@sentry/junior-sentry 0.134.0 → 0.136.0

package/README.md

@@ -1,34 +1,45 @@
 # @sentry/junior-sentry
 
-`@sentry/junior-sentry` adds Sentry investigation workflows and explicitly requested alert/monitor creation to Junior via per-user OAuth.
-
-Install it alongside `@sentry/junior`:
+Sentry investigations (per-user OAuth) and signed issue webhooks (internal integration) for Junior.
 
 ```bash
 pnpm add @sentry/junior @sentry/junior-sentry
 ```
 
-Add the package name to the plugin set exported from `plugins.ts`:
-
 ```ts
 import { defineJuniorPlugins } from "@sentry/junior";
+import { sentryPlugin } from "@sentry/junior-sentry";
 
-export const plugins = defineJuniorPlugins(["@sentry/junior-sentry"]);
+export const plugins = defineJuniorPlugins([sentryPlugin()]);
 ```
 
-## Sentry CLI Surface
+## User OAuth
+
+Set `SENTRY_CLIENT_ID` and `SENTRY_CLIENT_SECRET` from a Sentry OAuth app whose redirect is:
+
+```text
+<base-url>/api/oauth/callback/sentry
+```
 
-The plugin installs the npm `sentry` package as a runtime dependency and injects the current user's OAuth token as `SENTRY_AUTH_TOKEN` for Sentry skill commands. The OAuth grant supports alert, issue, project, team, member lookup, and release workflows. Existing connections must reconnect after upgrading to grant newly added scopes.
+Junior injects the user's token as `SENTRY_AUTH_TOKEN` for skill/CLI commands. Reconnect after scope changes.
 
-As of 2026-07-13, `sentry@latest` is `0.38.0`. The verified command groups used by the bundled skill are:
+Verified CLI surface (check live `sentry --help` before blocking):
 
 - `sentry issue list|events|explain|plan|view`
 - `sentry org list|view`
 - `sentry log list|view`
 - `sentry trace list|view|logs`
 - `sentry alert metrics list|view|create|edit|delete`
-- `sentry api <endpoint>` as a fallback when no first-class command covers the request
+- `sentry api <endpoint>` fallback
+
+## Issue webhooks
+
+Use a **Sentry internal integration** (not a public app install flow):
+
+1. Subscribe to the **issue** webhook resource.
+2. Point it at `https://<junior-host>/api/webhooks/sentry`.
+3. Set the org slug as `SENTRY_WEBHOOK_ORG` and the integration client secret as `SENTRY_WEBHOOK_SECRET`, then redeploy.
 
-The skill must verify live `sentry --help` output before declaring a Sentry data surface unavailable. Prefer singular command groups such as `sentry org list`; do not use stale forms such as `sentry organizations list`.
+Junior verifies `Sentry-Hook-Signature`, rejects payloads outside `SENTRY_WEBHOOK_ORG`, and publishes `issue.created` for `org/project#issueId` and `org/project`. Create watches/event tasks before the issue arrives; unmatched deliveries are not replayed.
 
-Full setup guide: https://junior.sentry.dev/extend/sentry-plugin/
+Full guide: https://junior.sentry.dev/extend/sentry-plugin/

