@sentry/junior 0.114.0 → 0.116.0

package/dist/{runner-IPXLWQOF.js → runner-4ISZYJEX.js}

@@ -1,11 +1,15 @@
 import {
   ConversationTurnLifecycleService,
   buildDeliveredTurnStatePatch,
+  completeAuthPauseTurn,
   finalizeFailedTurnReplyWithEvent,
   processPluginTask,
   scheduleSessionCompletedPluginTasks
-} from "./chunk-ABPSDO6M.js";
-import "./chunk-KNFROR7R.js";
+} from "./chunk-UEVLIYK5.js";
+import "./chunk-5I6ORJUY.js";
+import {
+  authorizationId
+} from "./chunk-DIB4GX3G.js";
 import {
   buildConversationContext,
   coerceThreadArtifactsState,
@@ -21,34 +25,36 @@ import {
   persistConversationMessages,
   persistThreadStateById,
   persistWithRetry,
+  recordAuthorizationCompleted,
   recordDeliveredAssistantMessage,
   startActiveTurn,
   stripRuntimeTurnContext,
   trimTrailingAssistantMessages,
   updateConversationStats,
   upsertConversationMessage
-} from "./chunk-6QWPVTMO.js";
+} from "./chunk-OF5FODBL.js";
 import "./chunk-MU6HHZEN.js";
 import "./chunk-PDO5BLNM.js";
-import "./chunk-VNNBSKCO.js";
-import "./chunk-YU6PO42Q.js";
-import "./chunk-RD7EJI7H.js";
+import "./chunk-VZCSLYCE.js";
+import "./chunk-53ZKTQO6.js";
+import "./chunk-CI3VK7X5.js";
 import {
   getConversationEventStore
-} from "./chunk-FIGAF6KL.js";
-import "./chunk-JQFJO5WH.js";
+} from "./chunk-KBNDFU6J.js";
+import "./chunk-RXRQJF7Y.js";
 import "./chunk-4ZNGQH7C.js";
-import "./chunk-ZGXH3REA.js";
+import "./chunk-PZGPCOSD.js";
 import "./chunk-VFUK3X5B.js";
-import "./chunk-6Y5L4BOM.js";
-import "./chunk-C4MZ3GP5.js";
+import "./chunk-FXOYURO4.js";
+import "./chunk-HZF5P5UN.js";
 import {
   logException
-} from "./chunk-4FUEG3QY.js";
-import "./chunk-42WRQLJ6.js";
+} from "./chunk-3JOGUT46.js";
+import "./chunk-OB42YVAE.js";
+import "./chunk-F3B2YJ76.js";
 import "./chunk-6GWA276C.js";
-import "./chunk-5CZ7RETL.js";
-import "./chunk-PM3PX42K.js";
+import "./chunk-N7TMYLF2.js";
+import "./chunk-MGH5ADQS.js";
 import "./chunk-MLKGABMK.js";
 
