_TOOL_NAMES = /* @__PURE__ */ new Set([
-  "bash",
-  "readFile",
-  "searchMcpTools",
-  "slackCanvasRead",
-  "slackChannelListMessages",
-  "slackListGetItems",
-  "systemTime",
-  "webFetch",
-  "webSearch"
-]);
-var ADVISOR_TOOL_DESCRIPTION = "Ask a stronger advisor for deep technical guidance. Call this when the task has a hard reasoning core: algorithm design, architecture, concurrency, security-sensitive logic, data modeling, unclear requirements, repeated failures, difficult debugging, broad refactors, or final review of nontrivial work. Pass a focused question plus curated context containing the exact evidence, constraints, current plan, alternatives, command output, code snippets, or diffs the advisor should start from. The advisor does not automatically receive the parent transcript, keeps its own advisor history for this parent conversation, can use inspection tools to verify evidence, can reason deeply, and returns guidance for you to apply and verify. Follow-up calls can build on prior advisor guidance but must include any new evidence or changed constraints. Use it after initial orientation reads when repository context matters, before committing to a non-obvious implementation plan, when changing approach, when stuck, and before declaring complex work complete. Do not use it for greetings, simple deterministic edits, routine formatting, or tasks where the next action is already obvious from fresh tool output.";
+var ADVISOR_TOOL_DESCRIPTION = "Ask a stronger advisor for deep technical guidance. Call this when the task has a hard reasoning core: algorithm design, architecture, concurrency, security-sensitive logic, data modeling, unclear requirements, repeated failures, difficult debugging, broad refactors, or final review of nontrivial work. Pass a focused question plus curated context containing the exact evidence, constraints, current plan, alternatives, command output, code snippets, or diffs the advisor should start from. The advisor does not automatically receive the parent transcript, keeps its own advisor history for this parent conversation, can use read-only inspection tools to verify evidence, can reason deeply, and returns guidance for you to apply and verify. Follow-up calls can build on prior advisor guidance but must include any new evidence or changed constraints. Use it after initial orientation reads when repository context matters, before committing to a non-obvious implementation plan, when changing approach, when stuck, and before declaring complex work complete. Do not use it for greetings, simple deterministic edits, routine formatting, or tasks where the next action is already obvious from fresh tool output.";
 var ADVISOR_SYSTEM_PROMPT = [
   "You are a senior technical advisor for the executor.",
-  "Analyze the executor-supplied context deeply. Use inspection tools when direct inspection or verification would materially improve the advice.",
+  "Analyze the executor-supplied context deeply. Use read-only tools when direct inspection or verification would materially improve the advice.",
   "Distinguish evidence from inference. Treat the advisor task as the focus for this call and the executor context as the starting evidence packet.",
   "Do not assume access to parent transcript or tool output that was not included or gathered in this advisor call.",
+  "Use only the read-only tools provided to you.",
   "Do not make user-visible side effects, post Slack messages, or mutate files. If a mutating action is needed, recommend it to the executor instead.",
   "Identify the hard part, recommend a concrete plan or correction, call out blocking risks, and propose focused verification.",
   "If the supplied context is insufficient, say exactly what additional evidence the executor needs to gather before acting.",
@@ -6684,20 +7453,27 @@ function success(memo) {
     }
   };
 }
-function isAdvisorToolAllowed(toolName) {
-  return ADVISOR_ALLOWED_TOOL_NAMES.has(toolName);
+function hasReadOnlyToolAnnotations(annotations) {
+  return annotations?.readOnlyHint === true && annotations.destructiveHint !== true;
+}
+function createAdvisorToolDefinitions(definitions) {
+  return Object.fromEntries(
+    Object.entries(definitions).filter(
+      ([name, definition]) => name !== "callMcpTool" && name !== "searchMcpTools" && hasReadOnlyToolAnnotations(definition.annotations)
+    )
+  );
 }
 function createAdvisorTool(context) {
   const store = context.store ?? createStateAdvisorSessionStore();
   const spanContext = context.logContext ?? {};
   return tool({
     description: ADVISOR_TOOL_DESCRIPTION,
-    inputSchema: Type15.Object({
-      question: Type15.String({
+    inputSchema: Type19.Object({
+      question: Type19.String({
         minLength: 1,
         description: "Focused advisor question or decision point."
       }),
-      context: Type15.String({
+      context: Type19.String({
         minLength: 1,
         description: "Curated evidence packet: relevant requirements, constraints, current plan, alternatives, code snippets, diffs, command output, and open questions."
       })
@@ -6809,7 +7585,7 @@ function createAdvisorTool(context) {
 }
 
 // src/chat/tools/web/fetch-tool.ts
-import { Type as Type16 } from "@sinclair/typebox";
+import { Type as Type20 } from "@sinclair/typebox";
 
 // src/chat/tools/web/constants.ts
 var USER_AGENT = "junior-bot/0.1";
@@ -7011,13 +7787,16 @@ async function assertPublicUrl(rawUrl) {
   }
   return parsed;
 }
-async function withTimeout(task, timeoutMs, label) {
+async function withTimeout(task, timeoutMs, label, options) {
   let timer;
   const timeoutPromise = new Promise((_, reject) => {
-    timer = setTimeout(
-      () => reject(new Error(`${label} timed out`)),
-      timeoutMs
-    );
+    timer = setTimeout(() => {
+      reject(new Error(`${label} timed out`));
+      try {
+        options?.onTimeout?.();
+      } catch {
+      }
+    }, timeoutMs);
   });
   try {
     return await Promise.race([task, timeoutPromise]);
@@ -7154,13 +7933,18 @@ function extractHttpStatusFromMessage(message) {
 function createWebFetchTool(hooks) {
   return tool({
     description: "Fetch and extract readable content from a specific URL. Use when you need details from a known page or document. Do not use for discovery when search is the first step.",
-    inputSchema: Type16.Object({
-      url: Type16.String({
+    annotations: {
+      readOnlyHint: true,
+      destructiveHint: false,
+      openWorldHint: true
+    },
+    inputSchema: Type20.Object({
+      url: Type20.String({
         minLength: 1,
         description: "HTTP(S) URL to fetch."
       }),
-      max_chars: Type16.Optional(
-        Type16.Integer({
+      max_chars: Type20.Optional(
+        Type20.Integer({
           minimum: 500,
           maximum: MAX_FETCH_CHARS,
           description: "Optional maximum number of extracted characters to return."
@@ -7220,7 +8004,7 @@ function createWebFetchTool(hooks) {
 // src/chat/tools/web/search.ts
 import { generateText } from "ai";
 import { createGatewayProvider } from "@ai-sdk/gateway";
-import { Type as Type17 } from "@sinclair/typebox";
+import { Type as Type21 } from "@sinclair/typebox";
 var SEARCH_TIMEOUT_MS = 6e4;
 var MAX_RESULTS2 = 5;
 var DEFAULT_SEARCH_MODEL = "xai/grok-4-fast-reasoning";
@@ -7263,14 +8047,19 @@ function isAuthFailure(message) {
 function createWebSearchTool() {
   return tool({
     description: "Search public web sources and return top snippets/URLs. Use when you need discovery or source candidates. Do not use when the user already provided a specific URL to inspect.",
-    inputSchema: Type17.Object({
-      query: Type17.String({
+    annotations: {
+      readOnlyHint: true,
+      destructiveHint: false,
+      openWorldHint: true
+    },
+    inputSchema: Type21.Object({
+      query: Type21.String({
         minLength: 1,
         maxLength: 500,
         description: "Search query."
