@sentry/junior 0.100.0 → 0.101.0

package/dist/{chunk-45DMFMY2.js → chunk-UWGTSF5O.js}

@@ -1,6 +1,7 @@
 import {
   CooperativeTurnYieldError,
   TurnInputCommitLostError,
+  abandonReplacedPendingAuth,
   canReusePendingAuthLink,
   getInterruptionMarker,
   isTurnInputCommitLostError,
@@ -10,10 +11,10 @@ import {
   persistRunningSessionRecord,
   persistTimeoutSessionRecord,
   persistYieldSessionRecord
-} from "./chunk-NSOCZGOH.js";
+} from "./chunk-XVR4O24H.js";
 import {
   JUNIOR_THREAD_STATE_TTL_MS
-} from "./chunk-6DTVCPLO.js";
+} from "./chunk-XIMUQ4IU.js";
 import {
   addAgentTurnUsage,
   hasAgentTurnUsage
@@ -3151,6 +3152,7 @@ var PluginMcpClient = class {
   plugin;
   options;
   client;
+  clientPromise;
   lastAttemptedTransportSessionId;
   transport;
   listedTools;
@@ -3227,6 +3229,20 @@ var PluginMcpClient = class {
     if (this.client) {
       return this.client;
     }
+    if (this.clientPromise) {
+      return await this.clientPromise;
+    }
+    const clientPromise = this.connectClient();
+    this.clientPromise = clientPromise;
+    try {
+      return await clientPromise;
+    } finally {
+      if (this.clientPromise === clientPromise) {
+        this.clientPromise = void 0;
+      }
+    }
+  }
+  async connectClient() {
     const mcp = this.plugin.manifest.mcp;
     if (!mcp) {
       throw new Error(
@@ -3289,6 +3305,7 @@ var PluginMcpClient = class {
     this.listedTools = void 0;
     this.transport = void 0;
     this.client = void 0;
+    this.clientPromise = void 0;
     if (transport) {
       await transport.close();
     }
@@ -3337,6 +3354,9 @@ function getMcpAwareTelemetryMessage(error, privacy) {
 }
 
 // src/chat/mcp/tool-manager.ts
+var MAX_TOOL_RESULT_TOKENS = 1e4;
+var MAX_TOOL_RESULT_BYTES = 32 * 1024;
+var CHARS_PER_ESTIMATED_TOKEN = 4;
 function normalizeMcpToolName(provider, toolName) {
   return `mcp__${provider}__${toolName}`;
 }
@@ -3407,16 +3427,80 @@ function toAgentToolContent(result) {
   }
   return [{ type: "text", text: "ok" }];
 }
+function utf8Bytes(value) {
+  return Buffer.byteLength(value, "utf8");
+}
+function prefixWithin(value, maxChars, maxBytes) {
+  let low = 0;
+  let high = Math.min(value.length, maxChars);
+  while (low < high) {
+    const middle = Math.ceil((low + high) / 2);
+    if (utf8Bytes(value.slice(0, middle)) <= maxBytes) {
+      low = middle;
+    } else {
+      high = middle - 1;
+    }
+  }
+  if (low > 0 && /[\uD800-\uDBFF]/.test(value[low - 1])) {
+    low -= 1;
+  }
+  return value.slice(0, low);
+}
+function suffixWithin(value, maxChars, maxBytes) {
+  let low = Math.max(0, value.length - maxChars);
+  let high = value.length;
+  while (low < high) {
+    const middle = Math.floor((low + high) / 2);
+    if (utf8Bytes(value.slice(middle)) <= maxBytes) {
+      high = middle;
+    } else {
+      low = middle + 1;
+    }
+  }
+  if (low < value.length && /[\uDC00-\uDFFF]/.test(value[low])) {
+    low += 1;
+  }
+  return value.slice(low);
+}
+function boundMcpContent(content) {
+  const text = content.filter((part) => part.type === "text").map((part) => part.text).join("\n\n");
+  const originalBytes = utf8Bytes(text);
+  const originalTokens = Math.ceil(text.length / CHARS_PER_ESTIMATED_TOKEN);
+  if (originalTokens <= MAX_TOOL_RESULT_TOKENS && originalBytes <= MAX_TOOL_RESULT_BYTES) {
+    return content;
+  }
+  const warning = `
+
+Warning: truncated output (original token count: ${originalTokens}; original bytes: ${originalBytes})
+
+`;
+  const remainingChars = MAX_TOOL_RESULT_TOKENS * CHARS_PER_ESTIMATED_TOKEN - warning.length;
+  const remainingBytes = MAX_TOOL_RESULT_BYTES - utf8Bytes(warning);
+  const head = prefixWithin(
+    text,
+    Math.ceil(remainingChars / 2),
+    Math.ceil(remainingBytes / 2)
+  );
+  const tail = suffixWithin(
+    text.slice(head.length),
