@sentry/junior-scheduler 0.100.0 → 0.102.0

package/README.md

@@ -0,0 +1,52 @@
+# @sentry/junior-scheduler
+
+The scheduler plugin stores user-created schedules and dispatches due work into
+Junior's durable agent runtime.
+
+## Task Model
+
+- A scheduled task records its creator, execution actor, Slack destination,
+  prompt text, timezone-aware schedule, recurrence, credential mode, status, and
+  next-run state.
+- SQL schemas and migrations are authoritative for persistence.
+- Schedule parsing normalizes calendar intent before storage; execution does not
+  reinterpret the original natural-language request.
+- Updates and deletion invalidate obsolete pending run times.
+
+## Dispatch
+
+- Heartbeat claims a bounded number of due runs.
+- Claiming and completion transitions are atomic and safe to retry.
+- Each run dispatches with explicit source, destination, creator attribution,
+  execution actor, metadata, and idempotency identity.
+- A deleted, paused, or rescheduled task is skipped when its claimed run no
+  longer matches current task state.
+- Dispatch completion, failure, or blocking updates both the run and the task's
+  next-run state.
+- Missed recurring work advances according to the stored calendar rather than
+  creating an unbounded catch-up burst.
+
+## Authority
+
+- Creation requires the active Slack actor and destination.
+- Tasks use system credentials by default. Creator credentials require explicit
+  authorization from the verified task creator and work in DMs or channels.
+- Only the creator may enable or re-enable creator credential mode. Any
+  conversation manager may disable it, and another user's executable task edit
+  clears it; schedule, status, and run-now changes preserve it.
+- Scheduled execution remains a system actor. At dispatch, creator mode derives
+  a user credential subject bound to the exact scheduler task; interactive OAuth
+  remains disabled.
+- Stored creator attribution grants no broader task-management or execution
+  authority.
+- User-visible schedule management remains scoped to the active Slack context.
+
+## Operations
+
+The plugin exposes create, update, delete, list, and run-now tools plus bounded
+operational reporting. Generate schema changes with
+`pnpm --filter @sentry/junior-scheduler db:generate`.
+
+Follow `../../policies/serverless-background-work.md`,
+`../../policies/context-bound-systems.md`, and
+`../junior-plugin-api/README.md`.

package/dist/index.js

@@ -8,7 +8,8 @@ import {
 import {
   pluginCredentialSubjectSchema,
   destinationSchema,
-  isSlackDestination
+  isSlackDestination,
+  slackActorSchema
 } from "@sentry/junior-plugin-api";
 import {
   and,
@@ -21,7 +22,7 @@ import {
   or,
   sql as sql2
 } from "drizzle-orm";
-import { z } from "zod";
+import { z as z2 } from "zod";
 
 // src/cadence.ts
 function parseScheduleTimestamp(value) {
@@ -416,6 +417,14 @@ var juniorSchedulerRuns = pgTable(
   ]
 );
 