       }),
-      max_results: Type17.Optional(
-        Type17.Integer({
+      max_results: Type21.Optional(
+        Type21.Integer({
           minimum: 1,
           maximum: MAX_RESULTS2,
           description: "Max results to return."
@@ -7280,6 +8069,7 @@ function createWebSearchTool() {
     execute: async ({ query, max_results }) => {
       const maxResults = max_results ?? 3;
       const model = process.env.AI_WEB_SEARCH_MODEL ?? DEFAULT_SEARCH_MODEL;
+      const controller = new AbortController();
       try {
         const provider = createGatewayProvider();
         const response = await withTimeout(
@@ -7292,10 +8082,12 @@ function createWebSearchTool() {
                 maxResults
               })
             },
-            toolChoice: { type: "tool", toolName: SEARCH_TOOL_NAME }
+            toolChoice: { type: "tool", toolName: SEARCH_TOOL_NAME },
+            abortSignal: controller.signal
           }),
           SEARCH_TIMEOUT_MS,
-          "webSearch"
+          "webSearch",
+          { onTimeout: () => controller.abort() }
         );
         const results = parseSearchResults(response.toolResults, maxResults);
         return {
@@ -7336,17 +8128,20 @@ function createWebSearchTool() {
 }
 
 // src/chat/tools/sandbox/write-file.ts
-import { Type as Type18 } from "@sinclair/typebox";
+import { Type as Type22 } from "@sinclair/typebox";
 function createWriteFileTool() {
   return tool({
     description: "Write UTF-8 content to a file in the sandbox workspace. Use for intentional file creation or replacement after validation. Do not use for exploratory analysis-only turns.",
-    inputSchema: Type18.Object(
+    promptSnippet: "new file or deliberate full-file replacement",
+    promptGuidelines: ["targeted existing-file changes: editFile"],
+    executionMode: "sequential",
+    inputSchema: Type22.Object(
       {
-        path: Type18.String({
+        path: Type22.String({
           minLength: 1,
           description: "Path to write in the sandbox workspace."
         }),
-        content: Type18.String({
+        content: Type22.String({
           description: "UTF-8 file content to write."
         })
       },
@@ -7406,6 +8201,10 @@ function createTools(availableSkills, hooks = {}, context) {
     bash: createBashTool(),
     attachFile: createAttachFileTool(context.sandbox, hooks),
     readFile: createReadFileTool(),
+    editFile: createEditFileTool(),
+    grep: createGrepTool(),
+    findFiles: createFindFilesTool(),
+    listDir: createListDirTool(),
     writeFile: createWriteFileTool(),
     webSearch: createWebSearchTool(),
     webFetch: createWebFetchTool(hooks),
@@ -7672,7 +8471,7 @@ import { createBashTool as createBashTool2 } from "bash-tool";
 
 // src/chat/sandbox/skill-sync.ts
 import fs3 from "fs/promises";
-import path5 from "path";
+import path9 from "path";
 
 // src/chat/sandbox/eval-gh-stub.ts
 function buildEvalGitHubCliStub() {
@@ -8041,7 +8840,7 @@ fallbackToRealSentry();
 
 // src/chat/sandbox/skill-sync.ts
 function toPosixRelative(base, absolute) {
-  return path5.relative(base, absolute).split(path5.sep).join("/");
+  return path9.relative(base, absolute).split(path9.sep).join("/");
 }
 async function listFilesRecursive(root) {
   const queue = [root];
@@ -8051,7 +8850,7 @@ async function listFilesRecursive(root) {
     const entries = await fs3.readdir(dir, { withFileTypes: true });
     entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      const absolute = path5.join(dir, entry.name);
+      const absolute = path9.join(dir, entry.name);
       if (entry.isDirectory()) {
         queue.push(absolute);
       } else if (entry.isFile()) {
@@ -8090,7 +8889,7 @@ async function buildSkillSyncFiles(availableSkills, runtimeBinDir, referenceFile
   });
   if (referenceFiles && referenceFiles.length > 0) {
     for (const absoluteFile of referenceFiles) {
-      const fileName = path5.basename(absoluteFile);
+      const fileName = path9.basename(absoluteFile);
       filesToWrite.push({
         path: `${SANDBOX_DATA_ROOT}/${fileName}`,
         content: await fs3.readFile(absoluteFile)
@@ -8118,7 +8917,7 @@ async function buildSkillSyncFiles(availableSkills, runtimeBinDir, referenceFile
 function collectDirectories(filesToWrite, workspaceRoot) {
   const directoriesToEnsure = /* @__PURE__ */ new Set();
   for (const file of filesToWrite) {
-    const normalizedPath = path5.posix.normalize(file.path);
+    const normalizedPath = path9.posix.normalize(file.path);
     const parts = normalizedPath.split("/").filter(Boolean);
     let current = "";
     for (let index = 0; index < parts.length - 1; index += 1) {
@@ -8131,19 +8930,19 @@ function collectDirectories(filesToWrite, workspaceRoot) {
   ).sort((a, b) => a.length - b.length);
 }
 function resolveHostSkillPath(availableSkills, sandboxPath) {
-  const normalizedPath = path5.posix.normalize(sandboxPath.trim());
+  const normalizedPath = path9.posix.normalize(sandboxPath.trim());
   for (const skill of availableSkills) {
     const virtualRoot = sandboxSkillDir(skill.name);
     if (normalizedPath !== virtualRoot && !normalizedPath.startsWith(`${virtualRoot}/`)) {
       continue;
     }
-    const relativePath = path5.posix.relative(virtualRoot, normalizedPath);
+    const relativePath = path9.posix.relative(virtualRoot, normalizedPath);
     if (!relativePath || relativePath.startsWith("../")) {
       return null;
     }
-    const hostRoot = path5.resolve(skill.skillPath);
-    const hostPath = path5.resolve(hostRoot, ...relativePath.split("/"));
-    if (hostPath !== hostRoot && !hostPath.startsWith(`${hostRoot}${path5.sep}`)) {
+    const hostRoot = path9.resolve(skill.skillPath);
+    const hostPath = path9.resolve(hostRoot, ...relativePath.split("/"));
+    if (hostPath !== hostRoot && !hostPath.startsWith(`${hostRoot}${path9.sep}`)) {
       return null;
     }
     return hostPath;
@@ -8151,16 +8950,16 @@ function resolveHostSkillPath(availableSkills, sandboxPath) {
   return null;
 }
 function resolveHostDataPath(referenceFiles, sandboxPath) {
-  const normalizedPath = path5.posix.normalize(sandboxPath.trim());
+  const normalizedPath = path9.posix.normalize(sandboxPath.trim());
   if (normalizedPath !== SANDBOX_DATA_ROOT && !normalizedPath.startsWith(`${SANDBOX_DATA_ROOT}/`)) {
     return null;
   }
-  const relativePath = path5.posix.relative(SANDBOX_DATA_ROOT, normalizedPath);
+  const relativePath = path9.posix.relative(SANDBOX_DATA_ROOT, normalizedPath);
   if (!relativePath || relativePath.startsWith("../") || relativePath.includes("/")) {
     return null;
   }
   for (const hostFile of referenceFiles) {
-    if (path5.basename(hostFile) === relativePath) {
+    if (path9.basename(hostFile) === relativePath) {
       return hostFile;
     }
   }
@@ -8658,16 +9457,41 @@ function createSandboxSessionManager(options) {
