@sentry/junior 0.223.0 → 0.225.0

package/dist/credential-sync-DCB2SwnQ.js

@@ -0,0 +1,940 @@
+import { C as resolvePluginOAuthAccount, D as lookupSlackUserProfile, V as getMcpProviderErrorAttributes, _ as putMcpStoredOAuthCredentials, at as parseOAuthStatePayload, b as getConversationPendingAuth, d as deleteMcpAuthSession, g as getMcpStoredOAuthCredentials, h as getMcpAuthSession, it as formatProviderLabel, mt as postSlackMessage, ot as resolveBaseUrl, u as finalizeMcpAuthorization, vt as createUserTokenStore } from "./agent-runner-Cad1RtWn.js";
+import { m as escapeXml } from "./client-ihmkx60d.js";
+import { d as logException, h as runBestEffort, p as logWarn } from "./logging-CcTvYQ8A.js";
+import { n as botConfig, o as getRuntimeMetadata } from "./config-DMg679BW.js";
+import { g as parseSlackUserId } from "./context-Bplcgypl.js";
+import { Jt as getSqlExecutor, U as getSlackClient, Wt as getConversationEventStore, ln as upsertIdentity, un as upsertLinkedIdentity } from "./agent-hooks-CRuRcOg9.js";
+import { i as homeDir } from "./package-discovery-7a9YqLhE.js";
+import { n as buildOAuthTokenRequest, r as parseOAuthTokenResponse, u as hasRequiredOAuthScope } from "./registry-C8I4IejN.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-pv4grNNb.js";
+import { t as discoverSkills } from "./skills-DUcDEgDI.js";
+import { B as recordAuthorizationCompleted, n as loadTurnCheckpoint, o as failTurnRecord, s as getTurnRecord, z as recordAuthenticationLinked } from "./checkpoint-6fkAdB3g.js";
+import { E as acquireActiveLock, w as getStateAdapter } from "./profile-CV97YuiL.js";
+import { Pt as requestConversationWork, wt as ensureConversationWake } from "./stats-DawHjcTw.js";
+import { t as getVercelConversationWorkQueue } from "./vercel-queue-DIkVcfK4.js";
+import { r as getPersistedThreadState, s as coerceThreadConversationState } from "./thread-state-CAR6gdAm.js";
+import { n as resolveTurnSessionRouting } from "./turn-session-routing-Jkmmxpp-.js";
+import { n as relayLocalOAuthCallback } from "./oauth-relay-CdCnu80W.js";
+import { n as deleteWebAuthorization } from "./web-authorization-B09B8A8R.js";
+import path from "node:path";
+import { z } from "zod";
+import { createHmac, createSecretKey, timingSafeEqual } from "node:crypto";
+import { pluginStoredTokensSchema } from "@sentry/junior-plugin-api";
+import fs from "node:fs";
+//#region src/chat/task-execution/authorized-turn.ts
+/**
+* OAuth callbacks save readiness, not agent history. The conversation worker
+* consumes this event under its lease before it resumes the paused Turn.
+*/
+const authorizationSchema = z.object({
+	kind: z.enum(["mcp", "plugin"]),
+	provider: z.string().min(1),
+	actorId: z.string().min(1),
+	authorizationId: z.string().min(1),
+	authSessionId: z.string().optional(),
+	scope: z.string().optional(),
+	configuration: z.record(z.string(), z.unknown()).optional(),
+	toolChannelId: z.string().optional()
+});
+function authorizationKey(turn) {
+	return `turn:${turn.turnId}:authorization:${turn.version}`;
+}
+/** Save authorization for this parked boundary without changing model history. */
+async function recordTurnAuthorization(args) {
+	const turn = await getTurnRecord(args.conversationId, args.turnId);
+	if (!turn || turn.state !== "paused" || turn.resumeReason !== "auth") return;
+	await getConversationEventStore().append(args.conversationId, [{
+		idempotencyKey: authorizationKey(turn),
+		createdAtMs: Date.now(),
+		data: {
+			type: "structured_event",
+			namespace: "junior",
+			name: "turn_authorized",
+			version: 1,
+			turnId: turn.turnId,
+			content: authorizationSchema.parse(args)
+		}
+	}], { activity: "preserve" });
+	return {
+		conversationId: args.conversationId,
+		destination: args.destination,
+		turnId: turn.turnId,
+		expectedVersion: turn.version
+	};
+}
+/** Read authorization for the exact pause; a later auth pause needs its own callback. */
+async function getTurnAuthorization(turn) {
+	const event = await getConversationEventStore().loadByIdempotencyKey(turn.conversationId, authorizationKey(turn));
+	if (event?.data.type !== "structured_event") return void 0;
+	return authorizationSchema.parse(event.data.content);
+}
+//#endregion
+//#region src/chat/task-execution/turn-wake.ts
+/** Build the worker input for a paused turn. */
+async function getPausedTurnRequest(args) {
+	const turn = (await loadTurnCheckpoint({
+		conversationId: args.conversationId,
+		turnId: args.turnId
+	})).record;
+	if (!turn || turn.state !== "paused" || turn.resumeReason !== "timeout" && turn.resumeReason !== "yield" && turn.resumeReason !== "retry" && !(turn.resumeReason === "auth" && await getTurnAuthorization(turn)) || turn.resumeReason === "timeout" && turn.sliceId < 2) return;
+	let routing;
+	try {
+		routing = await resolveTurnSessionRouting({
+			conversationId: args.conversationId,
+			conversationStore: args.conversationStore
