@sentry/junior 0.72.0 → 0.73.0

package/dist/chat/agent-dispatch/runner.d.ts

@@ -1,9 +1,11 @@
 import { generateAssistantReply as generateAssistantReplyImpl } from "@/chat/respond";
+import type { SandboxEgressTracePropagationConfig } from "@/chat/sandbox/egress-tracing";
 import { scheduleDispatchCallback } from "./signing";
 import type { DispatchCallback } from "./types";
 export interface AgentDispatchRunnerDeps {
     generateAssistantReply?: typeof generateAssistantReplyImpl;
     scheduleCallback?: typeof scheduleDispatchCallback;
+    tracePropagation?: SandboxEgressTracePropagationConfig;
 }
 /** Run one serverless slice for a core-owned agent dispatch. */
 export declare function runAgentDispatchSlice(callback: DispatchCallback, deps?: AgentDispatchRunnerDeps): Promise<void>;

package/dist/chat/agent-dispatch/store.d.ts

@@ -1,12 +1,12 @@
 import type { StateAdapter } from "chat";
-import { type Destination } from "@sentry/junior-plugin-api";
+import { type SlackDestination } from "@sentry/junior-plugin-api";
 import type { BoundDispatchOptions, DispatchCreateResult, DispatchProjection, DispatchRecord, DispatchStatus } from "./types";
 /** Keep dispatch persistence keys consistent across callback and recovery paths. */
 export declare function getDispatchStorageKey(id: string): string;
 /** Parse persisted dispatch records before recovery, callbacks, or projections use them. */
 export declare function parseDispatchRecord(value: unknown): DispatchRecord | undefined;
 /** Map a dispatch destination to the lock key that serializes Slack delivery. */
-export declare function getDispatchDestinationLockId(destination: Destination): string;
+export declare function getDispatchDestinationLockId(destination: SlackDestination): string;
 /** Return the isolated persisted conversation key for one dispatch run. */
 export declare function getDispatchConversationId(dispatch: Pick<DispatchRecord, "id">): string;
 /** Give dispatch slices stable turn ids for resumability and trace correlation. */

package/dist/chat/agent-dispatch/types.d.ts

@@ -1,7 +1,10 @@
-import type { Destination, DispatchOptions } from "@sentry/junior-plugin-api";
+import type { DispatchOptions, SlackDestination } from "@sentry/junior-plugin-api";
 import type { CredentialSubject, CredentialSystemActor } from "@/chat/credentials/context";
 export type DispatchStatus = "pending" | "running" | "awaiting_resume" | "completed" | "failed" | "blocked";
-export interface BoundDispatchOptions extends Omit<DispatchOptions, "credentialSubject"> {
+export type SlackDispatchOptions = Omit<DispatchOptions, "destination"> & {
+    destination: SlackDestination;
+};
+export interface BoundDispatchOptions extends Omit<SlackDispatchOptions, "credentialSubject"> {
     credentialSubject?: CredentialSubject;
 }
 export interface DispatchRecord {
@@ -9,7 +12,7 @@ export interface DispatchRecord {
     attempt: number;
     createdAtMs: number;
     credentialSubject?: CredentialSubject;
-    destination: Destination;
+    destination: SlackDestination;
     errorMessage?: string;
     id: string;
     idempotencyKey: string;

package/dist/chat/agent-dispatch/validation.d.ts

@@ -1,6 +1,5 @@
-import { type DispatchOptions } from "@sentry/junior-plugin-api";
-import type { BoundDispatchOptions } from "./types";
+import type { BoundDispatchOptions, SlackDispatchOptions } from "./types";
 /** Validate plugin-provided dispatch options before core persists them. */
-export declare function validateDispatchOptions(options: unknown): asserts options is DispatchOptions;
+export declare function validateDispatchOptions(options: unknown): asserts options is SlackDispatchOptions;
 /** Verify runtime-owned access requirements for delegated dispatch credentials. */
 export declare function verifyDispatchCredentialSubjectAccess(options: BoundDispatchOptions): Promise<void>;

