@sentry/junior 0.81.0 → 0.83.0

package/dist/{chunk-BOMLWLTF.js → chunk-LK53AHO5.js}

@@ -31,7 +31,7 @@ import {
   recordSubagentStarted,
   recordToolExecutionStarted,
   upsertAgentTurnSessionRecord
-} from "./chunk-YA2JCC7G.js";
+} from "./chunk-GK5CITCY.js";
 import {
   createPluginEmbedder,
   createPluginHookRunner,
@@ -42,14 +42,14 @@ import {
   getPlugins,
   getSlackToolContext,
   resolveChannelCapabilities
-} from "./chunk-Y3YUOEAZ.js";
+} from "./chunk-5C3RY6IZ.js";
 import {
   createPluginLogger,
   createPluginState
 } from "./chunk-GUO4EE7L.js";
 import {
   getDb
-} from "./chunk-PQ2U2AO3.js";
+} from "./chunk-QVMLDCVR.js";
 import {
   SANDBOX_DATA_ROOT,
   SANDBOX_SKILLS_ROOT,
@@ -71,7 +71,7 @@ import {
   normalizeSlackConversationId,
   parseDestination,
   withSlackRetries
-} from "./chunk-4XHCVBXH.js";
+} from "./chunk-KZLRUQAA.js";
 import {
   GEN_AI_PROVIDER_NAME,
   GEN_AI_SERVER_ADDRESS,
@@ -122,6 +122,7 @@ import {
   parseSkillInvocation
 } from "./chunk-WCXVEQPI.js";
 import {
+  CredentialUnavailableError,
   credentialContextSchema,
   pluginCatalogRuntime,
   resolveAuthTokenPlaceholder,
@@ -191,7 +192,7 @@ function getConfigDefaults() {
   return cloneDefaults(installDefaults);
 }
 
-// src/chat/sandbox/egress-tracing.ts
+// src/chat/sandbox/egress/tracing.ts
 function isValidDomainPattern(domain) {
   if (domain.includes("*")) {
     return domain.startsWith("*.") && domain.indexOf("*", 1) === -1;
@@ -776,8 +777,8 @@ var StateAdapterTokenStore = class {
   async set(userId, provider, tokens) {
     const parsed = storedTokensSchema.parse(tokens);
     const expiresAt = parsed.refreshTokenExpiresAt ?? parsed.expiresAt;
-    const ttlMs = expiresAt ? Math.max(expiresAt - Date.now() + BUFFER_MS, BUFFER_MS) : LONG_LIVED_TTL_MS;
-    await this.state.set(tokenKey(userId, provider), parsed, ttlMs);
+    const ttlMs2 = expiresAt ? Math.max(expiresAt - Date.now() + BUFFER_MS, BUFFER_MS) : LONG_LIVED_TTL_MS;
+    await this.state.set(tokenKey(userId, provider), parsed, ttlMs2);
   }
   async delete(userId, provider) {
     await this.state.delete(tokenKey(userId, provider));
@@ -3769,9 +3770,476 @@ function createReportProgressTool() {
   });
 }
 
-// src/chat/tools/slack/channel-list-messages.ts
+// src/chat/tools/resource-events.ts
 import { Type as Type13 } from "@sinclair/typebox";
 
