@sentry/junior 0.234.0 → 0.236.0

package/dist/app.js

@@ -1,36 +1,36 @@
-import { A as requestAttachmentDeletion, At as clearExpiredConversationLease, B as listScheduledAutomations, Bt as listActiveConversationIds, C as readPublicArtifact, Dn as createUserTokenStore, En as slackExternalRefIdSchema, Fn as setConfigDefaults, G as saveScheduledAutomationInLock, It as ensureConversationWake, Jt as stopConversationWork, K as scheduledRunId, Kt as requestConversationWork, Lt as getConversation, M as parseSlackThreadId, O as collectAttachmentGarbage, Pn as getConfigDefaults, Q as collectEventAutomationMatchKeys, Qt as hasRunnableConversationWork$1, R as logScheduledAutomationRunSkipped, Rt as getConversationWorkState, S as publicArtifactHeaders, T as lookupSlackUserProfile, Tn as slackEntitySchema, Tt as appendAndEnqueueInboundMessage, U as readScheduledAutomation, V as listScheduledAutomationsForTeam, Wt as removeActiveConversation, Xt as CONVERSATION_WORK_STALE_ENQUEUE_MS, Z as effectiveTaskOutcomes, _t as ingestEvent, a as isExperimentalFeatureEnabled, an as normalizeSandboxEgressTracePropagationDomains, bt as getEventCatalog, cn as clearSandboxEgressSignals, dn as parseSandboxEgressCredentialToken, en as isInvalidConversationRecordError, f as deleteMcpAuthSessionsForUserProvider, gn as startOAuthFlow, gt as processWorkspaceSnapshotJob, i as getExperimentalFeatures, in as resolveSandboxEgressProviderForHost, l as executeCredentialedEgressRequest, ln as consumeSandboxEgressAuthRequiredSignal, m as deleteMcpStoredOAuthCredentials, o as setExperimentalFeatures, on as shouldPropagateSandboxEgressTrace, p as deleteMcpServerSessionId, pn as formatProviderLabel, q as withScheduledAutomationLock, s as executeAgentRun, sn as SANDBOX_EGRESS_PROXY_PATH, t as createAgentRunner, tn as renderTaskInput, tt as findMatchingEventAutomations, un as consumeSandboxEgressPermissionDeniedSignal, w as unpublishedArtifactHeaders, xt as eventGuidance, z as scheduledAutomationRunAttributes, zt as hasRunnableConversationWork } from "./agent-runner-DUkGlK89.js";
-import { C as withLogContext, O as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE, S as withContext, d as logException, f as logInfo, j as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, p as logWarn, r as createRequestContext, v as setSpanAttributes, w as withSpan, y as setSpanStatus } from "./logging-Cox1Mgcv.js";
+import { A as requestAttachmentDeletion, B as scheduledAutomationRunAttributes, C as isExperimentalFeatureEnabled, Ct as ingestEvent, Dn as slackMention, Dt as eventGuidance, Et as getEventCatalog, Gt as hasRunnableConversationWork, H as listScheduledAutomationsForTeam, Hn as setConfigDefaults, Ht as ensureConversationWake, It as clearExpiredConversationLease, J as withScheduledAutomationLock, K as saveScheduledAutomationInLock, Kt as listActiveConversationIds, M as parseSlackThreadId, Mn as slackEntitySchema, Nn as slackExternalRefIdSchema, O as collectAttachmentGarbage, Pn as createUserTokenStore, Q as effectiveTaskOutcomes, Qt as requestConversationWork, S as getExperimentalFeatures, Sn as startOAuthFlow, St as processWorkspaceSnapshotJob, T as lookupSlackUserProfile, Ut as getConversation, V as listScheduledAutomations, Vn as getConfigDefaults, W as readScheduledAutomation, Wt as getConversationWorkState, Xt as removeActiveConversation, _n as parseSandboxEgressCredentialToken, a as executeCredentialedEgressRequest, b as unpublishedArtifactHeaders, c as deleteMcpAuthSessionsForUserProvider, dn as normalizeSandboxEgressTracePropagationDomains, en as stopConversationWork, et as collectEventAutomationMatchKeys, fn as shouldPropagateSandboxEgressTrace, gn as consumeSandboxEgressPermissionDeniedSignal, hn as consumeSandboxEgressAuthRequiredSignal, in as hasRunnableConversationWork$1, jt as appendAndEnqueueInboundMessage, l as deleteMcpServerSessionId, mn as clearSandboxEgressSignals, nn as CONVERSATION_WORK_STALE_ENQUEUE_MS, on as isInvalidConversationRecordError, pn as SANDBOX_EGRESS_PROXY_PATH, q as scheduledRunId, r as executeAgentRun, rt as findMatchingEventAutomations, sn as renderTaskInput, t as createAgentRunner, u as deleteMcpStoredOAuthCredentials, un as resolveSandboxEgressProviderForHost, v as publicArtifactHeaders, w as setExperimentalFeatures, y as readPublicArtifact, yn as formatProviderLabel, z as logScheduledAutomationRunSkipped } from "./agent-runner-uP7QRc4c.js";
