@sentry/junior 0.75.0 → 0.76.0

package/dist/{chunk-TQ74BATR.js → chunk-HHDUKWVG.js}

@@ -1,6 +1,25 @@
+import {
+  JUNIOR_THREAD_STATE_TTL_MS,
+  buildConversationStatePatch
+} from "./chunk-Z4CIQ3EB.js";
+import {
+  buildNonInteractiveShellScript,
+  createSandboxInstance,
+  getRuntimeDependencyProfileHash,
+  getVercelSandboxCredentials,
+  isSnapshotMissingError,
+  resolveRuntimeDependencySnapshot,
+  runNonInteractiveCommand
+} from "./chunk-JBASI5VV.js";
+import {
+  pluginTaskId,
+  pluginTaskParamsSchema,
+  sendVercelPluginTask
+} from "./chunk-KNFROR7R.js";
 import {
   JUNIOR_PERSONALITY,
   abandonAgentTurnSessionRecord,
+  buildPluginSystemPromptContributions,
   buildSystemPrompt,
   buildTurnContextPrompt,
   escapeXml,
@@ -9,28 +28,35 @@ import {
   recordAuthorizationRequested,
   recordMcpProviderConnected,
   upsertAgentTurnSessionRecord
-} from "./chunk-VNTLUFTY.js";
+} from "./chunk-KOIMO7S3.js";
 import {
+  createPluginEmbedder,
   createPluginHookRunner,
+  createPluginModel,
+  getPluginSystemPromptContributions,
   getPluginTools,
+  getPluginUserPromptContributions,
+  getPlugins,
   getSlackToolContext,
   resolveChannelCapabilities
-} from "./chunk-NPVUAXUE.js";
+} from "./chunk-NFTMTIP3.js";
 import {
-  discoverSkills,
-  findSkillByName,
-  loadSkillsByName,
-  parseSkillInvocation
-} from "./chunk-OJODNL2P.js";
+  createPluginLogger,
+  createPluginState
+} from "./chunk-56TBVRJG.js";
 import {
-  buildConversationStatePatch
-} from "./chunk-74HO27II.js";
+  getDb
+} from "./chunk-NYKJ3KON.js";
 import {
-  JUNIOR_THREAD_STATE_TTL_MS
-} from "./chunk-UJ7OTHPO.js";
+  SANDBOX_DATA_ROOT,
+  SANDBOX_SKILLS_ROOT,
+  SANDBOX_WORKSPACE_ROOT,
+  sandboxSkillDir,
+  sandboxSkillFile
+} from "./chunk-G3E7SCME.js";
 import {
-  parseDestination
-} from "./chunk-WBZ4M5N5.js";
+  getStateAdapter
+} from "./chunk-Y5OFBCBZ.js";
 import {
   SlackActionError,
   downloadPrivateSlackFile,
@@ -39,27 +65,9 @@ import {
   isConversationScopedChannel,
   isDmChannel,
   normalizeSlackConversationId,
+  parseDestination,
   withSlackRetries
-} from "./chunk-62FUNJYS.js";
-import {
-  buildNonInteractiveShellScript,
-  createSandboxInstance,
-  getRuntimeDependencyProfileHash,
-  getVercelSandboxCredentials,
-  isSnapshotMissingError,
-  resolveRuntimeDependencySnapshot,
-  runNonInteractiveCommand
-} from "./chunk-XJHDZUGD.js";
-import {
-  SANDBOX_DATA_ROOT,
-  SANDBOX_SKILLS_ROOT,
-  SANDBOX_WORKSPACE_ROOT,
-  sandboxSkillDir,
-  sandboxSkillFile
-} from "./chunk-G3E7SCME.js";
-import {
-  getStateAdapter
-} from "./chunk-ZNNTSPNF.js";
+} from "./chunk-Q6XFTRV5.js";
 import {
   GEN_AI_PROVIDER_NAME,
   GEN_AI_SERVER_ADDRESS,
@@ -72,7 +80,7 @@ import {
   encodeNonImageAttachmentForPrompt,
   extractAssistantText,
   getGatewayApiKey,
-  getPiGatewayApiKeyOverride,
+  getPiGatewayApiKey,
   getPiMessageRole,
   getSessionIdentifiers,
   getTerminalAssistantMessages,
@@ -87,9 +95,9 @@ import {
   normalizeSlackEmojiName,
   normalizeToolNameFromResult,
   parseSlackThreadId,
-  prependMissingRuntimeTurnContext,
   resolveConversationPrivacy,
   resolveGatewayModel,
+  stripRuntimeTurnContext,
   summarizeMessageText,
   toGenAiMessageMetadata,
   toGenAiMessagesTraceAttributes,
@@ -99,7 +107,13 @@ import {
   toObservablePromptPart,
   trimTrailingAssistantMessages,
   upsertActiveSkill
-} from "./chunk-FCZO7LAR.js";
+} from "./chunk-T77LUIX3.js";
+import {
+  discoverSkills,
+  findSkillByName,
+  loadSkillsByName,
+  parseSkillInvocation
+} from "./chunk-4SCWV7TJ.js";
 import {
   createPluginBroker,
   credentialContextSchema,