+// src/chat/resource-events/store.ts
+import { createHash } from "crypto";
+import { destinationSchema } from "@sentry/junior-plugin-api";
+import { z } from "zod";
+var RESOURCE_EVENT_PREFIX = "junior:resource_event_subscription";
+var INDEX_LOCK_TTL_MS = 1e4;
+var SUBSCRIPTION_LOCK_TTL_MS = 1e4;
+var subscriptionStatusSchema = z.enum(["active", "cancelled", "completed"]);
+var subscriptionIdIndexSchema = z.array(z.string().min(1));
+var subscriptionSchema = z.object({
+  conversationId: z.string().min(1),
+  createdAtMs: z.number().finite(),
+  destination: destinationSchema,
+  events: z.array(z.string().min(1)).min(1),
+  expiresAtMs: z.number().finite(),
+  id: z.string().min(1),
+  intent: z.string().min(1),
+  label: z.string().min(1),
+  provider: z.string().min(1),
+  resourceRef: z.string().min(1),
+  resourceType: z.string().min(1),
+  status: subscriptionStatusSchema,
+  updatedAtMs: z.number().finite()
+}).strict();
+function digest(value) {
+  return createHash("sha256").update(value).digest("hex").slice(0, 32);
+}
+function subscriptionKey(id) {
+  return `${RESOURCE_EVENT_PREFIX}:record:${id}`;
+}
+function subscriptionLockKey(id) {
+  return `${RESOURCE_EVENT_PREFIX}:lock:${id}`;
+}
+function resourceIndexKey(provider, resourceRef) {
+  return `${RESOURCE_EVENT_PREFIX}:resource:${digest(`${provider}\0${resourceRef}`)}`;
+}
+function conversationIndexKey(conversationId) {
+  return `${RESOURCE_EVENT_PREFIX}:conversation:${digest(conversationId)}`;
+}
+function indexLockKey(key) {
+  return `${key}:lock`;
+}
+function ttlUntil(expiresAtMs, nowMs) {
+  return Math.max(1, expiresAtMs - nowMs);
+}
+async function readSubscriptionIdIndex(state, key) {
+  const value = await state.get(key);
+  if (value === void 0 || value === null) {
+    return [];
+  }
+  return subscriptionIdIndexSchema.parse(value);
+}
+function buildSubscriptionId(input) {
+  const eventKey = [...new Set(input.events)].sort().join("\0");
+  return `resub_${digest(
+    `${input.provider}\0${input.resourceRef}\0${input.conversationId}\0${eventKey}`
+  )}`;
+}
+async function withIndexLock(state, key, callback) {
+  const lock = await state.acquireLock(indexLockKey(key), INDEX_LOCK_TTL_MS);
+  if (!lock) {
+    throw new Error(`Could not acquire resource event index lock for ${key}`);
+  }
+  try {
+    return await callback();
+  } finally {
+    await state.releaseLock(lock);
+  }
+}
+async function addToIndex(state, key, subscriptionId, nowMs) {
+  await withIndexLock(state, key, async () => {
+    const ids = [...new Set(await readSubscriptionIdIndex(state, key))];
+    const next = ids.includes(subscriptionId) ? ids : [...ids, subscriptionId];
+    await state.set(key, next, await indexTtlMs(state, next, nowMs));
+  });
+}
+async function removeFromIndex(state, key, subscriptionId, nowMs) {
+  await withIndexLock(state, key, async () => {
+    const existing = await readSubscriptionIdIndex(state, key);
+    const next = existing.filter((id) => id !== subscriptionId);
+    await state.set(key, next, await indexTtlMs(state, next, nowMs));
+  });
+}
+async function indexTtlMs(state, subscriptionIds, nowMs) {
+  const records = await Promise.all(
+    subscriptionIds.map(
+      async (id) => parseSubscription(await state.get(subscriptionKey(id)))
+    )
+  );
+  const latestExpiresAtMs = Math.max(
+    nowMs,
+    ...records.filter(
+      (record) => record !== void 0 && activeAt(record, nowMs)
+    ).map((record) => record.expiresAtMs)
+  );
+  return ttlUntil(latestExpiresAtMs, nowMs);
+}
+function parseSubscription(value) {
+  if (value === void 0 || value === null) {
+    return void 0;
+  }
+  return subscriptionSchema.parse(value);
+}
+function activeAt(subscription, nowMs) {
+  return subscription.status === "active" && subscription.expiresAtMs > nowMs;
+}
+function matchesEvent(subscription, input) {
+  return subscription.provider === input.provider && subscription.resourceRef === input.resourceRef && subscription.events.includes(input.eventType) && activeAt(subscription, input.nowMs);
+}
+async function createResourceEventSubscription(input, options = {}) {
+  const state = options.state ?? getStateAdapter();
+  await state.connect();
+  const nowMs = options.nowMs ?? Date.now();
+  const events = [...new Set(input.events.map((event) => event.trim()))].filter(
+    Boolean
+  );
+  if (events.length === 0) {
+    throw new Error("Resource event subscription requires at least one event");
+  }
+  if (input.expiresAtMs <= nowMs) {
+    throw new Error("Resource event subscription expiry must be in the future");
+  }
+  const id = buildSubscriptionId({
+    conversationId: input.conversationId,
+    events,
+    provider: input.provider,
+    resourceRef: input.resourceRef
+  });
+  const record = {
+    conversationId: input.conversationId,
+    createdAtMs: nowMs,
+    destination: input.destination,
+    events,
+    expiresAtMs: input.expiresAtMs,
+    id,
+    intent: input.intent,
+    label: input.label,
+    provider: input.provider,
+    resourceRef: input.resourceRef,
+    resourceType: input.resourceType,
+    status: "active",
+    updatedAtMs: nowMs
+  };
+  const parsed = subscriptionSchema.parse(record);
+  await state.set(
+    subscriptionKey(id),
+    parsed,
+    ttlUntil(parsed.expiresAtMs, nowMs)
+  );
+  await addToIndex(
+    state,
+    resourceIndexKey(input.provider, input.resourceRef),
+    id,
+    nowMs
+  );
+  await addToIndex(
+    state,
+    conversationIndexKey(input.conversationId),
+    id,
+    nowMs
+  );
+  return parsed;
+}
+async function listResourceEventSubscriptions(input) {
+  const state = input.state ?? getStateAdapter();
+  await state.connect();
+  const nowMs = input.nowMs ?? Date.now();
+  const ids = await readSubscriptionIdIndex(
+    state,
+    conversationIndexKey(input.conversationId)
+  );
+  const records = await Promise.all(
+    ids.map(
+      async (id) => parseSubscription(await state.get(subscriptionKey(id)))
+    )
+  );
+  return records.filter(
+    (record) => record !== void 0 && record.conversationId === input.conversationId && activeAt(record, nowMs)
+  ).sort((left, right) => left.createdAtMs - right.createdAtMs);
+}
+async function cancelResourceEventSubscription(input) {
+  const state = input.state ?? getStateAdapter();
+  await state.connect();
+  const lock = await state.acquireLock(
+    subscriptionLockKey(input.id),
+    SUBSCRIPTION_LOCK_TTL_MS
+  );
+  if (!lock) {
+    throw new Error(`Could not acquire subscription lock for ${input.id}`);
+  }
+  try {
+    const current = parseSubscription(
+      await state.get(subscriptionKey(input.id))
+    );
+    if (!current || current.conversationId !== input.conversationId) {
+      return void 0;
+    }
+    const nowMs = input.nowMs ?? Date.now();
+    const next = {
+      ...current,
+      status: "cancelled",
+      updatedAtMs: nowMs
+    };
+    await state.set(
+      subscriptionKey(input.id),
+      next,
+      JUNIOR_THREAD_STATE_TTL_MS
+    );
+    await removeFromIndex(
+      state,
+      resourceIndexKey(current.provider, current.resourceRef),
+      input.id,
+      nowMs
+    );
+    await removeFromIndex(
+      state,
+      conversationIndexKey(current.conversationId),
+      input.id,
+      nowMs
+    );
+    return next;
+  } finally {
+    await state.releaseLock(lock);
+  }
+}
+async function findMatchingResourceEventSubscriptions(input) {
+  const state = input.state ?? getStateAdapter();
+  await state.connect();
+  const nowMs = input.nowMs ?? Date.now();
+  const ids = await readSubscriptionIdIndex(
+    state,
+    resourceIndexKey(input.provider, input.resourceRef)
+  );
+  const records = await Promise.all(
+    ids.map(
+      async (id) => parseSubscription(await state.get(subscriptionKey(id)))
+    )
+  );
+  return records.filter(
+    (record) => record !== void 0 && matchesEvent(record, {
+      eventType: input.eventType,
+      nowMs,
+      provider: input.provider,
+      resourceRef: input.resourceRef
+    })
+  );
+}
+async function deliverResourceEventSubscription(input) {
+  const state = input.state ?? getStateAdapter();
+  await state.connect();
+  const lock = await state.acquireLock(
+    subscriptionLockKey(input.subscription.id),
+    SUBSCRIPTION_LOCK_TTL_MS
+  );
+  if (!lock) {
+    throw new Error(
+      `Resource event subscription delivery lock busy: ${input.subscription.id}`
+    );
+  }
+  try {
+    const nowMs = input.nowMs ?? Date.now();
+    const current = parseSubscription(
+      await state.get(subscriptionKey(input.subscription.id))
+    );
+    if (!current || !matchesEvent(current, {
+      eventType: input.eventType,
+      nowMs,
+      provider: input.provider,
+      resourceRef: input.resourceRef
+    })) {
+      return false;
+    }
+    const delivered = await input.deliver(current);
+    if (input.terminal) {
+      const latest = parseSubscription(
+        await state.get(subscriptionKey(current.id))
+      );
+      if (!latest || latest.status !== current.status || latest.updatedAtMs !== current.updatedAtMs) {
+        return delivered;
+      }
+      const next = {
+        ...current,
+        status: "completed",
+        updatedAtMs: nowMs
+      };
+      await state.set(
+        subscriptionKey(current.id),
+        next,
+        JUNIOR_THREAD_STATE_TTL_MS
+      );
+      await removeFromIndex(
+        state,
+        resourceIndexKey(current.provider, current.resourceRef),
+        current.id,
+        nowMs
+      );
+      await removeFromIndex(
+        state,
+        conversationIndexKey(current.conversationId),
+        current.id,
+        nowMs
+      );
+    }
+    return delivered;
+  } finally {
+    await state.releaseLock(lock);
+  }
+}
+
+// src/chat/tools/resource-events.ts
+var DEFAULT_TTL_MS = 14 * 24 * 60 * 60 * 1e3;
+var MAX_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+var subscribeInputSchema = Type13.Object(
+  {
+    resourceRef: Type13.String({
+      description: "Opaque resource ref copied from a subscribable tool result."
+    }),
+    provider: Type13.String({
+      description: "Provider that owns the resource ref."
+    }),
+    resourceType: Type13.String({
+      description: "Provider-defined resource type from the subscribable hint."
+    }),
+    label: Type13.String({
+      description: "Human-readable resource label from the subscribable hint."
+    }),
+    events: Type13.Array(Type13.String(), {
+      description: "High-signal event names to deliver to this conversation when they occur.",
+      minItems: 1
+    }),
+    intent: Type13.String({
+      description: "Concise reason this conversation wants these events, used when an event arrives."
+    }),
+    ttlMs: Type13.Optional(
+      Type13.Number({
+        description: "How long to keep the subscription active. Defaults to 14 days and is capped at 30 days."
+      })
+    )
+  },
+  { additionalProperties: false }
+);
+var cancelInputSchema = Type13.Object(
+  {
+    subscriptionId: Type13.String({
+      description: "Subscription id returned by subscribeToResourceEvents or listResourceEventSubscriptions."
+    })
+  },
+  { additionalProperties: false }
+);
+function requireConversationContext(context) {
+  if (!context.conversationId) {
+    throw new Error("Resource event subscriptions require a conversation");
+  }
+  if (context.destination.platform !== "slack") {
+    throw new Error(
+      "Resource event subscriptions currently require Slack delivery"
+    );
+  }
+  if (!isSlackThreadConversationId(context.conversationId)) {
+    throw new Error(
+      "Resource event subscriptions require a Slack thread conversation"
+    );
+  }
+  return context.conversationId;
+}
+function canUseResourceEventSubscriptionTools(context) {
+  return context.destination.platform === "slack" && Boolean(
+    context.conversationId && isSlackThreadConversationId(context.conversationId)
+  );
+}
+function isSlackThreadConversationId(conversationId) {
+  const parts = conversationId.split(":");
+  return parts.length === 3 && parts[0] === "slack" && Boolean(parts[1]) && Boolean(parts[2]);
+}
+function cleanStrings(values) {
+  return [...new Set(values.map((value) => value.trim()).filter(Boolean))];
+}
+function ttlMs(input) {
+  if (input.ttlMs === void 0) {
+    return DEFAULT_TTL_MS;
+  }
+  if (!Number.isFinite(input.ttlMs) || input.ttlMs <= 0) {
+    throw new Error("ttlMs must be a positive finite number");
+  }
+  return Math.min(input.ttlMs, MAX_TTL_MS);
+}
+function createSubscribeToResourceEventsTool(context) {
+  return tool({
+    description: "Subscribe the current conversation to high-signal events for a resource returned by a subscribable tool result. Matching events are queued as normal conversation messages; they do not interrupt active work.",
+    inputSchema: subscribeInputSchema,
+    async execute(input) {
+      const conversationId = requireConversationContext(context);
+      const events = cleanStrings(input.events);
+      const intent = input.intent.trim();
+      if (!intent) {
+        throw new Error("intent is required");
+      }
+      const nowMs = Date.now();
+      const subscription = await createResourceEventSubscription({
+        conversationId,
+        destination: context.destination,
+        events,
+        expiresAtMs: nowMs + ttlMs(input),
+        intent,
+        label: input.label.trim(),
+        provider: input.provider.trim(),
+        resourceRef: input.resourceRef.trim(),
+        resourceType: input.resourceType.trim()
+      });
+      return {
+        id: subscription.id,
+        status: subscription.status,
+        resourceRef: subscription.resourceRef,
+        events: subscription.events,
+        expiresAtMs: subscription.expiresAtMs
+      };
+    }
+  });
+}
+function createListResourceEventSubscriptionsTool(context) {
+  return tool({
+    description: "List active resource event subscriptions for the current conversation.",
+    inputSchema: Type13.Object({}, { additionalProperties: false }),
+    async execute() {
+      const conversationId = requireConversationContext(context);
+      const subscriptions = await listResourceEventSubscriptions({
+        conversationId
+      });
+      return {
+        subscriptions: subscriptions.map((subscription) => ({
+          id: subscription.id,
+          label: subscription.label,
+          resourceRef: subscription.resourceRef,
+          provider: subscription.provider,
+          resourceType: subscription.resourceType,
+          events: subscription.events,
+          intent: subscription.intent,
+          expiresAtMs: subscription.expiresAtMs
+        }))
+      };
+    }
+  });
+}
+function createCancelResourceEventSubscriptionTool(context) {
+  return tool({
+    description: "Cancel a resource event subscription for the current conversation.",
+    inputSchema: cancelInputSchema,
+    async execute(input) {
+      const conversationId = requireConversationContext(context);
+      const subscription = await cancelResourceEventSubscription({
+        conversationId,
+        id: input.subscriptionId
+      });
+      if (!subscription) {
+        throw new Error("Resource event subscription was not found");
+      }
+      return {
+        id: subscription.id,
+        status: subscription.status
+      };
+    }
+  });
+}
+
+// src/chat/tools/slack/channel-list-messages.ts
+import { Type as Type14 } from "@sinclair/typebox";
+
 // src/chat/slack/channel.ts
 async function listChannelMessages(input) {
   const client = getSlackClient();
@@ -3861,39 +4329,39 @@ function createSlackChannelListMessagesTool(context) {
   return tool({
     description: "List channel messages from Slack history in the active channel context. Use when the user asks for recent or historical channel context outside this thread. Do not use for live monitoring or when current thread context already answers the question.",
     annotations: { readOnlyHint: true, destructiveHint: false },
-    inputSchema: Type13.Object({
-      limit: Type13.Optional(
-        Type13.Integer({
+    inputSchema: Type14.Object({
+      limit: Type14.Optional(
+        Type14.Integer({
           minimum: 1,
           maximum: 1e3,
           description: "Maximum number of messages to return across pages."
         })
       ),
-      cursor: Type13.Optional(
-        Type13.String({
+      cursor: Type14.Optional(
+        Type14.String({
           minLength: 1,
           description: "Optional cursor to continue from a prior call."
         })
       ),
-      oldest: Type13.Optional(
-        Type13.String({
+      oldest: Type14.Optional(
+        Type14.String({
           minLength: 1,
           description: "Optional oldest message timestamp (Slack ts) for range filtering."
         })
       ),
-      latest: Type13.Optional(
-        Type13.String({
+      latest: Type14.Optional(
+        Type14.String({
           minLength: 1,
           description: "Optional latest message timestamp (Slack ts) for range filtering."
         })
       ),
-      inclusive: Type13.Optional(
-        Type13.Boolean({
+      inclusive: Type14.Optional(
+        Type14.Boolean({
           description: "Whether oldest/latest bounds should be inclusive."
         })
       ),
-      max_pages: Type13.Optional(
-        Type13.Integer({
+      max_pages: Type14.Optional(
+        Type14.Integer({
           minimum: 1,
           maximum: 10,
           description: "Maximum number of API pages to traverse in a single call."
@@ -3953,7 +4421,7 @@ function createSlackChannelListMessagesTool(context) {
 }
 
 // src/chat/tools/slack/channel-post-message.ts
-import { Type as Type14 } from "@sinclair/typebox";
+import { Type as Type15 } from "@sinclair/typebox";
 
 // src/chat/slack/outbound.ts
 var MAX_SLACK_MESSAGE_TEXT_CHARS = 4e4;
@@ -3997,7 +4465,13 @@ async function getPermalinkBestEffort(args) {
         message_ts: args.messageTs
       }),
       3,
-      { action: "chat.getPermalink" }
+      {
+        action: "chat.getPermalink",
+        spanAttributes: {
+          "app.slack.channel_id": args.channelId,
+          "app.slack.message_ts": args.messageTs
+        }
+      }
     );
     return response.permalink;
   } catch {
@@ -4024,7 +4498,13 @@ async function postSlackMessage(input) {
       ...threadTs ? { thread_ts: threadTs } : {}
     }),
     3,
-    { action: "chat.postMessage" }
+    {
+      action: "chat.postMessage",
+      spanAttributes: {
+        "app.slack.channel_id": channelId,
+        ...threadTs ? { "app.slack.thread_ts": threadTs } : {}
+      }
+    }
   );
   if (!response.ts) {
     throw new Error("Slack message posted without ts");
@@ -4054,7 +4534,13 @@ async function deleteSlackMessage(input) {
       ts: timestamp
     }),
     3,
-    { action: "chat.delete" }
+    {
+      action: "chat.delete",
+      spanAttributes: {
+        "app.slack.channel_id": channelId,
+        "app.slack.message_ts": timestamp
+      }
+    }
   );
 }
 async function postSlackEphemeralMessage(input) {
@@ -4082,7 +4568,14 @@ async function postSlackEphemeralMessage(input) {
       ...threadTs ? { thread_ts: threadTs } : {}
     }),
     3,
-    { action: "chat.postEphemeral" }
+    {
+      action: "chat.postEphemeral",
+      spanAttributes: {
+        "app.slack.channel_id": channelId,
+        "app.slack.user_id": userId,
+        ...threadTs ? { "app.slack.thread_ts": threadTs } : {}
+      }
+    }
   );
   return {
     messageTs: response.message_ts
@@ -4119,7 +4612,13 @@ async function uploadFilesToThread(input) {
       file_uploads: fileUploads
     }),
     3,
-    { action: "filesUploadV2" }
+    {
+      action: "filesUploadV2",
+      spanAttributes: {
+        "app.slack.channel_id": channelId,
+        "app.slack.thread_ts": threadTs
+      }
+    }
   );
 }
 async function addReactionToMessage(input) {
@@ -4143,7 +4642,14 @@ async function addReactionToMessage(input) {
         name: emoji
       }),
       3,
-      { action: "reactions.add" }
+      {
+        action: "reactions.add",
+        spanAttributes: {
+          "app.slack.channel_id": channelId,
+          "app.slack.message_ts": timestamp,
+          "app.slack.reaction": emoji
+        }
+      }
     );
   } catch (error) {
     if (error instanceof SlackActionError && error.code === "already_reacted") {
@@ -4174,7 +4680,14 @@ async function removeReactionFromMessage(input) {
         name: emoji
       }),
       3,
-      { action: "reactions.remove" }
+      {
+        action: "reactions.remove",
+        spanAttributes: {
+          "app.slack.channel_id": channelId,
+          "app.slack.message_ts": timestamp,
+          "app.slack.reaction": emoji
+        }
+      }
     );
   } catch (error) {
     if (error instanceof SlackActionError && error.code === "no_reaction") {
@@ -4205,8 +4718,8 @@ function createOperationKey(toolName, input) {
 function createSlackChannelPostMessageTool(context, state) {
   return tool({
     description: "Post a new top-level message to the current Slack channel. Use only when the user explicitly asks to post/send/share/say something to the channel. Do not use for thread replies, inline @mentions, or pinging mentioned users.",
-    inputSchema: Type14.Object({
-      text: Type14.String({
+    inputSchema: Type15.Object({
+      text: Type15.String({
         minLength: 1,
         maxLength: 4e4,
         description: "Slack mrkdwn text to post."
@@ -4246,12 +4759,12 @@ function createSlackChannelPostMessageTool(context, state) {
 }
 