package/dist/chat/app/production.d.ts

@@ -2,11 +2,18 @@ import type { SlackAdapter } from "@chat-adapter/slack";
 import { createSlackRuntime } from "@/chat/app/factory";
 import type { SlackWebhookServices } from "@/chat/ingress/slack-webhook";
 import type { VercelConversationWorkCallbackOptions } from "@/chat/task-execution/vercel-callback";
+import type { JuniorRuntimeServiceOverrides } from "@/chat/app/services";
 /** Return the lazily initialized production Slack adapter. */
 export declare function getProductionSlackAdapter(): SlackAdapter;
 /** Return the lazily initialized production Slack runtime. */
 export declare function getProductionSlackRuntime(): ReturnType<typeof createSlackRuntime>;
+/** Create production-backed services for Slack webhook ingress. */
+export declare function createProductionSlackWebhookServices(options?: {
+    services?: JuniorRuntimeServiceOverrides;
+}): SlackWebhookServices;
 /** Return production services for Slack webhook ingress. */
 export declare function getProductionSlackWebhookServices(): SlackWebhookServices;
 /** Return the production queue callback options for conversation work. */
-export declare function getProductionConversationWorkOptions(): VercelConversationWorkCallbackOptions;
+export declare function createProductionConversationWorkOptions(options?: {
+    services?: JuniorRuntimeServiceOverrides;
+}): VercelConversationWorkCallbackOptions;

package/dist/chat/app/services.d.ts

@@ -1,3 +1,5 @@
+import { generateAssistantReply as generateAssistantReplyImpl } from "@/chat/respond";
+import type { SandboxEgressTracePropagationConfig } from "@/chat/sandbox/egress-tracing";
 import { type ConversationMemoryDeps, type ConversationMemoryService } from "@/chat/services/conversation-memory";
 import { type ContextCompactor, type ContextCompactorDeps } from "@/chat/services/context-compaction";
 import { type SubscribedReplyPolicy, type SubscribedReplyPolicyDeps } from "@/chat/services/subscribed-reply-policy";
@@ -15,6 +17,11 @@ export interface JuniorRuntimeServiceOverrides {
     contextCompactor?: Partial<ContextCompactorDeps>;
     replyExecutor?: Partial<Omit<ReplyExecutorServices, "generateThreadTitle">>;
     subscribedReplyPolicy?: Partial<SubscribedReplyPolicyDeps>;
+    sandbox?: {
+        tracePropagation?: SandboxEgressTracePropagationConfig;
+    };
     visionContext?: Partial<VisionContextDeps>;
 }
+/** Apply app-owned sandbox egress trace config unless a turn overrides it. */
+export declare function withSandboxTracePropagation(generateReply: typeof generateAssistantReplyImpl, tracePropagation?: SandboxEgressTracePropagationConfig): typeof generateAssistantReplyImpl;
 export declare function createJuniorRuntimeServices(overrides?: JuniorRuntimeServiceOverrides): JuniorRuntimeServices;

package/dist/chat/destination.d.ts

@@ -1,4 +1,4 @@
-import { type Destination } from "@sentry/junior-plugin-api";
+import { type Destination, type SlackDestination } from "@sentry/junior-plugin-api";
 /** Build Junior's canonical destination from Slack workspace and channel ids. */
 export declare function createSlackDestination(input: {
     channelId: string | undefined;
@@ -6,6 +6,8 @@ export declare function createSlackDestination(input: {
 }): Destination | undefined;
 /** Parse and validate a serialized destination that crossed a runtime boundary. */
 export declare function parseDestination(value: unknown): Destination | undefined;
+/** Require a Slack destination at a Slack-only runtime boundary. */
+export declare function requireSlackDestination(destination: Destination | undefined, action: string): SlackDestination;
 /** Compare two destinations without relying on object identity. */
 export declare function sameDestination(left: Destination, right: Destination): boolean;
 /** Return the lock/index-safe storage key for a destination. */

package/dist/chat/logging.d.ts

@@ -31,6 +31,7 @@ export interface LogContext {
     urlFull?: string;
     userAgent?: string;
 }
+export type TracePropagationHeaders = Partial<Record<"baggage" | "sentry-trace" | "traceparent", string>>;
 interface SentryUserIdentity {
     id: string | number;
     email?: string;
@@ -77,6 +78,8 @@ export declare function createRequestContext(request: Request, context?: Partial
 export declare function withContext<T>(context: LogContext, callback: () => Promise<T>): Promise<T>;
 /** Run a callback within a Sentry span and scoped log context. */
 export declare function withSpan<T>(name: string, op: string, context: LogContext, callback: () => Promise<T>, attributes?: Record<string, unknown>): Promise<T>;
+/** Return Sentry-standard trace propagation headers for the active span. */
+export declare function getTracePropagationHeaders(): TracePropagationHeaders;
 /** Set attributes on the currently active Sentry span. */
 export declare function setSpanAttributes(attributes: Record<string, unknown>): void;
 /** Set the status of the currently active Sentry span. */

