@sentry/junior 0.203.0 → 0.204.0

package/dist/credential-sync-kXr1hvO1.js

@@ -0,0 +1,2660 @@
+import { N as getMcpProviderErrorAttributes, Q as createUserTokenStore, a as deleteMcpAuthSession, d as putMcpStoredOAuthCredentials, h as resolvePluginOAuthAccount, i as finalizeMcpAuthorization, l as getMcpAuthSession, u as getMcpStoredOAuthCredentials, y as lookupSlackUserProfile } from "./agent-CMyTD4DD.js";
+import { O as escapeXml, a as getRuntimeMetadata, i as getChatConfig, m as normalizeSlackEmojiName, n as botConfig } from "./config-nGCW1OTG.js";
+import { L as toOptionalString, S as withLogContext, d as logInfo, f as logWarn, m as runBestEffort, u as logException, y as setTags } from "./logging-BzAk1S_s.js";
+import { n as defaultModelId } from "./model-profile-CZmVoGdX.js";
+import { _ as parseSlackMessageTs, g as parseSlackUserId, l as isUserActor, s as createSlackResumeActor } from "./context-B45_WqVX.js";
+import { B as getSlackClient, Dt as getSqlExecutor, H as isDmChannel, I as SlackActionError, Lt as upsertIdentity, Rt as upsertLinkedIdentity, Tt as getConversationStore, U as normalizeSlackConversationId, Vt as requireSlackDestination, dt as getDashboardConversationLink, o as getPluginSlackConversationLink, z as getHeaderString } from "./agent-hooks-Bbcp9e33.js";
+import { i as homeDir } from "./package-discovery-7a9YqLhE.js";
+import { l as hasRequiredOAuthScope, n as buildOAuthTokenRequest, r as parseOAuthTokenResponse } from "./registry-DH1xUo2N.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-BReos-D4.js";
+import { t as discoverSkills } from "./skills-CIcDQSgM.js";
+import { P as commitAcceptedReply, Q as hydrateConversationMessages, R as loadProjection, U as recordAuthenticationLinked, W as recordAuthorizationCompleted, d as persistWithRetry, dt as recordDeliveredAssistantMessage, ft as turnHasReply, i as abandonTurnRecord, it as buildConversationContext, lt as markConversationMessage, m as buildTurnErrorResponse, n as loadTurnCheckpoint, o as failTurnRecord, r as saveTurnCheckpoint, s as getTurnRecord, u as recordTurnSummary } from "./checkpoint-CNrPyRJN.js";
+import { E as acquireActiveLock, w as getStateAdapter } from "./profile-CrT5nXbw.js";
+import { Ct as ensureConversationWake, Nt as requestConversationWork, c as parseSlackThreadId, d as resolveSlackChannelIdFromThreadId, l as readSlackRawMessageContext, u as resolveSlackChannelIdFromMessage } from "./stats-DTUbAb88.js";
+import { a as isPendingAuthLatestRequest, f as CooperativeTurnYieldError, g as isCooperativeTurnYieldError, i as getConversationPendingAuth, r as clearPendingAuth, s as getAssistantReplyText, x as markTurnFailed } from "./pending-auth-CWmSdZVg.js";
+import { a as parseOAuthStatePayload, c as escapeSlackMrkdwnText, d as normalizeSlackStatusText, f as truncateStatusText, g as removeReactionFromMessage, h as postSlackMessage, i as formatProviderLabel, l as formatSlackLink, o as resolveBaseUrl, p as addReactionToMessage, u as normalizeSlackReplyMarkdown, v as RetryableDeliveryError } from "./agent-runner-DNb1A49M.js";
+import { t as getVercelConversationWorkQueue } from "./vercel-queue-DIkVcfK4.js";
+import { a as getTurnRequestDeadline } from "./job-queue-Drn_LXlM.js";
+import { i as resolveTurnSessionRouting, n as scheduleSessionCompletedPluginTasks } from "./task-runner-D-O3A-Cp.js";
+import { n as getTurnLifecycle } from "./turn-lifecycle-DQV19VTW.js";
+import { n as executeTurn, t as AgentRunError } from "./turn-execution-BkinIdJF.js";
+import { c as configValueSchema, n as getPersistedSandboxState, o as persistThreadStateById, r as getPersistedThreadState, s as coerceThreadConversationState, t as getLocationConfigurationService } from "./thread-state-CRc9jTJS.js";
+import { a as requireTurnFailureEventId, c as getTurnUserMessageId, d as buildDeliveredTurnStatePatch, l as getTurnUserReplyAttachmentContext, n as persistAuthPauseTurnState, o as getInterruptionMarker, r as finalizeFailedTurnReplyWithEvent, s as getTurnUserMessage, u as getTurnUserSlackMessageTs } from "./auth-pause-state-DosEalIG.js";
+import { i as buildSentryConversationUrl, n as deleteWebAuthorization } from "./web-authorization-RMBxAR_t.js";
+import { n as relayLocalOAuthCallback } from "./oauth-relay-CdCnu80W.js";
+import path from "node:path";
+import { z } from "zod";
+import { createHmac, createSecretKey, timingSafeEqual } from "node:crypto";
+import { pluginStoredTokensSchema } from "@sentry/junior-plugin-api";
+import fs from "node:fs";
+//#region src/chat/slack/assistant-thread/status-render.ts
+const DEFAULT_STATUS_CONTEXTS = {
+	thinking: "…",
+	searching: "sources",
+	reading: "task",
+	reviewing: "results",
+	drafting: "reply",
+	running: "tasks"
+};
+function formatAssistantStatusText(verb, context) {
+	const normalizedVerb = normalizeSlackStatusText(verb).trim().toLowerCase();
+	const normalizedContext = normalizeSlackStatusText(context ?? "") || DEFAULT_STATUS_CONTEXTS[normalizedVerb] || "";
+	if (!normalizedVerb) return truncateStatusText(normalizedContext || "Working");
+	const displayVerb = `${normalizedVerb[0]?.toUpperCase() ?? ""}${normalizedVerb.slice(1)}`;
+	return truncateStatusText(normalizedContext ? `${displayVerb} ${normalizedContext}` : displayVerb);
+}
+/** Build assistant progress text from a verb and optional context. */
+function makeAssistantStatus(verb, context) {
+	return { text: formatAssistantStatusText(verb, context) };
+}
+/** Normalize a progress update into the visible Slack loading copy. */
+function renderAssistantStatus(args) {
+	const visible = truncateStatusText(normalizeSlackStatusText(args.status.text));
+	return {
+		key: visible,
+		visible
+	};
+}
+/** Select and normalize the loading messages used for Slack status rotation. */
+function selectAssistantLoadingMessages(args) {
+	const random = args.random ?? Math.random;
+	const normalized = Array.from(new Set(args.messages.map((message) => truncateStatusText(normalizeSlackStatusText(message))).filter((message) => message.length > 0)));
+	if (normalized.length === 0) return;
+	const shuffled = [...normalized];
+	for (let index = shuffled.length - 1; index > 0; index -= 1) {
+		const otherIndex = Math.floor(random() * (index + 1));
+		[shuffled[index], shuffled[otherIndex]] = [shuffled[otherIndex], shuffled[index]];
+	}
+	return shuffled.slice(0, 10);
+}
+//#endregion
+//#region src/chat/slack/assistant-thread/status-scheduler.ts
+const STATUS_UPDATE_DEBOUNCE_MS = 1e3;
+const STATUS_MIN_VISIBLE_MS = 1200;
+const STATUS_ROTATION_INTERVAL_MS = 3e4;
+/**
+* Pace assistant loading-state writes for a single turn.
+*
+* This layer owns only local scheduling policy: debounce, minimum visible
+* duration, refresh cadence, and write ordering. It deals in user-visible
+* progress copy; the transport decides how that maps onto Slack's `status`
+* versus `loading_messages` fields.
+*/
+function createAssistantStatusScheduler(args) {
+	const now = args.now ?? (() => Date.now());
+	const setTimer = args.setTimer ?? ((callback, delayMs) => setTimeout(callback, delayMs));
+	const clearTimer = args.clearTimer ?? ((timer) => clearTimeout(timer));
+	const random = args.random ?? Math.random;
+	const loadingMessages = selectAssistantLoadingMessages({
+		messages: args.loadingMessages ?? [],
+		random
+	});
+	const defaultStatus = makeAssistantStatus("thinking");
+	let active = false;
+	let currentKey = "";
+	let currentVisibleStatus = "";
+	let currentLoadingMessages;
+	let lastStatusAt = 0;
+	let pendingStatus = null;
+	let pendingKey = "";
+	let pendingTimer = null;
+	let rotationTimer = null;
+	let inflightStatusUpdate = Promise.resolve();
+	const enqueueStatusUpdate = (task) => {
+		const request = inflightStatusUpdate.catch(() => void 0).then(async () => {
+			await task();
+		});
+		inflightStatusUpdate = request.catch(() => void 0);
+		return request;
+	};
+	const scheduleRotation = () => {
+		if (rotationTimer) {
+			clearTimer(rotationTimer);
+			rotationTimer = null;
+		}
+		if (!active || !currentVisibleStatus) return;
+		rotationTimer = setTimer(() => {
+			rotationTimer = null;
+			if (!active || !currentVisibleStatus) return;
+			postStatus(currentVisibleStatus, currentLoadingMessages);
+		}, STATUS_ROTATION_INTERVAL_MS);
+	};
+	const getLoadingMessagesForVisibleStatus = (visible) => visible ? [visible] : void 0;
+	const getInitialStatusText = () => {
+		if (loadingMessages?.length) return loadingMessages[0];
+		return defaultStatus.text;
+	};
+	const haveSameLoadingMessages = (left, right) => {
+		if (left === right) return true;
+		if (!left || !right || left.length !== right.length) return false;
+		return left.every((message, index) => message === right[index]);
+	};
+	const postStatus = async (text, nextLoadingMessages) => {
+		if (!text && !currentVisibleStatus) return;
+		currentVisibleStatus = text;
+		currentLoadingMessages = nextLoadingMessages;
+		lastStatusAt = now();
+		scheduleRotation();
+		await enqueueStatusUpdate(async () => {
+			await args.sendStatus(text, nextLoadingMessages);
+		});
+	};
+	const postRenderedStatus = async (status) => {
+		const presentation = renderAssistantStatus({ status });
+		const nextLoadingMessages = getLoadingMessagesForVisibleStatus(presentation.visible);
+		currentKey = presentation.key;
+		await postStatus(presentation.visible, nextLoadingMessages);
+	};
+	const clearPending = () => {
+		if (pendingTimer) {
+			clearTimer(pendingTimer);
+			pendingTimer = null;
+		}
+		pendingStatus = null;
+		pendingKey = "";
+	};
+	const flushPending = async () => {
+		if (!active || !pendingStatus) {
+			clearPending();
+			return;
+		}
+		const next = pendingStatus;
+		clearPending();
+		if (renderAssistantStatus({ status: next }).key !== currentKey) await postRenderedStatus(next);
+	};
+	return {
+		async clear() {
+			active = false;
+			clearPending();
+			if (rotationTimer) {
+				clearTimer(rotationTimer);
+				rotationTimer = null;
+			}
+			currentKey = "";
+			await postStatus("");
+		},
+		update(status) {
+			if (!active) {
+				active = true;
+				clearPending();
+				if (status) {
+					postRenderedStatus(status);
+					return;
+				}
+				currentKey = "initial";
+				postStatus(getInitialStatusText(), loadingMessages);
+				return;
+			}
+			if (!status) {
+				clearPending();
+				currentKey = "initial";
+				postStatus(getInitialStatusText(), loadingMessages);
+				return;
+			}
+			const presentation = renderAssistantStatus({ status });
+			if (!presentation.visible) return;
+			if (presentation.key === currentKey || presentation.key === pendingKey) return;
+			if (presentation.visible === currentVisibleStatus) {
+				clearPending();
+				currentKey = presentation.key;
+				const nextLoadingMessages = getLoadingMessagesForVisibleStatus(presentation.visible);
+				if (!haveSameLoadingMessages(currentLoadingMessages, nextLoadingMessages)) postStatus(presentation.visible, nextLoadingMessages);
+				return;
+			}
+			const elapsed = now() - lastStatusAt;
+			const waitMs = Math.max(STATUS_UPDATE_DEBOUNCE_MS - elapsed, STATUS_MIN_VISIBLE_MS - elapsed, 0);
+			if (waitMs <= 0) {
+				clearPending();
+				postRenderedStatus(status);
+				return;
+			}
+			pendingStatus = status;
+			pendingKey = presentation.key;
+			if (pendingTimer) return;
+			pendingTimer = setTimer(() => {
+				pendingTimer = null;
+				flushPending();
+			}, Math.max(1, waitMs));
+		}
+	};
+}
+//#endregion
+//#region src/chat/slack/assistant-thread/status-send.ts
+/**
+* Slack's assistant loading UI accepts both `status` and `loading_messages`,
+* but product policy keeps `status` stable and generic. User-visible progress
+* copy belongs in `loading_messages`.
+*/
+const SLACK_ASSISTANT_ACTIVE_STATUS = "is working on your request...";
+/**
+* Build a best-effort sender for Slack's assistant loading state.
+*
+* The `text` argument is internal progress copy. This transport maps it onto
+* Slack's loading surface and keeps the raw Slack `status` field fixed.
+*/
+function createSlackAdapterStatusSender(args) {
+	const adapter = args.getSlackAdapter();
+	const boundToken = getSlackAdapterRequestToken(adapter);
+	return async (text, loadingMessages) => {
+		const channelId = args.channelId;
+		const threadTs = args.threadTs;
+		if (!channelId || !threadTs) return;
+		const normalizedChannelId = normalizeSlackConversationId(channelId);
+		if (!normalizedChannelId) return;
+		const nextLoadingMessages = text ? loadingMessages ?? [text] : void 0;
+		try {
+			await runWithBoundSlackToken(adapter, boundToken, () => adapter.setAssistantStatus(normalizedChannelId, threadTs, text ? SLACK_ASSISTANT_ACTIVE_STATUS : "", nextLoadingMessages));
+		} catch (error) {
+			logAssistantStatusFailure({
+				status: text,
+				error,
+				channelId,
+				normalizedChannelId,
+				threadTs
+			});
+		}
+	};
+}
+/**
+* Build a best-effort sender for Slack's assistant loading state over raw Web
+* API calls. As with the adapter-backed path, the dynamic copy goes to
+* `loading_messages` while `status` stays fixed and generic.
