@sentry/junior 0.206.0 → 0.208.0

package/dist/{agent-hooks-DNjlz2A-.js → agent-hooks-CuGjLjmR.js}

@@ -1,20 +1,21 @@
 import { t as __exportAll } from "./rolldown-runtime-B4FMCO8f.js";
-import { a as embedTexts, r as completeObject } from "./client-ceE7NtvC.js";
-import { C as withSpan, P as normalizeIdentityEmail, _ as setSpanAttributes, d as logInfo, f as logWarn, u as logException, v as setSpanStatus } from "./logging-D37bayDc.js";
+import { a as embedTexts, r as completeObject } from "./client-bRyPqwAV.js";
+import { C as withSpan, P as normalizeIdentityEmail, _ as setSpanAttributes, d as logInfo, f as logWarn, u as logException, v as setSpanStatus } from "./logging-sNS84Yuu.js";
 import { a as getClient$1 } from "./sentry-CD3SdJl-.js";
-import { a as getChatConfig, n as botConfig, s as getSlackBotToken } from "./config-CIE83sR2.js";
+import { t as canExposeConversationPayload } from "./conversation-privacy-whGaV2TG.js";
+import { a as getChatConfig, n as botConfig, s as getSlackBotToken } from "./config-EtF2uEaW.js";
 import { n as defaultModelId } from "./model-profile-CZmVoGdX.js";
-import { _ as parseSlackMessageTs, c as isActorUserId, h as parseSlackTeamId, m as parseSlackChannelReferenceId, u as parseActorUserId } from "./context-B45_WqVX.js";
+import { _ as parseSlackMessageTs, c as isActorUserId, h as parseSlackTeamId, m as parseSlackChannelReferenceId, u as parseActorUserId } from "./context-Bplcgypl.js";
 import { n as juniorDestinations } from "./destinations-BeBiJeEM.js";
-import { C as conversationReadColumns, E as juniorUsers, T as juniorIdentities, _ as juniorConversationEvents, b as juniorCodeChanges, g as juniorConversationBriefs, h as juniorConversationBindings, i as juniorWorkspaces, m as juniorConversationParticipants, n as juniorSnapshots, r as juniorWorkspaceRepos, t as createJuniorSqlExecutor, w as juniorConversations, x as juniorCodeRepositories, y as juniorConversationAnnotations } from "./executor-BfbYPW63.js";
+import { C as conversationReadColumns, E as juniorUsers, T as juniorIdentities, _ as juniorConversationEvents, b as juniorCodeChanges, g as juniorConversationBriefs, h as juniorConversationBindings, i as juniorWorkspaces, m as juniorConversationParticipants, n as juniorSnapshots, r as juniorWorkspaceRepos, t as createJuniorSqlExecutor, w as juniorConversations, x as juniorCodeRepositories, y as juniorConversationAnnotations } from "./executor-BW5qp0jC.js";
 import { B as decodeStoredConversationEvent, C as conversationReportEventSchema, H as newConversationEventSchema, L as conversationEventDataSchema, M as conversationBriefSchema, N as parseBriefInput, V as historyReplacementSchema } from "./conversation-AA4R1VUn.js";
-import { A as sleep$1, P as SANDBOX_WORKSPACE_ROOT, l as isSandboxMissingError, n as hash, v as getVercelSandboxCredentials, w as getStateAdapter, x as runNonInteractiveCommand } from "./profile-CSixooTi.js";
-import { n as briefEntriesFromReportEvents, s as generateBrief, t as BRIEF_PROMPT } from "./prompt-3gqNY1Ka.js";
+import { A as sleep$1, P as SANDBOX_WORKSPACE_ROOT, l as isSandboxMissingError, n as hash, v as getVercelSandboxCredentials, w as getStateAdapter, x as runNonInteractiveCommand } from "./profile-BfLMVhWo.js";
+import { n as briefEntriesFromReportEvents, s as generateBrief, t as BRIEF_PROMPT } from "./prompt-x-0ZtTyb.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { z } from "zod";
 import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
-import { and, arrayContains, asc, desc, eq, getTableColumns, gt, gte, inArray, isNotNull, isNull, lt, lte, max, ne, or, sql } from "drizzle-orm";
-import { codeChangeInputSchema, conversationAnnotationInputSchema, conversationEventPresentationSchema, defineConversationEvent, destinationSchema, identitySchema, locationSchema, missingToolAnnotationKeys, normalizeResourceEventIdentifier, pluginResourceEventsSchema, promptContextSchema, promptMessageSchema, resourceEventInputSchema, resourceEventMatchSchema, resourceEventMatches, resourceEventTypeSchema, sourceSchema, stableResourceEventMatchKey, userSchema } from "@sentry/junior-plugin-api";
+import { and, arrayContains, asc, desc, eq, exists, getTableColumns, gt, gte, inArray, isNotNull, isNull, lt, lte, max, ne, notExists, or, sql } from "drizzle-orm";
+import { codeChangeInputSchema, conversationAnnotationInputSchema, conversationEventPresentationSchema, defineConversationEvent, destinationSchema, eventInputSchema, eventMatchSchema, eventMatches, eventTypeSchema, identitySchema, locationSchema, missingToolAnnotationKeys, normalizeEventIdentifier, pluginEventsSchema, promptContextSchema, promptMessageSchema, sourceSchema, stableEventMatchKey, userSchema } from "@sentry/junior-plugin-api";
 import { alias } from "drizzle-orm/pg-core";
 import { WebClient } from "@slack/web-api";
 import { Sandbox } from "@vercel/sandbox";
@@ -207,7 +208,7 @@ function normalizeSessionSource(value) {
 		visibility: value.visibility,
 		conversationId: value.conversationId
 	};
-	if (value.kind === "resource_event" || value.kind === "scheduled_task" || value.kind === "event_task" || value.kind === "plugin_dispatch" || value.kind === "agent_invocation") return;
+	if (value.kind === "event" || value.kind === "scheduled_automation" || value.kind === "event_automation" || value.kind === "plugin_dispatch" || value.kind === "agent_invocation") return;
 	const threadTs = value.threadTs?.trim();
 	return {
 		kind: "slack",
@@ -278,11 +279,11 @@ function systemIdentityFromSource(source) {
 		providerSubjectId: "local-cli",
 		displayName: "Local CLI"
 	};
-	if (source === "resource_event") return {
+	if (source === "event") return {
 		kind: "system",
 		provider: "junior",
-		providerSubjectId: "resource-event",
-		displayName: "Resource Event"
+		providerSubjectId: "event",
+		displayName: "Event"
 	};
 }
 /** Prefer the user actor identity, else a source-derived system identity. */
@@ -403,7 +404,7 @@ function tenantId(value) {
 	return value ?? "";
 }
 function sourceFromValue(value) {
-	if (value === "api" || value === "internal" || value === "local" || value === "plugin" || value === "resource_event" || value === "scheduler" || value === "slack" || value === "web") return value;
+	if (value === "api" || value === "internal" || value === "local" || value === "plugin" || value === "event" || value === "scheduler" || value === "slack" || value === "web") return value;
 }
 function originTypeFromSource(source) {
 	return source;
@@ -1005,7 +1006,7 @@ const HUMAN_INSTRUCTION_PLATFORMS = /* @__PURE__ */ new Set([
 /**
 * Whether one event should restore an archived conversation to the feed.
