@sentry/junior 0.80.1 → 0.82.0

package/dist/{chunk-W2QGQCKG.js → chunk-NC6LR6U4.js}

@@ -42,7 +42,7 @@ import {
   getPlugins,
   getSlackToolContext,
   resolveChannelCapabilities
-} from "./chunk-Y3YUOEAZ.js";
+} from "./chunk-TR2G37II.js";
 import {
   createPluginLogger,
   createPluginState
@@ -122,6 +122,7 @@ import {
   parseSkillInvocation
 } from "./chunk-WCXVEQPI.js";
 import {
+  CredentialUnavailableError,
   credentialContextSchema,
   pluginCatalogRuntime,
   resolveAuthTokenPlaceholder,
@@ -191,7 +192,7 @@ function getConfigDefaults() {
   return cloneDefaults(installDefaults);
 }
 
-// src/chat/sandbox/egress-tracing.ts
+// src/chat/sandbox/egress/tracing.ts
 function isValidDomainPattern(domain) {
   if (domain.includes("*")) {
     return domain.startsWith("*.") && domain.indexOf("*", 1) === -1;
@@ -882,6 +883,17 @@ function parsePrefixFlag(extras) {
     error: "jr-rpc config list accepts optional --prefix <value>\n"
   };
 }
+function buildUnknownKeyWarning(key) {
+  const knownKeys = pluginCatalogRuntime.getProviders().flatMap((plugin) => [...plugin.manifest.configKeys]);
+  if (knownKeys.includes(key)) {
+    return "";
+  }
+  const prefix = key.includes(".") ? key.slice(0, key.indexOf(".") + 1) : "";
+  const suggestions = prefix ? knownKeys.filter((k) => k.startsWith(prefix)) : knownKeys;
+  const hint = suggestions.length > 0 ? `Known keys with prefix "${prefix}": ${suggestions.join(", ")}` : `Known config keys: ${knownKeys.join(", ")}`;
+  return `Warning: "${key}" is not a recognized config key. ${hint}
+`;
+}
 async function handleConfigCommand(args, deps) {
   const usage = [
     "jr-rpc config get <key>",
@@ -960,6 +972,7 @@ ${usage}
         });
       }
     }
+    const unknownKeyWarning = buildUnknownKeyWarning(key);
     try {
       const entry = await configuration.set({
         key,
@@ -989,6 +1002,7 @@ ${usage}
           updatedBy: entry.updatedBy,
           source: entry.source
         },
+        stderr: unknownKeyWarning,
         exitCode: 0
       });
     } catch (error) {
@@ -4191,7 +4205,7 @@ function createOperationKey(toolName, input) {
 // src/chat/tools/slack/channel-post-message.ts
 function createSlackChannelPostMessageTool(context, state) {
   return tool({
-    description: "Post a message in the active Slack channel context (outside the thread). Use this only when the user explicitly asks to post/send/share/say something in the current channel. Do not use it for normal thread replies, speculative broadcasts, or requests targeting another named channel; explain that limitation instead. Do not claim a channel message was posted unless this tool succeeds in this turn.",
+    description: "Post a new top-level message to the current Slack channel. Use only when the user explicitly asks to post/send/share/say something to the channel. Do not use for thread replies, inline @mentions, or pinging mentioned users.",
     inputSchema: Type14.Object({
       text: Type14.String({
         minLength: 1,
@@ -7149,10 +7163,10 @@ async function startOAuthFlow(provider, input) {
   };
 }
 
-// src/chat/sandbox/egress-session.ts
+// src/chat/sandbox/egress/session.ts
 import { createHmac, randomUUID, timingSafeEqual } from "crypto";
 
-// src/chat/sandbox/egress-schemas.ts
+// src/chat/sandbox/egress/schemas.ts
 import { z } from "zod";
 import {
   pluginAuthorizationSchema,
@@ -7217,7 +7231,7 @@ function parseSandboxEgressPermissionDeniedSignal(value) {
   return result.success ? result.data : void 0;
 }
 
-// src/chat/sandbox/egress-session.ts
+// src/chat/sandbox/egress/session.ts
 var SANDBOX_EGRESS_PROXY_PATH = "/api/internal/sandbox-egress";
 var SANDBOX_EGRESS_TOKEN_VERSION = "v1";
 var SANDBOX_EGRESS_HMAC_CONTEXT = "junior.sandbox_egress.v1";
@@ -7419,7 +7433,7 @@ async function consumeSandboxEgressPermissionDeniedSignal(egressId) {
   return signal;
 }
 
-// src/chat/sandbox/egress-policy.ts
+// src/chat/sandbox/egress/policy.ts
 function matchesSandboxEgressDomain(host, domain) {
   return host.toLowerCase() === domain.toLowerCase();
 }
@@ -11199,6 +11213,1028 @@ function createMcpAuthOrchestration(input) {
   };
 }
 
+// src/chat/egress/plugin.ts
+import { randomUUID as randomUUID4 } from "crypto";
+
+// src/chat/plugins/credential-hooks.ts
+import {
+  pluginAuthorizationSchema as pluginAuthorizationSchema2,
+  pluginCredentialResultSchema,
+  pluginGrantSchema as pluginGrantSchema2,
+  pluginProviderAccountSchema as pluginProviderAccountSchema2
+} from "@sentry/junior-plugin-api";
+function parseSchema(schema, value, message) {
+  const result = schema.safeParse(value);
+  if (!result.success) {
+    throw new Error(message);
+  }
+  return result.data;
+}
+function parseAuthorization(value, pluginName) {
+  if (value === void 0) {
+    return void 0;
+  }
+  const authorization = parseSchema(
+    pluginAuthorizationSchema2,
+    value,
+    `Plugin "${pluginName}" grant authorization is invalid`