           env: input.env,
           pathPrefix: `${SANDBOX_RUNTIME_BIN_DIR}:$PATH`
         });
+        const controller = input.timeoutMs && input.timeoutMs > 0 ? new AbortController() : void 0;
+        let timedOut = false;
+        const timeoutId = controller ? setTimeout(() => {
+          timedOut = true;
+          controller.abort();
+        }, input.timeoutMs) : void 0;
         return await withTemporaryHeaderTransforms(
           sandboxInstance,
           input.headerTransforms,
           async () => {
-            const commandResult2 = await sandboxInstance.runCommand({
-              cmd: "bash",
-              args: ["-c", script],
-              cwd: SANDBOX_WORKSPACE_ROOT
-            });
-            return await readCommandOutput(commandResult2);
+            try {
+              const commandResult2 = await sandboxInstance.runCommand({
+                cmd: "bash",
+                args: ["-c", script],
+                cwd: SANDBOX_WORKSPACE_ROOT,
+                ...controller ? { signal: controller.signal } : {}
+              });
+              return await readCommandOutput(commandResult2);
+            } catch (error) {
+              if (timedOut) {
+                return {
+                  stdout: "",
+                  stderr: `Command timed out after ${input.timeoutMs}ms`,
+                  exitCode: 124,
+                  stdoutTruncated: false,
+                  stderrTruncated: false,
+                  timedOut: true
+                };
+              }
+              throw error;
+            } finally {
+              if (timeoutId) {
+                clearTimeout(timeoutId);
+              }
+            }
           }
         );
       },
@@ -8678,7 +9502,8 @@ function createSandboxSessionManager(options) {
       writeFile: async (input) => await executeWriteFile(input, {
         toolCallId: "sandbox-write-file",
         messages: []
-      })
+      }),
+      fs: sandboxInstance.fs
     };
   };
   const ensureReadySandbox = async () => {
@@ -8734,7 +9559,15 @@ function createSandboxSessionManager(options) {
 }
 
 // src/chat/sandbox/sandbox.ts
-var SANDBOX_TOOL_NAMES = /* @__PURE__ */ new Set(["bash", "readFile", "writeFile"]);
+var SANDBOX_TOOL_NAMES = /* @__PURE__ */ new Set([
+  "bash",
+  "readFile",
+  "editFile",
+  "grep",
+  "findFiles",
+  "listDir",
+  "writeFile"
+]);
 function parseHeaderTransforms(raw) {
   if (!Array.isArray(raw)) {
     return void 0;
@@ -8798,6 +9631,7 @@ function createSandboxExecutor(options) {
   const executeBashTool = async (rawInput, command) => {
     const headerTransforms = parseHeaderTransforms(rawInput.headerTransforms);
     const env = parseEnv(rawInput.env);
+    const timeoutMs = positiveInteger(rawInput.timeoutMs);
     logSandboxBootRequest("tool.bash", {
       "app.sandbox.command_length": command.length
     });
@@ -8813,7 +9647,8 @@ function createSandboxExecutor(options) {
           const response = await executeBash({
             command,
             ...headerTransforms ? { headerTransforms } : {},
-            ...env ? { env } : {}
+            ...env ? { env } : {},
+            ...timeoutMs ? { timeoutMs } : {}
           });
           setSpanAttributes({
             "process.exit.code": response.exitCode,
@@ -8845,7 +9680,7 @@ function createSandboxExecutor(options) {
         cwd: SANDBOX_WORKSPACE_ROOT,
         exit_code: result.exitCode,
         signal: null,
-        timed_out: false,
+        timed_out: Boolean(result.timedOut),
         stdout: result.stdout,
         stderr: result.stderr,
         stdout_truncated: result.stdoutTruncated,
@@ -8858,6 +9693,8 @@ function createSandboxExecutor(options) {
     if (!filePath) {
       throw new Error("path is required");
     }
+    const offset = positiveInteger(rawInput.offset);
+    const limit = positiveInteger(rawInput.limit);
     if (!sessionManager.getSandboxId()) {
       const hostPath = resolveHostSkillPath(availableSkills, filePath) ?? resolveHostDataPath(referenceFiles, filePath);
       if (hostPath) {
@@ -8871,11 +9708,12 @@ function createSandboxExecutor(options) {
           });
           setSpanStatus("ok");
           return {
-            result: {
+            result: sliceFileContent({
               content,
               path: filePath,
-              success: true
-            }
+              offset,
+              limit
+            })
           };
         } catch (error) {
           if (!isHostFileMissingError(error)) {
@@ -8903,9 +9741,12 @@ function createSandboxExecutor(options) {
         });
         setSpanStatus("ok");
         return {
-          content,
-          path: filePath,
-          success: true
+          ...sliceFileContent({
+            content,
+            path: filePath,
+            offset,
+            limit
+          })
         };
       }
     );
@@ -8945,6 +9786,116 @@ function createSandboxExecutor(options) {
       }
     };
   };
+  const executeEditFileTool = async (rawInput) => {
+    const filePath = String(rawInput.path ?? "").trim();
+    if (!filePath) {
+      throw new Error("path is required");
+    }
+    if (!Array.isArray(rawInput.edits)) {
+      throw new Error("edits is required");
+    }
+    logSandboxBootRequest("tool.editFile", {
+      "file.path": filePath
+    });
+    const executors = await sessionManager.ensureToolExecutors();
+    const result = await withSandboxSpan(
+      "sandbox.editFile",
+      "sandbox.fs.edit",
+      {
+        "app.sandbox.path.length": filePath.length,
+        "app.sandbox.edit.count": rawInput.edits.length
+      },
+      async () => {
+        const response = await editFile({
+          fs: executors.fs,
+          path: filePath,
+          edits: rawInput.edits
+        });
+        setSpanStatus("ok");
+        return response;
+      }
+    );
+    return { result };
+  };
+  const executeGrepTool = async (rawInput) => {
+    const pattern = String(rawInput.pattern ?? "");
+    if (!pattern) {
+      throw new Error("pattern is required");
+    }
+    logSandboxBootRequest("tool.grep");
+    const contextLines = positiveInteger(rawInput.context);
+    const limit = positiveInteger(rawInput.limit);
+    const executors = await sessionManager.ensureToolExecutors();
+    const result = await withSandboxSpan(
+      "sandbox.grep",
+      "sandbox.fs.search",
+      {
+        "app.sandbox.pattern.length": pattern.length
+      },
+      async () => {
+        const response = await grepFiles({
+          fs: executors.fs,
+          pattern,
+          ...typeof rawInput.path === "string" ? { path: rawInput.path } : {},
+          ...typeof rawInput.glob === "string" ? { glob: rawInput.glob } : {},
+          ...typeof rawInput.ignoreCase === "boolean" ? { ignoreCase: rawInput.ignoreCase } : {},
