@sentry/junior 0.114.0 → 0.115.0

package/dist/catalog-runtime-Y32UEQLB.js

@@ -0,0 +1,18 @@
+import {
+  pluginCatalogRuntime
+} from "./chunk-6FKLPVF3.js";
+import "./chunk-EW5MLKT5.js";
+import "./chunk-W3U3YQYI.js";
+import "./chunk-HZF5P5UN.js";
+import "./chunk-NVUQSFWX.js";
+import "./chunk-OB42YVAE.js";
+import "./chunk-F3B2YJ76.js";
+import "./chunk-6GWA276C.js";
+import "./chunk-B3IT5END.js";
+import "./chunk-3V7OFJZC.js";
+import "./chunk-TVE25LPW.js";
+import "./chunk-FHC4JUSF.js";
+import "./chunk-MLKGABMK.js";
+export {
+  pluginCatalogRuntime
+};

package/dist/chat/agent/request.d.ts

@@ -15,7 +15,9 @@ import type { PiMessage } from "@/chat/pi/messages";
 import type { Actor } from "@/chat/actor";
 import type { SandboxRef } from "@/chat/sandbox/ref";
 import type { SandboxEgressTracePropagationConfig } from "@/chat/sandbox/egress/tracing";
+import type { SandboxEgressSignalTransport } from "@/chat/sandbox/egress/signals";
 import type { AuthorizationFlowMode } from "@/chat/services/auth-pause";
+import type { OAuthAuthorization } from "@/chat/oauth-authorization";
 import type { AssistantStatusSpec } from "@/chat/slack/assistant-thread/status";
 import type { SlackConversationContext } from "@/chat/slack/conversation-context";
 import type { ThreadArtifactsState } from "@/chat/state/artifacts";
@@ -94,6 +96,8 @@ export interface AgentRunPolicy {
     skillDirs?: string[];
     /** Per-slice override for app-owned sandbox egress trace propagation. */
     sandboxTracePropagation?: SandboxEgressTracePropagationConfig;
+    /** Per-slice sandbox egress signal storage override. */
+    sandboxEgressSignals?: SandboxEgressSignalTransport;
     toolOverrides?: {
         imageGenerate?: ImageGenerateToolDeps;
         webFetch?: WebFetchToolDeps;
@@ -152,6 +156,8 @@ export interface AgentRunRequest {
     runId?: string;
     input: AgentRunInput;
     routing: AgentRunRouting;
+    /** Surface-owned OAuth state and private delivery capabilities. */
+    authorization?: OAuthAuthorization;
     policy?: AgentRunPolicy;
     state?: AgentRunState;
     observers?: AgentRunObservers;

package/dist/chat/agent/sandbox.d.ts

@@ -11,6 +11,7 @@ import type { ChannelConfigurationService } from "@/chat/configuration/types";
 import type { CredentialContext } from "@/chat/credentials/context";
 import type { LogContext } from "@/chat/logging";
 import type { SandboxEgressTracePropagationConfig } from "@/chat/sandbox/egress/tracing";
+import type { SandboxEgressSignalTransport } from "@/chat/sandbox/egress/signals";
 import type { SandboxRef } from "@/chat/sandbox/ref";
 import { type SandboxTools } from "@/chat/sandbox/sandbox";
 import type { SandboxWorkspace } from "@/chat/sandbox/workspace";
@@ -21,6 +22,7 @@ export interface AgentSandboxOptions {
     skills: SkillMetadata[];
     traceContext: LogContext;
     tracePropagation?: SandboxEgressTracePropagationConfig;
+    egressSignals?: SandboxEgressSignalTransport;
     credentialEgress?: CredentialContext;
     actor?: Actor;
     channelConfiguration?: ChannelConfigurationService;