+		});
+	} catch (error) {
+		await failTurnRecord({
+			conversationId: args.conversationId,
+			expectedVersion: turn.version,
+			turnId: args.turnId,
+			errorMessage: error instanceof Error ? error.message : String(error)
+		});
+		return;
+	}
+	return {
+		conversationId: args.conversationId,
+		destination: routing.destination,
+		turnId: args.turnId,
+		expectedVersion: turn.version
+	};
+}
+/** Wake the conversation worker for a paused turn. */
+async function wakePausedTurn(request, options = {}) {
+	const nowMs = options.nowMs ?? Date.now();
+	await requestConversationWork({
+		conversationId: request.conversationId,
+		destination: request.destination,
+		nowMs,
+		state: options.state
+	});
+	const queue = options.queue ?? getVercelConversationWorkQueue();
+	await ensureConversationWake({
+		conversationId: request.conversationId,
+		idempotencyKey: [
+			"agent-continue",
+			request.conversationId,
+			request.turnId,
+			request.expectedVersion,
+			nowMs
+		].join(":"),
+		nowMs,
+		queue,
+		state: options.state
+	});
+}
+/** Create paused Turn operations for one app. */
+function createPausedTurns(options = {}) {
+	return {
+		get: (args) => getPausedTurnRequest({
+			...args,
+			conversationStore: options.conversationStore
+		}),
+		wake: (request) => wakePausedTurn(request, options)
+	};
+}
+/** Record completed authorization and wake the sole execution owner. */
+async function wakeAuthorizedTurn(args, queue) {
+	const request = await recordTurnAuthorization(args);
+	if (request) await wakePausedTurn(request, { queue });
+}
+//#endregion
+//#region src/handlers/oauth-html.ts
+/** Build pre-escaped callback HTML with the shared response security policy. */
+function htmlCallbackResponse(title, message, status, options = {}) {
+	const footerMessage = options.footerMessage ?? `You can close this tab and return to ${botConfig.userName}.`;
+	const isSuccess = status >= 200 && status < 300;
+	const statusClass = isSuccess ? "success" : "error";
+	const statusIcon = isSuccess ? "" : "!";
+	const html = `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="color-scheme" content="light dark">
+  <title>${title}</title>
+  <style>
+    :root {
+      color-scheme: light dark;
+      --canvas: #f4f1fa;
+      --surface: #ffffff;
+      --text: #211a2c;
+      --muted: #6e6479;
+      --border: #ded7e8;
+      --accent: #6c5fc7;
+      --success: #16835c;
+      --success-soft: #ddf5ea;
+      --error: #bc3d50;
+      --error-soft: #fce7eb;
+      --shadow: 0 24px 64px rgba(45, 31, 63, 0.14);
+    }
+
+    * { box-sizing: border-box; }
+
+    body {
+      min-height: 100vh;
+      margin: 0;
+      display: grid;
+      place-items: center;
+      padding: 24px;
+      background: var(--canvas);
+      color: var(--text);
+      font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+    }
+
+    main {
+      width: min(100%, 480px);
+      padding: 48px 40px 40px;
+      text-align: center;
+      background: var(--surface);
+      border: 1px solid var(--border);
+      border-radius: 24px;
+      box-shadow: var(--shadow);
+    }
+
+    .brand {
+      display: inline-flex;
+      align-items: center;
+      gap: 8px;
+      margin-bottom: 32px;
+      color: var(--muted);
+      font-size: 14px;
+      font-weight: 700;
+      letter-spacing: 0.08em;
+      text-transform: uppercase;
+    }
+
+    .brand-mark {
+      width: 10px;
+      height: 10px;
+      background: var(--accent);
+      border-radius: 3px;
+      transform: rotate(12deg);
+    }
+
+    .status {
+      width: 64px;
+      height: 64px;
+      margin: 0 auto 24px;
+      display: grid;
+      place-items: center;
+      border-radius: 20px;
+      font-size: 32px;
+      font-weight: 750;
+      line-height: 1;
+    }
+
+    .status.success { color: var(--success); background: var(--success-soft); }
+    .status.success::before {
+      content: "";
+      width: 12px;
+      height: 24px;
+      margin-top: -5px;
+      border-right: 4px solid currentColor;
+      border-bottom: 4px solid currentColor;
+      transform: rotate(45deg);
+    }
+    .status.error { color: var(--error); background: var(--error-soft); }
+
+    h1 {
+      margin: 0;
+      font-size: clamp(28px, 7vw, 36px);
+      line-height: 1.12;
+      letter-spacing: -0.035em;
+    }
+
+    .message {
+      margin: 16px auto 0;
+      color: var(--muted);
+      font-size: 17px;
+      line-height: 1.6;
+    }
+
+    .footer {
+      margin: 32px 0 0;
+      padding-top: 24px;
+      color: var(--muted);
+      border-top: 1px solid var(--border);
+      font-size: 14px;
+      line-height: 1.5;
+    }
+
+    @media (prefers-color-scheme: dark) {
+      :root {
+        --canvas: #15121a;
+        --surface: #211c28;
+        --text: #f6f1fb;
+        --muted: #b8adbf;
+        --border: #3a3243;
+        --accent: #a99af0;