@@ -113,15 +127,14 @@ import {
   isPluginConfigKey,
   resolveAuthTokenPlaceholder,
   resolvePluginCommandEnv
-} from "./chunk-2RWFUS5F.js";
+} from "./chunk-ZLMBNBUG.js";
+import {
+  createRequester,
+  parseActorUserId
+} from "./chunk-VALUBQ7R.js";
 import {
   listReferenceFiles
 } from "./chunk-Q3XNY442.js";
-import {
-  createRequester,
-  parseActorUserId,
-  toStoredSlackRequester
-} from "./chunk-EIYL7I4S.js";
 import {
   extractGenAiUsageAttributes,
   extractGenAiUsageSummary,
@@ -140,10 +153,11 @@ import {
   setTags,
   toOptionalString,
   withSpan
-} from "./chunk-OK4KKR7B.js";
+} from "./chunk-EJN6G5A2.js";
 import {
-  sentry_exports
-} from "./chunk-SJHUF3DP.js";
+  startInactiveSpan,
+  withActiveSpan
+} from "./chunk-ST6YNAXG.js";
 
 // src/chat/configuration/defaults.ts
 var installDefaults = {};
@@ -728,31 +742,65 @@ var ProviderCredentialRouter = class {
   }
 };
 
+// src/chat/credentials/user-token-store.ts
+import {
+  pluginStoredTokensSchema
+} from "@sentry/junior-plugin-api";
+var storedTokensSchema = pluginStoredTokensSchema;
+
 // src/chat/credentials/state-adapter-token-store.ts
 var KEY_PREFIX = "oauth-token";
 var BUFFER_MS = 24 * 60 * 60 * 1e3;
 var LONG_LIVED_TTL_MS = 365 * 24 * 60 * 60 * 1e3;
+var REFRESH_LOCK_TTL_MS = 3e4;
+var REFRESH_LOCK_WAIT_MS = 3e4;
+var REFRESH_LOCK_RETRY_MS = 100;
 function tokenKey(userId, provider) {
   return `${KEY_PREFIX}:${userId}:${provider}`;
 }
+function refreshLockKey(userId, provider) {
+  return `${tokenKey(userId, provider)}:refresh`;
+}
+async function sleep(ms) {
+  await new Promise((resolve) => setTimeout(resolve, ms));
+}
 var StateAdapterTokenStore = class {
   state;
   constructor(stateAdapter) {
     this.state = stateAdapter;
   }
   async get(userId, provider) {
-    const stored = await this.state.get(
-      tokenKey(userId, provider)
-    );
-    return stored ?? void 0;
+    const stored = await this.state.get(tokenKey(userId, provider));
+    return stored === null || stored === void 0 ? void 0 : storedTokensSchema.parse(stored);
   }
   async set(userId, provider, tokens) {
-    const ttlMs = tokens.expiresAt ? Math.max(tokens.expiresAt - Date.now() + BUFFER_MS, BUFFER_MS) : LONG_LIVED_TTL_MS;
-    await this.state.set(tokenKey(userId, provider), tokens, ttlMs);
+    const parsed = storedTokensSchema.parse(tokens);
+    const expiresAt = parsed.refreshTokenExpiresAt ?? parsed.expiresAt;
+    const ttlMs = expiresAt ? Math.max(expiresAt - Date.now() + BUFFER_MS, BUFFER_MS) : LONG_LIVED_TTL_MS;
+    await this.state.set(tokenKey(userId, provider), parsed, ttlMs);
   }
   async delete(userId, provider) {
     await this.state.delete(tokenKey(userId, provider));
   }
+  /** Wait for the per-slot refresh gate so rotated refresh tokens are used once. */
+  async withRefresh(userId, provider, callback) {
+    const lockKey = refreshLockKey(userId, provider);
+    const deadline = Date.now() + REFRESH_LOCK_WAIT_MS;
+    while (true) {
+      const lock = await this.state.acquireLock(lockKey, REFRESH_LOCK_TTL_MS);
+      if (lock) {
+        try {
+          return await callback();
+        } finally {
+          await this.state.releaseLock(lock);
+        }
+      }
+      if (Date.now() >= deadline) {
+        throw new Error(`Could not acquire OAuth token refresh lock`);
+      }
+      await sleep(REFRESH_LOCK_RETRY_MS);
+    }
+  }
 };
 
 // src/chat/capabilities/factory.ts
@@ -5908,8 +5956,9 @@ function createAdvisorTool(context) {
               "Advisor guidance is unavailable because advisor history could not be loaded. Continue without assuming advisor history."