 *
-* Archive hides finished noise until a human comes back. Resource events,
+* Archive hides finished noise until a human comes back. Events,
 * turn lifecycle, compaction, and other system writes may still refresh
 * activity clocks, but they must not unarchive on their own.
 */
@@ -2504,6 +2505,126 @@ function renderPluginConversationEvent(args) {
 	return definition.renderEvent(definition.parse(args.content));
 }
 //#endregion
+//#region src/api/conversations/membership.ts
+/** True when the viewer is a materialized participant on this root conversation. */
+function conversationHasParticipantUser(userId) {
+	const participant = getDb().select({ rootConversationId: juniorConversationParticipants.rootConversationId }).from(juniorConversationParticipants).where(and(eq(juniorConversationParticipants.rootConversationId, juniorConversations.conversationId), eq(juniorConversationParticipants.userId, userId)));
+	return exists(participant);
+}
+/**
+* True when a verified primary-email user participates on this root
+* conversation. Used only for the actorEmail feed fallback.
+*/
+function conversationHasParticipantEmail(email) {
+	const participant = getDb().select({ rootConversationId: juniorConversationParticipants.rootConversationId }).from(juniorConversationParticipants).innerJoin(juniorUsers, eq(juniorUsers.id, juniorConversationParticipants.userId)).where(and(eq(juniorConversationParticipants.rootConversationId, juniorConversations.conversationId), eq(juniorUsers.primaryEmailNormalized, email)));
+	return exists(participant);
+}
+/** True when one user's personal feed has archived this root after the cutoff. */
+function conversationArchivedForUser(userId, archivedAfter) {
+	const archive = getDb().select({ rootConversationId: juniorConversationParticipants.rootConversationId }).from(juniorConversationParticipants).where(and(eq(juniorConversationParticipants.rootConversationId, juniorConversations.conversationId), eq(juniorConversationParticipants.userId, userId), isNotNull(juniorConversationParticipants.archivedAt), archivedAfter ? gte(juniorConversationParticipants.archivedAt, archivedAfter) : void 0));
+	return exists(archive);
+}
+/** True when one user's personal feed has not archived this root. */
+function conversationNotArchivedForUser(userId) {
+	const archive = getDb().select({ rootConversationId: juniorConversationParticipants.rootConversationId }).from(juniorConversationParticipants).where(and(eq(juniorConversationParticipants.rootConversationId, juniorConversations.conversationId), eq(juniorConversationParticipants.userId, userId), isNotNull(juniorConversationParticipants.archivedAt)));
+	return notExists(archive);
+}
+/** True when one primary-email user's feed archived this root after the cutoff. */
+function conversationArchivedForEmail(email, archivedAfter) {
+	const archive = getDb().select({ rootConversationId: juniorConversationParticipants.rootConversationId }).from(juniorConversationParticipants).innerJoin(juniorUsers, eq(juniorUsers.id, juniorConversationParticipants.userId)).where(and(eq(juniorConversationParticipants.rootConversationId, juniorConversations.conversationId), eq(juniorUsers.primaryEmailNormalized, email), isNotNull(juniorConversationParticipants.archivedAt), archivedAfter ? gte(juniorConversationParticipants.archivedAt, archivedAfter) : void 0));
+	return exists(archive);
+}
+/** True when one primary-email user's personal feed has not archived this root. */
+function conversationNotArchivedForEmail(email) {
+	const archive = getDb().select({ rootConversationId: juniorConversationParticipants.rootConversationId }).from(juniorConversationParticipants).innerJoin(juniorUsers, eq(juniorUsers.id, juniorConversationParticipants.userId)).where(and(eq(juniorConversationParticipants.rootConversationId, juniorConversations.conversationId), eq(juniorUsers.primaryEmailNormalized, email), isNotNull(juniorConversationParticipants.archivedAt)));
+	return notExists(archive);
+}
+/** Root-actor ownership or a materialized participant row for the same person. */
+function viewerConversationMembership(args) {
+	if (args.actorMatch && args.participantMatch) return or(args.actorMatch, args.participantMatch);
+	return args.actorMatch ?? args.participantMatch;
+}
+/** Read personal archive timestamps for a bounded set of conversation roots. */
+async function conversationArchiveTimes(db, conversationIds, subject) {
+	if (!subject || conversationIds.length === 0) return /* @__PURE__ */ new Map();
+	const query = db.select({
+		archivedAt: juniorConversationParticipants.archivedAt,
+		rootConversationId: juniorConversationParticipants.rootConversationId
+	}).from(juniorConversationParticipants);
+	const rows = "userId" in subject ? await query.where(and(eq(juniorConversationParticipants.userId, subject.userId), inArray(juniorConversationParticipants.rootConversationId, [...conversationIds]), isNotNull(juniorConversationParticipants.archivedAt))) : await query.innerJoin(juniorUsers, eq(juniorUsers.id, juniorConversationParticipants.userId)).where(and(eq(juniorUsers.primaryEmailNormalized, subject.email), inArray(juniorConversationParticipants.rootConversationId, [...conversationIds]), isNotNull(juniorConversationParticipants.archivedAt)));
+	return new Map(rows.flatMap((row) => row.archivedAt ? [[row.rootConversationId, row.archivedAt.getTime()]] : []));
+}
+/** Find which of the supplied roots include the linked viewer as a participant. */
+async function conversationIdsWithParticipantUser(db, conversationIds, userId) {
+	if (conversationIds.length === 0) return /* @__PURE__ */ new Set();
+	const rows = await db.select({ rootConversationId: juniorConversationParticipants.rootConversationId }).from(juniorConversationParticipants).where(and(eq(juniorConversationParticipants.userId, userId), inArray(juniorConversationParticipants.rootConversationId, [...conversationIds])));
+	return new Set(rows.map((row) => row.rootConversationId));
+}
+//#endregion
+//#region src/api/conversations/access.ts
+const rootConversation = alias(juniorConversations, "access_root_conversation");
+const rootDestination = alias(juniorDestinations, "access_root_destination");
