@sentry/junior 0.63.0 → 0.65.0

package/dist/{chunk-H652GMDH.js → chunk-EDHJIYHS.js}

@@ -5,7 +5,7 @@ import {
   discoverInstalledPluginPackageContent,
   normalizePluginPackageNames,
   pluginRoots
-} from "./chunk-5LUISFEY.js";
+} from "./chunk-KVZL5NZS.js";
 
 // src/chat/coerce.ts
 function toOptionalString(value) {
@@ -119,6 +119,16 @@ var CONSOLE_PREVIEW_KEYS = /* @__PURE__ */ new Set([
   "gen_ai.tool.call.arguments",
   "gen_ai.tool.call.result"
 ]);
+var SENTRY_TAG_ATTRIBUTE_KEYS = /* @__PURE__ */ new Set([
+  "app.platform",
+  "messaging.system",
+  "app.actor.type",
+  "gen_ai.agent.name",
+  "gen_ai.request.model",
+  "app.skill.name",
+  "http.request.method",
+  "url.path"
+]);
 function getSentryEnvironment() {
   return (process.env.SENTRY_ENVIRONMENT ?? process.env.VERCEL_ENV ?? process.env.NODE_ENV ?? "").trim().toLowerCase();
 }
@@ -857,7 +867,7 @@ var log = {
   error(eventName, attrs = {}, body) {
     emit("error", eventName, attrs, body);
   },
-  exception(eventName, error, attrs = {}, body) {
+  exception(eventName, error, attrs = {}, body, context) {
     const normalizedError = error instanceof Error ? error : new Error(String(error));
     emit(
       "error",
@@ -876,6 +886,9 @@ var log = {
     const sentryCaptureException = sentry_exports.captureException;
     if (typeof sentryWithScope === "function" && typeof sentryCaptureException === "function") {
       sentryWithScope((scope) => {
+        if (context) {
+          setSentryScopeContext(scope, context);
+        }
         for (const [key, value] of Object.entries(
           mergeAttributes(contextStorage.getStore(), attrs)
         )) {
@@ -886,6 +899,9 @@ var log = {
       return eventId;
     }
     if (typeof sentryCaptureException === "function") {
+      if (context) {
+        setSentryUser(sentryUserIdentityFromContext(context));
+      }
       eventId = sentryCaptureException(normalizedError);
     }
     return eventId;
@@ -1007,16 +1023,51 @@ function toSpanAttributes(context) {
 function setSentryTagsFromContext(context) {
   const attrs = contextToAttributes(context);
   for (const [key, value] of Object.entries(attrs)) {
+    if (!SENTRY_TAG_ATTRIBUTE_KEYS.has(key)) {
+      continue;
+    }
     if (typeof value === "string" && value.length > 0) {
       sentry_exports.setTag(key, value);
     }
   }
+}
+function sentryUserIdentityFromContext(context) {
   if (context.slackUserId) {
-    sentry_exports.setUser({
+    return {
       id: context.slackUserId,
-      username: context.slackUserName
-    });
+      ...context.slackUserName ? { username: context.slackUserName } : {},
+      ...context.slackUserEmail ? { email: context.slackUserEmail } : {}
+    };
+  }
+  return void 0;
+}
+function sentryUserFromIdentity(identity) {
+  return {
+    id: identity.id,
+    ip_address: null,
+    ...identity.username ? { username: identity.username } : {},
+    ...identity.email ? { email: identity.email } : {}
+  };
+}
+function setSentryUser(identity) {
+  if (!identity) return;
+  sentry_exports.setUser(sentryUserFromIdentity(identity));
+}
+function setSentryScopeContext(scope, context) {
+  const attrs = contextToAttributes(context);
+  for (const [key, value] of Object.entries(attrs)) {
+    if (!SENTRY_TAG_ATTRIBUTE_KEYS.has(key)) {
+      continue;
+    }
+    if (typeof value === "string" && value.length > 0) {
+      scope.setTag(key, value);
+    }
+  }
+  const identity = sentryUserIdentityFromContext(context);
+  if (identity) {
+    scope.setUser(sentryUserFromIdentity(identity));
   }
+  scope.setContext("app", attrs);
 }
 function toSpanAttributeValue(value) {
   if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
@@ -1058,12 +1109,14 @@ function logException(error, eventName, context = {}, attributes = {}, body) {