+import { C as withLogContext, O as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE, S as withContext, d as logException, f as logInfo, j as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, p as logWarn, r as createRequestContext, v as setSpanAttributes, w as withSpan, y as setSpanStatus } from "./logging-B4sKwmCG.js";
 import { r as continueTrace } from "./sentry-CgWZM_kV.js";
-import { t as JUNIOR_VERSION } from "./version-A7-RRBOE.js";
-import { a as getChatConfig, f as setBotModelConfig, i as configureFunctionMaxDurationSeconds, m as setSlackReactionConfig, n as botConfig, p as setProfiles, s as getSlackBotToken, u as getSlackReactionConfig } from "./config-DuCzUoCo.js";
+import { t as JUNIOR_VERSION } from "./version-CWkIGcLU.js";
+import { _ as snapshotRuntimeConfig, d as restoreRuntimeConfig, f as setBotModelConfig, g as setSlackReactionConfig, h as setRuntimeLimits, i as getChatConfig, m as setProfiles, n as botConfig, o as getSlackBotToken, p as setCrossActorMidRunMode, u as resetRuntimeConfig } from "./config-JR9wke1W.js";
 import { _ as slackChannelIdSchema, g as parseSlackUserId, h as parseSlackTeamId, u as parseActorUserId, v as slackTeamIdSchema, x as slackMessageTsSchema, y as slackUserIdSchema } from "./context-0Et9iVSB.js";
-import { $t as getConversationStore, Ct as createPluginLogger, F as bindSlackDirectCredentialSubject, G as isDmChannel, I as verifyEventAutomationCredentialSubject, L as verifyScheduledAutomationCredentialSubject, N as bindEventAutomationCredentialSubject, P as bindScheduledAutomationCredentialSubject, Q as readActorIdentity, R as verifySlackDirectCredentialSubject, U as getSlackClient, Vt as resolveRootVisibility, Wt as listConversationAnnotations, X as runWithWorkspaceTeamId, Y as getWorkspaceTeamId, Zt as getConversationEventStore, a as getPluginRoutes, bt as createPluginState, ct as collectEventMatchKeys, d as setPlugins, en as getDb, f as validatePlugins, ft as findMatchingWatches, gt as getDashboardConversationLink, h as setBriefsConfig, i as getPluginApiRoutes, in as withConversationMutationLock, mn as deleteProviderIdentityForSlackUser, mt as takeDueTimerWatches, ot as cancelSubscriptions, rn as withConversationEventLock, tn as getSqlExecutor, u as getPlugins, vt as getDashboardTaskLink, wt as readConversationAccessFromSql, yt as setDashboardConversationLinkOptions } from "./agent-hooks-BcH6E48y.js";
+import { $ as readActorIdentity, F as bindScheduledAutomationCredentialSubject, Gt as listConversationAnnotations, Ht as resolveRootVisibility, I as bindSlackDirectCredentialSubject, K as isDmChannel, L as verifyEventAutomationCredentialSubject, P as bindEventAutomationCredentialSubject, Qt as getConversationEventStore, R as verifyScheduledAutomationCredentialSubject, Tt as readConversationAccessFromSql, W as getSlackClient, X as getWorkspaceTeamId, Z as runWithWorkspaceTeamId, _t as getDashboardConversationLink, a as getPluginRoutes, an as withConversationMutationLock, bt as setDashboardConversationLinkOptions, d as setPlugins, en as getConversationStore, f as validatePlugins, h as setBriefsConfig, hn as deleteProviderIdentityForSlackUser, ht as takeDueTimerWatches, i as getPluginApiRoutes, in as withConversationEventLock, lt as collectEventMatchKeys, nn as getSqlExecutor, pt as findMatchingWatches, st as cancelSubscriptions, tn as getDb, u as getPlugins, wt as createPluginLogger, xt as createPluginState, yt as getDashboardTaskLink, z as verifySlackDirectCredentialSubject } from "./agent-hooks-Da_H0jHv.js";
 import { n as juniorDestinations } from "./destinations-BeBiJeEM.js";
-import { E as juniorConversations, a as juniorSchedulerRuns, f as juniorAgentBindings, g as juniorConversationBriefs, o as juniorSchedulerTasks, p as juniorAgentInvocations, y as juniorConversationEvents } from "./executor--jWf-Nnm.js";