 // src/chat/tools/slack/message-add-reaction.ts
-import { Type as Type15 } from "@sinclair/typebox";
+import { Type as Type16 } from "@sinclair/typebox";
 function createSlackMessageAddReactionTool(context, state) {
   return tool({
     description: "Add an emoji reaction to the current inbound Slack message. Use sparingly for lightweight acknowledgements. Provide a Slack emoji alias name (for example `thumbsup`, `white_check_mark`, or `thumbsup::skin-tone-6`), not a unicode emoji glyph. The target message is injected by runtime context; do not use this for arbitrary historical messages.",
-    inputSchema: Type15.Object({
-      emoji: Type15.String({
+    inputSchema: Type16.Object({
+      emoji: Type16.String({
         minLength: 1,
         maxLength: 64,
         description: "Slack emoji alias name to react with (for example `thumbsup`, `white_check_mark`, or `thumbsup::skin-tone-6`). Optional surrounding colons are allowed."
@@ -4303,7 +4816,7 @@ function createSlackMessageAddReactionTool(context, state) {
 }
 
 // src/chat/tools/slack/canvas-tools.ts
-import { Type as Type16 } from "@sinclair/typebox";
+import { Type as Type17 } from "@sinclair/typebox";
 
 // src/chat/slack/canvas-references.ts
 var SLACK_FILE_ID_PATTERN = /^F[A-Z0-9]{4,}$/i;
@@ -4548,13 +5061,13 @@ function resolveCanvasTarget(canvas) {
   }
   return { ok: true, canvasId };
 }
-var editReplacementSchema2 = Type16.Object(
+var editReplacementSchema2 = Type17.Object(
   {
-    oldText: Type16.String({
+    oldText: Type17.String({
       minLength: 1,
       description: "Exact Canvas markdown to replace. It must be unique in the current Canvas body and must not overlap another edit."
     }),
-    newText: Type16.String({
+    newText: Type17.String({
       description: "Replacement Canvas markdown for this edit."
     })
   },
@@ -4563,13 +5076,13 @@ var editReplacementSchema2 = Type16.Object(
 function createSlackCanvasCreateTool(context, state) {
   return tool({
     description: "Create a Slack canvas for long-form output in the active assistant context channel. Use when the answer is better as a reusable document than a thread reply: long-form research, timelines, bios/profiles, structured notes, plans, comparisons, or anything likely to exceed one compact Slack reply. After creating it, reply with one or two short sentences plus the canvas link; do not recap the canvas contents. Do not use for short answers that fit cleanly in one normal thread reply.",
-    inputSchema: Type16.Object({
-      title: Type16.String({
+    inputSchema: Type17.Object({
+      title: Type17.String({
         minLength: 1,
         maxLength: 160,
         description: "Canvas title."
       }),
-      markdown: Type16.String({
+      markdown: Type17.String({
         minLength: 1,
         description: "Canvas markdown body content."
       })
@@ -4635,20 +5148,20 @@ function createSlackCanvasReadTool() {
   return tool({
     description: "Read a bounded line range from a Slack canvas as markdown. Use when you need exact Canvas contents to verify facts or make edits safely. Do not use for generic web pages \u2014 use webFetch for those.",
     annotations: { readOnlyHint: true, destructiveHint: false },
-    inputSchema: Type16.Object(
+    inputSchema: Type17.Object(
       {
-        canvas: Type16.String({
+        canvas: Type17.String({
           minLength: 1,
           description: "Canvas/file ID (e.g. `F0ABCDEF`) or Slack canvas/docs URL (e.g. `https://team.slack.com/docs/T.../F...`)."
         }),
-        offset: Type16.Optional(
-          Type16.Integer({
+        offset: Type17.Optional(
+          Type17.Integer({
             minimum: 1,
             description: "1-indexed line number to start reading from."
           })
         ),
-        limit: Type16.Optional(
-          Type16.Integer({
+        limit: Type17.Optional(
+          Type17.Integer({
             minimum: 1,
             description: "Maximum number of lines to read. Defaults to 1000."
           })
@@ -4709,13 +5222,13 @@ function createSlackCanvasEditTool(state) {
     description: "Edit one Slack canvas with exact markdown replacements. Use for precise changes to existing Canvas content; prefer this over slackCanvasWrite for targeted changes. Each oldText must match exactly, be unique, and not overlap another edit. Returns a diff. Multiple changes to the same canvas: use one edits[] call.",
     prepareArguments: prepareCanvasEditArguments,
     executionMode: "sequential",
-    inputSchema: Type16.Object(
+    inputSchema: Type17.Object(
       {
-        canvas: Type16.String({
+        canvas: Type17.String({
           minLength: 1,
           description: "Canvas/file ID (e.g. `F0ABCDEF`) or Slack canvas/docs URL."
         }),
-        edits: Type16.Array(editReplacementSchema2, {
+        edits: Type17.Array(editReplacementSchema2, {
           minItems: 1,
           description: "Exact replacements matched against the current Canvas body, not incrementally."
         })
@@ -4795,13 +5308,13 @@ function createSlackCanvasWriteTool(state) {
   return tool({
     description: "Write UTF-8 markdown content to a Slack canvas. Use for deliberate full-Canvas replacement after validation; use slackCanvasEdit for targeted changes to existing canvas content.",
     executionMode: "sequential",
-    inputSchema: Type16.Object(
+    inputSchema: Type17.Object(
       {
-        canvas: Type16.String({
+        canvas: Type17.String({
           minLength: 1,
           description: "Canvas/file ID (e.g. `F0ABCDEF`) or Slack canvas/docs URL."
         }),
-        content: Type16.String({
+        content: Type17.String({
           description: "UTF-8 markdown content to write."
         })
       },
@@ -4862,7 +5375,7 @@ function createSlackCanvasWriteTool(state) {
 }
 
 // src/chat/tools/slack/list-tools.ts
-import { Type as Type17 } from "@sinclair/typebox";
+import { Type as Type18 } from "@sinclair/typebox";
 
 // src/chat/tools/slack/lists.ts
 function normalizeKey(value) {
@@ -4918,7 +5431,9 @@ async function createTodoList(name) {
       name,
       schema: DEFAULT_TODO_SCHEMA,
       todo_mode: true
-    })
+    }),
+    3,
+    { action: "slackLists.create" }
   );
   if (!result.list_id) {
     throw new Error("Slack list was created without list_id");
@@ -4964,7 +5479,9 @@ async function addListItems(input) {
       () => client.slackLists.items.create({
         list_id: input.listId,
         initial_fields: initialFields
-      })
+      }),
+      3,
+      { action: "slackLists.items.create" }
     );
     if (response.item?.id) {
       createdItemIds.push(response.item.id);
@@ -4986,7 +5503,9 @@ async function listItems(listId, limit = 100) {
         list_id: listId,
         limit: cappedLimit,
         cursor
-      })
+      }),
+      3,
+      { action: "slackLists.items.list" }
     );
     const remaining = cappedLimit - items.length;
     if (remaining <= 0) {
@@ -5028,7 +5547,9 @@ async function updateListItem(input) {
     () => client.slackLists.items.update({
       list_id: input.listId,
       cells
-    })
+    }),
+    3,
+    { action: "slackLists.items.update" }
   );
 }
 
@@ -5036,8 +5557,8 @@ async function updateListItem(input) {
 function createSlackListCreateTool(state) {
   return tool({
     description: "Create a Slack todo list for action tracking. Use when the user needs structured tasks with ownership/completion tracking. Do not use for one-off notes without task management needs.",
-    inputSchema: Type17.Object({
-      name: Type17.String({
+    inputSchema: Type18.Object({
+      name: Type18.String({
         minLength: 1,
         maxLength: 160,
         description: "Name for the new Slack list."
@@ -5072,20 +5593,20 @@ function createSlackListCreateTool(state) {
 function createSlackListAddItemsTool(state) {
   return tool({
     description: "Add tasks to the active Slack list tracked in artifact context. Use when the user wants actionable items recorded in the current thread list. Do not use when no list exists and list creation was not requested.",
-    inputSchema: Type17.Object({
-      items: Type17.Array(Type17.String({ minLength: 1 }), {
+    inputSchema: Type18.Object({
+      items: Type18.Array(Type18.String({ minLength: 1 }), {
         minItems: 1,
         maxItems: 25,
         description: "List item titles to create."
       }),
-      assignee_user_id: Type17.Optional(
-        Type17.String({
+      assignee_user_id: Type18.Optional(
+        Type18.String({
           minLength: 1,
           description: "Optional Slack user ID assigned to all created items."
         })
       ),
-      due_date: Type17.Optional(
-        Type17.String({
+      due_date: Type18.Optional(
+        Type18.String({
           pattern: "^\\d{4}-\\d{2}-\\d{2}$",
           description: "Optional due date in YYYY-MM-DD format."
         })
@@ -5135,9 +5656,9 @@ function createSlackListGetItemsTool(state) {
   return tool({
     description: "Read items from the active Slack list tracked in artifact context. Use when the user asks for task status, open items, or list contents. Do not use when list state is already known from the immediately prior result.",
     annotations: { readOnlyHint: true, destructiveHint: false },
-    inputSchema: Type17.Object({
-      limit: Type17.Optional(
-        Type17.Integer({
+    inputSchema: Type18.Object({
+      limit: Type18.Optional(
+        Type18.Integer({
           minimum: 1,
           maximum: 200,
           description: "Maximum number of list items to return."
@@ -5162,19 +5683,19 @@ function createSlackListGetItemsTool(state) {
 function createSlackListUpdateItemTool(state) {
   return tool({
     description: "Update an item in the active Slack list tracked in artifact context (title/completion). Use when the user asks to mark progress or rename a tracked task. Do not use to add new tasks.",
-    inputSchema: Type17.Object(
+    inputSchema: Type18.Object(
       {
-        item_id: Type17.String({
+        item_id: Type18.String({
           minLength: 1,
           description: "ID of the Slack list item to update."
         }),
-        completed: Type17.Optional(
-          Type17.Boolean({
+        completed: Type18.Optional(
+          Type18.Boolean({
             description: "Optional completion status update."
           })
         ),
-        title: Type17.Optional(
-          Type17.String({
+        title: Type18.Optional(
+          Type18.String({
             minLength: 1,
             description: "Optional new item title."
           })
@@ -5224,7 +5745,7 @@ function createSlackListUpdateItemTool(state) {
 }
 
 // src/chat/tools/slack/thread-read.ts
-import { Type as Type18 } from "@sinclair/typebox";
+import { Type as Type19 } from "@sinclair/typebox";
 