     eventName,
     normalizedError,
     { ...toSpanAttributes(context), ...attributes },
-    body
+    body,
+    context
   );
 }
 function setTags(context = {}) {
   setLogContext(context);
   setSentryTagsFromContext(context);
+  setSentryUser(sentryUserIdentityFromContext(context));
 }
 function createRequestContext(request, context = {}) {
   return createLogContextFromRequest(request, context);
@@ -1151,7 +1204,7 @@ function sanitizeGenAiValue(value, seen, depth, keyName) {
     if (shouldTreatAsBlob) {
       return `[omitted:${value.length}]`;
     }
-    return truncateGenAiString(value, GEN_AI_MAX_STRING_CHARS);
+    return truncateGenAiString(redactSecrets(value), GEN_AI_MAX_STRING_CHARS);
   }
   if (typeof value === "number") {
     return Number.isFinite(value) ? value : void 0;
@@ -1166,7 +1219,7 @@ function sanitizeGenAiValue(value, seen, depth, keyName) {
     return value.slice(0, GEN_AI_MAX_ARRAY_ITEMS).map((entry) => sanitizeGenAiValue(entry, seen, depth + 1)).filter((entry) => entry !== void 0);
   }
   if (typeof value !== "object") {
-    return String(value);
+    return redactSecrets(String(value));
   }
   if (seen.has(value)) {
     return "[circular]";
@@ -1194,7 +1247,7 @@ function serializeGenAiAttribute(value, maxChars = GEN_AI_DEFAULT_MAX_ATTRIBUTE_
   if (!serialized) {
     return void 0;
   }
-  return truncateGenAiString(serialized, maxChars);
+  return truncateGenAiString(redactSecrets(serialized), maxChars);
 }
 function asRecord(value) {
   return value && typeof value === "object" ? value : void 0;
@@ -1270,6 +1323,125 @@ function extractGenAiUsageAttributes(...sources) {
 // src/chat/plugins/manifest.ts
 import { z } from "zod";
 import { parse as parseYaml } from "yaml";
+
+// src/chat/plugins/inline-manifest-source.ts
+function setDefined(target, key, value) {
+  if (value !== void 0) {
+    target[key] = value;
+  }
+}
+function isRecord2(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function unqualifyManifestToken(name, value) {
+  if (typeof name === "string" && typeof value === "string" && value.startsWith(`${name}.`)) {
+    return value.slice(name.length + 1);
+  }
+  return value;
+}
+function inlineTokenListSource(name, values) {
+  if (values === void 0 || !Array.isArray(values)) {
+    return values;
+  }
+  return values.map((value) => unqualifyManifestToken(name, value));
+}
+function inlineCredentialsSource(credentials) {
+  if (credentials === void 0 || !isRecord2(credentials)) {
+    return credentials;
+  }
+  const result = {};
+  setDefined(result, "type", credentials.type);
+  setDefined(result, "domains", credentials.domains);
+  setDefined(result, "api-headers", credentials.apiHeaders);
+  setDefined(result, "auth-token-env", credentials.authTokenEnv);
+  setDefined(
+    result,
+    "auth-token-placeholder",
+    credentials.authTokenPlaceholder
+  );
+  if (credentials.type === "github-app") {
+    setDefined(result, "app-id-env", credentials.appIdEnv);
+    setDefined(result, "private-key-env", credentials.privateKeyEnv);
+    setDefined(result, "installation-id-env", credentials.installationIdEnv);
+  }
+  return result;
+}
+function inlineMcpSource(mcp) {
+  if (mcp === void 0 || !isRecord2(mcp)) {
+    return mcp;
+  }
+  const result = {};
+  setDefined(result, "transport", mcp.transport);
+  setDefined(result, "url", mcp.url);
+  setDefined(result, "headers", mcp.headers);
+  setDefined(result, "allowed-tools", mcp.allowedTools);
+  return result;
+}
+function inlineOauthSource(oauth) {
+  if (oauth === void 0 || !isRecord2(oauth)) {
+    return oauth;
+  }
+  const result = {};
+  setDefined(result, "client-id-env", oauth.clientIdEnv);
+  setDefined(result, "client-secret-env", oauth.clientSecretEnv);