+  );
+  if (authorization.provider !== pluginName) {
+    throw new Error(
+      `Plugin "${pluginName}" grant authorization provider must match the issuing plugin`
+    );
+  }
+  return authorization;
+}
+function parseGrant(value, pluginName) {
+  return parseSchema(
+    pluginGrantSchema2,
+    value,
+    `Plugin "${pluginName}" grantForEgress returned an invalid grant`
+  );
+}
+function pluginFor(provider) {
+  return getPlugins().find((candidate) => candidate.manifest.name === provider);
+}
+function basePluginContext(plugin) {
+  const pluginName = plugin.manifest.name;
+  return {
+    plugin: { name: pluginName },
+    log: createPluginLogger(pluginName),
+    db: getDb()
+  };
+}
+function parseCredentialResult(value, pluginName) {
+  const result = parseSchema(
+    pluginCredentialResultSchema,
+    value,
+    `Plugin "${pluginName}" issueCredential result is invalid`
+  );
+  if (result.type === "lease") {
+    parseAuthorization(result.lease.authorization, pluginName);
+    return result;
+  }
+  if (result.type === "unavailable") {
+    return result;
+  }
+  parseAuthorization(result.authorization, pluginName);
+  return result;
+}
+async function selectPluginGrant(input) {
+  const plugin = pluginFor(input.provider);
+  const hook = plugin?.hooks?.grantForEgress;
+  if (!plugin || !hook) {
+    return void 0;
+  }
+  const result = await hook({
+    ...basePluginContext(plugin),
+    request: {
+      ...input.bodyText !== void 0 ? { bodyText: input.bodyText } : {},
+      method: input.method,
+      ...input.operation ? { operation: input.operation } : {},
+      url: input.upstreamUrl.toString()
+    }
+  });
+  return result === void 0 ? void 0 : parseGrant(result, plugin.manifest.name);
+}
+async function onPluginEgressResponse(input) {
+  const plugin = pluginFor(input.provider);
+  const hook = plugin?.hooks?.onEgressResponse;
+  if (!plugin || !hook) {
+    return {};
+  }
+  let permissionDenied;
+  await hook({
+    ...basePluginContext(plugin),
+    grant: input.grant,
+    permissionDenied(message) {
+      const trimmed = message.trim();
+      if (!trimmed) {
+        throw new Error(
+          `Plugin "${plugin.manifest.name}" onEgressResponse permissionDenied message is empty`
+        );
+      }
+      permissionDenied = { message: trimmed };
+    },
+    request: {
+      method: input.method,
+      ...input.operation ? { operation: input.operation } : {},
+      url: input.upstreamUrl.toString()
+    },
+    response: input.response
+  });
+  return permissionDenied ? { permissionDenied } : {};
+}
+function hasEgressCredentialHooks(provider) {
+  const hooks = pluginFor(provider)?.hooks;
+  return Boolean(hooks?.grantForEgress || hooks?.issueCredential);
+}
+async function resolvePluginOAuthAccount(input) {
+  const plugin = pluginFor(input.provider);
+  const hook = plugin?.hooks?.resolveOAuthAccount;
+  if (!plugin || !hook) {
+    return void 0;
+  }
+  const account = await hook({
+    ...basePluginContext(plugin),
+    tokens: input.tokens
+  });
+  return account === void 0 ? void 0 : parseSchema(
+    pluginProviderAccountSchema2,
+    account,
+    `Plugin "${plugin.manifest.name}" resolveOAuthAccount returned an invalid account`
+  );
+}
+async function issuePluginCredential(input) {
+  const plugin = pluginFor(input.provider);
+  const hook = plugin?.hooks?.issueCredential;
+  if (!plugin || !hook) {
+    throw new Error(`Plugin "${input.provider}" has no issueCredential hook`);
+  }
+  const currentUserId = input.actor.type === "user" ? input.actor.userId : void 0;
+  const credentialSubjectUserId = input.credentialSubject?.userId;
+  const result = await hook({
+    ...basePluginContext(plugin),
+    actor: input.actor,
+    grant: input.grant,
+    ...input.credentialSubject ? { credentialSubject: input.credentialSubject } : {},
+    tokens: {
+      ...currentUserId ? {
+        currentUser: {
+          userId: currentUserId,
+          get: async () => await input.userTokenStore.get(
+            currentUserId,
+            plugin.manifest.name
+          ),
+          set: async (tokens) => {
+            await input.userTokenStore.set(
+              currentUserId,
+              plugin.manifest.name,
+              tokens
+            );
+          },
+          withRefresh: async (callback) => await input.userTokenStore.withRefresh(
+            currentUserId,
+            plugin.manifest.name,
+            callback
+          )
+        }
+      } : {},
+      ...credentialSubjectUserId ? {
+        credentialSubject: {
+          userId: credentialSubjectUserId,
+          get: async () => await input.userTokenStore.get(
+            credentialSubjectUserId,
+            plugin.manifest.name
+          ),
+          set: async (tokens) => {
+            await input.userTokenStore.set(
+              credentialSubjectUserId,
+              plugin.manifest.name,
+              tokens