+const rootIdentity = alias(juniorIdentities, "access_root_identity");
+/** Resolve viewer access for a bounded set of persisted conversations. */
+async function readConversationAccessFromSql(db, conversationIds, viewer) {
+	if (conversationIds.length === 0) return /* @__PURE__ */ new Map();
+	const normalizedViewerEmail = viewer?.email.trim().toLowerCase() || void 0;
+	const rows = await db.select({
+		conversationId: juniorConversations.conversationId,
+		parentConversationId: juniorConversations.parentConversationId,
+		storedRootConversationId: juniorConversations.rootConversationId,
+		rootConversationId: rootConversation.conversationId,
+		rootParentConversationId: rootConversation.parentConversationId,
+		rootRootConversationId: rootConversation.rootConversationId,
+		visibility: rootDestination.visibility,
+		rootEmailNormalized: rootIdentity.emailNormalized,
+		rootEmailVerified: rootIdentity.emailVerified,
+		rootUserId: rootIdentity.userId
+	}).from(juniorConversations).leftJoin(rootConversation, eq(rootConversation.conversationId, juniorConversations.rootConversationId)).leftJoin(rootDestination, eq(rootDestination.id, rootConversation.destinationId)).leftJoin(rootIdentity, eq(rootIdentity.id, rootConversation.actorIdentityId)).where(inArray(juniorConversations.conversationId, [...conversationIds]));
+	const membershipConversationIds = /* @__PURE__ */ new Set();
+	for (const row of rows) {
+		membershipConversationIds.add(row.conversationId);
+		if (row.storedRootConversationId) membershipConversationIds.add(row.storedRootConversationId);
+	}
+	const participantRootIds = viewer !== void 0 ? await conversationIdsWithParticipantUser(db, [...membershipConversationIds], viewer.id) : /* @__PURE__ */ new Set();
+	return new Map(rows.map((row) => {
+		const validRootConversationId = row.rootConversationId !== null && row.rootConversationId === row.storedRootConversationId && row.rootRootConversationId === row.rootConversationId && row.rootParentConversationId === null && (row.parentConversationId !== null || row.storedRootConversationId === row.conversationId) ? row.rootConversationId ?? void 0 : void 0;
+		const visibility = validRootConversationId === void 0 ? null : row.visibility;
+		const isRootActor = validRootConversationId !== void 0 && viewer !== void 0 && (row.rootUserId === viewer.id || normalizedViewerEmail !== void 0 && row.rootEmailVerified === true && row.rootEmailNormalized === normalizedViewerEmail);
+		const isMaterializedParticipant = participantRootIds.has(row.conversationId) || validRootConversationId !== void 0 && participantRootIds.has(validRootConversationId);
+		const isParticipant = isRootActor || isMaterializedParticipant;
+		const canViewPrivateContent = isParticipant || validRootConversationId !== void 0 && canExposeConversationPayload({ visibility: visibility ?? void 0 });
+		return [row.conversationId, {
+			canViewPrivateContent,
+			isParticipant,
+			visibility
+		}];
+	}));
+}
+//#endregion
+//#region src/chat/plugins/conversation-event-reader.ts
+function registeredEventName$1(plugin, eventName) {
+	if (!plugin.conversationEvents?.some((definition) => definition.eventName === eventName)) throw new TypeError(`Plugin "${plugin.manifest.name}" did not register event "${eventName}"`);
+	return eventName;
+}
+/** Create Conversation event reads bound to one plugin namespace. */
+function createPluginConversationEventReader(plugin) {
+	return { async list(input) {
+		const eventName = registeredEventName$1(plugin, input.eventName);
+		const db = getDb();
+		if (!(await readConversationAccessFromSql(db, [input.conversationId], input.viewer)).get(input.conversationId)?.canViewPrivateContent) return void 0;
+		return (await db.select({
+			content: sql`${juniorConversationEvents.payload}->'content'`,
+			createdAt: juniorConversationEvents.createdAt,
+			version: sql`(${juniorConversationEvents.payload}->>'version')::integer`
+		}).from(juniorConversationEvents).where(and(eq(juniorConversationEvents.conversationId, input.conversationId), eq(juniorConversationEvents.type, "structured_event"), sql`${juniorConversationEvents.payload}->>'namespace' = ${plugin.manifest.name}`, sql`${juniorConversationEvents.payload}->>'name' = ${eventName}`)).orderBy(desc(juniorConversationEvents.seq))).map((row) => ({
+			content: row.content,
+			createdAt: row.createdAt.toISOString(),
+			version: row.version
+		}));
+	} };
+}
+//#endregion
 //#region src/chat/plugins/conversation-event-stats.ts
 const DAY_MS = 864e5;
 const costRowSchema = z.object({
@@ -2751,15 +2872,15 @@ function getDashboardConversationLink(conversationId) {
 }
 /** Build the dashboard task detail URL when the core dashboard is enabled. */
 function getDashboardTaskLink(taskId) {
-	return resolveDashboardPath(`/tasks/${encodeURIComponent(taskId)}`);
+	return resolveDashboardPath(`/automations/${encodeURIComponent(taskId)}`);
 }
 //#endregion
 //#region src/chat/state/ttl.ts
 /** Retain expiring conversation/runtime state long enough for resume and dashboard history. */
 const JUNIOR_THREAD_STATE_TTL_MS = 6048e5;
 //#endregion
-//#region src/chat/resource-events/store.ts
-const RESOURCE_EVENT_PREFIX = "junior:resource_event_subscription:v5";
+//#region src/chat/events/store.ts
+const EVENT_PREFIX = "junior:resource_event_subscription:v5";
 const INDEX_LOCK_TTL_MS = 1e4;
 const SUBSCRIPTION_LOCK_TTL_MS = 1e4;
 const SUBSCRIPTION_LOCK_WAIT_MS = 1e4;
@@ -2774,12 +2895,12 @@ const subscriptionIdIndexSchema = z.array(z.string().min(1));
 const subscriptionSchema = z.object({
 	conversationId: z.string().min(1),
 	createdAtMs: z.number().finite(),
-	events: z.array(resourceEventTypeSchema).min(1),
+	events: z.array(eventTypeSchema).min(1),
 	expiresAtMs: z.number().finite(),
 	id: z.string().min(1),
 	intent: z.string().min(1),
 	label: z.string().min(1),
-	match: resourceEventMatchSchema.optional(),
+	match: eventMatchSchema.optional(),
 	namespace: z.string().min(1),
 	identifier: z.string().min(1),
 	resourceType: z.string().min(1),
@@ -2790,16 +2911,16 @@ function digest(value) {
 	return createHash("sha256").update(value).digest("hex").slice(0, 32);
 }
 function subscriptionKey(id) {
-	return `${RESOURCE_EVENT_PREFIX}:record:${id}`;
