@sentry/junior 0.226.0 → 0.228.0

package/dist/app.js

@@ -1,28 +1,28 @@
-import { $t as renderTaskInput, A as collectAttachmentGarbage, B as scheduledAutomationRunAttributes, C as readPublicArtifact, Cn as slackEntitySchema, Ct as appendAndEnqueueInboundMessage, Ft as getConversation, G as listScheduledAutomationsForTeam, Ht as removeActiveConversation, It as getConversationWorkState, Jt as CONVERSATION_WORK_STALE_ENQUEUE_MS, Kt as stopConversationWork, Lt as hasRunnableConversationWork, M as requestAttachmentDeletion, Nn as getConfigDefaults, Ot as clearExpiredConversationLease, P as parseSlackThreadId, Pn as setConfigDefaults, Pt as ensureConversationWake, Q as scheduledRunSchema, Qt as isInvalidConversationRecordError, Rt as listActiveConversationIds, S as publicArtifactHeaders, Tn as createUserTokenStore, V as getNextRunAtMs, W as listScheduledAutomations, Wt as requestConversationWork, X as scheduledRunId, Xt as hasRunnableConversationWork$1, Y as saveScheduledAutomationInLock, Z as withScheduledAutomationLock, a as isExperimentalFeatureEnabled, an as SANDBOX_EGRESS_PROXY_PATH, bt as eventGuidance, cn as consumeSandboxEgressPermissionDeniedSignal, dn as formatProviderLabel, et as effectiveTaskOutcomes, f as deleteMcpAuthSessionsForUserProvider, gt as ingestEvent, ht as processWorkspaceSnapshotJob, i as getExperimentalFeatures, in as shouldPropagateSandboxEgressTrace, it as findMatchingEventAutomations, l as executeCredentialedEgressRequest, ln as parseSandboxEgressCredentialToken, m as deleteMcpStoredOAuthCredentials, mn as startOAuthFlow, nn as resolveSandboxEgressProviderForHost, o as setExperimentalFeatures, on as clearSandboxEgressSignals, p as deleteMcpServerSessionId, q as readScheduledAutomation, rn as normalizeSandboxEgressTracePropagationDomains, s as executeAgentRun, sn as consumeSandboxEgressAuthRequiredSignal, t as createAgentRunner, tt as collectEventAutomationMatchKeys, w as unpublishedArtifactHeaders, wn as slackExternalRefIdSchema, yt as getEventCatalog, z as logScheduledAutomationRunSkipped } from "./agent-runner-DEF7auSj.js";
-import { C as withLogContext, O as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE, S as withContext, d as logException, f as logInfo, j as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, p as logWarn, r as createRequestContext, v as setSpanAttributes, w as withSpan, y as setSpanStatus } from "./logging-CvjMHRvg.js";
+import { $ as collectEventAutomationMatchKeys, A as requestAttachmentDeletion, An as getConfigDefaults, Bt as removeActiveConversation, C as readPublicArtifact, Cn as createUserTokenStore, Et as clearExpiredConversationLease, Ft as hasRunnableConversationWork, G as readScheduledAutomation, H as listScheduledAutomations, Ht as requestConversationWork, It as listActiveConversationIds, J as scheduledRunId, Jt as hasRunnableConversationWork$1, Kt as CONVERSATION_WORK_STALE_ENQUEUE_MS, L as logScheduledAutomationRunSkipped, M as parseSlackThreadId, Mt as ensureConversationWake, Nt as getConversation, O as collectAttachmentGarbage, Pt as getConversationWorkState, Q as effectiveTaskOutcomes, R as scheduledAutomationRunAttributes, S as publicArtifactHeaders, Sn as slackExternalRefIdSchema, T as lookupSlackUserProfile, U as listScheduledAutomationsForTeam, Wt as stopConversationWork, X as scheduledRunSchema, Xt as isInvalidConversationRecordError, Y as withScheduledAutomationLock, Zt as renderTaskInput, _t as getEventCatalog, a as isExperimentalFeatureEnabled, an as consumeSandboxEgressAuthRequiredSignal, en as resolveSandboxEgressProviderForHost, f as deleteMcpAuthSessionsForUserProvider, fn as startOAuthFlow, i as getExperimentalFeatures, in as clearSandboxEgressSignals, jn as setConfigDefaults, l as executeCredentialedEgressRequest, ln as formatProviderLabel, m as deleteMcpStoredOAuthCredentials, mt as ingestEvent, nn as shouldPropagateSandboxEgressTrace, nt as findMatchingEventAutomations, o as setExperimentalFeatures, on as consumeSandboxEgressPermissionDeniedSignal, p as deleteMcpServerSessionId, pt as processWorkspaceSnapshotJob, q as saveScheduledAutomationInLock, rn as SANDBOX_EGRESS_PROXY_PATH, s as executeAgentRun, sn as parseSandboxEgressCredentialToken, t as createAgentRunner, tn as normalizeSandboxEgressTracePropagationDomains, vt as eventGuidance, w as unpublishedArtifactHeaders, xn as slackEntitySchema, xt as appendAndEnqueueInboundMessage, z as getNextRunAtMs } from "./agent-runner-CIesujf5.js";
+import { C as withLogContext, O as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE, S as withContext, d as logException, f as logInfo, j as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, p as logWarn, r as createRequestContext, v as setSpanAttributes, w as withSpan, y as setSpanStatus } from "./logging-Blgn76r3.js";
 import { r as continueTrace } from "./sentry-CgWZM_kV.js";
-import { t as JUNIOR_VERSION } from "./version-ByLtIYyy.js";