+*/
+function createSlackWebApiStatusSender(args) {
+	const getClient = args.getSlackClient ?? getSlackClient;
+	return async (text, loadingMessages) => {
+		const channelId = args.channelId;
+		const threadTs = args.threadTs;
+		if (!channelId || !threadTs) return;
+		const normalizedChannelId = normalizeSlackConversationId(channelId);
+		if (!normalizedChannelId) return;
+		const nextLoadingMessages = text ? loadingMessages ?? [text] : void 0;
+		try {
+			await getClient().assistant.threads.setStatus({
+				channel_id: normalizedChannelId,
+				thread_ts: threadTs,
+				status: text ? SLACK_ASSISTANT_ACTIVE_STATUS : "",
+				...nextLoadingMessages ? { loading_messages: nextLoadingMessages } : void 0
+			});
+		} catch (error) {
+			logAssistantStatusFailure({
+				status: text,
+				error,
+				channelId,
+				normalizedChannelId,
+				threadTs
+			});
+		}
+	};
+}
+function getSlackAdapterRequestToken(adapter) {
+	const token = adapter.requestContext?.getStore()?.token;
+	if (typeof token !== "string") return;
+	return token.trim() || void 0;
+}
+async function runWithBoundSlackToken(adapter, token, task) {
+	if (!token) return await task();
+	return await adapter.withBotToken(token, task);
+}
+function logAssistantStatusFailure(args) {
+	logWarn("assistant.status.update.failed", {
+		"app.slack.status_text": args.status || "(clear)",
+		"app.slack.channel_id_raw": args.channelId,
+		"app.slack.channel_id": args.normalizedChannelId,
+		"app.slack.thread_ts": args.threadTs,
+		"exception.message": args.error instanceof Error ? args.error.message : String(args.error)
+	});
+}
+//#endregion
+//#region src/chat/slack/assistant-thread/status.ts
+/**
+* Create a Slack adapter-backed session for Slack's assistant loading state.
+*
+* The session accepts internal progress updates and leaves it to the sender to
+* map them onto Slack's fixed generic `status` field plus dynamic
+* `loading_messages`.
+*/
+function createSlackAdapterAssistantStatusSession(args) {
+	return createAssistantStatusScheduler({
+		sendStatus: createSlackAdapterStatusSender({
+			channelId: args.channelId,
+			threadTs: args.threadTs,
+			getSlackAdapter: args.getSlackAdapter
+		}),
+		loadingMessages: args.loadingMessages ?? botConfig.loadingMessages,
+		now: args.now,
+		setTimer: args.setTimer,
+		clearTimer: args.clearTimer,
+		random: args.random
+	});
+}
+/**
+* Create a Web API-backed session for Slack's assistant loading state in
+* resume/callback flows that do not use the adapter thread object.
+*/
+function createSlackWebApiAssistantStatusSession(args) {
+	return createAssistantStatusScheduler({
+		sendStatus: createSlackWebApiStatusSender({
+			channelId: args.channelId,
+			threadTs: args.threadTs,
+			getSlackClient: args.getSlackClient
+		}),
+		loadingMessages: args.loadingMessages ?? botConfig.loadingMessages,
+		now: args.now,
+		setTimer: args.setTimer,
+		clearTimer: args.clearTimer,
+		random: args.random
+	});
+}
+//#endregion
+//#region src/chat/slack/footer.ts
+/** Render compact reply attribution for the Slack footer. */
+function formatReplyAttribution(attribution) {
+	return attribution.detail ? `${attribution.label} · ${attribution.detail}` : attribution.label;
+}
+/**
+* Build the compact conversation footer for visible Slack reply surfaces.
+*
+* Detailed turn metrics stay in the dashboard instead of Slack-visible copy.
+*/
+function buildSlackReplyFooter(args) {
+	const items = [];
+	const conversationId = args.conversationId?.trim();
+	if (conversationId) {
+		const idItem = {
+			label: "ID",
+			value: conversationId
+		};
+		const conversationUrl = getPluginSlackConversationLink(conversationId)?.url ?? getDashboardConversationLink(conversationId) ?? buildSentryConversationUrl(conversationId);
+		if (conversationUrl) idItem.url = conversationUrl;
+		items.push(idItem);
+	}
+	return items.length > 0 || args.replyAttribution ? {
+		...args.replyAttribution ? { attribution: args.replyAttribution } : void 0,
+		items
+	} : void 0;
+}
+/** Build Slack blocks for a reply chunk using the Slack-flavored markdown block for the body. */
+function buildSlackReplyBlocks(text, footer) {
+	if (!text.trim()) return;
+	const blocks = [{
+		type: "markdown",
+		text
+	}];
+	if (footer && (footer.attribution || footer.items.length > 0)) {
+		const attributionElements = footer.attribution ? [{
+			type: "plain_text",
+			text: formatReplyAttribution(footer.attribution)
+		}] : [];
+		blocks.push({
+			type: "context",
+			elements: [...attributionElements, ...footer.items.map((item) => ({
+				type: "mrkdwn",
+				text: item.url ? `*${escapeSlackMrkdwnText(item.label)}:* ${formatSlackLink(item.url, item.value)}` : `*${escapeSlackMrkdwnText(item.label)}:* ${escapeSlackMrkdwnText(item.value)}`
+			}))]
+		});
+	}
+	return blocks;
+}
+//#endregion
+//#region src/chat/slack/output.ts
+const MAX_INLINE_CHARS = 2200;
+const MAX_INLINE_LINES = 45;
+const CONTINUED_MARKER = "\n\n[Continued below]";
+function countSlackLines(text) {
+	if (!text) return 0;
+	return text.split("\n").length;
+}
+function fitsInlineBudget(text, maxChars = MAX_INLINE_CHARS, maxLines = MAX_INLINE_LINES) {
+	return text.length <= maxChars && countSlackLines(text) <= maxLines;
+}
+function findSplitIndex(text, maxChars) {
+	if (text.length <= maxChars) return text.length;
+	const bounded = text.slice(0, maxChars);
+	const newlineIndex = bounded.lastIndexOf("\n");
+	if (newlineIndex > 0) return newlineIndex;
+	const spaceIndex = bounded.lastIndexOf(" ");
+	if (spaceIndex > 0) return spaceIndex;
+	return maxChars;
+}
+function splitByLineBudget(text, maxLines) {
+	if (maxLines <= 0) return "";
+	const lines = text.split("\n");
+	if (lines.length <= maxLines) return text;
+	return lines.slice(0, maxLines).join("\n");
+}
+function reserveInlineBudgetForSuffix(suffix, maxChars = MAX_INLINE_CHARS, maxLines = MAX_INLINE_LINES) {
+	return {
+		maxChars: Math.max(1, maxChars - suffix.length),
+		maxLines: Math.max(1, maxLines - Math.max(0, countSlackLines(suffix) - 1))
+	};
+}
+function forceSplitBudget(text, budget) {
+	const lineCount = countSlackLines(text);
+	return {
+		maxChars: text.length <= budget.maxChars ? Math.max(1, text.length - 1) : budget.maxChars,
+		maxLines: lineCount <= budget.maxLines ? Math.max(1, lineCount - 1) : budget.maxLines
+	};
+}
+function getFenceContinuation(text) {
+	let open;
+	for (const line of text.split("\n")) {
+		const trimmed = line.trimStart();
+		const openerMatch = trimmed.match(/^(`{3,}|~{3,})(.*)$/);
+		if (!openerMatch) continue;
+		if (!open) {
+			open = {
+				fence: openerMatch[1],
+				openerLine: trimmed
+			};
+			continue;
+		}
+		if (new RegExp(`^${open.fence}\\s*$`).test(trimmed)) open = void 0;
+	}
+	if (!open) return null;
+	return {
+		closeSuffix: text.endsWith("\n") ? open.fence : `\n${open.fence}`,
+		reopenPrefix: `${open.openerLine}\n`
+	};
+}
+function appendSlackSuffix(text, marker) {
+	return `${text}${getFenceContinuation(text)?.closeSuffix ?? ""}${marker}`;
+}
+function stripTrailingContinuationMarker(text) {
+	return text.endsWith(CONTINUED_MARKER) ? text.slice(0, -19) : text;
+}
+function takeSlackContinuationChunk(text, budget) {
+	let { prefix, rest } = takeSlackInlinePrefix(text, budget);
+	if (!rest) ({prefix, rest} = takeSlackInlinePrefix(text, forceSplitBudget(text, budget)));
+	let carryover = rest ? getFenceContinuation(prefix) : null;
+	if (!carryover) return {
+		prefix,
+		rest
+	};
+	const carryoverBudget = reserveInlineBudgetForSuffix(`${carryover.closeSuffix}${CONTINUED_MARKER}`);
+	({prefix, rest} = takeSlackInlinePrefix(text, carryoverBudget));
+	if (!rest) ({prefix, rest} = takeSlackInlinePrefix(text, forceSplitBudget(text, carryoverBudget)));
+	carryover = rest ? getFenceContinuation(prefix) : null;
+	if (!carryover) return {
+		prefix,
+		rest
+	};
+	return {
+		prefix,
+		rest: `${carryover.reopenPrefix}${rest}`
+	};
+}
+/** Return the first continuation-safe chunk plus any remaining text. */
+function takeSlackContinuationPrefix(text, options) {
+	const budget = {
+		maxChars: options?.maxChars ?? getSlackContinuationBudget().maxChars,
+		maxLines: options?.maxLines ?? getSlackContinuationBudget().maxLines
+	};
+	const { prefix, rest } = (() => {
+		if (options?.forceSplit) return takeSlackContinuationChunk(text, budget);
+		const initial = takeSlackInlinePrefix(text, budget);
+		return initial.rest ? takeSlackContinuationChunk(text, budget) : initial;
+	})();
+	return {
+		prefix,
+		renderedPrefix: rest ? appendSlackSuffix(prefix, CONTINUED_MARKER) : prefix,
+		rest
+	};
+}
+/**
+* Take the largest Slack-safe inline prefix from `text` under the configured
+* character and line budgets. Returns the consumed prefix plus remaining text.
+*/
+function takeSlackInlinePrefix(text, options) {
+	const maxChars = options?.maxChars ?? MAX_INLINE_CHARS;
+	const maxLines = options?.maxLines ?? MAX_INLINE_LINES;
+	const normalized = text.replace(/\r\n?/g, "\n");
+	if (!normalized) return {
+		prefix: "",
+		rest: ""
+	};
+	if (fitsInlineBudget(normalized, maxChars, maxLines)) return {
+		prefix: normalized,
+		rest: ""
+	};
+	const lineBounded = splitByLineBudget(normalized, maxLines);
+	const cutIndex = findSplitIndex(lineBounded, maxChars);
+	const prefix = lineBounded.slice(0, cutIndex).trimEnd();
+	if (prefix) return {
+		prefix,
+		rest: normalized.slice(prefix.length).trimStart()
+	};
+	const hardPrefix = normalized.slice(0, Math.max(1, maxChars)).trimEnd();
+	return {
+		prefix: hardPrefix || normalized.slice(0, Math.max(1, maxChars)),
+		rest: normalized.slice(hardPrefix.length || Math.max(1, maxChars)).trimStart()
+	};
+}
+/**
+* Split a normalized Slack reply into multiple inline-safe thread messages.
+*
+* Replies split across more than two messages receive explicit continuation
+* markers on non-final chunks. When
+* `interrupted` is true, the final chunk receives an interruption marker.
+*/
+function splitSlackReplyText(text, options) {
+	const normalized = normalizeSlackReplyMarkdown(text);
+	if (!normalized) return [];
+	const chunks = [];
+	const continuationBudget = reserveInlineBudgetForSuffix(CONTINUED_MARKER);
+	let remaining = normalized;
+	while (remaining) {
+		if (options?.interrupted ? fitsInlineBudget(appendSlackSuffix(remaining, getInterruptionMarker())) : fitsInlineBudget(remaining)) {
+			chunks.push(options?.interrupted ? appendSlackSuffix(remaining, getInterruptionMarker()) : remaining);
+			break;
+		}
+		const { renderedPrefix, rest } = takeSlackContinuationPrefix(remaining, {
+			...continuationBudget,
+			forceSplit: true
+		});
+		chunks.push(renderedPrefix);
+		remaining = rest;
+	}
+	if (chunks.length === 2) chunks[0] = stripTrailingContinuationMarker(chunks[0] ?? "");
+	return chunks;
+}
+/**
+* Reserve enough inline budget for a continuation suffix on the current chunk.
+*/
+function getSlackContinuationBudget() {
+	return reserveInlineBudgetForSuffix(CONTINUED_MARKER);
+}
+/** Normalize text for Slack and wrap it as a PostableMessage. */
+function buildSlackOutputMessage(text) {
+	const normalized = normalizeSlackReplyMarkdown(text);
+	if (!normalized) throw new Error(`Slack output normalized to empty content: original_length=${text.length} parsed_length=${normalized.length}`);
+	return { markdown: normalized };
+}
+//#endregion
+//#region src/chat/slack/reply.ts
+/**
+* Send one destination-visible Slack reply.
+*
+* Chunks oversized text, builds compact attribution and conversation footer
+* context, and posts through the shared Slack outbound boundary.