+        --success: #72d6ad;
+        --success-soft: #193c30;
+        --error: #ff9aaa;
+        --error-soft: #48262e;
+        --shadow: 0 24px 64px rgba(0, 0, 0, 0.36);
+      }
+    }
+
+    @media (max-width: 520px) {
+      body { padding: 16px; }
+      main { padding: 40px 24px 32px; border-radius: 20px; }
+    }
+  </style>
+</head>
+<body>
+  <main>
+    <div class="brand"><span class="brand-mark" aria-hidden="true"></span>${botConfig.userName}</div>
+    <div class="status ${statusClass}" aria-hidden="true">${statusIcon}</div>
+    <h1>${title}</h1>
+    <p class="message">${message}</p>
+    <p class="footer">${footerMessage}</p>
+  </main>
+</body>
+</html>`;
+	return new Response(html, {
+		status,
+		headers: {
+			"Cache-Control": "no-store",
+			"Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'",
+			"Content-Type": "text/html; charset=utf-8",
+			"Referrer-Policy": "no-referrer",
+			"X-Content-Type-Options": "nosniff"
+		}
+	});
+}
+//#endregion
+//#region src/handlers/mcp-oauth-callback.ts
+/**
+* MCP OAuth callback handler.
+*
+* Public signed callbacks relay to the owning CLI. The loopback callback
+* finalizes local MCP authorization and leaves continuation to that CLI.
+* Slack callbacks save authorization readiness and wake the conversation
+* worker. Only that worker can change agent history or resume the Turn.
+*/
+function callbackPages(botName) {
+	return {
+		missing_state: {
+			title: "Authorization failed",
+			message: "Missing state parameter.",
+			status: 400
+		},
+		provider_error: {
+			title: "Authorization failed",
+			message: "The provider returned an authorization error.",
+			status: 400
+		},
+		missing_code: {
+			title: "Authorization failed",
+			message: "Missing code parameter.",
+			status: 400
+		},
+		expired: {
+			title: "Authorization expired",
+			message: `This authorization link is no longer active. Return to ${botName} and retry the original request.`,
+			status: 400
+		},
+		success: {
+			title: "Authorization complete",
+			message: `Your MCP access is connected. ${botName} will continue the paused request.`,
+			status: 200
+		},
+		failure: {
+			title: "Authorization failed",
+			message: `${botName} could not finish the authorization callback. Return to ${botName} and retry the original request.`,
+			status: 500
+		}
+	};
+}
+var McpOAuthAttemptExpiredError = class extends Error {
+	constructor() {
+		super("MCP OAuth authorization attempt is no longer current");
+		this.name = "McpOAuthAttemptExpiredError";
+	}
+};
+function mcpAuthorizationId(args) {
+	return `${args.sessionId}:mcp:${args.provider}`;
+}
+function htmlResponse(kind, options) {
+	const botName = botConfig.userName;
+	const pages = callbackPages(botName);
+	const page = kind === "success" && options?.local ? {
+		...pages.success,
+		message: `Your MCP access is connected. ${botName} will continue the paused request in the local client.`
+	} : pages[kind];
+	const footerMessage = kind === "success" && !options?.local ? `You can close this tab and return to ${botName}.` : void 0;
+	return htmlCallbackResponse(page.title, page.message, page.status, { footerMessage });
+}
+/** Queue the exact MCP authorization attempt without changing thread state. */
+async function wakeAuthorizedMcpTurn(args) {
+	const { authSession, provider } = args;
+	if (!authSession.destination) return;
+	await wakeAuthorizedTurn({
+		conversationId: authSession.conversationId,
+		destination: authSession.destination,
+		turnId: authSession.sessionId,
+		kind: "mcp",
+		provider,
+		actorId: authSession.userId,
+		authSessionId: authSession.authSessionId,
+		configuration: authSession.configuration,
+		toolChannelId: authSession.toolChannelId,
+		authorizationId: mcpAuthorizationId({
+			provider,
+			sessionId: authSession.sessionId
+		})
+	}, args.queue);
+}
+async function isCurrentMcpAuthorizationAttempt(authSession, provider) {
+	const conversationId = mcpConversationId(authSession);
+	if (!conversationId) return false;
+	const currentState = await getPersistedThreadState(conversationId);
+	const conversation = coerceThreadConversationState(currentState);
+	const pendingAuth = getConversationPendingAuth({
+		conversation,
+		kind: "mcp",
+		provider,
+		actorId: authSession.userId
+	});
+	return pendingAuth?.authSessionId === authSession.authSessionId && pendingAuth.sessionId === authSession.sessionId;
+}
+function mcpConversationId(authSession) {
+	if (authSession.destination?.platform === "local" || authSession.source?.kind === "web") return authSession.conversationId;
+	if (authSession.channelId && authSession.threadTs) return `slack:${authSession.channelId}:${authSession.threadTs}`;
+}
+/** Commit one shared credential mutation only while this attempt owns the thread. */
+async function runCurrentMcpCredentialMutation(authSession, provider, mutation) {
+	const conversationId = mcpConversationId(authSession);