package/dist/chunk-5IAUCX6U.js

@@ -0,0 +1,183 @@
+// src/resource-events/issue.ts
+var SENTRY_ISSUE_EVENTS = ["issue.created"];
+function sentryIssueResource(input) {
+  return {
+    identifier: `${input.org}/${input.project}#${input.issueId}`,
+    label: `Sentry issue ${input.org}/${input.project}#${input.issueId}`,
+    namespace: "sentry"
+  };
+}
+function sentryProjectResource(input) {
+  return {
+    identifier: `${input.org}/${input.project}`,
+    label: `Sentry project ${input.org}/${input.project}`,
+    namespace: "sentry"
+  };
+}
+
+// src/webhooks/resource-events.ts
+import { z } from "zod";
+var issueWebhookSchema = z.object({
+  action: z.string(),
+  data: z.object({
+    issue: z.object({
+      culprit: z.string().optional(),
+      firstSeen: z.string().optional(),
+      id: z.string().min(1),
+      issueCategory: z.string().optional(),
+      issueType: z.string().optional(),
+      level: z.string().optional(),
+      priority: z.string().optional(),
+      project: z.object({ slug: z.string().min(1) }).passthrough(),
+      status: z.string().optional(),
+      substatus: z.string().optional().nullable(),
+      title: z.string().optional(),
+      url: z.string().url(),
+      web_url: z.string().url().optional()
+    }).passthrough()
+  }),
+  installation: z.object({ uuid: z.string().min(1) }).passthrough()
+}).passthrough();
+function organizationSlug(issueApiUrl) {
+  try {
+    const segments = new URL(issueApiUrl).pathname.split("/").filter(Boolean);
+    const organizationsIndex = segments.indexOf("organizations");
+    return organizationsIndex >= 0 ? segments[organizationsIndex + 1] : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function providerTime(value) {
+  if (!value) return void 0;
+  if (/^\d+$/.test(value)) {
+    const seconds = Number(value);
+    return Number.isSafeInteger(seconds) ? seconds * 1e3 : void 0;
+  }
+  const parsed = Date.parse(value);
+  return Number.isFinite(parsed) ? parsed : void 0;
+}
+function issueText(issue) {
+  const parts = [
+    issue.title ? `Title: ${issue.title}` : void 0,
+    issue.culprit ? `Culprit: ${issue.culprit}` : void 0,
+    issue.level ? `Level: ${issue.level}` : void 0,
+    issue.priority ? `Priority: ${issue.priority}` : void 0,
+    issue.issueCategory ? `Category: ${issue.issueCategory}` : void 0,
+    issue.issueType ? `Type: ${issue.issueType}` : void 0,
+    issue.status ? `Status: ${issue.status}` : void 0,
+    issue.substatus ? `Substatus: ${issue.substatus}` : void 0,
+    issue.web_url ? `URL: ${issue.web_url}` : void 0
+  ].filter((part) => part !== void 0);
+  return parts.length > 0 ? parts.join("\n") : void 0;
+}
+function normalizeSentryResourceEvents(input) {
+  if (input.hookResource !== "issue") return [];
+  const parsed = issueWebhookSchema.safeParse(input.body);
+  if (!parsed.success || parsed.data.action !== "created") return [];
+  const issue = parsed.data.data.issue;
+  const org = organizationSlug(issue.url)?.toLowerCase();
+  if (!org || org !== input.webhookOrg.toLowerCase()) return [];
+  const issueResource = sentryIssueResource({
+    issueId: issue.id,
+    org,
+    project: issue.project.slug
+  });
+  const projectResource = sentryProjectResource({
+    org,
+    project: issue.project.slug
+  });
+  const eventType = "issue.created";
+  const occurredAtMs = providerTime(issue.firstSeen) ?? providerTime(input.hookTimestamp) ?? Date.now();
+  const untrustedText = issueText(issue);
+  const event = {
+    // Sentry assigns a new Request-ID to retries, so use resource identity for
+    // idempotency across repeated deliveries of the same lifecycle event.
+    eventKey: `sentry:${issueResource.identifier}:${eventType}`,
+    eventType,
+    occurredAtMs,
+    trustedSummary: `${issueResource.label} was created.`,
+    ...untrustedText ? { untrustedText } : {}
+  };
+  return [
+    { ...event, identifier: issueResource.identifier },
+    { ...event, identifier: projectResource.identifier }
+  ];
+}
+
+// src/webhooks/handler.ts
+import { createHmac, timingSafeEqual } from "crypto";
+function verifySentrySignature(body, signature, secret) {
+  if (!secret || !/^[0-9a-f]{64}$/i.test(signature)) return false;
+  const actual = Buffer.from(signature.toLowerCase());
+  const expected = Buffer.from(
+    createHmac("sha256", secret).update(body).digest("hex")
+  );
+  return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+function parseJson(body) {
+  try {
+    return JSON.parse(body);
+  } catch {
+    return void 0;
+  }
+}
+function createSentryWebhookRoute(args) {
+  return {
+    method: "POST",
+    path: "/api/webhooks/sentry",
+    async handler(request) {
+      const rawBody = await request.text();
+      const signature = request.headers.get("sentry-hook-signature") ?? "";
+      if (!verifySentrySignature(rawBody, signature, args.webhookSecret())) {
+        return new Response("Unauthorized", { status: 401 });
+      }
+      const body = parseJson(rawBody);
+      if (body === void 0) {
+        return new Response("Malformed Sentry webhook", { status: 400 });
+      }
+      const requestId = request.headers.get("request-id")?.trim();
+      const hookResource = request.headers.get("sentry-hook-resource")?.trim();
+      if (!requestId || !hookResource) {
+        return new Response("Malformed Sentry webhook headers", {
+          status: 400
+        });
+      }
+      const webhookOrg = args.webhookOrg();
+      if (!webhookOrg) {
+        return new Response("Sentry webhook organization is not configured", {
+          status: 503
+        });
+      }
+      const events = normalizeSentryResourceEvents({
+        body,
+        hookResource,
+        hookTimestamp: request.headers.get("sentry-hook-timestamp")?.trim() || void 0,
+        webhookOrg
+      });
+      for (const event of events) {
+        await args.resourceEvents.publish(event);
+      }
+      return new Response(events.length ? "Accepted" : "Ignored", {
+        status: 202
+      });
+    }
+  };
+}
+
+// src/webhooks/secret.ts
+function sentryWebhookSecret() {
+  return process.env.SENTRY_WEBHOOK_SECRET?.trim() || void 0;
+}
+function sentryWebhookOrg() {
+  return process.env.SENTRY_WEBHOOK_ORG?.trim().toLowerCase() || void 0;
+}
+
+export {
+  SENTRY_ISSUE_EVENTS,
+  sentryIssueResource,
+  sentryProjectResource,
+  normalizeSentryResourceEvents,
+  createSentryWebhookRoute,
+  sentryWebhookSecret,
+  sentryWebhookOrg
+};