+	return `${EVENT_PREFIX}:record:${id}`;
 }
 function subscriptionLockKey(id) {
-	return `${RESOURCE_EVENT_PREFIX}:lock:${id}`;
+	return `${EVENT_PREFIX}:lock:${id}`;
 }
 function resourceIndexKey(namespace, identifier) {
-	return `${RESOURCE_EVENT_PREFIX}:resource:${digest(`${namespace}\0${identifier}`)}`;
+	return `${EVENT_PREFIX}:resource:${digest(`${namespace}\0${identifier}`)}`;
 }
 function conversationIndexKey(conversationId) {
-	return `${RESOURCE_EVENT_PREFIX}:conversation:${digest(conversationId)}`;
+	return `${EVENT_PREFIX}:conversation:${digest(conversationId)}`;
 }
 function indexLockKey(key) {
 	return `${key}:lock`;
@@ -2813,7 +2934,7 @@ async function acquireSubscriptionLock(state, subscriptionId, waitDeadlineMs = D
 	while (true) {
 		const lock = await state.acquireLock(subscriptionLockKey(subscriptionId), SUBSCRIPTION_LOCK_TTL_MS);
 		if (lock) return lock;
-		if (Date.now() >= waitDeadlineMs) throw new Error(`Could not acquire resource event subscription lock for ${subscriptionId}`);
+		if (Date.now() >= waitDeadlineMs) throw new Error(`Could not acquire watch lock for ${subscriptionId}`);
 		await sleep(SUBSCRIPTION_LOCK_RETRY_MS);
 	}
 }
@@ -2827,7 +2948,7 @@ async function withSubscriptionLock(state, subscriptionId, callback, waitDeadlin
 		if (heartbeat) return;
 		heartbeat = state.extendLock(lock, SUBSCRIPTION_LOCK_TTL_MS).then((extended) => {
 			if (extended) heartbeatError = void 0;
-			else lockLostError = /* @__PURE__ */ new Error(`Resource event subscription lock was lost for ${subscriptionId}`);
+			else lockLostError = /* @__PURE__ */ new Error(`Watch lock was lost for ${subscriptionId}`);
 		}).catch((error) => {
 			heartbeatError = error instanceof Error ? error : /* @__PURE__ */ new Error(`Failed to extend subscription lock: ${String(error)}`);
 		}).finally(() => {
@@ -2857,12 +2978,12 @@ async function readSubscriptionIdIndex(state, key) {
 }
 function buildSubscriptionId(input) {
 	const eventKey = [...new Set(input.events)].sort().join("\0");
-	const matchKey = stableResourceEventMatchKey(input.match);
+	const matchKey = stableEventMatchKey(input.match);
 	return `resub_${digest(matchKey ? `${input.namespace}\0${input.identifier}\0${input.conversationId}\0${eventKey}\0${matchKey}` : `${input.namespace}\0${input.identifier}\0${input.conversationId}\0${eventKey}`)}`;
 }
 async function withIndexLock(state, key, callback) {
 	const lock = await state.acquireLock(indexLockKey(key), INDEX_LOCK_TTL_MS);
-	if (!lock) throw new Error(`Could not acquire resource event index lock for ${key}`);
+	if (!lock) throw new Error(`Could not acquire event index lock for ${key}`);
 	try {
 		return await callback();
 	} finally {
@@ -2894,16 +3015,16 @@ function activeAt(subscription, nowMs) {
 	return subscription.status === "active" && subscription.expiresAtMs > nowMs;
 }
 function matchesEvent(subscription, input) {
-	return subscription.namespace === input.namespace && subscription.identifier === input.identifier && subscription.events.includes(input.eventType) && activeAt(subscription, input.nowMs) && resourceEventMatches(subscription.match, input.data);
+	return subscription.namespace === input.namespace && subscription.identifier === input.identifier && subscription.events.includes(input.eventType) && activeAt(subscription, input.nowMs) && eventMatches(subscription.match, input.data);
 }
 /** Create or replace the active subscription for one conversation/resource/event set. */
-async function createResourceEventSubscription(input, options = {}) {
+async function createWatch(input, options = {}) {
 	const state = options.state ?? getStateAdapter();
 	await state.connect();
 	const nowMs = options.nowMs ?? Date.now();
 	const events = [...new Set(input.events.map((event) => event.trim()))].filter(Boolean);
-	if (events.length === 0) throw new Error("Resource event subscription requires at least one event");
-	if (input.expiresAtMs <= nowMs) throw new Error("Resource event subscription expiry must be in the future");
+	if (events.length === 0) throw new Error("Watch requires at least one event");
+	if (input.expiresAtMs <= nowMs) throw new Error("Watch expiry must be in the future");
 	const match = input.match && Object.keys(input.match).length > 0 ? input.match : void 0;
 	const id = buildSubscriptionId({
 		conversationId: input.conversationId,
@@ -2934,7 +3055,7 @@ async function createResourceEventSubscription(input, options = {}) {
 	return parsed;
 }
 /** List active subscriptions bound to one conversation. */
-async function listResourceEventSubscriptions(input) {
+async function listWatches(input) {
 	const state = input.state ?? getStateAdapter();
 	await state.connect();
 	const nowMs = input.nowMs ?? Date.now();
@@ -2942,7 +3063,7 @@ async function listResourceEventSubscriptions(input) {
 	return (await Promise.all(ids.map(async (id) => parseSubscription(await state.get(subscriptionKey(id)))))).filter((record) => record !== void 0 && record.conversationId === input.conversationId && activeAt(record, nowMs)).sort((left, right) => left.createdAtMs - right.createdAtMs);
 }
 /** Cancel a current-conversation subscription and remove it from match indexes. */
-async function cancelResourceEventSubscription(input) {
+async function cancelWatch(input) {
 	const state = input.state ?? getStateAdapter();
 	await state.connect();
 	return await withSubscriptionLock(state, input.id, async () => {
@@ -2960,10 +3081,10 @@ async function cancelResourceEventSubscription(input) {
 		return next;
 	});
 }
-/** Cancel every active resource event subscription bound to one conversation. */
+/** Cancel every active watch bound to one conversation. */
 async function cancelSubscriptions(input) {
-	const subscriptions = await listResourceEventSubscriptions(input);
-	for (const subscription of subscriptions) await cancelResourceEventSubscription({
+	const subscriptions = await listWatches(input);
+	for (const subscription of subscriptions) await cancelWatch({
 		conversationId: input.conversationId,
 		id: subscription.id,
 		nowMs: input.nowMs,
@@ -2974,7 +3095,7 @@ async function cancelSubscriptions(input) {
 * Collect match keys from active watches for these identifiers and event types.