+	if (!conversationId) throw new McpOAuthAttemptExpiredError();
+	const stateAdapter = getStateAdapter();
+	await stateAdapter.connect();
+	const lock = await acquireActiveLock(stateAdapter, conversationId);
+	if (!lock) throw new Error(`Could not acquire MCP OAuth callback lock for ${conversationId}`);
+	try {
+		if (!await isCurrentMcpAuthorizationAttempt(authSession, provider)) throw new McpOAuthAttemptExpiredError();
+		return await mutation();
+	} finally {
+		await stateAdapter.releaseLock(lock);
+	}
+}
+/** Exchange MCP credentials and queue the authorized Turn before reporting success. */
+async function GET$1(request, provider, waitUntil, options) {
+	const localRelay = await relayLocalOAuthCallback(request);
+	if (localRelay) return localRelay;
+	const url = new URL(request.url);
+	const state = url.searchParams.get("state")?.trim();
+	const code = url.searchParams.get("code")?.trim();
+	const error = url.searchParams.get("error")?.trim();
+	if (!state) return htmlResponse("missing_state");
+	if (error) {
+		try {
+			const pendingSession = await getMcpAuthSession(state);
+			if (pendingSession && pendingSession.provider === provider) {
+				try {
+					await runCurrentMcpCredentialMutation(pendingSession, provider, async () => {
+						const credentials = await getMcpStoredOAuthCredentials(pendingSession.userId, provider);
+						if (!credentials?.clientInformation && !credentials?.discoveryState) return;
+						const nextCredentials = credentials.tokens ? { tokens: credentials.tokens } : {};
+						await putMcpStoredOAuthCredentials(pendingSession.userId, provider, nextCredentials);
+					});
+				} catch (cleanupError) {
+					if (!(cleanupError instanceof McpOAuthAttemptExpiredError)) logException(cleanupError, "mcp.oauth_callback.provider_error_cleanup.failed", { "app.credential.provider": provider });
+				}
+				await deleteMcpAuthSession(pendingSession.authSessionId);
+			}
+		} catch (cleanupError) {
+			logException(cleanupError, "mcp.oauth_callback.provider_error_cleanup.failed", { "app.credential.provider": provider });
+		}
+		return htmlResponse("provider_error");
+	}
+	if (!code) return htmlResponse("missing_code");
+	try {
+		const pendingSession = await getMcpAuthSession(state);
+		if (!pendingSession || pendingSession.provider !== provider || !await isCurrentMcpAuthorizationAttempt(pendingSession, provider)) {
+			if (pendingSession) await deleteMcpAuthSession(pendingSession.authSessionId);
+			return htmlResponse("expired");
+		}
+		const authSession = await finalizeMcpAuthorization(provider, state, code, async (mutation) => await runCurrentMcpCredentialMutation(pendingSession, provider, mutation));
+		let providerLabel;
+		try {
+			providerLabel = formatProviderLabel(provider);
+		} catch {
+			providerLabel = void 0;
+		}
+		try {
+			await recordAuthenticationLinked({
+				conversationId: authSession.conversationId,
+				provider,
+				actorId: authSession.userId,
+				authorizationId: mcpAuthorizationId({
+					provider,
+					sessionId: authSession.sessionId
+				}),
+				turnId: authSession.sessionId,
+				...providerLabel ? { providerLabel } : void 0
+			});
+		} catch (error) {
+			logException(error, "mcp.oauth_callback.authentication_event.failed", { "app.credential.provider": provider });
+		}
+		try {
+			await deleteMcpAuthSession(authSession.authSessionId);
+		} catch (cleanupError) {
+			logException(cleanupError, "mcp.oauth_callback.session_cleanup.failed", { "app.credential.provider": provider });
+		}
+		if (authSession.source?.kind === "web" && authSession.destination) waitUntil(async () => {
+			const turn = await getTurnRecord(authSession.conversationId, authSession.sessionId);
+			await deleteWebAuthorization({
+				actorId: authSession.userId,
+				conversationId: authSession.conversationId
+			});
+			if (!turn || turn.state !== "paused" || turn.resumeReason !== "auth") return;
+			await recordAuthorizationCompleted({
+				conversationId: authSession.conversationId,
+				kind: "mcp",
+				provider,
+				actorId: authSession.userId,
+				authorizationId: mcpAuthorizationId({
+					provider,
+					sessionId: authSession.sessionId
+				})
+			});
+			await wakePausedTurn({
+				conversationId: authSession.conversationId,
+				destination: authSession.destination,
+				turnId: authSession.sessionId,
+				expectedVersion: turn.version
+			}, options.conversationWorkQueue ? { queue: options.conversationWorkQueue } : void 0);
+		});
+		else if (authSession.destination?.platform !== "local") await wakeAuthorizedMcpTurn({
+			authSession,
+			queue: options.conversationWorkQueue,
+			provider
+		});
+		return htmlResponse("success", { local: authSession.destination?.platform === "local" && authSession.source?.kind !== "web" });
+	} catch (callbackError) {
+		if (callbackError instanceof McpOAuthAttemptExpiredError) {
+			await deleteMcpAuthSession(state);