-import { a as getChatConfig, f as setBotModelConfig, i as configureFunctionMaxDurationSeconds, m as setSlackReactionConfig, n as botConfig, p as setProfiles, s as getSlackBotToken, u as getSlackReactionConfig } from "./config-Bws6Rpsh.js";
-import { a as createActor, u as parseActorUserId } from "./context-Bplcgypl.js";
-import { F as bindSlackDirectCredentialSubject, G as isDmChannel, I as verifyEventAutomationCredentialSubject, Jt as getSqlExecutor, Kt as getConversationStore, L as verifyScheduledAutomationCredentialSubject, Lt as listConversationAnnotations, N as bindEventAutomationCredentialSubject, P as bindScheduledAutomationCredentialSubject, Pt as resolveRootVisibility, Q as readActorIdentity, R as verifySlackDirectCredentialSubject, U as getSlackClient, Wt as getConversationEventStore, X as runWithWorkspaceTeamId, Xt as withConversationEventLock, Y as getWorkspaceTeamId, Zt as withConversationMutationLock, _t as createPluginState, a as getPluginRoutes, bt as createPluginLogger, ct as collectEventMatchKeys, d as setPlugins, dt as findMatchingWatches, f as validatePlugins, gt as setDashboardConversationLinkOptions, h as setBriefsConfig, ht as getDashboardTaskLink, i as getPluginApiRoutes, mt as getDashboardConversationLink, ot as cancelSubscriptions, qt as getDb, sn as deleteProviderIdentityForSlackUser, u as getPlugins, xt as readConversationAccessFromSql } from "./agent-hooks-FUetyyLe.js";
+import { t as JUNIOR_VERSION } from "./version-y4cRp5Y2.js";
+import { a as getChatConfig, f as setBotModelConfig, i as configureFunctionMaxDurationSeconds, m as setSlackReactionConfig, n as botConfig, p as setProfiles, s as getSlackBotToken, u as getSlackReactionConfig } from "./config-BLPaWN1Q.js";
+import { _ as slackChannelIdSchema, g as parseSlackUserId, h as parseSlackTeamId, u as parseActorUserId, v as slackTeamIdSchema, x as slackMessageTsSchema, y as slackUserIdSchema } from "./context-0Et9iVSB.js";
+import { $t as getConversationStore, Ct as createPluginLogger, F as bindSlackDirectCredentialSubject, G as isDmChannel, I as verifyEventAutomationCredentialSubject, L as verifyScheduledAutomationCredentialSubject, N as bindEventAutomationCredentialSubject, P as bindScheduledAutomationCredentialSubject, Q as readActorIdentity, R as verifySlackDirectCredentialSubject, U as getSlackClient, Vt as resolveRootVisibility, Wt as listConversationAnnotations, X as runWithWorkspaceTeamId, Y as getWorkspaceTeamId, Zt as getConversationEventStore, a as getPluginRoutes, bt as createPluginState, ct as collectEventMatchKeys, d as setPlugins, en as getDb, f as validatePlugins, ft as findMatchingWatches, gt as getDashboardConversationLink, h as setBriefsConfig, i as getPluginApiRoutes, in as withConversationMutationLock, mn as deleteProviderIdentityForSlackUser, mt as takeDueTimerWatches, ot as cancelSubscriptions, rn as withConversationEventLock, tn as getSqlExecutor, u as getPlugins, vt as getDashboardTaskLink, wt as readConversationAccessFromSql, yt as setDashboardConversationLinkOptions } from "./agent-hooks-DUQ3ASdp.js";
 import { n as juniorDestinations } from "./destinations-BeBiJeEM.js";
-import { E as juniorConversations, a as juniorSchedulerRuns, f as juniorAgentBindings, g as juniorConversationBriefs, o as juniorSchedulerTasks, p as juniorAgentInvocations, y as juniorConversationEvents } from "./executor-D36FWjcf.js";
-import { k as annotationCard } from "./conversation-DPbmIwjy.js";
-import { n as pluginCatalogRuntime } from "./catalog-runtime-BYGR3Dr4.js";
-import { X as projectConversationMessages, q as appendConversationMessages } from "./checkpoint-CJe-dZFF.js";
-import { O as withLock$1, w as getStateAdapter } from "./profile-dvV7PB7u.js";
-import { f as setSandboxResourceConfig, u as getSandboxResourceConfig } from "./resolve-DqwGI9wq.js";
-import { a as getVercelConversationWorkQueue, g as isConversationQueueMessageRejectedError, h as conversationQueueMessageSchema, i as verifyWorkspaceSnapshotJobMessage, o as resolveConversationWorkQueueTopic, s as verifyConversationQueueMessage, t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-2mFFDMHB.js";
-import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "./validation-q2PFxkTQ.js";
+import { E as juniorConversations, a as juniorSchedulerRuns, f as juniorAgentBindings, g as juniorConversationBriefs, o as juniorSchedulerTasks, p as juniorAgentInvocations, y as juniorConversationEvents } from "./executor-DZVZBfmX.js";
+import { k as annotationCard } from "./conversation-DOI6Y60M.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-NOBDOyJi.js";
+import { X as projectConversationMessages, q as appendConversationMessages } from "./checkpoint-CzN3gXoB.js";
+import { O as withLock$1, w as getStateAdapter } from "./profile-a5xmeUHf.js";
+import { f as setSandboxResourceConfig, u as getSandboxResourceConfig } from "./resolve-3PhWSiEF.js";