+    remainingChars - head.length,
+    remainingBytes - utf8Bytes(head)
+  );
+  return [
+    { type: "text", text: `${head}${warning}${tail}` },
+    ...content.filter((part) => part.type === "image")
+  ];
+}
 function toModelVisibleMcpContent(result) {
   const content = toAgentToolContent(result);
   if (content.some((part) => part.type === "image")) {
-    return content;
+    return boundMcpContent(content);
   }
   const structured = summarizeStructuredContent(result.structuredContent);
   if (structured) {
-    return [{ type: "text", text: structured }];
+    return boundMcpContent([{ type: "text", text: structured }]);
   }
-  return content;
+  return boundMcpContent(content);
 }
 function describeMcpTool(provider, tool) {
   const prefix = `[${provider}]`;
@@ -3453,6 +3537,7 @@ var McpToolManager = class {
   activeProviders = /* @__PURE__ */ new Set();
   authorizationPendingProviders = /* @__PURE__ */ new Set();
   clientsByProvider = /* @__PURE__ */ new Map();
+  clientPromisesByProvider = /* @__PURE__ */ new Map();
   toolsByProvider = /* @__PURE__ */ new Map();
   getActiveProviders() {
     return [...this.activeProviders].sort(
@@ -3545,6 +3630,21 @@ var McpToolManager = class {
     if (existing) {
       return existing;
     }
+    const pending = this.clientPromisesByProvider.get(plugin.manifest.name);
+    if (pending) {
+      return await pending;
+    }
+    const clientPromise = this.createClient(plugin);
+    this.clientPromisesByProvider.set(plugin.manifest.name, clientPromise);
+    try {
+      return await clientPromise;
+    } finally {
+      if (this.clientPromisesByProvider.get(plugin.manifest.name) === clientPromise) {
+        this.clientPromisesByProvider.delete(plugin.manifest.name);
+      }
+    }
+  }
+  async createClient(plugin) {
     const authProvider = this.options.authProviderFactory ? await this.options.authProviderFactory(plugin) : void 0;
     const client = new PluginMcpClient(plugin, {
       ...authProvider ? { authProvider } : {},
@@ -10006,13 +10106,19 @@ function createPluginAuthOrchestration(input) {
       }
     }
     if (input.sessionId && recordPendingAuth) {
-      await recordPendingAuth({
+      const nextPendingAuth = {
         kind: "plugin",
         provider,
         actorId: input.actorId,
         ...options?.scope ? { scope: options.scope } : {},
         sessionId: input.sessionId,
         linkSentAtMs: reusingPendingLink ? input.pendingAuth.linkSentAtMs : Date.now()
+      };
+      await recordPendingAuth(nextPendingAuth);
+      await abandonReplacedPendingAuth({
+        conversationId: input.conversationId,
+        previousPendingAuth: input.pendingAuth,
+        nextPendingAuth
       });
     }
     if (input.conversationId && input.sessionId) {
@@ -12580,9 +12686,9 @@ import { StreamableHTTPClientTransport as StreamableHTTPClientTransport2 } from
 import {
   sourceSchema as sourceSchema2
 } from "@sentry/junior-plugin-api";
-var MCP_AUTH_SESSION_PREFIX = "junior:mcp_auth_session";
+var MCP_AUTH_SESSION_PREFIX = "junior:mcp_oauth_attempt:v2";
 var MCP_AUTH_CREDENTIALS_PREFIX = "junior:mcp_auth_credentials";
-var MCP_AUTH_SESSION_INDEX_PREFIX = "junior:mcp_auth_session_index";
+var MCP_AUTH_SESSION_INDEX_PREFIX = "junior:mcp_oauth_attempt_index:v2";
 var MCP_SERVER_SESSION_PREFIX = "junior:mcp_server_session";
 var MCP_AUTH_SESSION_TTL_MS = 24 * 60 * 60 * 1e3;
 var MCP_AUTH_CREDENTIALS_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
@@ -12624,7 +12730,7 @@ function parseMcpAuthSession(value) {
     if (!isRecord(parsed)) {
       return void 0;
     }
-    if (typeof parsed.authSessionId !== "string" || typeof parsed.provider !== "string" || typeof parsed.userId !== "string" || typeof parsed.conversationId !== "string" || typeof parsed.sessionId !== "string" || typeof parsed.userMessage !== "string" || typeof parsed.createdAtMs !== "number" || typeof parsed.updatedAtMs !== "number") {