+*/
+async function sendSlackReply(args) {
+	const chunks = splitSlackReplyText(args.text);
+	const footer = buildSlackReplyFooter({
+		conversationId: args.conversationId,
+		replyAttribution: args.replyAttribution
+	});
+	const messageTs = [];
+	let threadTs = args.threadTs;
+	for (const [index, text] of chunks.entries()) {
+		const isFinalChunk = index === chunks.length - 1;
+		const blocks = buildSlackReplyBlocks(text, isFinalChunk ? footer : void 0);
+		const fallbackText = isFinalChunk && args.replyAttribution ? `${text}\n\n${escapeSlackMrkdwnText(formatReplyAttribution(args.replyAttribution))}` : text;
+		const response = await postSlackMessage({
+			channelId: args.channelId,
+			threadTs,
+			text: fallbackText,
+			...blocks ? { blocks } : void 0
+		});
+		if (response.ts) {
+			messageTs.push(response.ts);
+			threadTs ??= response.ts;
+		}
+	}
+	return messageTs;
+}
+//#endregion
+//#region src/chat/slack/errors.ts
+/** Extract Slack's stable API error code from Web API errors. */
+function getSlackApiErrorCode(error) {
+	if (!error || typeof error !== "object") return;
+	const candidate = error;
+	if (typeof candidate.data?.error === "string" && candidate.data.error.trim().length > 0) return candidate.data.error;
+	if (typeof candidate.code === "string" && candidate.code.trim().length > 0) return candidate.code;
+}
+/** Convert Slack Web API error details into the repository's trace attributes. */
+function getSlackErrorObservabilityAttributes(error) {
+	if (!error || typeof error !== "object") return {};
+	const candidate = error;
+	const attributes = {};
+	if (typeof candidate.code === "string" && candidate.code.trim().length > 0) attributes["app.slack.error_code"] = candidate.code;
+	if (typeof candidate.data?.error === "string" && candidate.data.error.trim().length > 0) attributes["app.slack.api_error"] = candidate.data.error;
+	const requestId = getHeaderString(candidate.headers, "x-slack-req-id");
+	if (requestId) attributes["app.slack.request_id"] = requestId;
+	if (typeof candidate.statusCode === "number" && Number.isFinite(candidate.statusCode)) attributes["http.response.status_code"] = candidate.statusCode;
+	return attributes;
+}
+const TRANSIENT_SLACK_API_ERRORS = /* @__PURE__ */ new Set([
+	"fatal_error",
+	"internal_error",
+	"rate_limited",
+	"ratelimited",
+	"request_timeout",
+	"service_unavailable"
+]);
+/** Recover transient or ambiguous Slack failures, but stop on explicit rejection. */
+function isRetryableSlackPostError(error) {
+	if (!error || typeof error !== "object") return true;
+	const candidate = error;
+	if (typeof candidate.statusCode === "number") {
+		if (candidate.statusCode === 429 || candidate.statusCode >= 500) return true;
+		if (candidate.statusCode >= 400) return false;
+	}
+	const apiError = error instanceof SlackActionError ? error.apiError : typeof candidate.data?.error === "string" ? candidate.data.error : void 0;
+	if (apiError) return TRANSIENT_SLACK_API_ERRORS.has(apiError);
+	if (error instanceof SlackActionError) return error.code === "rate_limited" || error.code === "internal_error";
+	return true;
+}
+/** Report whether Slack rejected assistant title updates for stable auth reasons. */
+function isSlackTitlePermissionError(error) {
+	const code = getSlackApiErrorCode(error);
+	return code === "no_permission" || code === "missing_scope" || code === "not_allowed_token_type";
+}
+//#endregion
+//#region src/chat/runtime/thread-context.ts
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function readOptionalStringField(value, key) {
+	if (!(key in value)) return;
+	return toOptionalString(value[key]);
+}
+function stripLeadingBotMention(text, options = {}) {
+	if (!text.trim()) return text;
+	let next = text;
+	if (options.stripLeadingSlackMentionToken) {
+		if (options.botUserId) {
+			const botUserId = escapeRegExp(options.botUserId);
+			const mentionByBotUserIdRe = new RegExp(`^\\s*(?:<@${botUserId}(?:\\|[^>]+)?>|@${botUserId})[\\s,:-]*`, "i");
+			next = next.replace(mentionByBotUserIdRe, "").trim();
+		} else next = next.replace(/^\s*<@[^>]+>[\s,:-]*/, "").trim();
+	}
+	const mentionByNameRe = new RegExp(`^\\s*@${escapeRegExp(botConfig.userName)}\\b[\\s,:-]*`, "i");
+	next = next.replace(mentionByNameRe, "").trim();
+	const mentionByLabeledEntityRe = new RegExp(`^\\s*<@[^>|]+\\|${escapeRegExp(botConfig.userName)}>[\\s,:-]*`, "i");
+	next = next.replace(mentionByLabeledEntityRe, "").trim();
+	return next;
+}
+function getThreadId(thread, _message) {
+	return toOptionalString(thread.id);
+}
+function getRunId(thread, message) {
+	return readOptionalStringField(thread, "runId") ?? readOptionalStringField(message, "runId");
+}
+function getChannelId(thread, message) {
+	return resolveSlackChannelIdFromThreadId(toOptionalString(thread.id)) ?? normalizeSlackConversationId(toOptionalString(thread.channelId)) ?? resolveSlackChannelIdFromMessage(message);
+}
+function getThreadTs(threadId) {
+	return parseSlackThreadId(threadId)?.threadTs;
+}
+/**
+* Resolve Slack assistant-thread API context for the current turn.
+*
+* Slack assistant-thread methods must use the live inbound thread context
+* Slack provided on the current message. Slack's assistant utilities build
+* `setStatus`/`setTitle` from `message.channel` plus `message.thread_ts ?? message.ts`
+* for non-DM message events, while `message.im` still requires an explicit
+* `thread_ts`. Do not synthesize assistant-thread roots from persisted state.
+*/
+function getAssistantThreadContext(message) {
+	const rawContext = readSlackRawMessageContext(message);
+	const channelId = rawContext?.channelId;
+	if (channelId) {
+		const threadTs = isDmChannel(channelId) ? rawContext.threadTs : rawContext.threadTs ?? rawContext.messageTs;
+		if (threadTs) return {
+			channelId,
+			threadTs
+		};
+	}
+	const parsedThreadId = parseSlackThreadId(readOptionalStringField(message, "threadId"));
+	if (!parsedThreadId || isDmChannel(parsedThreadId.channelId)) return;
+	return parsedThreadId;
+}
+/** Resolve the native Slack timestamp for a message that can target Slack APIs. */
+function getMessageTs(message) {
+	const directTs = readOptionalStringField(message, "ts");
+	const parsedDirectTs = parseSlackMessageTs(directTs);
+	if (parsedDirectTs) return parsedDirectTs;
+	const rawContext = readSlackRawMessageContext(message);
+	if (!rawContext) return;
+	const candidates = [rawContext.messageTs, rawContext.nestedMessageTs];
+	for (const candidate of candidates) {
+		const ts = parseSlackMessageTs(candidate);
+		if (ts) return ts;
+	}
+}
+//#endregion
+//#region src/chat/providers/slack/processing-reaction.ts
+const noProcessingReaction = {
+	complete: async () => void 0,
+	keep: () => void 0,
+	stop: async () => void 0
+};
+function isProcessingReactionEmoji(value) {
+	return typeof value === "string" && normalizeSlackEmojiName(value) === getChatConfig().slack.processingReactionEmoji;
+}
+/** Return true when a Slack reaction tool invocation keeps the processing reaction. */
+function shouldKeepProcessingReactionForToolInvocation(input) {
+	return input.toolName === "addReaction" && isProcessingReactionEmoji(input.params.emoji);
+}
+/** Start Junior's automatic Slack processing reaction for one inbound message. */
+async function startProcessingReaction(args) {
+	if (args.message.author.isMe) return noProcessingReaction;
+	const channelId = getChannelId(args.thread, args.message);
+	const messageTs = getMessageTs(args.message);
+	if (!channelId || !messageTs) return noProcessingReaction;
+	return startProcessingReactionForMessage({
+		channelId,
+		timestamp: messageTs
+	});
+}
+/** Start Junior's automatic Slack processing reaction for a known Slack message. */
+async function startProcessingReactionForMessage(args) {
+	try {
+		await addReactionToMessage({
+			channelId: args.channelId,
+			timestamp: args.timestamp,
+			emoji: getChatConfig().slack.processingReactionEmoji
+		});
+	} catch (error) {
+		logException(error, "slack.processing.reaction_add.failed", {
+			"app.slack.action": "reactions.add",
+			"messaging.message.id": args.timestamp,
+			...getSlackErrorObservabilityAttributes(error)
+		});
+		return noProcessingReaction;
+	}
+	let shouldRemove = true;
+	const removeProcessingReaction = async () => {
+		if (!shouldRemove) return false;
+		try {
+			await removeReactionFromMessage({
+				channelId: args.channelId,
+				timestamp: args.timestamp,
+				emoji: getChatConfig().slack.processingReactionEmoji
+			});
+			return true;
+		} catch (error) {
+			logException(error, "slack.processing.reaction_remove.failed", {
+				"app.slack.action": "reactions.remove",
+				"messaging.message.id": args.timestamp,
+				...getSlackErrorObservabilityAttributes(error)
+			});
+			return false;
+		}
+	};
+	return {
+		complete: async () => {
+			const shouldAddCompleted = shouldRemove;
+			await removeProcessingReaction();
+			if (!shouldAddCompleted) return;
+			try {
+				await addReactionToMessage({
+					channelId: args.channelId,
+					timestamp: args.timestamp,
+					emoji: getChatConfig().slack.completedReactionEmoji
+				});
+			} catch (error) {
+				logException(error, "slack.processing.reaction_complete.failed", {
+					"app.slack.action": "reactions.add",
+					"messaging.message.id": args.timestamp,
+					...getSlackErrorObservabilityAttributes(error)
+				});
+			}
+		},
+		keep: () => {
+			shouldRemove = false;
+		},
+		stop: async () => {
+			await removeProcessingReaction();
+		}
+	};
+}
+//#endregion
+//#region src/chat/services/auth-pause-response.ts
+const MAX_AUTH_REQUEST_LENGTH = 200;
+function formatAuthRequest(requestText) {
+	const normalized = requestText.replace(/\s+/g, " ").trim();
+	if (!normalized) return;
+	return (normalized.length > MAX_AUTH_REQUEST_LENGTH ? `${normalized.slice(0, 199).trimEnd()}…` : normalized).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+}
+/** Build the visible Slack thread note for an auth-paused turn. */
+function buildAuthPauseResponse(slackUserId, providerDisplayName, requestText) {
+	const mention = slackUserId ? `<@${slackUserId}> ` : "";
+	const request = requestText ? formatAuthRequest(requestText) : void 0;
+	if (!request) return `${mention}I'll need you to authorize ${providerDisplayName}. I sent you a link.`;
+	return `${mention}I need access to ${providerDisplayName} to continue.\n\n*Why:* ${request}\n\nI sent you a link.`;
+}
+//#endregion
+//#region src/chat/providers/slack/resume.ts
+function resolveReplyTimeoutMs() {
+	const raw = process.env.EVAL_AGENT_REPLY_TIMEOUT_MS?.trim();
+	if (!raw) return;
+	const parsed = Number.parseInt(raw, 10);
+	return Number.isFinite(parsed) && parsed > 0 ? parsed : void 0;
+}
+async function postSlackMessageBestEffort(channelId, threadTs, text, conversationId, replyAttribution) {
+	try {
+		if (conversationId) {
+			await sendSlackReply({
+				channelId,
+				conversationId,
+				replyAttribution,
+				text,
+				threadTs
+			});
+			return;
+		}
+		await postSlackMessage({
+			channelId,
+			threadTs,
+			text
+		});
+	} catch {}
+}
+/** Create a read-only configuration service from persisted values. */
+function createReadOnlyConfigService(rawValues) {
+	const values = Object.fromEntries(Object.entries(rawValues).map(([key, value]) => [key, configValueSchema.parse(value)]));
+	const entries = Object.entries(values).map(([key, value]) => ({
+		key,
+		value,
+		scope: "location",
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+	}));
+	return {
+		get: async (key) => entries.find((entry) => entry.key === key),
+		set: async () => {
+			throw new Error("Configuration is read-only for a resumed Run");
+		},
+		unset: async () => false,
+		list: async ({ prefix } = {}) => entries.filter((entry) => !prefix || entry.key.startsWith(prefix)),
+		resolve: async (key) => values[key],
+		resolveValues: async ({ keys, prefix } = {}) => {
+			const filtered = {};
+			for (const [key, value] of Object.entries(values)) {
+				if (prefix && !key.startsWith(prefix)) continue;
+				if (keys && !keys.includes(key)) continue;
+				filtered[key] = value;
+			}
+			return filtered;
+		}
+	};
+}
+/** Error raised when another worker is already resuming the Slack Turn. */
+var ResumeTurnBusyError = class extends Error {
+	constructor(lockKey) {
+		super(`Another worker is already resuming Slack Turn "${lockKey}"`);
+		this.name = "ResumeTurnBusyError";
+	}
+};
+function getDefaultLockKey(channelId, threadTs) {
+	return threadTs ? `slack:${channelId}:${threadTs}` : `slack:${channelId}`;
+}
+function getResumeLogContext(args, lockKey) {
+	const actor = args.run?.actor;
+	return {
+		conversationId: args.conversationId,
+		messageConversationId: lockKey,
+		userId: isUserActor(actor) ? actor.userId : void 0,
+		userName: isUserActor(actor) ? actor.userName : void 0,
+		destinationName: args.channelId,
+		assistantUserName: botConfig.userName,
+		modelId: defaultModelId(botConfig)
+	};
+}
+async function postResumeFailureReply(args) {
+	await postSlackMessage({
+		channelId: args.channelId,
+		threadTs: args.threadTs,
+		text: buildTurnErrorResponse(args.error, args.eventId)
+	});
+}
+async function handleResumeFailure(args) {
+	const turnLifecycle = getTurnLifecycle();
+	const capturedEventId = logException(args.error, args.eventName);
+	const eventId = requireTurnFailureEventId(capturedEventId, args.eventName);
+	let failureStatePersistError;
+	try {
+		await args.resume.onFailure?.(args.error);
+	} catch (persistError) {
+		const persistEventId = logException(persistError, "slack.resume.failure_state_persist.failed", { "app.error.original_event_id": eventId });
+		try {
+			await turnLifecycle.fail({
+				conversationId: args.resume.conversationId,
+				turnId: args.resume.turnId,
+				createdAtMs: Date.now(),
+				failureCode: "persistence_failed",
+				...persistEventId ? { eventId: persistEventId } : void 0
+			});
+		} catch (lifecycleError) {
+			logException(lifecycleError, "slack.resume.failure_lifecycle_persist.failed", { "app.error.original_event_id": eventId });
+		}
+		failureStatePersistError = persistError;
+	}
+	try {
+		await postResumeFailureReply({
+			channelId: args.resume.channelId,
+			threadTs: args.resume.threadTs,
+			eventId,
+			error: args.error
+		});
+	} catch (deliveryError) {
+		const deliveryEventId = logException(deliveryError, "slack.resume.failure_delivery.failed", { "app.error.original_event_id": eventId });
+		try {
+			await turnLifecycle.fail({
+				conversationId: args.resume.conversationId,
+				turnId: args.resume.turnId,
+				createdAtMs: Date.now(),
+				failureCode: "delivery_failed",
+				...deliveryEventId ? { eventId: deliveryEventId } : void 0
+			});
+		} catch (lifecycleError) {
+			logException(lifecycleError, "slack.resume.failure_lifecycle_persist.failed", { "app.error.original_event_id": eventId });
+		}
+		throw deliveryError;
+	}
+	if (failureStatePersistError) throw failureStatePersistError;
+	await turnLifecycle.fail({
+		conversationId: args.resume.conversationId,
+		turnId: args.resume.turnId,
+		createdAtMs: Date.now(),
+		failureCode: args.failureCode,
+		eventId
+	});
+}
+function buildResumedRun(args, statusSession, delivery) {
+	const savedRun = args.run;
+	if (!savedRun) throw new TypeError("Slack resume requires a saved Run");
+	if (!savedRun.source) throw new TypeError("Slack resume requires a Run Source");
+	const source = savedRun.source;
+	if (savedRun.destination.platform !== "slack") throw new TypeError("Slack resume requires a Slack Destination");
+	const requestDeadline = getTurnRequestDeadline();
+	const threadId = args.lockKey ?? getDefaultLockKey(args.channelId, args.threadTs);
+	const persistedLocationConfiguration = savedRun.environment?.locationConfiguration ?? (savedRun.environment?.configuration ? createReadOnlyConfigService(savedRun.environment.configuration) : void 0);
+	const priorOnEvent = savedRun.onEvent;
+	return {
+		...savedRun,
+		conversationId: args.conversationId,
+		turnId: args.turnId,
+		instruction: {
+			...savedRun.instruction ?? { text: args.messageText },
+			text: args.messageText
+		},
+		source: source.kind === "slack" ? {
+			...source,
+			channelId: args.channelId,
+			...args.threadTs ? { threadTs: args.threadTs } : void 0
+		} : source,
+		deadlineAtMs: savedRun.deadlineAtMs ?? requestDeadline?.deadlineAtMs,
+		environment: {
+			...savedRun.environment,
+			locationConfiguration: persistedLocationConfiguration
+		},
+		onEvent: async (event) => {
+			if (event.type === "status") statusSession.update({ text: event.text });
+			await priorOnEvent?.(event);
+		},
+		...savedRun.dispatch?.outcomes?.length === 0 ? void 0 : { delivery },
+		durability: {
+			...savedRun.durability,
+			onSandboxRefChanged: async (sandboxRef) => {
+				await persistThreadStateById(threadId, { sandboxRef });
+				await savedRun.durability?.onSandboxRefChanged?.(sandboxRef);
+			}
+		}
+	};
+}
+/**
+* Resume a paused Slack Turn.