 // src/chat/local/runner.ts
@@ -77,11 +83,17 @@ function localDestination(conversationId) {
 function localTurnId() {
   return `local-turn-${randomUUID()}`;
 }
+function localRunId() {
+  return `local-run-${randomUUID()}`;
+}
 function captureLocalBoundaryFailure(args) {
   const eventId = args.capture(
     args.error,
     LOCAL_FAILURE_EVENT_NAMES[args.failureCode],
-    { conversationId: args.conversationId, runId: args.turnId },
+    {
+      conversationId: args.conversationId,
+      ...args.runId ? { runId: args.runId } : {}
+    },
     { "app.ai.failure_code": args.failureCode },
     "Local agent turn failed at its owning runtime boundary"
   );
@@ -157,6 +169,8 @@ async function runLocalAgentTurn(input, deps) {
   let failureCode = "persistence_failed";
   let modelFailureEventId;
   let modelFailureCaptureAttempted = false;
+  let currentRunId;
+  let completionSliceId = 1;
   const localActor = {
     fullName: "Local CLI",
     platform: "local",
@@ -201,66 +215,117 @@ async function runLocalAgentTurn(input, deps) {
       conversationId: input.conversationId
     });
     failureCode = "agent_run_failed";
-    const outcome = await deps.agentRunner.run({
-      conversationId: input.conversationId,
-      turnId,
-      runId: turnId,
-      input: {
-        messageText: text,
-        conversationContext: buildConversationContext(conversation, {
-          excludeMessageId: userMessageId
-        }),
-        piMessages
-      },
-      routing: {
-        credentialContext: {
-          actor: { platform: "system", name: "local-cli" }
+    const runAgent = async (messages) => {
+      currentRunId = localRunId();
+      const authorization = deps.authorization ? {
+        createState: deps.authorization.createState,
+        deliver: deps.authorization.deliver
+      } : void 0;
+      return await deps.agentRunner.run({
+        conversationId: input.conversationId,
+        turnId,
+        runId: currentRunId,
+        input: {
+          messageText: text,
+          conversationContext: buildConversationContext(conversation, {
+            excludeMessageId: userMessageId
+          }),
+          piMessages: messages
         },
-        destination,
-        source,
-        actor: localActor,
-        surface: "internal"
-      },
-      policy: {
-        authorizationFlowMode: "disabled"
-      },
-      state: {
-        artifactState: artifacts,
-        sandboxRef
-      },
-      observers: {
-        onStatus: async (status) => {
-          await deps.onStatus?.(status.text);
+        routing: {
+          credentialContext: {
+            actor: { type: "user", userId: "local-cli" }
+          },
+          destination,
+          source,
+          actor: localActor,
+          surface: "internal"
         },
-        onToolInvocation: async (invocation) => {
-          await deps.onToolInvocation?.(invocation);
+        authorization,
+        policy: {
+          authorizationFlowMode: deps.authorization ? "interactive" : "disabled",
+          sandboxEgressSignals: deps.sandboxEgressSignals
         },
-        onToolResult: async (result) => {
-          await deps.onToolResult?.(result);
-        }
-      },
-      delivery: {
-        onAssistantMessage: deliverAssistantMessage
-      },
-      durability: {
-        onArtifactStateUpdated: async (nextArtifacts) => {
-          artifacts = nextArtifacts;
-          await persistThreadStateById(input.conversationId, {
-            artifacts,
-            conversation,
-            sandboxRef
-          });
+        state: {
+          artifactState: artifacts,
+          pendingAuth: conversation.processing.pendingAuth,
+          sandboxRef
+        },
+        observers: {
+          onStatus: async (status) => {
+            await deps.onStatus?.(status.text);
+          },
+          onToolInvocation: async (invocation) => {
+            await deps.onToolInvocation?.(invocation);
+          },
+          onToolResult: async (result) => {
+            await deps.onToolResult?.(result);
+          }
+        },
+        delivery: {
+          onAssistantMessage: deliverAssistantMessage
         },
-        onSandboxRefChanged: async (nextSandboxRef) => {