package/dist/chat/agent/tools.d.ts

@@ -20,6 +20,7 @@ import type { SandboxRef } from "@/chat/sandbox/ref";
 import type { PiMessage } from "@/chat/pi/messages";
 import type { LogContext } from "@/chat/logging";
 import type { ConversationPrivacy } from "@/chat/conversation-privacy";
+import type { OAuthAuthorization } from "@/chat/oauth-authorization";
 import type { Actor } from "@/chat/actor";
 import type { ThreadArtifactsState } from "@/chat/state/artifacts";
 import type { AuthorizationPauseError } from "@/chat/services/auth-pause";
@@ -38,6 +39,7 @@ interface ToolWiringArgs {
     connectedMcpProviders: Set<string>;
     conversationPrivacy?: ConversationPrivacy;
     durability: AgentRunDurability;
+    authorization?: OAuthAuthorization;
     generatedFiles: FileUpload[];
     invokedSkill: SkillMetadata | null;
     observers: AgentRunObservers;

package/dist/chat/config.d.ts

@@ -9,6 +9,7 @@ export declare const FUNCTION_TIMEOUT_BUFFER_SECONDS = 20;
 export declare const CONVERSATION_WORK_SOFT_YIELD_BUFFER_SECONDS = 40;
 export interface BotConfig {
     contextWindowTokens: number;
+    crossActorMidRunMode: CrossActorMidRunMode;
     embeddingModelId: string;
     fastModelId: string;
     imageGenerationModelId: string;
@@ -21,6 +22,7 @@ export interface BotConfig {
     userName: string;
     webSearchModelId: string;
 }
+export type CrossActorMidRunMode = "follow_up" | "steer";
 export type SqlDriver = "neon" | "postgres";
 export interface ChatConfig {
     bot: BotConfig;

package/dist/chat/conversations/history.d.ts

@@ -27,6 +27,7 @@ export declare const historyReplacementSchema: z.ZodObject<{
         modelId: z.ZodString;
         reasoningLevel: z.ZodOptional<z.ZodString>;
         triggeringToolCallId: z.ZodOptional<z.ZodString>;
+        summary: z.ZodOptional<z.ZodString>;
         replacementHistory: z.ZodArray<z.ZodObject<{
             message: z.ZodPipe<z.ZodObject<{
                 role: z.ZodString;
@@ -72,6 +73,7 @@ export declare const historyReplacementSchema: z.ZodObject<{
             retainedMessageCount: z.ZodNumber;
             summaryChars: z.ZodNumber;
         }, z.core.$strict>>;
+        summary: z.ZodOptional<z.ZodString>;
         replacementHistory: z.ZodArray<z.ZodObject<{
             message: z.ZodPipe<z.ZodObject<{
                 role: z.ZodString;
@@ -268,6 +270,7 @@ export declare const conversationEventDataSchema: z.ZodUnion<readonly [z.ZodUnio
     modelId: z.ZodString;
     reasoningLevel: z.ZodOptional<z.ZodString>;
     triggeringToolCallId: z.ZodOptional<z.ZodString>;
+    summary: z.ZodOptional<z.ZodString>;
     replacementHistory: z.ZodArray<z.ZodObject<{
         message: z.ZodPipe<z.ZodObject<{
             role: z.ZodString;
@@ -313,6 +316,7 @@ export declare const conversationEventDataSchema: z.ZodUnion<readonly [z.ZodUnio
         retainedMessageCount: z.ZodNumber;
         summaryChars: z.ZodNumber;
     }, z.core.$strict>>;
+    summary: z.ZodOptional<z.ZodString>;
     replacementHistory: z.ZodArray<z.ZodObject<{
         message: z.ZodPipe<z.ZodObject<{
             role: z.ZodString;
@@ -539,6 +543,7 @@ export declare const conversationEventSchema: z.ZodUnion<readonly [z.ZodObject<{
         modelId: z.ZodString;
         reasoningLevel: z.ZodOptional<z.ZodString>;
         triggeringToolCallId: z.ZodOptional<z.ZodString>;
+        summary: z.ZodOptional<z.ZodString>;
         replacementHistory: z.ZodArray<z.ZodObject<{
             message: z.ZodPipe<z.ZodObject<{
                 role: z.ZodString;
@@ -584,6 +589,7 @@ export declare const conversationEventSchema: z.ZodUnion<readonly [z.ZodObject<{
             retainedMessageCount: z.ZodNumber;
             summaryChars: z.ZodNumber;
         }, z.core.$strict>>;
+        summary: z.ZodOptional<z.ZodString>;
         replacementHistory: z.ZodArray<z.ZodObject<{
             message: z.ZodPipe<z.ZodObject<{
                 role: z.ZodString;