+*
+* Queue continuations pass `ownsConversationLease` and skip the second lock
+* because the worker lease is already held. Authorization callbacks and other
+* independent resumes still take the thread lock. A started resume owns its
+* completion work.
+* Returns false only when `beforeStart` proves the resume is stale before
+* generation begins.
+*/
+async function resumeSlackTurn(args) {
+	const lockKey = args.lockKey ?? getDefaultLockKey(args.channelId, args.threadTs);
+	return withLogContext(getResumeLogContext(args, lockKey), () => resumeSlackTurnInContext(args));
+}
+async function resumeSlackTurnInContext(args) {
+	const stateAdapter = getStateAdapter();
+	await stateAdapter.connect();
+	const lockKey = args.lockKey ?? getDefaultLockKey(args.channelId, args.threadTs);
+	const lock = args.ownsConversationLease ? void 0 : await acquireActiveLock(stateAdapter, lockKey);
+	if (!args.ownsConversationLease && !lock) throw new ResumeTurnBusyError(lockKey);
+	const status = createSlackWebApiAssistantStatusSession({
+		channelId: args.channelId,
+		threadTs: args.threadTs
+	});
+	let processingReaction;
+	let deferredAuthInfo;
+	let deferredPauseHandler;
+	let deferredFailureHandler;
+	let runResultHandled = false;
+	let assistantMessageDelivered = false;
+	let shouldScheduleCompletedPluginTasks = false;
+	let postDeliveryCommitError;
+	const turnLifecycle = getTurnLifecycle();
+	let failureCode = "agent_run_failed";
+	let runArgs = args;
+	try {
+		const preparedArgs = await args.beforeStart?.();
+		if (preparedArgs === false) return false;
+		if (preparedArgs) runArgs = {
+			...args,
+			...preparedArgs
+		};
+		setTags(getResumeLogContext(runArgs, lockKey));
+		const savedRun = runArgs.run;
+		if (!savedRun) throw new Error("Resumed Turn requires a saved Run");
+		const credentialContext = savedRun.credentialContext;
+		if (!credentialContext) throw new Error("Resumed Run requires a credential context");
+		const routingActor = savedRun.actor;
+		let resumeActor;
+		if ("type" in credentialContext.actor) {
+			if (!isUserActor(routingActor) || credentialContext.actor.userId !== routingActor.userId) throw new Error("Resumed Run credential actor must match its Actor");
+			resumeActor = routingActor;
+		} else {
+			if (routingActor && (routingActor.platform !== "system" || routingActor.name !== credentialContext.actor.name)) throw new Error("Resumed Run system credential actor must match its Actor");
+			resumeActor = credentialContext.actor;
+		}
+		if (runArgs.messageTs) processingReaction = await startProcessingReactionForMessage({
+			channelId: runArgs.channelId,
+			timestamp: runArgs.messageTs
+		});
+		if (runArgs.initialText) await postSlackMessageBestEffort(runArgs.channelId, runArgs.threadTs, runArgs.initialText);
+		status.update(runArgs.initialStatus);
+		const conversationId = runArgs.conversationId;
+		const visibility = (await getConversationStore().get({ conversationId }))?.visibility;
+		const visibleConversationId = lockKey;
+		const sessionId = runArgs.turnId;
+		let deliveryConversation;
+		let acceptedDeliveryId;
+		/** Load the resumed conversation once for ordered delivery recording. */
+		const getDeliveryConversation = async () => {
+			if (deliveryConversation) {
+				const userMessageId = getTurnUserMessage(deliveryConversation, sessionId)?.id;
+				return {
+					conversation: deliveryConversation,
+					sessionId,
+					...userMessageId ? { userMessageId } : void 0
+				};
+			}
+			const persistedState = await getPersistedThreadState(visibleConversationId);
+			const conversation = coerceThreadConversationState(persistedState);
+			await hydrateConversationMessages({
+				conversation,
+				conversationId
+			});
+			deliveryConversation = conversation;
+			const userMessageId = getTurnUserMessage(conversation, sessionId)?.id;
+			return {
+				conversation,
+				sessionId,
+				...userMessageId ? { userMessageId } : void 0
+			};
+		};
+		/** Post and record one completed assistant message for the resumed turn. */
+		const deliverAssistantMessage = async (reply) => {
+			const message = typeof reply === "string" ? void 0 : reply;
+			const text = typeof reply === "string" ? reply : getAssistantReplyText(reply);
+			if (!text?.trim()) return;
+			failureCode = "delivery_failed";
+			const deliveryState = await getDeliveryConversation();
+			let slackMessageTs = [];
+			try {
+				const outcomes = runArgs.run?.dispatch?.outcomes;
+				if (outcomes) for (const outcome of outcomes) slackMessageTs.push(...await sendSlackReply({
+					channelId: outcome.destination.channelId,
+					conversationId: runArgs.conversationId,
+					replyAttribution: runArgs.run?.dispatch?.replyAttribution,
+					text
+				}));
+				else slackMessageTs = await sendSlackReply({
+					channelId: runArgs.channelId,
+					conversationId: runArgs.conversationId,
+					replyAttribution: runArgs.run?.dispatch?.replyAttribution,
+					text,
+					threadTs: runArgs.threadTs
+				});
+			} catch (error) {
+				if (isRetryableSlackPostError(error)) throw new RetryableDeliveryError(error);
+				throw error;
+			}
+			const messageTs = slackMessageTs.at(-1);
+			assistantMessageDelivered = true;
+			acceptedDeliveryId = messageTs;
+			const recordedMessageId = recordDeliveredAssistantMessage({
+				conversation: deliveryState.conversation,
+				sessionId: deliveryState.sessionId,
+				source: "slack",
+				text,
+				userMessageId: deliveryState.userMessageId
+			});
+			if (messageTs) markConversationMessage(deliveryState.conversation, recordedMessageId, { slackTs: messageTs });
+			try {
+				const destination = runArgs.run?.destination;
+				const providerConversationIds = runArgs.threadTs ? [runArgs.threadTs] : slackMessageTs;
+				await persistWithRetry(() => commitAcceptedReply({
+					...message ? { agentMessage: message } : void 0,
+					conversation: deliveryState.conversation,
+					conversationMessageId: recordedMessageId,
+					conversationId,
+					...runArgs.run?.dispatch && destination?.platform === "slack" && providerConversationIds.length > 0 ? { providerConversationBindings: providerConversationIds.map((providerConversationId) => ({
+						provider: "slack",
+						providerDestinationId: destination.channelId,
+						providerTenantId: destination.teamId,
+						providerConversationId
+					})) } : void 0
+				}));
+			} catch (error) {
+				logException(/* @__PURE__ */ new Error("Accepted assistant message persistence failed"), "slack.resume.assistant_message_post_delivery_persist.failed", { "error.type": error instanceof Error ? error.name : typeof error });
+			}
+			const dispatchId = savedRun.dispatch?.id;
+			if (messageTs && dispatchId) try {
+				await persistWithRetry(() => recordTurnSummary({
+					conversationId: runArgs.conversationId,
+					destination: savedRun.destination,
+					destinationVisibility: visibility,
+					dispatchId,
+					resultMessageId: messageTs,
+					turnId: runArgs.turnId,
+					sliceId: runArgs.sliceId ?? 1,
+					source: savedRun.source,
+					state: "running",
+					surface: savedRun.surface ?? "slack"
+				}));
+			} catch (error) {
+				logException(error, "agent.turn.delivery_receipt_persist.failed");
+			}
+			failureCode = "agent_run_failed";
+		};
+		const deliveryState = await getDeliveryConversation();
+		assistantMessageDelivered = turnHasReply(deliveryState.conversation, sessionId);
+		const run = buildResumedRun(runArgs, status, deliverAssistantMessage);
+		if (runArgs.inputMessageIds?.length) await turnLifecycle.start({
+			conversationId: runArgs.conversationId,
+			turnId: runArgs.turnId,
+			createdAtMs: Date.now(),
+			inputMessageIds: [...new Set(runArgs.inputMessageIds)],
+			surface: "slack"
+		});
+		const replyTimeoutMs = resolveReplyTimeoutMs();
+		const outcome = await runArgs.executeTurn(run, async (result) => {
+			const finalized = finalizeFailedTurnReplyWithEvent({
+				reply: result,
+				logException
+			});
+			const reply = finalized.reply;
+			const dispatchErrorMessage = run.dispatch && reply.diagnostics.outcome !== "success" ? reply.diagnostics.errorMessage ?? `Agent turn ended with ${reply.diagnostics.outcome}.` : void 0;
+			if (reply.diagnostics.outcome !== "success") await deliverAssistantMessage(reply.text);
+			runResultHandled = true;
+			await status.clear();
+			failureCode = "persistence_failed";
+			if (reply.piMessages?.length) await saveTurnCheckpoint({
+				mode: "completed",
+				conversationId: runArgs.conversationId,
+				turnId: runArgs.turnId,
+				messages: reply.piMessages,
+				durationMs: reply.diagnostics.durationMs,
+				usage: reply.diagnostics.usage,
+				destination: run.destination,
+				destinationVisibility: visibility,
+				dispatchId: run.dispatch?.id,
+				dispatchOutcome: reply.diagnostics.outcome === "success" ? "completed" : "failed",
+				...dispatchErrorMessage ? { errorMessage: dispatchErrorMessage } : void 0,
+				...acceptedDeliveryId ? { resultMessageId: acceptedDeliveryId } : void 0,
+				source: run.source,
+				actor: resumeActor,
+				surface: run.surface ?? "slack",
+				sliceId: runArgs.sliceId
+			});
+			else if (run.dispatch?.id) await recordTurnSummary({
+				conversationId: runArgs.conversationId,
+				destination: run.destination,
+				destinationVisibility: visibility,
+				dispatchId: run.dispatch?.id,
+				dispatchOutcome: reply.diagnostics.outcome === "success" ? "completed" : "failed",
+				...acceptedDeliveryId ? { resultMessageId: acceptedDeliveryId } : void 0,
+				turnId: runArgs.turnId,
+				sliceId: runArgs.sliceId ?? 1,
+				source: run.source,
+				state: reply.diagnostics.outcome === "success" ? "completed" : "failed",
+				surface: run.surface ?? "slack"
+			});
+			await runArgs.commitResult?.(reply);
+			if (reply.diagnostics.outcome === "success") {
+				shouldScheduleCompletedPluginTasks = true;
+				return { outcome: assistantMessageDelivered ? "success" : "no_reply" };
+			}
+			return {
+				outcome: "failed",
+				failureCode: "model_execution_failed",
+				...finalized.eventId ? { eventId: finalized.eventId } : void 0,
+				...finalized.failureReason ? { failureReason: finalized.failureReason } : void 0
+			};
+		}, replyTimeoutMs);
+		if (outcome.status !== "completed") {
+			await status.clear();
+			const onAuthPause = runArgs.onAuthPause;
+			const onSuspend = runArgs.onSuspend;
+			if (outcome.status === "awaiting_auth" && onAuthPause) {
+				deferredAuthInfo = {
+					providerDisplayName: outcome.providerDisplayName,
+					actorId: isUserActor(resumeActor) ? resumeActor.userId : void 0,
+					...outcome.requestText ? { requestText: outcome.requestText } : void 0
+				};
+				deferredPauseHandler = async () => {
+					await onAuthPause({ providerDisplayName: outcome.providerDisplayName });
+				};
+			} else if (outcome.status === "suspended") {
+				if (runArgs.ownsConversationLease && (outcome.reason === "timeout" || savedRun.durability?.shouldYield?.())) throw new CooperativeTurnYieldError();
+				if (onSuspend) deferredPauseHandler = async () => {
+					await onSuspend(outcome.resumeVersion);
+				};
+				else deferredFailureHandler = async () => {
+					await handleResumeFailure({
+						error: /* @__PURE__ */ new Error("Resumed Run ended suspended without onSuspend"),
+						eventName: "slack.resume.turn.failed",
+						failureCode: "agent_run_failed",
+						resume: runArgs
+					});
+				};
+			} else deferredFailureHandler = async () => {
+				await handleResumeFailure({
+					error: /* @__PURE__ */ new Error(`Resumed Run ended ${outcome.status} without its required callback`),
+					eventName: "slack.resume.turn.failed",
+					failureCode: "agent_run_failed",
+					resume: runArgs
+				});
+			};
+		}
+		if (shouldScheduleCompletedPluginTasks) try {
+			const params = {
+				conversationId: runArgs.conversationId,
+				sessionId: runArgs.turnId
+			};
+			await (runArgs.scheduleSessionCompletedPluginTasks ?? scheduleSessionCompletedPluginTasks)(params);
+		} catch (scheduleError) {
+			logException(scheduleError, "plugin.session.completed_task_schedule.failed");
+		}
+	} catch (error) {
+		await status.clear();
+		const runError = error instanceof AgentRunError ? error.cause : error;
+		if (isCooperativeTurnYieldError(runError)) {
+			if (lock) await stateAdapter.releaseLock(lock);
+			await processingReaction?.stop();
+			throw runError;
+		}
+		if (runResultHandled) {
+			postDeliveryCommitError = error;
+			try {
+				await runArgs.onPostDeliveryCommitFailure?.(error);
+			} catch (terminalizeError) {
+				logException(terminalizeError, "slack.resume.post_delivery_terminalize.failed");
+			}
+		} else deferredFailureHandler = async () => {
+			await handleResumeFailure({
+				error: runError,
+				eventName: "slack.resume.turn.failed",
+				failureCode,
+				resume: runArgs
+			});
+		};
+	} finally {
+		if (runResultHandled) await processingReaction?.complete();