+            );
+          },
+          withRefresh: async (callback) => await input.userTokenStore.withRefresh(
+            credentialSubjectUserId,
+            plugin.manifest.name,
+            callback
+          )
+        }
+      } : {}
+    }
+  });
+  return parseCredentialResult(result, plugin.manifest.name);
+}
+
+// src/chat/sandbox/egress/credentials.ts
+var HTTP_READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+var SandboxEgressCredentialError = class extends Error {
+  authorization;
+  grant;
+  kind;
+  provider;
+  constructor(input) {
+    super(input.message);
+    this.name = "SandboxEgressCredentialError";
+    this.authorization = input.authorization;
+    this.grant = input.grant;
+    this.kind = input.kind;
+    this.provider = input.provider;
+  }
+};
+function defaultGrantForProvider(input) {
+  const access = HTTP_READ_METHODS.has(
+    input.method.toUpperCase()
+  ) ? "read" : "write";
+  return {
+    source: "broker",
+    grant: {
+      name: "default",
+      access,
+      reason: `sandbox-egress:${input.provider}:${access}`
+    }
+  };
+}
+function oauthAuthorizationForProvider(provider) {
+  const oauth = pluginCatalogRuntime.getOAuthConfig(provider);
+  return oauth ? {
+    type: "oauth",
+    provider,
+    ...oauth.scope ? { scope: oauth.scope } : {}
+  } : void 0;
+}
+function credentialSubjectFromContext(context) {
+  return "subject" in context.credentials && context.credentials.subject ? { type: "user", userId: context.credentials.subject.userId } : void 0;
+}
+function assertLeaseTransformsOwnedByProvider(provider, lease) {
+  for (const transform of lease.headerTransforms) {
+    if (resolveSandboxEgressProviderForHost(transform.domain) !== provider) {
+      throw new Error(
+        `Credential lease for ${provider} included header transform for unowned domain ${transform.domain}`
+      );
+    }
+  }
+}
+async function selectSandboxEgressGrant(input) {
+  if (!hasEgressCredentialHooks(input.provider)) {
+    return defaultGrantForProvider(input);
+  }
+  const pluginGrant = await selectPluginGrant({
+    ...input.bodyText !== void 0 ? { bodyText: input.bodyText } : {},
+    ...input.operation ? { operation: input.operation } : {},
+    provider: input.provider,
+    method: input.method,
+    upstreamUrl: input.upstreamUrl
+  });
+  if (!pluginGrant) {
+    throw new Error(
+      `Plugin "${input.provider}" grantForEgress must return a grant for sandbox egress`
+    );
+  }
+  return { source: "plugin", grant: pluginGrant };
+}
+function authorizationForSandboxEgressGrant(provider, selection) {
+  return selection.source === "broker" ? oauthAuthorizationForProvider(provider) : void 0;
+}
+async function sandboxEgressCredentialLease(provider, selection, context) {
+  const { grant } = selection;
+  const cached = await getSandboxEgressCredentialLease(
+    provider,
+    grant.name,
+    context
+  );
+  if (cached) {
+    if (selection.source === "plugin" && cached.grant.access !== grant.access) {
+      throw new Error(
+        `Cached credential lease for ${provider}/${grant.name} has ${cached.grant.access} access, but ${grant.access} was selected`
+      );
+    }
+    return {
+      ...cached,
+      grant
+    };
+  }
+  let lease;
+  if (selection.source === "plugin") {
+    const credentialSubject = credentialSubjectFromContext(context);
+    const pluginResult = await issuePluginCredential({
+      provider,
+      grant,
+      actor: context.credentials.actor,
+      ...credentialSubject ? { credentialSubject } : {},
+      userTokenStore: createUserTokenStore()
+    });
+    if (pluginResult.type === "needed") {
+      throw new SandboxEgressCredentialError({
+        provider,
+        grant,
+        kind: "auth_required",
+        authorization: pluginResult.authorization,
+        message: pluginResult.message
+      });
+    }
+    if (pluginResult.type === "unavailable") {
+      throw new SandboxEgressCredentialError({
+        provider,
+        grant,
+        kind: "unavailable",
+        message: pluginResult.message
+      });
+    }
+    lease = pluginResult.lease;
+  } else {
+    try {
+      lease = await issueProviderCredentialLease({
+        context: context.credentials,
+        provider,
+        reason: grant.reason ?? `sandbox-egress:${provider}:default`
+      });
+    } catch (error) {
+      if (error instanceof CredentialUnavailableError) {
+        throw new SandboxEgressCredentialError({
+          provider,
+          grant,
+          kind: "auth_required",
+          authorization: authorizationForSandboxEgressGrant(
+            provider,
+            selection
+          ),
+          message: error.message
+        });
+      }
+      throw error;
+    }
+  }
+  const headerTransforms = lease.headerTransforms ?? [];
+  if (headerTransforms.length === 0) {
+    throw new Error(
+      `Credential lease for ${provider} did not include header transforms`