-          sandboxRef = nextSandboxRef;
-          await persistThreadStateById(input.conversationId, {
-            artifacts,
-            conversation,
-            sandboxRef
-          });
+        durability: {
+          onArtifactStateUpdated: async (nextArtifacts) => {
+            artifacts = nextArtifacts;
+            await persistThreadStateById(input.conversationId, {
+              artifacts,
+              conversation,
+              sandboxRef
+            });
+          },
+          onSandboxRefChanged: async (nextSandboxRef) => {
+            sandboxRef = nextSandboxRef;
+            await persistThreadStateById(input.conversationId, {
+              artifacts,
+              conversation,
+              sandboxRef
+            });
+          },
+          recordPendingAuth: async (pendingAuth) => {
+            conversation.processing.pendingAuth = pendingAuth;
+            await persistThreadStateById(input.conversationId, {
+              artifacts,
+              conversation,
+              sandboxRef
+            });
+          }
         }
+      });
+    };
+    let outcome = await runAgent(piMessages);
+    while (outcome.status === "awaiting_auth") {
+      const pendingAuth = conversation.processing.pendingAuth;
+      if (!pendingAuth || !deps.authorization) {
+        throw new Error(
+          "Local OAuth requires an active callback server and authorization delivery."
+        );
       }
-    });
+      completeAuthPauseTurn({ conversation, sessionId: turnId });
+      await persistThreadStateById(input.conversationId, {
+        artifacts,
+        conversation,
+        sandboxRef
+      });
+      await deps.authorization.wait();
+      await recordAuthorizationCompleted({
+        conversationId: input.conversationId,
+        kind: pendingAuth.kind,
+        provider: pendingAuth.provider,
+        actorId: pendingAuth.actorId,
+        authorizationId: authorizationId({
+          sessionId: turnId,
+          kind: pendingAuth.kind,
+          provider: pendingAuth.provider
+        })
+      });
+      completionSliceId += 1;
+      outcome = await runAgent(
+        await (deps.loadPiMessages ?? loadLocalPiMessages)({
+          conversationId: input.conversationId
+        })
+      );
+    }
     if (outcome.status !== "completed") {
       throw new Error(`Local agent run ended with ${outcome.status}`);
     }
@@ -284,12 +349,13 @@ async function runLocalAgentTurn(input, deps) {
       userMessageId
     });
   } catch (error) {
+    deps.authorization?.cancel();
     const failureEventId = modelFailureCaptureAttempted && failureCode === "agent_run_failed" ? modelFailureEventId : captureLocalBoundaryFailure({
       capture: deps.logException ?? logException,
       conversationId: input.conversationId,
       error,
       failureCode,
-      turnId
+      runId: currentRunId
     });
     try {
       markTurnFailed({
@@ -311,7 +377,7 @@ async function runLocalAgentTurn(input, deps) {
         conversationId: input.conversationId,
         error: persistenceError,
         failureCode: "persistence_failed",
-        turnId
+        runId: currentRunId
       });
       await lifecycle.fail({
         conversationId: input.conversationId,
@@ -334,6 +400,7 @@ async function runLocalAgentTurn(input, deps) {
     });
     throw error;
   }
+  deps.authorization?.cancel();
   try {
     await persistThreadStateById(input.conversationId, {
       artifacts: completedState.artifacts ?? artifacts,
@@ -344,7 +411,7 @@ async function runLocalAgentTurn(input, deps) {
       await (deps.completeDeliveredTurn ?? completeDeliveredTurn)({
         conversationId: input.conversationId,
         sessionId: turnId,
-        sliceId: 1,
+        sliceId: completionSliceId,
         messages: reply.piMessages,
         modelId: reply.diagnostics.modelId,
         durationMs: reply.diagnostics.durationMs,
@@ -362,7 +429,7 @@ async function runLocalAgentTurn(input, deps) {
       conversationId: input.conversationId,
       error,
       failureCode: "persistence_failed",
-      turnId
+      runId: currentRunId
     });
     await lifecycle.fail({
       conversationId: input.conversationId,