             );
           }
+          const apiKeyOverride = getPiGatewayApiKey();
           const advisorAgent = new Agent({
-            getApiKey: () => getPiGatewayApiKeyOverride(),
+            ...apiKeyOverride ? { getApiKey: () => apiKeyOverride } : {},
             initialState: {
               systemPrompt: ADVISOR_SYSTEM_PROMPT,
               model: resolveGatewayModel(context.config.modelId),
@@ -6819,7 +6868,7 @@ function createTracedStreamFn(baseOrOptions = streamSimple) {
   const conversationPrivacy = typeof baseOrOptions === "function" ? void 0 : baseOrOptions.conversationPrivacy;
   const effectivePrivacy = conversationPrivacy ?? "private";
   return async (model, context, options) => {
-    const span = sentry_exports.startInactiveSpan({
+    const span = startInactiveSpan({
       name: `chat ${model.id}`,
       op: "gen_ai.chat",
       attributes: {
@@ -6828,7 +6877,7 @@ function createTracedStreamFn(baseOrOptions = streamSimple) {
       }
     });
     try {
-      const stream = await sentry_exports.withActiveSpan(
+      const stream = await withActiveSpan(
         span,
         () => Promise.resolve(base(model, context, options))
       );
@@ -6864,6 +6913,9 @@ import fs3 from "fs/promises";
 
 // src/chat/oauth-flow.ts
 import { randomBytes } from "crypto";
+import {
+  sourceSchema
+} from "@sentry/junior-plugin-api";
 var OAUTH_STATE_TTL_MS = 10 * 60 * 1e3;
 function optionalString(value) {
   return typeof value === "string" ? value : void 0;
@@ -6879,13 +6931,22 @@ function parseOAuthStatePayload(value) {
   if (value.destination !== void 0 && !destination) {
     return void 0;
   }
+  const source = value.source === void 0 ? void 0 : sourceSchema.safeParse(value.source);
+  if (value.source !== void 0 && (!source || !source.success)) {
+    return void 0;
+  }
+  const pendingMessage = optionalString(value.pendingMessage);
+  if (pendingMessage && !source?.success) {
+    return void 0;
+  }
   return {
     userId: value.userId,
     provider: value.provider,
     ...optionalString(value.channelId) ? { channelId: optionalString(value.channelId) } : {},
     ...destination ? { destination } : {},
+    ...source?.success ? { source: source.data } : {},
     ...optionalString(value.threadTs) ? { threadTs: optionalString(value.threadTs) } : {},
-    ...optionalString(value.pendingMessage) ? { pendingMessage: optionalString(value.pendingMessage) } : {},
+    ...pendingMessage ? { pendingMessage } : {},
     ...isRecord(value.configuration) ? { configuration: value.configuration } : {},
     ...optionalString(value.resumeConversationId) ? { resumeConversationId: optionalString(value.resumeConversationId) } : {},
     ...optionalString(value.resumeSessionId) ? { resumeSessionId: optionalString(value.resumeSessionId) } : {},
@@ -7007,6 +7068,7 @@ async function startOAuthFlow(provider, input) {
       provider,
       ...input.channelId ? { channelId: input.channelId } : {},
       ...input.destination ? { destination: input.destination } : {},
+      ...input.source ? { source: input.source } : {},
       ...input.threadTs ? { threadTs: input.threadTs } : {},
       ...input.userMessage ? { pendingMessage: input.userMessage } : {},
       ...configuration && Object.keys(configuration).length > 0 ? { configuration } : {},
@@ -7843,7 +7905,7 @@ function truncateOutput(output, maxLength) {
     truncated: true
   };
 }
-function sleep(ms) {
+function sleep2(ms) {
   return new Promise((resolve) => {
     setTimeout(resolve, ms);
   });
@@ -8014,7 +8076,7 @@ function createSandboxSessionManager(options) {
         if (!isSnapshottingError(error) || attempt === SNAPSHOT_BOOT_RETRY_COUNT - 1) {
           throw error;
         }
-        await sleep(SNAPSHOT_BOOT_RETRY_DELAY_MS);
+        await sleep2(SNAPSHOT_BOOT_RETRY_DELAY_MS);
       }
     }
     throw new Error(`Failed to boot sandbox from snapshot ${snapshotId}`);
@@ -9141,6 +9203,9 @@ import { PluginToolInputError } from "@sentry/junior-plugin-api";
 import { THREAD_STATE_TTL_MS } from "chat";
 
 // src/chat/mcp/auth-store.ts
+import {
+  sourceSchema as sourceSchema2
+} from "@sentry/junior-plugin-api";
 var MCP_AUTH_SESSION_PREFIX = "junior:mcp_auth_session";
 var MCP_AUTH_CREDENTIALS_PREFIX = "junior:mcp_auth_credentials";
 var MCP_AUTH_SESSION_INDEX_PREFIX = "junior:mcp_auth_session_index";
@@ -9192,12 +9257,17 @@ function parseMcpAuthSession(value) {
     if (parsed.destination !== void 0 && !destination) {
       return void 0;
     }
+    const source = parsed.source === void 0 ? void 0 : sourceSchema2.safeParse(parsed.source);
+    if (parsed.source !== void 0 && (!source || !source.success)) {
+      return void 0;
+    }
     return {
       authSessionId: parsed.authSessionId,
       provider: parsed.provider,
       userId: parsed.userId,
       conversationId: parsed.conversationId,
       ...destination ? { destination } : {},
+      ...source?.success ? { source: source.data } : {},
       sessionId: parsed.sessionId,
       userMessage: parsed.userMessage,
       createdAtMs: parsed.createdAtMs,
@@ -9518,6 +9588,7 @@ function createPluginAuthOrchestration(input) {
         requesterId: input.requesterId,
         channelId: input.channelId,
         destination: input.destination,
+        source: input.source,
         threadTs: input.threadTs,
         userMessage: input.userMessage,
         channelConfiguration: input.channelConfiguration,
@@ -9696,12 +9767,27 @@ function handleToolExecutionError(error, toolName, toolCallId, shouldTrace, trac