+		else await processingReaction?.stop();
+		if (lock) await stateAdapter.releaseLock(lock);
+	}
+	if (postDeliveryCommitError) {
+		const eventId = logException(postDeliveryCommitError, "slack.resume.success_handler.failed");
+		await turnLifecycle.fail({
+			conversationId: runArgs.conversationId,
+			turnId: runArgs.turnId,
+			createdAtMs: Date.now(),
+			failureCode: "persistence_failed",
+			...eventId ? { eventId } : void 0
+		});
+		throw postDeliveryCommitError;
+	}
+	if (deferredPauseHandler) try {
+		await deferredPauseHandler();
+		if (deferredAuthInfo) await postSlackMessageBestEffort(runArgs.channelId, runArgs.threadTs, buildAuthPauseResponse(deferredAuthInfo.actorId, deferredAuthInfo.providerDisplayName, deferredAuthInfo.requestText), runArgs.conversationId, runArgs.run?.dispatch?.replyAttribution);
+		return true;
+	} catch (pauseError) {
+		await handleResumeFailure({
+			error: pauseError,
+			eventName: "slack.resume.pause_handler.failed",
+			failureCode: "persistence_failed",
+			resume: runArgs
+		});
+		return true;
+	}
+	if (deferredFailureHandler) await deferredFailureHandler();
+	return true;
+}
+//#endregion
+//#region src/chat/task-execution/turn-wake.ts
+/** Build the worker input for a paused turn. */
+async function getPausedTurnRequest(args) {
+	const turn = (await loadTurnCheckpoint({
+		conversationId: args.conversationId,
+		turnId: args.turnId
+	})).record;
+	if (!turn || turn.state !== "paused" || turn.resumeReason !== "timeout" && turn.resumeReason !== "yield" && turn.resumeReason !== "retry" || turn.resumeReason === "timeout" && turn.sliceId < 2) return;
+	let routing;
+	try {
+		routing = await resolveTurnSessionRouting({
+			conversationId: args.conversationId,
+			conversationStore: args.conversationStore
+		});
+	} catch (error) {
+		await failTurnRecord({
+			conversationId: args.conversationId,
+			expectedVersion: turn.version,
+			turnId: args.turnId,
+			errorMessage: error instanceof Error ? error.message : String(error)
+		});
+		return;
+	}
+	return {
+		conversationId: args.conversationId,
+		destination: routing.destination,
+		turnId: args.turnId,
+		expectedVersion: turn.version
+	};
+}
+/** Wake the conversation worker for a paused turn. */
+async function wakePausedTurn(request, options = {}) {
+	const nowMs = options.nowMs ?? Date.now();
+	await requestConversationWork({
+		conversationId: request.conversationId,
+		destination: request.destination,
+		nowMs,
+		state: options.state
+	});
+	const queue = options.queue ?? getVercelConversationWorkQueue();
+	await ensureConversationWake({
+		conversationId: request.conversationId,
+		idempotencyKey: [
+			"agent-continue",
+			request.conversationId,
+			request.turnId,
+			request.expectedVersion,
+			nowMs
+		].join(":"),
+		nowMs,
+		queue,
+		state: options.state
+	});
+}
+/** Create paused Turn operations for one app. */
+function createPausedTurns(options = {}) {
+	return {
+		get: (args) => getPausedTurnRequest({
+			...args,
+			conversationStore: options.conversationStore
+		}),
+		wake: (request) => wakePausedTurn(request, options)
+	};
+}
+//#endregion
+//#region src/handlers/oauth-html.ts
+/** Build pre-escaped callback HTML with the shared response security policy. */
+function htmlCallbackResponse(title, message, status, options = {}) {
+	const footerMessage = options.footerMessage ?? `You can close this tab and return to ${botConfig.userName}.`;
+	const isSuccess = status >= 200 && status < 300;
+	const statusClass = isSuccess ? "success" : "error";
+	const statusIcon = isSuccess ? "" : "!";
+	const html = `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="color-scheme" content="light dark">
+  <title>${title}</title>
+  <style>
+    :root {
+      color-scheme: light dark;
+      --canvas: #f4f1fa;
+      --surface: #ffffff;
+      --text: #211a2c;
+      --muted: #6e6479;
+      --border: #ded7e8;
+      --accent: #6c5fc7;
+      --success: #16835c;
+      --success-soft: #ddf5ea;
+      --error: #bc3d50;
+      --error-soft: #fce7eb;
+      --shadow: 0 24px 64px rgba(45, 31, 63, 0.14);
+    }
+
+    * { box-sizing: border-box; }
+
+    body {
+      min-height: 100vh;
+      margin: 0;
+      display: grid;
+      place-items: center;
+      padding: 24px;
+      background: var(--canvas);
+      color: var(--text);
+      font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+    }
+
+    main {
+      width: min(100%, 480px);
+      padding: 48px 40px 40px;
+      text-align: center;
+      background: var(--surface);
+      border: 1px solid var(--border);
+      border-radius: 24px;
+      box-shadow: var(--shadow);
+    }
+
+    .brand {
+      display: inline-flex;
+      align-items: center;
+      gap: 8px;
+      margin-bottom: 32px;
+      color: var(--muted);
+      font-size: 14px;
+      font-weight: 700;
+      letter-spacing: 0.08em;
+      text-transform: uppercase;
+    }
+
+    .brand-mark {
+      width: 10px;
+      height: 10px;
+      background: var(--accent);
+      border-radius: 3px;
+      transform: rotate(12deg);
+    }
+
+    .status {
+      width: 64px;
+      height: 64px;
+      margin: 0 auto 24px;
+      display: grid;
+      place-items: center;
+      border-radius: 20px;
+      font-size: 32px;
+      font-weight: 750;
+      line-height: 1;
+    }
+
+    .status.success { color: var(--success); background: var(--success-soft); }
+    .status.success::before {
+      content: "";
+      width: 12px;
+      height: 24px;
+      margin-top: -5px;
+      border-right: 4px solid currentColor;
+      border-bottom: 4px solid currentColor;
+      transform: rotate(45deg);
+    }
+    .status.error { color: var(--error); background: var(--error-soft); }
+
+    h1 {
+      margin: 0;
+      font-size: clamp(28px, 7vw, 36px);
+      line-height: 1.12;
+      letter-spacing: -0.035em;
+    }
+
+    .message {
+      margin: 16px auto 0;
+      color: var(--muted);
+      font-size: 17px;
+      line-height: 1.6;
+    }
+
+    .footer {
+      margin: 32px 0 0;
+      padding-top: 24px;
+      color: var(--muted);
+      border-top: 1px solid var(--border);
+      font-size: 14px;
+      line-height: 1.5;
+    }
+
+    @media (prefers-color-scheme: dark) {
+      :root {
+        --canvas: #15121a;
+        --surface: #211c28;
+        --text: #f6f1fb;
+        --muted: #b8adbf;
+        --border: #3a3243;
+        --accent: #a99af0;
+        --success: #72d6ad;
+        --success-soft: #193c30;
+        --error: #ff9aaa;
+        --error-soft: #48262e;
+        --shadow: 0 24px 64px rgba(0, 0, 0, 0.36);
+      }
+    }
+
+    @media (max-width: 520px) {
+      body { padding: 16px; }
+      main { padding: 40px 24px 32px; border-radius: 20px; }
+    }
+  </style>
+</head>
+<body>
+  <main>
+    <div class="brand"><span class="brand-mark" aria-hidden="true"></span>${botConfig.userName}</div>
+    <div class="status ${statusClass}" aria-hidden="true">${statusIcon}</div>
+    <h1>${title}</h1>
+    <p class="message">${message}</p>
+    <p class="footer">${footerMessage}</p>
+  </main>
+</body>
+</html>`;
+	return new Response(html, {
+		status,
+		headers: {
+			"Cache-Control": "no-store",
+			"Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'",
+			"Content-Type": "text/html; charset=utf-8",
+			"Referrer-Policy": "no-referrer",
+			"X-Content-Type-Options": "nosniff"
+		}
+	});
+}
+//#endregion
+//#region src/handlers/mcp-oauth-callback.ts
+/**
+* MCP OAuth callback handler.
+*
+* Public signed callbacks relay to the owning CLI. The loopback callback
+* finalizes local MCP authorization and leaves continuation to that CLI.
+* Slack callbacks finalize authorization, update pending-auth/event-log state,
+* and resume the exact parked turn. Stale callbacks must not resume newer
+* thread work after another user message supersedes the paused request.
+*/
+function callbackPages(botName) {
+	return {
+		missing_state: {
+			title: "Authorization failed",
+			message: "Missing state parameter.",
+			status: 400
+		},
+		provider_error: {
+			title: "Authorization failed",
+			message: "The provider returned an authorization error.",
+			status: 400
+		},
+		missing_code: {
+			title: "Authorization failed",
+			message: "Missing code parameter.",
+			status: 400
+		},
+		expired: {
+			title: "Authorization expired",
+			message: `This authorization link is no longer active. Return to ${botName} and retry the original request.`,
+			status: 400
+		},
+		success: {
+			title: "Authorization complete",
+			message: `Your MCP access is connected. ${botName} will continue the paused request.`,
+			status: 200
+		},
+		failure: {
+			title: "Authorization failed",
+			message: `${botName} could not finish the authorization callback. Return to ${botName} and retry the original request.`,
+			status: 500
+		}
+	};
+}
+var McpOAuthAttemptExpiredError = class extends Error {
+	constructor() {
+		super("MCP OAuth authorization attempt is no longer current");
+		this.name = "McpOAuthAttemptExpiredError";
+	}
+};
+function mcpAuthorizationId(args) {
+	return `${args.sessionId}:mcp:${args.provider}`;
+}
+function htmlResponse(kind, options) {
+	const botName = botConfig.userName;
+	const pages = callbackPages(botName);
+	const page = kind === "success" && options?.local ? {
+		...pages.success,
+		message: `Your MCP access is connected. ${botName} will continue the paused request in the local client.`
+	} : pages[kind];
+	const footerMessage = kind === "success" && !options?.local ? `You can close this tab and return to ${botName}.` : void 0;
+	return htmlCallbackResponse(page.title, page.message, page.status, { footerMessage });
+}
+async function persistCompletedReplyState(channelId, threadTs, sessionId, reply) {
+	const threadId = `slack:${channelId}:${threadTs}`;
+	const currentState = await getPersistedThreadState(threadId);
+	const conversation = coerceThreadConversationState(currentState);
+	await hydrateConversationMessages({
+		conversation,
+		conversationId: threadId
+	});
+	const userMessage = getTurnUserMessage(conversation, sessionId);
+	const statePatch = buildDeliveredTurnStatePatch({
+		conversation,
+		reply,
+		sessionId,
+		userMessageId: userMessage?.id
+	});
+	await persistThreadStateById(threadId, { ...statePatch });
+}
+async function failSessionRecordBestEffort$1(args) {
+	try {
+		await failTurnRecord({
+			conversationId: args.conversationId,
+			turnId: args.turnId,
+			errorMessage: args.errorMessage,
+			expectedVersion: args.expectedVersion
+		});
+	} catch (error) {
+		logException(error, "mcp.oauth_callback.session_record.failure_persistence.failed", {
+			"app.ai.conversation_id": args.conversationId,
+			"app.ai.session_id": args.turnId
+		});
+	}
+}
+async function persistFailedReplyState(channelId, threadTs, sessionId, expectedVersion) {
+	const threadId = `slack:${channelId}:${threadTs}`;
+	const currentState = await getPersistedThreadState(threadId);
+	const conversation = coerceThreadConversationState(currentState);
+	await hydrateConversationMessages({
+		conversation,
+		conversationId: threadId
+	});
+	clearPendingAuth(conversation, sessionId);
+	markTurnFailed({
+		conversation,
+		nowMs: Date.now(),
+		sessionId,
+		userMessageId: getTurnUserMessageId(conversation, sessionId),
+		markConversationMessage
+	});
+	await failSessionRecordBestEffort$1({
+		conversationId: threadId,
+		turnId: sessionId,
+		errorMessage: "OAuth-resumed MCP turn failed",
+		expectedVersion
+	});
+	await persistThreadStateById(threadId, { conversation });
+}
+async function resumeAuthorizedMcpTurn(args) {
+	const { authSession, agentRunner, provider } = args;
+	if (!authSession.channelId || !authSession.destination || !authSession.threadTs) return;
+	const destination = requireSlackDestination(authSession.destination, "MCP OAuth resume");
+	const threadId = `slack:${authSession.channelId}:${authSession.threadTs}`;
+	const currentState = await getPersistedThreadState(threadId);
+	const conversation = coerceThreadConversationState(currentState);
+	await hydrateConversationMessages({
+		conversation,
+		conversationId: threadId
+	});
+	const pendingAuth = getConversationPendingAuth({
+		conversation,
+		kind: "mcp",
+		provider,
+		actorId: authSession.userId
+	});
+	if (pendingAuth?.authSessionId !== authSession.authSessionId) return;
+	const resolvedSessionId = pendingAuth.sessionId;
+	const userMessage = getTurnUserMessage(conversation, resolvedSessionId);
+	if (!isPendingAuthLatestRequest(conversation, pendingAuth)) {
+		clearPendingAuth(conversation, pendingAuth.sessionId);
+		await persistThreadStateById(threadId, { conversation });
+		await abandonTurnRecord({
+			conversationId: authSession.conversationId,
+			turnId: pendingAuth.sessionId,
+			errorMessage: "Auth completed after a newer thread message abandoned this blocked request."