+			return htmlResponse("expired");
+		}
+		logException(callbackError, "mcp.oauth_callback.failed", {
+			"app.credential.provider": provider,
+			...getMcpProviderErrorAttributes(callbackError)
+		});
+		return htmlResponse("failure");
+	}
+}
+//#endregion
+//#region src/chat/slack/app-home.ts
+const DEFAULT_DESCRIPTION_TEXT = "I help your team investigate, summarize, and act on work in Slack.";
+const MAX_HOME_SKILLS = 6;
+const MAX_SECTION_TEXT_CHARS = 3e3;
+const HIDDEN_HOME_SKILLS = /* @__PURE__ */ new Set(["jr-rpc"]);
+function clampSectionText(text) {
+	if (text.length <= MAX_SECTION_TEXT_CHARS) return text;
+	return `${text.slice(0, 2999)}…`;
+}
+function loadDescriptionText() {
+	const descriptionPath = path.join(homeDir(), "DESCRIPTION.md");
+	try {
+		const raw = fs.readFileSync(descriptionPath, "utf8").trim();
+		if (raw.length > 0) return clampSectionText(raw);
+	} catch {}
+	return DEFAULT_DESCRIPTION_TEXT;
+}
+async function buildSkillsSummaryText() {
+	const skills = (await discoverSkills()).filter((skill) => !HIDDEN_HOME_SKILLS.has(skill.name));
+	if (skills.length === 0) return "No skills installed.";
+	const visible = skills.slice(0, MAX_HOME_SKILLS);
+	const lines = visible.map((skill) => `• *${skill.name}* — ${skill.description}`);
+	if (skills.length > visible.length) lines.push(`• …and ${skills.length - visible.length} more`);
+	return lines.join("\n");
+}
+function accountLabel(account) {
+	const label = account.label ?? account.id;
+	return account.url ? `<${account.url}|${label}>` : label;
+}
+function connectedAccountText(plugin, account) {
+	return account ? `*${plugin.manifest.name}*\nConnected as ${accountLabel(account)}` : `*${plugin.manifest.name}*\n${plugin.manifest.description}`;
+}
+async function connectedOAuthTokens(userId, plugin, userTokenStore) {
+	if (plugin.manifest.oauth || plugin.manifest.credentials) {
+		const stored = await userTokenStore.get(userId, plugin.manifest.name);
+		return stored && hasRequiredOAuthScope(stored.scope, plugin.manifest.oauth?.scope) ? stored : void 0;
+	}
+}
+async function hasConnectedMcpAccount(userId, plugin) {
+	if (!plugin.manifest.mcp) return false;
+	const credentials = await getMcpStoredOAuthCredentials(userId, plugin.manifest.name);
+	return Boolean(credentials?.tokens || credentials?.clientInformation || credentials?.discoveryState);
+}
+/** Build the Slack App Home tab view showing skills, connected accounts, and version. */
+async function buildHomeView(userId, userTokenStore) {
+	const runtimeMetadata = getRuntimeMetadata();
+	const descriptionText = loadDescriptionText();
+	const skillsSummaryText = await buildSkillsSummaryText();
+	const providers = pluginCatalogRuntime.getProviders();
+	const connectedSections = [];
+	for (const plugin of providers) {
+		const tokens = await connectedOAuthTokens(userId, plugin, userTokenStore);
+		if (!tokens && !await hasConnectedMcpAccount(userId, plugin)) continue;
+		connectedSections.push({
+			type: "section",
+			text: {
+				type: "mrkdwn",
+				text: connectedAccountText(plugin, tokens?.account)
+			},
+			accessory: {
+				type: "button",
+				text: {
+					type: "plain_text",
+					text: "Unlink"
+				},
+				action_id: "app_home_disconnect",
+				value: plugin.manifest.name,
+				style: "danger"
+			}
+		});
+	}
+	const accountBlocks = connectedSections.length > 0 ? connectedSections : [{
+		type: "section",
+		text: {
+			type: "mrkdwn",
+			text: "No connected accounts"
+		}
+	}];
+	return {
+		type: "home",
+		blocks: [
+			{
+				type: "header",
+				text: {
+					type: "plain_text",
+					text: "Junior"
+				}
+			},
+			{
+				type: "section",
+				text: {
+					type: "mrkdwn",
+					text: descriptionText
+				}
+			},
+			{ type: "divider" },
+			{
+				type: "header",
+				text: {
+					type: "plain_text",
+					text: "What I can help with"
+				}
+			},
+			{
+				type: "section",
+				text: {
+					type: "mrkdwn",
+					text: skillsSummaryText
+				}
+			},
+			{ type: "divider" },
+			{
+				type: "header",
+				text: {
+					type: "plain_text",
+					text: "Connected accounts"
+				}
+			},
+			...accountBlocks,
+			{
+				type: "context",
+				elements: [{
+					type: "mrkdwn",
+					text: `*junior version:* \`${runtimeMetadata.version ?? "unknown"}\``
+				}]
+			}
+		]
+	};
+}
+/** Publish the App Home view to a specific Slack user. */
+async function publishAppHomeView(slackClient, userId, userTokenStore) {
+	const view = await buildHomeView(userId, userTokenStore);
+	await slackClient.views.publish({
+		user_id: userId,
+		view
+	});
+}
+//#endregion
+//#region src/handlers/oauth-callback.ts
+/**
+* OAuth callbacks exchange and store credentials. Public signed callbacks
+* relay to the owning CLI, which controls local continuation. Slack callbacks
+* save readiness and wake the conversation worker. They do not run the agent
+* or change its history.