 }
 
 // src/chat/tools/agent-tools.ts
-function createAgentTools(tools, sandbox, spanContext, onStatus, sandboxExecutor, pluginAuthOrchestration, onToolCall, agentHooks, conversationPrivacy) {
+function createAgentTools(tools, sandbox, spanContext, onStatus, sandboxExecutor, pluginAuthOrchestration, onToolCall, agentHooks, conversationPrivacy, onToolResult) {
   const shouldTrace = shouldEmitDevAgentTrace();
   const effectiveConversationPrivacy = conversationPrivacy ?? "private";
   const serializeToolPayload = (payload) => serializeGenAiAttribute(
     effectiveConversationPrivacy === "private" ? toGenAiPayloadMetadata(payload) : payload
   );
+  const notifyToolResult = async (report) => {
+    try {
+      await onToolResult?.(report);
+    } catch (error) {
+      logWarn(
+        "tool_result_observer_failed",
+        spanContext,
+        {
+          "gen_ai.tool.name": report.toolName,
+          "exception.message": error instanceof Error ? error.message : String(error)
+        },
+        "Tool result observer failed"
+      );
+    }
+  };
   return Object.entries(tools).map(([toolName, toolDef]) => ({
     name: toolName,
     label: toolName,
@@ -9751,7 +9837,7 @@ function createAgentTools(tools, sandbox, spanContext, onStatus, sandboxExecutor
               input: parsed
             }) : { input: parsed, env: {} };
             const toolInput = beforeTool.input;
-            onToolCall?.(toolName, toolInput);
+            await onToolCall?.(toolName, toolInput);
             const sandboxInput = buildSandboxInput(toolName, toolInput);
             const isSandbox = Boolean(sandboxExecutor?.canExecute(toolName));
             const result = isSandbox ? await sandboxExecutor.execute({
@@ -9781,8 +9867,20 @@ function createAgentTools(tools, sandbox, spanContext, onStatus, sandboxExecutor
                 )
               });
             }
+            await notifyToolResult({
+              ok: true,
+              params: toolInput,
+              result: resultAttributeValue,
+              toolName
+            });
             return normalized;
           } catch (error) {
+            await notifyToolResult({
+              error: error instanceof Error ? error.message : String(error),
+              ok: false,
+              params: parsed,
+              toolName
+            });
             if (error instanceof AuthorizationPauseError || error instanceof AuthorizationFlowDisabledError) {
               throw error;
             }
@@ -10389,7 +10487,7 @@ async function loadTurnSessionRecord(ctx) {
   const canUseTurnSession = Boolean(ctx.conversationId && ctx.sessionId);
   const existingSessionRecord = canUseTurnSession && ctx.conversationId && ctx.sessionId ? await getAgentTurnSessionRecord(ctx.conversationId, ctx.sessionId) : void 0;
   const hasAwaitingResumeRecord = Boolean(
-    existingSessionRecord && existingSessionRecord.state === "awaiting_resume" && existingSessionRecord.piMessages.length > 0
+    existingSessionRecord && existingSessionRecord.state === "awaiting_resume"
   );
   return {
     canUseTurnSession,
@@ -10413,6 +10511,7 @@ async function persistRunningSessionRecord(args) {
       cumulativeDurationMs: latestSessionRecord?.cumulativeDurationMs,
       cumulativeUsage: latestSessionRecord?.cumulativeUsage,
       ...args.destination ?? latestSessionRecord?.destination ? { destination: args.destination ?? latestSessionRecord?.destination } : {},
+      ...args.source ?? latestSessionRecord?.source ? { source: args.source ?? latestSessionRecord?.source } : {},
       sessionId: args.sessionId,
       sliceId: args.sliceId,
       state: "running",
@@ -10457,6 +10556,7 @@ async function persistCompletedSessionRecord(args) {
         args.currentUsage
       ),
       ...args.destination ?? latestSessionRecord?.destination ? { destination: args.destination ?? latestSessionRecord?.destination } : {},
+      ...args.source ?? latestSessionRecord?.source ? { source: args.source ?? latestSessionRecord?.source } : {},
       sessionId: args.sessionId,
       sliceId: args.sliceId,
       state: "completed",
@@ -10492,7 +10592,7 @@ async function persistAuthPauseSessionRecord(args) {
       args.messages,
       latestSessionRecord?.piMessages
     );
-    if (piMessages.length === 0 || !isContinuableBoundary(piMessages)) {
+    if (piMessages.length > 0 && !isContinuableBoundary(piMessages)) {
       return void 0;
     }
     return await upsertAgentTurnSessionRecord({
@@ -10507,6 +10607,7 @@ async function persistAuthPauseSessionRecord(args) {
         args.currentUsage
       ),
       ...args.destination ?? latestSessionRecord?.destination ? { destination: args.destination ?? latestSessionRecord?.destination } : {},
+      ...args.source ?? latestSessionRecord?.source ? { source: args.source ?? latestSessionRecord?.source } : {},
       sessionId: args.sessionId,
       sliceId: nextSliceId,
       state: "awaiting_resume",
@@ -10566,6 +10667,7 @@ async function persistTimeoutSessionRecord(args) {
         ...args.destination ?? latestSessionRecord?.destination ? {
           destination: args.destination ?? latestSessionRecord?.destination
         } : {},
+        ...args.source ?? latestSessionRecord?.source ? { source: args.source ?? latestSessionRecord?.source } : {},
         sessionId: args.sessionId,
         sliceId: args.currentSliceId,
         state: "failed",
@@ -10585,6 +10687,7 @@ async function persistTimeoutSessionRecord(args) {
