@sentry/junior 0.100.0 → 0.101.0

package/README.md

@@ -50,4 +50,3 @@ Canonical docs: **https://junior.sentry.dev/**
 - Slack app setup: https://junior.sentry.dev/start-here/slack-app-setup/
 - Deployment: https://junior.sentry.dev/start-here/deploy-to-vercel/
 - Plugin setup: https://junior.sentry.dev/extend/
-- API reference: https://junior.sentry.dev/reference/api/

package/dist/api/conversations/schema.d.ts

@@ -310,7 +310,7 @@ export declare const conversationContextEventSchema: z.ZodDiscriminatedUnion<[z.
     type: z.ZodLiteral<"model_handoff">;
     createdAt: z.ZodString;
     fromModelId: z.ZodOptional<z.ZodString>;
-    summary: z.ZodOptional<z.ZodString>;
+    message: z.ZodOptional<z.ZodString>;
     toModelId: z.ZodString;
     transcriptIndex: z.ZodNumber;
 }, z.core.$strict>], "type">;
@@ -436,7 +436,7 @@ export declare const conversationDetailReportSchema: z.ZodObject<{
         type: z.ZodLiteral<"model_handoff">;
         createdAt: z.ZodString;
         fromModelId: z.ZodOptional<z.ZodString>;
-        summary: z.ZodOptional<z.ZodString>;
+        message: z.ZodOptional<z.ZodString>;
         toModelId: z.ZodString;
         transcriptIndex: z.ZodNumber;
     }, z.core.$strict>], "type">>>;

package/dist/api/schema.js

@@ -9,17 +9,17 @@ import {
   dailyConversationActivitySchema,
   locationDetailReportSchema,
   locationDirectoryReportSchema
-} from "../chunk-4AQUWWEM.js";
+} from "../chunk-HNIT4HXU.js";
 import {
   actorDirectoryReportSchema,
   actorProfileReportSchema
-} from "../chunk-IDZBM3NW.js";
+} from "../chunk-DBPLXSBK.js";
 import {
   conversationDetailReportSchema,
   conversationFeedSchema,
   conversationStatsReportSchema,
   conversationSubagentTranscriptReportSchema
-} from "../chunk-MM5UFDAC.js";
+} from "../chunk-HYDQULR2.js";
 import {
   healthReportSchema,
   pluginOperationalReportFeedSchema,

package/dist/api.js

@@ -5,9 +5,9 @@ import {
   personParamsSchema,
   subagentParamsSchema
 } from "./chunk-2RNOB32R.js";
-import "./chunk-4AQUWWEM.js";
-import "./chunk-IDZBM3NW.js";
-import "./chunk-MM5UFDAC.js";
+import "./chunk-HNIT4HXU.js";
+import "./chunk-DBPLXSBK.js";
+import "./chunk-HYDQULR2.js";
 import {
   readHealthReport
 } from "./chunk-QNVHH5PU.js";
@@ -126,7 +126,7 @@ function createJuniorApi() {
     return Response.json(await readPluginOperationalReportFeed());
   });
   app.get("/api/conversations", async (c) => {
-    const { readConversationFeed } = await import("./list-KHRAWZWU.js");
+    const { readConversationFeed } = await import("./list-J6ROVH56.js");
     const { actorEmail } = parseQuery(
       conversationFeedQuerySchema,
       c.req.query()
@@ -134,11 +134,11 @@ function createJuniorApi() {
     return Response.json(await readConversationFeed({ actorEmail }));
   });
   app.get("/api/conversations/stats", async () => {
-    const { readConversationStats } = await import("./stats-J3YGCYDF.js");
+    const { readConversationStats } = await import("./stats-Q5FRUXLY.js");
     return Response.json(await readConversationStats());
   });
   app.get("/api/conversations/:conversationId", async (c) => {
-    const { readConversationDetail } = await import("./detail-LU6COZO6.js");
+    const { readConversationDetail } = await import("./detail-4EPUMSDU.js");
     const { conversationId } = parseParams(
       conversationParamsSchema,
       c.req.param()
@@ -149,7 +149,7 @@ function createJuniorApi() {
   app.get(
     "/api/conversations/:conversationId/subagents/:subagentId",
     async (c) => {
-      const { readConversationSubagent } = await import("./subagent-P7HOSMVC.js");
+      const { readConversationSubagent } = await import("./subagent-YIINCFAS.js");
       const { conversationId, subagentId } = parseParams(
         subagentParamsSchema,
         c.req.param()
@@ -159,21 +159,21 @@ function createJuniorApi() {
     }
   );
   app.get("/api/people", async () => {
-    const { readPeopleList } = await import("./list-2FI5SFV7.js");
+    const { readPeopleList } = await import("./list-DA2ATOM4.js");
     return Response.json(await readPeopleList());
   });
   app.get("/api/people/:email", async (c) => {
     const { email } = parseParams(personParamsSchema, c.req.param());
-    const { readPeopleProfile } = await import("./profile-3O3OVENT.js");
+    const { readPeopleProfile } = await import("./profile-6NRWEKMZ.js");
     return Response.json(await readPeopleProfile(email));
   });
   app.get("/api/locations", async () => {
-    const { readLocationDirectory } = await import("./list-4ALSU6ZW.js");
+    const { readLocationDirectory } = await import("./list-7L5LY2WU.js");
     return Response.json(await readLocationDirectory());
   });
   app.get("/api/locations/:locationId", async (c) => {
     const { locationId } = parseParams(locationParamsSchema, c.req.param());
-    const { readLocationDetail } = await import("./detail-5SLCGT6J.js");
+    const { readLocationDetail } = await import("./detail-CD4SPJ4K.js");
     const report = await readLocationDetail(locationId);
     return report ? Response.json(report) : Response.json({ error: "Location not found." }, { status: 404 });
   });