+*/
+function htmlErrorResponse(title, message, status) {
+	return htmlCallbackResponse(escapeXml(title), escapeXml(message), status);
+}
+function oauthTokenErrorAttributes(provider, endpoint, status) {
+	return {
+		"app.credential.provider": provider,
+		"app.oauth.error.phase": "token_exchange",
+		"server.address": new URL(endpoint).hostname,
+		...status !== void 0 ? { "http.response.status_code": status } : void 0
+	};
+}
+function pluginAuthorizationId(args) {
+	return `${args.sessionId}:plugin:${args.provider}`;
+}
+/** Queue the pending Turn, including a newer Turn that reused this auth link. */
+async function wakeAuthorizedPluginTurn(stored, options) {
+	if (!stored.resumeConversationId || !stored.resumeSessionId || !stored.destination) return;
+	const conversation = coerceThreadConversationState(await getPersistedThreadState(stored.resumeConversationId));
+	const turnId = getConversationPendingAuth({
+		conversation,
+		kind: "plugin",
+		provider: stored.provider,
+		actorId: stored.userId,
+		...stored.scope ? { scope: stored.scope } : void 0
+	})?.sessionId ?? stored.resumeSessionId;
+	await wakeAuthorizedTurn({
+		conversationId: stored.resumeConversationId,
+		destination: stored.destination,
+		turnId,
+		kind: "plugin",
+		provider: stored.provider,
+		actorId: stored.userId,
+		scope: stored.scope,
+		authorizationId: pluginAuthorizationId({
+			provider: stored.provider,
+			sessionId: turnId
+		})
+	}, options.conversationWorkQueue);
+}
+/** Complete provider authorization and queue any paused Slack Turn. */
+async function GET(request, provider, waitUntil, options) {
+	const localRelay = await relayLocalOAuthCallback(request);
+	if (localRelay) return localRelay;
+	const providerConfig = pluginCatalogRuntime.getOAuthConfig(provider);
+	if (!providerConfig) return htmlErrorResponse("Unknown provider", "The OAuth provider in this link is not recognized.", 404);
+	const providerLabel = formatProviderLabel(provider);
+	const url = new URL(request.url);
+	const errorParam = url.searchParams.get("error");
+	const code = url.searchParams.get("code");
+	const state = url.searchParams.get("state");
+	if (errorParam) {
+		if (state) await getStateAdapter().delete(`oauth-state:${state}`);
+		if (errorParam === "access_denied") return htmlErrorResponse("Authorization declined", `You declined the ${providerLabel} authorization request. Return to Junior and connect your ${providerLabel} account again if you change your mind.`, 400);
+		return htmlErrorResponse("Authorization failed", `${providerLabel} returned an error: ${errorParam}. Return to Junior and try again.`, 400);
+	}
+	if (!code || !state) return htmlErrorResponse("Invalid request", "This authorization link is missing required parameters.", 400);
+	const stateAdapter = getStateAdapter();
+	const stateKey = `oauth-state:${state}`;
+	const stored = parseOAuthStatePayload(await stateAdapter.get(stateKey));
+	if (!stored) return htmlErrorResponse("Link expired", `This authorization link has expired (links are valid for 10 minutes). Return to Junior and connect your ${providerLabel} account again to get a new link.`, 400);
+	if (stored.provider !== provider) return htmlErrorResponse("Provider mismatch", "This authorization link does not match the expected provider.", 400);
+	await stateAdapter.delete(stateKey);
+	const clientId = process.env[providerConfig.clientIdEnv]?.trim();
+	const clientSecret = process.env[providerConfig.clientSecretEnv]?.trim();
+	if (!clientId || !clientSecret) return htmlErrorResponse("Configuration error", "OAuth client credentials are not configured on the server.", 500);
+	const baseUrl = resolveBaseUrl();
+	if (!baseUrl) return htmlErrorResponse("Configuration error", "The server cannot determine its base URL.", 500);
+	const redirectUri = `${baseUrl}${providerConfig.callbackPath}`;
+	const requestedScope = stored.scope ?? providerConfig.scope;
+	let tokenResponse;
+	try {
+		const tokenRequest = buildOAuthTokenRequest({
+			clientId,
+			clientSecret,
+			payload: {
+				grant_type: "authorization_code",
+				code,
+				redirect_uri: redirectUri
+			},
+			tokenAuthMethod: providerConfig.tokenAuthMethod,
+			tokenExtraHeaders: providerConfig.tokenExtraHeaders
+		});
+		tokenResponse = await fetch(providerConfig.tokenEndpoint, {
+			method: "POST",
+			headers: tokenRequest.headers,
+			body: tokenRequest.body
+		});
+	} catch {
+		logWarn("oauth.token_exchange.failed", oauthTokenErrorAttributes(provider, providerConfig.tokenEndpoint));