-import { z as annotationCard } from "./conversation-CPjHYOV5.js";
-import { n as pluginCatalogRuntime } from "./catalog-runtime-BSgsPVnr.js";
-import { X as projectConversationMessages, q as appendConversationMessages } from "./checkpoint-BNfXlq_1.js";
-import { O as withLock$1, w as getStateAdapter } from "./profile-BdApelHS.js";
-import { f as setSandboxResourceConfig, u as getSandboxResourceConfig } from "./resolve-VpJoiDpc.js";
-import { a as getVercelConversationWorkQueue, g as isConversationQueueMessageRejectedError, h as conversationQueueMessageSchema, i as verifyWorkspaceSnapshotJobMessage, o as resolveConversationWorkQueueTopic, s as verifyConversationQueueMessage, t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-cwHVOwVZ.js";
-import { f as getNextRunAtMs, r as scheduledRunSchema } from "./types-Du-HbEun.js";
-import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "./validation-0F9IgG3b.js";
+import { D as juniorConversations, _ as juniorConversationBriefs, a as juniorSchedulerRuns, b as juniorConversationEvents, m as juniorAgentInvocations, o as juniorSchedulerTasks, p as juniorAgentBindings } from "./executor-BW9XWgUQ.js";
+import { V as annotationCard } from "./conversation-9Fxa1Zbq.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-C7339Cfm.js";
+import { J as appendConversationMessages, Z as projectConversationMessages, et as settleConversationTitleWork } from "./checkpoint-DaD7_Gsb.js";
+import { O as withLock$1, w as getStateAdapter } from "./profile-BamYnmhO.js";
+import { f as setSandboxResourceConfig, u as getSandboxResourceConfig } from "./resolve-C9ETkt4T.js";
+import { a as getVercelConversationWorkQueue, g as isConversationQueueMessageRejectedError, h as conversationQueueMessageSchema, i as verifyWorkspaceSnapshotJobMessage, o as resolveConversationWorkQueueTopic, s as verifyConversationQueueMessage, t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-BqXd0ZPV.js";
+import { D as scheduledRunSchema, I as getNextRunAtMs } from "./automation-B9Kc1gcf.js";
+import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "./validation-B9lMbisx.js";
 import { a as pluginRuntimeRegistrationsFromPluginSet, n as pluginCatalogConfigFromEnv, r as pluginCatalogConfigFromPluginSet, t as defineJuniorPlugins } from "./plugins-egKWjgue.js";
-import { A as THREAD_OPTOUT_ACK, C as verifySlackSignature, D as withNormalizedThreadId, E as normalizeIncomingSlackThreadId, F as createVercelAttachmentStorage, L as enqueueAgentDispatch, M as parseContent, N as getThreadStopDecision, O as getAuthPausedConversationTurnId, P as renderSlackObjectCard, R as GET$3, S as runWithSlackInstallation, T as stopSlackThread, a as webActorFromEmail, b as clearSlackPendingReactions, c as getProductionSlackAdapter, g as readViewerAutomationSummary, i as recordWebConversationActivity, j as startProcessingReaction, n as conversationTurnIdForMessage, o as createProductionConversationWorkOptions, s as createProductionSlackWebhookServices, t as appendAndEnqueueWebMessage, v as recordSkippedConversationMessage, w as isSlackMessageStopped, y as buildSlackInboundMessage } from "./web-input-B-siN5Dr.js";
-import { O as recordAutomationExecution, _ as markDispatchFailed, a as confirmDispatchMailboxAppend, d as getPluginDispatchProjection, f as isTerminalDispatchStatus, l as getDispatchRecord, o as createOrGetDispatch, p as listPendingDispatchMailboxAppends, s as getDispatchConversationId } from "./task-runner-BZaqoUCT.js";
-import { c as listPendingAgentInvocationMailboxAppends, r as enqueueAgentInvocation } from "./work-CNc0ejGG.js";
-import { s as coerceThreadConversationState } from "./thread-state-8tXZhu0y.js";
-import { a as GET$4, i as publishAppHomeView, r as GET$5, t as receiveLocalOAuthCredential } from "./credential-sync-BO4DfH9a.js";
-import { a as registerVercelPluginTaskDevConsumer, n as createVercelPluginTaskCallback, s as queueCallback } from "./task-queue-CZqUNJD0.js";
-import { t as processConversationWork } from "./worker-BHbqpUAu.js";
-import { t as bindSpawnAgent } from "./spawn-DhfMKt4y.js";