package/dist/app.js

@@ -5,7 +5,7 @@ import {
   processPluginTask,
   requireTurnFailureEventId,
   scheduleSessionCompletedPluginTasks
-} from "./chunk-XSBIISXS.js";
+} from "./chunk-L2JIOAA2.js";
 import {
   buildSentryConversationUrl
 } from "./chunk-LVUKF5CE.js";
@@ -37,7 +37,7 @@ import {
   requestConversationContinuation,
   requestConversationWork,
   startConversationWork
-} from "./chunk-2T7DCRAW.js";
+} from "./chunk-EBFJOOUE.js";
 import {
   GET
 } from "./chunk-QNVHH5PU.js";
@@ -86,6 +86,7 @@ import {
   formatProviderLabel,
   formatSlackLink,
   getConfigDefaults,
+  getMcpAuthSession,
   getMcpStoredOAuthCredentials,
   latestReportedProgress,
   listThreadReplies,
@@ -105,12 +106,11 @@ import {
   splitSlackReplyText,
   startOAuthFlow,
   truncateStatusText
-} from "./chunk-45DMFMY2.js";
+} from "./chunk-UWGTSF5O.js";
 import {
   CooperativeTurnYieldError,
   TurnInputCommitLostError,
   TurnInputDeferredError,
-  applyPendingAuthUpdate,
   buildDeterministicTurnId,
   clearPendingAuth,
   coerceThreadArtifactsState,
@@ -134,11 +134,11 @@ import {
   persistWithRetry,
   persistYieldSessionRecord,
   startActiveTurn
-} from "./chunk-NSOCZGOH.js";
+} from "./chunk-XVR4O24H.js";
 import {
   JUNIOR_THREAD_STATE_TTL_MS,
   coerceThreadConversationState
-} from "./chunk-6DTVCPLO.js";
+} from "./chunk-XIMUQ4IU.js";
 import {
   abandonAgentTurnSessionRecord,
   failAgentTurnSessionRecord,
@@ -4497,6 +4497,11 @@ var CALLBACK_PAGES = {
     message: "Missing code parameter.",
     status: 400
   },
+  expired: {
+    title: "Authorization expired",
+    message: "This authorization link is no longer active. Return to Slack and retry the original request.",
+    status: 400
+  },
   success: {
     title: "Authorization complete",
     message: "Your MCP access is connected. Junior will continue the paused request in Slack.",
@@ -4508,6 +4513,12 @@ var CALLBACK_PAGES = {
     status: 500
   }
 };
+var McpOAuthAttemptExpiredError = class extends Error {
+  constructor() {
+    super("MCP OAuth authorization attempt is no longer current");
+    this.name = "McpOAuthAttemptExpiredError";
+  }
+};
 function mcpAuthorizationId(args) {
   return `${args.sessionId}:mcp:${args.provider}`;
 }
@@ -4597,20 +4608,19 @@ async function resumeAuthorizedMcpTurn(args) {
     provider,
     actorId: authSession.userId
   });
-  const resolvedSessionId = pendingAuth?.sessionId ?? authSession.sessionId;
+  if (pendingAuth?.authSessionId !== authSession.authSessionId) {
+    return;
+  }
+  const resolvedSessionId = pendingAuth.sessionId;
   const userMessage = getTurnUserMessage(conversation, resolvedSessionId);
-  if (pendingAuth) {
-    if (!isPendingAuthLatestRequest(conversation, pendingAuth)) {
-      clearPendingAuth(conversation, pendingAuth.sessionId);
-      await persistThreadStateById(threadId, { conversation });
-      await abandonAgentTurnSessionRecord({
-        conversationId: authSession.conversationId,
-        sessionId: pendingAuth.sessionId,
-        errorMessage: "Auth completed after a newer thread message abandoned this blocked request."
-      });
-      return;
-    }
-  } else if (conversation.processing.activeTurnId !== authSession.sessionId) {
+  if (!isPendingAuthLatestRequest(conversation, pendingAuth)) {
+    clearPendingAuth(conversation, pendingAuth.sessionId);
+    await persistThreadStateById(threadId, { conversation });
+    await abandonAgentTurnSessionRecord({
+      conversationId: authSession.conversationId,
+      sessionId: pendingAuth.sessionId,
+      errorMessage: "Auth completed after a newer thread message abandoned this blocked request."