+    if (parsed.schemaVersion !== 2 || typeof parsed.authSessionId !== "string" || typeof parsed.provider !== "string" || typeof parsed.userId !== "string" || typeof parsed.conversationId !== "string" || typeof parsed.sessionId !== "string" || typeof parsed.userMessage !== "string" || typeof parsed.createdAtMs !== "number" || typeof parsed.updatedAtMs !== "number") {
       return void 0;
     }
     const destination = parsed.destination === void 0 ? void 0 : parseDestination(parsed.destination);
@@ -12636,6 +12742,7 @@ function parseMcpAuthSession(value) {
       return void 0;
     }
     return {
+      schemaVersion: 2,
       authSessionId: parsed.authSessionId,
       provider: parsed.provider,
       userId: parsed.userId,
@@ -12733,6 +12840,7 @@ async function patchMcpAuthSession(authSessionId, patch) {
   const next = {
     ...current,
     ...patch,
+    schemaVersion: 2,
     authSessionId: current.authSessionId,
     provider: current.provider,
     userId: current.userId,
@@ -12777,25 +12885,6 @@ async function deleteMcpAuthSessionsForUserProvider(userId, provider) {
   }
   await stateAdapter.delete(indexKey);
 }
-async function getLatestMcpAuthSessionForUserProvider(userId, provider) {
-  const stateAdapter = await getConnectedStateAdapter();
-  const authSessionIds = parseSessionIndex(
-    await stateAdapter.get(sessionIndexKey(userId, provider))
-  );
-  let latestSession;
-  for (const authSessionId of authSessionIds) {
-    const session = parseMcpAuthSession(
-      await stateAdapter.get(sessionKey(authSessionId))
-    );
-    if (!session) {
-      continue;
-    }
-    if (!latestSession || session.updatedAtMs > latestSession.updatedAtMs) {
-      latestSession = session;
-    }
-  }
-  return latestSession;
-}
 async function getMcpStoredOAuthCredentials(userId, provider) {
   const stateAdapter = await getConnectedStateAdapter();
   return parseStoredCredentials(
@@ -12854,15 +12943,17 @@ function clientAllowsRedirectUri(clientInformation, callbackUrl) {
   return redirectUris.includes(callbackUrl);
 }
 var StateBackedMcpOAuthClientProvider = class {
-  constructor(authSessionId, callbackUrl, sessionContext) {
+  constructor(authSessionId, callbackUrl, sessionContext, runCredentialMutation) {
     this.authSessionId = authSessionId;
     this.callbackUrl = callbackUrl;
     this.sessionContext = sessionContext;
+    this.runCredentialMutation = runCredentialMutation;
     this.clientMetadata = createClientMetadata(callbackUrl);
   }
   authSessionId;
   callbackUrl;
   sessionContext;
+  runCredentialMutation;
   clientMetadata;
   get redirectUrl() {
     return this.callbackUrl;
@@ -12886,11 +12977,16 @@ var StateBackedMcpOAuthClientProvider = class {
     return void 0;
   }
   async saveClientInformation(clientInformation) {
-    const session = await this.getCredentialContext();
-    const credentials = await getMcpStoredOAuthCredentials(session.userId, session.provider) ?? {};
-    await putMcpStoredOAuthCredentials(session.userId, session.provider, {
-      ...credentials,
-      clientInformation
+    await this.mutateCredentials(async () => {
+      const session = await this.getCredentialContext();
+      const credentials = await getMcpStoredOAuthCredentials(
+        session.userId,
+        session.provider
+      ) ?? {};
+      await putMcpStoredOAuthCredentials(session.userId, session.provider, {
+        ...credentials,
+        clientInformation
+      });
     });
   }
   async tokens() {
@@ -12902,19 +12998,32 @@ var StateBackedMcpOAuthClientProvider = class {
     return credentials?.tokens;
   }
   async saveTokens(tokens) {
-    const session = await this.getCredentialContext();