+import { a as getVercelConversationWorkQueue, g as isConversationQueueMessageRejectedError, h as conversationQueueMessageSchema, i as verifyWorkspaceSnapshotJobMessage, o as resolveConversationWorkQueueTopic, s as verifyConversationQueueMessage, t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-BuSPM0cX.js";
+import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "./validation-DZc56dXw.js";
 import { a as pluginRuntimeRegistrationsFromPluginSet, n as pluginCatalogConfigFromEnv, r as pluginCatalogConfigFromPluginSet, t as defineJuniorPlugins } from "./plugins-egKWjgue.js";
-import { A as THREAD_OPTOUT_ACK, C as verifySlackSignature, D as withNormalizedThreadId, E as normalizeIncomingSlackThreadId, F as createVercelAttachmentStorage, L as enqueueAgentDispatch, M as parseContent, N as getThreadStopDecision, O as getAuthPausedConversationTurnId, P as renderSlackObjectCard, R as GET$3, S as runWithSlackInstallation, T as stopSlackThread, a as webActorFromEmail, b as clearSlackPendingReactions, c as getProductionSlackAdapter, g as readViewerAutomationSummary, i as recordWebConversationActivity, j as startProcessingReaction, n as conversationTurnIdForMessage, o as createProductionConversationWorkOptions, s as createProductionSlackWebhookServices, t as appendAndEnqueueWebMessage, v as recordSkippedConversationMessage, w as isSlackMessageStopped, y as buildSlackInboundMessage } from "./web-input-DM9LaEdn.js";
-import { O as recordAutomationExecution, _ as markDispatchFailed, a as confirmDispatchMailboxAppend, d as getPluginDispatchProjection, f as isTerminalDispatchStatus, l as getDispatchRecord, o as createOrGetDispatch, p as listPendingDispatchMailboxAppends, s as getDispatchConversationId } from "./task-runner-axUJS1No.js";
-import { c as listPendingAgentInvocationMailboxAppends, r as enqueueAgentInvocation } from "./work-QrbHdXTc.js";
-import { s as coerceThreadConversationState } from "./thread-state-CTuWhjru.js";
-import { a as GET$4, i as publishAppHomeView, r as GET$5, t as receiveLocalOAuthCredential } from "./credential-sync-ibuNsMyl.js";
-import { a as registerVercelPluginTaskDevConsumer, n as createVercelPluginTaskCallback, s as queueCallback } from "./task-queue-TXhAWQwj.js";
-import { t as processConversationWork } from "./worker-r17aopXW.js";
-import { t as bindSpawnAgent } from "./spawn-Ck3L0rEr.js";
+import { A as THREAD_OPTOUT_ACK, C as verifySlackSignature, D as withNormalizedThreadId, E as normalizeIncomingSlackThreadId, F as createVercelAttachmentStorage, L as enqueueAgentDispatch, M as parseContent, N as getThreadStopDecision, O as getAuthPausedConversationTurnId, P as renderSlackObjectCard, R as GET$3, S as runWithSlackInstallation, T as stopSlackThread, a as webActorFromEmail, b as clearSlackPendingReactions, c as getProductionSlackAdapter, g as readViewerAutomationSummary, i as recordWebConversationActivity, j as startProcessingReaction, n as conversationTurnIdForMessage, o as createProductionConversationWorkOptions, s as createProductionSlackWebhookServices, t as appendAndEnqueueWebMessage, v as recordSkippedConversationMessage, w as isSlackMessageStopped, y as buildSlackInboundMessage } from "./web-input-B6FZlrgg.js";
+import { O as recordAutomationExecution, _ as markDispatchFailed, a as confirmDispatchMailboxAppend, d as getPluginDispatchProjection, f as isTerminalDispatchStatus, l as getDispatchRecord, o as createOrGetDispatch, p as listPendingDispatchMailboxAppends, s as getDispatchConversationId } from "./task-runner-uSodiP4v.js";
+import { c as listPendingAgentInvocationMailboxAppends, r as enqueueAgentInvocation } from "./work-Dy8sW9MZ.js";
+import { s as coerceThreadConversationState } from "./thread-state-BurqeqMv.js";
+import { a as GET$4, i as publishAppHomeView, r as GET$5, t as receiveLocalOAuthCredential } from "./credential-sync-OKs419AB.js";
+import { a as registerVercelPluginTaskDevConsumer, n as createVercelPluginTaskCallback, s as queueCallback } from "./task-queue-C2sTDXqQ.js";
+import { t as processConversationWork } from "./worker-BH0RP7Hj.js";
+import { t as bindSpawnAgent } from "./spawn-CS56i7Nm.js";
 import { createRequire } from "node:module";
 import { pathToFileURL } from "node:url";
 import { Hono } from "hono";
@@ -34,6 +34,26 @@ import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { createRemoteJWKSet, decodeJwt, jwtVerify } from "jose";
 import { ChannelImpl, ThreadImpl } from "chat";
 import * as acp from "@agentclientprotocol/sdk";
+//#region src/chat/events/timers.ts
+/** Publish a bounded batch of due timers; the mailbox owns agent execution. */
+async function runTimerWatchHeartbeat(args) {
+	const errors = [];
+	for (const watch of await takeDueTimerWatches(args.nowMs)) try {
+		await ingestEvent({
+			namespace: "junior",
+			identifier: watch.identifier,
+			eventType: "timer.fired",
+			eventKey: `timer:${watch.id}`,
+			occurredAtMs: watch.firesAtMs,
+			terminal: true,
+			trustedSummary: "Timer elapsed."