+  setDefined(result, "authorize-endpoint", oauth.authorizeEndpoint);
+  setDefined(result, "token-endpoint", oauth.tokenEndpoint);
+  setDefined(result, "scope", oauth.scope);
+  setDefined(result, "authorize-params", oauth.authorizeParams);
+  setDefined(result, "token-auth-method", oauth.tokenAuthMethod);
+  setDefined(result, "token-extra-headers", oauth.tokenExtraHeaders);
+  return result;
+}
+function inlineTargetSource(name, target) {
+  if (target === void 0 || !isRecord2(target)) {
+    return target;
+  }
+  const result = {};
+  setDefined(result, "type", target.type);
+  setDefined(
+    result,
+    "config-key",
+    unqualifyManifestToken(name, target.configKey)
+  );
+  setDefined(result, "command-flags", target.commandFlags);
+  return result;
+}
+function inlineManifestSource(manifest) {
+  const result = {};
+  setDefined(result, "name", manifest.name);
+  setDefined(result, "description", manifest.description);
+  setDefined(
+    result,
+    "capabilities",
+    inlineTokenListSource(manifest.name, manifest.capabilities)
+  );
+  setDefined(
+    result,
+    "config-keys",
+    inlineTokenListSource(manifest.name, manifest.configKeys)
+  );
+  setDefined(result, "domains", manifest.domains);
+  setDefined(result, "api-headers", manifest.apiHeaders);
+  setDefined(result, "command-env", manifest.commandEnv);
+  setDefined(result, "env-vars", manifest.envVars);
+  setDefined(
+    result,
+    "credentials",
+    inlineCredentialsSource(manifest.credentials)
+  );
+  setDefined(result, "runtime-dependencies", manifest.runtimeDependencies);
+  setDefined(result, "runtime-postinstall", manifest.runtimePostinstall);
+  setDefined(result, "mcp", inlineMcpSource(manifest.mcp));
+  setDefined(result, "oauth", inlineOauthSource(manifest.oauth));
+  setDefined(
+    result,
+    "target",
+    inlineTargetSource(manifest.name, manifest.target)
+  );
+  return result;
+}
+
+// src/chat/plugins/manifest.ts
 var PLUGIN_NAME_RE = /^[a-z][a-z0-9-]*$/;
 var SHORT_CAPABILITY_RE = /^[a-z0-9-]+(\.[a-z0-9-]+)*$/;
 var SHORT_CONFIG_KEY_RE = /^[a-z0-9]+(\.[a-z0-9-]+)*$/;
@@ -1489,45 +1661,45 @@ var manifestSourceSchema = z.object({
     error: "must be an object"
   }).optional()
 }).passthrough();
-function setDefined(target, key, value) {
+function setDefined2(target, key, value) {
   if (value !== void 0) {
     target[key] = value;
   }
 }
 function manifestConfigPatch(config) {
   const result = {};
-  setDefined(result, "description", config.description);
-  setDefined(result, "capabilities", config.capabilities);
-  setDefined(result, "config-keys", config.configKeys);
-  setDefined(result, "domains", config.domains);
-  setDefined(result, "api-headers", config.apiHeaders);
-  setDefined(result, "command-env", config.commandEnv);
-  setDefined(result, "env-vars", config.envVars);
+  setDefined2(result, "description", config.description);
+  setDefined2(result, "capabilities", config.capabilities);
+  setDefined2(result, "config-keys", config.configKeys);
+  setDefined2(result, "domains", config.domains);
+  setDefined2(result, "api-headers", config.apiHeaders);
+  setDefined2(result, "command-env", config.commandEnv);
+  setDefined2(result, "env-vars", config.envVars);
   if (config.credentials !== void 0) {
     if (!config.credentials) {
       result.credentials = null;
     } else {
       const credentials = {};
-      setDefined(credentials, "type", config.credentials.type);
-      setDefined(credentials, "domains", config.credentials.domains);
-      setDefined(credentials, "api-headers", config.credentials.apiHeaders);
-      setDefined(
+      setDefined2(credentials, "type", config.credentials.type);
+      setDefined2(credentials, "domains", config.credentials.domains);