+		});
+		return;
+	}
+	if (!userMessage) return;
+	await resumeSlackTurn({
+		messageText: userMessage.text,
+		conversationId: authSession.conversationId,
+		turnId: resolvedSessionId,
+		channelId: authSession.channelId,
+		threadTs: authSession.threadTs,
+		messageTs: getTurnUserSlackMessageTs(userMessage),
+		lockKey: threadId,
+		initialText: "",
+		executeTurn: async (run, saveResult, timeoutMs) => await executeTurn(agentRunner, run, saveResult, timeoutMs),
+		beforeStart: async () => {
+			const lockedState = await getPersistedThreadState(threadId);
+			const lockedConversation = coerceThreadConversationState(lockedState);
+			await hydrateConversationMessages({
+				conversation: lockedConversation,
+				conversationId: threadId
+			});
+			const lockedPendingAuth = getConversationPendingAuth({
+				conversation: lockedConversation,
+				kind: "mcp",
+				provider,
+				actorId: authSession.userId
+			});
+			if (lockedPendingAuth?.authSessionId !== authSession.authSessionId) return false;
+			const lockedSessionId = lockedPendingAuth.sessionId;
+			if (lockedSessionId !== resolvedSessionId) return false;
+			if (!isPendingAuthLatestRequest(lockedConversation, lockedPendingAuth)) {
+				clearPendingAuth(lockedConversation, lockedPendingAuth.sessionId);
+				await persistThreadStateById(threadId, { conversation: lockedConversation });
+				await abandonTurnRecord({
+					conversationId: authSession.conversationId,
+					turnId: lockedPendingAuth.sessionId,
+					errorMessage: "Auth completed after a newer thread message abandoned this blocked request."
+				});
+				return false;
+			}
+			const lockedUserMessage = getTurnUserMessage(lockedConversation, lockedSessionId);
+			if (!lockedUserMessage) return false;
+			const lockedSessionRecord = await getTurnRecord(authSession.conversationId, lockedSessionId);
+			if (!lockedSessionRecord || lockedSessionRecord.state !== "paused" || lockedSessionRecord.resumeReason !== "auth") return false;
+			const lockedConversationContext = buildConversationContext(lockedConversation, { excludeMessageId: lockedUserMessage.id });
+			const lockedLocationConfiguration = getLocationConfigurationService(destination);
+			let actor;
+			try {
+				actor = createSlackResumeActor({
+					actor: lockedSessionRecord.actor,
+					teamId: destination.teamId,
+					userId: authSession.userId
+				});
+			} catch {
+				await failTurnRecord({
+					conversationId: authSession.conversationId,
+					expectedVersion: lockedSessionRecord.version,
+					turnId: lockedSessionId,
+					errorMessage: "Unable to rebuild Slack actor for OAuth resume"
+				});
+				return false;
+			}
+			let routing;
+			try {
+				routing = await resolveTurnSessionRouting({ conversationId: authSession.conversationId });
+			} catch (error) {
+				await failTurnRecord({
+					conversationId: authSession.conversationId,
+					expectedVersion: lockedSessionRecord.version,
+					turnId: lockedSessionId,
+					errorMessage: error instanceof Error ? error.message : String(error)
+				});
+				return false;
+			}
+			await recordAuthorizationCompleted({
+				conversationId: authSession.conversationId,
+				kind: "mcp",
+				provider,
+				actorId: authSession.userId,
+				authorizationId: mcpAuthorizationId({
+					provider,
+					sessionId: lockedSessionId
+				})
+			});
+			const lockedMessageTs = getTurnUserSlackMessageTs(lockedUserMessage);
+			return {
+				messageText: lockedUserMessage.text,
+				sliceId: lockedSessionRecord.sliceId,
+				messageTs: lockedMessageTs,
+				inputMessageIds: [lockedUserMessage.id],
+				run: {
+					instruction: {
+						text: lockedUserMessage.text,
+						context: lockedConversationContext,
+						...getTurnUserReplyAttachmentContext(lockedUserMessage)
+					},
+					history: await loadProjection({ conversationId: threadId }),
+					credentialContext: { actor: {
+						type: "user",
+						userId: actor.userId
+					} },
+					actor,
+					destination,
+					...routing.location ? { location: routing.location } : void 0,
+					source: routing.source,
+					toolChannelId: authSession.toolChannelId ?? authSession.channelId,
+					environment: {
+						configuration: authSession.configuration,
+						locationConfiguration: lockedLocationConfiguration
+					},
+					state: {
+						pendingAuth: lockedPendingAuth,
+						sandboxRef: getPersistedSandboxState(lockedState)
+					},
+					durability: { recordPendingAuth: async (nextPendingAuth) => {
+						lockedConversation.processing.pendingAuth = nextPendingAuth;
+						await persistThreadStateById(threadId, { conversation: lockedConversation });
+					} }
+				},
+				commitResult: async (reply) => {
+					await persistCompletedReplyState(authSession.channelId, authSession.threadTs, lockedSessionId, reply);
+				},
+				onPostDeliveryCommitFailure: async () => {
+					await failTurnRecord({
+						conversationId: authSession.conversationId,
+						expectedVersion: lockedSessionRecord.version,
+						turnId: lockedSessionId,
+						errorMessage: "OAuth-resumed MCP reply was delivered but completion state did not persist"
+					});
+				},
+				onFailure: async () => {
+					try {
+						await persistFailedReplyState(authSession.channelId, authSession.threadTs, lockedSessionId, lockedSessionRecord.version);
+					} catch (persistError) {
+						logException(persistError, "mcp.oauth_callback.resume_failure_persist.failed", { "app.credential.provider": provider });
+					}
+				},
+				onAuthPause: async () => {
+					await persistAuthPauseTurnState({
+						sessionId: lockedSessionId,
+						threadStateId: threadId
+					});
+					logWarn("mcp.oauth_callback.resume.reparked_for_auth", { "app.credential.provider": provider });
+				},
+				onSuspend: async (resumeVersion) => {
+					await wakePausedTurn({
+						conversationId: authSession.conversationId,
+						destination,
+						turnId: lockedSessionId,
+						expectedVersion: resumeVersion
+					});
+				}
+			};
+		}
+	});
+}
+async function isCurrentMcpAuthorizationAttempt(authSession, provider) {
+	const conversationId = mcpConversationId(authSession);
+	if (!conversationId) return false;
+	const currentState = await getPersistedThreadState(conversationId);
+	const conversation = coerceThreadConversationState(currentState);
+	const pendingAuth = getConversationPendingAuth({
+		conversation,
+		kind: "mcp",
+		provider,
+		actorId: authSession.userId
+	});
+	return pendingAuth?.authSessionId === authSession.authSessionId && pendingAuth.sessionId === authSession.sessionId;
+}
+function mcpConversationId(authSession) {
+	if (authSession.destination?.platform === "local" || authSession.source?.kind === "web") return authSession.conversationId;
+	if (authSession.channelId && authSession.threadTs) return `slack:${authSession.channelId}:${authSession.threadTs}`;
+}
+/** Commit one shared credential mutation only while this attempt owns the thread. */
+async function runCurrentMcpCredentialMutation(authSession, provider, mutation) {
+	const conversationId = mcpConversationId(authSession);
+	if (!conversationId) throw new McpOAuthAttemptExpiredError();
+	const stateAdapter = getStateAdapter();
+	await stateAdapter.connect();
+	const lock = await acquireActiveLock(stateAdapter, conversationId);
+	if (!lock) throw new Error(`Could not acquire MCP OAuth callback lock for ${conversationId}`);
+	try {
+		if (!await isCurrentMcpAuthorizationAttempt(authSession, provider)) throw new McpOAuthAttemptExpiredError();
+		return await mutation();
+	} finally {
+		await stateAdapter.releaseLock(lock);
+	}
+}
+async function GET$1(request, provider, waitUntil, options) {
+	const localRelay = await relayLocalOAuthCallback(request);
+	if (localRelay) return localRelay;
+	const url = new URL(request.url);
+	const state = url.searchParams.get("state")?.trim();
+	const code = url.searchParams.get("code")?.trim();
+	const error = url.searchParams.get("error")?.trim();
+	if (!state) return htmlResponse("missing_state");
+	if (error) {
+		try {
+			const pendingSession = await getMcpAuthSession(state);
+			if (pendingSession && pendingSession.provider === provider) {
+				try {
+					await runCurrentMcpCredentialMutation(pendingSession, provider, async () => {
+						const credentials = await getMcpStoredOAuthCredentials(pendingSession.userId, provider);
+						if (!credentials?.clientInformation && !credentials?.discoveryState) return;
+						const nextCredentials = credentials.tokens ? { tokens: credentials.tokens } : {};
+						await putMcpStoredOAuthCredentials(pendingSession.userId, provider, nextCredentials);
+					});
+				} catch (cleanupError) {
+					if (!(cleanupError instanceof McpOAuthAttemptExpiredError)) logException(cleanupError, "mcp.oauth_callback.provider_error_cleanup.failed", { "app.credential.provider": provider });
+				}
+				await deleteMcpAuthSession(pendingSession.authSessionId);
+			}
+		} catch (cleanupError) {
+			logException(cleanupError, "mcp.oauth_callback.provider_error_cleanup.failed", { "app.credential.provider": provider });
+		}
+		return htmlResponse("provider_error");
+	}
+	if (!code) return htmlResponse("missing_code");
+	try {
+		const pendingSession = await getMcpAuthSession(state);
+		if (!pendingSession || pendingSession.provider !== provider || !await isCurrentMcpAuthorizationAttempt(pendingSession, provider)) {
+			if (pendingSession) await deleteMcpAuthSession(pendingSession.authSessionId);
+			return htmlResponse("expired");
+		}
+		const authSession = await finalizeMcpAuthorization(provider, state, code, async (mutation) => await runCurrentMcpCredentialMutation(pendingSession, provider, mutation));
+		let providerLabel;
+		try {
+			providerLabel = formatProviderLabel(provider);
+		} catch {
+			providerLabel = void 0;
+		}
+		try {
+			await recordAuthenticationLinked({
+				conversationId: authSession.conversationId,
+				provider,
+				actorId: authSession.userId,
+				authorizationId: mcpAuthorizationId({
+					provider,
+					sessionId: authSession.sessionId
+				}),
+				turnId: authSession.sessionId,
+				...providerLabel ? { providerLabel } : void 0
+			});
+		} catch (error) {
+			logException(error, "mcp.oauth_callback.authentication_event.failed", { "app.credential.provider": provider });
+		}
+		try {
+			await deleteMcpAuthSession(authSession.authSessionId);
+		} catch (cleanupError) {
+			logException(cleanupError, "mcp.oauth_callback.session_cleanup.failed", { "app.credential.provider": provider });
+		}
+		if (authSession.source?.kind === "web" && authSession.destination) waitUntil(async () => {
+			const turn = await getTurnRecord(authSession.conversationId, authSession.sessionId);
+			await deleteWebAuthorization({
+				actorId: authSession.userId,
+				conversationId: authSession.conversationId
+			});
+			if (!turn || turn.state !== "paused" || turn.resumeReason !== "auth") return;
+			await recordAuthorizationCompleted({
+				conversationId: authSession.conversationId,
+				kind: "mcp",
+				provider,
+				actorId: authSession.userId,
+				authorizationId: mcpAuthorizationId({
+					provider,
+					sessionId: authSession.sessionId
+				})
+			});
+			await wakePausedTurn({
+				conversationId: authSession.conversationId,
+				destination: authSession.destination,
+				turnId: authSession.sessionId,
+				expectedVersion: turn.version
+			}, options.conversationWorkQueue ? { queue: options.conversationWorkQueue } : void 0);
+		});
+		else if (authSession.destination?.platform !== "local") waitUntil(() => resumeAuthorizedMcpTurn({
+			authSession,
+			agentRunner: options.agentRunner,
+			provider
+		}));
+		return htmlResponse("success", { local: authSession.destination?.platform === "local" && authSession.source?.kind !== "web" });
+	} catch (callbackError) {
+		if (callbackError instanceof McpOAuthAttemptExpiredError) {
+			await deleteMcpAuthSession(state);
+			return htmlResponse("expired");
+		}
+		logException(callbackError, "mcp.oauth_callback.failed", {
+			"app.credential.provider": provider,
+			...getMcpProviderErrorAttributes(callbackError)
+		});
+		return htmlResponse("failure");
+	}
+}
+//#endregion
+//#region src/chat/slack/app-home.ts
+const DEFAULT_DESCRIPTION_TEXT = "I help your team investigate, summarize, and act on work in Slack.";
+const MAX_HOME_SKILLS = 6;
+const MAX_SECTION_TEXT_CHARS = 3e3;
+const HIDDEN_HOME_SKILLS = /* @__PURE__ */ new Set(["jr-rpc"]);
+function clampSectionText(text) {
+	if (text.length <= MAX_SECTION_TEXT_CHARS) return text;
+	return `${text.slice(0, 2999)}…`;
+}
+function loadDescriptionText() {
+	const descriptionPath = path.join(homeDir(), "DESCRIPTION.md");
+	try {
+		const raw = fs.readFileSync(descriptionPath, "utf8").trim();
+		if (raw.length > 0) return clampSectionText(raw);
+	} catch {}
+	return DEFAULT_DESCRIPTION_TEXT;
+}
+async function buildSkillsSummaryText() {
+	const skills = (await discoverSkills()).filter((skill) => !HIDDEN_HOME_SKILLS.has(skill.name));
+	if (skills.length === 0) return "No skills installed.";
+	const visible = skills.slice(0, MAX_HOME_SKILLS);
+	const lines = visible.map((skill) => `• *${skill.name}* — ${skill.description}`);
+	if (skills.length > visible.length) lines.push(`• …and ${skills.length - visible.length} more`);
+	return lines.join("\n");
+}
+function accountLabel(account) {
+	const label = account.label ?? account.id;
+	return account.url ? `<${account.url}|${label}>` : label;
+}
+function connectedAccountText(plugin, account) {
+	return account ? `*${plugin.manifest.name}*\nConnected as ${accountLabel(account)}` : `*${plugin.manifest.name}*\n${plugin.manifest.description}`;
+}
+async function connectedOAuthTokens(userId, plugin, userTokenStore) {
+	if (plugin.manifest.oauth || plugin.manifest.credentials) {
+		const stored = await userTokenStore.get(userId, plugin.manifest.name);
+		return stored && hasRequiredOAuthScope(stored.scope, plugin.manifest.oauth?.scope) ? stored : void 0;
+	}
+}
+async function hasConnectedMcpAccount(userId, plugin) {
+	if (!plugin.manifest.mcp) return false;
+	const credentials = await getMcpStoredOAuthCredentials(userId, plugin.manifest.name);
+	return Boolean(credentials?.tokens || credentials?.clientInformation || credentials?.discoveryState);
+}
+/** Build the Slack App Home tab view showing skills, connected accounts, and version. */
+async function buildHomeView(userId, userTokenStore) {
+	const runtimeMetadata = getRuntimeMetadata();
+	const descriptionText = loadDescriptionText();
+	const skillsSummaryText = await buildSkillsSummaryText();
+	const providers = pluginCatalogRuntime.getProviders();
+	const connectedSections = [];
+	for (const plugin of providers) {
+		const tokens = await connectedOAuthTokens(userId, plugin, userTokenStore);
+		if (!tokens && !await hasConnectedMcpAccount(userId, plugin)) continue;
+		connectedSections.push({
+			type: "section",
+			text: {
+				type: "mrkdwn",
+				text: connectedAccountText(plugin, tokens?.account)
+			},
+			accessory: {
+				type: "button",
+				text: {
+					type: "plain_text",
+					text: "Unlink"
+				},
+				action_id: "app_home_disconnect",
+				value: plugin.manifest.name,
+				style: "danger"
+			}
+		});
+	}
+	const accountBlocks = connectedSections.length > 0 ? connectedSections : [{
+		type: "section",
+		text: {
+			type: "mrkdwn",
+			text: "No connected accounts"
+		}
+	}];
+	return {
+		type: "home",
+		blocks: [
+			{
+				type: "header",
+				text: {
+					type: "plain_text",
+					text: "Junior"
+				}
+			},
+			{
+				type: "section",
+				text: {
+					type: "mrkdwn",
+					text: descriptionText
+				}
+			},
+			{ type: "divider" },
+			{
+				type: "header",
+				text: {
+					type: "plain_text",
+					text: "What I can help with"
+				}
+			},
+			{
+				type: "section",
+				text: {
+					type: "mrkdwn",
+					text: skillsSummaryText
+				}
+			},
+			{ type: "divider" },
+			{
+				type: "header",
+				text: {
+					type: "plain_text",
+					text: "Connected accounts"
+				}
+			},
+			...accountBlocks,
+			{
+				type: "context",
+				elements: [{
+					type: "mrkdwn",
+					text: `*junior version:* \`${runtimeMetadata.version ?? "unknown"}\``
+				}]
+			}
+		]
+	};
+}
+/** Publish the App Home view to a specific Slack user. */
+async function publishAppHomeView(slackClient, userId, userTokenStore) {
+	const view = await buildHomeView(userId, userTokenStore);
+	await slackClient.views.publish({
+		user_id: userId,
+		view
+	});
+}
+//#endregion
+//#region src/handlers/oauth-callback.ts
+/**
+* OAuth callback contract for `@sentry/junior`.