       cumulativeDurationMs,
       cumulativeUsage,
       ...args.destination ?? latestSessionRecord?.destination ? { destination: args.destination ?? latestSessionRecord?.destination } : {},
+      ...args.source ?? latestSessionRecord?.source ? { source: args.source ?? latestSessionRecord?.source } : {},
       sessionId: args.sessionId,
       sliceId: nextSliceId,
       state: "awaiting_resume",
@@ -10636,6 +10739,7 @@ async function persistYieldSessionRecord(args) {
         args.currentUsage
       ),
       ...args.destination ?? latestSessionRecord?.destination ? { destination: args.destination ?? latestSessionRecord?.destination } : {},
+      ...args.source ?? latestSessionRecord?.source ? { source: args.source ?? latestSessionRecord?.source } : {},
       sessionId: args.sessionId,
       sliceId: args.currentSliceId,
       state: "awaiting_resume",
@@ -10852,6 +10956,7 @@ async function createMcpOAuthClientProvider(input) {
     userId: input.userId,
     conversationId: input.conversationId,
     ...input.destination ? { destination: input.destination } : {},
+    ...input.source ? { source: input.source } : {},
     sessionId: input.sessionId,
     userMessage: input.userMessage,
     ...input.channelId ? { channelId: input.channelId } : {},
@@ -10953,6 +11058,7 @@ function createMcpAuthOrchestration(input) {
       provider: plugin.manifest.name,
       conversationId: input.conversationId,
       destination: input.destination,
+      source: input.source,
       sessionId: input.sessionId,
       userId: input.requesterId,
       userMessage: input.userMessage,
@@ -11058,7 +11164,7 @@ function createMcpAuthOrchestration(input) {
 
 // src/chat/respond.ts
 var AGENT_ABORT_SETTLE_GRACE_MS = 5e3;
-function sleep2(ms) {
+function sleep3(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function waitForAbortSettlement(promise, timeoutMs) {
@@ -11115,8 +11221,7 @@ function extractSliceUsage(messages, beforeMessageCount) {
   return hasAgentTurnUsage(usage) ? usage : void 0;
 }
 function requesterFromContext(context) {
-  const identity = actorRequesterFromContext(context);
-  return identity?.platform === "slack" ? toStoredSlackRequester(identity) : void 0;
+  return actorRequesterFromContext(context);
 }
 function assertRequesterDestinationMatch(context) {
   const { destination, requester } = context;
@@ -11150,26 +11255,11 @@ function assertCorrelationDestinationMatch(context) {
 }
 function actorRequesterFromContext(context) {
   return createRequester(context.requester, {
-    platform: context.requester?.platform ?? (context.destination?.platform === "slack" ? "slack" : void 0),
-    teamId: (context.destination?.platform === "slack" ? context.destination.teamId : void 0) ?? context.correlation?.teamId ?? (context.requester?.platform === "slack" ? context.requester.teamId : void 0),
+    platform: context.requester?.platform ?? (context.destination.platform === "slack" ? "slack" : void 0),
+    teamId: (context.destination.platform === "slack" ? context.destination.teamId : void 0) ?? context.correlation?.teamId ?? (context.requester?.platform === "slack" ? context.requester.teamId : void 0),
     userId: context.correlation?.requesterId
   });
 }
-function toolInvocationSource(context) {
-  if (context.source) {
-    return context.source;
-  }
-  if (context.destination.platform !== "slack") {
-    return context.destination;
-  }
-  return {
-    platform: "slack",
-    teamId: context.destination.teamId,
-    channelId: context.destination.channelId,
-    ...context.correlation?.messageTs ? { messageTs: context.correlation.messageTs } : {},
-    ...context.correlation?.threadTs ? { threadTs: context.correlation.threadTs } : {}
-  };
-}
 function toolInvocationDestination(context) {
   if (context.destination.platform !== "slack" || !context.toolChannelId) {
     return context.destination;
@@ -11281,7 +11371,20 @@ function buildSteeringPiMessage(message) {
     timestamp: message.timestampMs ?? Date.now()
   };
 }
-async function generateAssistantReply(messageText, context) {
+function withoutTrailingUncheckpointedUserPrompt(messages, userContentParts) {
+  if (!messages || messages.length === 0) {
+    return [];
+  }
+  const lastMessage = messages.at(-1);
+  if (lastMessage?.role !== "user") {
+    return messages;
+  }
+  if (JSON.stringify(lastMessage.content) !== JSON.stringify(userContentParts)) {
+    return messages;
+  }
+  return messages.slice(0, -1);
+}
+async function generateAssistantReply(messageText2, context) {
   if (!context.destination) {
     throw new TypeError("Assistant reply generation requires a destination");
   }
@@ -11313,6 +11416,7 @@ async function generateAssistantReply(messageText, context) {
   const requester = requesterFromContext(context);
   const actorRequester = actorRequesterFromContext(context);
   const surface = surfaceFromContext(context);
+  const runSource = context.source;
   const credentialActor = context.credentialContext?.actor;
   const credentialActorLogContext = credentialActor ? {
     actorType: credentialActor.type,
@@ -11393,7 +11497,7 @@ async function generateAssistantReply(messageText, context) {
     }
     let baseInstructions = "";
     let configurationValues;
-    const userInput = messageText;
+    const userInput = messageText2;
     if (shouldTrace) {
       const inboundAttachmentCount = context.inboundAttachmentCount ?? 0;
       const promptAttachmentCount = context.userAttachments?.length ?? 0;