+      setDefined2(credentials, "api-headers", config.credentials.apiHeaders);
+      setDefined2(
         credentials,
         "auth-token-env",
         config.credentials.authTokenEnv
       );
-      setDefined(
+      setDefined2(
         credentials,
         "auth-token-placeholder",
         config.credentials.authTokenPlaceholder
       );
-      setDefined(credentials, "app-id-env", config.credentials.appIdEnv);
-      setDefined(
+      setDefined2(credentials, "app-id-env", config.credentials.appIdEnv);
+      setDefined2(
         credentials,
         "private-key-env",
         config.credentials.privateKeyEnv
       );
-      setDefined(
+      setDefined2(
         credentials,
         "installation-id-env",
         config.credentials.installationIdEnv
@@ -1535,17 +1707,17 @@ function manifestConfigPatch(config) {
       result.credentials = credentials;
     }
   }
-  setDefined(result, "runtime-dependencies", config.runtimeDependencies);
-  setDefined(result, "runtime-postinstall", config.runtimePostinstall);
+  setDefined2(result, "runtime-dependencies", config.runtimeDependencies);
+  setDefined2(result, "runtime-postinstall", config.runtimePostinstall);
   if (config.mcp !== void 0) {
     if (!config.mcp) {
       result.mcp = null;
     } else {
       const mcp = {};
-      setDefined(mcp, "transport", config.mcp.transport);
-      setDefined(mcp, "url", config.mcp.url);
-      setDefined(mcp, "headers", config.mcp.headers);
-      setDefined(mcp, "allowed-tools", config.mcp.allowedTools);
+      setDefined2(mcp, "transport", config.mcp.transport);
+      setDefined2(mcp, "url", config.mcp.url);
+      setDefined2(mcp, "headers", config.mcp.headers);
+      setDefined2(mcp, "allowed-tools", config.mcp.allowedTools);
       result.mcp = mcp;
     }
   }
@@ -1554,14 +1726,14 @@ function manifestConfigPatch(config) {
       result.oauth = null;
     } else {
       const oauth = {};
-      setDefined(oauth, "client-id-env", config.oauth.clientIdEnv);
-      setDefined(oauth, "client-secret-env", config.oauth.clientSecretEnv);
-      setDefined(oauth, "authorize-endpoint", config.oauth.authorizeEndpoint);
-      setDefined(oauth, "token-endpoint", config.oauth.tokenEndpoint);
-      setDefined(oauth, "scope", config.oauth.scope);
-      setDefined(oauth, "authorize-params", config.oauth.authorizeParams);
-      setDefined(oauth, "token-auth-method", config.oauth.tokenAuthMethod);
-      setDefined(oauth, "token-extra-headers", config.oauth.tokenExtraHeaders);
+      setDefined2(oauth, "client-id-env", config.oauth.clientIdEnv);
+      setDefined2(oauth, "client-secret-env", config.oauth.clientSecretEnv);
+      setDefined2(oauth, "authorize-endpoint", config.oauth.authorizeEndpoint);
+      setDefined2(oauth, "token-endpoint", config.oauth.tokenEndpoint);
+      setDefined2(oauth, "scope", config.oauth.scope);
+      setDefined2(oauth, "authorize-params", config.oauth.authorizeParams);
+      setDefined2(oauth, "token-auth-method", config.oauth.tokenAuthMethod);
+      setDefined2(oauth, "token-extra-headers", config.oauth.tokenExtraHeaders);
       result.oauth = oauth;
     }
   }
@@ -1570,9 +1742,9 @@ function manifestConfigPatch(config) {
       result.target = null;
     } else {
       const target = {};
-      setDefined(target, "type", config.target.type);
-      setDefined(target, "config-key", config.target.configKey);
-      setDefined(target, "command-flags", config.target.commandFlags);
+      setDefined2(target, "type", config.target.type);
+      setDefined2(target, "config-key", config.target.configKey);
+      setDefined2(target, "command-flags", config.target.commandFlags);
       result.target = target;
     }
   }
@@ -1741,6 +1913,21 @@ function assertCommandEnvDoesNotExposeHostSecretRefs(commandEnv, apiHeaders, cre