-    const credentials = await getMcpStoredOAuthCredentials(session.userId, session.provider) ?? {};
-    await putMcpStoredOAuthCredentials(session.userId, session.provider, {
-      ...credentials,
-      tokens
+    await this.mutateCredentials(async () => {
+      const session = await this.getCredentialContext();
+      const credentials = await getMcpStoredOAuthCredentials(
+        session.userId,
+        session.provider
+      ) ?? {};
+      await putMcpStoredOAuthCredentials(session.userId, session.provider, {
+        ...credentials,
+        tokens
+      });
     });
   }
   async redirectToAuthorization(authorizationUrl) {
+    const existing = await getMcpAuthSession(this.authSessionId);
+    if (existing?.authorizationUrl && existing.authorizationUrl !== authorizationUrl.toString()) {
+      throw new Error("MCP OAuth authorization attempt is already initialized");
+    }
     await this.ensureSession({
       authorizationUrl: authorizationUrl.toString()
     });
   }
   async saveCodeVerifier(codeVerifier) {
+    const existing = await getMcpAuthSession(this.authSessionId);
+    if (existing?.codeVerifier && existing.codeVerifier !== codeVerifier) {
+      throw new Error("MCP OAuth authorization attempt is already initialized");
+    }
     await this.ensureSession({ codeVerifier });
   }
   async codeVerifier() {
@@ -12925,11 +13034,16 @@ var StateBackedMcpOAuthClientProvider = class {
     return session.codeVerifier;
   }
   async saveDiscoveryState(state) {
-    const session = await this.getCredentialContext();
-    const credentials = await getMcpStoredOAuthCredentials(session.userId, session.provider) ?? {};
-    await putMcpStoredOAuthCredentials(session.userId, session.provider, {
-      ...credentials,
-      discoveryState: state
+    await this.mutateCredentials(async () => {
+      const session = await this.getCredentialContext();
+      const credentials = await getMcpStoredOAuthCredentials(
+        session.userId,
+        session.provider
+      ) ?? {};
+      await putMcpStoredOAuthCredentials(session.userId, session.provider, {
+        ...credentials,
+        discoveryState: state
+      });
     });
   }
   async discoveryState() {
@@ -12941,34 +13055,36 @@ var StateBackedMcpOAuthClientProvider = class {
     return credentials?.discoveryState;
   }
   async invalidateCredentials(scope) {
-    const session = await this.getCredentialContext();
-    const credentials = await getMcpStoredOAuthCredentials(session.userId, session.provider) ?? {};
-    await putMcpStoredOAuthCredentials(session.userId, session.provider, {
-      ...scope === "tokens" || scope === "all" ? {} : credentials.tokens ? { tokens: credentials.tokens } : {},
-      ...scope === "client" || scope === "all" ? {} : credentials.clientInformation ? { clientInformation: credentials.clientInformation } : {},
-      ...scope === "discovery" || scope === "all" ? {} : credentials.discoveryState ? { discoveryState: credentials.discoveryState } : {}
+    await this.mutateCredentials(async () => {
+      const session = await this.getCredentialContext();
+      const credentials = await getMcpStoredOAuthCredentials(
+        session.userId,
+        session.provider
+      ) ?? {};
+      await putMcpStoredOAuthCredentials(session.userId, session.provider, {
+        ...scope === "tokens" || scope === "all" ? {} : credentials.tokens ? { tokens: credentials.tokens } : {},
+        ...scope === "client" || scope === "all" ? {} : credentials.clientInformation ? { clientInformation: credentials.clientInformation } : {},
+        ...scope === "discovery" || scope === "all" ? {} : credentials.discoveryState ? { discoveryState: credentials.discoveryState } : {}
+      });
     });
-    if (scope === "verifier" || scope === "all") {
-      const authSession = await getMcpAuthSession(this.authSessionId);