+          ...typeof rawInput.literal === "boolean" ? { literal: rawInput.literal } : {},
+          ...contextLines ? { context: contextLines } : {},
+          ...limit ? { limit } : {}
+        });
+        setSpanStatus("ok");
+        return response;
+      }
+    );
+    return { result };
+  };
+  const executeFindFilesTool = async (rawInput) => {
+    const pattern = String(rawInput.pattern ?? "");
+    if (!pattern) {
+      throw new Error("pattern is required");
+    }
+    logSandboxBootRequest("tool.findFiles");
+    const limit = positiveInteger(rawInput.limit);
+    const executors = await sessionManager.ensureToolExecutors();
+    const result = await withSandboxSpan(
+      "sandbox.findFiles",
+      "sandbox.fs.find",
+      {
+        "app.sandbox.pattern.length": pattern.length
+      },
+      async () => {
+        const response = await findFiles({
+          fs: executors.fs,
+          pattern,
+          ...typeof rawInput.path === "string" ? { path: rawInput.path } : {},
+          ...limit ? { limit } : {}
+        });
+        setSpanStatus("ok");
+        return response;
+      }
+    );
+    return { result };
+  };
+  const executeListDirTool = async (rawInput) => {
+    logSandboxBootRequest("tool.listDir");
+    const limit = positiveInteger(rawInput.limit);
+    const executors = await sessionManager.ensureToolExecutors();
+    const result = await withSandboxSpan(
+      "sandbox.listDir",
+      "sandbox.fs.list",
+      {},
+      async () => {
+        const response = await listDir({
+          fs: executors.fs,
+          ...typeof rawInput.path === "string" ? { path: rawInput.path } : {},
+          ...limit ? { limit } : {}
+        });
+        setSpanStatus("ok");
+        return response;
+      }
+    );
+    return { result };
+  };
   const execute = async (params) => {
     const rawInput = params.input ?? {};
     const bashCommand = params.toolName === "bash" ? String(rawInput.command ?? "").trim() : void 0;
@@ -8963,6 +9914,18 @@ function createSandboxExecutor(options) {
     if (params.toolName === "readFile") {
       return await executeReadFileTool(rawInput);
     }
+    if (params.toolName === "editFile") {
+      return await executeEditFileTool(rawInput);
+    }
+    if (params.toolName === "grep") {
+      return await executeGrepTool(rawInput);
+    }
+    if (params.toolName === "findFiles") {
+      return await executeFindFilesTool(rawInput);
+    }
+    if (params.toolName === "listDir") {
+      return await executeListDirTool(rawInput);
+    }
     if (params.toolName === "writeFile") {
       return await executeWriteFileTool(rawInput);
     }
@@ -9035,11 +9998,49 @@ function buildReportedProgressStatus(input) {
 
 // src/chat/tools/execution/build-sandbox-input.ts
 function buildSandboxInput(toolName, params) {
+  const optionalNumber = (value) => typeof value === "number" && Number.isFinite(value) ? value : void 0;
   if (toolName === "bash") {
-    return { command: String(params.command ?? "") };
+    return {
+      command: String(params.command ?? ""),
+      ...optionalNumber(params.timeoutMs) ? { timeoutMs: optionalNumber(params.timeoutMs) } : {}
+    };
   }
   if (toolName === "readFile") {
-    return { path: String(params.path ?? "") };
+    return {
+      path: String(params.path ?? ""),
+      ...optionalNumber(params.offset) ? { offset: optionalNumber(params.offset) } : {},
+      ...optionalNumber(params.limit) ? { limit: optionalNumber(params.limit) } : {}
+    };
+  }
+  if (toolName === "editFile") {
+    return {
+      path: String(params.path ?? ""),
+      edits: Array.isArray(params.edits) ? params.edits : []
+    };
+  }
+  if (toolName === "grep") {
+    return {
+      pattern: String(params.pattern ?? ""),
+      ...typeof params.path === "string" ? { path: params.path } : {},
+      ...typeof params.glob === "string" ? { glob: params.glob } : {},
+      ...typeof params.ignoreCase === "boolean" ? { ignoreCase: params.ignoreCase } : {},
+      ...typeof params.literal === "boolean" ? { literal: params.literal } : {},
+      ...optionalNumber(params.context) ? { context: optionalNumber(params.context) } : {},
+      ...optionalNumber(params.limit) ? { limit: optionalNumber(params.limit) } : {}
+    };
+  }
+  if (toolName === "findFiles") {
+    return {
+      pattern: String(params.pattern ?? ""),
+      ...typeof params.path === "string" ? { path: params.path } : {},
+      ...optionalNumber(params.limit) ? { limit: optionalNumber(params.limit) } : {}
+    };
+  }
+  if (toolName === "listDir") {
+    return {
+      ...typeof params.path === "string" ? { path: params.path } : {},
+      ...optionalNumber(params.limit) ? { limit: optionalNumber(params.limit) } : {}
+    };
   }
   if (toolName === "writeFile") {
     return {
@@ -9174,6 +10175,8 @@ function createAgentTools(tools, sandbox, spanContext, onStatus, sandboxExecutor
     label: toolName,
     description: toolDef.description,
     parameters: toolDef.inputSchema,
+    prepareArguments: toolDef.prepareArguments,
+    executionMode: toolDef.executionMode,
     execute: async (toolCallId, params) => {
       const normalizedToolCallId = typeof toolCallId === "string" && toolCallId.length > 0 ? toolCallId : void 0;
       const toolArgumentsAttribute = serializeGenAiAttribute(params);
@@ -9431,18 +10434,17 @@ function buildTurnResult(input) {
   const errorMessage = typeof lastAssistant?.errorMessage === "string" ? lastAssistant.errorMessage : void 0;
   const usedPrimaryText = Boolean(primaryText);
   const outcome = primaryText ? stopReason === "error" ? "provider_error" : "success" : sideEffectOnlySuccess ? "success" : "execution_failure";
-  const fallbackText = buildExecutionFailureMessage(toolErrorCount);
   const suppressReactionOnlyText = reactionPerformed && !channelPostPerformed && replyFiles.length === 0 && Boolean(primaryText) && isReactionOnlyIntent(userInput);
-  const rawResponseText = suppressReactionOnlyText ? "" : primaryText || (sideEffectOnlySuccess ? "" : fallbackText);
+  const rawResponseText = suppressReactionOnlyText ? "" : primaryText;
   const responseText = canvasCreated && isVerbosePostCanvasReply(rawResponseText) ? buildBriefPostCanvasReply(artifactStatePatch) : rawResponseText;
   const escapedOrRawPayload = Boolean(primaryText) && (isExecutionEscapeResponse(primaryText) || isRawToolPayloadResponse(primaryText));
-  const resolvedText = escapedOrRawPayload ? fallbackText : enforceAttachmentClaimTruth(responseText, replyFiles.length > 0);
-  const deliveryPlan = reactionPerformed && !resolvedText && replyFiles.length === 0 && !channelPostPerformed ? {
+  const resolvedText = escapedOrRawPayload ? "" : enforceAttachmentClaimTruth(responseText, replyFiles.length > 0);
+  const resolvedOutcome = escapedOrRawPayload ? "execution_failure" : outcome;