+import { A as withNormalizedThreadId, B as enqueueAgentDispatch, C as clearSlackPendingReactions, D as isSlackMessageStopped, E as verifySlackSignature, F as parseContent, I as getThreadStopDecision, L as renderSlackObjectCard, N as THREAD_OPTOUT_ACK, O as stopSlackThread, P as startProcessingReaction, R as createVercelAttachmentStorage, S as buildSlackInboundMessage, T as runWithSlackInstallation, V as GET$3, _ as readViewerAutomationSummary, a as recordWebConversationActivity, c as createProductionSlackWebhookServices, j as getAuthPausedConversationTurnId, k as normalizeIncomingSlackThreadId, l as getProductionSlackAdapter, n as conversationTurnIdForMessage, o as webActorFromEmail, s as createProductionConversationWorkOptions, t as appendAndEnqueueWebMessage, x as recordSkippedConversationMessage } from "./web-input-CfNxXtHm.js";
+import { O as recordAutomationExecution, _ as markDispatchFailed, a as confirmDispatchMailboxAppend, d as getPluginDispatchProjection, f as isTerminalDispatchStatus, l as getDispatchRecord, o as createOrGetDispatch, p as listPendingDispatchMailboxAppends, s as getDispatchConversationId, t as processPluginTask } from "./task-runner-C5XCIDSF.js";
+import { c as listPendingAgentInvocationMailboxAppends, r as enqueueAgentInvocation } from "./work-DNaoFrEe.js";
+import { s as coerceThreadConversationState } from "./thread-state-D3E29wZk.js";
+import { a as GET$4, i as publishAppHomeView, r as GET$5, t as receiveLocalOAuthCredential } from "./credential-sync-BWTA3LnL.js";
+import { a as registerVercelPluginTaskDevConsumer, n as createVercelPluginTaskCallback, s as queueCallback } from "./task-queue-DGQEOk1A.js";
+import { t as processConversationWork } from "./worker-xeJLxYwm.js";
+import { t as bindSpawnAgent } from "./spawn-DFdRspSD.js";
 import { createRequire } from "node:module";
-import { pathToFileURL } from "node:url";
 import { Hono } from "hono";
 import { z } from "zod";
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { and, asc, eq, inArray, isNotNull, isNull, lte, or, sql } from "drizzle-orm";
 import { EVENT_SUMMARY_MAX_LENGTH, EVENT_TEXT_MAX_LENGTH, dispatchOptionsSchema, eventSchema, isSlackDestination, userSchema } from "@sentry/junior-plugin-api";
+import { pathToFileURL } from "node:url";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { createRemoteJWKSet, decodeJwt, jwtVerify } from "jose";
 import { ChannelImpl, ThreadImpl } from "chat";
@@ -652,6 +652,7 @@ function singleLineMetadataValue(value) {
 /** Render the due scheduled automation as plain agent input. */
 function buildDispatchInput(task) {
 	return renderTaskInput({
+		creator: slackMention(task.createdBy.slackUserId),
 		instructions: task.task.text,
 		outcomes: effectiveTaskOutcomes(task.outcomes, task.destination)
 	});
@@ -2791,14 +2792,35 @@ function resolveConversationWorkVisibilityTimeoutSeconds(functionMaxDurationSeco
 /** Process one Vercel Queue payload with the generic conversation worker. */
 async function processConversationQueueMessage(message, options) {
 	const parsed = parseConversationQueueMessage(message);
-	return await processConversationWork(parsed, {
-		checkInIntervalMs: options.checkInIntervalMs,
-		conversationStore: options.conversationStore,
-		nowMs: options.nowMs,
-		queue: options.queue ?? getVercelConversationWorkQueue(),
-		run: options.run,
-		softYieldAfterMs: options.softYieldAfterMs,
-		state: options.state
+	try {
+		return await processConversationWork(parsed, {
+			checkInIntervalMs: options.checkInIntervalMs,
+			conversationStore: options.conversationStore,
+			nowMs: options.nowMs,
+			queue: options.queue ?? getVercelConversationWorkQueue(),
+			run: options.run,
+			softYieldAfterMs: options.softYieldAfterMs,
+			state: options.state
+		});
+	} finally {
+		options.waitUntil?.(settleConversationTitleWork(parsed.conversationId));
+	}
+}
+/**
+* Run one queue message through the worker without a Vercel push callback.
+* In-process queues use this. The callback's kill switch, request deadline,
+* and permanent rejection rules apply; signature checks do not.