+		}, args);
+	} catch (error) {
+		errors.push(error);
+	}
+	if (errors.length) throw new AggregateError(errors, "Timer Watch delivery failed");
+}
+//#endregion
 //#region src/chat/task-execution/heartbeat.ts
 const DEFAULT_RECOVERY_LIMIT = 25;
 function heartbeatIdempotencyKey(reason, conversationId, nowMs) {
@@ -1026,6 +1046,14 @@ async function runHeartbeat(args) {
 	} catch (error) {
 		logException(error, "scheduled_automations.heartbeat.failed");
 	}
+	try {
+		await runTimerWatchHeartbeat({
+			nowMs: args.nowMs,
+			queue
+		});
+	} catch (error) {
+		logException(error, "watches.timer.heartbeat.failed");
+	}
 	await runPluginHeartbeats({
 		conversationWorkQueue: queue,
 		nowMs: args.nowMs
@@ -1740,6 +1768,104 @@ async function presentSlackAnnotationDetails(event, teamId) {
 	});
 }
 //#endregion
+//#region src/chat/ingress/slack-payload.ts
+const eventTimestampSchema = slackMessageTsSchema.refine((value) => Number.isFinite((/* @__PURE__ */ new Date(Number(value) * 1e3)).getTime()));
+const slackSlashCommandSchema = z.object({
+	channel_id: z.string().trim().pipe(slackChannelIdSchema),
+	team_id: z.string().trim().pipe(slackTeamIdSchema),
+	user_id: z.string().trim().pipe(slackUserIdSchema),
+	text: z.string(),
+	enterprise_id: z.string().optional(),
+	is_enterprise_install: z.enum(["true", "false"]).optional()
+});
+const slackAssistantThreadSchema = z.object({
+	channel_id: z.string().min(1),
+	thread_ts: eventTimestampSchema,
+	user_id: z.string(),
+	context: z.object({
+		channel_id: z.string().optional(),
+		team_id: z.string().optional(),
+		enterprise_id: z.string().nullable().optional()
+	})
+});
+const slackEventSchema = z.looseObject({
+	type: z.string(),
+	attachments: z.array(z.looseObject({
+		from_url: z.string().optional(),
+		original_url: z.string().optional(),
+		title: z.string().optional(),
+		text: z.string().optional(),
+		image_url: z.string().optional(),
+		thumb_url: z.string().optional(),
+		service_name: z.string().optional()
+	})).optional(),
+	files: z.array(z.looseObject({
+		id: z.string().optional(),
+		mimetype: z.string().optional(),
+		url_private: z.string().optional(),
+		name: z.string().optional(),
+		size: z.number().optional(),
+		original_w: z.number().optional(),
+		original_h: z.number().optional()
+	})).optional(),
+	edited: z.looseObject({ ts: eventTimestampSchema }).optional(),
+	team: z.string().optional(),
+	team_id: z.string().optional(),
+	username: z.string().optional(),
+	blocks: z.array(z.looseObject({
+		type: z.string(),
+		elements: z.array(z.looseObject({
+			type: z.string(),
+			elements: z.array(z.looseObject({
+				type: z.string(),
+				url: z.string().optional()
+			})).optional()
+		})).optional(),
+		text: z.union([z.string(), z.looseObject({
+			type: z.enum(["mrkdwn", "plain_text"]),
+			text: z.string()
+		})]).optional()
+	})).optional(),
+	bot_id: z.string().optional(),
+	channel: z.string().optional(),
+	channel_type: z.enum([
+		"channel",
+		"group",
+		"mpim",
+		"im",
+		"app_home"
+	]).optional(),
+	event_ts: eventTimestampSchema.optional(),
+	subtype: z.string().optional(),
+	text: z.string().optional(),
+	thread_ts: eventTimestampSchema.optional(),
+	ts: eventTimestampSchema.optional(),
+	user: z.string().optional()
+});
+const slackEventEnvelopeSchema = z.object({
+	event_id: z.unknown().optional(),
+	is_ext_shared_channel: z.unknown().optional(),
+	enterprise_id: z.string().optional(),
+	event: slackEventSchema.optional(),
+	is_enterprise_install: z.boolean().optional(),
+	team_id: z.string().optional(),
+	type: z.string(),
+	challenge: z.string().optional()
+});
+const slackInteractivePayloadSchema = z.object({
+	actions: z.array(z.object({
+		action_id: z.string().optional(),
+		selected_option: z.object({ value: z.string().optional() }).optional(),
+		value: z.string().optional()
+	})).optional(),
+	team: z.object({ id: z.string().optional() }).nullish(),
+	type: z.string(),
+	user: z.object({
+		id: z.string().optional(),
+		team_id: z.string().optional()
+	}).optional()
+});
+//#endregion
 //#region src/chat/conversations/stop.ts
 /** Stop the current Conversation Turn and wake an idle resume when needed. */
 async function stopConversationTurn(args) {
@@ -1856,22 +1982,75 @@ function textMentionsBot(text, botUserId) {
 }
 //#endregion
 //#region src/chat/ingress/workspace-membership.ts
-/**
-* Return true when a Slack event's author is from an external workspace.
-*
-* In Slack Connect shared channels the inner event carries `user_team`
-* (the author's home workspace). When it differs from the outer payload's
-* `team_id` the author is a Slack Connect participant, not a local member.