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Sentry plugin runtime boundary.
+ *
+ * This package owns per-user Sentry OAuth, CLI setup, internal-integration
+ * issue webhook normalization, and Sentry resource identities. Junior core owns
+ * watches and event tasks.
+ */
+import { type PluginRegistration } from "@sentry/junior-plugin-api";
+/** Register Sentry runtime metadata and signed resource-event ingress. */
+export declare function sentryPlugin(): PluginRegistration;

package/dist/index.js

@@ -0,0 +1,81 @@
+import {
+  SENTRY_ISSUE_EVENTS,
+  createSentryWebhookRoute,
+  sentryWebhookOrg,
+  sentryWebhookSecret
+} from "./chunk-5IAUCX6U.js";
+
+// src/index.ts
+import {
+  defineJuniorPlugin
+} from "@sentry/junior-plugin-api";
+function sentryPlugin() {
+  return defineJuniorPlugin({
+    packageName: "@sentry/junior-sentry",
+    resourceEvents: {
+      resourceTypes: [
+        {
+          type: "issue",
+          supportedEvents: [...SENTRY_ISSUE_EVENTS],
+          suggestedEvents: [...SENTRY_ISSUE_EVENTS]
+        },
+        {
+          type: "project",
+          supportedEvents: [...SENTRY_ISSUE_EVENTS],
+          suggestedEvents: [...SENTRY_ISSUE_EVENTS]
+        }
+      ],
+      isEnabled: () => Boolean(sentryWebhookSecret()) && Boolean(sentryWebhookOrg()),
+      normalizeIdentifier: (identifier) => identifier.toLowerCase()
+    },
+    manifest: {
+      commandEnv: {
+        SENTRY_AUTH_TOKEN: "host_managed_credential"
+      },
+      configKeys: ["org", "project"],
+      credentials: {
+        authTokenEnv: "SENTRY_AUTH_TOKEN",
+        authTokenPlaceholder: "host_managed_credential",
+        domains: ["sentry.io", "us.sentry.io", "de.sentry.io"],
+        type: "oauth-bearer"
+      },
+      description: "Investigate Sentry telemetry, manage alerting, and receive issue webhooks",
+      displayName: "Sentry",
+      envVars: {
+        SENTRY_CLIENT_ID: {},
+        SENTRY_CLIENT_SECRET: {},
+        SENTRY_WEBHOOK_ORG: {},
+        SENTRY_WEBHOOK_SECRET: {}
+      },
+      name: "sentry",
+      oauth: {
+        authorizeEndpoint: "https://sentry.io/oauth/authorize/",
+        clientIdEnv: "SENTRY_CLIENT_ID",
+        clientSecretEnv: "SENTRY_CLIENT_SECRET",
+        scope: "alerts:write event:write member:read org:read project:releases project:write team:write",
+        tokenEndpoint: "https://sentry.io/oauth/token/"
+      },
+      runtimeDependencies: [
+        {
+          package: "sentry",
+          type: "npm",
+          version: "latest"
+        }
+      ]
+    },
+    hooks: {
+      routes(ctx) {
+        return [
+          createSentryWebhookRoute({
+            resourceEvents: ctx.resourceEvents,
+            webhookOrg: sentryWebhookOrg,
+            webhookSecret: sentryWebhookSecret
+          })
+        ];
+      }
+    }
+  });
+}
+export {
+  sentryPlugin
+};

package/dist/resource-events/issue.d.ts

@@ -0,0 +1,13 @@
+import type { SubscribableResource } from "@sentry/junior-plugin-api";
+export declare const SENTRY_ISSUE_EVENTS: readonly ["issue.created"];
+/** Build the stable Sentry issue identity shared by tools and webhooks. */
+export declare function sentryIssueResource(input: {
+    issueId: string;
+    org: string;
+    project: string;
+}): Pick<SubscribableResource, "identifier" | "label" | "namespace">;
+/** Build the stable Sentry project identity used for project-scoped events. */
+export declare function sentryProjectResource(input: {
+    org: string;
+    project: string;
+}): Pick<SubscribableResource, "identifier" | "label" | "namespace">;

package/dist/testing.d.ts

@@ -0,0 +1,4 @@
+export { sentryIssueResource, sentryProjectResource, } from "./resource-events/issue.js";
+export { createSentryWebhookRoute } from "./webhooks/handler.js";
+export { normalizeSentryResourceEvents } from "./webhooks/resource-events.js";
+export { sentryWebhookOrg, sentryWebhookSecret } from "./webhooks/secret.js";

package/dist/testing.js

@@ -0,0 +1,16 @@
+import {
+  createSentryWebhookRoute,
+  normalizeSentryResourceEvents,
+  sentryIssueResource,
+  sentryProjectResource,
+  sentryWebhookOrg,
+  sentryWebhookSecret
+} from "./chunk-5IAUCX6U.js";
+export {
+  createSentryWebhookRoute,
+  normalizeSentryResourceEvents,
+  sentryIssueResource,
+  sentryProjectResource,
+  sentryWebhookOrg,
+  sentryWebhookSecret
+};

package/dist/webhooks/handler.d.ts

@@ -0,0 +1,7 @@
+import type { PluginRoute, ResourceEventPublisher } from "@sentry/junior-plugin-api";
+/** Create the public, signed Sentry resource-event webhook route. */
+export declare function createSentryWebhookRoute(args: {
+    resourceEvents: ResourceEventPublisher;
+    webhookOrg(): string | undefined;
+    webhookSecret(): string | undefined;
+}): PluginRoute;