package/dist/chat/local/credential-sync.d.ts

@@ -0,0 +1,5 @@
+import { type PluginStoredTokens } from "@sentry/junior-plugin-api";
+/** Copy a local user's provider credential to the loopback dev-server broker. */
+export declare function syncLocalOAuthCredential(provider: string, tokens: PluginStoredTokens): Promise<void>;
+/** Verify and store one credential sent by the local CLI over loopback. */
+export declare function receiveLocalOAuthCredential(request: Request): Promise<Response>;

package/dist/chat/local/oauth-relay.d.ts

@@ -0,0 +1,4 @@
+/** Create an OAuth state value that can be safely relayed to a local CLI callback. */
+export declare function createLocalOAuthState(port: number): Promise<string>;
+/** Redirect a provider callback from the public dev URL to the owning local CLI. */
+export declare function relayLocalOAuthCallback(request: Request): Promise<Response | undefined>;

package/dist/chat/mcp/oauth.d.ts

@@ -17,6 +17,7 @@ export declare function createMcpOAuthClientProvider(input: {
     toolChannelId?: string;
     configuration?: Record<string, unknown>;
     artifactState?: ThreadArtifactsState;
+    createAuthorizationState?: () => Promise<string>;
 }): Promise<StateBackedMcpOAuthClientProvider>;
 /** Exchange a callback code while guarding every shared credential mutation. */
 export declare function finalizeMcpAuthorization(provider: string, authSessionId: string, authorizationCode: string, runCredentialMutation?: <T>(mutation: () => Promise<T>) => Promise<T>): Promise<McpAuthSessionState>;

package/dist/chat/oauth-authorization.d.ts

@@ -0,0 +1,17 @@
+/** User-facing link and guidance for one OAuth authorization attempt. */
+export interface OAuthAuthorizationRequest {
+    authorizationUrl: string;
+    completionText: string;
+    label: string;
+}
+/** Surface-owned capabilities for creating and presenting OAuth authorization. */
+export interface OAuthAuthorization {
+    createState: () => Promise<string>;
+    deliver: (request: OAuthAuthorizationRequest) => void | Promise<void>;
+}
+/** Build the stable event identity shared by authorization request and completion. */
+export declare function authorizationId(args: {
+    kind: "mcp" | "plugin";
+    provider: string;
+    sessionId: string;
+}): string;

package/dist/chat/oauth-flow.d.ts

@@ -1,4 +1,5 @@
 import { type Destination, type Source } from "@sentry/junior-plugin-api";
+import type { OAuthAuthorization, OAuthAuthorizationRequest } from "@/chat/oauth-authorization";
 type PrivateDeliveryResult = "in_context" | "fallback_dm" | false;
 export type OAuthStatePayload = {
     userId: string;
@@ -21,6 +22,7 @@ type OAuthFlowInput = {
     resumeConversationId?: string;
     resumeSessionId?: string;
     scope?: string;
+    authorization?: OAuthAuthorization;
 };
 /** Parse OAuth callback state that was persisted before a provider redirect. */
 export declare function parseOAuthStatePayload(value: unknown): OAuthStatePayload | undefined;
@@ -38,6 +40,13 @@ export declare function deliverPrivateMessage(input: {
     userId: string;
     text: string;
 }): Promise<PrivateDeliveryResult>;
+/** Present one OAuth request through the active surface's private delivery. */
+export declare function deliverOAuthAuthorization(request: OAuthAuthorizationRequest, input: {
+    authorization?: OAuthAuthorization;
+    channelId?: string;
+    threadTs?: string;
+    userId: string;
+}): Promise<PrivateDeliveryResult>;
 /** Initiate an OAuth authorization code flow for a provider and deliver the auth link to the user. */
 export declare function startOAuthFlow(provider: string, input: OAuthFlowInput): Promise<{
     ok: false;