+		return htmlErrorResponse("Connection failed", "Failed to exchange the authorization code. Please try again.", 500);
+	}
+	if (!tokenResponse.ok) {
+		logWarn("oauth.token_exchange.failed", oauthTokenErrorAttributes(provider, providerConfig.tokenEndpoint, tokenResponse.status));
+		return htmlErrorResponse("Connection failed", "The token exchange with the provider failed. Please try again.", 500);
+	}
+	let parsedTokenResponse;
+	try {
+		const tokenData = await tokenResponse.json();
+		parsedTokenResponse = parseOAuthTokenResponse(tokenData, requestedScope, { treatEmptyScopeAsUnreported: providerConfig.treatEmptyScopeAsUnreported });
+	} catch {
+		logWarn("oauth.token_exchange.failed", oauthTokenErrorAttributes(provider, providerConfig.tokenEndpoint, tokenResponse.status));
+		return htmlErrorResponse("Connection failed", "The provider returned an incomplete token response. Please try again.", 500);
+	}
+	if (!hasRequiredOAuthScope(parsedTokenResponse.scope, requestedScope)) return htmlErrorResponse("Connection failed", `The ${providerLabel} authorization did not grant the access Junior requires. Return to Junior and connect your ${providerLabel} account again.`, 400);
+	const userTokenStore = createUserTokenStore();
+	let account;
+	try {
+		account = await resolvePluginOAuthAccount({
+			provider,
+			tokens: parsedTokenResponse
+		});
+	} catch {
+		return htmlErrorResponse("Connection failed", `Junior could not verify the connected ${providerLabel} account. Please try again.`, 500);
+	}
+	await userTokenStore.set(stored.userId, provider, {
+		...parsedTokenResponse,
+		...account ? { account } : void 0
+	});
+	const slackActor = stored.actor?.platform === "slack" ? stored.actor : void 0;
+	if (account && slackActor) await runBestEffort(async () => {
+		const slackUserId = parseSlackUserId(slackActor.userId);
+		if (!slackUserId) throw new Error("OAuth Slack actor user id is invalid");
+		const profile = await lookupSlackUserProfile(slackUserId);
+		const slackIdentity = await upsertIdentity(getSqlExecutor(), {
+			kind: "user",
+			provider: "slack",
+			providerTenantId: slackActor.teamId,
+			providerSubjectId: profile.id,
+			displayName: profile.real_name || profile.display_name,
+			handle: profile.name,
+			...profile.email ? {
+				email: profile.email,
+				emailVerified: true
+			} : void 0
+		});
+		if (!slackIdentity.userId) throw new Error("OAuth Slack identity is not linked to a user");
+		await upsertLinkedIdentity(getSqlExecutor(), slackIdentity.userId, {
+			kind: "user",
+			provider,
+			providerSubjectId: account.id,
+			displayName: account.displayName,
+			handle: account.handle ?? account.label
+		});
+	}, "oauth.callback.identity_link.failed", { "app.credential.provider": provider });
+	const resumeConversationId = stored.resumeConversationId;
+	if (resumeConversationId) await runBestEffort(async () => {
+		await recordAuthenticationLinked({
+			conversationId: resumeConversationId,
+			provider,
+			actorId: stored.userId,
+			providerLabel,
+			...account?.label ? { accountLabel: account.label } : void 0,
+			...stored.resumeSessionId ? {
+				authorizationId: pluginAuthorizationId({
+					provider,
+					sessionId: stored.resumeSessionId
+				}),
+				turnId: stored.resumeSessionId
+			} : void 0
+		});
+	}, "oauth.callback.authentication_event.failed", { "app.credential.provider": provider });
+	if (stored.destination?.platform !== "local" && stored.source?.kind !== "web") waitUntil(async () => {
+		try {
+			await publishAppHomeView(getSlackClient(), stored.userId, userTokenStore);
+		} catch {}
+	});
+	const resumesWebTurn = Boolean(stored.source?.kind === "web" && stored.destination && stored.resumeConversationId && stored.resumeSessionId);
+	const resumesAgentTurn = Boolean(stored.destination?.platform !== "local" && stored.resumeConversationId && stored.resumeSessionId);
+	if (resumesWebTurn) waitUntil(async () => {
+		const turn = await getTurnRecord(stored.resumeConversationId, stored.resumeSessionId);
+		await deleteWebAuthorization({
+			actorId: stored.userId,
+			conversationId: stored.resumeConversationId
+		});
+		if (!turn || turn.state !== "paused" || turn.resumeReason !== "auth") return;
+		await recordAuthorizationCompleted({
+			conversationId: stored.resumeConversationId,
+			kind: "plugin",
+			provider: stored.provider,
+			actorId: stored.userId,
+			authorizationId: pluginAuthorizationId({
+				provider: stored.provider,
+				sessionId: stored.resumeSessionId