 // src/chat/tools/slack/slack-message-url.ts
 var SLACK_HOST_PATTERN = /^[a-z0-9-]+\.slack(?:-gov)?\.com$/;
@@ -5406,34 +5927,34 @@ function createSlackThreadReadTool(context) {
   return tool({
     description: "Read a Slack thread from a shared Slack message archive URL or explicit channel + timestamp. Use when the user shares a Slack message link (https://*.slack.com/archives/...) and you need the referenced message and its thread context. Public channel links can be read if the bot has access; private channels and DMs are only readable when they are the current conversation.",
     annotations: { readOnlyHint: true, destructiveHint: false },
-    inputSchema: Type18.Object({
-      url: Type18.Optional(
-        Type18.String({
+    inputSchema: Type19.Object({
+      url: Type19.Optional(
+        Type19.String({
           minLength: 1,
           description: "Slack message archive URL, e.g. https://workspace.slack.com/archives/C123/p1700000000123456"
         })
       ),
-      channel_id: Type18.Optional(
-        Type18.String({
+      channel_id: Type19.Optional(
+        Type19.String({
           minLength: 1,
           description: "Slack channel/conversation ID (e.g. C123). Use with `ts` as an alternative to `url`."
         })
       ),
-      ts: Type18.Optional(
-        Type18.String({
+      ts: Type19.Optional(
+        Type19.String({
           minLength: 1,
           description: "Slack message timestamp (e.g. 1700000000.123456). May be the thread root or any message in the thread."
         })
       ),
-      limit: Type18.Optional(
-        Type18.Integer({
+      limit: Type19.Optional(
+        Type19.Integer({
           minimum: 1,
           maximum: 1e3,
           description: "Maximum number of thread messages to fetch."
         })
       ),
-      max_pages: Type18.Optional(
-        Type18.Integer({
+      max_pages: Type19.Optional(
+        Type19.Integer({
           minimum: 1,
           maximum: 10,
           description: "Maximum number of Slack API pages to traverse."
@@ -5528,7 +6049,7 @@ function createSlackThreadReadTool(context) {
 }
 
 // src/chat/tools/slack/user-lookup.ts
-import { Type as Type19 } from "@sinclair/typebox";
+import { Type as Type20 } from "@sinclair/typebox";
 
 // src/chat/slack/users.ts
 function normalizeUser(raw) {
@@ -5674,41 +6195,41 @@ function createSlackUserLookupTool() {
   return tool({
     description: "Look up Slack user profiles by user ID, email, or name search. Use when you need to identify a user, resolve cross-platform identity, or look up profile details like title or status. Returns profile fields including custom fields. For user ID lookup, pass a Slack user ID (e.g. U039RR91S). For search, pass a name query.",
     annotations: { readOnlyHint: true, destructiveHint: false },
-    inputSchema: Type19.Object({
-      user_id: Type19.Optional(
-        Type19.String({
+    inputSchema: Type20.Object({
+      user_id: Type20.Optional(
+        Type20.String({
           minLength: 1,
           description: "Slack user ID to look up (e.g. U039RR91S). Mutually exclusive with email and query."
         })
       ),
-      email: Type19.Optional(
-        Type19.String({
+      email: Type20.Optional(
+        Type20.String({
           minLength: 3,
           description: "Email address to look up. Mutually exclusive with user_id and query."
         })
       ),
-      query: Type19.Optional(
-        Type19.String({
+      query: Type20.Optional(
+        Type20.String({
           minLength: 2,
           description: "Name to search for (matches against username, display name, real name). Mutually exclusive with user_id and email."
         })
       ),
-      limit: Type19.Optional(
-        Type19.Integer({
+      limit: Type20.Optional(
+        Type20.Integer({
           minimum: 1,
           maximum: 20,
           description: "Maximum number of results to return for name search. Defaults to 10."
         })
       ),
-      max_pages: Type19.Optional(
-        Type19.Integer({
+      max_pages: Type20.Optional(
+        Type20.Integer({
           minimum: 1,
           maximum: 5,
           description: "Maximum number of Slack API pages to scan for name search. Defaults to 3."
         })
       ),
-      include_bots: Type19.Optional(
-        Type19.Boolean({
+      include_bots: Type20.Optional(
+        Type20.Boolean({
           description: "Include bot accounts in name search results. Defaults to false."
         })
       )
@@ -5787,12 +6308,12 @@ function createSlackUserLookupTool() {
 }
 
 // src/chat/tools/system-time.ts
-import { Type as Type20 } from "@sinclair/typebox";
+import { Type as Type21 } from "@sinclair/typebox";
 function createSystemTimeTool() {
   return tool({
     description: "Return current system time in UTC and local ISO formats. Use when the user asks for current time/date context. Do not use as a substitute for historical or timezone-conversion research.",
     annotations: { readOnlyHint: true, destructiveHint: false },
-    inputSchema: Type20.Object({}),
+    inputSchema: Type21.Object({}),
     execute: async () => {
       const now = /* @__PURE__ */ new Date();
       return {
@@ -5810,7 +6331,7 @@ function createSystemTimeTool() {
 import {
   Agent
 } from "@earendil-works/pi-agent-core";
-import { Type as Type21 } from "@sinclair/typebox";
+import { Type as Type22 } from "@sinclair/typebox";
 import { THREAD_STATE_TTL_MS } from "chat";
 
 // src/chat/tools/advisor/session-store.ts
@@ -5898,12 +6419,12 @@ function createAdvisorTool(context) {
   const spanContext = context.logContext ?? {};
   return tool({
     description: ADVISOR_TOOL_DESCRIPTION,
-    inputSchema: Type21.Object({
-      question: Type21.String({
+    inputSchema: Type22.Object({
+      question: Type22.String({
         minLength: 1,
         description: "Focused advisor question or decision point."
       }),
-      context: Type21.String({
+      context: Type22.String({
         minLength: 1,
         description: "Curated evidence packet: relevant requirements, constraints, current plan, alternatives, code snippets, diffs, command output, and open questions."
       })
@@ -6079,7 +6600,7 @@ function createAdvisorTool(context) {
 }
 
 // src/chat/tools/web/fetch-tool.ts
-import { Type as Type22 } from "@sinclair/typebox";
+import { Type as Type23 } from "@sinclair/typebox";
 
 // src/chat/tools/web/constants.ts
 var USER_AGENT = "junior-bot/0.1";
@@ -6524,13 +7045,13 @@ function createWebFetchTool(hooks) {
       destructiveHint: false,
       openWorldHint: true
     },
-    inputSchema: Type22.Object({
-      url: Type22.String({
+    inputSchema: Type23.Object({
+      url: Type23.String({
         minLength: 1,
         description: "HTTP(S) URL to fetch."
       }),
-      max_chars: Type22.Optional(
-        Type22.Integer({
+      max_chars: Type23.Optional(
+        Type23.Integer({
           minimum: 500,
           maximum: MAX_FETCH_CHARS,
           description: "Optional maximum number of extracted characters to return."
@@ -6594,7 +7115,7 @@ function createWebFetchTool(hooks) {
 import { generateText } from "ai";
 import { createGatewayProvider } from "@ai-sdk/gateway";
 import { getModel } from "@earendil-works/pi-ai";
-import { Type as Type23 } from "@sinclair/typebox";
+import { Type as Type24 } from "@sinclair/typebox";
 var SEARCH_TIMEOUT_MS = 6e4;
 var MAX_RESULTS2 = 5;
 var DEFAULT_SEARCH_MODEL = getModel("vercel-ai-gateway", "openai/gpt-5.4").id;
@@ -6642,14 +7163,14 @@ function createWebSearchTool(override) {
       destructiveHint: false,
       openWorldHint: true
     },
-    inputSchema: Type23.Object({
-      query: Type23.String({
+    inputSchema: Type24.Object({
+      query: Type24.String({
         minLength: 1,
         maxLength: 500,
         description: "Search query."
       }),
-      max_results: Type23.Optional(
-        Type23.Integer({
+      max_results: Type24.Optional(
+        Type24.Integer({
           minimum: 1,
           maximum: MAX_RESULTS2,
           description: "Max results to return."
@@ -6721,18 +7242,18 @@ function createWebSearchTool(override) {
 }
 
 // src/chat/tools/sandbox/write-file.ts
-import { Type as Type24 } from "@sinclair/typebox";
+import { Type as Type25 } from "@sinclair/typebox";
 function createWriteFileTool() {
   return tool({
     description: "Write UTF-8 content to a file in the sandbox workspace. Use for intentional file creation or deliberate full-file replacement after validation; use editFile instead for targeted changes to existing files. Do not use for exploratory analysis-only turns.",
     executionMode: "sequential",
-    inputSchema: Type24.Object(
+    inputSchema: Type25.Object(
       {
-        path: Type24.String({
+        path: Type25.String({
           minLength: 1,
           description: "Path to write in the sandbox workspace."
         }),
-        content: Type24.String({
+        content: Type25.String({
           description: "UTF-8 file content to write."
         })
       },
@@ -6801,6 +7322,11 @@ function createTools(availableSkills, hooks = {}, context) {
   if (context.advisor) {
     tools.advisor = createAdvisorTool(context.advisor);
   }
+  if (canUseResourceEventSubscriptionTools(context)) {
+    tools.subscribeToResourceEvents = createSubscribeToResourceEventsTool(context);
+    tools.listResourceEventSubscriptions = createListResourceEventSubscriptionsTool(context);
+    tools.cancelResourceEventSubscription = createCancelResourceEventSubscriptionTool(context);
+  }
   if (context.mcpToolManager) {
     tools.searchMcpTools = createSearchMcpToolsTool(context.mcpToolManager);
     tools.callMcpTool = createCallMcpToolTool(context.mcpToolManager);
@@ -7062,7 +7588,14 @@ async function deliverPrivateMessage(input) {
     }
   }
   try {
-    const dmChannelId = (await client.conversations.open({ users: input.userId })).channel?.id;
+    const dmChannelId = (await withSlackRetries(
+      () => client.conversations.open({ users: input.userId }),
+      3,
+      {
+        action: "conversations.open",
+        spanAttributes: { "app.slack.user_id": input.userId }
+      }
+    )).channel?.id;
     if (!dmChannelId) {
       logWarn(
         "oauth_dm_fallback_failed",
@@ -7162,63 +7695,63 @@ async function startOAuthFlow(provider, input) {
   };
 }
 
-// src/chat/sandbox/egress-session.ts
+// src/chat/sandbox/egress/session.ts
 import { createHmac, randomUUID, timingSafeEqual } from "crypto";
 