+    });
     return;
   }
   if (!userMessage) {
@@ -4638,24 +4648,23 @@ async function resumeAuthorizedMcpTurn(args) {
         provider,
         actorId: authSession.userId
       });
-      const lockedSessionId = lockedPendingAuth?.sessionId ?? authSession.sessionId;
+      if (lockedPendingAuth?.authSessionId !== authSession.authSessionId) {
+        return false;
+      }
+      const lockedSessionId = lockedPendingAuth.sessionId;
       if (lockedSessionId !== resolvedSessionId) {
         return false;
       }
-      if (lockedPendingAuth) {
-        if (!isPendingAuthLatestRequest(lockedConversation, lockedPendingAuth)) {
-          clearPendingAuth(lockedConversation, lockedPendingAuth.sessionId);
-          await persistThreadStateById(threadId, {
-            conversation: lockedConversation
-          });
-          await abandonAgentTurnSessionRecord({
-            conversationId: authSession.conversationId,
-            sessionId: lockedPendingAuth.sessionId,
-            errorMessage: "Auth completed after a newer thread message abandoned this blocked request."
-          });
-          return false;
-        }
-      } else if (lockedConversation.processing.activeTurnId !== authSession.sessionId) {
+      if (!isPendingAuthLatestRequest(lockedConversation, lockedPendingAuth)) {
+        clearPendingAuth(lockedConversation, lockedPendingAuth.sessionId);
+        await persistThreadStateById(threadId, {
+          conversation: lockedConversation
+        });
+        await abandonAgentTurnSessionRecord({
+          conversationId: authSession.conversationId,
+          sessionId: lockedPendingAuth.sessionId,
+          errorMessage: "Auth completed after a newer thread message abandoned this blocked request."
+        });
         return false;
       }
       const lockedUserMessage = getTurnUserMessage(
@@ -4755,11 +4764,7 @@ async function resumeAuthorizedMcpTurn(args) {
           },
           durability: {
             recordPendingAuth: async (nextPendingAuth) => {
-              await applyPendingAuthUpdate({
-                conversation: lockedConversation,
-                conversationId: authSession.conversationId,
-                nextPendingAuth
-              });
+              lockedConversation.processing.pendingAuth = nextPendingAuth;
               await persistThreadStateById(threadId, {
                 conversation: lockedConversation
               });
@@ -4824,6 +4829,43 @@ async function resumeAuthorizedMcpTurn(args) {
     }
   });
 }
+async function isCurrentMcpAuthorizationAttempt(authSession, provider) {
+  if (!authSession.channelId || !authSession.threadTs) {
+    return false;
+  }
+  const threadId = `slack:${authSession.channelId}:${authSession.threadTs}`;
+  const currentState = await getPersistedThreadState(threadId);
+  const conversation = coerceThreadConversationState(currentState);
+  const pendingAuth = getConversationPendingAuth({
+    conversation,
+    kind: "mcp",
+    provider,
+    actorId: authSession.userId
+  });
+  return pendingAuth?.authSessionId === authSession.authSessionId && pendingAuth.sessionId === authSession.sessionId;
+}
+async function runCurrentMcpCredentialMutation(authSession, provider, mutation) {
+  if (!authSession.channelId || !authSession.threadTs) {
+    throw new McpOAuthAttemptExpiredError();
+  }
+  const threadId = `slack:${authSession.channelId}:${authSession.threadTs}`;
+  const stateAdapter = getStateAdapter();
+  await stateAdapter.connect();
+  const lock = await acquireActiveLock(stateAdapter, threadId);