     }
   }
 }
+function assertCommandEnvHostRefsAreExplicitlyExposed(commandEnv, envVars, pluginName) {
+  if (!commandEnv) {
+    return;
+  }
+  for (const [key, value] of Object.entries(commandEnv)) {
+    for (const name of envReferences(value)) {
+      const declaration = envVars[name];
+      if (declaration && declaration.default === void 0 && declaration.exposeToCommandEnv !== true) {
+        throw new Error(
+          `Plugin ${pluginName} command-env.${key} references env var ${name}, but env-vars.${name} must set expose-to-command-env: true before host env can be exposed to sandbox`
+        );
+      }
+    }
+  }
+}
 function normalizeCredentials(data, name) {
   const schema = data.type === "oauth-bearer" ? oauthBearerCredentialsSchema : data.type === "github-app" ? githubAppCredentialsSchema : void 0;
   if (!schema) {
@@ -1915,7 +2102,9 @@ function normalizeRuntimePostinstall(commands, name) {
 var envVarDeclarationSchema = z.preprocess(
   (value) => value === null || value === void 0 ? {} : value,
   z.object({
-    default: z.string().optional()
+    default: z.string().optional(),
+    "expose-to-command-env": z.boolean().optional(),
+    exposeToCommandEnv: z.boolean().optional()
   }).strict()
 );
 function normalizeEnvVars(data, pluginName) {
@@ -1937,6 +2126,9 @@ function normalizeEnvVars(data, pluginName) {
     if (parsed.data.default !== void 0) {
       decl.default = parsed.data.default;
     }
+    if (parsed.data["expose-to-command-env"] === true || parsed.data.exposeToCommandEnv === true) {
+      decl.exposeToCommandEnv = true;
+    }
     normalized[name] = decl;
   }
   return normalized;
@@ -1985,89 +2177,76 @@ function normalizeMcp(data, envVars, name) {
     ...result.data["allowed-tools"] ? { allowedTools: result.data["allowed-tools"] } : {}
   };
 }
-function parsePluginManifest(raw, dir, config) {
-  let parsedYaml;
-  try {
-    parsedYaml = parseYaml(raw);
-  } catch (error) {
-    throw new Error(
-      `Invalid plugin manifest in ${dir}: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-  if (!parsedYaml || typeof parsedYaml !== "object" || Array.isArray(parsedYaml)) {
-    throw new Error(`Invalid plugin manifest in ${dir}: expected an object`);
-  }
-  const source = applyManifestConfig(parsedYaml, config);
+function parseManifestSource(parsedSource, dir, config) {
+  const source = applyManifestConfig(parsedSource, config);
   const sourceResult = manifestSourceSchema.safeParse(source);
   if (!sourceResult.success) {
     const issue = sourceResult.error.issues[0];
     const path3 = formatPath(issue?.path ?? []);
     if (path3 === "name") {
-      throw new Error(
-        `Invalid plugin name in ${dir}: "${parsedYaml.name}"`
-      );
+      throw new Error(`Invalid plugin name in ${dir}: "${parsedSource.name}"`);
     }
     if (path3 === "description") {
       throw new Error(`Invalid plugin description in ${dir}`);
     }
     if (path3 === "capabilities") {
       throw new Error(
-        `Plugin ${parsedYaml.name ?? "unknown"} capabilities must be an array when provided`
+        `Plugin ${String(parsedSource.name ?? "unknown")} capabilities must be an array when provided`
       );
     }
     if (path3 === "config-keys") {
       throw new Error(
-        `Plugin ${parsedYaml.name ?? "unknown"} config-keys must be an array when provided`
+        `Plugin ${String(parsedSource.name ?? "unknown")} config-keys must be an array when provided`
       );
     }
     if (path3 === "domains") {
       throw new Error(
-        `Plugin ${parsedYaml.name ?? "unknown"} ${path3} must be a non-empty array of domains`
+        `Plugin ${String(parsedSource.name ?? "unknown")} ${path3} must be a non-empty array of domains`
       );
     }