package/dist/webhooks/resource-events.d.ts

@@ -0,0 +1,8 @@
+import type { ResourceEventInput } from "@sentry/junior-plugin-api";
+/** Normalize one verified Sentry webhook into issue- and project-scoped events. */
+export declare function normalizeSentryResourceEvents(input: {
+    body: unknown;
+    hookResource: string;
+    hookTimestamp?: string;
+    webhookOrg: string;
+}): ResourceEventInput[];

package/dist/webhooks/secret.d.ts

@@ -0,0 +1,4 @@
+/** Read the internal-integration client secret used for issue webhook ingress. */
+export declare function sentryWebhookSecret(): string | undefined;
+/** Read the Sentry organization allowed to publish issue webhooks. */
+export declare function sentryWebhookOrg(): string | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-sentry",
-  "version": "0.134.0",
+  "version": "0.136.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -11,8 +11,35 @@
     "url": "git+https://github.com/getsentry/junior.git",
     "directory": "packages/junior-sentry"
   },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./testing": {
+      "types": "./dist/testing.d.ts",
+      "default": "./dist/testing.js"
+    }
+  },
   "files": [
-    "plugin.yaml",
+    "dist",
     "skills"
-  ]
+  ],
+  "dependencies": {
+    "zod": "^4.4.3",
+    "@sentry/junior-plugin-api": "0.136.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.9.1",
+    "oxlint": "^1.66.0",
+    "tsup": "^8.5.1",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.7"
+  },
+  "scripts": {
+    "build": "tsup && tsc -p tsconfig.build.json --emitDeclarationOnly",
+    "lint": "oxlint --config ../junior/.oxlintrc.json --deny-warnings src tests tsup.config.ts vitest.config.ts",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  }
 }