+// src/types.ts
+import { z } from "zod";
+var scheduledTaskCredentialModeSchema = z.enum(["system", "creator"]);
+var SCHEDULED_TASK_SYSTEM_ACTOR = Object.freeze({
+  platform: "system",
+  name: "scheduled-task"
+});
+
 // src/store.ts
 var SCHEDULER_KEY_PREFIX = "junior:scheduler";
 var SCHEDULER_RECORD_TTL_MS = 5 * 365 * 24 * 60 * 60 * 1e3;
@@ -425,69 +434,76 @@ var PENDING_CLAIM_STALE_MS = 6e4;
 var MISSED_RUN_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var SQL_INCOMPLETE_RUN_STATUSES = ["pending", "running"];
 var slackDestinationSchema = destinationSchema.refine(isSlackDestination);
-var taskPrincipalSchema = z.object({
-  slackUserId: z.string(),
-  fullName: z.string().optional(),
-  userName: z.string().optional()
+var taskPrincipalSchema = z2.object({
+  slackUserId: slackActorSchema.shape.userId,
+  fullName: z2.string().optional(),
+  userName: z2.string().optional()
 }).strict();
-var recurrenceSchema = z.object({
-  dayOfMonth: z.number().optional(),
-  frequency: z.enum(["daily", "weekly", "monthly", "yearly"]),
-  interval: z.number(),
-  month: z.number().optional(),
-  startDate: z.string(),
-  time: z.object({
-    hour: z.number(),
-    minute: z.number()
+var recurrenceSchema = z2.object({
+  dayOfMonth: z2.number().optional(),
+  frequency: z2.enum(["daily", "weekly", "monthly", "yearly"]),
+  interval: z2.number(),
+  month: z2.number().optional(),
+  startDate: z2.string(),
+  time: z2.object({
+    hour: z2.number(),
+    minute: z2.number()
   }).strict(),
-  weekdays: z.array(z.number()).optional()
+  weekdays: z2.array(z2.number()).optional()
 }).strict();
-var taskScheduleSchema = z.object({
-  description: z.string(),
-  kind: z.enum(["one_off", "recurring"]),
+var taskScheduleSchema = z2.object({
+  description: z2.string(),
+  kind: z2.enum(["one_off", "recurring"]),
   recurrence: recurrenceSchema.optional(),
-  timezone: z.string()
+  timezone: z2.string()
 }).strict();
-var taskSpecSchema = z.object({
-  text: z.string()
+var taskSpecSchema = z2.object({
+  text: z2.string()
 }).strict();
-var taskRecordSchema = z.object({
-  id: z.string(),
-  conversationAccess: z.object({
-    audience: z.enum(["direct", "group", "channel"]),
-    visibility: z.enum(["private", "public", "unknown"])
+var taskRecordFields = {
+  id: z2.string(),
+  conversationAccess: z2.object({
+    audience: z2.enum(["direct", "group", "channel"]),
+    visibility: z2.enum(["private", "public", "unknown"])
   }).strict().optional(),
-  createdAtMs: z.number(),
+  createdAtMs: z2.number(),
   createdBy: taskPrincipalSchema,
-  credentialSubject: pluginCredentialSubjectSchema.optional(),
   destination: slackDestinationSchema,
-  executionActor: z.object({
-    platform: z.literal("system"),
-    name: z.string()
+  executionActor: z2.object({
+    platform: z2.literal("system"),
+    name: z2.string()
   }).strict().optional(),
-  lastRunAtMs: z.number().optional(),
-  nextRunAtMs: z.number().optional(),
-  originalRequest: z.string().optional(),
-  runNowAtMs: z.number().optional(),
+  lastRunAtMs: z2.number().optional(),
+  nextRunAtMs: z2.number().optional(),
+  originalRequest: z2.string().optional(),
+  runNowAtMs: z2.number().optional(),
   schedule: taskScheduleSchema,
-  status: z.enum(["active", "paused", "blocked", "deleted"]),
-  statusReason: z.string().optional(),
+  status: z2.enum(["active", "paused", "blocked", "deleted"]),
+  statusReason: z2.string().optional(),