     if (path3 === "api-headers") {
       throw new Error(
-        `Plugin ${parsedYaml.name ?? "unknown"} api-headers must be an object when provided`
+        `Plugin ${String(parsedSource.name ?? "unknown")} api-headers must be an object when provided`
       );
     }
     if (path3 === "command-env") {
       throw new Error(
-        `Plugin ${parsedYaml.name ?? "unknown"} command-env must be an object when provided`
+        `Plugin ${String(parsedSource.name ?? "unknown")} command-env must be an object when provided`
       );
     }
     if (path3 === "credentials") {
       throw new Error(
-        `Plugin ${parsedYaml.name ?? "unknown"} credentials must be an object when provided`
+        `Plugin ${String(parsedSource.name ?? "unknown")} credentials must be an object when provided`
       );
     }
     if (path3 === "runtime-dependencies") {
       throw new Error(
-        `Plugin ${parsedYaml.name ?? "unknown"} runtime-dependencies must be an array`
+        `Plugin ${String(parsedSource.name ?? "unknown")} runtime-dependencies must be an array`
       );
     }
     if (path3 === "runtime-postinstall") {
       throw new Error(
-        `Plugin ${parsedYaml.name ?? "unknown"} runtime-postinstall must be an array`
+        `Plugin ${String(parsedSource.name ?? "unknown")} runtime-postinstall must be an array`
       );
     }
     if (path3 === "env-vars") {
       throw new Error(
-        `Plugin ${parsedYaml.name ?? "unknown"} env-vars must be an object`
+        `Plugin ${String(parsedSource.name ?? "unknown")} env-vars must be an object`
       );
     }
     if (path3 === "mcp") {
       throw new Error(
-        `Plugin ${parsedYaml.name ?? "unknown"} mcp must be an object`
+        `Plugin ${String(parsedSource.name ?? "unknown")} mcp must be an object`
       );
     }
     if (path3 === "oauth") {
       throw new Error(
-        `Plugin ${parsedYaml.name ?? "unknown"} oauth must be an object`
+        `Plugin ${String(parsedSource.name ?? "unknown")} oauth must be an object`
       );
     }
     if (path3 === "target") {
       throw new Error(
-        `Plugin ${parsedYaml.name ?? "unknown"} target must be an object`
+        `Plugin ${String(parsedSource.name ?? "unknown")} target must be an object`
       );
     }
     throw new Error(issue?.message ?? `Invalid plugin manifest in ${dir}`);
@@ -2108,11 +2287,6 @@ function parsePluginManifest(raw, dir, config) {
     envVars
   ) : void 0;
   const credentials = data.credentials ? normalizeCredentials(data.credentials, data.name) : void 0;
-  if (commandEnv && !credentials && !apiHeaders) {
-    throw new Error(
-      `Plugin ${data.name} command-env requires credentials or api-headers`
-    );
-  }
   const runtimeDependencies = data["runtime-dependencies"] ? normalizeRuntimeDependencies(data["runtime-dependencies"], data.name) : void 0;
   const runtimePostinstall = data["runtime-postinstall"] ? normalizeRuntimePostinstall(data["runtime-postinstall"], data.name) : void 0;
   const mcp = data.mcp ? normalizeMcp(data.mcp, envVars, data.name) : void 0;
@@ -2175,6 +2349,11 @@ function parsePluginManifest(raw, dir, config) {
     manifest.oauth,
     data.name
   );
+  assertCommandEnvHostRefsAreExplicitlyExposed(
+    data["command-env"],
+    envVars,
+    data.name
+  );
   if (data.target) {
     const result = targetSourceSchema.safeParse(data.target);
     if (!result.success) {
@@ -2205,6 +2384,23 @@ function parsePluginManifest(raw, dir, config) {
   }
   return manifest;
 }
+function parsePluginManifest(raw, dir, config) {
+  let parsedYaml;
+  try {
+    parsedYaml = parseYaml(raw);
+  } catch (error) {
+    throw new Error(
+      `Invalid plugin manifest in ${dir}: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if (!parsedYaml || typeof parsedYaml !== "object" || Array.isArray(parsedYaml)) {