package/skills/sentry/SOURCES.md

@@ -4,22 +4,22 @@ Last updated: 2026-07-13
 
 ## Source inventory
 
-| Source                                                          | Trust tier | Confidence | Contribution                                                                                                                                       | Usage constraints                                                   |
-| --------------------------------------------------------------- | ---------- | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- |
-| `https://github.com/getsentry/junior/issues/271`                | canonical  | high       | Regression report: Junior tried stale `sentry organizations list` and should verify current CLI help before blocking.                              | Use as issue context, not as a full command reference.              |
-| `https://cli.sentry.dev/commands/issue/`                        | canonical  | high       | Current `sentry issue list`, target syntax, issue subcommands, and JSON support.                                                                   | Verify live help when runtime CLI differs.                          |
-| `https://cli.sentry.dev/commands/org/`                          | canonical  | high       | Current `sentry org list` and `sentry org view` commands.                                                                                          | Verify live help when runtime CLI differs.                          |
-| `https://cli.sentry.dev/commands/log/`                          | canonical  | high       | Current `sentry log list` and `sentry log view` commands, trace filtering, and log query flags.                                                    | Verify live help when runtime CLI differs.                          |
-| `https://cli.sentry.dev/commands/trace/`                        | canonical  | high       | Current `sentry trace list`, `view`, and `logs` commands.                                                                                          | Verify live help when runtime CLI differs.                          |
-| `https://cli.sentry.dev/commands/api/`                          | canonical  | high       | Authenticated `sentry api <endpoint>` fallback and request flags.                                                                                  | Use read-only requests unless the user asks for mutation.           |
-| `https://cli.sentry.dev/configuration/`                         | canonical  | high       | `SENTRY_AUTH_TOKEN`, JSON/global flags, cache controls, and runtime configuration behavior.                                                        | Junior injects credentials; do not persist or print tokens.         |
-| `pnpm view sentry version dist-tags description bin repository` | canonical  | high       | Confirmed npm package `sentry` latest is `0.38.0` and exposes the `sentry` binary.                                                                   | Package metadata only; command behavior still comes from help/docs. |
-| `pnpm dlx sentry@latest --help` and subcommand help             | canonical  | high       | Confirmed `alert metrics list|view|create|edit|delete`, including triggers and dry-run, plus the existing investigation commands.                   | Re-run when updating for a newer CLI.                               |
-| `packages/junior-sentry/plugin.yaml`                            | canonical  | high       | Confirms runtime dependency is the npm `sentry` package and auth token env is `SENTRY_AUTH_TOKEN`.                                                 | Local repo contract.                                                |
-| `https://github.com/getsentry/junior/issues/615`                | canonical  | high       | Regression report: Sentry product feature usage routed to Hex, then an explicit "use Sentry telemetry" redirect was ignored after Hex auth paused. | Use as routing evidence, not as command reference.                  |
-| `https://docs.sentry.io/api/monitors/create-a-monitor-for-a-project/` | canonical | high | Current public monitor creation endpoint, payload fields, and metric monitor examples. | Alerting API may evolve; verify live docs before writes. |
-| `https://docs.sentry.io/api/monitors/create-an-alert-for-an-organization/` | canonical | high | Current public alert workflow endpoint, connection fields, conditions, and actions. | Resolve integration and target IDs; never guess action identifiers. |
-| `getsentry/sentry` workflow engine endpoint and frontend form sources | canonical | high | Confirms `alerts:write`, `detectors`/`workflows` paths, dynamic anomaly payload shape, and legacy alert-rule deprecation. | Source-backed implementation detail; public API docs remain the user-facing contract. |
+| Source                                                                     | Trust tier | Confidence | Contribution                                                                                                                                                 | Usage constraints                                                                     |