+*
+* Providers redirect users to `/api/oauth/callback/:provider`. A public signed
+* callback relays to the owning CLI; the loopback callback exchanges and stores
+* the local credential while the CLI owns continuation. Slack callbacks
+* exchange credentials synchronously, then use `waitUntil(...)` for
+* best-effort resume side effects.
+*/
+function htmlErrorResponse(title, message, status) {
+	return htmlCallbackResponse(escapeXml(title), escapeXml(message), status);
+}
+function oauthTokenErrorAttributes(provider, endpoint, status) {
+	return {
+		"app.credential.provider": provider,
+		"app.oauth.error.phase": "token_exchange",
+		"server.address": new URL(endpoint).hostname,
+		...status !== void 0 ? { "http.response.status_code": status } : void 0
+	};
+}
+async function persistCompletedOAuthReplyState(args) {
+	const currentState = await getPersistedThreadState(args.conversationId);
+	const conversation = coerceThreadConversationState(currentState);
+	await hydrateConversationMessages({
+		conversation,
+		conversationId: args.conversationId
+	});
+	const userMessage = getTurnUserMessage(conversation, args.sessionId);
+	const statePatch = buildDeliveredTurnStatePatch({
+		conversation,
+		reply: args.reply,
+		sessionId: args.sessionId,
+		userMessageId: userMessage?.id
+	});
+	await persistThreadStateById(args.conversationId, { ...statePatch });
+}
+function pluginAuthorizationId(args) {
+	return `${args.sessionId}:plugin:${args.provider}`;
+}
+async function failSessionRecordBestEffort(args) {
+	try {
+		await failTurnRecord({
+			conversationId: args.conversationId,
+			expectedVersion: args.expectedVersion,
+			turnId: args.turnId,
+			errorMessage: args.errorMessage
+		});
+	} catch (error) {
+		logException(error, "oauth.callback.session_record.failure_persistence.failed", {
+			"app.ai.conversation_id": args.conversationId,
+			"app.ai.session_id": args.turnId
+		});
+	}
+}
+async function persistFailedOAuthReplyState(args) {
+	const currentState = await getPersistedThreadState(args.conversationId);
+	const conversation = coerceThreadConversationState(currentState);
+	await hydrateConversationMessages({
+		conversation,
+		conversationId: args.conversationId
+	});
+	clearPendingAuth(conversation, args.sessionId);
+	markTurnFailed({
+		conversation,
+		nowMs: Date.now(),
+		sessionId: args.sessionId,
+		userMessageId: getTurnUserMessage(conversation, args.sessionId)?.id,
+		markConversationMessage
+	});
+	await failSessionRecordBestEffort({
+		conversationId: args.conversationId,
+		expectedVersion: args.expectedVersion,
+		turnId: args.sessionId,
+		errorMessage: "OAuth-resumed turn failed"
+	});
+	await persistThreadStateById(args.conversationId, { conversation });
+}
+async function resumeOAuthSessionRecordTurn(stored, options) {
+	if (!stored.resumeConversationId || !stored.resumeSessionId || !stored.channelId || !stored.destination || !stored.source || !stored.threadTs) return;
+	const destination = requireSlackDestination(stored.destination, "OAuth resume");
+	const currentState = await getPersistedThreadState(stored.resumeConversationId);
+	const conversation = coerceThreadConversationState(currentState);
+	await hydrateConversationMessages({
+		conversation,
+		conversationId: stored.resumeConversationId
+	});
+	const pendingAuth = getConversationPendingAuth({
+		conversation,
+		kind: "plugin",
+		provider: stored.provider,
+		actorId: stored.userId,
+		...stored.scope ? { scope: stored.scope } : void 0
+	});
+	const resolvedSessionId = pendingAuth?.sessionId ?? stored.resumeSessionId;
+	const userMessage = resolvedSessionId ? getTurnUserMessage(conversation, resolvedSessionId) : void 0;
+	if (pendingAuth) {
+		if (!isPendingAuthLatestRequest(conversation, pendingAuth)) {
+			clearPendingAuth(conversation, pendingAuth.sessionId);
+			await persistThreadStateById(stored.resumeConversationId, { conversation });
+			await abandonTurnRecord({
+				conversationId: stored.resumeConversationId,
+				turnId: pendingAuth.sessionId,
+				errorMessage: "Auth completed after a newer thread message abandoned this blocked request."
+			});
+			return;
+		}
+	}
+	const sessionRecord = await getTurnRecord(stored.resumeConversationId, resolvedSessionId);
+	if (!sessionRecord) return;
+	if (sessionRecord.state === "completed" || sessionRecord.state === "failed" || sessionRecord.state === "abandoned") return;
+	if (sessionRecord.state !== "paused" || sessionRecord.resumeReason !== "auth") return;
+	if (!userMessage?.author?.userId) return;
+	if (!pendingAuth && conversation.processing.activeTurnId !== stored.resumeSessionId) return;
+	await resumeSlackTurn({
+		messageText: userMessage.text,
+		conversationId: stored.resumeConversationId,
+		turnId: resolvedSessionId,
+		channelId: stored.channelId,
+		threadTs: stored.threadTs,
+		messageTs: getTurnUserSlackMessageTs(userMessage),
+		lockKey: stored.resumeConversationId,
+		initialText: "",
+		executeTurn: async (run, saveResult, timeoutMs) => await executeTurn(options.agentRunner, run, saveResult, timeoutMs),
+		beforeStart: async () => {
+			const lockedState = await getPersistedThreadState(stored.resumeConversationId);
+			const lockedConversation = coerceThreadConversationState(lockedState);
+			await hydrateConversationMessages({
+				conversation: lockedConversation,
+				conversationId: stored.resumeConversationId
+			});
+			const lockedPendingAuth = getConversationPendingAuth({
+				conversation: lockedConversation,
+				kind: "plugin",
+				provider: stored.provider,
+				actorId: stored.userId,
+				...stored.scope ? { scope: stored.scope } : void 0
+			});
+			const lockedSessionId = lockedPendingAuth?.sessionId ?? stored.resumeSessionId;
+			if (lockedSessionId !== resolvedSessionId) return false;
+			const lockedSessionRecord = await getTurnRecord(stored.resumeConversationId, lockedSessionId);
+			if (!lockedSessionRecord || lockedSessionRecord.state !== "paused" || lockedSessionRecord.resumeReason !== "auth") return false;
+			if (lockedPendingAuth) {
+				if (!isPendingAuthLatestRequest(lockedConversation, lockedPendingAuth)) {
+					clearPendingAuth(lockedConversation, lockedPendingAuth.sessionId);
+					await persistThreadStateById(stored.resumeConversationId, { conversation: lockedConversation });
+					await abandonTurnRecord({
+						conversationId: stored.resumeConversationId,
+						turnId: lockedPendingAuth.sessionId,
+						errorMessage: "Auth completed after a newer thread message abandoned this blocked request."