+    throw new Error(`Invalid plugin manifest in ${dir}: expected an object`);
+  }
+  return parseManifestSource(parsedYaml, dir, config);
+}
+function parseInlinePluginManifest(manifest, dir, config) {
+  return parseManifestSource(inlineManifestSource(manifest), dir, config);
+}
 
 // src/chat/plugins/registry.ts
 import { readFileSync, readdirSync, statSync } from "fs";
@@ -2852,8 +3048,7 @@ function providerDomains(manifest) {
     ])
   ].sort((left, right) => left.localeCompare(right));
 }
-function registerPluginManifest(state, raw, pluginDir) {
-  const manifest = parsePluginManifest(raw, pluginDir, pluginConfig);
+function registerPluginManifest(state, manifest, pluginDir, skillsDir) {
   if (state.pluginsByName.has(manifest.name)) {
     throw new Error(`Duplicate plugin name "${manifest.name}"`);
   }
@@ -2868,14 +3063,14 @@ function registerPluginManifest(state, raw, pluginDir) {
     const owner = state.domainToPlugin.get(domain);
     if (owner) {
       throw new Error(
-        `Duplicate provider domain "${domain}" in plugin "${manifest.name}" already declared by plugin "${owner}". Use plugins.manifests in PluginConfig to change one plugin's domains or credentials.`
+        `Duplicate provider domain "${domain}" in plugin "${manifest.name}" already declared by plugin "${owner}". Use plugins.manifests in PluginCatalogConfig to change one plugin's domains or credentials.`
       );
     }
   }
   const definition = {
     manifest,
     dir: pluginDir,
-    skillsDir: path2.join(pluginDir, "skills")
+    ...skillsDir ? { skillsDir } : {}
   };
   state.pluginDefinitions.push(definition);
   state.pluginsByName.set(manifest.name, definition);
@@ -2889,6 +3084,15 @@ function registerPluginManifest(state, raw, pluginDir) {
     state.domainToPlugin.set(domain, manifest.name);
   }
 }
+function registerYamlPluginManifest(state, raw, pluginDir) {
+  const manifest = parsePluginManifest(raw, pluginDir, pluginConfig);
+  registerPluginManifest(
+    state,
+    manifest,
+    pluginDir,
+    path2.join(pluginDir, "skills")
+  );
+}
 function normalizePluginRoots(roots) {
   const resolved = [];
   const seen = /* @__PURE__ */ new Set();
@@ -2910,10 +3114,14 @@ function getPluginCatalogSource() {
     ...packagedContent.manifestRoots
   ]);
   const packagedSkillRoots = normalizePluginRoots(packagedContent.skillRoots);
+  const inlineManifests = pluginConfig?.inlineManifests ?? [];
   return {
+    inlineManifests,
     manifestRoots,
     packagedSkillRoots,
+    packagedContent,
     signature: JSON.stringify({
+      inlineManifests,
       manifestRoots,
       packagedSkillRoots,
       packageNames: [...packagedContent.packageNames].sort(),
@@ -2921,24 +3129,42 @@ function getPluginCatalogSource() {
     })
   };
 }
-function normalizePluginConfig(config) {
+function normalizePluginCatalogConfig(config) {
   if (!config) {
     return void 0;
   }
   return {
+    inlineManifests: config.inlineManifests ? structuredClone(config.inlineManifests) : void 0,
     packages: normalizePluginPackageNames(config.packages),
     ...config.manifests ? { manifests: structuredClone(config.manifests) } : {}
   };
 }
-function clonePluginConfig(config) {
+function clonePluginCatalogConfig(config) {
   if (!config) {
     return void 0;
   }
   return {
+    ...config.inlineManifests ? { inlineManifests: structuredClone(config.inlineManifests) } : {},
     packages: [...config.packages ?? []],
     ...config.manifests ? { manifests: structuredClone(config.manifests) } : {}
   };
 }
+function packageContentByName(packagedContent, packageName) {
+  return packagedContent.packages.find((pkg) => pkg.name === packageName);
+}