 * Does not evaluate match values — only reports keys that filters use.
 */
-async function collectResourceEventMatchKeys(input) {
+async function collectEventMatchKeys(input) {
 	const state = input.state ?? getStateAdapter();
 	await state.connect();
 	const nowMs = input.nowMs ?? Date.now();
@@ -2996,8 +3117,8 @@ async function collectResourceEventMatchKeys(input) {
 	}
 	return [...keys].sort();
 }
-/** Find active subscriptions interested in a normalized resource event. */
-async function findMatchingResourceEventSubscriptions(input) {
+/** Find active subscriptions interested in a normalized event. */
+async function findMatchingWatches(input) {
 	const state = input.state ?? getStateAdapter();
 	await state.connect();
 	const nowMs = input.nowMs ?? Date.now();
@@ -3011,7 +3132,7 @@ async function findMatchingResourceEventSubscriptions(input) {
 	}));
 }
 /** Recheck and deliver a matched subscription while holding its status lock. */
-async function deliverResourceEventSubscription(input) {
+async function deliverWatch(input) {
 	const state = input.state ?? getStateAdapter();
 	await state.connect();
 	return await withSubscriptionLock(state, input.subscription.id, async () => {
@@ -3041,15 +3162,15 @@ async function deliverResourceEventSubscription(input) {
 	}, input.waitDeadlineMs);
 }
 //#endregion
-//#region src/chat/resource-events/tool-support.ts
-/** Default lifetime for temporary resource subscriptions. */
+//#region src/chat/events/tool-support.ts
+/** Default lifetime for temporary watches. */
 const RESOURCE_SUBSCRIPTION_DEFAULT_TTL_MS = 12096e5;
-/** Hard upper bound for temporary resource subscriptions. */
+/** Hard upper bound for temporary watches. */
 const RESOURCE_SUBSCRIPTION_MAX_TTL_MS = 2592e6;
 const STOP_WATCHING_TOOL_NAME = "stopWatchingResources";
 const RESOURCE_WATCH_TOOL_SOURCE = {
 	id: "resource-watches",
-	description: "Inspect or stop resource watches for the current conversation."
+	description: "Inspect or stop watches for the current conversation."
 };
 //#endregion
 //#region src/chat/slack/tool-support/context.ts
@@ -3578,24 +3699,24 @@ function verifySlackDirectCredentialSubject(input) {
 	])), binding.signature);
 }
 /** Bind a delegated user subject to one scheduler task dispatch. */
-function bindScheduledTaskCredentialSubject(input) {
+function bindScheduledAutomationCredentialSubject(input) {
 	const secret = getCredentialSubjectSecret();
 	const plugin = input.plugin.trim();
 	const userId = parseActorUserId(input.subject.userId);
-	if (!secret || plugin !== "scheduler" || !userId || input.subject.allowedWhen !== "scheduled-task") return;
+	if (!secret || plugin !== "scheduler" || !userId || input.subject.allowedWhen !== "scheduled-automation") return;
 	const taskId = input.subject.taskId;
 	if (!taskId || taskId !== taskId.trim()) return;
 	return {
 		type: "user",
 		userId,
-		allowedWhen: "scheduled-task",
+		allowedWhen: "scheduled-automation",
 		taskId,
 		binding: {
-			type: "scheduled-task",
+			type: "scheduled-automation",
 			plugin,
 			taskId,
 			signature: signPayload(secret, buildPayload([
-				"scheduled-task",
+				"scheduled-automation",
 				plugin,
 				taskId,
 				userId
@@ -3604,37 +3725,37 @@ function bindScheduledTaskCredentialSubject(input) {
 	};
 }
 /** Verify that a delegated subject was signed for one scheduler task. */
-function verifyScheduledTaskCredentialSubject(input) {
+function verifyScheduledAutomationCredentialSubject(input) {
 	const secret = getCredentialSubjectSecret();
 	const { subject } = input;
 	const binding = subject.binding;
-	if (!secret || input.plugin !== "scheduler" || subject.type !== "user" || !isActorUserId(subject.userId) || subject.allowedWhen !== "scheduled-task" || !subject.taskId || binding.type !== "scheduled-task" || binding.plugin !== input.plugin || binding.taskId !== subject.taskId) return false;
+	if (!secret || input.plugin !== "scheduler" || subject.type !== "user" || !isActorUserId(subject.userId) || subject.allowedWhen !== "scheduled-automation" || !subject.taskId || binding.type !== "scheduled-automation" || binding.plugin !== input.plugin || binding.taskId !== subject.taskId) return false;
 	return timingSafeMatch(signPayload(secret, buildPayload([
-		"scheduled-task",
+		"scheduled-automation",
 		binding.plugin,
 		binding.taskId,
 		subject.userId
 	])), binding.signature);
 }
-/** Bind a delegated user subject to one event task dispatch. */
-function bindEventTaskCredentialSubject(input) {
+/** Bind a delegated user subject to one event automation dispatch. */
+function bindEventAutomationCredentialSubject(input) {
 	const secret = getCredentialSubjectSecret();
 	const plugin = input.plugin.trim();
 	const userId = parseActorUserId(input.subject.userId);
-	if (!secret || plugin !== "junior" || !userId || input.subject.allowedWhen !== "event-task") return;
+	if (!secret || plugin !== "junior" || !userId || input.subject.allowedWhen !== "event-automation") return;
 	const taskId = input.subject.taskId;
 	if (!taskId || taskId !== taskId.trim()) return;
 	return {
 		type: "user",
 		userId,
-		allowedWhen: "event-task",
+		allowedWhen: "event-automation",
 		taskId,
 		binding: {
-			type: "event-task",
+			type: "event-automation",
 			plugin,
 			taskId,
 			signature: signPayload(secret, buildPayload([
-				"event-task",
+				"event-automation",
 				plugin,
 				taskId,
 				userId
@@ -3642,14 +3763,14 @@ function bindEventTaskCredentialSubject(input) {
 		}
 	};
 }
-/** Verify that a delegated subject was signed for one event task. */