+  if (!lock) {
+    throw new Error(
+      `Could not acquire MCP OAuth callback lock for ${threadId}`
+    );
+  }
+  try {
+    if (!await isCurrentMcpAuthorizationAttempt(authSession, provider)) {
+      throw new McpOAuthAttemptExpiredError();
+    }
+    return await mutation();
+  } finally {
+    await stateAdapter.releaseLock(lock);
+  }
+}
 async function GET4(request, provider, waitUntil, options) {
   const url = new URL(request.url);
   const state = url.searchParams.get("state")?.trim();
@@ -4839,7 +4881,23 @@ async function GET4(request, provider, waitUntil, options) {
     return htmlResponse("missing_code");
   }
   try {
-    const authSession = await finalizeMcpAuthorization(provider, state, code);
+    const pendingSession = await getMcpAuthSession(state);
+    if (!pendingSession || pendingSession.provider !== provider || !await isCurrentMcpAuthorizationAttempt(pendingSession, provider)) {
+      if (pendingSession) {
+        await deleteMcpAuthSession(pendingSession.authSessionId);
+      }
+      return htmlResponse("expired");
+    }
+    const authSession = await finalizeMcpAuthorization(
+      provider,
+      state,
+      code,
+      async (mutation) => await runCurrentMcpCredentialMutation(
+        pendingSession,
+        provider,
+        mutation
+      )
+    );
     try {
       await deleteMcpAuthSession(authSession.authSessionId);
     } catch (cleanupError) {
@@ -4860,6 +4918,10 @@ async function GET4(request, provider, waitUntil, options) {
     );
     return htmlResponse("success");
   } catch (callbackError) {
+    if (callbackError instanceof McpOAuthAttemptExpiredError) {
+      await deleteMcpAuthSession(state);
+      return htmlResponse("expired");
+    }
     logException(
       callbackError,
       "mcp_oauth_callback_failed",
@@ -5304,11 +5366,7 @@ async function resumeOAuthSessionRecordTurn(stored, options) {
           },
           durability: {
             recordPendingAuth: async (nextPendingAuth) => {
-              await applyPendingAuthUpdate({
-                conversation: lockedConversation,
-                conversationId: stored.resumeConversationId,
-                nextPendingAuth
-              });
+              lockedConversation.processing.pendingAuth = nextPendingAuth;
               await persistThreadStateById(stored.resumeConversationId, {
                 conversation: lockedConversation
               });
@@ -10108,11 +10166,7 @@ function createReplyToThread(deps) {
                 });
               },
               recordPendingAuth: async (pendingAuth) => {
-                await applyPendingAuthUpdate({
-                  conversation: preparedState.conversation,
-                  conversationId,
-                  nextPendingAuth: pendingAuth
-                });
+                preparedState.conversation.processing.pendingAuth = pendingAuth;
                 await persistThreadState(thread, {
                   conversation: preparedState.conversation
                 });
@@ -11200,11 +11254,7 @@ async function continueSlackAgentRun(payload, options) {
             },
             durability: {
               recordPendingAuth: async (nextPendingAuth) => {
-                await applyPendingAuthUpdate({
-                  conversation,
-                  conversationId: payload.conversationId,
-                  nextPendingAuth
-                });
+                conversation.processing.pendingAuth = nextPendingAuth;
                 await persistThreadStateById(payload.conversationId, {
                   conversation
                 });