+  const deliveryPlan = resolvedOutcome === "success" && !resolvedText && replyFiles.length === 0 && (reactionPerformed || channelPostPerformed) ? {
     ...baseDeliveryPlan,
     postThreadText: false
   } : baseDeliveryPlan;
   const deliveryMode = deliveryPlan.mode;
-  const resolvedOutcome = escapedOrRawPayload ? "execution_failure" : outcome;
   if (shouldTrace) {
     logInfo(
       "agent_message_out",
@@ -10734,6 +11736,13 @@ async function generateAssistantReply(messageText, context = {}) {
         }
       }
     );
+    const toolGuidance = Object.entries(
+      tools
+    ).map(([name, definition]) => ({
+      name,
+      promptGuidelines: definition.promptGuidelines,
+      promptSnippet: definition.promptSnippet
+    }));
     syncResumeState();
     for (const skill of activeSkills) {
       await turnMcpToolManager.activateForSkill(skill);
@@ -10753,6 +11762,7 @@ async function generateAssistantReply(messageText, context = {}) {
       availableSkills,
       activeSkills,
       activeMcpCatalogs,
+      toolGuidance,
       runtime: {
         channelId: toolChannelId,
         fastModelId: botConfig.fastModelId,
@@ -10806,7 +11816,16 @@ async function generateAssistantReply(messageText, context = {}) {
       pluginAuth,
       onToolCall
     );
-    advisorTools = agentTools.filter((tool2) => isAdvisorToolAllowed(tool2.name));
+    advisorTools = createAgentTools(
+      createAdvisorToolDefinitions(tools),
+      skillSandbox,
+      spanContext,
+      context.onStatus,
+      sandboxExecutor,
+      capabilityRuntime,
+      pluginAuth,
+      onToolCall
+    );
     agent = new Agent2({
       getApiKey: () => getPiGatewayApiKeyOverride(),
       initialState: {
@@ -11107,6 +12126,97 @@ async function generateAssistantReply(messageText, context = {}) {
   }
 }
 
+// src/chat/services/turn-failure-response.ts
+function requireTurnFailureEventId(eventId, eventName) {
+  if (!eventId) {
+    throw new Error(`Sentry did not return an event ID for ${eventName}`);
+  }
+  return eventId;
+}
+function getExecutionFailureReason(reply) {
+  const errorMessage = reply.diagnostics.errorMessage?.trim();
+  if (errorMessage) {
+    return errorMessage;
+  }
+  if (reply.diagnostics.toolErrorCount > 0) {
+    return `${reply.diagnostics.toolErrorCount} tool result error(s)`;
+  }
+  if (reply.diagnostics.assistantMessageCount > 0) {
+    return "assistant returned no text";
+  }
+  return "empty assistant turn";
+}
+function getFailureCapture(reply) {
+  if (reply.diagnostics.outcome === "provider_error") {
+    return {
+      eventName: "agent_turn_provider_error",
+      error: reply.diagnostics.providerError ?? new Error(
+        reply.diagnostics.errorMessage ?? "Provider error without explicit message"
+      ),
+      attributes: {},
+      body: "Agent turn failed with provider error"
+    };
+  }
+  const failureReason = getExecutionFailureReason(reply);
+  return {
+    eventName: "agent_turn_execution_failure",
+    error: new Error(`Agent turn execution failure: ${failureReason}`),
+    attributes: {
+      "app.ai.execution_failure_reason": failureReason
+    },
+    body: "Agent turn completed with execution failure"
+  };
+}
+function getAgentTurnDiagnosticsAttributes(reply) {
+  return {
+    "gen_ai.provider.name": GEN_AI_PROVIDER_NAME,
+    "gen_ai.operation.name": "invoke_agent",
+    "app.ai.outcome": reply.diagnostics.outcome,
+    "app.ai.assistant_messages": reply.diagnostics.assistantMessageCount,
+    "app.ai.tool_results": reply.diagnostics.toolResultCount,
+    "app.ai.tool_error_results": reply.diagnostics.toolErrorCount,
+    "app.ai.tool_call_count": reply.diagnostics.toolCalls.length,
+    "app.ai.used_primary_text": reply.diagnostics.usedPrimaryText,
+    ...reply.diagnostics.thinkingLevel ? {
+      "app.ai.reasoning_effort": reply.diagnostics.thinkingLevel
+    } : {},
+    ...reply.diagnostics.stopReason ? {
+      "gen_ai.response.finish_reasons": [reply.diagnostics.stopReason]
+    } : {},
+    ...reply.diagnostics.errorMessage ? { "error.message": reply.diagnostics.errorMessage } : {}
+  };
+}
+function finalizeFailedTurnReply(args) {
+  if (args.reply.diagnostics.outcome === "success") {
+    return args.reply;
+  }
+  const capture = getFailureCapture(args.reply);
+  const eventId = requireTurnFailureEventId(
+    args.logException(
+      capture.error,
+      capture.eventName,
+      args.context,
+      {
+        ...getAgentTurnDiagnosticsAttributes(args.reply),
+        ...args.attributes,
+        ...capture.attributes
+      },
+      capture.body
+    ),
+    capture.eventName
+  );
+  return {
+    ...args.reply,
+    text: buildTurnFailureResponse(eventId),
+    deliveryMode: "thread",
+    deliveryPlan: {
+      mode: "thread",
+      postThreadText: true,
+      attachFiles: args.reply.files && args.reply.files.length > 0 ? "inline" : "none"
+    }
+  };
+}
+
 // src/chat/slack/assistant-thread/status-render.ts
 var DEFAULT_STATUS_CONTEXTS = {
   thinking: "\u2026",
@@ -11376,7 +12486,7 @@ function createSlackAdapterStatusSender(args) {
   };
 }
 function createSlackWebApiStatusSender(args) {
-  const getClient2 = args.getSlackClient ?? getSlackClient;
+  const getClient3 = args.getSlackClient ?? getSlackClient;
   return async (text, loadingMessages) => {
     const channelId = args.channelId;
     const threadTs = args.threadTs;
@@ -11389,7 +12499,7 @@ function createSlackWebApiStatusSender(args) {
     }
     const nextLoadingMessages = text ? loadingMessages ?? [text] : void 0;
     try {
-      await getClient2().assistant.threads.setStatus({
+      await getClient3().assistant.threads.setStatus({
         channel_id: normalizedChannelId,
         thread_ts: threadTs,
         status: text ? SLACK_ASSISTANT_ACTIVE_STATUS : "",
@@ -11466,9 +12576,56 @@ function createSlackWebApiAssistantStatusSession(args) {
 }
 
 // src/chat/slack/footer.ts
+var SENTRY_CONVERSATION_SEARCH_STATS_PERIOD = "14d";
+var ORG_ID_HOST_RE = /^o(\d+)\./;
 function escapeSlackMrkdwn(text) {
   return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 }
+function escapeSlackLinkUrl(url) {
+  return url.replaceAll("&", "&amp;").replaceAll("<", "%3C").replaceAll(">", "%3E");
+}
+function toOptionalString2(value) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return String(value);
+  }
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function quoteSentrySearchValue(value) {
+  return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+function getDsnOrgId(host) {
+  return host?.match(ORG_ID_HOST_RE)?.[1];
+}
+function isSentrySaasDsnHost(host) {
+  return host === "sentry.io" || host.endsWith(".sentry.io");
+}
+function buildSentryWebBaseUrl(dsn) {
+  if (isSentrySaasDsnHost(dsn.host)) {
+    return "https://sentry.io";
+  }
+  const port = dsn.port ? `:${dsn.port}` : "";
+  const path11 = dsn.path ? `/${dsn.path}` : "";