package/dist/sandbox-egress-signals-CDFAP67O.js

@@ -0,0 +1,75 @@
+import {
+  sandboxEgressSignalsResponseSchema
+} from "./chunk-HDSDCEPK.js";
+import "./chunk-W3U3YQYI.js";
+import "./chunk-HZF5P5UN.js";
+import "./chunk-F3B2YJ76.js";
+import "./chunk-MLKGABMK.js";
+
+// src/chat/local/sandbox-egress-signals.ts
+var SANDBOX_EGRESS_SIGNALS_PATH = "/api/internal/sandbox-egress/signals";
+var LOCAL_DEV_SERVER_TIMEOUT_MS = 1e3;
+function signalRequest(baseUrl, credentialToken) {
+  return {
+    headers: {
+      "x-junior-sandbox-egress-token": credentialToken
+    },
+    url: `${baseUrl}${SANDBOX_EGRESS_SIGNALS_PATH}`
+  };
+}
+async function requestLocalDevServer(request, init) {
+  try {
+    return await fetch(request.url, {
+      ...init,
+      headers: request.headers,
+      signal: AbortSignal.timeout(LOCAL_DEV_SERVER_TIMEOUT_MS)
+    });
+  } catch {
+    return void 0;
+  }
+}
+function createLocalSandboxEgressSignalTransport(baseUrl) {
+  return {
+    clear: async (credentialToken) => {
+      const request = signalRequest(baseUrl, credentialToken);
+      const response = await requestLocalDevServer(request, {
+        method: "DELETE"
+      });
+      if (!response) {
+        return;
+      }
+      if (!response.ok) {
+        throw new Error(
+          `Could not clear dev-server sandbox egress signals: HTTP ${response.status}`
+        );
+      }
+    },
+    consume: async (credentialToken) => {
+      const request = signalRequest(baseUrl, credentialToken);
+      const response = await requestLocalDevServer(request);
+      if (!response) {
+        return {};
+      }
+      if (!response.ok) {
+        throw new Error(
+          `Could not consume dev-server sandbox egress signals: HTTP ${response.status}`
+        );
+      }
+      const value = sandboxEgressSignalsResponseSchema.safeParse(
+        await response.json()
+      );
+      if (!value.success) {
+        throw new Error("Dev-server sandbox egress signals were invalid");
+      }
+      const authRequired = value.data.auth_required;
+      const permissionDenied = value.data.permission_denied;
+      return {
+        ...authRequired ? { authRequired } : {},
+        ...permissionDenied ? { permissionDenied } : {}
+      };
+    }
+  };
+}
+export {
+  createLocalSandboxEgressSignalTransport
+};

package/dist/{skills-QCNZISNF.js → skills-UE2KXQMB.js}

@@ -6,17 +6,19 @@ import {
   parseSkillInvocation,
   resetSkillDiscoveryCache,
   stripFrontmatter
-} from "./chunk-TLGM5X2M.js";
-import "./chunk-OSKEC4XU.js";
-import "./chunk-K2W4CK7K.js";
-import "./chunk-C4MZ3GP5.js";
-import "./chunk-4FUEG3QY.js";
-import "./chunk-42WRQLJ6.js";
+} from "./chunk-6RQ5GCWH.js";
+import "./chunk-25GU5B5E.js";
+import "./chunk-JZPQ5K4V.js";
+import "./chunk-W3U3YQYI.js";
+import "./chunk-HZF5P5UN.js";
+import "./chunk-3JOGUT46.js";
+import "./chunk-OB42YVAE.js";
+import "./chunk-F3B2YJ76.js";
 import "./chunk-6GWA276C.js";
 import "./chunk-B3IT5END.js";
 import "./chunk-3V7OFJZC.js";
-import "./chunk-5CZ7RETL.js";
-import "./chunk-PM3PX42K.js";
+import "./chunk-N7TMYLF2.js";
+import "./chunk-MGH5ADQS.js";
 import "./chunk-MLKGABMK.js";
 export {
   discoverSkills,

package/dist/validation-PO5LHTJT.js

@@ -0,0 +1,21 @@
+import {
+  validatePluginEgressCredentialHooks,
+  validatePluginRegistrations
+} from "./chunk-BXLS3I4W.js";
+import "./chunk-25GU5B5E.js";
+import "./chunk-JZPQ5K4V.js";
+import "./chunk-W3U3YQYI.js";
+import "./chunk-HZF5P5UN.js";
+import "./chunk-3JOGUT46.js";
+import "./chunk-OB42YVAE.js";
+import "./chunk-F3B2YJ76.js";
+import "./chunk-6GWA276C.js";
+import "./chunk-B3IT5END.js";
+import "./chunk-3V7OFJZC.js";
+import "./chunk-N7TMYLF2.js";
+import "./chunk-MGH5ADQS.js";
+import "./chunk-MLKGABMK.js";
+export {
+  validatePluginEgressCredentialHooks,
+  validatePluginRegistrations
+};