-// src/chat/sandbox/egress-schemas.ts
-import { z } from "zod";
+// src/chat/sandbox/egress/schemas.ts
+import { z as z2 } from "zod";
 import {
   pluginAuthorizationSchema,
   pluginCredentialHeaderTransformSchema,
   pluginGrantSchema,
   pluginProviderAccountSchema
 } from "@sentry/junior-plugin-api";
-var finiteNumberSchema = z.number().refine(Number.isFinite);
-var httpStatusSchema = z.number().int().min(100).max(599);
-var providerNameSchema = z.string().regex(/^[a-z][a-z0-9-]*$/);
-var credentialSignalKindSchema = z.enum(["auth_required", "unavailable"]);
+var finiteNumberSchema = z2.number().refine(Number.isFinite);
+var httpStatusSchema = z2.number().int().min(100).max(599);
+var providerNameSchema = z2.string().regex(/^[a-z][a-z0-9-]*$/);
+var credentialSignalKindSchema = z2.enum(["auth_required", "unavailable"]);
 var sandboxEgressGrantSchema = pluginGrantSchema;
-var sandboxEgressCredentialContextSchema = z.object({
+var sandboxEgressCredentialContextSchema = z2.object({
   credentials: credentialContextSchema,
-  egressId: z.string().min(1),
+  egressId: z2.string().min(1),
   expiresAtMs: finiteNumberSchema,
-  contextId: z.string().min(1)
+  contextId: z2.string().min(1)
 }).strict();
-var sandboxEgressCredentialLeaseSchema = z.object({
+var sandboxEgressCredentialLeaseSchema = z2.object({
   account: pluginProviderAccountSchema.optional(),
   authorization: pluginAuthorizationSchema.optional(),
   grant: sandboxEgressGrantSchema,
   provider: providerNameSchema,
-  expiresAt: z.string().min(1),
-  headerTransforms: z.array(pluginCredentialHeaderTransformSchema).min(1)
+  expiresAt: z2.string().min(1),
+  headerTransforms: z2.array(pluginCredentialHeaderTransformSchema).min(1)
 }).strict();
-var sandboxEgressAuthRequiredSignalSchema = z.object({
+var sandboxEgressAuthRequiredSignalSchema = z2.object({
   authorization: pluginAuthorizationSchema.optional(),
   grant: sandboxEgressGrantSchema,
   kind: credentialSignalKindSchema.default("auth_required"),
   provider: providerNameSchema,
-  message: z.string().optional(),
+  message: z2.string().optional(),
   createdAtMs: finiteNumberSchema
 }).strict().superRefine((signal, ctx) => {
   if (signal.authorization && signal.authorization.provider !== signal.provider) {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       message: "Auth signal authorization provider must match provider",
       path: ["authorization", "provider"]
     });
   }
 });
-var sandboxEgressPermissionDeniedSignalSchema = z.object({
+var sandboxEgressPermissionDeniedSignalSchema = z2.object({
   account: pluginProviderAccountSchema.optional(),
-  acceptedPermissions: z.string().optional(),
+  acceptedPermissions: z2.string().optional(),
   grant: sandboxEgressGrantSchema,
-  message: z.string().min(1),
+  message: z2.string().min(1),
   provider: providerNameSchema,
-  source: z.literal("upstream"),
-  sso: z.string().optional(),
+  source: z2.literal("upstream"),
+  sso: z2.string().optional(),
   status: httpStatusSchema,
-  upstreamHost: z.string().min(1),
-  upstreamPath: z.string().min(1),
+  upstreamHost: z2.string().min(1),
+  upstreamPath: z2.string().min(1),
   createdAtMs: finiteNumberSchema
 }).strict();
 function parseSandboxEgressAuthRequiredSignal(value) {
@@ -7230,7 +7763,7 @@ function parseSandboxEgressPermissionDeniedSignal(value) {
   return result.success ? result.data : void 0;
 }
 
-// src/chat/sandbox/egress-session.ts
+// src/chat/sandbox/egress/session.ts
 var SANDBOX_EGRESS_PROXY_PATH = "/api/internal/sandbox-egress";
 var SANDBOX_EGRESS_TOKEN_VERSION = "v1";
 var SANDBOX_EGRESS_HMAC_CONTEXT = "junior.sandbox_egress.v1";
@@ -7295,12 +7828,12 @@ function getSandboxEgressSecret() {
   throw new Error("Cannot determine sandbox egress secret (set JUNIOR_SECRET)");
 }
 function createSandboxEgressCredentialToken(input) {
-  const ttlMs = Math.max(1, input.ttlMs ?? DEFAULT_SESSION_TTL_MS);
+  const ttlMs2 = Math.max(1, input.ttlMs ?? DEFAULT_SESSION_TTL_MS);
   const now = Date.now();
   const context = {
     credentials: input.credentials,
     egressId: input.egressId,
-    expiresAtMs: now + ttlMs,
+    expiresAtMs: now + ttlMs2,
     contextId: randomUUID()
   };
   const payload = `${SANDBOX_EGRESS_TOKEN_VERSION}.${base64Url(
@@ -7336,7 +7869,7 @@ async function setSandboxEgressCredentialLease(context, lease) {
   if (!Number.isFinite(leaseExpiresAtMs) || leaseExpiresAtMs <= Date.now()) {
     return;
   }
-  const ttlMs = Math.max(
+  const ttlMs2 = Math.max(
     1,
     Math.min(leaseExpiresAtMs, context.expiresAtMs) - Date.now()
   );
@@ -7345,7 +7878,7 @@ async function setSandboxEgressCredentialLease(context, lease) {
   await state.set(
     leaseKey(lease.provider, lease.grant.name, context),
     lease,
-    ttlMs
+    ttlMs2
   );
 }
 async function getSandboxEgressCredentialLease(provider, grantName, context) {
@@ -7359,7 +7892,7 @@ async function clearSandboxEgressCredentialLease(provider, grantName, context) {
   await state.delete(leaseKey(provider, grantName, context));
 }
 async function setSandboxEgressAuthRequiredSignal(context, signal) {
-  const ttlMs = Math.max(1, context.expiresAtMs - Date.now());
+  const ttlMs2 = Math.max(1, context.expiresAtMs - Date.now());
   const state = getStateAdapter();
   await state.connect();
   await state.set(
@@ -7368,11 +7901,11 @@ async function setSandboxEgressAuthRequiredSignal(context, signal) {
       ...signal,
       createdAtMs: Date.now()
     },
-    ttlMs
+    ttlMs2
   );
 }
 async function setSandboxEgressPermissionDeniedSignal(context, signal) {
-  const ttlMs = Math.max(1, context.expiresAtMs - Date.now());
+  const ttlMs2 = Math.max(1, context.expiresAtMs - Date.now());
   const state = getStateAdapter();
   await state.connect();
   await state.set(
@@ -7381,7 +7914,7 @@ async function setSandboxEgressPermissionDeniedSignal(context, signal) {
       ...signal,
       createdAtMs: Date.now()
     },
-    ttlMs
+    ttlMs2
   );
 }
 async function clearSandboxEgressSignals(egressId) {
@@ -7432,7 +7965,7 @@ async function consumeSandboxEgressPermissionDeniedSignal(egressId) {
   return signal;
 }
 
-// src/chat/sandbox/egress-policy.ts
+// src/chat/sandbox/egress/policy.ts
 function matchesSandboxEgressDomain(host, domain) {
   return host.toLowerCase() === domain.toLowerCase();
 }
@@ -9382,12 +9915,12 @@ async function getMcpAuthSession(authSessionId) {
   const stateAdapter = await getConnectedStateAdapter();
   return parseMcpAuthSession(await stateAdapter.get(sessionKey(authSessionId)));
 }
-async function putMcpAuthSession(session, ttlMs = MCP_AUTH_SESSION_TTL_MS) {
+async function putMcpAuthSession(session, ttlMs2 = MCP_AUTH_SESSION_TTL_MS) {
   const stateAdapter = await getConnectedStateAdapter();
   await stateAdapter.set(
     sessionKey(session.authSessionId),
     JSON.stringify(session),
-    ttlMs
+    ttlMs2
   );
   const nextIndex = parseSessionIndex(
     await stateAdapter.get(sessionIndexKey(session.userId, session.provider))
@@ -9398,7 +9931,7 @@ async function putMcpAuthSession(session, ttlMs = MCP_AUTH_SESSION_TTL_MS) {
   await stateAdapter.set(
     sessionIndexKey(session.userId, session.provider),
     JSON.stringify(nextIndex),
-    ttlMs
+    ttlMs2
   );
 }
 async function patchMcpAuthSession(authSessionId, patch) {
@@ -9478,12 +10011,12 @@ async function getMcpStoredOAuthCredentials(userId, provider) {
     await stateAdapter.get(credentialsKey(userId, provider))
   );
 }
-async function putMcpStoredOAuthCredentials(userId, provider, value, ttlMs = MCP_AUTH_CREDENTIALS_TTL_MS) {
+async function putMcpStoredOAuthCredentials(userId, provider, value, ttlMs2 = MCP_AUTH_CREDENTIALS_TTL_MS) {
   const stateAdapter = await getConnectedStateAdapter();
   await stateAdapter.set(
     credentialsKey(userId, provider),
     JSON.stringify(value),
-    ttlMs
+    ttlMs2
   );
 }
 async function deleteMcpStoredOAuthCredentials(userId, provider) {
@@ -9496,7 +10029,7 @@ async function getMcpServerSessionId(userId, provider) {
     await stateAdapter.get(serverSessionKey(userId, provider))
   )?.sessionId;
 }
-async function putMcpServerSessionId(userId, provider, sessionId, ttlMs = MCP_SERVER_SESSION_TTL_MS) {
+async function putMcpServerSessionId(userId, provider, sessionId, ttlMs2 = MCP_SERVER_SESSION_TTL_MS) {
   const stateAdapter = await getConnectedStateAdapter();
   await stateAdapter.set(
     serverSessionKey(userId, provider),
@@ -9504,7 +10037,7 @@ async function putMcpServerSessionId(userId, provider, sessionId, ttlMs = MCP_SE
       sessionId,
       updatedAtMs: Date.now()
     }),
-    ttlMs
+    ttlMs2
   );
 }
 async function deleteMcpServerSessionId(userId, provider) {
@@ -9524,6 +10057,15 @@ async function unlinkProvider(userId, provider, userTokenStore) {
 
 // src/chat/services/pending-auth.ts
 var AUTH_LINK_REUSE_WINDOW_MS = 10 * 60 * 1e3;
+var NON_REQUEST_SKIPPED_REASON_PREFIXES = [
+  "directed_to_other_party:",
+  "side_conversation:"
+];
+function isSkippedNonRequest(reason) {
+  return NON_REQUEST_SKIPPED_REASON_PREFIXES.some(
+    (prefix) => reason?.startsWith(prefix)
+  );
+}
 function canReusePendingAuthLink(args) {
   const { pendingAuth } = args;
   if (!pendingAuth) {
@@ -9567,6 +10109,12 @@ function isPendingAuthLatestRequest(conversation, pendingAuth) {
     if (message?.role !== "user") {
       continue;
     }
+    if (message.author?.isBot) {
+      continue;
+    }
+    if (isSkippedNonRequest(message.meta?.skippedReason)) {
+      continue;
+    }
     return buildDeterministicTurnId(message.id) === pendingAuth.sessionId;
   }
   return false;
@@ -10206,7 +10754,7 @@ function buildTurnResult(input) {
 }
 
 // src/chat/services/turn-thinking-level.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 var CLASSIFIER_CONFIDENCE_THRESHOLD = 0.75;
 var MAX_ROUTER_CONTEXT_CHARS = 8e3;
 var ROUTER_CONTEXT_HEAD_CHARS = 3e3;
@@ -10238,13 +10786,13 @@ function coerceClassifierConfidence(value) {
   }
   return CONFIDENCE_LABELS[trimmed] ?? value;
 }
-var turnExecutionProfileSchema = z2.object({
-  thinking_level: z2.enum(TURN_THINKING_LEVELS),
-  confidence: z2.preprocess(
+var turnExecutionProfileSchema = z3.object({
+  thinking_level: z3.enum(TURN_THINKING_LEVELS),
+  confidence: z3.preprocess(
     coerceClassifierConfidence,
-    z2.number().min(0).max(1)
+    z3.number().min(0).max(1)
   ),
-  reason: z2.string().min(1)
+  reason: z3.string().min(1)
 });
 var DEFAULT_THINKING_LEVEL = "medium";
 var THINKING_LEVEL_RANK = {
@@ -11212,6 +11760,1028 @@ function createMcpAuthOrchestration(input) {
   };
 }
 