-      if (authSession) {
-        await patchMcpAuthSession(this.authSessionId, {
-          codeVerifier: void 0,
-          ...scope === "all" ? { authorizationUrl: void 0 } : {}
-        });
-      }
-    }
   }
   async getMcpServerSessionId() {
     const session = await this.getCredentialContext();
     return await getMcpServerSessionId(session.userId, session.provider);
   }
   async saveMcpServerSessionId(sessionId) {
-    const session = await this.getCredentialContext();
-    if (!sessionId) {
-      await deleteMcpServerSessionId(session.userId, session.provider);
-      return;
-    }
-    await putMcpServerSessionId(session.userId, session.provider, sessionId);
+    await this.mutateCredentials(async () => {
+      const session = await this.getCredentialContext();
+      if (!sessionId) {
+        await deleteMcpServerSessionId(session.userId, session.provider);
+        return;
+      }
+      await putMcpServerSessionId(session.userId, session.provider, sessionId);
+    });
+  }
+  /** Route shared credential writes through callback-owned freshness control. */
+  async mutateCredentials(mutation) {
+    return this.runCredentialMutation ? await this.runCredentialMutation(mutation) : await mutation();
   }
   async getCredentialContext() {
     return this.sessionContext ?? await this.requireSession();
@@ -12983,6 +13099,7 @@ var StateBackedMcpOAuthClientProvider = class {
     }
     const now = Date.now();
     const nextSession = {
+      schemaVersion: 2,
       authSessionId: this.authSessionId,
       ...this.sessionContext,
       ...patch,
@@ -13020,32 +13137,7 @@ async function createMcpOAuthClientProvider(input) {
       "Cannot determine base URL (set JUNIOR_BASE_URL or deploy to Vercel)"
     );
   }
-  const existingSession = await getLatestMcpAuthSessionForUserProvider(
-    input.userId,
-    input.provider
-  );
-  const reusableSession = existingSession && existingSession.conversationId === input.conversationId && existingSession.sessionId === input.sessionId ? existingSession : void 0;
-  const now = Date.now();
-  const authSessionId = reusableSession?.authSessionId ?? randomUUID3();
-  await putMcpAuthSession({
-    authSessionId,
-    provider: input.provider,
-    userId: input.userId,
-    conversationId: input.conversationId,
-    ...input.destination ? { destination: input.destination } : {},
-    ...input.source ? { source: input.source } : {},
-    sessionId: input.sessionId,
-    userMessage: input.userMessage,
-    ...input.channelId ? { channelId: input.channelId } : {},
-    ...input.threadTs ? { threadTs: input.threadTs } : {},
-    ...input.toolChannelId ? { toolChannelId: input.toolChannelId } : {},
-    ...input.configuration ? { configuration: input.configuration } : {},
-    ...input.artifactState ? { artifactState: input.artifactState } : {},
-    ...reusableSession?.authorizationUrl ? { authorizationUrl: reusableSession.authorizationUrl } : {},
-    ...reusableSession?.codeVerifier ? { codeVerifier: reusableSession.codeVerifier } : {},
-    createdAtMs: reusableSession?.createdAtMs ?? now,
-    updatedAtMs: now
-  });
+  const authSessionId = randomUUID3();
   return new StateBackedMcpOAuthClientProvider(
     authSessionId,
     `${baseUrl}${getMcpOAuthCallbackPath(input.provider)}`,
@@ -13054,6 +13146,7 @@ async function createMcpOAuthClientProvider(input) {
       userId: input.userId,
       conversationId: input.conversationId,
       ...input.destination ? { destination: input.destination } : {},
+      ...input.source ? { source: input.source } : {},
       sessionId: input.sessionId,
       userMessage: input.userMessage,
       ...input.channelId ? { channelId: input.channelId } : {},
@@ -13064,7 +13157,7 @@ async function createMcpOAuthClientProvider(input) {
     }
   );
 }