+*/
+async function consumeConversationQueueMessage(message, options) {
+	const nowMs = Date.now();
+	await conversationWorkCallback(options).consume(message, {
+		consumerGroup: "in_process",
+		createdAt: new Date(nowMs),
+		deliveryCount: 1,
+		expiresAt: new Date(nowMs + 3e4),
+		messageId: options.messageId,
+		region: "local",
+		topicName: resolveConversationWorkQueueTopic(options)
 	});
 }
 function logConversationQueueMessageRejected(reason, metadata, error) {
@@ -2923,6 +2945,7 @@ function eventInput(task, event) {
 	const guidance = eventGuidance(getEventCatalog(), event.namespace, task.trigger.resourceType, event.eventType);
 	return renderTaskInput({
 		about: task.trigger.label,
+		creator: slackMention(task.createdBy.slackUserId),
 		instructions: task.task.text,
 		outcomes: effectiveTaskOutcomes(task.outcomes, task.destination),
 		guidance,
@@ -4802,82 +4825,15 @@ async function handleAcpAuthorizationPage(args) {
 	return renderResult(args.agentName, result);
 }
 //#endregion
-//#region src/app.ts
-/** Resolve the public deployment URL used by ACP browser authorization. */
-function resolveAcpBaseURL(dashboard) {
-	const configured = dashboard?.baseURL?.trim() || process.env.JUNIOR_BASE_URL?.trim();
-	if (configured) return configured;
-	const vercelURL = process.env.VERCEL_PROJECT_PRODUCTION_URL?.trim() || process.env.VERCEL_URL?.trim();
-	if (!vercelURL) return void 0;
-	return /^https?:\/\//.test(vercelURL) ? vercelURL : `https://${vercelURL}`;
-}
+//#region src/dashboard-routes.ts
 const DASHBOARD_PACKAGE_NAME = "@sentry/junior-dashboard";
-/** Build a `WaitUntilFn`, preferring Vercel's lifetime extension when available. */
-async function defaultWaitUntil() {
-	try {
-		const { waitUntil } = await import("@vercel/functions");
-		return (task) => {
-			const promise = typeof task === "function" ? task() : task;
-			waitUntil(promise);
-		};
-	} catch {
-		return (task) => {
-			(typeof task === "function" ? task() : task).catch(console.error);
-		};
-	}
-}
-/** Resolve build-time configuration from the virtual module injected by juniorNitro(). */
-async function resolveVirtualConfig() {
-	try {
-		const mod = await import("#junior/config");
-		return {
-			createDashboardApp: mod.createDashboardApp,
-			functionMaxDurationSeconds: mod.functionMaxDurationSeconds,
-			dashboard: mod.dashboard,
-			pluginSet: mod.pluginSet,
-			plugins: mod.plugins,
-			pluginRuntimeRegistrations: mod.pluginRuntimeRegistrations ?? []
-		};
-	} catch (error) {
-		if (!isMissingVirtualConfig(error)) throw error;
-		return;
-	}
-}
-function isMissingVirtualConfig(error) {
-	if (!(error instanceof Error)) return false;
-	const code = error.code;
-	return (code === "ERR_PACKAGE_IMPORT_NOT_DEFINED" || code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND") && error.message.includes("#junior/config");
-}
-function hasConfiguredPluginCatalog(config) {
-	if (!config) return false;
-	return Boolean(config.inlineManifests?.length || config.packages?.length || Object.keys(config.manifests ?? {}).length);
-}
-function warnUnregisteredConfigDefaults(defaults) {
-	for (const key of Object.keys(defaults ?? {})) if (!pluginCatalogRuntime.isConfigKey(key)) logWarn("config.default.unregistered", { "app.config.key": key });
-}
-function pluginPackageNames(config) {
-	return config?.packages ?? [];
-}
-function validateBuildIncludesPluginPackages(pluginConfig, virtualConfig) {
-	if (!virtualConfig?.plugins) return;
-	const bundled = new Set(pluginPackageNames(virtualConfig.plugins));
-	const missing = pluginPackageNames(pluginConfig).filter((packageName) => !bundled.has(packageName));
-	if (missing.length === 0) return;
-	throw new Error(`createApp() registered plugin package(s) not bundled by juniorNitro(): ${missing.join(", ")}. Point juniorNitro({ plugins: "./plugins" }) at the runtime plugin module or pass the same defineJuniorPlugins(...) set to juniorNitro({ plugins }) and createApp({ plugins }).`);
-}
-function validateBuildIncludesPluginRuntimeRegistrations(runtimeRegistrations, virtualConfig) {
-	const bundledRuntimeRegistrations = virtualConfig?.pluginRuntimeRegistrations ?? [];
-	if (bundledRuntimeRegistrations.length === 0) return;
-	const registered = new Set(runtimeRegistrations.map((plugin) => plugin.manifest.name));
-	const missing = bundledRuntimeRegistrations.filter((pluginName) => !registered.has(pluginName));