+// src/chat/egress/plugin.ts
+import { randomUUID as randomUUID4 } from "crypto";
+
+// src/chat/plugins/credential-hooks.ts
+import {
+  pluginAuthorizationSchema as pluginAuthorizationSchema2,
+  pluginCredentialResultSchema,
+  pluginGrantSchema as pluginGrantSchema2,
+  pluginProviderAccountSchema as pluginProviderAccountSchema2
+} from "@sentry/junior-plugin-api";
+function parseSchema(schema, value, message) {
+  const result = schema.safeParse(value);
+  if (!result.success) {
+    throw new Error(message);
+  }
+  return result.data;
+}
+function parseAuthorization(value, pluginName) {
+  if (value === void 0) {
+    return void 0;
+  }
+  const authorization = parseSchema(
+    pluginAuthorizationSchema2,
+    value,
+    `Plugin "${pluginName}" grant authorization is invalid`
+  );
+  if (authorization.provider !== pluginName) {
+    throw new Error(
+      `Plugin "${pluginName}" grant authorization provider must match the issuing plugin`
+    );
+  }
+  return authorization;
+}
+function parseGrant(value, pluginName) {
+  return parseSchema(
+    pluginGrantSchema2,
+    value,
+    `Plugin "${pluginName}" grantForEgress returned an invalid grant`
+  );
+}
+function pluginFor(provider) {
+  return getPlugins().find((candidate) => candidate.manifest.name === provider);
+}
+function basePluginContext(plugin) {
+  const pluginName = plugin.manifest.name;
+  return {
+    plugin: { name: pluginName },
+    log: createPluginLogger(pluginName),
+    db: getDb()
+  };
+}
+function parseCredentialResult(value, pluginName) {
+  const result = parseSchema(
+    pluginCredentialResultSchema,
+    value,
+    `Plugin "${pluginName}" issueCredential result is invalid`
+  );
+  if (result.type === "lease") {
+    parseAuthorization(result.lease.authorization, pluginName);
+    return result;
+  }
+  if (result.type === "unavailable") {
+    return result;
+  }
+  parseAuthorization(result.authorization, pluginName);
+  return result;
+}
+async function selectPluginGrant(input) {
+  const plugin = pluginFor(input.provider);
+  const hook = plugin?.hooks?.grantForEgress;
+  if (!plugin || !hook) {
+    return void 0;
+  }
+  const result = await hook({
+    ...basePluginContext(plugin),
+    request: {
+      ...input.bodyText !== void 0 ? { bodyText: input.bodyText } : {},
+      method: input.method,
+      ...input.operation ? { operation: input.operation } : {},
+      url: input.upstreamUrl.toString()
+    }
+  });
+  return result === void 0 ? void 0 : parseGrant(result, plugin.manifest.name);
+}
+async function onPluginEgressResponse(input) {
+  const plugin = pluginFor(input.provider);
+  const hook = plugin?.hooks?.onEgressResponse;
+  if (!plugin || !hook) {
+    return {};
+  }
+  let permissionDenied;
+  await hook({
+    ...basePluginContext(plugin),
+    grant: input.grant,
+    permissionDenied(message) {
+      const trimmed = message.trim();
+      if (!trimmed) {
+        throw new Error(
+          `Plugin "${plugin.manifest.name}" onEgressResponse permissionDenied message is empty`
+        );
+      }
+      permissionDenied = { message: trimmed };
+    },
+    request: {
+      method: input.method,
+      ...input.operation ? { operation: input.operation } : {},
+      url: input.upstreamUrl.toString()
+    },
+    response: input.response
+  });
+  return permissionDenied ? { permissionDenied } : {};
+}
+function hasEgressCredentialHooks(provider) {
+  const hooks = pluginFor(provider)?.hooks;
+  return Boolean(hooks?.grantForEgress || hooks?.issueCredential);
+}
+async function resolvePluginOAuthAccount(input) {
+  const plugin = pluginFor(input.provider);
+  const hook = plugin?.hooks?.resolveOAuthAccount;
+  if (!plugin || !hook) {
+    return void 0;
+  }
+  const account = await hook({
+    ...basePluginContext(plugin),
+    tokens: input.tokens
+  });
+  return account === void 0 ? void 0 : parseSchema(
+    pluginProviderAccountSchema2,
+    account,
+    `Plugin "${plugin.manifest.name}" resolveOAuthAccount returned an invalid account`
+  );
+}
+async function issuePluginCredential(input) {
+  const plugin = pluginFor(input.provider);
+  const hook = plugin?.hooks?.issueCredential;
+  if (!plugin || !hook) {
+    throw new Error(`Plugin "${input.provider}" has no issueCredential hook`);
+  }
+  const currentUserId = input.actor.type === "user" ? input.actor.userId : void 0;
+  const credentialSubjectUserId = input.credentialSubject?.userId;
+  const result = await hook({
+    ...basePluginContext(plugin),
+    actor: input.actor,
+    grant: input.grant,
+    ...input.credentialSubject ? { credentialSubject: input.credentialSubject } : {},
+    tokens: {
+      ...currentUserId ? {
+        currentUser: {
+          userId: currentUserId,
+          get: async () => await input.userTokenStore.get(
+            currentUserId,
+            plugin.manifest.name
+          ),
+          set: async (tokens) => {
+            await input.userTokenStore.set(
+              currentUserId,
+              plugin.manifest.name,
+              tokens
+            );
+          },
+          withRefresh: async (callback) => await input.userTokenStore.withRefresh(
+            currentUserId,
+            plugin.manifest.name,
+            callback
+          )
+        }
+      } : {},
+      ...credentialSubjectUserId ? {
+        credentialSubject: {
+          userId: credentialSubjectUserId,
+          get: async () => await input.userTokenStore.get(
+            credentialSubjectUserId,
+            plugin.manifest.name
+          ),
+          set: async (tokens) => {
+            await input.userTokenStore.set(
+              credentialSubjectUserId,
+              plugin.manifest.name,
+              tokens
+            );
+          },
+          withRefresh: async (callback) => await input.userTokenStore.withRefresh(
+            credentialSubjectUserId,
+            plugin.manifest.name,
+            callback
+          )
+        }
+      } : {}
+    }
+  });
+  return parseCredentialResult(result, plugin.manifest.name);
+}
+
+// src/chat/sandbox/egress/credentials.ts
+var HTTP_READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+var SandboxEgressCredentialError = class extends Error {
+  authorization;
+  grant;
+  kind;
+  provider;
+  constructor(input) {
+    super(input.message);
+    this.name = "SandboxEgressCredentialError";
+    this.authorization = input.authorization;
+    this.grant = input.grant;
+    this.kind = input.kind;
+    this.provider = input.provider;
+  }
+};
+function defaultGrantForProvider(input) {
+  const access = HTTP_READ_METHODS.has(
+    input.method.toUpperCase()
+  ) ? "read" : "write";
+  return {
+    source: "broker",
+    grant: {
+      name: "default",
+      access,
+      reason: `sandbox-egress:${input.provider}:${access}`
+    }
+  };
+}
+function oauthAuthorizationForProvider(provider) {
+  const oauth = pluginCatalogRuntime.getOAuthConfig(provider);
+  return oauth ? {
+    type: "oauth",
+    provider,
+    ...oauth.scope ? { scope: oauth.scope } : {}
+  } : void 0;
+}
+function credentialSubjectFromContext(context) {
+  return "subject" in context.credentials && context.credentials.subject ? { type: "user", userId: context.credentials.subject.userId } : void 0;
+}
+function assertLeaseTransformsOwnedByProvider(provider, lease) {
+  for (const transform of lease.headerTransforms) {
+    if (resolveSandboxEgressProviderForHost(transform.domain) !== provider) {
+      throw new Error(
+        `Credential lease for ${provider} included header transform for unowned domain ${transform.domain}`
+      );
+    }
+  }
+}
+async function selectSandboxEgressGrant(input) {
+  if (!hasEgressCredentialHooks(input.provider)) {
+    return defaultGrantForProvider(input);
+  }
+  const pluginGrant = await selectPluginGrant({
+    ...input.bodyText !== void 0 ? { bodyText: input.bodyText } : {},
+    ...input.operation ? { operation: input.operation } : {},
+    provider: input.provider,
+    method: input.method,
+    upstreamUrl: input.upstreamUrl
+  });
+  if (!pluginGrant) {
+    throw new Error(
+      `Plugin "${input.provider}" grantForEgress must return a grant for sandbox egress`
+    );
+  }
+  return { source: "plugin", grant: pluginGrant };
+}
+function authorizationForSandboxEgressGrant(provider, selection) {
+  return selection.source === "broker" ? oauthAuthorizationForProvider(provider) : void 0;
+}
+async function sandboxEgressCredentialLease(provider, selection, context) {
+  const { grant } = selection;
+  const cached = await getSandboxEgressCredentialLease(
+    provider,
+    grant.name,
+    context
+  );
+  if (cached) {
+    if (selection.source === "plugin" && cached.grant.access !== grant.access) {
+      throw new Error(
+        `Cached credential lease for ${provider}/${grant.name} has ${cached.grant.access} access, but ${grant.access} was selected`
+      );
+    }
+    return {
+      ...cached,
+      grant
+    };
+  }
+  let lease;
+  if (selection.source === "plugin") {
+    const credentialSubject = credentialSubjectFromContext(context);
+    const pluginResult = await issuePluginCredential({
+      provider,
+      grant,
+      actor: context.credentials.actor,
+      ...credentialSubject ? { credentialSubject } : {},
+      userTokenStore: createUserTokenStore()
+    });
+    if (pluginResult.type === "needed") {
+      throw new SandboxEgressCredentialError({
+        provider,
+        grant,
+        kind: "auth_required",
+        authorization: pluginResult.authorization,
+        message: pluginResult.message
+      });
+    }
+    if (pluginResult.type === "unavailable") {
+      throw new SandboxEgressCredentialError({
+        provider,
+        grant,
+        kind: "unavailable",
+        message: pluginResult.message
+      });
+    }
+    lease = pluginResult.lease;
+  } else {
+    try {
+      lease = await issueProviderCredentialLease({
+        context: context.credentials,
+        provider,
+        reason: grant.reason ?? `sandbox-egress:${provider}:default`
+      });
+    } catch (error) {
+      if (error instanceof CredentialUnavailableError) {
+        throw new SandboxEgressCredentialError({
+          provider,
+          grant,
+          kind: "auth_required",
+          authorization: authorizationForSandboxEgressGrant(
+            provider,
+            selection
+          ),
+          message: error.message
+        });
+      }
+      throw error;
+    }
+  }
+  const headerTransforms = lease.headerTransforms ?? [];
+  if (headerTransforms.length === 0) {
+    throw new Error(
+      `Credential lease for ${provider} did not include header transforms`
+    );
+  }
+  const leaseExpiresAtMs = Date.parse(lease.expiresAt);
+  if (!Number.isFinite(leaseExpiresAtMs) || leaseExpiresAtMs <= Date.now()) {
+    throw new Error(`Credential lease for ${provider} is expired`);
+  }
+  const authorization = selection.source === "broker" ? oauthAuthorizationForProvider(provider) : lease.authorization;
+  const cachedLease = {
+    provider,
+    grant,
+    ...lease.account ? { account: lease.account } : {},
+    ...authorization ? { authorization } : {},
+    expiresAt: lease.expiresAt,
+    headerTransforms
+  };
+  assertLeaseTransformsOwnedByProvider(provider, cachedLease);
+  await setSandboxEgressCredentialLease(context, cachedLease);
+  return cachedLease;
+}
+function hasSandboxEgressLeaseTransformForHost(lease, host) {
+  return lease.headerTransforms.some(
+    (transform) => matchesSandboxEgressDomain(host, transform.domain)
+  );
+}
+
+// src/chat/egress/credentialed.ts
+import {
+  EgressAuthRequired,
+  EgressPolicyDenied
+} from "@sentry/junior-plugin-api";