package/dist/chat/oauth-flow.d.ts

@@ -27,7 +27,7 @@ type OAuthFlowInput = {
 };
 /** Parse OAuth callback state that was persisted before a provider redirect. */
 export declare function parseOAuthStatePayload(value: unknown): OAuthStatePayload | undefined;
-/** Capitalize the first letter of a provider name for display. */
+/** Return the manifest-owned display label for a provider. */
 export declare function formatProviderLabel(provider: string): string;
 /** Resolve the public base URL from environment variables (JUNIOR_BASE_URL or Vercel). */
 export declare function resolveBaseUrl(): string | undefined;

package/dist/chat/plugins/registry.d.ts

@@ -17,6 +17,8 @@ export declare function getPluginOAuthConfig(provider: string): OAuthProviderCon
 export declare function getPluginSkillRoots(): string[];
 export declare function getPluginForSkillPath(skillPath: string): PluginDefinition | undefined;
 export declare function getPluginDefinition(provider: string): PluginDefinition | undefined;
+/** Return the human-facing provider label from the plugin manifest. */
+export declare function getPluginDisplayName(provider: string): string | undefined;
 export declare function isPluginProvider(provider: string): boolean;
 export declare function isPluginCapability(capability: string): boolean;
 export declare function isPluginConfigKey(key: string): boolean;

package/dist/chat/plugins/types.d.ts

@@ -61,6 +61,7 @@ export interface PluginEnvVarDeclaration {
 }
 export interface PluginManifest {
     name: string;
+    displayName: string;
     description: string;
     capabilities: string[];
     configKeys: string[];
@@ -106,6 +107,7 @@ type PluginCredentialConfig = PluginCredentialConfigBase & {
 };
 /** Install-level changes applied to one plugin manifest before validation. */
 export interface PluginManifestConfig {
+    displayName?: string;
     description?: string;
     capabilities?: string[];
     configKeys?: string[];

package/dist/chat/prompt.d.ts

@@ -2,6 +2,7 @@ import type { SlackConversationContext } from "@/chat/slack/conversation-context
 import type { ThreadArtifactsState } from "@/chat/state/artifacts";
 import type { SkillMetadata, SkillInvocation } from "@/chat/skills";
 import type { ActiveMcpCatalogSummary } from "@/chat/tools/skill/mcp-tool-summary";
+import type { Source } from "@sentry/junior-plugin-api";
 export declare const JUNIOR_PERSONALITY: string;
 export declare const JUNIOR_WORLD: string | null;
 interface ToolPromptContext {
@@ -28,7 +29,9 @@ type TurnContextPromptInput = {
     configuration?: Record<string, unknown>;
 };
 /** Return byte-stable platform instructions shared by every conversation and turn. */
-export declare function buildSystemPrompt(): string;
+export declare function buildSystemPrompt(params: {
+    source: Source;
+}): string;
 /** Build volatile runtime context that belongs in the user turn, not the system prompt. */
 export declare function buildTurnContextPrompt(params: TurnContextPromptInput): string | null;
 export {};

package/dist/chat/requester.d.ts

@@ -1,9 +1,9 @@
 /**
- * Canonical Slack requester identity.
+ * Canonical requester identity.
  *
- * Runtime requesters are always workspace-scoped Slack actors. Stored requester
- * parsing remains explicit so legacy durable records can resume without
- * repairing malformed team or user ids.
+ * Runtime requesters are platform-scoped actors. Stored Slack requester parsing
+ * remains explicit so legacy durable records can resume without repairing
+ * malformed team or user ids.
  */
 import { z } from "zod";
 export declare const storedSlackRequesterSchema: z.ZodObject<{
@@ -14,14 +14,20 @@ export declare const storedSlackRequesterSchema: z.ZodObject<{
     slackUserName: z.ZodOptional<z.ZodString>;
     teamId: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
-export interface Requester {
+interface BaseRequester {
     email?: string;
     fullName?: string;
-    platform: "slack";
-    teamId: string;
     userId: string;
     userName?: string;
 }
+export interface SlackRequester extends BaseRequester {
+    platform: "slack";
+    teamId: string;
+}
+export interface LocalRequester extends BaseRequester {
+    platform: "local";
+}
+export type Requester = SlackRequester | LocalRequester;
 export interface SlackRequesterProfile {
     email?: string;
     fullName?: string;
@@ -31,7 +37,7 @@ export type StoredSlackRequester = z.output<typeof storedSlackRequesterSchema>;
 interface RequesterInput {
     email?: string;
     fullName?: string;
-    platform?: "slack";
+    platform?: Requester["platform"];
     teamId?: string;
     userId?: string;
     userName?: string;
@@ -40,21 +46,22 @@ interface RequesterInput {
 export declare function parseActorUserId(value: unknown): string | undefined;
 /** Assert persisted actor ids without read-side repair. */
 export declare function isActorUserId(value: string | undefined): value is string;
-/** Build Junior's canonical requester from exact Slack team/user ids and profile data. */
+/** Build Junior's canonical platform requester from exact actor ids and profile data. */
 export declare function createRequester(input: RequesterInput | undefined, context: {
+    platform?: Requester["platform"];
     teamId?: string;
     userId?: string;
 }): Requester | undefined;
 /** Build Junior's canonical requester from Slack profile data. */
-export declare function createSlackRequester(teamId: string, userId: string, profile: SlackRequesterProfile | null | undefined): Requester;
+export declare function createSlackRequester(teamId: string, userId: string, profile: SlackRequesterProfile | null | undefined): SlackRequester;
 /** Parse a serialized Slack requester that crossed a runtime boundary. */
 export declare function parseStoredSlackRequester(value: unknown): StoredSlackRequester | undefined;
 /** Convert a runtime Slack requester into its durable session shape. */
-export declare function toStoredSlackRequester(requester: Requester): StoredSlackRequester;
+export declare function toStoredSlackRequester(requester: SlackRequester): StoredSlackRequester;
 /** Rebuild a runtime requester from durable Slack requester state. */
 export declare function createRequesterFromStoredSlackRequester(args: {
     requester?: StoredSlackRequester;
     teamId: string;
     userId: string;
-}): Requester;
+}): SlackRequester;
 export {};