package/dist/chat/agent/request.d.ts

@@ -133,7 +133,7 @@ export interface AgentRunDurability {
     /** Return true when the durable worker should pause at the next Pi boundary. */
     shouldYield?: () => boolean;
     drainSteeringMessages?: (accept: (messages: AgentRunSteeringMessage[]) => Promise<void>) => Promise<AgentRunSteeringMessage[]>;
-    recordPendingAuth?: (pendingAuth: ConversationPendingAuthState) => void | Promise<void>;
+    recordPendingAuth?: (pendingAuth: ConversationPendingAuthState | undefined) => void | Promise<void>;
     onSandboxAcquired?: (sandbox: SandboxAcquiredState) => void | Promise<void>;
     onArtifactStateUpdated?: (artifactState: ThreadArtifactsState) => void | Promise<void>;
 }

package/dist/chat/conversations/store.d.ts

@@ -26,7 +26,7 @@ export interface Conversation {
     /**
      * When retention purged this conversation's content. Set means messages and
      * steps were deleted wholesale; reporting presents the transcript as expired
-     * rather than privacy-redacted (`../../../specs/data-redaction-policy.md`).
+     * rather than privacy-redacted (`../../../../../policies/data-redaction.md`).
      */
     transcriptPurgedAtMs?: number;
     /** Persisted destination visibility. Undefined means no destination row exists. */

package/dist/chat/mcp/auth-store.d.ts

@@ -3,6 +3,7 @@ import type { OAuthDiscoveryState } from "@modelcontextprotocol/sdk/client/auth.
 import { type Destination, type Source } from "@sentry/junior-plugin-api";
 import type { ThreadArtifactsState } from "@/chat/state/artifacts";
 export interface McpAuthSessionState {
+    schemaVersion: 2;
     authSessionId: string;
     provider: string;
     userId: string;

package/dist/chat/mcp/client.d.ts

@@ -15,6 +15,7 @@ export declare class PluginMcpClient {
     private readonly plugin;
     private readonly options;
     private client?;
+    private clientPromise?;
     private lastAttemptedTransportSessionId?;
     private transport?;
     private listedTools?;
@@ -24,6 +25,7 @@ export declare class PluginMcpClient {
     close(): Promise<void>;
     private withSessionRecovery;
     private getClient;
+    private connectClient;
     private wrapAuth;
     private shouldResetMissingSession;
     private disposeClient;

package/dist/chat/mcp/oauth-provider.d.ts

@@ -5,8 +5,9 @@ export declare class StateBackedMcpOAuthClientProvider implements OAuthClientPro
     readonly authSessionId: string;
     private readonly callbackUrl;
     private readonly sessionContext?;
+    private readonly runCredentialMutation?;
     readonly clientMetadata: OAuthClientMetadata;
-    constructor(authSessionId: string, callbackUrl: string, sessionContext?: Omit<McpAuthSessionState, "authSessionId" | "authorizationUrl" | "codeVerifier" | "createdAtMs" | "updatedAtMs"> | undefined);
+    constructor(authSessionId: string, callbackUrl: string, sessionContext?: Omit<McpAuthSessionState, "schemaVersion" | "authSessionId" | "authorizationUrl" | "codeVerifier" | "createdAtMs" | "updatedAtMs"> | undefined, runCredentialMutation?: (<T>(mutation: () => Promise<T>) => Promise<T>) | undefined);
     get redirectUrl(): string;
     state(): Promise<string>;
     clientInformation(): Promise<OAuthClientInformationMixed | undefined>;
@@ -21,6 +22,8 @@ export declare class StateBackedMcpOAuthClientProvider implements OAuthClientPro
     invalidateCredentials(scope: "all" | "client" | "tokens" | "verifier" | "discovery"): Promise<void>;
     getMcpServerSessionId(): Promise<string | undefined>;
     saveMcpServerSessionId(sessionId: string | undefined): Promise<void>;
+    /** Route shared credential writes through callback-owned freshness control. */
+    private mutateCredentials;
     private getCredentialContext;
     private ensureSession;
     private requireSession;