+  return `${dsn.protocol}://${dsn.host}${port}${path11}`;
+}
+function getSentryConversationSearchUrl(conversationId) {
+  const client2 = sentry_exports.getClient();
+  const dsn = client2?.getDsn();
+  if (!dsn?.host || !dsn.projectId) {
+    return void 0;
+  }
+  const orgId = toOptionalString2(client2?.getOptions().orgId) ?? getDsnOrgId(dsn.host);
+  if (!orgId) {
+    return void 0;
+  }
+  const params = new URLSearchParams();
+  params.set(
+    "query",
+    `gen_ai.conversation.id:${quoteSentrySearchValue(conversationId)}`
+  );
+  params.set("project", dsn.projectId);
+  params.set("statsPeriod", SENTRY_CONVERSATION_SEARCH_STATS_PERIOD);
+  return `${buildSentryWebBaseUrl(dsn)}/organizations/${orgId}/explore/traces/?${params.toString()}`;
+}
 function formatSlackTokenCount(value) {
   if (value >= 1e6) {
     const millions = value / 1e6;
@@ -11518,10 +12675,15 @@ function buildSlackReplyFooter(args) {
   const items = [];
   const conversationId = args.conversationId?.trim();
   if (conversationId) {
-    items.push({
+    const idItem = {
       label: "ID",
       value: conversationId
-    });
+    };
+    const conversationUrl = getSentryConversationSearchUrl(conversationId);
+    if (conversationUrl) {
+      idItem.url = conversationUrl;
+    }
+    items.push(idItem);
   }
   const totalTokens = resolveTotalTokens(args.usage);
   if (totalTokens !== void 0) {
@@ -11560,7 +12722,7 @@ function buildSlackReplyBlocks(text, footer) {
       type: "context",
       elements: footer.items.map((item) => ({
         type: "mrkdwn",
-        text: `*${escapeSlackMrkdwn(item.label)}:* ${escapeSlackMrkdwn(item.value)}`
+        text: item.url ? `*${escapeSlackMrkdwn(item.label)}:* <${escapeSlackLinkUrl(item.url)}|${escapeSlackMrkdwn(item.value)}>` : `*${escapeSlackMrkdwn(item.label)}:* ${escapeSlackMrkdwn(item.value)}`
       }))
     });
   }
@@ -11569,9 +12731,6 @@ function buildSlackReplyBlocks(text, footer) {
 
 // src/chat/slack/reply.ts
 import { Buffer as Buffer2 } from "buffer";
-function isInterruptedVisibleReply(reply) {
-  return reply.diagnostics.outcome === "provider_error";
-}
 function resolveReplyDelivery(reply) {
   const replyHasFiles = Boolean(reply.files && reply.files.length > 0);
   const deliveryPlan = reply.deliveryPlan ?? {
@@ -11595,9 +12754,7 @@ function buildReplyText(text) {
   return "";
 }
 function buildTextPosts(args) {
-  const chunks = splitSlackReplyText(args.text, {
-    interrupted: args.interrupted
-  });
+  const chunks = splitSlackReplyText(args.text);
   return chunks.map((chunk, index) => ({
     text: chunk,
     ...index === 0 && args.firstFiles ? { files: args.firstFiles } : {},
@@ -11648,11 +12805,9 @@ function planSlackReplyPosts(args) {
   const { shouldPostThreadReply, attachFiles } = resolveReplyDelivery(
     args.reply
   );
-  const interrupted = isInterruptedVisibleReply(args.reply);
   const posts = [];
   const textPosts = shouldPostThreadReply ? buildTextPosts({
     text: args.reply.text,
-    interrupted,
     firstFiles: attachFiles === "inline" ? replyFiles : void 0
   }) : [];
   posts.push(...textPosts);
@@ -11777,6 +12932,64 @@ var ResumeTurnBusyError = class extends Error {
 function getDefaultLockKey(channelId, threadTs) {
   return `slack:${channelId}:${threadTs}`;
 }
+function getResumeLogContext(args, lockKey) {
+  return {
+    conversationId: args.replyContext?.correlation?.conversationId ?? lockKey,
+    slackThreadId: args.replyContext?.correlation?.threadId ?? lockKey,
+    slackUserId: args.replyContext?.requester?.userId ?? args.replyContext?.correlation?.requesterId,
+    slackUserName: args.replyContext?.requester?.userName,
+    slackChannelId: args.channelId,
+    runId: args.replyContext?.correlation?.runId,
+    assistantUserName: botConfig.userName,
+    modelId: botConfig.modelId
+  };
+}
+async function postResumeFailureReply(args) {
+  try {
+    await postSlackMessage({
+      channelId: args.channelId,
+      threadTs: args.threadTs,
+      text: buildTurnFailureResponse(args.eventId)
+    });
+  } catch (error) {
+    logException(
+      error,
+      "slack_resume_failure_reply_post_failed",
+      args.logContext,
+      {
+        "app.error.original_event_id": args.eventId
+      },
+      "Failed to post resumed turn failure reply"
+    );
+    throw error;
+  }
+}
+async function handleResumeFailure(args) {
+  const logContext = getResumeLogContext(args.resumeArgs, args.lockKey);
+  const capturedEventId = logException(
+    args.error,
+    args.eventName,
+    logContext,
+    {},
+    args.body
+  );
+  await args.resumeArgs.onFailure?.(args.error);
+  const eventId = requireTurnFailureEventId(capturedEventId, args.eventName);
+  let postError;
+  try {
+    await postResumeFailureReply({
+      channelId: args.resumeArgs.channelId,
+      threadTs: args.resumeArgs.threadTs,
+      eventId,
+      logContext
+    });
+  } catch (error) {
+    postError = error;
+  }
+  if (postError) {
+    throw postError;
+  }
+}
 function createResumeReplyContext(args, statusSession) {
   const replyContext = args.replyContext ?? {};
   const threadId = args.lockKey ?? getDefaultLockKey(args.channelId, args.threadTs);
@@ -11844,7 +13057,7 @@ async function resumeSlackTurn(args) {
       ...replyContext
     });
     const replyTimeoutMs = resolveReplyTimeoutMs(args.replyTimeoutMs);
-    const reply = typeof replyTimeoutMs === "number" ? await Promise.race([
+    let reply = typeof replyTimeoutMs === "number" ? await Promise.race([
       replyPromise,
       new Promise(
         (_, reject) => setTimeout(
@@ -11857,6 +13070,11 @@ async function resumeSlackTurn(args) {
         )
       )
     ]) : await replyPromise;
+    reply = finalizeFailedTurnReply({
+      reply,
+      logException,
+      context: getResumeLogContext(args, lockKey)
+    });
     await status.stop();
     const footer = buildSlackReplyFooter({
       conversationId: args.replyContext?.correlation?.conversationId ?? lockKey,
@@ -11884,14 +13102,13 @@ async function resumeSlackTurn(args) {
       };
     } else {
       deferredFailureHandler = async () => {
-        await args.onFailure?.(error);
-        if (args.failureText) {
-          await postSlackMessageBestEffort(
-            args.channelId,
-            args.threadTs,
-            args.failureText
-          );
-        }
+        await handleResumeFailure({
+          body: "Failed to resume Slack turn",
+          error,
+          eventName: "slack_resume_turn_failed",
+          lockKey,
+          resumeArgs: args
+        });
       };
     }
   } finally {
@@ -11902,14 +13119,13 @@ async function resumeSlackTurn(args) {
       await deferredPauseHandler();
       return;
     } catch (pauseError) {
-      await args.onFailure?.(pauseError);
-      if (args.failureText) {
-        await postSlackMessageBestEffort(