package/dist/chat/respond.d.ts

@@ -5,6 +5,7 @@ import type { ConversationPendingAuthState } from "@/chat/state/conversation";
 import type { ImageGenerateToolDeps, WebFetchToolDeps, WebSearchToolDeps } from "@/chat/tools/types";
 import type { PiMessage } from "@/chat/pi/messages";
 import { type SandboxAcquiredState } from "@/chat/sandbox/sandbox";
+import type { SandboxEgressTracePropagationConfig } from "@/chat/sandbox/egress-tracing";
 import type { AssistantStatusSpec } from "@/chat/slack/assistant-thread/status";
 import type { SlackConversationContext } from "@/chat/slack/conversation-context";
 import { type AssistantReply, type AgentTurnDiagnostics } from "@/chat/services/turn-result";
@@ -18,7 +19,7 @@ export interface ReplyRequestContext {
     credentialContext?: CredentialContext;
     requester?: Requester;
     slackConversation?: SlackConversationContext;
-    destination?: Destination;
+    destination: Destination;
     surface?: AgentTurnSurface;
     correlation?: {
         conversationId?: string;
@@ -49,6 +50,8 @@ export interface ReplyRequestContext {
     sandbox?: {
         sandboxId?: string;
         sandboxDependencyProfileHash?: string;
+        /** Per-turn override for app-owned sandbox egress trace propagation. */
+        tracePropagation?: SandboxEgressTracePropagationConfig;
     };
     onSandboxAcquired?: (sandbox: SandboxAcquiredState) => void | Promise<void>;
     onArtifactStateUpdated?: (artifactState: ThreadArtifactsState) => void | Promise<void>;
@@ -70,6 +73,7 @@ export interface ReplyRequestContext {
         params: Record<string, unknown>;
     }) => void;
 }
+export type AssistantReplyRequestContext = ReplyRequestContext;
 export interface ReplyRequestAttachment {
     data?: Buffer;
     mediaType: string;
@@ -83,4 +87,4 @@ export interface ReplySteeringMessage {
     userAttachments?: ReplyRequestAttachment[];
 }
 /** Run a full agent turn: discover skills, execute tools, and return the assistant reply. */
-export declare function generateAssistantReply(messageText: string, context?: ReplyRequestContext): Promise<AssistantReply>;
+export declare function generateAssistantReply(messageText: string, context: AssistantReplyRequestContext): Promise<AssistantReply>;

package/dist/chat/runtime/agent-continue-runner.d.ts

@@ -14,7 +14,7 @@ export interface AgentContinueRunnerOptions {
  */
 export declare function continueSlackAgentRun(payload: AgentContinueRequest, options?: AgentContinueRunnerOptions): Promise<boolean>;
 /** Resume the first valid paused Slack session for an idle conversation. */
-export declare function resumeAwaitingSlackContinuation(conversationId: string): Promise<boolean>;
+export declare function resumeAwaitingSlackContinuation(conversationId: string, options?: AgentContinueRunnerOptions): Promise<boolean>;
 /**
  * Retry agent continuation when the normal Slack thread lock is briefly busy.
  *