@@ -11550,14 +11654,7 @@ async function generateAssistantReply(messageText, context) {
       userAttachments: context.userAttachments,
       userTurnText
     });
-    const preAgentPromptMessages = () => existingSessionRecord?.piMessages ?? [
-      ...context.piMessages ?? [],
-      {
-        role: "user",
-        content: userContentParts,
-        timestamp: Date.now()
-      }
-    ];
+    const preAgentPromptMessages = () => existingSessionRecord?.piMessages ?? [...context.piMessages ?? []];
     thinkingSelection = await selectTurnThinkingLevel({
       completeObject,
       conversationContext: context.conversationContext,
@@ -11600,6 +11697,7 @@ async function generateAssistantReply(messageText, context) {
       requesterId: authRequesterId,
       channelId: slackChannelId,
       destination: context.destination,
+      source: runSource,
       threadTs: context.correlation?.threadTs,
       toolChannelId: context.toolChannelId,
       userMessage: userInput,
@@ -11617,6 +11715,7 @@ async function generateAssistantReply(messageText, context) {
       requesterId: authRequesterId,
       channelId: slackChannelId,
       destination: context.destination,
+      source: runSource,
       threadTs: context.correlation?.threadTs,
       userMessage: userInput,
       channelConfiguration: context.channelConfiguration,
@@ -11661,20 +11760,26 @@ async function generateAssistantReply(messageText, context) {
         streamFn: createTracedStreamFn({ conversationPrivacy })
       }
     };
-    const toolSource = toolInvocationSource(context);
+    const toolSource = runSource;
     const toolDestination = toolInvocationDestination(context);
     let toolRuntimeContext;
     if (toolSource.platform === "slack") {
+      if (toolDestination.platform !== "slack") {
+        throw new TypeError("Slack tool runtime requires a Slack destination");
+      }
       toolRuntimeContext = {
         ...commonToolRuntimeContext,
-        ...toolDestination.platform === "slack" ? { destination: toolDestination } : {},
+        destination: toolDestination,
         requester: actorRequester?.platform === "slack" ? actorRequester : void 0,
         source: toolSource
       };
     } else {
+      if (toolDestination.platform !== "local") {
+        throw new TypeError("Local tool runtime requires a local destination");
+      }
       toolRuntimeContext = {
         ...commonToolRuntimeContext,
-        ...toolDestination.platform === "local" ? { destination: toolDestination } : {},
+        destination: toolDestination,
         requester: actorRequester?.platform === "local" ? actorRequester : void 0,
         source: toolSource
       };
@@ -11759,12 +11864,29 @@ async function generateAssistantReply(messageText, context) {
     const activeMcpCatalogs = toActiveMcpCatalogSummaries(
       turnMcpToolManager.getActiveToolCatalog()
     );
-    baseInstructions = buildSystemPrompt({ source: toolSource });
-    const needsBootstrapContext = !hasRuntimeTurnContext(priorPiMessages ?? []);
-    const turnContextPrompt = needsBootstrapContext ? buildTurnContextPrompt({
+    const hasPromptCheckpoint = resumedFromSessionRecord && existingSessionRecord?.turnStartMessageIndex !== void 0;
+    const shouldPromptAgent = !resumedFromSessionRecord || !hasPromptCheckpoint;
+    const promptHistoryMessages = shouldPromptAgent && resumedFromSessionRecord ? withoutTrailingUncheckpointedUserPrompt(
+      priorPiMessages,
+      userContentParts
+    ) : shouldPromptAgent ? priorPiMessages ?? [] : existingSessionRecord.piMessages;
+    const needsBootstrapContextForPrompt = shouldPromptAgent && !hasRuntimeTurnContext(promptHistoryMessages);
+    const systemPromptContributions = await getPluginSystemPromptContributions(toolSource);
+    const pluginSystemPrompt = buildPluginSystemPromptContributions(
+      systemPromptContributions
+    );
+    baseInstructions = [
+      buildSystemPrompt({ source: toolSource }),
+      pluginSystemPrompt
+    ].filter((section) => Boolean(section)).join("\n\n");
+    const pluginUserPromptContributions = !shouldPromptAgent ? [] : await getPluginUserPromptContributions({
+      context: toolRuntimeContext
+    });
+    const turnContextPrompt = needsBootstrapContextForPrompt || pluginUserPromptContributions.length > 0 ? buildTurnContextPrompt({
       availableSkills,
       activeMcpCatalogs,
-      includeSessionContext: true,
+      includeSessionContext: needsBootstrapContextForPrompt,
+      pluginPromptContributions: pluginUserPromptContributions,
       toolGuidance,
       runtime: {
         conversationId: spanContext.conversationId,
@@ -11798,10 +11920,10 @@ async function generateAssistantReply(messageText, context) {
     const inputMessagesAttribute = serializeGenAiAttribute(
       conversationPrivacy !== "public" ? inputMessages.map(toGenAiMessageMetadata) : inputMessages
     );
-    const onToolCall = (toolName, params) => {
+    const onToolCall = async (toolName, params) => {
       toolCalls.push(toolName);
       try {
-        context.onToolInvocation?.({ toolName, params });
+        await context.onToolInvocation?.({ toolName, params });
       } catch (error) {
         logWarn(
           "tool_invocation_observer_failed",
@@ -11823,7 +11945,8 @@ async function generateAssistantReply(messageText, context) {
       pluginAuth,
       onToolCall,
       pluginHooks,
-      conversationPrivacy
+      conversationPrivacy,
+      context.onToolResult
     );
     advisorTools = createAgentTools(
       createAdvisorToolDefinitions(tools),