+    );
+  }
+  const leaseExpiresAtMs = Date.parse(lease.expiresAt);
+  if (!Number.isFinite(leaseExpiresAtMs) || leaseExpiresAtMs <= Date.now()) {
+    throw new Error(`Credential lease for ${provider} is expired`);
+  }
+  const authorization = selection.source === "broker" ? oauthAuthorizationForProvider(provider) : lease.authorization;
+  const cachedLease = {
+    provider,
+    grant,
+    ...lease.account ? { account: lease.account } : {},
+    ...authorization ? { authorization } : {},
+    expiresAt: lease.expiresAt,
+    headerTransforms
+  };
+  assertLeaseTransformsOwnedByProvider(provider, cachedLease);
+  await setSandboxEgressCredentialLease(context, cachedLease);
+  return cachedLease;
+}
+function hasSandboxEgressLeaseTransformForHost(lease, host) {
+  return lease.headerTransforms.some(
+    (transform) => matchesSandboxEgressDomain(host, transform.domain)
+  );
+}
+
+// src/chat/egress/credentialed.ts
+import {
+  EgressAuthRequired,
+  EgressPolicyDenied
+} from "@sentry/junior-plugin-api";
+var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
+  "connection",
+  "host",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
+var PROXY_ONLY_HEADERS = /* @__PURE__ */ new Set([
+  "vercel-sandbox-oidc-token",
+  "vercel-forwarded-host",
+  "vercel-forwarded-scheme",
+  "vercel-forwarded-port",
+  "vercel-forwarded-path"
+]);
+var TRACE_PROPAGATION_HEADERS = /* @__PURE__ */ new Set([
+  "baggage",
+  "sentry-trace",
+  "traceparent"
+]);
+var DECODED_RESPONSE_HEADERS = /* @__PURE__ */ new Set([
+  "content-encoding",
+  "content-length"
+]);
+var UPSTREAM_TOKEN_REJECTION_STATUS = 401;
+var UPSTREAM_PERMISSION_REJECTION_STATUS = 403;
+var GRANT_SELECTION_BODY_TEXT_LIMIT_BYTES = 64 * 1024;
+var RESPONSE_BODY_TEXT_LIMIT_BYTES = 64 * 1024;
+function authRequiredResponse(input) {
+  return new Response(
+    `junior-auth-required provider=${input.provider} grant=${input.grant.name} access=${input.grant.access} 401 unauthorized
+${input.message}`,
+    {
+      status: 401,
+      headers: {
+        "content-type": "text/plain; charset=utf-8",
+        "cache-control": "no-store"
+      }
+    }
+  );
+}
+function policyDeniedResponse(error) {
+  return Response.json(
+    { error: error.message },
+    {
+      status: 403,
+      headers: {
+        "cache-control": "no-store"
+      }
+    }
+  );
+}
+function shouldLogSandboxEgressInfo() {
+  const environment = (process.env.SENTRY_ENVIRONMENT ?? process.env.VERCEL_ENV ?? process.env.NODE_ENV ?? "").trim().toLowerCase();
+  return environment !== "production";
+}
+function egressAttributes(input) {
+  return {
+    ...input.egressId ? { "app.sandbox.egress_id": input.egressId } : {},
+    ...input.provider ? { "app.provider.name": input.provider } : {},
+    ...input.grantName ? { "app.grant.name": input.grantName } : {},
+    ...input.grantAccess ? { "app.grant.access": input.grantAccess } : {},
+    ...input.grantReason ? { "app.grant.reason": input.grantReason } : {},
+    ...input.host ? { "server.address": input.host } : {},
+    ...input.method ? { "http.request.method": input.method } : {},
+    ...input.path ? { "url.path": input.path } : {},
+    ...input.status ? { "http.response.status_code": input.status } : {}
+  };
+}
+function redactedProxyPath(pathname) {
+  if (pathname.startsWith(`${SANDBOX_EGRESS_PROXY_PATH}/`)) {
+    return `${SANDBOX_EGRESS_PROXY_PATH}/<token>`;
+  }
+  return pathname;
+}
+function routingAttributes(request, upstreamUrl) {
+  const proxyUrl = new URL(request.url);
+  const attributes = {
+    "app.sandbox.egress.proxy_path": redactedProxyPath(proxyUrl.pathname)
+  };
+  if (upstreamUrl) {
+    attributes["app.sandbox.egress.upstream_path"] = upstreamUrl.pathname;
+    const gitService = upstreamUrl.searchParams.get("service");
+    if (upstreamUrl.hostname.toLowerCase() === "github.com" && (gitService === "git-upload-pack" || gitService === "git-receive-pack")) {
+      attributes["app.sandbox.egress.git_service"] = gitService;
+    }
+  }
+  return attributes;
+}
+function displayedUpstreamPath(upstreamUrl) {
+  const gitService = upstreamUrl.searchParams.get("service");
+  if (upstreamUrl.hostname.toLowerCase() === "github.com" && (gitService === "git-upload-pack" || gitService === "git-receive-pack")) {
+    return `${upstreamUrl.pathname}?service=${gitService}`;
+  }
+  return upstreamUrl.pathname;
+}
+function upstreamPermissionAttributes(provider, upstream) {
+  if (provider !== "github") {
+    return {};
+  }
+  return {
+    "app.github.accepted_permissions": upstream.headers.get("x-accepted-github-permissions") ?? void 0,
+    "app.github.sso": upstream.headers.get("x-github-sso") ?? void 0
+  };
+}
+function githubPermissionHeaders(upstream) {
+  const acceptedPermissions = upstream.headers.get(
+    "x-accepted-github-permissions"
+  );
+  const sso = upstream.headers.get("x-github-sso");
+  return {