package/dist/chat/runtime/reply-executor.d.ts

@@ -56,7 +56,9 @@ export declare function createReplyToThread(deps: ReplyExecutorDeps): (thread: T
     onTurnStatePersisted?: () => Promise<void>;
     preparedState?: PreparedTurnState;
     queuedMessages?: QueuedTurnMessage[];
-    drainSteeringMessages?: (inject: (messages: QueuedTurnMessage[]) => Promise<void>) => Promise<QueuedTurnMessage[]>;
+    drainSteeringMessages?: (inject: (messages: QueuedTurnMessage[]) => Promise<void>, context?: {
+        conversationContext?: string;
+    }) => Promise<QueuedTurnMessage[]>;
     shouldYield?: () => boolean;
 }) => Promise<void>;
 export {};

package/dist/chat/runtime/slack-resume.d.ts

@@ -1,4 +1,4 @@
-import { generateAssistantReply, type AssistantReply, type ReplyRequestContext } from "@/chat/respond";
+import { generateAssistantReply, type AssistantReply, type AssistantReplyRequestContext } from "@/chat/respond";
 /** Error raised when another worker already owns the resume lock. */
 export declare class ResumeTurnBusyError extends Error {
     constructor(lockKey: string);
@@ -8,7 +8,7 @@ interface ResumeSlackTurnArgs {
     channelId: string;
     threadTs: string;
     messageTs?: string;
-    replyContext?: ReplyRequestContext;
+    replyContext?: AssistantReplyRequestContext;
     lockKey?: string;
     initialText?: string;
     generateReply?: typeof generateAssistantReply;
@@ -35,7 +35,7 @@ export declare function resumeAuthorizedRequest(args: {
     threadTs: string;
     messageTs?: string;
     connectedText: string;
-    replyContext?: ReplyRequestContext;
+    replyContext?: AssistantReplyRequestContext;
     lockKey?: string;
     generateReply?: typeof generateAssistantReply;
     onSuccess?: (reply: AssistantReply) => Promise<void>;

package/dist/chat/runtime/slack-runtime.d.ts

@@ -28,6 +28,9 @@ export interface ReplyHooks {
     onTurnStatePersisted?: () => Promise<void>;
     shouldYield?: () => boolean;
 }
+interface SteeringDrainContext {
+    conversationContext?: string;
+}
 export interface SlackTurnOptions extends ReplyHooks {
     destination: Destination;
 }
@@ -53,7 +56,13 @@ export interface SlackTurnRuntimeDependencies<TPreparedState> {
     logWarn: (eventName: string, context?: Record<string, unknown>, attributes?: Record<string, unknown>, body?: string) => void;
     modelId: string;
     now: () => number;
-    recordSkippedSubscribedMessage: (args: {
+    recordSkippedSteeringMessage: (args: {
+        decision: SubscribedReplyDecision;
+        message: Message;
+        text: TurnMessageText;
+        thread: Thread;
+    }) => Promise<void>;
+    recordSkippedSubscribedTurn: (args: {
         completedAtMs: number;
         decision: SubscribedReplyDecision;
         message: Message;
@@ -64,7 +73,7 @@ export interface SlackTurnRuntimeDependencies<TPreparedState> {
         completedAtMs: number;
         decision: SubscribedReplyDecision;
         message: Message;
-        preparedState?: TPreparedState;
+        preparedState: TPreparedState;
         thread: Thread;
     }) => Promise<void>;
     persistPreparedState: (args: {
@@ -82,7 +91,7 @@ export interface SlackTurnRuntimeDependencies<TPreparedState> {
         onTurnStatePersisted?: () => Promise<void>;
         preparedState?: TPreparedState;
         queuedMessages?: QueuedTurnMessage[];
-        drainSteeringMessages?: (inject: (messages: QueuedTurnMessage[]) => Promise<void>) => Promise<QueuedTurnMessage[]>;
+        drainSteeringMessages?: (inject: (messages: QueuedTurnMessage[]) => Promise<void>, context?: SteeringDrainContext) => Promise<QueuedTurnMessage[]>;
         shouldYield?: () => boolean;
     }) => Promise<void>;
     decideSubscribedReply: SubscribedReplyPolicy;
@@ -100,3 +109,4 @@ export interface SlackTurnRuntime<_TPreparedState, TAssistantEvent extends Assis
 }
 /** Build the Slack event runtime that routes mentions and subscribed messages. */
 export declare function createSlackTurnRuntime<TPreparedState, TAssistantEvent extends AssistantLifecycleEvent = AssistantLifecycleEvent>(deps: SlackTurnRuntimeDependencies<TPreparedState>): SlackTurnRuntime<TPreparedState, TAssistantEvent>;
+export {};