package/dist/chat/sandbox/egress/schemas.d.ts

@@ -113,6 +113,52 @@ export declare const sandboxEgressPermissionDeniedSignalSchema: z.ZodObject<{
     upstreamPath: z.ZodString;
     createdAtMs: z.ZodNumber;
 }, z.core.$strict>;
+export declare const sandboxEgressSignalsResponseSchema: z.ZodObject<{
+    auth_required: z.ZodOptional<z.ZodObject<{
+        authorization: z.ZodOptional<z.ZodObject<{
+            provider: z.ZodString;
+            scope: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"oauth">;
+        }, z.core.$strict>>;
+        grant: z.ZodObject<{
+            access: z.ZodUnion<readonly [z.ZodLiteral<"read">, z.ZodLiteral<"write">]>;
+            leaseScope: z.ZodOptional<z.ZodString>;
+            name: z.ZodString;
+            reason: z.ZodOptional<z.ZodString>;
+            requirements: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>;
+        kind: z.ZodDefault<z.ZodEnum<{
+            unavailable: "unavailable";
+            auth_required: "auth_required";
+        }>>;
+        provider: z.ZodString;
+        message: z.ZodOptional<z.ZodString>;
+        createdAtMs: z.ZodNumber;
+    }, z.core.$strict>>;
+    permission_denied: z.ZodOptional<z.ZodObject<{
+        account: z.ZodOptional<z.ZodObject<{
+            id: z.ZodString;
+            label: z.ZodOptional<z.ZodString>;
+            url: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        acceptedPermissions: z.ZodOptional<z.ZodString>;
+        grant: z.ZodObject<{
+            access: z.ZodUnion<readonly [z.ZodLiteral<"read">, z.ZodLiteral<"write">]>;
+            leaseScope: z.ZodOptional<z.ZodString>;
+            name: z.ZodString;
+            reason: z.ZodOptional<z.ZodString>;
+            requirements: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>;
+        message: z.ZodString;
+        provider: z.ZodString;
+        source: z.ZodLiteral<"upstream">;
+        sso: z.ZodOptional<z.ZodString>;
+        status: z.ZodNumber;
+        upstreamHost: z.ZodString;
+        upstreamPath: z.ZodString;
+        createdAtMs: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
 export type SandboxEgressCredentialContext = z.output<typeof sandboxEgressCredentialContextSchema>;
 export type SandboxEgressGrant = z.output<typeof sandboxEgressGrantSchema>;
 export type SandboxEgressCredentialLease = z.output<typeof sandboxEgressCredentialLeaseSchema>;

package/dist/chat/sandbox/egress/signals.d.ts

@@ -0,0 +1,9 @@
+import type { SandboxEgressAuthRequiredSignal, SandboxEgressPermissionDeniedSignal } from "@/chat/sandbox/egress/schemas";
+/** Authenticated transport for signal state owned by another Junior process. */
+export interface SandboxEgressSignalTransport {
+    clear: (credentialToken: string) => Promise<void>;
+    consume: (credentialToken: string) => Promise<{
+        authRequired?: SandboxEgressAuthRequiredSignal;
+        permissionDenied?: SandboxEgressPermissionDeniedSignal;
+    }>;
+}

package/dist/chat/sandbox/sandbox.d.ts

@@ -1,4 +1,5 @@
 import { type LogContext } from "@/chat/logging";
+import type { SandboxEgressSignalTransport } from "@/chat/sandbox/egress/signals";
 import type { SandboxEgressTracePropagationConfig } from "@/chat/sandbox/egress/tracing";
 import type { CredentialContext } from "@/chat/credentials/context";
 import type { SandboxRef } from "@/chat/sandbox/ref";
@@ -26,6 +27,7 @@ export interface SandboxOptions {
     traceContext?: LogContext;
     tracePropagation?: SandboxEgressTracePropagationConfig;
     credentialEgress?: CredentialContext;
+    egressSignals?: SandboxEgressSignalTransport;
     prepare?: (workspace: SandboxWorkspace) => void | Promise<void>;
     onSandboxRefChanged?: (sandboxRef: SandboxRef) => void | Promise<void>;
 }