-async function finalizeMcpAuthorization(provider, authSessionId, authorizationCode) {
+async function finalizeMcpAuthorization(provider, authSessionId, authorizationCode, runCredentialMutation) {
   const plugin = requirePluginWithMcp(provider);
   const mcp = plugin.manifest.mcp;
   if (!mcp) {
@@ -13088,7 +13181,9 @@ async function finalizeMcpAuthorization(provider, authSessionId, authorizationCo
   const callbackUrl = `${baseUrl}${getMcpOAuthCallbackPath(provider)}`;
   const authProvider = new StateBackedMcpOAuthClientProvider(
     authSessionId,
-    callbackUrl
+    callbackUrl,
+    void 0,
+    runCredentialMutation
   );
   const requestInit = {};
   if (mcp.headers && Object.keys(mcp.headers).length > 0) {
@@ -13171,16 +13266,6 @@ function createMcpAuthOrchestration(input) {
         `Missing pending auth recorder for MCP authorization pause "${provider}"`
       );
     }
-    const latestArtifactState = input.getMergedArtifactState();
-    await patchMcpAuthSession(authSessionId, {
-      configuration: { ...input.getConfiguration() },
-      artifactState: latestArtifactState,
-      toolChannelId: input.toolChannelId ?? latestArtifactState.assistantContextChannelId ?? input.channelId
-    });
-    const authSession = await getMcpAuthSession(authSessionId);
-    if (!authSession?.authorizationUrl) {
-      throw new Error(`Missing MCP authorization URL for plugin "${provider}"`);
-    }
     const reusingPendingLink = canReusePendingAuthLink({
       pendingAuth: input.pendingAuth,
       kind: "mcp",
@@ -13188,8 +13273,31 @@ function createMcpAuthOrchestration(input) {
       actorId,
       sessionId
     });
+    const reusedAuthSessionId = reusingPendingLink && input.pendingAuth?.kind === "mcp" ? input.pendingAuth.authSessionId : void 0;
+    const activeAuthSessionId = reusedAuthSessionId ?? authSessionId;
+    const latestArtifactState = input.getMergedArtifactState();
+    await patchMcpAuthSession(activeAuthSessionId, {
+      configuration: { ...input.getConfiguration() },
+      artifactState: latestArtifactState,
+      toolChannelId: input.toolChannelId ?? latestArtifactState.assistantContextChannelId ?? input.channelId
+    });
     const providerLabel = formatProviderLabel(provider);
+    const nextPendingAuth = {
+      authSessionId: activeAuthSessionId,
+      kind: "mcp",
+      provider,
+      actorId,
+      sessionId,
+      linkSentAtMs: reusingPendingLink ? input.pendingAuth.linkSentAtMs : Date.now()
+    };
     if (!reusingPendingLink) {
+      const authSession = await getMcpAuthSession(authSessionId);
+      if (!authSession?.authorizationUrl) {
+        throw new Error(
+          `Missing MCP authorization URL for plugin "${provider}"`
+        );
+      }
+      await recordPendingAuth(nextPendingAuth);
       const delivery = await deliverPrivateMessage({
         channelId: authSession.channelId,
         threadTs: authSession.threadTs,
@@ -13201,20 +13309,21 @@ function createMcpAuthOrchestration(input) {
         })
       });
       if (!delivery) {
+        await deleteMcpAuthSession(authSessionId);
+        await recordPendingAuth(input.pendingAuth);
         throw new Error(
           `Unable to deliver MCP authorization link for plugin "${provider}"`
         );
       }
+      await abandonReplacedPendingAuth({
+        conversationId,
+        previousPendingAuth: input.pendingAuth,
+        nextPendingAuth
+      });
     } else {
       await deleteMcpAuthSession(authSessionId);
+      await recordPendingAuth(nextPendingAuth);
     }
-    await recordPendingAuth({
-      kind: "mcp",
-      provider,
-      actorId,
-      sessionId,
-      linkSentAtMs: reusingPendingLink ? input.pendingAuth.linkSentAtMs : Date.now()
-    });
     await recordAuthorizationRequested({
       conversationId,
       kind: "mcp",
@@ -16102,6 +16211,7 @@ export {