+    ...acceptedPermissions ? { acceptedPermissions } : {},
+    ...sso ? { sso } : {}
+  };
+}
+function permissionDeniedMessage(provider, grant) {
+  return `${provider} returned HTTP 403 after Junior injected the ${grant.name} grant. Junior forwarded the request; this is not a local runtime block.`;
+}
+function isEgressAuthRequired(error) {
+  return error instanceof EgressAuthRequired || error instanceof Error && error.name === "EgressAuthRequired";
+}
+function isEgressPolicyDenied(error) {
+  return error instanceof EgressPolicyDenied || error instanceof Error && error.name === "EgressPolicyDenied";
+}
+function logSandboxEgressUpstreamRequest(input) {
+  if (!shouldLogSandboxEgressInfo()) {
+    return;
+  }
+  logInfo(
+    "sandbox_egress_upstream_request",
+    {},
+    {
+      ...egressAttributes({
+        egressId: input.egressId,
+        grantAccess: input.grantAccess,
+        grantName: input.grantName,
+        grantReason: input.grantReason,
+        host: input.upstreamUrl.hostname,
+        method: input.request.method,
+        path: input.upstreamUrl.pathname,
+        provider: input.provider,
+        status: input.upstream.status
+      }),
+      ...routingAttributes(input.request, input.upstreamUrl),
+      "app.sandbox.egress.upstream_ok": input.upstream.ok
+    },
+    `Sandbox egress ${input.request.method} ${input.upstreamUrl.hostname}${displayedUpstreamPath(input.upstreamUrl)} -> ${input.upstream.status}`
+  );
+}
+async function requestBodyBytes(request) {
+  if (request.method === "GET" || request.method === "HEAD" || request.body === null) {
+    return void 0;
+  }
+  return await request.arrayBuffer();
+}
+function isGrantSelectionBodyVisible(input) {
+  return input.provider === "github" && input.upstreamUrl.hostname.toLowerCase() === "api.github.com" && input.upstreamUrl.pathname.toLowerCase().endsWith("/graphql");
+}
+function grantSelectionBodyText(input) {
+  if (input.body === void 0) {
+    return void 0;
+  }
+  if (input.body.byteLength > GRANT_SELECTION_BODY_TEXT_LIMIT_BYTES) {
+    if (!input.operation && input.provider === "github" && input.request.method.toUpperCase() === "POST" && input.upstreamUrl.hostname.toLowerCase() === "api.github.com" && input.upstreamUrl.pathname.toLowerCase().endsWith("/graphql")) {
+      throw new EgressPolicyDenied(
+        "GitHub GraphQL request body is too large for Junior to inspect before issuing credentials."
+      );
+    }
+    return void 0;
+  }
+  return new TextDecoder().decode(input.body);
+}
+function responseContentLength(upstream) {
+  const raw = upstream.headers.get("content-length");
+  if (!raw) {
+    return void 0;
+  }
+  const parsed = Number(raw);
+  return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : void 0;
+}
+async function responseTextWithinLimit(upstream, maxBytes) {
+  const limit = Math.min(
+    Math.max(0, Math.floor(maxBytes)),
+    RESPONSE_BODY_TEXT_LIMIT_BYTES
+  );
+  if (limit <= 0) {
+    return void 0;
+  }
+  const contentLength = responseContentLength(upstream);
+  if (contentLength !== void 0 && contentLength > limit) {
+    return void 0;
+  }
+  let clone;
+  try {
+    clone = upstream.clone();
+  } catch {
+    return void 0;
+  }
+  const body = clone.body;
+  if (!body) {
+    return "";
+  }
+  const reader = body.getReader();
+  const chunks = [];
+  let bytes = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      if (!value) {
+        continue;
+      }
+      bytes += value.byteLength;
+      if (bytes > limit) {
+        await reader.cancel().catch(() => void 0);
+        return void 0;
+      }
+      chunks.push(value);
+    }
+  } catch {
+    await reader.cancel().catch(() => void 0);
+    return void 0;
+  } finally {
+    reader.releaseLock();
+  }
+  const combined = new Uint8Array(bytes);
+  let offset = 0;
+  for (const chunk of chunks) {
+    combined.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(combined);
+}
+function requestHeaders(request, lease, upstreamHost, tracePropagation) {
+  const headers = new Headers();
+  const mayPropagateTrace = shouldPropagateSandboxEgressTrace(
+    upstreamHost,
+    tracePropagation
+  );
+  request.headers.forEach((value, key) => {
+    const normalized = key.toLowerCase();
+    if (HOP_BY_HOP_HEADERS.has(normalized) || PROXY_ONLY_HEADERS.has(normalized)) {
+      return;
+    }
+    if (TRACE_PROPAGATION_HEADERS.has(normalized) && !mayPropagateTrace) {
+      return;
+    }
+    headers.append(key, value);
+  });
+  for (const transform of lease.headerTransforms) {
+    if (!matchesSandboxEgressDomain(upstreamHost, transform.domain)) {
+      continue;
+    }
+    for (const [key, value] of Object.entries(transform.headers)) {
+      if (TRACE_PROPAGATION_HEADERS.has(key.toLowerCase()) && !mayPropagateTrace) {
+        continue;
+      }
+      headers.set(key, value);
+    }
+  }
+  return headers;
+}
+function responseHeaders(upstream) {