+function registerInlineManifests(state, source) {
+  for (const definition of source.inlineManifests) {
+    const pkg = definition.packageName ? packageContentByName(source.packagedContent, definition.packageName) : void 0;
+    const dir = pkg?.dir ?? process.cwd();
+    const skillsDir = pkg?.hasSkillsDir ? path2.join(pkg.dir, "skills") : void 0;
+    const manifest = parseInlinePluginManifest(
+      definition.manifest,
+      dir,
+      pluginConfig
+    );
+    registerPluginManifest(state, manifest, dir, skillsDir);
+  }
+}
 function discoverConfiguredPluginPackageContent() {
   return discoverInstalledPluginPackageContent(process.cwd(), {
     packageNames: pluginConfig?.packages
@@ -2949,6 +3175,7 @@ function buildLoadedPluginState(source) {
   for (const skillRoot of source.packagedSkillRoots) {
     state.packageSkillRoots.add(skillRoot);
   }
+  registerInlineManifests(state, source);
   const roots = source.manifestRoots;
   for (const pluginsRoot of roots) {
     let entries;
@@ -2977,7 +3204,7 @@ function buildLoadedPluginState(source) {
       }
       if (hasRootManifest) {
         const rawRootManifest = readFileSync(manifestPath, "utf8");
-        registerPluginManifest(state, rawRootManifest, pluginsRoot);
+        registerYamlPluginManifest(state, rawRootManifest, pluginsRoot);
         continue;
       }
     }
@@ -3010,7 +3237,7 @@ function buildLoadedPluginState(source) {
       } catch {
         continue;
       }
-      registerPluginManifest(state, raw, pluginDir);
+      registerYamlPluginManifest(state, raw, pluginDir);
     }
   }
   for (const name of Object.keys(pluginConfig?.manifests ?? {})) {
@@ -3040,7 +3267,7 @@ function logLoadedPlugins(state) {
         "app.plugin.config_key_count": plugin.manifest.configKeys.length,
         "app.plugin.has_mcp": Boolean(plugin.manifest.mcp),
         "file.directory": plugin.dir,
-        "app.file.skill_directory": plugin.skillsDir
+        ...plugin.skillsDir ? { "app.file.skill_directory": plugin.skillsDir } : {}
       },
       "Loaded plugin"
     );
@@ -3056,9 +3283,9 @@ function ensurePluginsLoaded() {
   logLoadedPlugins(state);
   return state;
 }
-function setPluginConfig(config) {
-  const previousConfig = clonePluginConfig(pluginConfig);
-  pluginConfig = normalizePluginConfig(config);
+function setPluginCatalogConfig(config) {
+  const previousConfig = clonePluginCatalogConfig(pluginConfig);
+  pluginConfig = normalizePluginCatalogConfig(config);
   return previousConfig;
 }
 function getPluginPackageContent() {
@@ -3152,7 +3379,9 @@ function getPluginSkillRoots() {
   const state = ensurePluginsLoaded();
   return [
     .../* @__PURE__ */ new Set([
-      ...state.pluginDefinitions.map((plugin) => plugin.skillsDir),
+      ...state.pluginDefinitions.flatMap(
+        (plugin) => plugin.skillsDir ? [plugin.skillsDir] : []
+      ),
       ...state.packageSkillRoots
     ])
   ];
@@ -3161,6 +3390,9 @@ function getPluginForSkillPath(skillPath) {
   const state = ensurePluginsLoaded();
   const resolvedSkillPath = path2.resolve(skillPath);
   return state.pluginDefinitions.find((plugin) => {
+    if (!plugin.skillsDir) {
+      return false;
+    }
     const resolvedSkillsDir = path2.resolve(plugin.skillsDir);
     return resolvedSkillPath === resolvedSkillsDir || resolvedSkillPath.startsWith(`${resolvedSkillsDir}${path2.sep}`);
   });
@@ -3210,6 +3442,7 @@ export {
   normalizeGenAiFinishReason,
   createChatSdkLogger,
   getLogContextAttributes,
+  setSentryUser,
   logInfo,
   logWarn,
   logError,
@@ -3232,7 +3465,7 @@ export {
   hasRequiredOAuthScope,
   buildOAuthTokenRequest,
   parseOAuthTokenResponse,
-  setPluginConfig,
+  setPluginCatalogConfig,
   getPluginPackageContent,
   getPluginCatalogSignature,
   getPluginCapabilityProviders,