   normalizeSandboxEgressTracePropagationDomains,
   shouldPropagateSandboxEgressTrace,
   resolveSandboxEgressProviderForHost,
+  getMcpAuthSession,
   deleteMcpAuthSession,
   deleteMcpAuthSessionsForUserProvider,
   getMcpStoredOAuthCredentials,

package/dist/{chunk-QSBQJ3PA.js → chunk-VFBFK6EY.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-PGGEOCQY.js";
 import {
   activityDays
-} from "./chunk-4AQUWWEM.js";
+} from "./chunk-HNIT4HXU.js";
 import {
   getDb,
   juniorConversations,

package/dist/{chunk-6DTVCPLO.js → chunk-XIMUQ4IU.js}

@@ -31,20 +31,21 @@ function coercePendingAuthState(value) {
   const kind = value.kind;
   const provider = toOptionalString(value.provider);
   const actorId = toOptionalString(value.actorId);
+  const authSessionId = toOptionalString(value.authSessionId);
   const scope = toOptionalString(value.scope);
   const sessionId = toOptionalString(value.sessionId);
   const linkSentAtMs = toOptionalNumber(value.linkSentAtMs);
-  if (kind !== "mcp" && kind !== "plugin" || !provider || !actorId || !sessionId || typeof linkSentAtMs !== "number") {
+  if (kind !== "mcp" && kind !== "plugin" || !provider || !actorId || kind === "mcp" && !authSessionId || !sessionId || typeof linkSentAtMs !== "number") {
     return void 0;
   }
-  return {
-    kind,
+  const base = {
     provider,
     actorId,
     ...scope ? { scope } : {},
     sessionId,
     linkSentAtMs
   };
+  return kind === "mcp" ? { ...base, authSessionId, kind } : { ...base, kind };
 }
 function coerceThreadConversationState(value) {
   if (!isRecord(value)) {

package/dist/{chunk-NSOCZGOH.js → chunk-XVR4O24H.js}

@@ -1,7 +1,7 @@
 import {
   JUNIOR_THREAD_STATE_TTL_MS,
   buildConversationStatePatch
-} from "./chunk-6DTVCPLO.js";
+} from "./chunk-XIMUQ4IU.js";
 import {
   abandonAgentTurnSessionRecord,
   addAgentTurnUsage,
@@ -899,13 +899,11 @@ function clearPendingAuth(conversation, sessionId) {
   }
   conversation.processing.pendingAuth = void 0;
 }
-async function applyPendingAuthUpdate(args) {
-  const previousPendingAuth = args.conversation.processing.pendingAuth;
-  args.conversation.processing.pendingAuth = args.nextPendingAuth;
-  if (previousPendingAuth && previousPendingAuth.sessionId !== args.nextPendingAuth.sessionId && args.conversationId) {
+async function abandonReplacedPendingAuth(args) {
+  if (args.previousPendingAuth && args.previousPendingAuth.sessionId !== args.nextPendingAuth.sessionId && args.conversationId) {
     await abandonAgentTurnSessionRecord({
       conversationId: args.conversationId,
-      sessionId: previousPendingAuth.sessionId,
+      sessionId: args.previousPendingAuth.sessionId,
       errorMessage: "Abandoned by a newer auth-blocked request in the same conversation."
     });
   }
@@ -951,7 +949,7 @@ export {
   canReusePendingAuthLink,
   getConversationPendingAuth,
   clearPendingAuth,
-  applyPendingAuthUpdate,
+  abandonReplacedPendingAuth,
   isPendingAuthLatestRequest,
   coerceThreadArtifactsState,
   mergeArtifactsState,

package/dist/cli/chat.js

@@ -1,9 +1,9 @@
 import {
   createAgentRunner,
   executeAgentRun
-} from "../chunk-45DMFMY2.js";
-import "../chunk-NSOCZGOH.js";
-import "../chunk-6DTVCPLO.js";
+} from "../chunk-UWGTSF5O.js";
+import "../chunk-XVR4O24H.js";
+import "../chunk-XIMUQ4IU.js";
 import "../chunk-IVXL57YF.js";
 import "../chunk-IQIBZXGB.js";
 import "../chunk-JPQISMMJ.js";
@@ -217,7 +217,7 @@ function newRunConversationId() {
 async function prepareLocalChatRun(io, pluginSet) {
   defaultStateAdapterForLocalChat();
   await configureLocalChatPlugins(pluginSet);
-  const { runLocalAgentTurn } = await import("../runner-BM7D35YW.js");
+  const { runLocalAgentTurn } = await import("../runner-CZIKSWGC.js");
   const deps = {
     agentRunner: createAgentRunner(executeAgentRun),
     deliverReply: async (reply) => {