@sentry/junior 0.136.1 → 0.138.0

package/dist/{chunk-6ZK6FZIV.js → chunk-KCBZSJRU.js}

@@ -1,38 +1,20 @@
+import {
+  conversationQueueMessageSchema
+} from "./chunk-IUFM5JWV.js";
 import {
   createVercelQueueClient
 } from "./chunk-5I6ORJUY.js";
 
 // src/chat/task-execution/queue-signing.ts
 import { createHmac, timingSafeEqual } from "crypto";
-import { z as z2 } from "zod";
-
-// src/chat/task-execution/queue.ts
 import { z } from "zod";
-var conversationQueueMessageSchema = z.object({
-  conversationId: z.string().trim().min(1)
-}).strict();
-var ConversationQueueMessageRejectedError = class extends Error {
-  conversationId;
-  reason;
-  constructor(reason, message, options = {}) {
-    super(message);
-    this.name = "ConversationQueueMessageRejectedError";
-    this.reason = reason;
-    this.conversationId = options.conversationId;
-  }
-};
-function isConversationQueueMessageRejectedError(error) {
-  return error instanceof ConversationQueueMessageRejectedError;
-}
-
-// src/chat/task-execution/queue-signing.ts
 var CONVERSATION_WORK_QUEUE_SIGNATURE_CONTEXT = "junior.conversation_work_queue.v2";
 var CONVERSATION_WORK_QUEUE_SIGNATURE_VERSION = "v2";
 var CONVERSATION_WORK_QUEUE_SIGNATURE_MAX_SKEW_MS = 60 * 60 * 1e3;
 var signedConversationQueueMessageSchema = conversationQueueMessageSchema.extend({
-  signature: z2.string().trim().min(1),
-  signatureVersion: z2.literal(CONVERSATION_WORK_QUEUE_SIGNATURE_VERSION),
-  signedAtMs: z2.number().finite()
+  signature: z.string().trim().min(1),
+  signatureVersion: z.literal(CONVERSATION_WORK_QUEUE_SIGNATURE_VERSION),
+  signedAtMs: z.number().finite()
 }).strict();
 function getConversationWorkQueueSecret() {
   return process.env.JUNIOR_SECRET?.trim() || void 0;
@@ -139,9 +121,6 @@ function getVercelConversationWorkQueue() {
 }
 
 export {
-  conversationQueueMessageSchema,
-  ConversationQueueMessageRejectedError,
-  isConversationQueueMessageRejectedError,
   verifyConversationQueueMessage,
   resolveConversationWorkQueueTopic,
   getVercelConversationWorkQueue

package/dist/{chunk-BG3KWWDJ.js → chunk-KDCHVT25.js}

@@ -1,6 +1,6 @@
 import {
   JUNIOR_VERSION
-} from "./chunk-JQRTXJHD.js";
+} from "./chunk-C7ZVPO4Z.js";
 
 // src/deployment.ts
 var JUNIOR_HEARTBEAT_ROUTE = "/api/internal/heartbeat";

package/dist/{chunk-VH6MI4L7.js → chunk-KFRHRSCJ.js}

@@ -5,7 +5,7 @@ import {
   logInfo,
   logWarn,
   setSpanAttributes
-} from "./chunk-XWPA5KZF.js";
+} from "./chunk-JNNJZURV.js";
 import {
   discoverInstalledPluginPackageContent,
   normalizePluginPackageNames