+			})
+		});
+		await wakePausedTurn({
+			conversationId: stored.resumeConversationId,
+			destination: stored.destination,
+			turnId: stored.resumeSessionId,
+			expectedVersion: turn.version
+		}, options.conversationWorkQueue ? { queue: options.conversationWorkQueue } : void 0);
+	});
+	else if (resumesAgentTurn) await wakeAuthorizedPluginTurn(stored, options);
+	else if (stored.channelId && stored.threadTs) {
+		const { channelId, threadTs } = stored;
+		waitUntil(() => postSlackMessage({
+			channelId,
+			threadTs,
+			text: `Your ${providerLabel} account is now connected. You can start using ${providerLabel} commands.`
+		}));
+	}
+	const botName = botConfig.userName;
+	const statusMessage = stored.destination?.platform === "local" && !resumesWebTurn ? `Your request is continuing in the local ${botName} client.` : resumesWebTurn ? `Your request is continuing in ${botName}.` : resumesAgentTurn ? "Your request is being processed in Slack." : `Your ${providerLabel} account is connected.`;
+	const footerMessage = stored.destination?.platform === "local" || resumesWebTurn ? `You can close this tab and return to ${botName}.` : "You can close this tab and return to Slack.";
+	return htmlCallbackResponse(escapeXml(`${providerLabel} account connected`), escapeXml(statusMessage), 200, { footerMessage: escapeXml(footerMessage) });
+}
+//#endregion
+//#region src/chat/local/credential-sync.ts
+const LOCAL_CREDENTIAL_SYNC_CONTEXT = "junior.local-credential-sync.v1";
+const LOCAL_CREDENTIAL_SYNC_MAX_AGE_MS = 6e4;
+const localCredentialSyncSchema = z.object({
+	createdAtMs: z.number().finite(),
+	provider: z.string().regex(/^[a-z][a-z0-9-]*$/),
+	tokens: pluginStoredTokensSchema
+}).strict();
+function syncSecret() {
+	const secret = process.env.JUNIOR_SECRET?.trim();
+	if (!secret) throw new Error("Local credential sync requires JUNIOR_SECRET");
+	return secret;
+}
+/** Sign one local credential payload in its own HMAC domain. */
+function signature(body) {
+	const signingKey = createSecretKey(Buffer.from(syncSecret(), "utf8"));
+	return createHmac("sha256", signingKey).update(`${LOCAL_CREDENTIAL_SYNC_CONTEXT}:${body}`).digest("base64url");
+}
+/** Compare credential signatures without leaking a matching prefix by timing. */
+function signaturesMatch(expected, actual) {
+	const expectedBuffer = Buffer.from(expected);
+	const actualBuffer = Buffer.from(actual);
+	return expectedBuffer.length === actualBuffer.length && timingSafeEqual(expectedBuffer, actualBuffer);
+}
+/** Copy a local user's provider credential to the loopback dev-server broker. */
+async function syncLocalOAuthCredential(provider, tokens) {
+	const body = JSON.stringify({
+		createdAtMs: Date.now(),
+		provider,
+		tokens
+	});
+	const port = process.env.PORT?.trim() || "3000";
+	const response = await fetch(`http://127.0.0.1:${port}/api/internal/local-oauth-credentials`, {
+		method: "POST",
+		headers: {
+			"content-type": "application/json",
+			"x-junior-local-credential-signature": signature(body)
+		},
+		body
+	});
+	if (!response.ok) throw new Error(`Could not sync local OAuth credential: HTTP ${response.status}`);
+}
+/** Verify and store one credential sent by the local CLI over loopback. */
+async function receiveLocalOAuthCredential(request) {
+	const hostname = new URL(request.url).hostname;
+	if (process.env.NODE_ENV !== "development" || hostname !== "127.0.0.1" && hostname !== "localhost") return new Response(null, { status: 404 });
+	const body = await request.text();
+	const actualSignature = request.headers.get("x-junior-local-credential-signature");
+	if (!actualSignature || !signaturesMatch(signature(body), actualSignature)) return Response.json({ error: "Unauthorized" }, { status: 401 });
+	let value;
+	try {
+		value = JSON.parse(body);
+	} catch {
+		return Response.json({ error: "Invalid request" }, { status: 400 });
+	}
+	const payload = localCredentialSyncSchema.safeParse(value);
+	if (!payload.success || Math.abs(Date.now() - payload.data.createdAtMs) > LOCAL_CREDENTIAL_SYNC_MAX_AGE_MS) return Response.json({ error: "Invalid request" }, { status: 400 });
+	await createUserTokenStore().set("local-cli", payload.data.provider, payload.data.tokens);
+	return new Response(null, { status: 204 });
+}
+//#endregion
+export { GET$1 as a, wakePausedTurn as c, publishAppHomeView as i, getTurnAuthorization as l, syncLocalOAuthCredential as n, createPausedTurns as o, GET as r, getPausedTurnRequest as s, receiveLocalOAuthCredential as t };