+  const headers = new Headers();
+  upstream.headers.forEach((value, key) => {
+    const normalized = key.toLowerCase();
+    if (!HOP_BY_HOP_HEADERS.has(normalized) && !DECODED_RESPONSE_HEADERS.has(normalized)) {
+      headers.append(key, value);
+    }
+  });
+  return headers;
+}
+function leaseLogAttributes(input) {
+  return {
+    ...egressAttributes({
+      egressId: input.egressId,
+      grantAccess: input.lease.grant.access,
+      grantName: input.lease.grant.name,
+      grantReason: input.lease.grant.reason,
+      host: input.upstreamUrl.hostname,
+      method: input.request.method,
+      path: input.upstreamUrl.pathname,
+      provider: input.provider,
+      status: input.status
+    }),
+    ...routingAttributes(input.request, input.upstreamUrl),
+    ...input.upstream ? upstreamPermissionAttributes(input.provider, input.upstream) : {}
+  };
+}
+async function recordSandboxAuthRequired(input) {
+  await setSandboxEgressAuthRequiredSignal(input.credentialContext, {
+    provider: input.provider,
+    grant: input.grant,
+    kind: input.kind ?? "auth_required",
+    ...input.authorization ? { authorization: input.authorization } : {},
+    message: input.message
+  });
+}
+async function recordSandboxPermissionDenied(input) {
+  await setSandboxEgressPermissionDeniedSignal(input.credentialContext, {
+    provider: input.provider,
+    grant: input.lease.grant,
+    ...input.lease.account ? { account: input.lease.account } : {},
+    message: input.message,
+    source: "upstream",
+    status: input.upstream.status,
+    upstreamHost: input.upstreamUrl.hostname,
+    upstreamPath: displayedUpstreamPath(input.upstreamUrl),
+    ...input.provider === "github" ? githubPermissionHeaders(input.upstream) : {}
+  });
+}
+async function executeCredentialedEgressRequest(input) {
+  const {
+    activeEgressId,
+    credentialContext,
+    deps,
+    operation,
+    provider,
+    request,
+    upstreamUrl
+  } = input;
+  const bodyForGrantSelection = isGrantSelectionBodyVisible({
+    provider,
+    upstreamUrl
+  }) ? await requestBodyBytes(request) : void 0;
+  let grantSelection;
+  try {
+    grantSelection = await selectSandboxEgressGrant({
+      bodyText: grantSelectionBodyText({
+        body: bodyForGrantSelection,
+        ...operation ? { operation } : {},
+        provider,
+        request,
+        upstreamUrl
+      }),
+      ...operation ? { operation } : {},
+      provider,
+      method: request.method,
+      upstreamUrl
+    });
+  } catch (error) {
+    if (isEgressPolicyDenied(error)) {
+      logWarn(
+        "sandbox_egress_policy_denied",
+        {},
+        {
+          ...egressAttributes({
+            egressId: activeEgressId,
+            host: upstreamUrl.hostname,
+            method: request.method,
+            path: upstreamUrl.pathname,
+            provider,
+            status: 403
+          }),
+          ...routingAttributes(request, upstreamUrl)
+        },
+        error.message
+      );
+      return policyDeniedResponse(error);
+    }
+    throw error;
+  }
+  const issueCredentialLease = deps.issueCredentialLease ?? sandboxEgressCredentialLease;
+  const clearCredentialLease = deps.clearCredentialLease ?? clearSandboxEgressCredentialLease;
+  const recordAuthRequired = deps.recordAuthRequired ?? recordSandboxAuthRequired;
+  const recordPermissionDenied = deps.recordPermissionDenied ?? recordSandboxPermissionDenied;
+  let lease;
+  try {
+    lease = await issueCredentialLease(
+      provider,
+      grantSelection,
+      credentialContext
+    );
+  } catch (error) {
+    if (error instanceof SandboxEgressCredentialError) {
+      await recordAuthRequired({
+        credentialContext,
+        provider: error.provider,
+        grant: error.grant,
+        kind: error.kind,
+        authorization: error.authorization,
+        message: error.message
+      });
+      const isAuthRequired = error.kind === "auth_required";
+      logWarn(
+        isAuthRequired ? "sandbox_egress_credential_needed" : "sandbox_egress_credential_unavailable",
+        {},
+        {
+          ...egressAttributes({
+            egressId: activeEgressId,
+            grantAccess: error.grant.access,
+            grantName: error.grant.name,
+            grantReason: error.grant.reason,
+            host: upstreamUrl.hostname,
+            method: request.method,
+            path: upstreamUrl.pathname,
+            provider: error.provider,
+            status: 401
+          }),
+          ...routingAttributes(request, upstreamUrl)
+        },
+        isAuthRequired ? "Sandbox egress grant needs user authorization before issuing a credential lease" : "Sandbox egress credential lease is unavailable for selected grant"
+      );
+      return authRequiredResponse({
+        provider: error.provider,
+        grant: error.grant,
+        message: error.message
+      });
+    }
+    throw error;