package/dist/version.js

@@ -1,6 +1,6 @@
 import {
   JUNIOR_VERSION
-} from "./chunk-PM3PX42K.js";
+} from "./chunk-MGH5ADQS.js";
 import "./chunk-MLKGABMK.js";
 export {
   JUNIOR_VERSION

package/migrations/0008_sticky_rage.sql

@@ -0,0 +1,14 @@
+CREATE TABLE "junior_api_tokens" (
+	"id" text PRIMARY KEY NOT NULL,
+	"owner_email_normalized" text NOT NULL,
+	"name" text NOT NULL,
+	"token_hash" text NOT NULL,
+	"token_suffix" text NOT NULL,
+	"created_at" timestamp with time zone NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"last_used_at" timestamp with time zone,
+	"revoked_at" timestamp with time zone
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX "junior_api_tokens_token_hash_uidx" ON "junior_api_tokens" USING btree ("token_hash");--> statement-breakpoint
+CREATE INDEX "junior_api_tokens_owner_email_idx" ON "junior_api_tokens" USING btree ("owner_email_normalized");

package/migrations/0009_slippery_harrier.sql

@@ -0,0 +1,12 @@
+CREATE TABLE "junior_conversation_annotations" (
+	"conversation_id" text NOT NULL,
+	"plugin" text NOT NULL,
+	"kind" text NOT NULL,
+	"key" text NOT NULL,
+	"annotation_json" jsonb NOT NULL,
+	"created_at" timestamp with time zone NOT NULL,
+	"updated_at" timestamp with time zone NOT NULL,
+	CONSTRAINT "junior_conversation_annotations_pk" PRIMARY KEY("conversation_id","plugin","kind","key")
+);
+--> statement-breakpoint
+ALTER TABLE "junior_conversation_annotations" ADD CONSTRAINT "junior_conversation_annotations_conversation_id_fk" FOREIGN KEY ("conversation_id") REFERENCES "public"."junior_conversations"("conversation_id") ON DELETE cascade ON UPDATE no action;