package/dist/chat/mcp/oauth.d.ts

@@ -3,6 +3,7 @@ import type { ThreadArtifactsState } from "@/chat/state/artifacts";
 import { type McpAuthSessionState } from "./auth-store";
 import { StateBackedMcpOAuthClientProvider } from "./oauth-provider";
 export declare function getMcpOAuthCallbackPath(provider: string): string;
+/** Create one immutable provider authorization attempt for the active turn. */
 export declare function createMcpOAuthClientProvider(input: {
     provider: string;
     conversationId: string;
@@ -17,4 +18,5 @@ export declare function createMcpOAuthClientProvider(input: {
     configuration?: Record<string, unknown>;
     artifactState?: ThreadArtifactsState;
 }): Promise<StateBackedMcpOAuthClientProvider>;
-export declare function finalizeMcpAuthorization(provider: string, authSessionId: string, authorizationCode: string): Promise<McpAuthSessionState>;
+/** Exchange a callback code while guarding every shared credential mutation. */
+export declare function finalizeMcpAuthorization(provider: string, authSessionId: string, authorizationCode: string, runCredentialMutation?: <T>(mutation: () => Promise<T>) => Promise<T>): Promise<McpAuthSessionState>;

package/dist/chat/mcp/tool-manager.d.ts

@@ -43,6 +43,7 @@ export declare class McpToolManager {
     private readonly activeProviders;
     private readonly authorizationPendingProviders;
     private readonly clientsByProvider;
+    private readonly clientPromisesByProvider;
     private readonly toolsByProvider;
     constructor(plugins: PluginDefinition[], options?: McpToolManagerOptions);
     getActiveProviders(): string[];
@@ -61,6 +62,7 @@ export declare class McpToolManager {
     }): ManagedMcpToolDescriptor[];
     private filterListedTools;
     private getClient;
+    private createClient;
     private toManagedTool;
     private handleAuthorizationRequired;
     /** Return all active ManagedMcpTool objects, optionally filtered by provider. */

package/dist/chat/services/mcp-auth-orchestration.d.ts

@@ -30,7 +30,7 @@ export interface McpAuthOrchestrationInput {
     getConfiguration: () => Record<string, unknown>;
     getArtifactState: () => ThreadArtifactsState | undefined;
     getMergedArtifactState: () => ThreadArtifactsState;
-    recordPendingAuth?: (pendingAuth: ConversationPendingAuthState) => void | Promise<void>;
+    recordPendingAuth?: (pendingAuth: ConversationPendingAuthState | undefined) => void | Promise<void>;
     authorizationFlowMode?: AuthorizationFlowMode;
 }
 export interface McpAuthOrchestration {

package/dist/chat/services/pending-auth.d.ts

@@ -10,22 +10,30 @@ export declare function canReusePendingAuthLink(args: {
     scope?: string;
     sessionId: string;
 }): boolean;
+/** Return the exact pending authorization target for one actor and provider. */
 export declare function getConversationPendingAuth(args: {
     conversation: ThreadConversationState;
-    kind: AuthorizationPauseKind;
+    kind: "mcp";
     provider: string;
     actorId: string;
     scope?: string;
-}): ConversationPendingAuthState | undefined;
-export declare function clearPendingAuth(conversation: ThreadConversationState, sessionId?: string): void;
-/**
- * Apply a new pending-auth record to the conversation and, when replacing a
- * different session's pending-auth, mark the prior session record as abandoned.
- * Callers are responsible for persisting the mutated conversation afterwards.
- */
-export declare function applyPendingAuthUpdate(args: {
+}): Extract<ConversationPendingAuthState, {
+    kind: "mcp";
+}> | undefined;
+export declare function getConversationPendingAuth(args: {
     conversation: ThreadConversationState;
+    kind: "plugin";
+    provider: string;
+    actorId: string;
+    scope?: string;
+}): Extract<ConversationPendingAuthState, {
+    kind: "plugin";
+}> | undefined;
+export declare function clearPendingAuth(conversation: ThreadConversationState, sessionId?: string): void;
+/** Mark the prior blocked turn abandoned after a new auth attempt replaces it. */
+export declare function abandonReplacedPendingAuth(args: {
     conversationId: string | undefined;
+    previousPendingAuth: ConversationPendingAuthState | undefined;
     nextPendingAuth: ConversationPendingAuthState;
 }): Promise<void>;
 /**

package/dist/chat/state/conversation.d.ts

@@ -1,4 +1,3 @@
-import type { AuthorizationPauseKind } from "@/chat/services/auth-pause";
 type ConversationRole = "assistant" | "system" | "user";
 export interface ConversationAuthor {
     fullName?: string;
@@ -39,14 +38,19 @@ export interface ConversationProcessingState {
     lastCompletedAtMs?: number;
     pendingAuth?: ConversationPendingAuthState;
 }
-export interface ConversationPendingAuthState {
-    kind: AuthorizationPauseKind;
+interface ConversationPendingAuthBase {
     linkSentAtMs: number;
     provider: string;
     actorId: string;
     scope?: string;
     sessionId: string;
 }
+export type ConversationPendingAuthState = (ConversationPendingAuthBase & {
+    authSessionId: string;
+    kind: "mcp";
+}) | (ConversationPendingAuthBase & {
+    kind: "plugin";
+});
 export interface ConversationStats {
     compactedMessageCount: number;
     estimatedContextTokens: number;