package/dist/chat/sentry-payload-filter.d.ts

@@ -3,12 +3,12 @@ type SentryErrorEvent = Parameters<NonNullable<Sentry.NodeOptions["beforeSend"]>
 type SentryTransactionEvent = Parameters<NonNullable<Sentry.NodeOptions["beforeSendTransaction"]>>[0];
 type SentrySpan = Parameters<Parameters<typeof Sentry.withStreamedSpan>[0]>[0];
 type SentryLog = Parameters<NonNullable<Sentry.NodeOptions["beforeSendLog"]>>[0];
-/** Remove raw private conversation payloads from Sentry error events. */
+/** Remove private conversation payloads and boundary secrets from error events. */
 export declare function scrubPrivateSentryEvent(event: SentryErrorEvent): SentryErrorEvent | null;
-/** Remove raw private conversation payloads from Sentry transaction events. */
+/** Remove private conversation payloads and boundary secrets from transactions. */
 export declare function scrubPrivateSentryTransaction(event: SentryTransactionEvent): SentryTransactionEvent | null;
-/** Remove raw private conversation payloads from streamed Sentry spans. */
+/** Remove private conversation payloads and boundary secrets from streamed spans. */
 export declare function scrubPrivateSentrySpan(span: SentrySpan): SentrySpan;
-/** Remove raw private conversation payloads from Sentry structured logs. */
+/** Remove private conversation payloads and boundary secrets from structured logs. */
 export declare function scrubPrivateSentryLog(log: SentryLog): SentryLog | null;
 export {};

package/dist/chat/services/mcp-auth-orchestration.d.ts

@@ -2,12 +2,13 @@
  * MCP authorization pause orchestration.
  *
  * This module turns an MCP client auth challenge into Junior's paused-run
- * model: create provider auth state, deliver or reuse a private Slack link,
- * record pending auth, and abort the agent so the OAuth callback can resume the
- * same session.
+ * model: create provider auth state, privately present or reuse its link,
+ * record pending auth, and abort the agent so the OAuth callback can resume
+ * the same session.
  */
 import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
 import type { Destination, Source } from "@sentry/junior-plugin-api";
+import { type OAuthAuthorization } from "@/chat/oauth-authorization";
 import { AuthorizationPauseError, type AuthorizationFlowMode } from "@/chat/services/auth-pause";
 import type { ThreadArtifactsState } from "@/chat/state/artifacts";
 import type { ConversationPendingAuthState } from "@/chat/state/conversation";
@@ -32,6 +33,7 @@ export interface McpAuthOrchestrationInput {
     getMergedArtifactState: () => ThreadArtifactsState;
     recordPendingAuth?: (pendingAuth: ConversationPendingAuthState | undefined) => void | Promise<void>;
     authorizationFlowMode?: AuthorizationFlowMode;
+    authorization?: OAuthAuthorization;
 }
 export interface McpAuthOrchestration {
     authProviderFactory: (plugin: PluginDefinition) => Promise<OAuthClientProvider | undefined>;

package/dist/chat/services/plugin-auth-orchestration.d.ts

@@ -14,6 +14,7 @@ import type { Destination, Source } from "@sentry/junior-plugin-api";
 import type { UserTokenStore } from "@/chat/credentials/user-token-store";
 import { AuthorizationPauseError, type AuthorizationFlowMode } from "@/chat/services/auth-pause";
 import type { ConversationPendingAuthState } from "@/chat/state/conversation";
+import { type OAuthAuthorization } from "@/chat/oauth-authorization";
 export declare class PluginAuthorizationPauseError extends AuthorizationPauseError {
     constructor(provider: string, providerDisplayName: string, disposition: "link_already_sent" | "link_sent", requestText?: string);
 }
@@ -35,6 +36,7 @@ export interface PluginAuthOrchestrationInput {
     recordPendingAuth?: (pendingAuth: ConversationPendingAuthState) => void | Promise<void>;
     authorizationFlowMode?: AuthorizationFlowMode;
     userTokenStore?: UserTokenStore;
+    authorization?: OAuthAuthorization;
 }
 export interface PluginAuthOrchestration {
     /**

package/dist/chat/slack/message-control.d.ts

@@ -0,0 +1,2 @@
+/** Remove the explicit Slack steering marker before building agent input. */
+export declare function stripLeadingSteeringOverride(text: string): string;

package/dist/chat/slack/oauth-authorization-message.d.ts

@@ -0,0 +1,3 @@
+import type { OAuthAuthorizationRequest } from "@/chat/oauth-authorization";
+/** Format the private OAuth authorization prompt for Slack delivery. */
+export declare function formatOAuthAuthorizationMessage(args: OAuthAuthorizationRequest): string;