   task: taskSpecSchema,
-  updatedAtMs: z.number(),
-  version: z.number().optional()
+  updatedAtMs: z2.number(),
+  version: z2.number().optional()
+};
+var taskRecordSchema = z2.object({
+  ...taskRecordFields,
+  credentialMode: scheduledTaskCredentialModeSchema
+}).strict();
+var legacyTaskRecordSchema = z2.object({
+  ...taskRecordFields,
+  credentialSubject: pluginCredentialSubjectSchema.optional()
 }).strict();
-var runRecordSchema = z.object({
-  id: z.string(),
-  attempt: z.number(),
-  claimedAtMs: z.number(),
-  completedAtMs: z.number().optional(),
-  dispatchId: z.string().optional(),
-  errorMessage: z.string().optional(),
-  idempotencyKey: z.string().optional(),
-  resultMessageTs: z.string().optional(),
-  scheduledForMs: z.number(),
-  startedAtMs: z.number().optional(),
-  status: z.enum([
+var runRecordSchema = z2.object({
+  id: z2.string(),
+  attempt: z2.number(),
+  claimedAtMs: z2.number(),
+  completedAtMs: z2.number().optional(),
+  dispatchId: z2.string().optional(),
+  errorMessage: z2.string().optional(),
+  idempotencyKey: z2.string().optional(),
+  resultMessageTs: z2.string().optional(),
+  scheduledForMs: z2.number(),
+  startedAtMs: z2.number().optional(),
+  status: z2.enum([
     "pending",
     "running",
     "completed",
@@ -495,8 +511,8 @@ var runRecordSchema = z.object({
     "blocked",
     "skipped"
   ]),
-  taskId: z.string(),
-  taskVersion: z.number().optional()
+  taskId: z2.string(),
+  taskVersion: z2.number().optional()
 }).strict();
 function taskKey(taskId) {
   return `${SCHEDULER_KEY_PREFIX}:task:${taskId}`;
@@ -573,6 +589,8 @@ function normalizedText(value) {
 }
 function taskDedupeFingerprint(task) {
   return JSON.stringify({
+    credentialMode: task.credentialMode,
+    credentialUserId: task.credentialMode === "creator" ? task.createdBy.slackUserId : null,
     destination: task.destination,
     schedule: {
       kind: task.schedule.kind,
@@ -604,6 +622,21 @@ function parseStoredTask(value) {
   const parsed = taskRecordSchema.safeParse(parseJsonRecord(value));
   return parsed.success ? stripLegacyTaskFields(parsed.data) : void 0;
 }
+function parseLegacyStoredTaskForMigration(value) {
+  const parsed = legacyTaskRecordSchema.safeParse(parseJsonRecord(value));
+  if (!parsed.success) {
+    return void 0;
+  }
+  const {
+    credentialSubject: _credentialSubject,
+    version: _version,
+    ...task
+  } = parsed.data;
+  return {
+    ...task,
+    credentialMode: "system"
+  };
+}
 function parseStoredRun(value) {
   const parsed = runRecordSchema.safeParse(parseJsonRecord(value));
   return parsed.success ? stripLegacyRunFields(parsed.data) : void 0;
@@ -643,9 +676,6 @@ function requireStoredTask(task) {
   }
   return parsed;
 }
-async function getTaskFromState(state, taskId) {
-  return parseStoredTask(await state.get(taskKey(taskId)));
-}
 async function getRunFromState(state, runId) {
   return parseStoredRun(await state.get(runKey(runId)));
 }
@@ -1071,7 +1101,8 @@ async function migrateSchedulerStateToSql(args) {
   let missing = 0;
   const migratedTasks = [];
   for (const id of ids) {
-    const task = await getTaskFromState(args.state, id);
+    const rawTask = await args.state.get(taskKey(id));
+    const task = parseStoredTask(rawTask) ?? parseLegacyStoredTaskForMigration(rawTask);
     if (!task) {
       missing += 1;
       continue;
@@ -1150,62 +1181,55 @@ function scheduledTaskPrincipalLabel(principal) {
 