package/migrations/0010_native_conversation_history.sql

@@ -0,0 +1,142 @@
+DO $$
+BEGIN
+	IF EXISTS (
+		SELECT 1
+		FROM "junior_conversation_events"
+		WHERE "schema_version" = 1
+			AND "type" = 'agent_step'
+			AND (
+				jsonb_typeof("payload") IS DISTINCT FROM 'object'
+				OR jsonb_typeof("payload"->'message') IS DISTINCT FROM 'object'
+				OR "payload"->'message'->>'role' IS NULL
+				OR "payload"->'message'->>'role' NOT IN ('user', 'assistant', 'toolResult')
+			)
+	) THEN
+		RAISE EXCEPTION 'Cannot migrate malformed agent_step conversation events';
+	END IF;
+
+	IF EXISTS (
+		SELECT 1
+		FROM "junior_conversation_events" AS "event"
+		WHERE "event"."schema_version" = 1
+			AND "event"."type" IN ('compaction', 'handoff', 'rollback')
+			AND (
+				jsonb_typeof("event"."payload") IS DISTINCT FROM 'object'
+				OR jsonb_typeof("event"."payload"->'replacementHistory') IS DISTINCT FROM 'array'
+			)
+	) THEN
+		RAISE EXCEPTION 'Cannot migrate malformed conversation history replacements';
+	END IF;
+
+	IF EXISTS (
+		SELECT 1
+		FROM "junior_conversation_events" AS "event"
+		CROSS JOIN LATERAL jsonb_array_elements(
+			"event"."payload"->'replacementHistory'
+		) AS "replacement"("item")
+		WHERE "event"."schema_version" = 1
+			AND "event"."type" IN ('compaction', 'handoff', 'rollback')
+			AND (
+				jsonb_typeof("replacement"."item") IS DISTINCT FROM 'object'
+				OR (
+					"replacement"."item" ? 'message'
+					AND (
+						jsonb_typeof("replacement"."item"->'message') IS DISTINCT FROM 'object'
+						OR "replacement"."item"->'message'->>'role' IS NULL
+						OR "replacement"."item"->'message'->>'role' NOT IN ('user', 'assistant', 'toolResult')
+					)
+				)
+				OR (
+					NOT ("replacement"."item" ? 'message')
+					AND (
+						jsonb_typeof("replacement"."item"->'item') IS DISTINCT FROM 'object'
+						OR "replacement"."item"->'item'->>'type' IS NULL
+						OR "replacement"."item"->'item'->>'type' NOT IN ('user_message', 'assistant_message', 'tool_result')
+						OR "replacement"."item"->'item' ? 'role'
+						OR (
+							"replacement"."item"->'item'->>'type' = 'user_message'
+							AND jsonb_typeof("replacement"."item"->'item'->'provenance') IS DISTINCT FROM 'object'
+						)
+					)
+				)
+			)
+	) THEN
+		RAISE EXCEPTION 'Cannot migrate malformed replacement history items';
+	END IF;
+END $$;
+--> statement-breakpoint
+UPDATE "junior_conversation_events"
+SET
+	"type" = CASE "payload"->'message'->>'role'
+		WHEN 'user' THEN 'user_message'
+		WHEN 'assistant' THEN 'assistant_message'
+		WHEN 'toolResult' THEN 'tool_result'
+	END,
+	"payload" = CASE "payload"->'message'->>'role'
+		WHEN 'user' THEN
+			(("payload"->'message') - 'role')
+			|| jsonb_build_object(
+				'provenance',
+				coalesce("payload"->'provenance', '{"authority":"context"}'::jsonb)
+			)
+		ELSE ("payload"->'message') - 'role'
+	END
+WHERE "schema_version" = 1
+	AND "type" = 'agent_step';
+--> statement-breakpoint
+UPDATE "junior_conversation_events" AS "event"
+SET "payload" = jsonb_set(
+	"event"."payload",
+	'{replacementHistory}',
+	(
+		SELECT coalesce(
+			jsonb_agg(
+				CASE
+					WHEN "replacement"."item" ? 'message' THEN
+						(("replacement"."item" - 'message') - 'provenance')
+						|| jsonb_build_object(
+							'item',
+							CASE "replacement"."item"->'message'->>'role'
+								WHEN 'user' THEN
+									(("replacement"."item"->'message') - 'role')
+									|| jsonb_build_object('type', 'user_message')
+									|| jsonb_build_object(
+										'provenance',
+										coalesce(
+											"replacement"."item"->'provenance',
+											'{"authority":"context"}'::jsonb
+										)
+									)
+								WHEN 'assistant' THEN
+									(("replacement"."item"->'message') - 'role')
+									|| jsonb_build_object('type', 'assistant_message')
+								WHEN 'toolResult' THEN
+									(("replacement"."item"->'message') - 'role')
+									|| jsonb_build_object('type', 'tool_result')
+							END
+						)
+					ELSE "replacement"."item"
+				END
+				ORDER BY "replacement"."position"
+			),
+			'[]'::jsonb
+		)
+		FROM jsonb_array_elements(
+			"event"."payload"->'replacementHistory'
+		) WITH ORDINALITY AS "replacement"("item", "position")
+	)
+)
+WHERE "event"."schema_version" = 1
+	AND "event"."type" IN ('compaction', 'handoff', 'rollback')
+	AND EXISTS (
+		SELECT 1
+		FROM jsonb_array_elements(
+			"event"."payload"->'replacementHistory'
+		) AS "replacement"("item")
+		WHERE "replacement"."item" ? 'message'
+	);
+--> statement-breakpoint
+UPDATE "junior_conversation_events"
+SET "type" = 'compaction'
+WHERE "schema_version" = 1
+	AND "type" = 'rollback';