package/dist/chat/task-execution/slack-work.d.ts

@@ -7,6 +7,7 @@ import type { InboundMessage } from "@/chat/task-execution/store";
 import type { ConversationWorkerContext, ConversationWorkerResult } from "@/chat/task-execution/worker";
 import { type SlackInstallationContext } from "@/chat/slack/adapter-context";
 import { type SlackActorProfile } from "@/chat/actor";
+import { type CrossActorMidRunMode } from "@/chat/config";
 declare const slackConversationRouteSchema: z.ZodEnum<{
     mention: "mention";
     subscribed: "subscribed";
@@ -270,6 +271,7 @@ interface SlackResourceEventInboundInput {
     text: string;
 }
 export interface CreateSlackConversationWorkerOptions {
+    crossActorMidRunMode?: CrossActorMidRunMode;
     getSlackAdapter: () => SlackAdapter;
     lookupSlackUser?: (teamId: string, userId: string) => Promise<SlackActorProfile | null | undefined>;
     resumeAwaitingContinuation: (conversationId: string, options: {

package/dist/chat/tool-support/zod-tool.d.ts

@@ -2,7 +2,7 @@ import { z, type ZodType, type ZodTypeAny } from "zod";
 import { type JuniorToolResult } from "@/chat/tool-support/structured-result";
 import type { ImageContent, TextContent } from "@earendil-works/pi-ai";
 import type { AnyToolDefinition, JsonSchemaObject, ToolExecuteOptions } from "@/chat/tools/definition";
-type ZodToolDefinitionBase<TInputSchema extends ZodTypeAny> = Pick<AnyToolDefinition, "identity" | "source" | "description" | "exposure" | "annotations" | "promptSnippet" | "promptGuidelines" | "executionMode"> & {
+type ZodToolDefinitionBase<TInputSchema extends ZodTypeAny> = Pick<AnyToolDefinition, "approvalMode" | "identity" | "source" | "description" | "exposure" | "annotations" | "promptSnippet" | "promptGuidelines" | "executionMode"> & {
     inputSchema: TInputSchema;
     prepareArguments?: (args: unknown) => z.input<TInputSchema>;
 };

package/dist/chat/tools/definition.d.ts

@@ -1,6 +1,7 @@
 import type { ToolAnnotations } from "@modelcontextprotocol/sdk/types.js";
 import { type Static, type TSchema } from "@sinclair/typebox";
 import type { ToolExecutionMode } from "@earendil-works/pi-agent-core";
+import type { ToolApprovalMode } from "@sentry/junior-plugin-api";
 import type { ConversationPrivacy } from "@/chat/conversation-privacy";
 /**
  * Tool definition boundary for Pi-facing agent tools.
@@ -17,6 +18,8 @@ export interface ToolExecuteOptions {
     toolCallId?: string;
 }
 interface BaseToolDefinition<TInput, TInputSchema extends ToolInputSchema> {
+    /** Optional declared approval mode; omission delegates to core defaults. */
+    approvalMode?: ToolApprovalMode;
     /** Stable internal owner-qualified identity for plugin-contributed tools. */
     identity?: {
         id: string;
@@ -56,6 +59,8 @@ export interface ToolDefinition<TInputSchema extends TSchema = TSchema> extends
  * Schema-erased view for heterogeneous registries after Pi validates tool input.
  */
 export interface AnyToolDefinition {
+    /** Optional declared approval mode; omission delegates to core defaults. */
+    approvalMode?: ToolApprovalMode;
     /** Stable internal owner-qualified identity for plugin-contributed tools. */
     identity?: {
         id: string;

package/dist/{chunk-TLGM5X2M.js → chunk-2QG4MZQ7.js}

@@ -1,9 +1,9 @@
 import {
   pluginCatalogRuntime
-} from "./chunk-OSKEC4XU.js";
+} from "./chunk-6FKLPVF3.js";
 import {
   logWarn
-} from "./chunk-4FUEG3QY.js";
+} from "./chunk-NVUQSFWX.js";
 import {
   skillRoots
 } from "./chunk-3V7OFJZC.js";