-*/
-function isExternalSlackUser(raw) {
-	if (!raw) return false;
+const MEMBER_TTL_MS = 3e5;
+const NON_MEMBER_TTL_MS = 3e4;
+const authorTeamSchema = z.object({
+	user_team: z.string().optional(),
+	source_team: z.string().optional(),
+	user: z.unknown().optional()
+});
+/** Accept only verified workspace authors, reusing recent membership lookups. */
+async function isSlackWorkspaceMember(raw, state) {
 	const workspaceTeamId = getWorkspaceTeamId();
 	if (!workspaceTeamId) return false;
-	const userTeam = typeof raw.user_team === "string" ? raw.user_team : void 0;
-	if (userTeam) return userTeam !== workspaceTeamId;
-	const sourceTeam = typeof raw.source_team === "string" ? raw.source_team : void 0;
-	if (sourceTeam) return sourceTeam !== workspaceTeamId;
-	return false;
+	const parsed = authorTeamSchema.safeParse(raw);
+	if (!parsed.success) return false;
+	const event = parsed.data;
+	const userId = parseSlackUserId(event.user);
+	if (!userId) return false;
+	const key = `slack:membership:${workspaceTeamId}:${userId}`;
+	const authorTeam = parseSlackTeamId(event.user_team);
+	if (authorTeam === workspaceTeamId) return true;
+	if (event.user_team !== void 0 && !authorTeam && !/^E[A-Z0-9]+$/.test(event.user_team)) return false;
+	const explicitlyExternal = authorTeam !== void 0;
+	if (!explicitlyExternal) {
+		const cached = await state.get(key);
+		if (typeof cached === "boolean") return cached;
+	}
+	const result = await withLock$1(state, `${key}:lookup`, async () => {
+		if (explicitlyExternal) {
+			await state.set(key, false, NON_MEMBER_TTL_MS);
+			return false;
+		}
+		const cached = await state.get(key);
+		if (typeof cached === "boolean") return cached;
+		const user = await lookupSlackUserProfile(userId);
+		const authorTeam = parseSlackTeamId(user.team_id);
+		if (user.id !== userId || !authorTeam) return false;
+		const member = authorTeam === workspaceTeamId && !user.is_deleted;
+		await state.set(key, member, member ? MEMBER_TTL_MS : NON_MEMBER_TTL_MS);
+		return member;
+	}, {
+		keepAlive: true,
+		waitMs: 1e4
+	});
+	if (!result.acquired) throw new Error("Could not acquire Slack membership lookup lock");
+	return result.value;
+}
+//#endregion
+//#region src/chat/ingress/slack-message-telemetry.ts
+function field(value, pattern) {
+	if (value === void 0) return "missing";
+	return typeof value === "string" && value.length <= 64 && pattern.test(value) ? value : "invalid";
+}
+/** Record Slack's identity fields separately from the membership decision. */
+function slackMessageAttributes(body) {
+	const event = body.event;
+	const teamId = /^[TE][A-Z0-9]+$/;
+	return {
+		"messaging.message.id": event?.ts,
+		"app.slack.event_id": field(body.event_id, /^Ev[A-Z0-9]+$/),
+		"app.slack.event_type": field(event?.type, /^[a-z_]+$/),
+		"app.slack.event_subtype": field(event?.subtype, /^[a-z_]+$/),
+		"app.slack.user_id": field(event?.user, /^[UW][A-Z0-9]+$/),
+		"app.slack.bot_id": field(event?.bot_id, /^B[A-Z0-9]+$/),
+		"app.slack.team_id": field(body.team_id, /^T[A-Z0-9]+$/),
+		"app.slack.enterprise_id": field(body.enterprise_id, /^E[A-Z0-9]+$/),
+		"app.slack.user_team": field(event?.user_team, teamId),
+		"app.slack.source_team": field(event?.source_team, teamId),
+		"app.slack.event_team": field(event?.team, teamId),
+		"app.slack.is_ext_shared_channel": typeof body.is_ext_shared_channel === "boolean" ? body.is_ext_shared_channel : body.is_ext_shared_channel === void 0 ? "missing" : "invalid"
+	};
 }
 //#endregion
 //#region src/chat/credentials/unlink-provider.ts
@@ -1889,17 +2068,12 @@ async function unlinkProvider(userId, provider, userTokenStore, slackTeamId) {
 //#endregion
 //#region src/chat/ingress/slash-command.ts
 async function postEphemeral(event, text) {
-	await event.channel.postEphemeral(event.user, text, { fallbackToDM: false });
-}
-function requireActorId(event) {
-	const userId = parseActorUserId(event.user.userId);
-	if (!userId) throw new Error("Slack slash command requires a actor user id");
-	return userId;
+	await event.channel.postEphemeral(event.userId, text, { fallbackToDM: false });
 }
 function getCommandName() {
 	return getChatConfig().slack.slashCommand;
 }
-async function handleLink(event, actorId, provider) {
+async function handleLink(event, provider) {
 	if (!pluginCatalogRuntime.isProvider(provider)) {
 		await postEphemeral(event, `Unknown provider: \`${provider}\``);
 		return;
@@ -1908,20 +2082,14 @@ async function handleLink(event, actorId, provider) {
 		await postEphemeral(event, `${formatProviderLabel(provider)} doesn't support account linking.`);
 		return;
 	}
-	const raw = event.raw;
-	const actor = createActor({
-		platform: "slack",
-		teamId: raw.team_id,
-		userId: actorId
-	}, {
-		platform: "slack",
-		teamId: raw.team_id,
-		userId: actorId
-	});
 	const result = await startOAuthFlow(provider, {
-		actorId,
-		...actor ? { actor } : void 0,
-		channelId: raw.channel_id
+		actorId: event.userId,
+		actor: {
+			platform: "slack",
+			teamId: event.teamId,
+			userId: event.userId
+		},
+		channelId: event.channelId
 	});
