@sentry/junior 0.64.0 → 0.65.0

package/dist/app.js

@@ -22,13 +22,13 @@ import {
   splitSlackReplyText,
   truncateStatusText,
   upsertAgentTurnSessionRecord
-} from "./chunk-4CRYMG7M.js";
+} from "./chunk-7KZXQNA6.js";
 import {
   discoverSkills,
   findSkillByName,
   loadSkillsByName,
   parseSkillInvocation
-} from "./chunk-D23WCM66.js";
+} from "./chunk-PYU2YB35.js";
 import {
   buildNonInteractiveShellScript,
   createSandboxInstance,
@@ -37,7 +37,7 @@ import {
   isSnapshotMissingError,
   resolveRuntimeDependencySnapshot,
   runNonInteractiveCommand
-} from "./chunk-WZFQQ6SP.js";
+} from "./chunk-K3JNVV4Q.js";
 import {
   ACTIVE_LOCK_TTL_MS,
   GEN_AI_PROVIDER_NAME,
@@ -70,7 +70,7 @@ import {
   toGenAiPayloadMetadata,
   toGenAiPayloadTraceAttributes,
   toGenAiTextMetadata
-} from "./chunk-IGVHCX2U.js";
+} from "./chunk-OMQ5X5QH.js";
 import {
   CredentialUnavailableError,
   buildOAuthTokenRequest,
@@ -110,7 +110,7 @@ import {
   toOptionalString,
   withContext,
   withSpan
-} from "./chunk-WDPWFMCE.js";
+} from "./chunk-EDHJIYHS.js";
 import {
   sentry_exports
 } from "./chunk-Z3YD6NHK.js";

package/dist/chat/plugins/command-env.d.ts

@@ -1,3 +1,3 @@
 import type { PluginManifest } from "@/chat/plugins/types";
-/** Resolve non-secret sandbox command env declared by a plugin manifest. */
+/** Resolve sandbox command env declared by a plugin manifest. */
 export declare function resolvePluginCommandEnv(manifest: PluginManifest): Record<string, string>;

package/dist/chat/plugins/types.d.ts

@@ -59,6 +59,7 @@ export interface PluginMcpHttpConfig {
 export type PluginMcpConfig = PluginMcpHttpConfig;
 export interface PluginEnvVarDeclaration {
     default?: string;
+    exposeToCommandEnv?: boolean;
 }
 export interface PluginManifest {
     name: string;

package/dist/{chunk-4CRYMG7M.js → chunk-7KZXQNA6.js}

@@ -6,12 +6,12 @@ import {
   getConnectedStateContext,
   getStateAdapter,
   sandboxSkillDir
-} from "./chunk-IGVHCX2U.js";
+} from "./chunk-OMQ5X5QH.js";
 import {
   isRecord,
   logInfo,
   logWarn
-} from "./chunk-WDPWFMCE.js";
+} from "./chunk-EDHJIYHS.js";
 import {
   sentry_exports
 } from "./chunk-Z3YD6NHK.js";

package/dist/{chunk-WDPWFMCE.js → chunk-EDHJIYHS.js}

@@ -1913,6 +1913,21 @@ function assertCommandEnvDoesNotExposeHostSecretRefs(commandEnv, apiHeaders, cre
     }
   }
 }
+function assertCommandEnvHostRefsAreExplicitlyExposed(commandEnv, envVars, pluginName) {
+  if (!commandEnv) {
+    return;
+  }
+  for (const [key, value] of Object.entries(commandEnv)) {
+    for (const name of envReferences(value)) {
+      const declaration = envVars[name];
+      if (declaration && declaration.default === void 0 && declaration.exposeToCommandEnv !== true) {
+        throw new Error(
+          `Plugin ${pluginName} command-env.${key} references env var ${name}, but env-vars.${name} must set expose-to-command-env: true before host env can be exposed to sandbox`
+        );
+      }
+    }
+  }
+}
 function normalizeCredentials(data, name) {
   const schema = data.type === "oauth-bearer" ? oauthBearerCredentialsSchema : data.type === "github-app" ? githubAppCredentialsSchema : void 0;
   if (!schema) {
@@ -2087,7 +2102,9 @@ function normalizeRuntimePostinstall(commands, name) {
 var envVarDeclarationSchema = z.preprocess(
   (value) => value === null || value === void 0 ? {} : value,
   z.object({
-    default: z.string().optional()
+    default: z.string().optional(),
+    "expose-to-command-env": z.boolean().optional(),
+    exposeToCommandEnv: z.boolean().optional()
   }).strict()
 );
 function normalizeEnvVars(data, pluginName) {
@@ -2109,6 +2126,9 @@ function normalizeEnvVars(data, pluginName) {
     if (parsed.data.default !== void 0) {
       decl.default = parsed.data.default;
     }
+    if (parsed.data["expose-to-command-env"] === true || parsed.data.exposeToCommandEnv === true) {
+      decl.exposeToCommandEnv = true;
+    }
     normalized[name] = decl;
   }
   return normalized;
@@ -2267,11 +2287,6 @@ function parseManifestSource(parsedSource, dir, config) {
     envVars
   ) : void 0;
   const credentials = data.credentials ? normalizeCredentials(data.credentials, data.name) : void 0;
-  if (commandEnv && !credentials && !apiHeaders) {
-    throw new Error(
-      `Plugin ${data.name} command-env requires credentials or api-headers`
-    );
-  }
   const runtimeDependencies = data["runtime-dependencies"] ? normalizeRuntimeDependencies(data["runtime-dependencies"], data.name) : void 0;
   const runtimePostinstall = data["runtime-postinstall"] ? normalizeRuntimePostinstall(data["runtime-postinstall"], data.name) : void 0;
   const mcp = data.mcp ? normalizeMcp(data.mcp, envVars, data.name) : void 0;
@@ -2334,6 +2349,11 @@ function parseManifestSource(parsedSource, dir, config) {
     manifest.oauth,
     data.name
   );
+  assertCommandEnvHostRefsAreExplicitlyExposed(
+    data["command-env"],
+    envVars,
+    data.name
+  );
   if (data.target) {
     const result = targetSourceSchema.safeParse(data.target);
     if (!result.success) {