@@ -11834,7 +11957,8 @@ async function generateAssistantReply(messageText, context) {
       pluginAuth,
       onToolCall,
       pluginHooks,
-      conversationPrivacy
+      conversationPrivacy,
+      context.onToolResult
     );
     let hasEmittedText = false;
     let needsSeparator = false;
@@ -11853,6 +11977,7 @@ async function generateAssistantReply(messageText, context) {
         channelName: context.correlation?.channelName,
         conversationId: sessionConversationId,
         destination: context.destination,
+        source: runSource,
         sessionId,
         sliceId: currentSliceId,
         messages,
@@ -11931,8 +12056,9 @@ async function generateAssistantReply(messageText, context) {
       );
       throw cooperativeYieldError;
     };
+    const apiKeyOverride = getPiGatewayApiKey();
     agent = new Agent2({
-      getApiKey: () => getPiGatewayApiKeyOverride(),
+      ...apiKeyOverride ? { getApiKey: () => apiKeyOverride } : {},
       streamFn: createTracedStreamFn({ conversationPrivacy }),
       steeringMode: "all",
       prepareNextTurn: async () => {
@@ -11991,16 +12117,13 @@ async function generateAssistantReply(messageText, context) {
     beforeMessageCount = agent.state.messages.length;
     try {
       if (resumedFromSessionRecord) {
-        agent.state.messages = turnContextPrompt ? prependMissingRuntimeTurnContext(
-          existingSessionRecord.piMessages,
-          turnContextPrompt
-        ) : existingSessionRecord.piMessages;
+        agent.state.messages = shouldPromptAgent ? promptHistoryMessages ?? [] : existingSessionRecord.piMessages;
         turnStartMessageIndex = existingSessionRecord.turnStartMessageIndex;
       } else if (context.piMessages && context.piMessages.length > 0) {
         agent.state.messages = [...context.piMessages];
       }
       beforeMessageCount = agent.state.messages.length;
-      if (!resumedFromSessionRecord) {
+      if (shouldPromptAgent) {
         turnStartMessageIndex = beforeMessageCount;
       }
       await withSpan(
@@ -12014,7 +12137,7 @@ async function generateAssistantReply(messageText, context) {
             content: promptContentParts,
             timestamp: Date.now()
           };
-          if (!resumedFromSessionRecord) {
+          if (shouldPromptAgent) {
             const promptPersisted = await requireDurableInputCheckpoint([
               ...agent.state.messages,
               freshPromptMessage
@@ -12091,7 +12214,7 @@ async function generateAssistantReply(messageText, context) {
               }
             }
           };
-          let run = resumedFromSessionRecord ? agent.continue() : agent.prompt(freshPromptMessage);
+          let run = shouldPromptAgent ? agent.prompt(freshPromptMessage) : agent.continue();
           let retryUsage;
           for (let attempt = 0; ; attempt += 1) {
             promptResult = await runAgentStep(run);
@@ -12140,7 +12263,7 @@ async function generateAssistantReply(messageText, context) {
               {},
               "Retrying transient provider failure"
             );
-            await sleep2(providerRetry.delayMs);
+            await sleep3(providerRetry.delayMs);
             run = agent.continue();
           }
         },
@@ -12171,6 +12294,7 @@ async function generateAssistantReply(messageText, context) {
         currentDurationMs: Date.now() - replyStartedAtMs,
         currentUsage: turnUsage,
         destination: context.destination,
+        source: runSource,
         sessionId,
         sliceId: currentSliceId,
         allMessages: agent.state.messages,
@@ -12207,6 +12331,7 @@ async function generateAssistantReply(messageText, context) {
         channelName: context.correlation?.channelName,
         conversationId: timeoutResumeConversationId,
         destination: context.destination,
+        source: runSource,
         sessionId: timeoutResumeSessionId,
         currentSliceId: timeoutResumeSliceId,
         currentDurationMs: Date.now() - replyStartedAtMs,
@@ -12232,6 +12357,7 @@ async function generateAssistantReply(messageText, context) {
         channelName: context.correlation?.channelName,
         conversationId: timeoutResumeConversationId,
         destination: context.destination,
+        source: runSource,
         sessionId: timeoutResumeSessionId,
         currentSliceId: timeoutResumeSliceId,
         currentDurationMs: Date.now() - replyStartedAtMs,
@@ -12276,6 +12402,7 @@ async function generateAssistantReply(messageText, context) {
         channelName: context.correlation?.channelName,
         conversationId: timeoutResumeConversationId,
         destination: context.destination,
+        source: runSource,
         sessionId: timeoutResumeSessionId,
         currentSliceId: timeoutResumeSliceId,
         currentDurationMs: Date.now() - replyStartedAtMs,
@@ -12729,6 +12856,194 @@ function getConversationMessageSlackTs(message) {
   return message.meta?.slackTs ?? toOptionalString(message.id);
 }
 
+// src/chat/plugins/task-runner.ts
+import { pluginRunContextSchema } from "@sentry/junior-plugin-api";
+var PLUGIN_TASK_LOCK_TTL_MS = 5 * 60 * 1e3;
+function isRecord4(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function textPart(value) {
+  if (isRecord4(value) && value.type === "text" && typeof value.text === "string") {
+    return value.text;
+  }
+  return void 0;
+}
+function messageText(message) {
+  const content = message.content;
+  if (typeof content === "string") {
+    return sanitizeText(content);