-          args.channelId,
-          args.threadTs,
-          args.failureText
-        );
-      }
+      await handleResumeFailure({
+        body: "Failed to handle resumed turn pause",
+        error: pauseError,
+        eventName: "slack_resume_pause_handler_failed",
+        lockKey,
+        resumeArgs: args
+      });
       return;
     }
   }
@@ -11925,7 +13141,6 @@ async function resumeAuthorizedRequest(args) {
     replyContext: args.replyContext,
     lockKey: args.lockKey,
     initialText: args.connectedText,
-    failureText: args.failureText,
     generateReply: args.generateReply,
     onSuccess: args.onSuccess,
     onFailure: args.onFailure,
@@ -12233,7 +13448,6 @@ async function resumeAuthorizedMcpTurn(args) {
     threadTs: authSession.threadTs,
     lockKey: authSession.conversationId,
     connectedText: "",
-    failureText: "MCP authorization completed, but resuming the request failed. Please retry the original command.",
     replyContext: {
       requester: {
         userId: authSession.userId,
@@ -12283,14 +13497,7 @@ async function resumeAuthorizedMcpTurn(args) {
         );
       }
     },
-    onFailure: async (error) => {
-      logException(
-        error,
-        "mcp_oauth_callback_resume_failed",
-        {},
-        { "app.credential.provider": provider },
-        "Failed to resume MCP-authorized turn"
-      );
+    onFailure: async () => {
       try {
         await persistFailedReplyState(
           authSession.channelId,
@@ -12403,7 +13610,7 @@ async function GET4(request, provider, waitUntil) {
 
 // src/chat/slack/app-home.ts
 import fs5 from "fs";
-import path6 from "path";
+import path10 from "path";
 var DEFAULT_DESCRIPTION_TEXT = "I help your team investigate, summarize, and act on work in Slack.";
 var MAX_HOME_SKILLS = 6;
 var MAX_SECTION_TEXT_CHARS = 3e3;
@@ -12415,7 +13622,7 @@ function clampSectionText(text) {
   return `${text.slice(0, MAX_SECTION_TEXT_CHARS - 1)}\u2026`;
 }
 function loadDescriptionText() {
-  const descriptionPath = path6.join(homeDir(), "DESCRIPTION.md");
+  const descriptionPath = path10.join(homeDir(), "DESCRIPTION.md");
   try {
     const raw = fs5.readFileSync(descriptionPath, "utf8").trim();
     if (raw.length > 0) {
@@ -12682,7 +13889,6 @@ async function resumeCheckpointedOAuthTurn(stored) {
     threadTs: stored.threadTs,
     lockKey: stored.resumeConversationId,
     initialText: "",
-    failureText: "I connected your account but hit an error processing your request. Please try the command again.",
     replyContext: {
       requester: {
         userId: userMessage.author.userId,
@@ -12730,14 +13936,7 @@ async function resumeCheckpointedOAuthTurn(stored) {
         reply
       });
     },
-    onFailure: async (error) => {
-      logException(
-        error,
-        "oauth_callback_resume_failed",
-        {},
-        { "app.credential.provider": stored.provider },
-        "Failed to auto-resume checkpointed turn after OAuth callback"
-      );
+    onFailure: async () => {
       await persistFailedOAuthReplyState({
         conversationId: stored.resumeConversationId,
         sessionId: resolvedSessionId
@@ -12789,7 +13988,6 @@ async function resumePendingOAuthMessage(stored) {
     channelId: stored.channelId,
     threadTs: stored.threadTs,
     connectedText: "",
-    failureText: `I connected your account but hit an error processing your request. Please try \`${stored.pendingMessage}\` again.`,
     replyContext: {
       requester: { userId: stored.userId },
       conversationContext,
@@ -12807,15 +14005,6 @@ async function resumePendingOAuthMessage(stored) {
         },
         "OAuth callback auto-resumed pending message finished replying"
       );
-    },
-    onFailure: async (error) => {
-      logException(
-        error,
-        "oauth_callback_resume_failed",
-        {},
-        { "app.credential.provider": stored.provider },
-        "Failed to auto-resume pending message after OAuth callback"
-      );
     }
   });
 }
@@ -13142,7 +14331,6 @@ async function resumeTimedOutTurn(payload) {
     channelId: thread.channelId,
     threadTs: thread.threadTs,
     lockKey: payload.conversationId,
-    failureText: "I hit an error while resuming that request. Please try the command again.",
     replyContext: {
       requester: {
         userId: userMessage.author.userId,
@@ -13191,18 +14379,7 @@ async function resumeTimedOutTurn(payload) {
         );
       }
     },
-    onFailure: async (error) => {
-      logException(
-        error,
-        "timeout_resume_failed",
-        {},
-        {
-          "app.ai.conversation_id": payload.conversationId,
-          "app.ai.session_id": payload.sessionId,
-          ...isRetryableTurnError(error) ? { "app.turn.retryable_reason": error.reason } : {}
-        },
-        "Failed to resume timed-out turn"
-      );
+    onFailure: async () => {
       await persistFailedReplyState2(checkpoint);
     },
     onAuthPause: async () => {
@@ -13314,11 +14491,11 @@ var DIRECTED_FOLLOW_UP_CUE_RE = /\b(?:you said|you just said|your last response|
 var TERSE_CLARIFICATION_RE = /^(?:which one|which ones|why|how so|what do you mean|what did you mean|say more|explain that|clarify that|expand on that|elaborate on that)\??$/i;
 var GENERIC_IMMEDIATE_SIDE_CONVERSATION_RE = /^(?:is that (?:the )?right (?:approach|call|move)|(?:can|could|would) you check on this)\??$/i;
 var RECENT_THREAD_WINDOW = 6;
-function escapeRegExp(value) {
+function escapeRegExp2(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function containsAssistantInvocation(text, botUserName) {
-  const escapedUserName = escapeRegExp(botUserName);
+  const escapedUserName = escapeRegExp2(botUserName);
   const plainNameMentionRe = new RegExp(`(^|\\s)@${escapedUserName}\\b`, "i");
   const labeledEntityMentionRe = new RegExp(
     `<@[^>|]+\\|${escapedUserName}>`,
@@ -13614,7 +14791,7 @@ async function decideSubscribedThreadReply(args) {
 }
 
 // src/chat/runtime/thread-context.ts
-function escapeRegExp2(value) {
+function escapeRegExp3(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function stripLeadingBotMention(text, options = {}) {
@@ -13624,12 +14801,12 @@ function stripLeadingBotMention(text, options = {}) {
     next = next.replace(/^\s*<@[^>]+>[\s,:-]*/, "").trim();
   }
   const mentionByNameRe = new RegExp(
-    `^\\s*@${escapeRegExp2(botConfig.userName)}\\b[\\s,:-]*`,
+    `^\\s*@${escapeRegExp3(botConfig.userName)}\\b[\\s,:-]*`,
     "i"
   );
   next = next.replace(mentionByNameRe, "").trim();
   const mentionByLabeledEntityRe = new RegExp(
-    `^\\s*<@[^>|]+\\|${escapeRegExp2(botConfig.userName)}>[\\s,:-]*`,
+    `^\\s*<@[^>|]+\\|${escapeRegExp3(botConfig.userName)}>[\\s,:-]*`,
     "i"
   );
   next = next.replace(mentionByLabeledEntityRe, "").trim();
@@ -13730,15 +14907,6 @@ async function maybeHandleThreadOptOutDecision(args) {