-function verifyEventTaskCredentialSubject(input) {
+/** Verify that a delegated subject was signed for one event automation. */
+function verifyEventAutomationCredentialSubject(input) {
 	const secret = getCredentialSubjectSecret();
 	const { subject } = input;
 	const binding = subject.binding;
-	if (!secret || input.plugin !== "junior" || subject.type !== "user" || !isActorUserId(subject.userId) || subject.allowedWhen !== "event-task" || !subject.taskId || binding.type !== "event-task" || binding.plugin !== input.plugin || binding.taskId !== subject.taskId) return false;
+	if (!secret || input.plugin !== "junior" || subject.type !== "user" || !isActorUserId(subject.userId) || subject.allowedWhen !== "event-automation" || !subject.taskId || binding.type !== "event-automation" || binding.plugin !== input.plugin || binding.taskId !== subject.taskId) return false;
 	return timingSafeMatch(signPayload(secret, buildPayload([
-		"event-task",
+		"event-automation",
 		binding.plugin,
 		binding.taskId,
 		subject.userId
@@ -4256,9 +4377,9 @@ function pluginInvocationContext(context) {
 			destination: context.destination,
 			source: context.source
 		};
-		case "resource_event":
-		case "scheduled_task":
-		case "event_task":
+		case "event":
+		case "scheduled_automation":
+		case "event_automation":
 		case "plugin_dispatch":
 		case "agent_invocation": return {
 			...common,
@@ -4362,7 +4483,7 @@ function validatePlugins(plugins) {
 		const name = plugin.manifest.name;
 		if (!PLUGIN_NAME_RE.test(name)) throw new Error(`Plugin name "${name}" must be a lowercase plugin identifier`);
 		if (seen.has(name)) throw new Error(`Duplicate plugin name "${name}"`);
-		if (plugin.resourceEvents !== void 0 && !pluginResourceEventsSchema.safeParse(plugin.resourceEvents).success) throw new Error(`Plugin "${name}" resourceEvents is invalid`);
+		if (plugin.events !== void 0 && !pluginEventsSchema.safeParse(plugin.events).success) throw new Error(`Plugin "${name}" events is invalid`);
 		for (const [taskName, task] of Object.entries(plugin.tasks ?? {})) {
 			if (!PLUGIN_TOOL_NAME_RE.test(taskName)) throw new Error(`Plugin task "${taskName}" from plugin "${name}" must be a camelCase identifier`);
 			if (typeof task.run !== "function") throw new Error(`Plugin task "${taskName}" from plugin "${name}" must define a run function`);
@@ -4517,22 +4638,22 @@ function getPluginTools(context, sandbox = createSandboxCapability(context.works
 			plugin: pluginName
 		});
 		const mcp = pluginMcpContext(plugin, context);
-		const canSubscribe = Boolean(plugin.resourceEvents) && plugin.resourceEvents?.isEnabled?.() !== false;
-		const resourceEvents = {
+		const canSubscribe = Boolean(plugin.events) && plugin.events?.isEnabled?.() !== false;
+		const events = {
 			canSubscribe,
 			async subscribe(input) {
-				if (!canSubscribe) throw new Error("Resource subscriptions are not available in this conversation.");
-				const registration = plugin.resourceEvents;
+				if (!canSubscribe) throw new Error("Watches are not available in this conversation.");
+				const registration = plugin.events;
 				const resourceType = registration?.resourceTypes.find((candidate) => candidate.type === input.resource.type);
-				if (input.resource.namespace !== pluginName || !resourceType || input.events.length === 0 || input.events.some((eventType) => !resourceType.supportedEvents.includes(eventType))) throw new Error("Resource subscription contains an event or resource that the plugin does not support.");
-				const subscription = await createResourceEventSubscription({
+				if (input.resource.namespace !== pluginName || !resourceType || input.events.length === 0 || input.events.some((eventType) => !resourceType.supportedEvents.includes(eventType))) throw new Error("Watch contains an event or resource that the plugin does not support.");
+				const subscription = await createWatch({
 					conversationId: context.conversationId,
 					events: input.events,
 					expiresAtMs: Date.now() + RESOURCE_SUBSCRIPTION_DEFAULT_TTL_MS,
 					intent: input.intent,
 					label: input.resource.label,
 					namespace: pluginName,
-					identifier: normalizeResourceEventIdentifier(registration, input.resource.identifier),
+					identifier: normalizeEventIdentifier(registration, input.resource.identifier),
 					resourceType: input.resource.type
 				});
 				return {
@@ -4553,7 +4674,7 @@ function getPluginTools(context, sandbox = createSandboxCapability(context.works
 			egress: context.egress,
 			...mcp ? { mcp } : void 0,
 			model: createPluginModel(pluginName, plugin.model),
-			resourceEvents,
+			events,
 			sandbox,
 			state: createPluginState(pluginName),
 			users: { resolveActor },
@@ -4589,9 +4710,9 @@ function getPluginTools(context, sandbox = createSandboxCapability(context.works
 					source: context.source
 				};
 				break;
-			case "resource_event":
-			case "scheduled_task":
-			case "event_task":
+			case "event":
+			case "scheduled_automation":
+			case "event_automation":
 			case "plugin_dispatch":
 			case "agent_invocation": pluginContext = {
 				...common,
@@ -4637,10 +4758,10 @@ function routeMethods(route, pluginName) {
 	if (methods.includes("ALL") && methods.length > 1) throw new Error(`Plugin route "${route.path}" from plugin "${pluginName}" must not combine ALL with explicit methods`);
 	return methods;
 }
-function requirePublishedResourceEvent(plugin, eventType) {
-	const registration = plugin.resourceEvents;