+  }
+  if (!Array.isArray(content)) {
+    return "";
+  }
+  return sanitizeText(content.map(textPart).filter(Boolean).join("\n"));
+}
+function toolResultText(message) {
+  const record = message;
+  const parts = [
+    messageText(message),
+    record.output,
+    record.result,
+    record.stdout,
+    record.stderr,
+    record.toolResult
+  ].filter(
+    (value) => typeof value === "string" && value.length > 0
+  );
+  return sanitizeText(parts.join("\n"));
+}
+function sanitizeText(text) {
+  return text.replace(
+    /<data_base64>[\s\S]*?<\/data_base64>/g,
+    "<data_base64>[omitted]</data_base64>"
+  ).replace(
+    /data:image\/[a-z0-9.+-]+;base64,[a-z0-9+/=]+/gi,
+    "[image data omitted]"
+  ).replaceAll("\0", " ").trim();
+}
+function runTranscriptEntry(message) {
+  const role = getPiMessageRole(message);
+  if (role === "user" || role === "assistant") {
+    const text2 = messageText(message);
+    if (!text2) {
+      return void 0;
+    }
+    return { type: "message", role, text: text2 };
+  }
+  if (!isToolResultMessage(message)) {
+    return void 0;
+  }
+  const toolName = normalizeToolNameFromResult(message);
+  if (!toolName) {
+    return void 0;
+  }
+  const text = toolResultText(message);
+  return {
+    type: "toolResult",
+    toolName,
+    isError: isToolResultError(message),
+    ...text ? { text } : {}
+  };
+}
+async function withPluginTaskLock(taskId, callback) {
+  const state = getStateAdapter();
+  await state.connect();
+  const lock = await state.acquireLock(
+    `plugin:task:${taskId}`,
+    PLUGIN_TASK_LOCK_TTL_MS
+  );
+  if (!lock) {
+    throw new Error(`Could not acquire plugin task lock for ${taskId}`);
+  }
+  try {
+    return await callback();
+  } finally {
+    await state.releaseLock(lock);
+  }
+}
+async function loadPluginRun(params) {
+  const record = await getAgentTurnSessionRecord(
+    params.conversationId,
+    params.sessionId
+  );
+  if (!record) {
+    throw new Error("Completed plugin task session record is unavailable");
+  }
+  if (record.state !== "completed") {
+    throw new Error("Completed plugin task session record is not completed");
+  }
+  if (!record.source || !record.destination) {
+    throw new Error(
+      "Completed plugin task session record is missing source or destination"
+    );
+  }
+  const sessionMessages = stripRuntimeTurnContext(
+    record.piMessages.slice(record.turnStartMessageIndex ?? 0)
+  );
+  return pluginRunContextSchema.parse({
+    completedAtMs: record.updatedAtMs,
+    conversationId: record.conversationId,
+    destination: record.destination,
+    ...record.requester ? { requester: record.requester } : {},
+    runId: record.sessionId,
+    source: record.source,
+    transcript: sessionMessages.map(runTranscriptEntry).filter((entry) => Boolean(entry))
+  });
+}
+function taskPluginContext(plugin, message, options = {}) {
+  const pluginName = plugin.manifest.name;
+  const sessionParams = pluginTaskParamsSchema.parse(message.params);
+  return {
+    db: getDb(),
+    embedder: createPluginEmbedder(pluginName, {
+      signal: options.signal
+    }),
+    id: pluginTaskId(message),
+    log: createPluginLogger(pluginName),
+    model: createPluginModel(pluginName, plugin.model, {
+      signal: options.signal
+    }),
+    name: message.name,
+    plugin: { name: pluginName },
+    run: {
+      async load() {
+        return await loadPluginRun(sessionParams);
+      }
+    },
+    state: createPluginState(pluginName)
+  };
+}
+function findPluginTask(message) {
+  const plugin = getPlugins().find(
+    (candidate) => candidate.manifest.name === message.plugin
+  );
+  if (!plugin?.tasks || !Object.hasOwn(plugin.tasks, message.name)) {
+    return void 0;
+  }
+  const task = plugin.tasks[message.name];
+  return { plugin, task };
+}
+async function scheduleSessionCompletedPluginTasks(params, options = {}) {
+  const coreParams = pluginTaskParamsSchema.parse(params);
+  const taskRegistrations = getPlugins().flatMap(
+    (plugin) => Object.keys(plugin.tasks ?? {}).map((name) => ({ name, plugin }))
+  );
+  if (taskRegistrations.length === 0) {
+    return;
+  }
+  const record = await getAgentTurnSessionRecord(
+    coreParams.conversationId,
+    coreParams.sessionId
+  );
+  if (!record || record.state !== "completed") {
+    throw new Error("Completed plugin task session record is not ready");
+  }
+  const send = options.send ?? sendVercelPluginTask;
+  const messages = taskRegistrations.map(({ name, plugin }) => ({
+    name,
+    params: coreParams,
+    plugin: plugin.manifest.name
+  }));
+  await Promise.all(
+    messages.map(async (message) => {
+      await send(message);
+    })
+  );
+}
+async function processPluginTask(message, options = {}) {
+  await withPluginTaskLock(pluginTaskId(message), async () => {
+    const resolved = findPluginTask(message);
+    if (!resolved) {
+      throw new Error(
+        `Plugin task "${message.plugin}.${message.name}" is not registered`
+      );
+    }
+    await resolved.task.run(
+      taskPluginContext(resolved.plugin, message, options)
+    );
+  });
+}
+
 // src/chat/runtime/delivered-turn-state.ts
 function buildDeliveredTurnStatePatch(args) {
   const conversation = structuredClone(args.conversation);
@@ -12839,5 +13154,7 @@ export {
   createConversationMemoryService,
   isHumanConversationMessage,
   getConversationMessageSlackTs,
+  scheduleSessionCompletedPluginTasks,
+  processPluginTask,
   buildDeliveredTurnStatePatch
 };