 // src/tools/create-task.ts
 import { definePluginTool } from "@sentry/junior-plugin-api";
-import { z as z3 } from "zod";
-
-// src/types.ts
-var SCHEDULED_TASK_SYSTEM_ACTOR = Object.freeze({
-  platform: "system",
-  name: "scheduled-task"
-});
+import { z as z4 } from "zod";
 
 // src/tool-support.ts
 import { randomUUID } from "crypto";
 import {
   PluginToolInputError,
   pluginToolResultSchema,
-  pluginCredentialSubjectSchema as pluginCredentialSubjectSchema2,
   sourceSchema
 } from "@sentry/junior-plugin-api";
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 var TASK_ID_PREFIX = "sched";
 var MAX_LISTED_TASKS = 50;
 var DEFAULT_SCHEDULE_TIMEZONE = "America/Los_Angeles";
-var compactTaskResultSchema = z2.object({
-  id: z2.string(),
-  status: z2.enum(["active", "paused", "blocked", "deleted"]),
-  task: z2.string(),
-  schedule: z2.string(),
-  timezone: z2.string(),
-  recurrence: z2.unknown().nullable(),
-  next_run_at: z2.string().nullable(),
-  conversation_access: z2.unknown().nullable(),
-  credential_subject: z2.unknown().nullable(),
-  last_run_at: z2.string().nullable(),
-  run_now_at: z2.string().nullable()
+var compactTaskResultSchema = z3.object({
+  id: z3.string(),
+  status: z3.enum(["active", "paused", "blocked", "deleted"]),
+  task: z3.string(),
+  schedule: z3.string(),
+  timezone: z3.string(),
+  recurrence: z3.unknown().nullable(),
+  next_run_at: z3.string().nullable(),
+  conversation_access: z3.unknown().nullable(),
+  credential_mode: z3.enum(["system", "creator"]),
+  last_run_at: z3.string().nullable(),
+  run_now_at: z3.string().nullable()
 }).strict();
-var scheduleTaskResultDataSchema = z2.object({
-  ok: z2.literal(true),
+var scheduleTaskResultDataSchema = z3.object({
+  ok: z3.literal(true),
   task: compactTaskResultSchema
 }).strict();
 var scheduleTaskToolResultSchema = pluginToolResultSchema.extend({
-  ok: z2.literal(true),
-  status: z2.literal("success"),
-  target: z2.string(),
+  ok: z3.literal(true),
+  status: z3.literal("success"),
+  target: z3.string(),
   data: scheduleTaskResultDataSchema,
   task: compactTaskResultSchema
 });
-var scheduleListResultDataSchema = z2.object({
-  ok: z2.literal(true),
-  tasks: z2.array(compactTaskResultSchema),
-  truncated: z2.boolean()
+var scheduleListResultDataSchema = z3.object({
+  ok: z3.literal(true),
+  tasks: z3.array(compactTaskResultSchema),
+  truncated: z3.boolean()
 }).strict();
 var scheduleListToolResultSchema = pluginToolResultSchema.extend({
-  ok: z2.literal(true),
-  status: z2.literal("success"),
-  target: z2.string(),
+  ok: z3.literal(true),
+  status: z3.literal("success"),
+  target: z3.string(),
   data: scheduleListResultDataSchema,
-  tasks: z2.array(compactTaskResultSchema),
-  truncated: z2.boolean()
+  tasks: z3.array(compactTaskResultSchema),
+  truncated: z3.boolean()
 });
 function throwToolInputError(error) {
   throw new PluginToolInputError(error);
@@ -1240,8 +1264,8 @@ function requireActiveConversation(context) {
     channelId: parsed.data.channelId
   };
 }
-function requireActor(context) {
-  if (context.actor?.platform !== "slack") {
+function requireActor(context, destination) {
+  if (context.actor?.platform !== "slack" || context.actor.teamId !== destination.teamId) {
     throwToolInputError("No active Slack actor context is available.");
   }
   const userId = context.actor?.userId?.trim();
@@ -1269,23 +1293,6 @@ function getConversationAccess(destination) {
   }
   return { audience: "channel", visibility: "unknown" };
 }
-function getCredentialSubject(args) {
-  if (args.access.audience !== "direct" || args.access.visibility !== "private") {
-    return void 0;
-  }
-  if (!args.subject) {
-    return void 0;
-  }
-  const subject = pluginCredentialSubjectSchema2.safeParse(args.subject);
-  if (!subject.success) {
-    throwToolInputError("Active Slack credential subject is invalid.");
-  }
-  return {
-    type: subject.data.type,
-    userId: subject.data.userId,
-    allowedWhen: subject.data.allowedWhen
-  };
-}
 function sameDestination(task, destination) {
   const taskDestination = task.destination;
   return taskDestination.platform === "slack" && taskDestination.teamId === destination.teamId && taskDestination.channelId === destination.channelId;
@@ -1323,10 +1330,7 @@ function compactTask(task) {
     } : null,
     next_run_at: task.nextRunAtMs ? new Date(task.nextRunAtMs).toISOString() : null,
     conversation_access: task.conversationAccess ?? null,
-    credential_subject: task.credentialSubject ? {
-      type: task.credentialSubject.type,
-      allowed_when: task.credentialSubject.allowedWhen
-    } : null,
+    credential_mode: task.credentialMode,
     last_run_at: task.lastRunAtMs ? new Date(task.lastRunAtMs).toISOString() : null,