+| -------------------------------------------------------------------------- | ---------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- | ------ | ---- | ---------------------------------------------------------------------------------- | ------------------------------------- |
+| `https://github.com/getsentry/junior/issues/271`                           | canonical  | high       | Regression report: Junior tried stale `sentry organizations list` and should verify current CLI help before blocking.                                        | Use as issue context, not as a full command reference.                                |
+| `https://cli.sentry.dev/commands/issue/`                                   | canonical  | high       | Current `sentry issue list`, target syntax, issue subcommands, and JSON support.                                                                             | Verify live help when runtime CLI differs.                                            |
+| `https://cli.sentry.dev/commands/org/`                                     | canonical  | high       | Current `sentry org list` and `sentry org view` commands.                                                                                                    | Verify live help when runtime CLI differs.                                            |
+| `https://cli.sentry.dev/commands/log/`                                     | canonical  | high       | Current `sentry log list` and `sentry log view` commands, trace filtering, and log query flags.                                                              | Verify live help when runtime CLI differs.                                            |
+| `https://cli.sentry.dev/commands/trace/`                                   | canonical  | high       | Current `sentry trace list`, `view`, and `logs` commands.                                                                                                    | Verify live help when runtime CLI differs.                                            |
+| `https://cli.sentry.dev/commands/api/`                                     | canonical  | high       | Authenticated `sentry api <endpoint>` fallback and request flags.                                                                                            | Use read-only requests unless the user asks for mutation.                             |
+| `https://cli.sentry.dev/configuration/`                                    | canonical  | high       | `SENTRY_AUTH_TOKEN`, JSON/global flags, cache controls, and runtime configuration behavior.                                                                  | Junior injects credentials; do not persist or print tokens.                           |
+| `pnpm view sentry version dist-tags description bin repository`            | canonical  | high       | Confirmed npm package `sentry` latest is `0.38.0` and exposes the `sentry` binary.                                                                           | Package metadata only; command behavior still comes from help/docs.                   |
+| `pnpm dlx sentry@latest --help` and subcommand help                        | canonical  | high       | Confirmed `alert metrics list                                                                                                                                | view                                                                                  | create | edit | delete`, including triggers and dry-run, plus the existing investigation commands. | Re-run when updating for a newer CLI. |
+| `packages/junior-sentry/src/index.ts`                                      | canonical  | high       | Confirms runtime dependency is the npm `sentry` package, auth token env is `SENTRY_AUTH_TOKEN`, and optional `SENTRY_WEBHOOK_SECRET` enables issue webhooks. | Local repo contract.                                                                  |
+| `https://github.com/getsentry/junior/issues/615`                           | canonical  | high       | Regression report: Sentry product feature usage routed to Hex, then an explicit "use Sentry telemetry" redirect was ignored after Hex auth paused.           | Use as routing evidence, not as command reference.                                    |
+| `https://docs.sentry.io/api/monitors/create-a-monitor-for-a-project/`      | canonical  | high       | Current public monitor creation endpoint, payload fields, and metric monitor examples.                                                                       | Alerting API may evolve; verify live docs before writes.                              |
+| `https://docs.sentry.io/api/monitors/create-an-alert-for-an-organization/` | canonical  | high       | Current public alert workflow endpoint, connection fields, conditions, and actions.                                                                          | Resolve integration and target IDs; never guess action identifiers.                   |
+| `getsentry/sentry` workflow engine endpoint and frontend form sources      | canonical  | high       | Confirms `alerts:write`, `detectors`/`workflows` paths, dynamic anomaly payload shape, and legacy alert-rule deprecation.                                    | Source-backed implementation detail; public API docs remain the user-facing contract. |
 