package/dist/chat/runtime/turn.d.ts

@@ -4,11 +4,14 @@ import type { TurnThinkingSelection } from "@/chat/services/turn-thinking-level"
 import type { AgentTurnUsage } from "@/chat/usage";
 export { buildDeterministicTurnId } from "@/chat/state/turn-id";
 export type RetryableTurnReason = "mcp_auth_resume" | "plugin_auth_resume" | "agent_continue";
+/** Auth-pause reasons require a known provider before a resume can be parked. */
+export type AuthResumeRetryableTurnReason = Extract<RetryableTurnReason, "mcp_auth_resume" | "plugin_auth_resume">;
 export interface RetryableTurnMetadata {
     authDisposition?: AuthorizationPauseDisposition;
     authDurationMs?: number;
     authKind?: AuthorizationPauseKind;
     authProvider?: string;
+    authProviderDisplayName?: string;
     authThinkingLevel?: TurnThinkingSelection["thinkingLevel"];
     authUsage?: AgentTurnUsage;
     version?: number;
@@ -16,14 +19,25 @@ export interface RetryableTurnMetadata {
     sessionId?: string;
     sliceId?: number;
 }
+export interface AuthResumeRetryableTurnMetadata extends RetryableTurnMetadata {
+    authProvider: string;
+    authProviderDisplayName: string;
+}
+export type AuthResumeRetryableTurnError = RetryableTurnError & {
+    readonly reason: AuthResumeRetryableTurnReason;
+    readonly metadata: AuthResumeRetryableTurnMetadata;
+};
 /** Error indicating an agent run can continue later after timeout or auth pause. */
 export declare class RetryableTurnError extends Error {
     readonly code = "retryable_turn";
     readonly metadata?: RetryableTurnMetadata;
     readonly reason: RetryableTurnReason;
-    constructor(reason: RetryableTurnReason, message: string, metadata?: RetryableTurnMetadata);
+    constructor(reason: AuthResumeRetryableTurnReason, message: string, metadata: AuthResumeRetryableTurnMetadata);
+    constructor(reason: "agent_continue", message: string, metadata?: RetryableTurnMetadata);
 }
 export declare function isRetryableTurnError(error: unknown, reason?: RetryableTurnReason): error is RetryableTurnError;
+/** Return whether a retryable turn is waiting for provider authorization. */
+export declare function isAuthResumeRetryableTurnError(error: unknown): error is AuthResumeRetryableTurnError;
 /** Error indicating the turn paused voluntarily at a safe continuation boundary. */
 export declare class CooperativeTurnYieldError extends Error {
     readonly code = "cooperative_turn_yield";

package/dist/chat/sandbox/egress-credentials.d.ts

@@ -7,14 +7,17 @@ export type SandboxEgressGrantSelection = {
     grant: AgentPluginGrant;
     source: "broker";
 };
-/** Signals that a plugin selected a grant but needs user authorization before issuing headers. */
-export declare class SandboxEgressCredentialNeededError extends Error {
+export type SandboxEgressCredentialErrorKind = "auth_required" | "unavailable";
+/** Signals that egress selected a grant but could not issue credential headers. */
+export declare class SandboxEgressCredentialError extends Error {
     readonly authorization?: AgentPluginAuthorization;
     readonly grant: AgentPluginGrant;
+    readonly kind: SandboxEgressCredentialErrorKind;
     readonly provider: string;
     constructor(input: {
         authorization?: AgentPluginAuthorization;
         grant: AgentPluginGrant;
+        kind: SandboxEgressCredentialErrorKind;
         message: string;
         provider: string;
     });

package/dist/chat/sandbox/egress-policy.d.ts

@@ -1,11 +1,15 @@
 import type { NetworkPolicy } from "@vercel/sandbox";
+import type { TracePropagationHeaders } from "@/chat/logging";
+import { type SandboxEgressTracePropagationConfig } from "@/chat/sandbox/egress-tracing";
 /** Return whether an outbound host is covered by a sandbox egress domain rule. */
 export declare function matchesSandboxEgressDomain(host: string, domain: string): boolean;
 /** Resolve the plugin provider responsible for an outbound sandbox host. */
 export declare function resolveSandboxEgressProviderForHost(host: string): string | undefined;
-/** Build the policy that forwards provider requests back to Junior for credentials. */
+/** Build the policy that forwards credentials and configured trace headers. */
 export declare function buildSandboxEgressNetworkPolicy(input?: {
     credentialToken?: string;
+    traceConfig?: SandboxEgressTracePropagationConfig;
+    traceHeaders?: TracePropagationHeaders;
 }): NetworkPolicy;
 /** Resolve non-secret command environment values for registered sandbox providers. */
 export declare function resolveSandboxCommandEnvironment(): Promise<Record<string, string>>;