+var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
+  "connection",
+  "host",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
+var PROXY_ONLY_HEADERS = /* @__PURE__ */ new Set([
+  "vercel-sandbox-oidc-token",
+  "vercel-forwarded-host",
+  "vercel-forwarded-scheme",
+  "vercel-forwarded-port",
+  "vercel-forwarded-path"
+]);
+var TRACE_PROPAGATION_HEADERS = /* @__PURE__ */ new Set([
+  "baggage",
+  "sentry-trace",
+  "traceparent"
+]);
+var DECODED_RESPONSE_HEADERS = /* @__PURE__ */ new Set([
+  "content-encoding",
+  "content-length"
+]);
+var UPSTREAM_TOKEN_REJECTION_STATUS = 401;
+var UPSTREAM_PERMISSION_REJECTION_STATUS = 403;
+var GRANT_SELECTION_BODY_TEXT_LIMIT_BYTES = 64 * 1024;
+var RESPONSE_BODY_TEXT_LIMIT_BYTES = 64 * 1024;
+function authRequiredResponse(input) {
+  return new Response(
+    `junior-auth-required provider=${input.provider} grant=${input.grant.name} access=${input.grant.access} 401 unauthorized
+${input.message}`,
+    {
+      status: 401,
+      headers: {
+        "content-type": "text/plain; charset=utf-8",
+        "cache-control": "no-store"
+      }
+    }
+  );
+}
+function policyDeniedResponse(error) {
+  return Response.json(
+    { error: error.message },
+    {
+      status: 403,
+      headers: {
+        "cache-control": "no-store"
+      }
+    }
+  );
+}
+function shouldLogSandboxEgressInfo() {
+  const environment = (process.env.SENTRY_ENVIRONMENT ?? process.env.VERCEL_ENV ?? process.env.NODE_ENV ?? "").trim().toLowerCase();
+  return environment !== "production";
+}
+function egressAttributes(input) {
+  return {
+    ...input.egressId ? { "app.sandbox.egress_id": input.egressId } : {},
+    ...input.provider ? { "app.provider.name": input.provider } : {},
+    ...input.grantName ? { "app.grant.name": input.grantName } : {},
+    ...input.grantAccess ? { "app.grant.access": input.grantAccess } : {},
+    ...input.grantReason ? { "app.grant.reason": input.grantReason } : {},
+    ...input.host ? { "server.address": input.host } : {},
+    ...input.method ? { "http.request.method": input.method } : {},
+    ...input.path ? { "url.path": input.path } : {},
+    ...input.status ? { "http.response.status_code": input.status } : {}
+  };
+}
+function redactedProxyPath(pathname) {
+  if (pathname.startsWith(`${SANDBOX_EGRESS_PROXY_PATH}/`)) {
+    return `${SANDBOX_EGRESS_PROXY_PATH}/<token>`;
+  }
+  return pathname;
+}
+function routingAttributes(request, upstreamUrl) {
+  const proxyUrl = new URL(request.url);
+  const attributes = {
+    "app.sandbox.egress.proxy_path": redactedProxyPath(proxyUrl.pathname)
+  };
+  if (upstreamUrl) {
+    attributes["app.sandbox.egress.upstream_path"] = upstreamUrl.pathname;
+    const gitService = upstreamUrl.searchParams.get("service");
+    if (upstreamUrl.hostname.toLowerCase() === "github.com" && (gitService === "git-upload-pack" || gitService === "git-receive-pack")) {
+      attributes["app.sandbox.egress.git_service"] = gitService;
+    }
+  }
+  return attributes;
+}
+function displayedUpstreamPath(upstreamUrl) {
+  const gitService = upstreamUrl.searchParams.get("service");
+  if (upstreamUrl.hostname.toLowerCase() === "github.com" && (gitService === "git-upload-pack" || gitService === "git-receive-pack")) {
+    return `${upstreamUrl.pathname}?service=${gitService}`;
+  }
+  return upstreamUrl.pathname;
+}
+function upstreamPermissionAttributes(provider, upstream) {
+  if (provider !== "github") {
+    return {};
+  }
+  return {
+    "app.github.accepted_permissions": upstream.headers.get("x-accepted-github-permissions") ?? void 0,
+    "app.github.sso": upstream.headers.get("x-github-sso") ?? void 0
+  };
+}
+function githubPermissionHeaders(upstream) {
+  const acceptedPermissions = upstream.headers.get(
+    "x-accepted-github-permissions"
+  );
+  const sso = upstream.headers.get("x-github-sso");
+  return {
+    ...acceptedPermissions ? { acceptedPermissions } : {},
+    ...sso ? { sso } : {}
+  };
+}
+function permissionDeniedMessage(provider, grant) {
+  return `${provider} returned HTTP 403 after Junior injected the ${grant.name} grant. Junior forwarded the request; this is not a local runtime block.`;
+}
+function isEgressAuthRequired(error) {
+  return error instanceof EgressAuthRequired || error instanceof Error && error.name === "EgressAuthRequired";
+}
+function isEgressPolicyDenied(error) {
+  return error instanceof EgressPolicyDenied || error instanceof Error && error.name === "EgressPolicyDenied";
+}
+function logSandboxEgressUpstreamRequest(input) {
+  if (!shouldLogSandboxEgressInfo()) {
+    return;
+  }
+  logInfo(
+    "sandbox_egress_upstream_request",
+    {},
+    {
+      ...egressAttributes({
+        egressId: input.egressId,
+        grantAccess: input.grantAccess,
+        grantName: input.grantName,
+        grantReason: input.grantReason,
+        host: input.upstreamUrl.hostname,
+        method: input.request.method,
+        path: input.upstreamUrl.pathname,
+        provider: input.provider,
+        status: input.upstream.status
+      }),
+      ...routingAttributes(input.request, input.upstreamUrl),
+      "app.sandbox.egress.upstream_ok": input.upstream.ok
+    },
+    `Sandbox egress ${input.request.method} ${input.upstreamUrl.hostname}${displayedUpstreamPath(input.upstreamUrl)} -> ${input.upstream.status}`
+  );
+}
+async function requestBodyBytes(request) {
+  if (request.method === "GET" || request.method === "HEAD" || request.body === null) {
+    return void 0;
+  }
+  return await request.arrayBuffer();
+}
+function isGrantSelectionBodyVisible(input) {
+  return input.provider === "github" && input.upstreamUrl.hostname.toLowerCase() === "api.github.com" && input.upstreamUrl.pathname.toLowerCase().endsWith("/graphql");
+}
+function grantSelectionBodyText(input) {
+  if (input.body === void 0) {
+    return void 0;
+  }
+  if (input.body.byteLength > GRANT_SELECTION_BODY_TEXT_LIMIT_BYTES) {
+    if (!input.operation && input.provider === "github" && input.request.method.toUpperCase() === "POST" && input.upstreamUrl.hostname.toLowerCase() === "api.github.com" && input.upstreamUrl.pathname.toLowerCase().endsWith("/graphql")) {
+      throw new EgressPolicyDenied(
+        "GitHub GraphQL request body is too large for Junior to inspect before issuing credentials."
+      );
+    }
+    return void 0;
+  }
+  return new TextDecoder().decode(input.body);
+}
+function responseContentLength(upstream) {
+  const raw = upstream.headers.get("content-length");
+  if (!raw) {
+    return void 0;
+  }
+  const parsed = Number(raw);
+  return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : void 0;
+}
+async function responseTextWithinLimit(upstream, maxBytes) {
+  const limit = Math.min(
+    Math.max(0, Math.floor(maxBytes)),
+    RESPONSE_BODY_TEXT_LIMIT_BYTES
+  );
+  if (limit <= 0) {
+    return void 0;
+  }
+  const contentLength = responseContentLength(upstream);
+  if (contentLength !== void 0 && contentLength > limit) {
+    return void 0;
+  }
+  let clone;
+  try {
+    clone = upstream.clone();
+  } catch {
+    return void 0;
+  }
+  const body = clone.body;
+  if (!body) {
+    return "";
+  }
+  const reader = body.getReader();
+  const chunks = [];
+  let bytes = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      if (!value) {
+        continue;
+      }
+      bytes += value.byteLength;
+      if (bytes > limit) {
+        await reader.cancel().catch(() => void 0);
+        return void 0;
+      }
+      chunks.push(value);
+    }
+  } catch {
+    await reader.cancel().catch(() => void 0);
+    return void 0;
+  } finally {
+    reader.releaseLock();
+  }
+  const combined = new Uint8Array(bytes);
+  let offset = 0;
+  for (const chunk of chunks) {
+    combined.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(combined);
+}
+function requestHeaders(request, lease, upstreamHost, tracePropagation) {
+  const headers = new Headers();
+  const mayPropagateTrace = shouldPropagateSandboxEgressTrace(
+    upstreamHost,
+    tracePropagation
+  );
+  request.headers.forEach((value, key) => {
+    const normalized = key.toLowerCase();
+    if (HOP_BY_HOP_HEADERS.has(normalized) || PROXY_ONLY_HEADERS.has(normalized)) {
+      return;
+    }
+    if (TRACE_PROPAGATION_HEADERS.has(normalized) && !mayPropagateTrace) {
+      return;
+    }
+    headers.append(key, value);
+  });
+  for (const transform of lease.headerTransforms) {
+    if (!matchesSandboxEgressDomain(upstreamHost, transform.domain)) {
+      continue;
+    }
+    for (const [key, value] of Object.entries(transform.headers)) {
+      if (TRACE_PROPAGATION_HEADERS.has(key.toLowerCase()) && !mayPropagateTrace) {
+        continue;
+      }
+      headers.set(key, value);
+    }
+  }
+  return headers;
+}
+function responseHeaders(upstream) {
+  const headers = new Headers();
+  upstream.headers.forEach((value, key) => {
+    const normalized = key.toLowerCase();
+    if (!HOP_BY_HOP_HEADERS.has(normalized) && !DECODED_RESPONSE_HEADERS.has(normalized)) {
+      headers.append(key, value);
+    }
+  });
+  return headers;
+}
+function leaseLogAttributes(input) {
+  return {
+    ...egressAttributes({
+      egressId: input.egressId,
+      grantAccess: input.lease.grant.access,
+      grantName: input.lease.grant.name,
+      grantReason: input.lease.grant.reason,
+      host: input.upstreamUrl.hostname,
+      method: input.request.method,
+      path: input.upstreamUrl.pathname,
+      provider: input.provider,
+      status: input.status
+    }),
+    ...routingAttributes(input.request, input.upstreamUrl),
+    ...input.upstream ? upstreamPermissionAttributes(input.provider, input.upstream) : {}
+  };
+}
+async function recordSandboxAuthRequired(input) {
+  await setSandboxEgressAuthRequiredSignal(input.credentialContext, {
+    provider: input.provider,
+    grant: input.grant,
+    kind: input.kind ?? "auth_required",
+    ...input.authorization ? { authorization: input.authorization } : {},
+    message: input.message
+  });
+}
+async function recordSandboxPermissionDenied(input) {
+  await setSandboxEgressPermissionDeniedSignal(input.credentialContext, {
+    provider: input.provider,
+    grant: input.lease.grant,
+    ...input.lease.account ? { account: input.lease.account } : {},
+    message: input.message,
+    source: "upstream",
+    status: input.upstream.status,
+    upstreamHost: input.upstreamUrl.hostname,
+    upstreamPath: displayedUpstreamPath(input.upstreamUrl),
+    ...input.provider === "github" ? githubPermissionHeaders(input.upstream) : {}
+  });
+}
+async function executeCredentialedEgressRequest(input) {
+  const {
+    activeEgressId,
+    credentialContext,
+    deps,
+    operation,
+    provider,
+    request,
+    upstreamUrl
+  } = input;
+  const bodyForGrantSelection = isGrantSelectionBodyVisible({
+    provider,
+    upstreamUrl
+  }) ? await requestBodyBytes(request) : void 0;
+  let grantSelection;
+  try {
+    grantSelection = await selectSandboxEgressGrant({
+      bodyText: grantSelectionBodyText({
+        body: bodyForGrantSelection,
+        ...operation ? { operation } : {},
+        provider,
+        request,
+        upstreamUrl
+      }),
+      ...operation ? { operation } : {},
+      provider,
+      method: request.method,
+      upstreamUrl
+    });
+  } catch (error) {
+    if (isEgressPolicyDenied(error)) {
+      logWarn(
+        "sandbox_egress_policy_denied",
+        {},
+        {
+          ...egressAttributes({
+            egressId: activeEgressId,
+            host: upstreamUrl.hostname,
+            method: request.method,
+            path: upstreamUrl.pathname,
+            provider,
+            status: 403