package/dist/chunk-LPVUNO2W.js

@@ -0,0 +1,320 @@
+import {
+  authorizationId
+} from "./chunk-DIB4GX3G.js";
+import {
+  formatProviderLabel,
+  startOAuthFlow
+} from "./chunk-SD3OFRWY.js";
+import {
+  abandonReplacedPendingAuth,
+  canReusePendingAuthLink,
+  recordAuthorizationRequested
+} from "./chunk-TUUDXEXU.js";
+import {
+  parseSandboxEgressAuthRequiredSignal
+} from "./chunk-EPBBYMNE.js";
+import {
+  AGENT_INVOCATION_MAILBOX_STATUSES
+} from "./chunk-DCLLQGS6.js";
+import {
+  TURN_REASONING_LEVELS
+} from "./chunk-BYW4B4PR.js";
+import {
+  pluginCatalogRuntime
+} from "./chunk-QS527AV5.js";
+import {
+  credentialContextSchema
+} from "./chunk-77VDLF3Z.js";
+
+// src/chat/services/auth-pause.ts
+var AuthorizationPauseError = class extends Error {
+  disposition;
+  kind;
+  provider;
+  providerDisplayName;
+  requestText;
+  constructor(kind, provider, providerDisplayName, disposition, requestText) {
+    super(
+      kind === "mcp" ? `MCP authorization started for ${provider}` : `Plugin authorization started for ${provider}`
+    );
+    this.name = kind === "mcp" ? "McpAuthorizationPauseError" : "PluginAuthorizationPauseError";
+    this.disposition = disposition;
+    this.kind = kind;
+    this.provider = provider;
+    this.providerDisplayName = providerDisplayName;
+    this.requestText = requestText;
+  }
+};
+var AuthPausePersistenceError = class extends Error {
+  constructor(conversationId, turnId, cause) {
+    super(
+      `Failed to persist auth pause for conversation=${conversationId} turn=${turnId}`,
+      cause === void 0 ? void 0 : { cause }
+    );
+    this.name = "AuthPausePersistenceError";
+  }
+};
+var AuthorizationFlowDisabledError = class extends Error {
+  kind;
+  provider;
+  constructor(kind, provider) {
+    super(
+      `Authorization is required for ${provider}, but this turn cannot start an authorization flow.`
+    );
+    this.name = "AuthorizationFlowDisabledError";
+    this.kind = kind;
+    this.provider = provider;
+  }
+};
+
+// src/chat/services/plugin-auth-orchestration.ts
+var PluginAuthorizationPauseError = class extends AuthorizationPauseError {
+  constructor(provider, providerDisplayName, disposition, requestText) {
+    super("plugin", provider, providerDisplayName, disposition, requestText);
+  }
+};
+var PluginCredentialFailureError = class extends Error {
+  provider;
+  constructor(provider, message) {
+    super(message);
+    this.name = "PluginCredentialFailureError";
+    this.provider = provider;
+  }
+};
+function pluginAuthRequiredSignal(details) {
+  if (!details || typeof details !== "object") {
+    return void 0;
+  }
+  const signal = details.auth_required;
+  const parsedSignal = parseSandboxEgressAuthRequiredSignal(signal);
+  if (!parsedSignal) {
+    return void 0;
+  }
+  return {
+    provider: parsedSignal.provider,
+    grant: parsedSignal.grant,
+    kind: parsedSignal.kind,
+    ...parsedSignal.message ? { message: parsedSignal.message } : {},
+    ...parsedSignal.authorization ? { authorization: parsedSignal.authorization } : {}
+  };
+}
+function createPluginAuthOrchestration(input) {
+  let pendingPause;
+  const startAuthorizationPause = async (provider, options) => {
+    if (pendingPause) {
+      throw pendingPause;
+    }
+    if (!input.actorId || !pluginCatalogRuntime.getOAuthConfig(provider)) {
+      throw new Error(`Cannot start plugin authorization for ${provider}`);
+    }
+    if (input.interactiveAuthEnabled === false) {
+      throw new AuthorizationFlowDisabledError("plugin", provider);
+    }
+    const recordPendingAuth = input.sessionId ? input.recordPendingAuth : void 0;
+    if (input.sessionId && !recordPendingAuth) {
+      throw new Error(
+        `Missing pending auth recorder for plugin authorization pause "${provider}"`
+      );
+    }
+    const providerLabel = formatProviderLabel(provider);
+    const reusingPendingLink = input.sessionId ? canReusePendingAuthLink({
+      pendingAuth: input.pendingAuth,
+      kind: "plugin",
+      provider,
+      actorId: input.actorId,
+      sessionId: input.sessionId,
+      ...options?.scope ? { scope: options.scope } : {}
+    }) : false;
+    if (!reusingPendingLink) {
+      const oauthResult = await startOAuthFlow(provider, {
+        actorId: input.actorId,
+        channelId: input.channelId,
+        destination: input.destination,
+        source: input.source,
+        threadTs: input.threadTs,
+        ...options?.scope ? { scope: options.scope } : {},
+        resumeConversationId: input.conversationId,
+        resumeSessionId: input.sessionId,
+        authorization: input.authorization
+      });
+      if (!oauthResult.ok) {
+        throw new Error(oauthResult.error);
+      }
+      if (!oauthResult.delivery) {
+        throw new Error(
+          `I need to connect your ${providerLabel} account first, but I wasn't able to send you a private authorization link. Please send me a direct message and try again.`
+        );
+      }
+    }
+    if (input.sessionId && recordPendingAuth) {
+      const nextPendingAuth = {
+        kind: "plugin",
+        provider,
+        actorId: input.actorId,
+        ...options?.scope ? { scope: options.scope } : {},
+        sessionId: input.sessionId,
+        linkSentAtMs: reusingPendingLink ? input.pendingAuth.linkSentAtMs : Date.now()
+      };
+      await recordPendingAuth(nextPendingAuth);
+      await abandonReplacedPendingAuth({