package/dist/chat/sandbox/egress-proxy.d.ts

@@ -1,3 +1,4 @@
+import { type SandboxEgressTracePropagationConfig } from "@/chat/sandbox/egress-tracing";
 import type { JWTPayload } from "jose";
 /** Intercepts a credential-injected sandbox HTTP request before live forwarding. */
 export type SandboxEgressHttpInterceptor = (input: {
@@ -8,6 +9,7 @@ export type SandboxEgressHttpInterceptor = (input: {
 interface ProxyDeps {
     fetch?: typeof fetch;
     interceptHttp?: SandboxEgressHttpInterceptor;
+    tracePropagation?: SandboxEgressTracePropagationConfig;
     verifyOidc?: (token: string) => Promise<JWTPayload>;
 }
 /** Return whether a request appears to be from the Vercel Sandbox egress proxy. */

package/dist/chat/sandbox/egress-schemas.d.ts

@@ -68,6 +68,10 @@ export declare const sandboxEgressAuthRequiredSignalSchema: z.ZodObject<{
         reason: z.ZodOptional<z.ZodString>;
         requirements: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>;
+    kind: z.ZodDefault<z.ZodEnum<{
+        unavailable: "unavailable";
+        auth_required: "auth_required";
+    }>>;
     provider: z.ZodString;
     message: z.ZodOptional<z.ZodString>;
     createdAtMs: z.ZodNumber;

package/dist/chat/sandbox/egress-session.d.ts

@@ -17,7 +17,9 @@ export declare function getSandboxEgressCredentialLease(provider: string, grantN
 /** Clear a cached egress credential lease after the provider rejects its headers. */
 export declare function clearSandboxEgressCredentialLease(provider: string, grantName: string, context: SandboxEgressCredentialContext): Promise<void>;
 /** Record that host-side sandbox egress returned an auth-required response. */
-export declare function setSandboxEgressAuthRequiredSignal(context: SandboxEgressCredentialContext, signal: Omit<SandboxEgressAuthRequiredSignal, "createdAtMs">): Promise<void>;
+export declare function setSandboxEgressAuthRequiredSignal(context: SandboxEgressCredentialContext, signal: Omit<SandboxEgressAuthRequiredSignal, "createdAtMs" | "kind"> & {
+    kind?: SandboxEgressAuthRequiredSignal["kind"];
+}): Promise<void>;
 /** Record that host-side sandbox egress saw an upstream permission denial. */
 export declare function setSandboxEgressPermissionDeniedSignal(context: SandboxEgressCredentialContext, signal: Omit<SandboxEgressPermissionDeniedSignal, "createdAtMs">): Promise<void>;
 /** Remove any pending host-side sandbox egress signals for a command. */

package/dist/chat/sandbox/egress-tracing.d.ts

@@ -0,0 +1,7 @@
+export interface SandboxEgressTracePropagationConfig {
+    domains?: string[];
+}
+/** Normalize exact and leading-wildcard sandbox egress trace domains. */
+export declare function normalizeSandboxEgressTracePropagationDomains(domains: string[] | undefined): string[];
+/** Return whether a host may carry sandbox egress trace propagation headers. */
+export declare function shouldPropagateSandboxEgressTrace(host: string, config?: SandboxEgressTracePropagationConfig): boolean;

package/dist/chat/sandbox/sandbox.d.ts

@@ -1,5 +1,6 @@
 import { type LogContext } from "@/chat/logging";
 import { type SandboxEgressAuthRequiredSignal, type SandboxEgressPermissionDeniedSignal } from "@/chat/sandbox/egress-session";
+import type { SandboxEgressTracePropagationConfig } from "@/chat/sandbox/egress-tracing";
 import type { CredentialContext } from "@/chat/credentials/context";
 import type { AgentPluginHookRunner } from "@/chat/plugins/agent-hooks";
 import type { SandboxInstance } from "@/chat/sandbox/workspace";
@@ -46,6 +47,7 @@ export declare function createSandboxExecutor(options?: {
     sandboxDependencyProfileHash?: string;
     timeoutMs?: number;
     traceContext?: LogContext;
+    tracePropagation?: SandboxEgressTracePropagationConfig;
     credentialEgress?: CredentialContext;
     agentHooks?: AgentPluginHookRunner;
     onSandboxAcquired?: (sandbox: SandboxAcquiredState) => void | Promise<void>;