 	if (!result.ok) {
 		await postEphemeral(event, `Failed to start linking: ${result.error}`);
@@ -1930,7 +2098,7 @@ async function handleLink(event, actorId, provider) {
 	if (result.delivery === "fallback_dm") await postEphemeral(event, `Check your DMs for a ${formatProviderLabel(provider)} authorization link.`);
 	else if (result.delivery === false) await postEphemeral(event, "I wasn't able to send you a private authorization link. Please try again in a direct message.");
 }
-async function handleUnlink(event, actorId, provider) {
+async function handleUnlink(event, provider) {
 	if (!pluginCatalogRuntime.isProvider(provider)) {
 		await postEphemeral(event, `Unknown provider: \`${provider}\``);
 		return;
@@ -1940,8 +2108,7 @@ async function handleUnlink(event, actorId, provider) {
 		return;
 	}
 	const tokenStore = createUserTokenStore();
-	const teamId = event.raw.team_id;
-	await unlinkProvider(actorId, provider, tokenStore, teamId);
+	await unlinkProvider(event.userId, provider, tokenStore, event.teamId);
 	logInfo("slash_command.credential.unlinked", { "app.credential.provider": provider });
 	await postEphemeral(event, `Your ${formatProviderLabel(provider)} account has been unlinked.`);
 }
@@ -1957,9 +2124,8 @@ async function handleSlashCommand(event) {
 		return;
 	}
 	const normalized = provider.toLowerCase();
-	const actorId = requireActorId(event);
-	if (subcommand === "link") await handleLink(event, actorId, normalized);
-	else await handleUnlink(event, actorId, normalized);
+	if (subcommand === "link") await handleLink(event, normalized);
+	else await handleUnlink(event, normalized);
 }
 //#endregion
 //#region src/chat/slack/automation-details.ts
@@ -2154,7 +2320,7 @@ async function buildThread(args) {
 	});
 }
 function shouldIgnoreMessage(message) {
-	return message.author.isMe === true || !parseActorUserId(message.author.userId) || isExternalSlackUser(message.raw);
+	return message.author.isMe === true || !parseActorUserId(message.author.userId);
 }
 function shouldPersistBeforeAck(body) {
 	return body.event?.type === "app_mention" || body.event?.type === "message";
@@ -2273,7 +2439,7 @@ async function routeParsedMessage(args) {
 	const message = normalized.message;
 	const canonicalThreadId = normalized.threadId;
 	const botUserId = args.adapter.botUserId;
-	const isMention = Boolean(botUserId && (textMentionsBot(args.event.text ?? "", botUserId) || args.event.blocks?.some((block) => block.type === "section" && block.text?.type === "mrkdwn" && textMentionsBot(block.text.text, botUserId))));
+	const isMention = Boolean(botUserId && (textMentionsBot(args.event.text ?? "", botUserId) || args.event.blocks?.some((block) => block.type === "section" && typeof block.text === "object" && block.text.type === "mrkdwn" && textMentionsBot(block.text.text, botUserId))));
 	if (isMention) message.isMention = true;
 	const isDirectMessage = isDmEvent(args.event);
 	const isSubscribed = !isDirectMessage && !isMention && await args.state.isSubscribed(canonicalThreadId);
@@ -2356,32 +2522,22 @@ async function handleSlackEvent(args) {
 		installation,
 		state,
 		task: async () => {
-			if (event.type === "assistant_thread_started") {
-				const assistantThread = event.assistant_thread;
-				if (assistantThread?.channel_id && assistantThread.thread_ts) await args.services.runtime.handleAssistantThreadStarted({
-					channelId: assistantThread.channel_id,
-					context: { channelId: assistantThread.context?.channel_id },
-					threadId: adapter.encodeThreadId({
-						channel: assistantThread.channel_id,
-						threadTs: assistantThread.thread_ts
-					}),
-					threadTs: assistantThread.thread_ts,
-					userId: assistantThread.user_id
-				});
-				return;
-			}
-			if (event.type === "assistant_thread_context_changed") {
-				const assistantThread = event.assistant_thread;
-				if (assistantThread?.channel_id && assistantThread.thread_ts) await args.services.runtime.handleAssistantContextChanged({
-					channelId: assistantThread.channel_id,
-					context: { channelId: assistantThread.context?.channel_id },
+			if (event.type === "assistant_thread_started" || event.type === "assistant_thread_context_changed") {
+				const parsed = slackAssistantThreadSchema.safeParse(event.assistant_thread);
+				if (!parsed.success) return;
+				const thread = parsed.data;
+				const callback = {
+					channelId: thread.channel_id,
+					context: { channelId: thread.context.channel_id },
 					threadId: adapter.encodeThreadId({
-						channel: assistantThread.channel_id,
-						threadTs: assistantThread.thread_ts
+						channel: thread.channel_id,
+						threadTs: thread.thread_ts
 					}),
-					threadTs: assistantThread.thread_ts,
-					userId: assistantThread.user_id
-				});
+					threadTs: thread.thread_ts,
+					userId: thread.user_id
+				};
+				if (event.type === "assistant_thread_started") await args.services.runtime.handleAssistantThreadStarted(callback);
+				else await args.services.runtime.handleAssistantContextChanged(callback);
 				return;
 			}
 			if (event.type === "entity_details_requested") {