     run_now_at: task.runNowAtMs ? new Date(task.runNowAtMs).toISOString() : null
   });
@@ -1451,28 +1455,31 @@ function parseNextRunAtMs(nextRunAtIso) {
 // src/tools/create-task.ts
 function createSlackScheduleCreateTaskTool(context) {
   return definePluginTool({
-    description: "Create a one-time or recurring Junior task in the active Slack conversation. For one-time reminders or one-time scheduled work, omit recurrence entirely; never choose a default recurrence. Use only when the user explicitly asks Junior to do work later or on a recurring cadence. Do not create scheduled polling tasks to watch provider resources when a subscribable tool result can deliver the requested events. Only manage tasks for the active Slack DM or channel; never target threads, other channels, or another user's DM. When the task, schedule, and destination are clear, create it without asking for confirmation; ask only when one of those is ambiguous.",
+    description: "Create a one-time or recurring Junior task in the active Slack conversation. For one-time reminders or one-time scheduled work, omit recurrence entirely; never choose a default recurrence. Use only when the user explicitly asks Junior to do work later or on a recurring cadence. Do not create scheduled polling tasks to watch provider resources when a subscribable tool result can deliver the requested events. Only manage tasks for the active Slack DM or channel; never target threads, other channels, or another user's DM. Set credential_mode to creator only when the current user explicitly authorizes future scheduled use of their connected credentials. If connected-credential use is needed but authorization is ambiguous, ask before creating the task. Otherwise omit credential_mode and use system credentials. When the task, schedule, destination, and credential mode are clear, create it without another confirmation.",
     executionMode: "sequential",
-    inputSchema: z3.object({
-      task: z3.string().min(1).max(4e3),
-      schedule: z3.string().min(1).max(300),
-      schedule_kind: z3.enum(["one_off", "recurring"]).describe(
+    inputSchema: z4.object({
+      task: z4.string().min(1).max(4e3),
+      schedule: z4.string().min(1).max(300),
+      schedule_kind: z4.enum(["one_off", "recurring"]).describe(
         "Required schedule classification. Use one_off for one-time reminders or one-time scheduled work. Use recurring only when the user explicitly asks for a repeating schedule."
       ),
-      timezone: z3.string().min(1).max(80).describe(
+      timezone: z4.string().min(1).max(80).describe(
         "IANA timezone, e.g. 'America/Los_Angeles'. Defaults to the channel's configured timezone."
       ).optional(),
-      next_run_at: z3.string().min(1).describe(
+      next_run_at: z4.string().min(1).describe(
         "Exact next run time as an ISO timestamp, computed from the user's requested schedule."
       ).optional(),
-      recurrence: z3.enum(["daily", "weekly", "monthly", "yearly"]).nullable().describe(
+      recurrence: z4.enum(["daily", "weekly", "monthly", "yearly"]).nullable().describe(
         "Required when schedule_kind is recurring. Omit when schedule_kind is one_off. Recurring tasks run at most once per day: use daily, weekly, monthly, or yearly only."
+      ).optional(),
+      credential_mode: z4.enum(["system", "creator"]).nullable().describe(
+        "Use creator only when the current user explicitly authorizes future scheduled use of their connected credentials. Omit or use system otherwise."
       ).optional()
     }),
     outputSchema: scheduleTaskToolResultSchema,
     execute: async (input) => {
       const destination = requireActiveConversation(context);
-      const actor = requireActor(context);
+      const actor = requireActor(context, destination);
       const nowMs = Date.now();
       const timezone = input.timezone ?? getDefaultScheduleTimezone();
       validateCreateScheduleKind(input);
@@ -1490,17 +1497,13 @@ function createSlackScheduleCreateTaskTool(context) {
         timezone
       });
       const conversationAccess = getConversationAccess(destination);
-      const credentialSubject = getCredentialSubject({
-        access: conversationAccess,
-        subject: context.credentialSubject
-      });
       const task = {
         id: buildTaskId(),
         createdAtMs: nowMs,
         updatedAtMs: nowMs,
         createdBy: actor,
         conversationAccess,
-        ...credentialSubject ? { credentialSubject } : {},
+        credentialMode: input.credential_mode ?? "system",
         destination,
         executionActor: SCHEDULED_TASK_SYSTEM_ACTOR,
         nextRunAtMs,
@@ -1527,13 +1530,13 @@ function createSlackScheduleCreateTaskTool(context) {
 