package/dist/chat/sandbox/session.d.ts

@@ -1,5 +1,5 @@
 import { type NetworkPolicy } from "@vercel/sandbox";
-import { type LogContext } from "@/chat/logging";
+import { type LogContext, type TracePropagationHeaders } from "@/chat/logging";
 import { type SandboxFileSystem, type SandboxInstance } from "@/chat/sandbox/workspace";
 import type { SkillMetadata } from "@/chat/skills";
 interface SandboxToolExecutors {
@@ -38,6 +38,7 @@ interface SandboxSessionManager {
     getDependencyProfileHash(): string | undefined;
     createSandbox(): Promise<SandboxInstance>;
     ensureToolExecutors(): Promise<SandboxToolExecutors>;
+    refreshNetworkPolicy(traceHeaders?: TracePropagationHeaders): Promise<void>;
     dispose(): Promise<void>;
 }
 /** Manage sandbox lifecycle, sync, keepalive, and tool executor caching for one executor instance. */
@@ -47,7 +48,7 @@ export declare function createSandboxSessionManager(options?: {
     timeoutMs?: number;
     traceContext?: LogContext;
     commandEnv?: () => Promise<Record<string, string>>;
-    createNetworkPolicy?: (egressId: string) => NetworkPolicy | undefined;
+    createNetworkPolicy?: (egressId: string, traceHeaders?: TracePropagationHeaders) => NetworkPolicy | undefined;
     onSandboxPrepare?: (sandbox: SandboxInstance) => void | Promise<void>;
     onSandboxAcquired?: (sandbox: {
         sandboxId: string;

package/dist/chat/services/auth-pause-response.d.ts

@@ -1,2 +1,2 @@
 /** Build the visible Slack thread note for an auth-paused turn. */
-export declare function buildAuthPauseResponse(): string;
+export declare function buildAuthPauseResponse(slackUserId: string | undefined, providerDisplayName: string): string;

package/dist/chat/services/auth-pause.d.ts

@@ -9,7 +9,8 @@ export declare class AuthorizationPauseError extends Error {
     readonly disposition: AuthorizationPauseDisposition;
     readonly kind: AuthorizationPauseKind;
     readonly provider: string;
-    constructor(kind: AuthorizationPauseKind, provider: string, disposition: AuthorizationPauseDisposition);
+    readonly providerDisplayName: string;
+    constructor(kind: AuthorizationPauseKind, provider: string, providerDisplayName: string, disposition: AuthorizationPauseDisposition);
 }
 /** Error indicating this turn cannot start an external authorization flow. */
 export declare class AuthorizationFlowDisabledError extends Error {

package/dist/chat/services/mcp-auth-orchestration.d.ts

@@ -5,7 +5,7 @@ import type { ThreadArtifactsState } from "@/chat/state/artifacts";
 import type { ConversationPendingAuthState } from "@/chat/state/conversation";
 import type { PluginDefinition } from "@/chat/plugins/types";
 export declare class McpAuthorizationPauseError extends AuthorizationPauseError {
-    constructor(provider: string, disposition: "link_already_sent" | "link_sent");
+    constructor(provider: string, providerDisplayName: string, disposition: "link_already_sent" | "link_sent");
 }
 export interface McpAuthOrchestrationDeps {
     conversationId?: string;

package/dist/chat/services/message-actor-identity.d.ts

@@ -1,5 +1,5 @@
 import type { Message } from "chat";
-import { type Requester, type SlackRequesterProfile } from "@/chat/requester";
+import { type Requester, type SlackRequester, type SlackRequesterProfile } from "@/chat/requester";
 interface MessageAuthorIdentity {
     email?: string;
     fullName?: string;
@@ -12,5 +12,5 @@ export declare function bindMessageActorIdentity(message: Message, requester: Re
 /** Read message identity without promoting adapter display fallbacks. */
 export declare function getMessageActorIdentity(message: Message): MessageActorIdentity | undefined;
 /** Attach Slack display fields only after the author id is exact. */
-export declare function ensureSlackMessageActorIdentity(message: Message, teamId: string, lookupSlackUser: (teamId: string, userId: string) => Promise<SlackRequesterProfile | null | undefined>): Promise<Requester>;
+export declare function ensureSlackMessageActorIdentity(message: Message, teamId: string, lookupSlackUser: (teamId: string, userId: string) => Promise<SlackRequesterProfile | null | undefined>): Promise<SlackRequester>;
 export {};