-	if (missing.length === 0) return;
-	throw new Error(`createApp() is missing plugin registration(s) with runtime code bundled by juniorNitro(): ${missing.join(", ")}. Pass a runtime-safe plugin module to juniorNitro({ plugins: "./plugins" }) or pass the same defineJuniorPlugins(...) set to createApp({ plugins }).`);
-}
+/** Mount the dashboard app on the dashboard-owned host paths. */
 async function createDashboardRouteRegistrations(args) {
 	if (!args.dashboard || args.dashboard.disabled) return [];
 	const createDashboardApp = args.createDashboardApp ?? await loadDashboardAppFactory();
 	return dashboardRouteRegistrations({
 		authenticatedRoutes: args.authenticatedRoutes,
+		conversationWorkQueue: args.conversationWorkQueue,
 		dashboard: args.dashboard,
 		createDashboardApp,
 		pluginRoutes: args.pluginRoutes
@@ -4920,6 +4876,7 @@ function dashboardHostRoutePaths(dashboard, authenticatedRoutes = []) {
 	const pagePaths = [
 		basePath,
 		pagePath("code"),
+		`${pagePath("code")}/*`,
 		conversationsPath,
 		`${conversationsPath}/*`,
 		pagePath("locations"),
@@ -4962,6 +4919,7 @@ function dashboardHostRoutePaths(dashboard, authenticatedRoutes = []) {
 		"/api/automations/*",
 		"/api/skills",
 		"/api/code",
+		"/api/code/*",
 		"/api/stats",
 		"/api/conversations",
 		"/api/conversations/*",
@@ -5020,6 +4978,7 @@ function dashboardRouteRegistrations(args) {
 			...args.dashboard,
 			agentName: botConfig.userName,
 			authenticatedRoutes: args.authenticatedRoutes,
+			conversationWorkQueue: args.conversationWorkQueue,
 			pluginRoutes: args.pluginRoutes
 		};
 		app ??= args.createDashboardApp(dashboardOptions);
@@ -5031,10 +4990,82 @@ function dashboardRouteRegistrations(args) {
 		path
 	}));
 }
+/** Reject plugin routes that would shadow dashboard or auth paths. */
 function validateDashboardRouteOwnership(args) {
 	if (!args.dashboard || args.dashboard.disabled) return;
 	for (const route of args.routes) if (dashboardOwnedRoutePath(route.path, args.dashboard, args.authenticatedRoutes)) throw new Error(`Plugin "${route.pluginName}" route "${route.path}" conflicts with core dashboard routes`);
 }
+//#endregion
+//#region src/app.ts
+/** Resolve the public deployment URL used by ACP browser authorization. */
+function resolveAcpBaseURL(dashboard) {
+	const configured = dashboard?.baseURL?.trim() || process.env.JUNIOR_BASE_URL?.trim();
+	if (configured) return configured;
+	const vercelURL = process.env.VERCEL_PROJECT_PRODUCTION_URL?.trim() || process.env.VERCEL_URL?.trim();
+	if (!vercelURL) return void 0;
+	return /^https?:\/\//.test(vercelURL) ? vercelURL : `https://${vercelURL}`;
+}
+/** Build a `WaitUntilFn`, preferring Vercel's lifetime extension when available. */
+async function defaultWaitUntil() {
+	try {
+		const { waitUntil } = await import("@vercel/functions");
+		return (task) => {
+			const promise = typeof task === "function" ? task() : task;
+			waitUntil(promise);
+		};
+	} catch {
+		return (task) => {
+			(typeof task === "function" ? task() : task).catch(console.error);
+		};
+	}
+}
+/** Resolve build-time configuration from the virtual module injected by juniorNitro(). */
+async function resolveVirtualConfig() {
+	try {
+		const mod = await import("#junior/config");
+		return {
+			createDashboardApp: mod.createDashboardApp,
+			functionMaxDurationSeconds: mod.functionMaxDurationSeconds,
+			dashboard: mod.dashboard,
+			pluginSet: mod.pluginSet,
+			plugins: mod.plugins,
+			pluginRuntimeRegistrations: mod.pluginRuntimeRegistrations ?? []
+		};
+	} catch (error) {
+		if (!isMissingVirtualConfig(error)) throw error;
+		return;
+	}
+}
+function isMissingVirtualConfig(error) {
+	if (!(error instanceof Error)) return false;
+	const code = error.code;
+	return (code === "ERR_PACKAGE_IMPORT_NOT_DEFINED" || code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND") && error.message.includes("#junior/config");
+}
+function hasConfiguredPluginCatalog(config) {
+	if (!config) return false;
+	return Boolean(config.inlineManifests?.length || config.packages?.length || Object.keys(config.manifests ?? {}).length);
+}
+function warnUnregisteredConfigDefaults(defaults) {
+	for (const key of Object.keys(defaults ?? {})) if (!pluginCatalogRuntime.isConfigKey(key)) logWarn("config.default.unregistered", { "app.config.key": key });
+}
+function pluginPackageNames(config) {
+	return config?.packages ?? [];