@@ -2395,6 +2551,9 @@ async function handleSlackEvent(args) {
 				return;
 			}
 			if ((event.type === "message" || event.type === "app_mention") && !shouldIgnoreMessageSubtype(event) && event.channel && event.ts) {
+				const member = await isSlackWorkspaceMember(event, state);
+				setSpanAttributes({ "app.slack.membership": member ? "verified" : "unverified" });
+				if (!member) return;
 				const message = adapter.parseMessage(event);
 				if (!(await withLock$1(state, `slack:ingress:${normalizeMessageThreadId(message).threadId}`, () => routeParsedMessage({
 					adapter,
@@ -2419,42 +2578,19 @@ function requireSlackPayloadUserId(value, source) {
 	return userId;
 }
 async function handleSlashCommandForm(args) {
-	const raw = Object.fromEntries(args.params);
-	const channelId = args.params.get("channel_id") ?? "";
+	const { channel_id: channelId, team_id: teamId, user_id: userId } = args.form;
 	const channel = new ChannelImpl({
-		id: channelId ? `slack:${channelId}` : "",
+		id: `slack:${channelId}`,
 		adapter: args.adapter,
 		stateAdapter: args.state
 	});
-	const userId = requireSlackPayloadUserId(args.params.get("user_id"), "Slack slash command payload");
-	const teamId = args.params.get("team_id") ?? void 0;
-	const userIdentity = createActor({
-		platform: "slack",
-		teamId,
-		userId,
-		userName: args.params.get("user_name") ?? void 0,
-		fullName: args.params.get("user_name") ?? void 0
-	}, {
-		teamId,
-		userId
-	});
-	if (!userIdentity?.userId) throw new Error("Slack slash command payload actor identity is invalid");
 	await withSpan("chat.slash_command", "chat.slash_command", { userId }, async () => {
 		await handleSlashCommand({
-			adapter: args.adapter,
 			channel,
-			command: args.params.get("command") || "",
-			text: args.params.get("text") || "",
-			triggerId: args.params.get("trigger_id") || void 0,
-			raw,
-			user: {
-				userId,
-				userName: userIdentity.userName ?? "",
-				fullName: userIdentity.fullName ?? "",
-				isBot: false,
-				isMe: false
-			},
-			openModal: async () => void 0
+			channelId,
+			teamId,
+			text: args.form.text,
+			userId
 		});
 	});
 }
@@ -2477,14 +2613,6 @@ async function handleInteractivePayload(args) {
 		}
 	});
 }
-function installationFromForm(params) {
-	const isEnterpriseInstall = params.get("is_enterprise_install") === "true";
-	return {
-		teamId: params.get("team_id") ?? void 0,
-		enterpriseId: params.get("enterprise_id") ?? void 0,
-		isEnterpriseInstall
-	};
-}
 function installationFromInteractive(payload) {
 	return { teamId: payload.team?.id ?? payload.user?.team_id };
 }
@@ -2494,17 +2622,24 @@ async function handleSlackForm(args) {
 	const state = args.services.state ?? getStateAdapter();
 	await state.connect();
 	if (params.has("command") && !params.has("payload")) {
-		const installation = installationFromForm(params);
+		const result = slackSlashCommandSchema.safeParse(Object.fromEntries(params));
+		if (!result.success) return new Response("Invalid slash command payload", { status: 400 });
+		const form = result.data;
+		const installation = {
+			teamId: form.team_id,
+			enterpriseId: form.enterprise_id,
+			isEnterpriseInstall: form.is_enterprise_install === "true"
+		};
 		enqueue(args.waitUntil, withLogContext({
 			platform: "slack",
-			userId: params.get("user_id")?.trim() || void 0
+			userId: form.user_id
 		}, () => runWithWorkspaceTeamId(installation.teamId, () => runWithSlackInstallation({
 			adapter,
 			installation,
 			state,
 			task: () => handleSlashCommandForm({
 				adapter,
-				params,
+				form,
 				state
 			})
 		})).catch((error) => {
@@ -2514,8 +2649,9 @@ async function handleSlackForm(args) {
 	}
 	const rawPayload = params.get("payload");
 	if (!rawPayload) return new Response("Missing payload", { status: 400 });
-	const payload = parseJson(rawPayload);
-	if (!payload) return new Response("Invalid payload JSON", { status: 400 });
+	const result = slackInteractivePayloadSchema.safeParse(parseJson(rawPayload));
+	if (!result.success) return new Response("Invalid payload JSON", { status: 400 });
+	const payload = result.data;
 	const installation = installationFromInteractive(payload);
 	enqueue(args.waitUntil, withLogContext({
 		platform: "slack",
@@ -2547,20 +2683,21 @@ async function handleSlackWebhook(args) {
 		services: args.services,
 		waitUntil: args.waitUntil
 	});
-	const parsed = parseJson(body);
-	if (!parsed) return new Response("Invalid JSON", { status: 400 });
-	if (parsed.type === "url_verification") {
-		const challenge = parsed.challenge;
-		return Response.json({ challenge });
-	}
+	const result = slackEventEnvelopeSchema.safeParse(parseJson(body));
+	if (!result.success) return new Response("Invalid JSON", { status: 400 });
+	const parsed = result.data;
+	if (parsed.type === "url_verification") return Response.json({ challenge: parsed.challenge });
 	if (parsed.type === "event_callback") {
 		const eventLogContext = slackEventLogContext(parsed.event);
 		if (shouldPersistBeforeAck(parsed)) {
 			const failureResponse = await withLogContext(eventLogContext, async () => {