-	if (!registration || registration.isEnabled?.() === false) throw new Error(`Plugin "${plugin.manifest.name}" cannot publish resource events without an active registration`);
-	if (!registration.resourceTypes.some((resourceType) => resourceType.supportedEvents.includes(eventType))) throw new Error(`Plugin "${plugin.manifest.name}" did not register resource event "${eventType}"`);
+function requirePublishedEvent(plugin, eventType) {
+	const registration = plugin.events;
+	if (!registration || registration.isEnabled?.() === false) throw new Error(`Plugin "${plugin.manifest.name}" cannot publish events without an active registration`);
+	if (!registration.resourceTypes.some((resourceType) => resourceType.supportedEvents.includes(eventType))) throw new Error(`Plugin "${plugin.manifest.name}" did not register event "${eventType}"`);
 }
 /** Collect route handlers exposed by plugins for app-level mounting. */
 function getPluginRoutes(options) {
@@ -4659,33 +4780,33 @@ function getPluginRoutes(options) {
 				plugin: pluginName
 			}) },
 			codeChanges: createCodeChangePublisher(pluginName),
-			resourceEvents: {
+			events: {
 				async hasMatch(event) {
-					if (!options.resourceEvents.hasMatch) return false;
-					const parsed = resourceEventInputSchema.parse(event);
-					requirePublishedResourceEvent(plugin, parsed.eventType);
-					return await options.resourceEvents.hasMatch({
+					if (!options.events.hasMatch) return false;
+					const parsed = eventInputSchema.parse(event);
+					requirePublishedEvent(plugin, parsed.eventType);
+					return await options.events.hasMatch({
 						...parsed,
-						identifier: normalizeResourceEventIdentifier(plugin.resourceEvents, parsed.identifier),
+						identifier: normalizeEventIdentifier(plugin.events, parsed.identifier),
 						namespace: pluginName
 					});
 				},
 				async neededMatchKeys(input) {
-					if (!options.resourceEvents.neededMatchKeys) return [];
-					const identifiers = [...new Set(input.identifiers.map((identifier) => normalizeResourceEventIdentifier(plugin.resourceEvents, identifier)).filter(Boolean))];
+					if (!options.events.neededMatchKeys) return [];
+					const identifiers = [...new Set(input.identifiers.map((identifier) => normalizeEventIdentifier(plugin.events, identifier)).filter(Boolean))];
 					if (identifiers.length === 0 || input.eventTypes.length === 0) return [];
-					return await options.resourceEvents.neededMatchKeys({
+					return await options.events.neededMatchKeys({
 						eventTypes: input.eventTypes,
 						identifiers,
 						namespace: pluginName
 					});
 				},
 				async publish(event) {
-					const parsed = resourceEventInputSchema.parse(event);
-					requirePublishedResourceEvent(plugin, parsed.eventType);
-					await options.resourceEvents.publish({
+					const parsed = eventInputSchema.parse(event);
+					requirePublishedEvent(plugin, parsed.eventType);
+					await options.events.publish({
 						...parsed,
-						identifier: normalizeResourceEventIdentifier(plugin.resourceEvents, parsed.identifier),
+						identifier: normalizeEventIdentifier(plugin.events, parsed.identifier),
 						namespace: pluginName
 					});
 				}
@@ -4723,6 +4844,7 @@ function getPluginApiRoutes() {
 		if (!hook) continue;
 		const app = hook({
 			...basePluginContext(plugin),
+			conversationEvents: createPluginConversationEventReader(plugin),
 			eventStats: createPluginConversationEventStats(plugin),
 			users: { resolve: resolveViewerUser }
 		});
@@ -5026,6 +5148,7 @@ function createPluginHookRunner(input = {}) {
 				paths.add(key);
 			}
 			const sandboxCapability = createSandboxCapability(sandbox, signal);
+			const finalizers = [];
 			for (const plugin of loaded) {
 				const hook = plugin.hooks?.workspacePrepare;
 				if (!hook) continue;
@@ -5034,12 +5157,16 @@ function createPluginHookRunner(input = {}) {
 					repo: repo.repo
 				}));
 				if (selected.length === 0) continue;
-				await hook({
+				const finalize = await hook({
 					...basePluginContext(plugin),
 					repos: selected,
 					sandbox: sandboxCapability
 				});
+				if (finalize) finalizers.push(finalize);
 			}
+			return async () => {
+				for (const finalize of finalizers) await finalize();
+			};
 		},
 		async prepareSandbox(sandbox) {
 			const sandboxCapability = createSandboxCapability(sandbox);
@@ -5105,4 +5232,4 @@ function createPluginHookRunner(input = {}) {
 	};
 }
 //#endregion
-export { resolveViewerUser as $, tryWorkspaceRepoCheckoutPath as A, authenticationLinkedEvent as At, downloadPrivateSlackFile as B, sanitizePostgresJson as Bt, invalidateReadySnapshot as C, readConversationEventPage as Ct, SANDBOX_RUNTIME as D, listConversationAnnotationsById as Dt, setWorkspaceSnapshotBuild as E, listConversationAnnotations as Et, bindSlackDirectCredentialSubject as F, getConversationStore as Ft, isDmChannel as G, resolveRootConversationId as Gt, getHeaderString as H, locationFromRow as Ht, verifyEventTaskCredentialSubject as I, getDb as It, withSlackRetries as J, upsertLinkedIdentity as Jt, normalizeSlackConversationId as K, deleteProviderIdentityForSlackUser as Kt, verifyScheduledTaskCredentialSubject as L, getSqlExecutor as Lt, resolveChannelCapabilities as M, db_exports as Mt, bindEventTaskCredentialSubject as N, getConversationEventStore as Nt, deleteWorkspaceSnapshotBuilders as O, JUNIOR_NATIVE_EVENT_NAMESPACE as Ot, bindScheduledTaskCredentialSubject as P, getConversationMessageSearchStore as Pt, readActorIdentity as Q, sameDestination as Qt, verifySlackDirectCredentialSubject as R, createSqlConversationEventStore