+}
+function validateBuildIncludesPluginPackages(pluginConfig, virtualConfig) {
+	if (!virtualConfig?.plugins) return;
+	const bundled = new Set(pluginPackageNames(virtualConfig.plugins));
+	const missing = pluginPackageNames(pluginConfig).filter((packageName) => !bundled.has(packageName));
+	if (missing.length === 0) return;
+	throw new Error(`createApp() registered plugin package(s) not bundled by juniorNitro(): ${missing.join(", ")}. Point juniorNitro({ plugins: "./plugins" }) at the runtime plugin module or pass the same defineJuniorPlugins(...) set to juniorNitro({ plugins }) and createApp({ plugins }).`);
+}
+function validateBuildIncludesPluginRuntimeRegistrations(runtimeRegistrations, virtualConfig) {
+	const bundledRuntimeRegistrations = virtualConfig?.pluginRuntimeRegistrations ?? [];
+	if (bundledRuntimeRegistrations.length === 0) return;
+	const registered = new Set(runtimeRegistrations.map((plugin) => plugin.manifest.name));
+	const missing = bundledRuntimeRegistrations.filter((pluginName) => !registered.has(pluginName));
+	if (missing.length === 0) return;
+	throw new Error(`createApp() is missing plugin registration(s) with runtime code bundled by juniorNitro(): ${missing.join(", ")}. Pass a runtime-safe plugin module to juniorNitro({ plugins: "./plugins" }) or pass the same defineJuniorPlugins(...) set to createApp({ plugins }).`);
+}
 /** Mount HTTP handlers before core routes claim those paths. */
 function mountRoutes(app, routes) {
 	for (const route of routes) {
@@ -5048,7 +5079,6 @@ function mountRoutes(app, routes) {
 /** Create a Hono app with all Junior routes. */
 async function createApp(options) {
 	const virtualConfig = await resolveVirtualConfig();
-	if (virtualConfig?.functionMaxDurationSeconds !== void 0) configureFunctionMaxDurationSeconds(virtualConfig.functionMaxDurationSeconds);
 	const dashboard = options?.dashboard ?? virtualConfig?.dashboard;
 	const configuredPlugins = options?.plugins ?? virtualConfig?.pluginSet;
 	const plugins = pluginRuntimeRegistrationsFromPluginSet(configuredPlugins);
@@ -5058,21 +5088,19 @@ async function createApp(options) {
 	validatePlugins(plugins);
 	getDb();
 	const shouldValidatePluginCatalog = hasConfiguredPluginCatalog(pluginConfig) || Boolean(configuredPlugins?.registrations.length) || Boolean(Object.keys(options?.configDefaults ?? {}).length);
-	const previousBotConfig = { ...botConfig };
+	const previousRuntimeConfig = snapshotRuntimeConfig();
 	const previousPluginCatalogConfig = pluginCatalogRuntime.setConfig(pluginConfig);
 	const previousPlugins = setPlugins(plugins);
 	const previousConfigDefaults = getConfigDefaults();
-	const previousSlackReactionConfig = getSlackReactionConfig();
 	const previousSandboxResources = getSandboxResourceConfig();
 	const previousExperimentalFeatures = getExperimentalFeatures();
 	const previousBriefsConfig = setBriefsConfig(options?.briefs);
 	const previousDashboardLinkOptions = setDashboardConversationLinkOptions(dashboard);
-	const restoreRuntimeConfig = () => {
+	const restoreRuntimeConfig$1 = () => {
 		pluginCatalogRuntime.setConfig(previousPluginCatalogConfig);
 		setPlugins(previousPlugins);
 		setConfigDefaults(previousConfigDefaults);
-		Object.assign(botConfig, previousBotConfig);
-		setSlackReactionConfig(previousSlackReactionConfig);
+		restoreRuntimeConfig(previousRuntimeConfig);
 		setSandboxResourceConfig(previousSandboxResources);
 		setExperimentalFeatures(previousExperimentalFeatures);
 		setBriefsConfig(previousBriefsConfig);
@@ -5080,7 +5108,10 @@ async function createApp(options) {
 	};
 	let pluginRoutes = [];
 	let pluginApiRoutes = [];
-	const events = createEventAppPublisher({ conversationWork: () => getConversationWorkOptions() });
+	const events = createEventAppPublisher({ conversationWork: () => ({
+		...getConversationWorkOptions(),
+		queue: conversationWorkQueue
+	}) });
 	let sandboxEgressTracePropagationDomains = [];
 	try {
 		sandboxEgressTracePropagationDomains = normalizeSandboxEgressTracePropagationDomains(options?.sandbox?.egressTracePropagationDomains);
@@ -5088,9 +5119,12 @@ async function createApp(options) {
 		setExperimentalFeatures(options?.experimental);
 		setConfigDefaults(options?.configDefaults);
 		warnUnregisteredConfigDefaults(options?.configDefaults);
+		resetRuntimeConfig(virtualConfig?.functionMaxDurationSeconds);