+					});
+					return false;
+				}
+			} else if (lockedConversation.processing.activeTurnId !== stored.resumeSessionId) return false;
+			const lockedUserMessage = getTurnUserMessage(lockedConversation, lockedSessionId);
+			if (!lockedUserMessage?.author?.userId) return false;
+			const lockedConversationContext = buildConversationContext(lockedConversation, { excludeMessageId: lockedUserMessage.id });
+			const lockedLocationConfiguration = getLocationConfigurationService(destination);
+			let actor;
+			try {
+				actor = createSlackResumeActor({
+					actor: lockedSessionRecord.actor,
+					teamId: destination.teamId,
+					userId: lockedUserMessage.author.userId
+				});
+			} catch {
+				await failTurnRecord({
+					conversationId: stored.resumeConversationId,
+					expectedVersion: lockedSessionRecord.version,
+					turnId: lockedSessionId,
+					errorMessage: "Unable to rebuild Slack actor for OAuth resume"
+				});
+				return false;
+			}
+			let routing;
+			try {
+				routing = await resolveTurnSessionRouting({ conversationId: stored.resumeConversationId });
+			} catch (error) {
+				await failTurnRecord({
+					conversationId: stored.resumeConversationId,
+					expectedVersion: lockedSessionRecord.version,
+					turnId: lockedSessionId,
+					errorMessage: error instanceof Error ? error.message : String(error)
+				});
+				return false;
+			}
+			await recordAuthorizationCompleted({
+				conversationId: stored.resumeConversationId,
+				kind: "plugin",
+				provider: stored.provider,
+				actorId: stored.userId,
+				authorizationId: pluginAuthorizationId({
+					provider: stored.provider,
+					sessionId: lockedSessionId
+				})
+			});
+			const lockedMessageTs = getTurnUserSlackMessageTs(lockedUserMessage);
+			return {
+				messageText: lockedUserMessage.text,
+				sliceId: lockedSessionRecord.sliceId,
+				messageTs: lockedMessageTs,
+				inputMessageIds: [lockedUserMessage.id],
+				run: {
+					instruction: {
+						text: lockedUserMessage.text,
+						context: lockedConversationContext,
+						...getTurnUserReplyAttachmentContext(lockedUserMessage)
+					},
+					history: await loadProjection({ conversationId: stored.resumeConversationId }),
+					credentialContext: { actor: {
+						type: "user",
+						userId: actor.userId
+					} },
+					actor,
+					destination,
+					...routing.location ? { location: routing.location } : void 0,
+					source: routing.source,
+					toolChannelId: stored.channelId,
+					environment: { locationConfiguration: lockedLocationConfiguration },
+					state: {
+						pendingAuth: lockedPendingAuth,
+						sandboxRef: getPersistedSandboxState(lockedState)
+					},
+					durability: { recordPendingAuth: async (nextPendingAuth) => {
+						lockedConversation.processing.pendingAuth = nextPendingAuth;
+						await persistThreadStateById(stored.resumeConversationId, { conversation: lockedConversation });
+					} }
+				},
+				commitResult: async (reply) => {
+					logInfo("oauth.callback.resume.completed", {
+						"app.credential.provider": stored.provider,
+						"app.ai.outcome": reply.diagnostics.outcome,
+						"app.ai.tool_calls": reply.diagnostics.toolCalls.length
+					});
+					await persistCompletedOAuthReplyState({
+						conversationId: stored.resumeConversationId,
+						sessionId: lockedSessionId,
+						reply
+					});
+				},
+				onPostDeliveryCommitFailure: async () => {
+					await failTurnRecord({
+						conversationId: stored.resumeConversationId,
+						expectedVersion: lockedSessionRecord.version,
+						turnId: lockedSessionId,
+						errorMessage: "OAuth-resumed reply was delivered but completion state did not persist"
+					});
+				},
+				onFailure: async () => {
+					await persistFailedOAuthReplyState({
+						conversationId: stored.resumeConversationId,
+						expectedVersion: lockedSessionRecord.version,
+						sessionId: lockedSessionId
+					});
+				},
+				onAuthPause: async () => {
+					await persistAuthPauseTurnState({
+						sessionId: lockedSessionId,
+						threadStateId: stored.resumeConversationId
+					});
+				},
+				onSuspend: async (resumeVersion) => {
+					await wakePausedTurn({
+						conversationId: stored.resumeConversationId,
+						destination,
+						turnId: lockedSessionId,
+						expectedVersion: resumeVersion
+					});
+				}
+			};
+		}
+	});
+}
+async function GET(request, provider, waitUntil, options) {
+	const localRelay = await relayLocalOAuthCallback(request);
+	if (localRelay) return localRelay;
+	const providerConfig = pluginCatalogRuntime.getOAuthConfig(provider);
+	if (!providerConfig) return htmlErrorResponse("Unknown provider", "The OAuth provider in this link is not recognized.", 404);
+	const providerLabel = formatProviderLabel(provider);
+	const url = new URL(request.url);
+	const errorParam = url.searchParams.get("error");
+	const code = url.searchParams.get("code");
+	const state = url.searchParams.get("state");
+	if (errorParam) {
+		if (state) await getStateAdapter().delete(`oauth-state:${state}`);
+		if (errorParam === "access_denied") return htmlErrorResponse("Authorization declined", `You declined the ${providerLabel} authorization request. Return to Junior and connect your ${providerLabel} account again if you change your mind.`, 400);
+		return htmlErrorResponse("Authorization failed", `${providerLabel} returned an error: ${errorParam}. Return to Junior and try again.`, 400);
+	}
+	if (!code || !state) return htmlErrorResponse("Invalid request", "This authorization link is missing required parameters.", 400);
+	const stateAdapter = getStateAdapter();
+	const stateKey = `oauth-state:${state}`;
+	const stored = parseOAuthStatePayload(await stateAdapter.get(stateKey));
+	if (!stored) return htmlErrorResponse("Link expired", `This authorization link has expired (links are valid for 10 minutes). Return to Junior and connect your ${providerLabel} account again to get a new link.`, 400);
+	if (stored.provider !== provider) return htmlErrorResponse("Provider mismatch", "This authorization link does not match the expected provider.", 400);
+	await stateAdapter.delete(stateKey);
+	const clientId = process.env[providerConfig.clientIdEnv]?.trim();
+	const clientSecret = process.env[providerConfig.clientSecretEnv]?.trim();
+	if (!clientId || !clientSecret) return htmlErrorResponse("Configuration error", "OAuth client credentials are not configured on the server.", 500);
+	const baseUrl = resolveBaseUrl();
+	if (!baseUrl) return htmlErrorResponse("Configuration error", "The server cannot determine its base URL.", 500);
+	const redirectUri = `${baseUrl}${providerConfig.callbackPath}`;
+	const requestedScope = stored.scope ?? providerConfig.scope;
+	let tokenResponse;
+	try {
+		const tokenRequest = buildOAuthTokenRequest({
+			clientId,
+			clientSecret,
+			payload: {
+				grant_type: "authorization_code",
+				code,
+				redirect_uri: redirectUri
+			},
+			tokenAuthMethod: providerConfig.tokenAuthMethod,
+			tokenExtraHeaders: providerConfig.tokenExtraHeaders
+		});
+		tokenResponse = await fetch(providerConfig.tokenEndpoint, {
+			method: "POST",
+			headers: tokenRequest.headers,
+			body: tokenRequest.body
+		});
+	} catch {
+		logWarn("oauth.token_exchange.failed", oauthTokenErrorAttributes(provider, providerConfig.tokenEndpoint));
+		return htmlErrorResponse("Connection failed", "Failed to exchange the authorization code. Please try again.", 500);
+	}
+	if (!tokenResponse.ok) {
+		logWarn("oauth.token_exchange.failed", oauthTokenErrorAttributes(provider, providerConfig.tokenEndpoint, tokenResponse.status));
+		return htmlErrorResponse("Connection failed", "The token exchange with the provider failed. Please try again.", 500);
+	}
+	let parsedTokenResponse;
+	try {
+		const tokenData = await tokenResponse.json();
+		parsedTokenResponse = parseOAuthTokenResponse(tokenData, requestedScope, { treatEmptyScopeAsUnreported: providerConfig.treatEmptyScopeAsUnreported });
+	} catch {
+		logWarn("oauth.token_exchange.failed", oauthTokenErrorAttributes(provider, providerConfig.tokenEndpoint, tokenResponse.status));
+		return htmlErrorResponse("Connection failed", "The provider returned an incomplete token response. Please try again.", 500);
+	}
+	if (!hasRequiredOAuthScope(parsedTokenResponse.scope, requestedScope)) return htmlErrorResponse("Connection failed", `The ${providerLabel} authorization did not grant the access Junior requires. Return to Junior and connect your ${providerLabel} account again.`, 400);
+	const userTokenStore = createUserTokenStore();
+	let account;
+	try {
+		account = await resolvePluginOAuthAccount({
+			provider,
+			tokens: parsedTokenResponse
+		});
+	} catch {
+		return htmlErrorResponse("Connection failed", `Junior could not verify the connected ${providerLabel} account. Please try again.`, 500);
+	}
+	await userTokenStore.set(stored.userId, provider, {
+		...parsedTokenResponse,
+		...account ? { account } : void 0
+	});
+	const slackActor = stored.actor?.platform === "slack" ? stored.actor : void 0;
+	if (account && slackActor) await runBestEffort(async () => {
+		const slackUserId = parseSlackUserId(slackActor.userId);
+		if (!slackUserId) throw new Error("OAuth Slack actor user id is invalid");
+		const profile = await lookupSlackUserProfile(slackUserId);
+		const slackIdentity = await upsertIdentity(getSqlExecutor(), {
+			kind: "user",
+			provider: "slack",
+			providerTenantId: slackActor.teamId,
+			providerSubjectId: profile.id,
+			displayName: profile.real_name || profile.display_name,
+			handle: profile.name,
+			...profile.email ? {
+				email: profile.email,
+				emailVerified: true
+			} : void 0
+		});
+		if (!slackIdentity.userId) throw new Error("OAuth Slack identity is not linked to a user");
+		await upsertLinkedIdentity(getSqlExecutor(), slackIdentity.userId, {
+			kind: "user",
+			provider,
+			providerSubjectId: account.id,
+			displayName: account.displayName,
+			handle: account.handle ?? account.label
+		});
+	}, "oauth.callback.identity_link.failed", { "app.credential.provider": provider });
+	const resumeConversationId = stored.resumeConversationId;
+	if (resumeConversationId) await runBestEffort(async () => {
+		await recordAuthenticationLinked({
+			conversationId: resumeConversationId,
+			provider,
+			actorId: stored.userId,
+			providerLabel,
+			...account?.label ? { accountLabel: account.label } : void 0,
+			...stored.resumeSessionId ? {
+				authorizationId: pluginAuthorizationId({
+					provider,
+					sessionId: stored.resumeSessionId
+				}),
+				turnId: stored.resumeSessionId
+			} : void 0
+		});
+	}, "oauth.callback.authentication_event.failed", { "app.credential.provider": provider });
+	if (stored.destination?.platform !== "local" && stored.source?.kind !== "web") waitUntil(async () => {
+		try {
+			await publishAppHomeView(getSlackClient(), stored.userId, userTokenStore);
+		} catch {}
+	});
+	const resumesWebTurn = Boolean(stored.source?.kind === "web" && stored.destination && stored.resumeConversationId && stored.resumeSessionId);
+	const resumesAgentTurn = Boolean(stored.destination?.platform !== "local" && stored.resumeConversationId && stored.resumeSessionId);
+	if (resumesWebTurn) waitUntil(async () => {
+		const turn = await getTurnRecord(stored.resumeConversationId, stored.resumeSessionId);
+		await deleteWebAuthorization({
+			actorId: stored.userId,
+			conversationId: stored.resumeConversationId
+		});
+		if (!turn || turn.state !== "paused" || turn.resumeReason !== "auth") return;
+		await recordAuthorizationCompleted({
+			conversationId: stored.resumeConversationId,
+			kind: "plugin",
+			provider: stored.provider,
+			actorId: stored.userId,
+			authorizationId: pluginAuthorizationId({
+				provider: stored.provider,
+				sessionId: stored.resumeSessionId
+			})
+		});
+		await wakePausedTurn({
+			conversationId: stored.resumeConversationId,
+			destination: stored.destination,
+			turnId: stored.resumeSessionId,
+			expectedVersion: turn.version
+		}, options.conversationWorkQueue ? { queue: options.conversationWorkQueue } : void 0);
+	});
+	else if (resumesAgentTurn) waitUntil(() => withLogContext({ conversationId: stored.resumeConversationId }, async () => {
+		try {
+			await resumeOAuthSessionRecordTurn(stored, options);
+		} catch (error) {
+			if (error instanceof ResumeTurnBusyError) {
+				logWarn("oauth.callback.resume.busy", {
+					"app.credential.provider": stored.provider,
+					...stored.resumeSessionId && { "app.ai.session_id": stored.resumeSessionId }
+				});
+				return;
+			}
+			throw error;
+		}
+	}));
+	else if (stored.channelId && stored.threadTs) {
+		const { channelId, threadTs } = stored;
+		waitUntil(() => postSlackMessage({
+			channelId,
+			threadTs,
+			text: `Your ${providerLabel} account is now connected. You can start using ${providerLabel} commands.`
+		}));
+	}
+	const botName = botConfig.userName;
+	const statusMessage = stored.destination?.platform === "local" && !resumesWebTurn ? `Your request is continuing in the local ${botName} client.` : resumesWebTurn ? `Your request is continuing in ${botName}.` : resumesAgentTurn ? "Your request is being processed in Slack." : `Your ${providerLabel} account is connected.`;
+	const footerMessage = stored.destination?.platform === "local" || resumesWebTurn ? `You can close this tab and return to ${botName}.` : "You can close this tab and return to Slack.";
+	return htmlCallbackResponse(escapeXml(`${providerLabel} account connected`), escapeXml(statusMessage), 200, { footerMessage: escapeXml(footerMessage) });
+}
+//#endregion
+//#region src/chat/local/credential-sync.ts
+const LOCAL_CREDENTIAL_SYNC_CONTEXT = "junior.local-credential-sync.v1";
+const LOCAL_CREDENTIAL_SYNC_MAX_AGE_MS = 6e4;
+const localCredentialSyncSchema = z.object({
+	createdAtMs: z.number().finite(),
+	provider: z.string().regex(/^[a-z][a-z0-9-]*$/),
+	tokens: pluginStoredTokensSchema
+}).strict();
+function syncSecret() {
+	const secret = process.env.JUNIOR_SECRET?.trim();
+	if (!secret) throw new Error("Local credential sync requires JUNIOR_SECRET");
+	return secret;
+}
+/** Sign one local credential payload in its own HMAC domain. */
+function signature(body) {
+	const signingKey = createSecretKey(Buffer.from(syncSecret(), "utf8"));
+	return createHmac("sha256", signingKey).update(`${LOCAL_CREDENTIAL_SYNC_CONTEXT}:${body}`).digest("base64url");
+}
+/** Compare credential signatures without leaking a matching prefix by timing. */
+function signaturesMatch(expected, actual) {
+	const expectedBuffer = Buffer.from(expected);
+	const actualBuffer = Buffer.from(actual);
+	return expectedBuffer.length === actualBuffer.length && timingSafeEqual(expectedBuffer, actualBuffer);
+}
+/** Copy a local user's provider credential to the loopback dev-server broker. */
+async function syncLocalOAuthCredential(provider, tokens) {
+	const body = JSON.stringify({
+		createdAtMs: Date.now(),
+		provider,
+		tokens
+	});
+	const port = process.env.PORT?.trim() || "3000";
+	const response = await fetch(`http://127.0.0.1:${port}/api/internal/local-oauth-credentials`, {
+		method: "POST",
+		headers: {
+			"content-type": "application/json",
+			"x-junior-local-credential-signature": signature(body)
+		},
+		body
+	});
+	if (!response.ok) throw new Error(`Could not sync local OAuth credential: HTTP ${response.status}`);
+}
+/** Verify and store one credential sent by the local CLI over loopback. */
+async function receiveLocalOAuthCredential(request) {
+	const hostname = new URL(request.url).hostname;
+	if (process.env.NODE_ENV !== "development" || hostname !== "127.0.0.1" && hostname !== "localhost") return new Response(null, { status: 404 });
+	const body = await request.text();
+	const actualSignature = request.headers.get("x-junior-local-credential-signature");
+	if (!actualSignature || !signaturesMatch(signature(body), actualSignature)) return Response.json({ error: "Unauthorized" }, { status: 401 });
+	let value;
+	try {
+		value = JSON.parse(body);
+	} catch {
+		return Response.json({ error: "Invalid request" }, { status: 400 });
+	}
+	const payload = localCredentialSyncSchema.safeParse(value);
+	if (!payload.success || Math.abs(Date.now() - payload.data.createdAtMs) > LOCAL_CREDENTIAL_SYNC_MAX_AGE_MS) return Response.json({ error: "Invalid request" }, { status: 400 });
+	await createUserTokenStore().set("local-cli", payload.data.provider, payload.data.tokens);
+	return new Response(null, { status: 204 });
+}
+//#endregion
+export { isSlackTitlePermissionError as C, createSlackAdapterAssistantStatusSession as D, splitSlackReplyText as E, isRetryableSlackPostError as S, buildSlackOutputMessage as T, getThreadId as _, GET$1 as a, getSlackApiErrorCode as b, wakePausedTurn as c, shouldKeepProcessingReactionForToolInvocation as d, startProcessingReaction as f, getRunId as g, getMessageTs as h, publishAppHomeView as i, resumeSlackTurn as l, getChannelId as m, syncLocalOAuthCredential as n, createPausedTurns as o, getAssistantThreadContext as p, GET as r, getPausedTurnRequest as s, receiveLocalOAuthCredential as t, buildAuthPauseResponse as u, getThreadTs as v, sendSlackReply as w, getSlackErrorObservabilityAttributes as x, stripLeadingBotMention as y };