 // src/tools/delete-task.ts
 import { definePluginTool as definePluginTool2 } from "@sentry/junior-plugin-api";
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 function createSlackScheduleDeleteTaskTool(context) {
   return definePluginTool2({
     description: "Delete one scheduled Junior task from the active Slack conversation. Use only task IDs returned for this conversation. Do not delete schedules from threads, other channels, or another user's DM.",
     executionMode: "sequential",
-    inputSchema: z4.object({
-      task_id: z4.string().min(1).describe(
+    inputSchema: z5.object({
+      task_id: z5.string().min(1).describe(
         "ID of the task to delete. Must be from this active Slack conversation."
       )
     }),
@@ -1558,12 +1561,12 @@ function createSlackScheduleDeleteTaskTool(context) {
 
 // src/tools/list-tasks.ts
 import { definePluginTool as definePluginTool3 } from "@sentry/junior-plugin-api";
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 function createSlackScheduleListTasksTool(context) {
   return definePluginTool3({
     description: "List scheduled Junior tasks for the active Slack conversation. Use when the user asks what is scheduled here, or when task IDs are needed before editing, deleting, or running schedules. Only manages tasks for the active Slack DM or channel.",
     annotations: { readOnlyHint: true, destructiveHint: false },
-    inputSchema: z5.object({}),
+    inputSchema: z6.object({}),
     outputSchema: scheduleListToolResultSchema,
     execute: async () => {
       const destination = requireActiveConversation(context);
@@ -1585,13 +1588,13 @@ function createSlackScheduleListTasksTool(context) {
 
 // src/tools/run-task-now.ts
 import { definePluginTool as definePluginTool4 } from "@sentry/junior-plugin-api";
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 function createSlackScheduleRunTaskNowTool(context) {
   return definePluginTool4({
     description: "Queue an existing active scheduled Junior task to run as soon as possible, without changing its cadence. Use when the user asks to run an existing scheduled task now. Use only task IDs returned for this conversation.",
     executionMode: "sequential",
-    inputSchema: z6.object({
-      task_id: z6.string().min(1).describe(
+    inputSchema: z7.object({
+      task_id: z7.string().min(1).describe(
         "ID of the active task to run now. Must be from this active Slack conversation."
       )
     }),
@@ -1620,24 +1623,27 @@ function createSlackScheduleRunTaskNowTool(context) {
 