 ## Decisions
 
@@ -33,8 +33,8 @@ Last updated: 2026-07-13
 | Preserve stale plural subcommands as recommended forms.                                              | rejected | `organizations list` was the root failure; aliases should not be taught as canonical command shapes.          |
 | Create a broad new troubleshooting reference.                                                        | deferred | Current failure modes fit in the focused CLI reference without crowding `SKILL.md`.                           |
 | Permit explicitly requested alert/monitor writes only.                                               | adopted  | `alerts:write` is intentionally narrow; unrelated Sentry mutations remain out of scope.                       |
-| Prefer first-class `sentry alert metrics` commands.                                                    | adopted  | CLI `0.38.0` supports list, view, create, edit, delete, triggers, and dry-run.                                 |
-| Keep API fallback for dynamic anomaly detection.                                                       | adopted  | The current CLI create flags expose threshold triggers but no dynamic/anomaly configuration.                  |
+| Prefer first-class `sentry alert metrics` commands.                                                  | adopted  | CLI `0.38.0` supports list, view, create, edit, delete, triggers, and dry-run.                                |
+| Keep API fallback for dynamic anomaly detection.                                                     | adopted  | The current CLI create flags expose threshold triggers but no dynamic/anomaly configuration.                  |
 
 ## Coverage matrix
 

package/skills/sentry/SPEC.md

@@ -50,7 +50,7 @@ Out of scope:
 Authoritative sources:
 
 - Current Sentry CLI docs and live `sentry --help` output.
-- The Sentry plugin manifest and Junior runtime contracts.
+- The Sentry plugin runtime registration (`packages/junior-sentry/src/index.ts`) and Junior runtime contracts.
 - GitHub issues or PRs that document observed skill failures.
 
 Useful improvement sources:

package/plugin.yaml

@@ -1,27 +0,0 @@
-name: sentry
-display-name: Sentry
-description: Sentry issue tracking
-
-config-keys:
-  - org
-  - project
-
-credentials:
-  type: oauth-bearer
-  domains:
-    - sentry.io
-    - us.sentry.io
-    - de.sentry.io
-  auth-token-env: SENTRY_AUTH_TOKEN
-  auth-token-placeholder: host_managed_credential
-
-oauth:
-  client-id-env: SENTRY_CLIENT_ID
-  client-secret-env: SENTRY_CLIENT_SECRET
-  authorize-endpoint: https://sentry.io/oauth/authorize/
-  token-endpoint: https://sentry.io/oauth/token/
-  scope: "alerts:write event:write member:read org:read project:releases project:write team:write"
-
-runtime-dependencies:
-  - type: npm
-    package: "sentry"