as Rt, WorkspaceValidationError as S, readLatestConversationBrief as St, setWorkspaceSnapshot as T, resolveRootVisibility as Tt, getSlackClient as U, bindProviderConversation as Ut, getFilePermalink as V, withConversationMutationLock as Vt, isConversationScopedChannel as W, parseSessionSource as Wt, runWithWorkspaceTeamId as X, parseDestination as Xt, getWorkspaceTeamId as Y, createSlackDestination as Yt, findUserByEmail as Z, requireSlackDestination as Zt, deleteWorkspace as _, createPluginState as _t, getPluginRoutes as a, STOP_WATCHING_TOOL_NAME as at, listWorkspaces as b, createPluginLogger as bt, getPluginTools as c, collectResourceEventMatchKeys as ct, setPlugins as d, findMatchingResourceEventSubscriptions as dt, updateViewerDisplayName as et, validatePlugins as f, listResourceEventSubscriptions as ft, createWorkspace as g, setDashboardConversationLinkOptions as gt, setBriefsConfig as h, getDashboardTaskLink as ht, getPluginApiRoutes as i, RESOURCE_WATCH_TOOL_SOURCE as it, workspaceRepoCheckoutPath as j, authenticationUnlinkedEvent as jt, getWorkspaceSnapshotBuilder as k, agentsInstructionsUpdatedEvent as kt, getPluginUserPromptContributions as l, createResourceEventSubscription as lt, registration_exports as m, getDashboardConversationLink as mt, applyPluginFormatMarkdown as n, RESOURCE_SUBSCRIPTION_DEFAULT_TTL_MS as nt, getPluginSlackConversationLink as o, cancelResourceEventSubscription as ot, coreTaskRegistrations as p, JUNIOR_THREAD_STATE_TTL_MS as pt, runWithSlackInstallationToken as q, upsertIdentity as qt, createPluginHookRunner as r, RESOURCE_SUBSCRIPTION_MAX_TTL_MS as rt, getPluginSystemPromptContributions as s, cancelSubscriptions as st, agent_hooks_exports as t, getSlackToolContext as tt, getPlugins as u, deliverResourceEventSubscription as ut, getWorkspace as v, createPluginEmbedder as vt, loadSnapshotsForProfile as w, buildSentryConversationUrl as wt, updateWorkspace as x, createPluginConversationEvents as xt, getWorkspaceByName as y, createPluginModel as yt, SlackActionError as z, withConversationEventLock as zt };
+export { resolveViewerUser as $, parseSessionSource as $t, tryWorkspaceRepoCheckoutPath as A, createPluginConversationEvents as At, downloadPrivateSlackFile as B, authenticationUnlinkedEvent as Bt, invalidateReadySnapshot as C, conversationArchivedForEmail as Ct, SANDBOX_RUNTIME as D, conversationNotArchivedForEmail as Dt, setWorkspaceSnapshotBuild as E, conversationHasParticipantUser as Et, bindSlackDirectCredentialSubject as F, listConversationAnnotations as Ft, isDmChannel as G, getDb as Gt, getHeaderString as H, getConversationEventStore as Ht, verifyEventAutomationCredentialSubject as I, listConversationAnnotationsById as It, withSlackRetries as J, withConversationEventLock as Jt, normalizeSlackConversationId as K, getSqlExecutor as Kt, verifyScheduledAutomationCredentialSubject as L, JUNIOR_NATIVE_EVENT_NAMESPACE as Lt, resolveChannelCapabilities as M, readConversationEventPage as Mt, bindEventAutomationCredentialSubject as N, buildSentryConversationUrl as Nt, deleteWorkspaceSnapshotBuilders as O, conversationNotArchivedForUser as Ot, bindScheduledAutomationCredentialSubject as P, resolveRootVisibility as Pt, readActorIdentity as Q, bindProviderConversation as Qt, verifySlackDirectCredentialSubject as R, agentsInstructionsUpdatedEvent as Rt, WorkspaceValidationError as S, conversationArchiveTimes as St, setWorkspaceSnapshot as T, conversationHasParticipantEmail as Tt, getSlackClient as U, getConversationMessageSearchStore as Ut, getFilePermalink as V, db_exports as Vt, isConversationScopedChannel as W, getConversationStore as Wt, runWithWorkspaceTeamId as X, withConversationMutationLock as Xt, getWorkspaceTeamId as Y, sanitizePostgresJson as Yt, findUserByEmail as Z, locationFromRow as Zt, deleteWorkspace as _, createPluginState as _t, getPluginRoutes as a, parseDestination as an, STOP_WATCHING_TOOL_NAME as at, listWorkspaces as b, createPluginLogger as bt, getPluginTools as c, collectEventMatchKeys as ct, setPlugins as d, findMatchingWatches as dt, resolveRootConversationId as en, updateViewerDisplayName as et, validatePlugins as f, listWatches as ft, createWorkspace as g, setDashboardConversationLinkOptions as gt, setBriefsConfig as h, getDashboardTaskLink as ht, getPluginApiRoutes as i, createSlackDestination as in, RESOURCE_WATCH_TOOL_SOURCE as it, workspaceRepoCheckoutPath as j, readLatestConversationBrief as jt, getWorkspaceSnapshotBuilder as k, viewerConversationMembership as kt, getPluginUserPromptContributions as l, createWatch as lt, registration_exports as m, getDashboardConversationLink as mt, applyPluginFormatMarkdown as n, upsertIdentity as nn, RESOURCE_SUBSCRIPTION_DEFAULT_TTL_MS as nt, getPluginSlackConversationLink as o, requireSlackDestination as on, cancelSubscriptions as ot, coreTaskRegistrations as p, JUNIOR_THREAD_STATE_TTL_MS as pt, runWithSlackInstallationToken as q, createSqlConversationEventStore as qt, createPluginHookRunner as r, upsertLinkedIdentity as rn, RESOURCE_SUBSCRIPTION_MAX_TTL_MS as rt, getPluginSystemPromptContributions as s, sameDestination as sn, cancelWatch as st, agent_hooks_exports as t, deleteProviderIdentityForSlackUser as tn, getSlackToolContext as tt, getPlugins as u, deliverWatch as ut, getWorkspace as v, createPluginEmbedder as vt, loadSnapshotsForProfile as w, conversationArchivedForUser as wt, updateWorkspace as x, readConversationAccessFromSql as xt, getWorkspaceByName as y, createPluginModel as yt, SlackActionError as z, authenticationLinkedEvent as zt };