+        conversationId: input.conversationId,
+        previousPendingAuth: input.pendingAuth,
+        nextPendingAuth
+      });
+    }
+    if (input.conversationId && input.sessionId) {
+      await recordAuthorizationRequested({
+        conversationId: input.conversationId,
+        kind: "plugin",
+        provider,
+        actorId: input.actorId,
+        authorizationId: authorizationId({
+          kind: "plugin",
+          provider,
+          sessionId: input.sessionId
+        }),
+        delivery: reusingPendingLink ? "private_link_reused" : "private_link_sent"
+      });
+    }
+    pendingPause = new PluginAuthorizationPauseError(
+      provider,
+      providerLabel,
+      reusingPendingLink ? "link_already_sent" : "link_sent",
+      input.userMessage
+    );
+    input.abortAgent();
+    throw pendingPause;
+  };
+  return {
+    maybeHandleAuthSignal: async (details) => {
+      const signal = pluginAuthRequiredSignal(details);
+      if (!signal) {
+        return;
+      }
+      const { provider, authorization } = signal;
+      if (signal.kind === "unavailable") {
+        throw new PluginCredentialFailureError(
+          provider,
+          signal.message ?? `${formatProviderLabel(provider)} credentials are unavailable.`
+        );
+      }
+      if (!authorization) {
+        throw new PluginCredentialFailureError(
+          provider,
+          signal.message ?? `${formatProviderLabel(provider)} credentials are required but no OAuth flow is available for this provider.`
+        );
+      }
+      if (!input.actorId || !input.userTokenStore) {
+        if (input.interactiveAuthEnabled === false) {
+          throw new AuthorizationFlowDisabledError("plugin", provider);
+        }
+        throw new PluginCredentialFailureError(
+          provider,
+          signal.message ?? `${formatProviderLabel(provider)} credentials are required. Please connect your ${formatProviderLabel(provider)} account and try again.`
+        );
+      }
+      if (!pluginCatalogRuntime.getOAuthConfig(authorization.provider)) {
+        throw new PluginCredentialFailureError(
+          provider,
+          signal.message ?? `${formatProviderLabel(provider)} credentials are required but the provider is not configured for OAuth.`
+        );
+      }
+      await startAuthorizationPause(
+        authorization.provider,
+        authorization.scope ? { scope: authorization.scope } : void 0
+      );
+    },
+    getPendingPause: () => pendingPause
+  };
+}
+
+// src/chat/agent-invocations/errors.ts
+var AgentInvocationBusyError = class extends Error {
+  constructor(name) {
+    super(`Named agent "${name}" already has active work`);
+    this.name = "AgentInvocationBusyError";
+  }
+};
+var AgentInvocationLimitError = class extends Error {
+  constructor(limit) {
+    super(
+      `Parent already has ${limit} active child agent invocations (limit ${limit})`
+    );
+    this.name = "AgentInvocationLimitError";
+  }
+};
+
+// src/chat/agent-invocations/types.ts
+import {
+  actorSchema,
+  destinationSchema,
+  sourceSchema
+} from "@sentry/junior-plugin-api";
+import { z } from "zod";
+var exactStringSchema = z.string().min(1).refine((value) => value === value.trim());
+var agentNameSchema = exactStringSchema.max(64);
+var agentInvocationMailboxStatusSchema = z.enum(
+  AGENT_INVOCATION_MAILBOX_STATUSES
+);
+var agentBindingSchema = z.object({
+  childConversationId: exactStringSchema,
+  name: agentNameSchema,
+  parentConversationId: exactStringSchema
+}).strict();
+var agentInvocationBaseSchema = z.object({
+  actor: actorSchema,
+  agentName: agentNameSchema.optional(),
+  childConversationId: exactStringSchema,
+  createdAtMs: z.number().finite(),
+  credentialContext: credentialContextSchema.optional(),
+  destination: destinationSchema,
+  destinationVisibility: z.enum(["public", "private"]).optional(),
+  input: exactStringSchema,
+  invocationId: exactStringSchema,
+  mailboxStatus: agentInvocationMailboxStatusSchema,
+  parentConversationId: exactStringSchema,
+  reasoningLevel: z.enum(TURN_REASONING_LEVELS).optional(),
+  source: sourceSchema,
+  updatedAtMs: z.number().finite()
+}).strict();
+var agentInvocationSchema = z.discriminatedUnion("status", [
+  agentInvocationBaseSchema.extend({
+    status: z.enum(["pending", "running", "awaiting_resume"])
+  }),
+  agentInvocationBaseSchema.extend({
+    result: z.string(),
+    status: z.literal("completed"),
+    terminalAtMs: z.number().finite()
+  }),
+  agentInvocationBaseSchema.extend({
+    errorMessage: z.string(),
+    status: z.enum(["blocked", "failed"]),
+    terminalAtMs: z.number().finite()
+  })
+]);
+var createAgentInvocationSchema = z.object({
+  actor: actorSchema,
+  agentName: agentNameSchema.optional(),
+  credentialContext: credentialContextSchema.optional(),
+  destination: destinationSchema,
+  destinationVisibility: z.enum(["public", "private"]).optional(),
+  idempotencyKey: exactStringSchema,
+  input: exactStringSchema,
+  parentConversationId: exactStringSchema,
+  reasoningLevel: z.enum(TURN_REASONING_LEVELS).optional(),
+  source: sourceSchema
+}).strict();
+
+export {
+  AuthorizationPauseError,
+  AuthPausePersistenceError,
+  AuthorizationFlowDisabledError,
+  AgentInvocationBusyError,
+  AgentInvocationLimitError,
+  agentNameSchema,
+  agentBindingSchema,
+  agentInvocationSchema,
+  createAgentInvocationSchema,
+  PluginCredentialFailureError,
+  createPluginAuthOrchestration
+};