package/dist/{chunk-WZFQQ6SP.js → chunk-K3JNVV4Q.js}

@@ -2,12 +2,12 @@ import {
   SANDBOX_WORKSPACE_ROOT,
   getStateAdapter,
   toOptionalTrimmed
-} from "./chunk-IGVHCX2U.js";
+} from "./chunk-OMQ5X5QH.js";
 import {
   getPluginRuntimeDependencies,
   getPluginRuntimePostinstall,
   withSpan
-} from "./chunk-WDPWFMCE.js";
+} from "./chunk-EDHJIYHS.js";
 
 // src/chat/sandbox/runtime-dependency-snapshots.ts
 import { createHash } from "crypto";

package/dist/{chunk-IGVHCX2U.js → chunk-OMQ5X5QH.js}

@@ -6,7 +6,7 @@ import {
   setSpanAttributes,
   toOptionalString,
   withSpan
-} from "./chunk-WDPWFMCE.js";
+} from "./chunk-EDHJIYHS.js";
 
 // src/chat/slack/context.ts
 function toTrimmedSlackString(value) {

package/dist/{chunk-D23WCM66.js → chunk-PYU2YB35.js}

@@ -2,7 +2,7 @@ import {
   getPluginForSkillPath,
   getPluginSkillRoots,
   logWarn
-} from "./chunk-WDPWFMCE.js";
+} from "./chunk-EDHJIYHS.js";
 import {
   skillRoots
 } from "./chunk-KVZL5NZS.js";

package/dist/cli/check.js

@@ -1,9 +1,9 @@
 import {
   parseSkillFile
-} from "../chunk-D23WCM66.js";
+} from "../chunk-PYU2YB35.js";
 import {
   parsePluginManifest
-} from "../chunk-WDPWFMCE.js";
+} from "../chunk-EDHJIYHS.js";
 import "../chunk-Z3YD6NHK.js";
 import "../chunk-KVZL5NZS.js";
 import "../chunk-2KG3PWR4.js";

package/dist/cli/snapshot-warmup.js

@@ -1,14 +1,14 @@
 import {
   resolveRuntimeDependencySnapshot
-} from "../chunk-WZFQQ6SP.js";
+} from "../chunk-K3JNVV4Q.js";
 import {
   disconnectStateAdapter
-} from "../chunk-IGVHCX2U.js";
+} from "../chunk-OMQ5X5QH.js";
 import {
   getPluginProviders,
   getPluginRuntimeDependencies,
   getPluginRuntimePostinstall
-} from "../chunk-WDPWFMCE.js";
+} from "../chunk-EDHJIYHS.js";
 import "../chunk-Z3YD6NHK.js";
 import "../chunk-KVZL5NZS.js";
 import "../chunk-2KG3PWR4.js";

package/dist/reporting.js

@@ -6,20 +6,20 @@ import {
   getAgentTurnSessionRecord,
   listAgentTurnSessionSummaries,
   listAgentTurnSessionSummariesForConversation
-} from "./chunk-4CRYMG7M.js";
+} from "./chunk-7KZXQNA6.js";
 import {
   discoverSkills
-} from "./chunk-D23WCM66.js";
+} from "./chunk-PYU2YB35.js";
 import {
   canExposeConversationPayload,
   parseSlackThreadId,
   resolveConversationPrivacy
-} from "./chunk-IGVHCX2U.js";
+} from "./chunk-OMQ5X5QH.js";
 import {
   getPluginPackageContent,
   getPluginProviders,
   isRecord
-} from "./chunk-WDPWFMCE.js";
+} from "./chunk-EDHJIYHS.js";
 import "./chunk-Z3YD6NHK.js";
 import {
   homeDir

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior",
-  "version": "0.64.0",
+  "version": "0.65.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -64,7 +64,7 @@
     "node-html-markdown": "^2.0.0",
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
-    "@sentry/junior-plugin-api": "0.64.0"
+    "@sentry/junior-plugin-api": "0.65.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",
@@ -76,7 +76,7 @@
     "typescript": "^6.0.3",
     "vercel": "^54.4.0",
     "vitest": "^4.1.7",
-    "@sentry/junior-scheduler": "0.64.0"
+    "@sentry/junior-scheduler": "0.65.0"
   },
   "scripts": {
     "build": "tsup && tsc -p tsconfig.build.json --emitDeclarationOnly",