+  }
+  const attributes = (status, upstream2) => leaseLogAttributes({
+    egressId: activeEgressId,
+    lease,
+    provider,
+    request,
+    status,
+    ...upstream2 ? { upstream: upstream2 } : {},
+    upstreamUrl
+  });
+  if (!hasSandboxEgressLeaseTransformForHost(lease, upstreamUrl.hostname)) {
+    logWarn(
+      "sandbox_egress_transform_missing",
+      {},
+      {
+        ...attributes(403),
+        "app.sandbox.egress.transform_domains": lease.headerTransforms.map(
+          (transform) => transform.domain
+        )
+      },
+      "Sandbox egress credential lease does not cover forwarded host"
+    );
+    return Response.json(
+      { error: "Credential lease does not cover forwarded host" },
+      { status: 403 }
+    );
+  }
+  const fetchImpl = deps.fetch ?? fetch;
+  const headers = requestHeaders(
+    request,
+    lease,
+    upstreamUrl.hostname,
+    deps.tracePropagation ?? {}
+  );
+  const body = bodyForGrantSelection ?? await requestBodyBytes(request);
+  const intercepted = await deps.interceptHttp?.({
+    provider,
+    request: new Request(upstreamUrl, {
+      method: request.method,
+      headers,
+      ...body !== void 0 ? { body } : {}
+    }),
+    upstreamUrl
+  });
+  if (intercepted) {
+    return intercepted;
+  }
+  const upstream = await fetchImpl(upstreamUrl, {
+    method: request.method,
+    headers,
+    ...body !== void 0 ? { body } : {},
+    redirect: "manual"
+  });
+  try {
+    const effects = await onPluginEgressResponse({
+      provider,
+      grant: lease.grant,
+      method: request.method,
+      ...operation ? { operation } : {},
+      upstreamUrl,
+      response: {
+        headers: new Headers(upstream.headers),
+        readText: async (maxBytes) => await responseTextWithinLimit(upstream, maxBytes),
+        status: upstream.status
+      }
+    });
+    if (effects.permissionDenied) {
+      await recordPermissionDenied({
+        credentialContext,
+        provider,
+        lease,
+        message: effects.permissionDenied.message,
+        upstream,
+        upstreamUrl
+      });
+      logWarn(
+        "sandbox_egress_upstream_permission_classified",
+        {},
+        {
+          ...attributes(upstream.status, upstream)
+        },
+        "Sandbox egress plugin classified upstream response as permission denied"
+      );
+    }
+  } catch (error) {
+    if (!isEgressAuthRequired(error)) {
+      throw error;
+    }
+    await clearCredentialLease(provider, lease.grant.name, credentialContext);
+    await recordAuthRequired({
+      credentialContext,
+      provider,
+      grant: lease.grant,
+      authorization: error.authorization ?? lease.authorization,
+      message: error.message
+    });
+    logWarn(
+      "sandbox_egress_upstream_auth_required_classified",
+      {},
+      {
+        ...attributes(upstream.status, upstream)
+      },
+      "Sandbox egress plugin classified upstream response as auth required"
+    );
+    await upstream.body?.cancel().catch(() => void 0);
+    return authRequiredResponse({
+      provider,
+      grant: lease.grant,
+      message: error.message
+    });
+  }
+  logSandboxEgressUpstreamRequest({
+    egressId: activeEgressId,
+    grantAccess: lease.grant.access,
+    grantName: lease.grant.name,
+    grantReason: lease.grant.reason,
+    provider,
+    request,
+    upstream,
+    upstreamUrl
+  });
+  if (upstream.status >= 400) {
+    logWarn(
+      "sandbox_egress_upstream_error_response",
+      {},
+      {
+        ...attributes(upstream.status, upstream),
+        "error.type": `http_${upstream.status}`
+      },
+      `Sandbox egress upstream returned HTTP ${upstream.status}`
+    );
+  }
+  if (upstream.status === UPSTREAM_TOKEN_REJECTION_STATUS || upstream.status === UPSTREAM_PERMISSION_REJECTION_STATUS) {
+    logWarn(
+      "sandbox_egress_upstream_auth_rejected",
+      {},
+      {
+        ...attributes(upstream.status, upstream),
+        ...upstream.status === UPSTREAM_TOKEN_REJECTION_STATUS ? {
+          "app.sandbox.egress.www_authenticate": upstream.headers.get("www-authenticate") ?? void 0
+        } : {}
+      },
+      upstream.status === UPSTREAM_TOKEN_REJECTION_STATUS ? "Sandbox egress upstream auth rejected injected credential" : "Sandbox egress upstream permission denied"
+    );
+    if (upstream.status === UPSTREAM_TOKEN_REJECTION_STATUS) {
+      await clearCredentialLease(provider, lease.grant.name, credentialContext);
+      await recordAuthRequired({
+        credentialContext,
+        provider,
+        grant: lease.grant,
+        authorization: lease.authorization,
+        message: `Provider rejected the injected ${provider} credential.`
+      });
+      await upstream.body?.cancel().catch(() => void 0);
+      return authRequiredResponse({
+        provider,
+        grant: lease.grant,
+        message: `Provider rejected the injected ${provider} credential.