 				try {
-					await handleSlackEvent({
+					await withSpan("slack.message.ingress", "slack.message.ingress", eventLogContext, () => handleSlackEvent({
 						body: parsed,
 						services: args.services
+					}), {
+						...slackMessageAttributes(parsed),
+						"app.slack.membership": "not_checked"
 					});
 				} catch (error) {
 					if (error instanceof SlackEventPersistenceError) logException(error.cause, "slack.event.persist.failed");
@@ -4798,6 +4935,7 @@ function dashboardHostRoutePaths(dashboard, authenticatedRoutes = []) {
 		...pagePaths,
 		"/favicon.ico",
 		"/_junior/dashboard/avatar.png",
+		"/_junior/dashboard/object-icons/*",
 		"/_junior/dashboard/client.js",
 		"/_junior/dashboard/icon-512.png",
 		"/_junior/dashboard/manifest.webmanifest",

package/dist/{briefs-Cb4T2BUI.js → briefs-BTrVMqUg.js}

@@ -1,7 +1,7 @@
-import { r as completeObject } from "./client-C2WBBx7m.js";
+import { r as completeObject } from "./client-C6VUBzL_.js";
 import { r as defaultModelId } from "./model-profile-BwU8mqwD.js";
-import { P as briefCodeChangeSchema, R as parseBriefInput, d as conversationDetailReportSchema, p as conversationEventPageSchema } from "./conversation-DPbmIwjy.js";
-import { n as briefEntriesFromReportEvents, s as generateBrief, t as BRIEF_PROMPT } from "./prompt-DehgjkO5.js";
+import { U as parseBriefInput, d as conversationDetailReportSchema, p as conversationEventPageSchema, z as briefCodeChangeSchema } from "./conversation-DOI6Y60M.js";
+import { n as briefEntriesFromReportEvents, s as generateBrief, t as BRIEF_PROMPT } from "./prompt-9C-wUwwx.js";
 import { CLI_USAGE } from "./cli/run.js";
 import path from "node:path";
 import { z } from "zod";
@@ -269,7 +269,7 @@ async function parseRunOptions(argv) {
 * `DATABASE_URL` at import, and `briefs pull` must work with only a token.
 */
 async function configuredDefaultModelId() {
-	const { botConfig } = await import("./config-Bws6Rpsh.js").then((n) => n.r);
+	const { botConfig } = await import("./config-BLPaWN1Q.js").then((n) => n.r);
 	return defaultModelId(botConfig);
 }
 function apiUrl(baseUrl, pathname) {

package/dist/{catalog-runtime-BYGR3Dr4.js → catalog-runtime-NOBDOyJi.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-B4FMCO8f.js";
-import { t as createPluginCatalogRuntime } from "./registry-C6FHctIu.js";
+import { t as createPluginCatalogRuntime } from "./registry-BUbczT2k.js";
 //#region src/chat/plugins/catalog-runtime.ts
 var catalog_runtime_exports = /* @__PURE__ */ __exportAll({ pluginCatalogRuntime: () => pluginCatalogRuntime });
 const pluginCatalogRuntime = createPluginCatalogRuntime();

package/dist/{checkpoint-CJe-dZFF.js → checkpoint-CzN3gXoB.js}

@@ -1,10 +1,10 @@
-import { i as completeText, m as escapeXml, o as resolveGatewayModel, p as unwrapCurrentInstruction } from "./client-C2WBBx7m.js";
-import { d as logException, o as getActiveTraceId, p as logWarn, t as buildTurnFailureResponse, v as setSpanAttributes } from "./logging-CvjMHRvg.js";
-import { n as botConfig } from "./config-Bws6Rpsh.js";
-import { _ as parseSlackMessageTs, f as toStoredSlackActor } from "./context-Bplcgypl.js";
-import { $t as bindProviderConversation, Bt as agentsInstructionsUpdatedEvent, Ht as authenticationUnlinkedEvent, Jt as getSqlExecutor, Kt as getConversationStore, Vt as authenticationLinkedEvent, Wt as getConversationEventStore, Xt as withConversationEventLock, Yt as createSqlConversationEventStore, tn as addAgentTurnUsage, zt as JUNIOR_NATIVE_EVENT_NAMESPACE } from "./agent-hooks-FUetyyLe.js";
-import { B as agentHistoryItemSchema, J as contextProvenance, X as instructionProvenanceFor, Y as instructionActors } from "./conversation-DPbmIwjy.js";
-import { D as fenceLock, O as withLock, T as MUTATION_LOCK_TTL_MS, k as sleep, w as getStateAdapter } from "./profile-dvV7PB7u.js";
+import { i as completeText, m as escapeXml, o as resolveGatewayModel, p as unwrapCurrentInstruction } from "./client-C6VUBzL_.js";
+import { d as logException, o as getActiveTraceId, p as logWarn, t as buildTurnFailureResponse, v as setSpanAttributes } from "./logging-Blgn76r3.js";
+import { n as botConfig } from "./config-BLPaWN1Q.js";
+import { b as parseSlackMessageTs, f as toStoredSlackActor } from "./context-0Et9iVSB.js";
+import { $t as getConversationStore, Jt as authenticationLinkedEvent, Kt as JUNIOR_NATIVE_EVENT_NAMESPACE, Yt as authenticationUnlinkedEvent, Zt as getConversationEventStore, cn as addAgentTurnUsage, nn as createSqlConversationEventStore, on as bindProviderConversation, qt as agentsInstructionsUpdatedEvent, rn as withConversationEventLock, tn as getSqlExecutor } from "./agent-hooks-DUQ3ASdp.js";
+import { $ as contextProvenance, G as agentHistoryItemSchema, et as instructionActors, tt as instructionProvenanceFor } from "./conversation-DOI6Y60M.js";
+import { D as fenceLock, O as withLock, T as MUTATION_LOCK_TTL_MS, k as sleep, w as getStateAdapter } from "./profile-a5xmeUHf.js";
 import { isDeepStrictEqual } from "node:util";
 import { z } from "zod";
 import { createHash } from "node:crypto";