   await args.thread.post(THREAD_OPTOUT_ACK);
   return true;
 }
-function buildFailureMessage(reference) {
-  if (!reference) {
-    return "I ran into an internal error while processing that. Please try again.";
-  }
-  if (reference.eventId) {
-    return `I ran into an internal error while processing that. Reference: \`event_id=${reference.eventId} trace_id=${reference.traceId}\`.`;
-  }
-  return `I ran into an internal error while processing that. Reference: \`trace_id=${reference.traceId}\`.`;
-}
 function buildLogContext(deps, args) {
   return {
     conversationId: args.threadId ?? args.runId,
@@ -13755,7 +14923,7 @@ function createSlackTurnRuntime(deps) {
   const logContext = (args) => buildLogContext(deps, args);
   const postFallbackErrorReplyWithLogging = async (args) => {
     try {
-      await args.thread.post(buildFailureMessage(args.reference));
+      await args.thread.post(buildTurnFailureResponse(args.eventId));
     } catch (postError) {
       deps.logException(
         postError,
@@ -13763,7 +14931,7 @@ function createSlackTurnRuntime(deps) {
         args.errorContext,
         {
           "app.slack.reply_stage": "error_fallback_post",
-          ...args.eventId ? { "app.error.original_event_id": args.eventId } : {},
+          "app.error.original_event_id": args.eventId,
           ...getSlackErrorObservabilityAttributes(postError)
         },
         args.postFailureBody
@@ -13849,11 +15017,14 @@ function createSlackTurnRuntime(deps) {
           {},
           "onNewMention failed"
         );
+        if (!eventId) {
+          throw new Error(
+            "Sentry did not return an event ID for mention_handler_failed"
+          );
+        }
         await hooks?.beforeFirstResponsePost?.();
-        const reference = deps.getErrorReference(eventId);
         await postFallbackErrorReplyWithLogging({
           thread,
-          reference,
           errorContext,
           eventId,
           postFailureEventName: "mention_handler_failure_reply_post_failed",
@@ -13981,11 +15152,14 @@ function createSlackTurnRuntime(deps) {
           {},
           "onSubscribedMessage failed"
         );
+        if (!eventId) {
+          throw new Error(
+            "Sentry did not return an event ID for subscribed_message_handler_failed"
+          );
+        }
         await hooks?.beforeFirstResponsePost?.();
-        const reference = deps.getErrorReference(eventId);
         await postFallbackErrorReplyWithLogging({
           thread,
-          reference,
           errorContext,
           eventId,
           postFailureEventName: "subscribed_message_handler_failure_reply_post_failed",
@@ -14773,19 +15947,6 @@ function maybeUpdateAssistantTitle(args) {
 }
 
 // src/chat/runtime/reply-executor.ts
-function getExecutionFailureReason(reply) {
-  const errorMessage = reply.diagnostics.errorMessage?.trim();
-  if (errorMessage) {
-    return errorMessage;
-  }
-  if (reply.diagnostics.toolErrorCount > 0) {
-    return `${reply.diagnostics.toolErrorCount} tool result error(s)`;
-  }
-  if (reply.diagnostics.assistantMessageCount > 0) {
-    return "assistant returned no text";
-  }
-  return "empty assistant turn";
-}
 function createReplyToThread(deps) {
   return async function replyToThread(thread, message, options = {}) {
     if (message.author.isMe) {
@@ -14935,7 +16096,7 @@ function createReplyToThread(deps) {
         let shouldPersistFailureState = true;
         try {
           const toolChannelId = preparedState.artifacts.assistantContextChannelId ?? channelId;
-          const reply = await deps.services.generateAssistantReply(userText, {
+          let reply = await deps.services.generateAssistantReply(userText, {
             requester: {
               userId: message.author.userId,
               userName: message.author.userName ?? fallbackIdentity?.userName,
@@ -14994,49 +16155,14 @@ function createReplyToThread(deps) {
             assistantUserName: botConfig.userName,
             modelId: reply.diagnostics.modelId
           };
-          const diagnosticsAttributes = {
-            "gen_ai.provider.name": GEN_AI_PROVIDER_NAME,
-            "gen_ai.operation.name": "invoke_agent",
-            "app.ai.outcome": reply.diagnostics.outcome,
-            "app.ai.assistant_messages": reply.diagnostics.assistantMessageCount,
-            "app.ai.tool_results": reply.diagnostics.toolResultCount,
-            "app.ai.tool_error_results": reply.diagnostics.toolErrorCount,
-            "app.ai.tool_call_count": reply.diagnostics.toolCalls.length,
-            "app.ai.used_primary_text": reply.diagnostics.usedPrimaryText,
-            ...reply.diagnostics.thinkingLevel ? {
-              "app.ai.reasoning_effort": reply.diagnostics.thinkingLevel
-            } : {},
-            ...reply.diagnostics.stopReason ? {
-              "gen_ai.response.finish_reasons": [
-                reply.diagnostics.stopReason
-              ]
-            } : {},
-            ...reply.diagnostics.errorMessage ? { "error.message": reply.diagnostics.errorMessage } : {}
-          };
+          const diagnosticsAttributes = getAgentTurnDiagnosticsAttributes(reply);
           setSpanAttributes(diagnosticsAttributes);
-          if (reply.diagnostics.outcome === "provider_error") {
-            const providerError = reply.diagnostics.providerError ?? new Error(
-              reply.diagnostics.errorMessage ?? "Provider error without explicit message"
-            );
-            logException(
-              providerError,
-              "agent_turn_provider_error",
-              diagnosticsContext,
-              diagnosticsAttributes,
-              "Agent turn failed with provider error"
-            );
-          } else if (reply.diagnostics.outcome !== "success") {
-            const failureReason = getExecutionFailureReason(reply);
-            logException(
-              new Error(`Agent turn execution failure: ${failureReason}`),
-              "agent_turn_execution_failure",
-              diagnosticsContext,
-              {
-                ...diagnosticsAttributes,
-                "app.ai.execution_failure_reason": failureReason
-              },
-              "Agent turn completed with execution failure"
-            );
+          if (reply.diagnostics.outcome !== "success") {
+            reply = finalizeFailedTurnReply({
+              reply,
+              logException,
+              context: diagnosticsContext
+            });
           }
           markConversationMessage(
             preparedState.conversation,
@@ -15408,7 +16534,6 @@ function createSlackRuntime(options) {
     assistantUserName: botConfig.userName,
     modelId: botConfig.modelId,
     now: options.now ?? (() => Date.now()),
-    getErrorReference: resolveErrorReference,
     getThreadId,
     getChannelId,
     getRunId,