+`
+      });
+    } else {
+      await clearCredentialLease(provider, lease.grant.name, credentialContext);
+      await recordPermissionDenied({
+        credentialContext,
+        provider,
+        lease,
+        message: permissionDeniedMessage(provider, lease.grant),
+        upstream,
+        upstreamUrl
+      });
+    }
+  }
+  return new Response(upstream.body, {
+    status: upstream.status,
+    statusText: upstream.statusText,
+    headers: responseHeaders(upstream)
+  });
+}
+
+// src/chat/egress/plugin.ts
+function credentialContextForPluginEgress(credentialContext) {
+  return {
+    credentials: credentialContext,
+    contextId: randomUUID4(),
+    egressId: `plugin-egress:${randomUUID4()}`,
+    expiresAtMs: Date.now() + 30 * 60 * 1e3
+  };
+}
+function createPluginEgress(deps) {
+  const credentialContext = deps.credentialContext ? credentialContextForPluginEgress(deps.credentialContext) : void 0;
+  return {
+    async fetch(input) {
+      const operation = input.operation.trim();
+      if (!operation) {
+        throw new Error("Plugin egress operation is required");
+      }
+      if (!credentialContext) {
+        throw new PluginCredentialFailureError(
+          input.provider,
+          `Cannot issue ${input.provider} credentials without a credential context.`
+        );
+      }
+      const upstreamUrl = new URL(input.request.url);
+      if (upstreamUrl.protocol !== "https:") {
+        throw new Error("Plugin egress requires HTTPS provider URLs");
+      }
+      const resolvedProvider = resolveSandboxEgressProviderForHost(
+        upstreamUrl.hostname
+      );
+      if (resolvedProvider !== input.provider) {
+        throw new Error(
+          `Plugin egress provider "${input.provider}" does not own ${upstreamUrl.hostname}`
+        );
+      }
+      return await executeCredentialedEgressRequest({
+        activeEgressId: credentialContext.egressId,
+        credentialContext,
+        deps: {
+          ...deps.fetch ? { fetch: deps.fetch } : {},
+          recordAuthRequired: async (signal) => {
+            await deps.pluginAuth.handleAuthRequired({
+              ...signal.authorization ? { authorization: signal.authorization } : {},
+              grant: signal.grant,
+              kind: signal.kind ?? "auth_required",
+              message: signal.message,
+              provider: signal.provider
+            });
+          },
+          recordPermissionDenied: async () => {
+          },
+          tracePropagation: {}
+        },
+        operation,
+        provider: input.provider,
+        request: input.request,
+        upstreamUrl
+      });
+    }
+  };
+}
+
 // src/chat/respond.ts
 var AGENT_ABORT_SETTLE_GRACE_MS = 5e3;
 function sleep3(ms) {
@@ -11811,6 +12847,23 @@ async function generateAssistantReplyInPrivacyContext(messageText2, context, con
       userText: userInput,
       artifactState: context.artifactState,
       configuration: configurationValues,
+      egress: createPluginEgress({
+        credentialContext: context.credentialContext,
+        pluginAuth: {
+          async handleAuthRequired(signal) {
+            await pluginAuth.maybeHandleAuthSignal({
+              auth_required: {
+                ...signal.authorization ? { authorization: signal.authorization } : {},
+                createdAtMs: Date.now(),
+                grant: signal.grant,
+                kind: signal.kind,
+                message: signal.message,
+                provider: signal.provider
+              }
+            });
+          }
+        }
+      }),
       mcpToolManager: turnMcpToolManager,
       sandbox,
       surface,
@@ -13162,7 +14215,6 @@ export {
   setConfigDefaults,
   getConfigDefaults,
   createUserTokenStore,
-  issueProviderCredentialLease,
   listThreadReplies,
   postSlackMessage,
   deleteSlackMessage,
@@ -13177,14 +14229,8 @@ export {
   startOAuthFlow,
   SANDBOX_EGRESS_PROXY_PATH,
   parseSandboxEgressCredentialToken,
-  setSandboxEgressCredentialLease,
-  getSandboxEgressCredentialLease,
-  clearSandboxEgressCredentialLease,
-  setSandboxEgressAuthRequiredSignal,
-  setSandboxEgressPermissionDeniedSignal,
   normalizeSandboxEgressTracePropagationDomains,
   shouldPropagateSandboxEgressTrace,
-  matchesSandboxEgressDomain,
   resolveSandboxEgressProviderForHost,
   shouldEmitDevAgentTrace,
   AuthorizationFlowDisabledError,
@@ -13215,6 +14261,8 @@ export {
   markTurnFailed,
   isRedundantReactionAckText,
   finalizeMcpAuthorization,
+  resolvePluginOAuthAccount,
+  executeCredentialedEgressRequest,
   generateAssistantReply,
   estimateTextTokens,
   getAgentContextCompactionTriggerTokens,