+          }),
+          ...routingAttributes(request, upstreamUrl)
+        },
+        error.message
+      );
+      return policyDeniedResponse(error);
+    }
+    throw error;
+  }
+  const issueCredentialLease = deps.issueCredentialLease ?? sandboxEgressCredentialLease;
+  const clearCredentialLease = deps.clearCredentialLease ?? clearSandboxEgressCredentialLease;
+  const recordAuthRequired = deps.recordAuthRequired ?? recordSandboxAuthRequired;
+  const recordPermissionDenied = deps.recordPermissionDenied ?? recordSandboxPermissionDenied;
+  let lease;
+  try {
+    lease = await issueCredentialLease(
+      provider,
+      grantSelection,
+      credentialContext
+    );
+  } catch (error) {
+    if (error instanceof SandboxEgressCredentialError) {
+      await recordAuthRequired({
+        credentialContext,
+        provider: error.provider,
+        grant: error.grant,
+        kind: error.kind,
+        authorization: error.authorization,
+        message: error.message
+      });
+      const isAuthRequired = error.kind === "auth_required";
+      logWarn(
+        isAuthRequired ? "sandbox_egress_credential_needed" : "sandbox_egress_credential_unavailable",
+        {},
+        {
+          ...egressAttributes({
+            egressId: activeEgressId,
+            grantAccess: error.grant.access,
+            grantName: error.grant.name,
+            grantReason: error.grant.reason,
+            host: upstreamUrl.hostname,
+            method: request.method,
+            path: upstreamUrl.pathname,
+            provider: error.provider,
+            status: 401
+          }),
+          ...routingAttributes(request, upstreamUrl)
+        },
+        isAuthRequired ? "Sandbox egress grant needs user authorization before issuing a credential lease" : "Sandbox egress credential lease is unavailable for selected grant"
+      );
+      return authRequiredResponse({
+        provider: error.provider,
+        grant: error.grant,
+        message: error.message
+      });
+    }
+    throw error;
+  }
+  const attributes = (status, upstream2) => leaseLogAttributes({
+    egressId: activeEgressId,
+    lease,
+    provider,
+    request,
+    status,
+    ...upstream2 ? { upstream: upstream2 } : {},
+    upstreamUrl
+  });
+  if (!hasSandboxEgressLeaseTransformForHost(lease, upstreamUrl.hostname)) {
+    logWarn(
+      "sandbox_egress_transform_missing",
+      {},
+      {
+        ...attributes(403),
+        "app.sandbox.egress.transform_domains": lease.headerTransforms.map(
+          (transform) => transform.domain
+        )
+      },
+      "Sandbox egress credential lease does not cover forwarded host"
+    );
+    return Response.json(
+      { error: "Credential lease does not cover forwarded host" },
+      { status: 403 }
+    );
+  }
+  const fetchImpl = deps.fetch ?? fetch;
+  const headers = requestHeaders(
+    request,
+    lease,
+    upstreamUrl.hostname,
+    deps.tracePropagation ?? {}
+  );
+  const body = bodyForGrantSelection ?? await requestBodyBytes(request);
+  const intercepted = await deps.interceptHttp?.({
+    provider,
+    request: new Request(upstreamUrl, {
+      method: request.method,
+      headers,
+      ...body !== void 0 ? { body } : {}
+    }),
+    upstreamUrl
+  });
+  if (intercepted) {
+    return intercepted;
+  }
+  const upstream = await fetchImpl(upstreamUrl, {
+    method: request.method,
+    headers,
+    ...body !== void 0 ? { body } : {},
+    redirect: "manual"
+  });
+  try {
+    const effects = await onPluginEgressResponse({
+      provider,
+      grant: lease.grant,
+      method: request.method,
+      ...operation ? { operation } : {},
+      upstreamUrl,
+      response: {
+        headers: new Headers(upstream.headers),
+        readText: async (maxBytes) => await responseTextWithinLimit(upstream, maxBytes),
+        status: upstream.status
+      }
+    });
+    if (effects.permissionDenied) {
+      await recordPermissionDenied({
+        credentialContext,
+        provider,
+        lease,
+        message: effects.permissionDenied.message,
+        upstream,
+        upstreamUrl
+      });
+      logWarn(
+        "sandbox_egress_upstream_permission_classified",
+        {},
+        {
+          ...attributes(upstream.status, upstream)
+        },
+        "Sandbox egress plugin classified upstream response as permission denied"
+      );
+    }
+  } catch (error) {
+    if (!isEgressAuthRequired(error)) {
+      throw error;
+    }
+    await clearCredentialLease(provider, lease.grant.name, credentialContext);
+    await recordAuthRequired({
+      credentialContext,
+      provider,
+      grant: lease.grant,
+      authorization: error.authorization ?? lease.authorization,
+      message: error.message
+    });
+    logWarn(
+      "sandbox_egress_upstream_auth_required_classified",
+      {},
+      {
+        ...attributes(upstream.status, upstream)
+      },
+      "Sandbox egress plugin classified upstream response as auth required"
+    );
+    await upstream.body?.cancel().catch(() => void 0);
+    return authRequiredResponse({
+      provider,
+      grant: lease.grant,
+      message: error.message
+    });
+  }
+  logSandboxEgressUpstreamRequest({
+    egressId: activeEgressId,
+    grantAccess: lease.grant.access,
+    grantName: lease.grant.name,
+    grantReason: lease.grant.reason,
+    provider,
+    request,
+    upstream,
+    upstreamUrl
+  });
+  if (upstream.status >= 400) {
+    logWarn(
+      "sandbox_egress_upstream_error_response",
+      {},
+      {
+        ...attributes(upstream.status, upstream),
+        "error.type": `http_${upstream.status}`
+      },
+      `Sandbox egress upstream returned HTTP ${upstream.status}`
+    );
+  }
+  if (upstream.status === UPSTREAM_TOKEN_REJECTION_STATUS || upstream.status === UPSTREAM_PERMISSION_REJECTION_STATUS) {
+    logWarn(
+      "sandbox_egress_upstream_auth_rejected",
+      {},
+      {
+        ...attributes(upstream.status, upstream),
+        ...upstream.status === UPSTREAM_TOKEN_REJECTION_STATUS ? {
+          "app.sandbox.egress.www_authenticate": upstream.headers.get("www-authenticate") ?? void 0
+        } : {}
+      },
+      upstream.status === UPSTREAM_TOKEN_REJECTION_STATUS ? "Sandbox egress upstream auth rejected injected credential" : "Sandbox egress upstream permission denied"
+    );
+    if (upstream.status === UPSTREAM_TOKEN_REJECTION_STATUS) {
+      await clearCredentialLease(provider, lease.grant.name, credentialContext);
+      await recordAuthRequired({
+        credentialContext,
+        provider,
+        grant: lease.grant,
+        authorization: lease.authorization,
+        message: `Provider rejected the injected ${provider} credential.`
+      });
+      await upstream.body?.cancel().catch(() => void 0);
+      return authRequiredResponse({
+        provider,
+        grant: lease.grant,
+        message: `Provider rejected the injected ${provider} credential.
+`
+      });
+    } else {
+      await clearCredentialLease(provider, lease.grant.name, credentialContext);
+      await recordPermissionDenied({
+        credentialContext,
+        provider,
+        lease,
+        message: permissionDeniedMessage(provider, lease.grant),
+        upstream,
+        upstreamUrl
+      });
+    }
+  }
+  return new Response(upstream.body, {
+    status: upstream.status,
+    statusText: upstream.statusText,
+    headers: responseHeaders(upstream)
+  });
+}
+
+// src/chat/egress/plugin.ts
+function credentialContextForPluginEgress(credentialContext) {
+  return {
+    credentials: credentialContext,
+    contextId: randomUUID4(),
+    egressId: `plugin-egress:${randomUUID4()}`,
+    expiresAtMs: Date.now() + 30 * 60 * 1e3
+  };
+}
+function createPluginEgress(deps) {
+  const credentialContext = deps.credentialContext ? credentialContextForPluginEgress(deps.credentialContext) : void 0;
+  return {
+    async fetch(input) {
+      const operation = input.operation.trim();
+      if (!operation) {
+        throw new Error("Plugin egress operation is required");
+      }
+      if (!credentialContext) {
+        throw new PluginCredentialFailureError(
+          input.provider,
+          `Cannot issue ${input.provider} credentials without a credential context.`
+        );
+      }
+      const upstreamUrl = new URL(input.request.url);
+      if (upstreamUrl.protocol !== "https:") {
+        throw new Error("Plugin egress requires HTTPS provider URLs");
+      }
+      const resolvedProvider = resolveSandboxEgressProviderForHost(
+        upstreamUrl.hostname
+      );
+      if (resolvedProvider !== input.provider) {
+        throw new Error(
+          `Plugin egress provider "${input.provider}" does not own ${upstreamUrl.hostname}`
+        );
+      }
+      return await executeCredentialedEgressRequest({
+        activeEgressId: credentialContext.egressId,
+        credentialContext,
+        deps: {
+          ...deps.fetch ? { fetch: deps.fetch } : {},
+          recordAuthRequired: async (signal) => {
+            await deps.pluginAuth.handleAuthRequired({
+              ...signal.authorization ? { authorization: signal.authorization } : {},
+              grant: signal.grant,
+              kind: signal.kind ?? "auth_required",
+              message: signal.message,
+              provider: signal.provider
+            });
+          },
+          recordPermissionDenied: async () => {
+          },
+          tracePropagation: {}
+        },
+        operation,
+        provider: input.provider,
+        request: input.request,
+        upstreamUrl
+      });
+    }
+  };
+}
+
 // src/chat/respond.ts
 var AGENT_ABORT_SETTLE_GRACE_MS = 5e3;
 function sleep3(ms) {
@@ -11824,6 +13394,23 @@ async function generateAssistantReplyInPrivacyContext(messageText2, context, con
       userText: userInput,
       artifactState: context.artifactState,
       configuration: configurationValues,
+      egress: createPluginEgress({
+        credentialContext: context.credentialContext,
+        pluginAuth: {
+          async handleAuthRequired(signal) {
+            await pluginAuth.maybeHandleAuthSignal({
+              auth_required: {
+                ...signal.authorization ? { authorization: signal.authorization } : {},
+                createdAtMs: Date.now(),
+                grant: signal.grant,
+                kind: signal.kind,
+                message: signal.message,
+                provider: signal.provider
+              }
+            });
+          }
+        }
+      }),
       mcpToolManager: turnMcpToolManager,
       sandbox,
       surface,
@@ -13175,7 +14762,8 @@ export {
   setConfigDefaults,
   getConfigDefaults,
   createUserTokenStore,
-  issueProviderCredentialLease,
+  findMatchingResourceEventSubscriptions,
+  deliverResourceEventSubscription,
   listThreadReplies,
   postSlackMessage,
   deleteSlackMessage,
@@ -13190,14 +14778,8 @@ export {
   startOAuthFlow,
   SANDBOX_EGRESS_PROXY_PATH,
   parseSandboxEgressCredentialToken,
-  setSandboxEgressCredentialLease,
-  getSandboxEgressCredentialLease,
-  clearSandboxEgressCredentialLease,
-  setSandboxEgressAuthRequiredSignal,
-  setSandboxEgressPermissionDeniedSignal,
   normalizeSandboxEgressTracePropagationDomains,
   shouldPropagateSandboxEgressTrace,
-  matchesSandboxEgressDomain,
   resolveSandboxEgressProviderForHost,
   shouldEmitDevAgentTrace,
   AuthorizationFlowDisabledError,
@@ -13228,6 +14810,8 @@ export {
   markTurnFailed,
   isRedundantReactionAckText,
   finalizeMcpAuthorization,
+  resolvePluginOAuthAccount,
+  executeCredentialedEgressRequest,
   generateAssistantReply,
   estimateTextTokens,
   getAgentContextCompactionTriggerTokens,