 		if (options?.profiles || options?.defaultProfile) setProfiles(options.profiles, options.defaultProfile);
-		if (options) setBotModelConfig(options);
-		if (options?.slack) setSlackReactionConfig(options.slack);
+		setBotModelConfig(options ?? {});
+		setRuntimeLimits(options?.limits);
+		setSlackReactionConfig(options?.slack ?? {});
+		if (options?.slack?.crossActorMidRunMode) setCrossActorMidRunMode(options.slack.crossActorMidRunMode);
 		if (shouldValidatePluginCatalog) {
 			pluginCatalogRuntime.getSignature();
 			validatePluginRegistrations(configuredPlugins?.registrations ?? []);
@@ -5099,12 +5133,16 @@ async function createApp(options) {
 		pluginRoutes = getPluginRoutes({ events });
 		if (dashboard && !dashboard.disabled) pluginApiRoutes = getPluginApiRoutes();
 	} catch (error) {
-		restoreRuntimeConfig();
+		restoreRuntimeConfig$1();
 		throw error;
 	}
 	const waitUntil = options?.waitUntil ?? await defaultWaitUntil();
 	const tracePropagation = { domains: sandboxEgressTracePropagationDomains };
-	const conversationWorkQueue = getVercelConversationWorkQueue();
+	const conversationWorkQueue = options?.conversationWork?.queue ?? options?.conversationWorkQueue?.((message, delivery) => consumeConversationQueueMessage(message, {
+		...getConversationWorkOptions(),
+		messageId: delivery.messageId
+	})) ?? getVercelConversationWorkQueue();
+	const pluginTaskQueue = options?.pluginTaskQueue?.(processPluginTask);
 	const attachmentStorage = createVercelAttachmentStorage();
 	const agentRunner = createAgentRunner(executeAgentRun, {
 		attachmentStorage,
@@ -5120,7 +5158,10 @@ async function createApp(options) {
 	const getConversationWorkOptions = () => {
 		conversationWorkOptions ??= options?.conversationWork ?? createProductionConversationWorkOptions({
 			agentRunner,
-			services: runtimeServiceOverrides
+			queue: conversationWorkQueue,
+			...pluginTaskQueue ? { sendPluginTask: (message) => pluginTaskQueue.send(message) } : void 0,
+			services: runtimeServiceOverrides,
+			waitUntil: (task) => waitUntil(task)
 		});
 		return conversationWorkOptions;
 	};
@@ -5136,7 +5177,7 @@ async function createApp(options) {
 				conversations: createAcpConversations({
 					conversationStore: work.conversationStore,
 					eventStore: getConversationEventStore(),
-					queue: work.queue ?? getVercelConversationWorkQueue(),
+					queue: conversationWorkQueue,
 					state
 				}),
 				onError: (error, event, attributes) => void logException(error, event, {
@@ -5167,10 +5208,13 @@ async function createApp(options) {
 			routes: pluginRoutes
 		});
 	} catch (error) {
-		restoreRuntimeConfig();
+		restoreRuntimeConfig$1();
 		throw error;
 	}
-	const slackWebhookServices = createProductionSlackWebhookServices({ services: runtimeServiceOverrides });
+	const slackWebhookServices = createProductionSlackWebhookServices({
+		queue: conversationWorkQueue,
+		services: runtimeServiceOverrides
+	});
 	const app = new Hono();
 	app.onError((err, c) => {
 		logException(err, "route.unhandled.exception");
@@ -5187,6 +5231,7 @@ async function createApp(options) {
 	mountRoutes(app, pluginRoutes);
 	mountRoutes(app, await createDashboardRouteRegistrations({
 		authenticatedRoutes,
+		conversationWorkQueue,
 		dashboard,
 		createDashboardApp: virtualConfig?.createDashboardApp,
 		pluginRoutes: pluginApiRoutes
@@ -5198,10 +5243,10 @@ async function createApp(options) {
 		storage: attachmentStorage
 	}));
 	app.get("/api/oauth/callback/mcp/:provider", (c) => {
-		return GET$4(c.req.raw, c.req.param("provider"), waitUntil, { conversationWorkQueue: getVercelConversationWorkQueue() });
+		return GET$4(c.req.raw, c.req.param("provider"), waitUntil, { conversationWorkQueue });
 	});
 	app.get("/api/oauth/callback/:provider", (c) => {
-		return GET$5(c.req.raw, c.req.param("provider"), waitUntil, { conversationWorkQueue: getVercelConversationWorkQueue() });
+		return GET$5(c.req.raw, c.req.param("provider"), waitUntil, { conversationWorkQueue });
 	});
 	app.get("/api/internal/sandbox-egress/signals", (c) => {
 		return GET(c.req.raw);
@@ -5233,7 +5278,7 @@ async function createApp(options) {
 		return workspaceSnapshotJobPOST(c.req.raw);
 	});
 	app.get("/api/internal/heartbeat", (c) => {
-		return GET$2(c.req.raw, waitUntil);
+		return GET$2(c.req.raw, waitUntil, { conversationWorkQueue });
 	});
 	app.get("/api/internal/retention", (c) => {
 		return GET$1(c.req.raw);