package/dist/{chunk-VY7BT4SM.js → chunk-5VGJJSSV.js}

@@ -465,10 +465,11 @@ function historyContent(args) {
     ) : marker?.entry.reason === "handoff" ? summaryIndex(projected, projectedProvenance, [
       MODEL_HANDOFF_SUMMARY_PREFIX
     ]) : -1;
-    const summary = replacementSummaryIndex >= 0 ? summaryAfterPrefix(
+    const summary = marker?.entry.reason === "compaction" && replacementSummaryIndex >= 0 ? summaryAfterPrefix(
       projected[replacementSummaryIndex],
-      marker?.entry.reason === "handoff" ? [MODEL_HANDOFF_SUMMARY_PREFIX] : COMPACTION_SUMMARY_PREFIXES
+      COMPACTION_SUMMARY_PREFIXES
     ) : void 0;
+    const handoffMessage = marker?.entry.reason === "handoff" && replacementSummaryIndex >= 0 ? messageText(projected[replacementSummaryIndex]) || void 0 : void 0;
     if (marker?.entry.reason === "compaction") {
       contextEvents.push({
         type: "context_compacted",
@@ -483,7 +484,7 @@ function historyContent(args) {
         createdAt: new Date(marker.createdAtMs).toISOString(),
         ...previousModelId ? { fromModelId: previousModelId } : {},
         toModelId: marker.entry.modelId,
-        ...args.canExposePayload && summary ? { summary } : {},
+        ...args.canExposePayload && handoffMessage ? { message: handoffMessage } : {},
         transcriptIndex: messages.length
       });
     }

package/dist/{chunk-IDZBM3NW.js → chunk-DBPLXSBK.js}

@@ -2,7 +2,7 @@ import {
   actorIdentitySchema,
   conversationStatsItemSchema,
   conversationSummaryReportSchema
-} from "./chunk-MM5UFDAC.js";
+} from "./chunk-HYDQULR2.js";
 
 // src/api/people/schema.ts
 import { z } from "zod";

package/dist/{chunk-2T7DCRAW.js → chunk-EBFJOOUE.js}

@@ -1,6 +1,6 @@
 import {
   JUNIOR_THREAD_STATE_TTL_MS
-} from "./chunk-6DTVCPLO.js";
+} from "./chunk-XIMUQ4IU.js";
 import {
   getChatConfig,
   getDefaultRedisStateAdapterFor,

package/dist/{chunk-4AQUWWEM.js → chunk-HNIT4HXU.js}

@@ -2,7 +2,7 @@ import {
   actorIdentitySchema,
   conversationStatsItemSchema,
   conversationSummaryReportSchema
-} from "./chunk-MM5UFDAC.js";
+} from "./chunk-HYDQULR2.js";
 import {
   juniorDestinationKindSchema
 } from "./chunk-FXFQNHRU.js";

package/dist/{chunk-MM5UFDAC.js → chunk-HYDQULR2.js}

@@ -131,7 +131,7 @@ var conversationContextEventSchema = z.discriminatedUnion("type", [
     type: z.literal("model_handoff"),
     createdAt: z.string(),
     fromModelId: z.string().optional(),
-    summary: z.string().optional(),
+    message: z.string().optional(),
     toModelId: z.string(),
     transcriptIndex: z.number().int().nonnegative()
   }).strict()

package/dist/{chunk-XSBIISXS.js → chunk-L2JIOAA2.js}

@@ -9,10 +9,10 @@ import {
   getPersistedThreadState,
   markTurnCompleted,
   mergeArtifactsState
-} from "./chunk-NSOCZGOH.js";
+} from "./chunk-XVR4O24H.js";
 import {
   coerceThreadConversationState
-} from "./chunk-6DTVCPLO.js";
+} from "./chunk-XIMUQ4IU.js";
 import {
   getAgentTurnSessionRecord
 } from "./chunk-IVXL57YF.js";