 // src/tools/update-task.ts
 import { definePluginTool as definePluginTool5 } from "@sentry/junior-plugin-api";
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 function createSlackScheduleUpdateTaskTool(context) {
   return definePluginTool5({
-    description: "Edit, pause, resume, or reschedule an existing Junior scheduled task in the active Slack conversation. Use only task IDs returned for this conversation. Do not move scheduled tasks across conversations.",
+    description: "Edit, pause, resume, reschedule, or change credential use for an existing Junior scheduled task in the active Slack conversation. Use only task IDs returned for this conversation. Do not move scheduled tasks across conversations. Set credential_mode to creator only when the task creator explicitly authorizes future scheduled use of their connected credentials. If creator credential use is requested but authorization is ambiguous, ask before enabling it. If another user changes the executable task text, creator credential use is cleared automatically.",
     executionMode: "sequential",
-    inputSchema: z7.object({
-      task_id: z7.string().min(1).describe(
+    inputSchema: z8.object({
+      task_id: z8.string().min(1).describe(
         "ID of the task to update. Must be from this active Slack conversation."
       ),
-      task: z7.string().min(1).max(4e3).optional(),
-      schedule: z7.string().min(1).max(300).optional(),
-      timezone: z7.string().min(1).max(80).optional(),
-      next_run_at: z7.string().min(1).describe("Exact ISO timestamp when changing the next run time.").optional(),
-      recurrence: z7.enum(["daily", "weekly", "monthly", "yearly"]).nullable().describe(
+      task: z8.string().min(1).max(4e3).optional(),
+      schedule: z8.string().min(1).max(300).optional(),
+      timezone: z8.string().min(1).max(80).optional(),
+      next_run_at: z8.string().min(1).describe("Exact ISO timestamp when changing the next run time.").optional(),
+      recurrence: z8.enum(["daily", "weekly", "monthly", "yearly"]).nullable().describe(
         "Provide only for repeating schedules. Omit for one-time requests. Set to null to convert a recurring task to one-time."
       ).optional(),
-      status: z7.enum(["active", "paused", "blocked"]).describe(
+      status: z8.enum(["active", "paused", "blocked"]).describe(
         "Set to active, paused, or blocked to resume, pause, or block the task."
+      ).optional(),
+      credential_mode: z8.enum(["system", "creator"]).nullable().describe(
+        "Set creator only when the current actor is the task creator and explicitly authorizes future scheduled credential use. Set system to disable delegation."
       ).optional()
     }),
     outputSchema: scheduleTaskToolResultSchema,
@@ -1646,6 +1652,13 @@ function createSlackScheduleUpdateTaskTool(context) {
         context,
         taskId: input.task_id
       });
+      const actor = requireActor(context, lookup.destination);
+      const isCreator = actor.slackUserId === lookup.createdBy.slackUserId;
+      if (input.credential_mode === "creator" && !isCreator) {
+        throwToolInputError(
+          "Only the scheduled task creator can enable creator credential use."
+        );
+      }
       const timezone = input.timezone ?? lookup.schedule.timezone;
       validateRecurringFrequencyLimit(input);
       if (!isValidTimeZone(timezone)) {
@@ -1672,8 +1685,10 @@ function createSlackScheduleUpdateTaskTool(context) {
         timezone
       }) : lookup.schedule.recurrence;
       const nextStatus = status ?? lookup.status;
+      const credentialMode = input.task !== void 0 && input.task !== lookup.task.text && !isCreator ? "system" : input.credential_mode ?? lookup.credentialMode;
       const next = {
         ...lookup,
+        credentialMode,
         updatedAtMs: Date.now(),
         nextRunAtMs,
         runNowAtMs: nextStatus === "active" ? lookup.runNowAtMs : void 0,
@@ -1752,7 +1767,6 @@ function shouldSkipRun(task, run) {
 }
 function createSchedulerToolContext(ctx) {
   return {
-    credentialSubject: ctx.slack?.credentialSubject,
     source: ctx.source.platform === "slack" ? ctx.source : void 0,
     actor: ctx.actor?.platform === "slack" ? ctx.actor : void 0,
     store: schedulerStore2(ctx),
@@ -2007,6 +2021,16 @@ function createSchedulerPlugin() {
     },
     packageName: "@sentry/junior-scheduler",
     hooks: {
+      systemPrompt(ctx) {
+        if (ctx.platform !== "slack") {
+          return [];
+        }
+        return [
+          {
+            text: "Scheduled tasks use system credentials by default. Use the task creator's connected credentials only when they explicitly authorize future scheduled use. Requests such as 'use my account if needed' are ambiguous, not authorization; ask before creating or enabling creator credentials for the task."
+          }
+        ];
+      },
       tools(ctx) {
         if (ctx.source.platform !== "slack" || ctx.actor?.platform !== "slack") {
           return {};
@@ -2089,9 +2113,15 @@ function createSchedulerPlugin() {
           }
           let dispatch;
           try {
+            const credentialSubject = task.credentialMode === "creator" ? {
+              type: "user",
+              userId: task.createdBy.slackUserId,
+              allowedWhen: "scheduled-task",
+              taskId: task.id
+            } : void 0;
             dispatch = await ctx.agent.dispatch({
               idempotencyKey: run.id,
-              ...task.credentialSubject ? { credentialSubject: task.credentialSubject } : {},
+              ...credentialSubject ? { credentialSubject } : {},
               destination: task.destination,
               input: task.task.text,
               metadata: dispatchMetadata,

package/dist/store.d.ts

@@ -2,7 +2,7 @@ import { type PluginReadState, type PluginState } from "@sentry/junior-plugin-ap
 import type { PgDatabase } from "drizzle-orm/pg-core";
 import type { PgQueryResultHKT } from "drizzle-orm/pg-core/session";
 import * as schedulerSqlSchema from "./db/schema";
-import type { ScheduledRun, ScheduledTask } from "./types";
+import { type ScheduledRun, type ScheduledTask } from "./types";
 export type SchedulerDb = PgDatabase<PgQueryResultHKT, typeof schedulerSqlSchema>;
 export interface SchedulerStore {
     claimDueRun(args: {