@sentry/junior 0.244.0 → 0.246.0

package/dist/{app-DRLh-8zs.d.ts → app-BYB7szGb.d.ts}

@@ -61,6 +61,8 @@ interface RuntimeLimits {
   maxAgentDepth?: number;
   /** Automated turns in a row before Junior stops answering automation. */
   maxConsecutiveAutomatedTurns?: number;
+  /** Runs one Event automation can start in a rolling hour. */
+  maxEventAutomationRunsPerHour?: number;
   /** Run slices one turn may use. */
   maxSlicesPerTurn?: number;
   /** Tool calls one turn may make. */

package/dist/app.d.ts

@@ -1,4 +1,4 @@
-import { i as ModelProfileInput, n as createApp, r as JuniorDashboardOptions, t as JuniorAppOptions } from "./app-DRLh-8zs.js";
+import { i as ModelProfileInput, n as createApp, r as JuniorDashboardOptions, t as JuniorAppOptions } from "./app-BYB7szGb.js";
 import { i as defineJuniorPlugins, n as JuniorPluginSet, r as JuniorPluginSetOptions, t as JuniorPluginInput } from "./plugins-CjfUP5gJ.js";
 import { t as JUNIOR_VERSION } from "./version-CnXZ614E.js";
 export { JUNIOR_VERSION, JuniorAppOptions, type JuniorDashboardOptions, type JuniorPluginInput, type JuniorPluginSet, type JuniorPluginSetOptions, type ModelProfileInput, createApp, defineJuniorPlugins };

package/dist/app.js

@@ -1,33 +1,34 @@
-import { $t as resolveSandboxEgressProviderForHost, B as effectiveTaskOutcomes, Cn as setConfigDefaults, E as requestAttachmentDeletion, F as logScheduledAutomationRunSkipped, Ft as listActiveConversationIds, Gt as CONVERSATION_WORK_STALE_ENQUEUE_MS, I as scheduledAutomationRunAttributes, Mt as getConversation, Nt as getConversationWorkState, O as parseSlackThreadId, Pt as hasRunnableConversationWork, Sn as getConfigDefaults, Tt as clearExpiredConversationLease, U as recordSubagentEnded, Ut as stopConversationWork, Vt as requestConversationWork, Xt as renderTaskInput, Yt as isInvalidConversationRecordError, an as consumeSandboxEgressPermissionDeniedSignal, b as unpublishedArtifactHeaders, bt as appendAndEnqueueInboundMessage, c as deleteMcpAuthSessionsForUserProvider, cn as formatProviderLabel, dn as startOAuthFlow, dt as ingestEvent, en as normalizeSandboxEgressTracePropagationDomains, fn as createUserTokenStore, gt as eventGuidance, ht as getEventCatalog, i as executeCredentialedEgressRequest, in as consumeSandboxEgressAuthRequiredSignal, jt as ensureConversationWake, l as deleteMcpServerSessionId, n as executeAgentRun, nn as SANDBOX_EGRESS_PROXY_PATH, nt as listPendingAgentInvocationMailboxAppends, on as parseSandboxEgressCredentialToken, qt as hasRunnableConversationWork$1, rn as clearSandboxEgressSignals, rt as listPendingAgentInvocationResults, t as createAgentRunner, tn as shouldPropagateSandboxEgressTrace, u as deleteMcpStoredOAuthCredentials, ut as processWorkspaceSnapshotJob, v as publicArtifactHeaders, w as collectAttachmentGarbage, x as lookupSlackUserProfile, y as readPublicArtifact, zt as removeActiveConversation } from "./agent-runner-DtEtbaOb.js";
-import { C as withLogContext, O as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE, S as withContext, d as logException, f as logInfo, j as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, p as logWarn, r as createRequestContext, v as setSpanAttributes, w as withSpan, y as setSpanStatus } from "./logging-z7_w-KN_.js";
-import { r as continueTrace } from "./sentry-CgWZM_kV.js";
-import { t as JUNIOR_VERSION } from "./version-DVCHJYcY.js";
-import { _ as snapshotRuntimeConfig, d as restoreRuntimeConfig, f as setBotModelConfig, g as setSlackReactionConfig, h as setRuntimeLimits, i as getChatConfig, m as setProfiles, n as botConfig, o as getSlackBotToken, p as setCrossActorMidRunMode, u as resetRuntimeConfig } from "./config-q9xXVN_5.js";
+import { At as appendAndEnqueueInboundMessage, B as effectiveTaskOutcomes, Ct as SLACK_EVENT_NAMESPACE, Dt as eventGuidance, E as requestAttachmentDeletion, F as logScheduledAutomationRunSkipped, Ft as clearExpiredConversationLease, Gt as listActiveConversationIds, Ht as getConversation, I as scheduledAutomationRunAttributes, Nn as getConfigDefaults, O as parseSlackThreadId, Pn as setConfigDefaults, Sn as createUserTokenStore, St as getEventCatalog, Tt as slackChannelMessageReplyThreadTs, U as recordSubagentEnded, Ut as getConversationWorkState, Vt as ensureConversationWake, Wt as hasRunnableConversationWork, Yt as removeActiveConversation, _t as processWorkspaceSnapshotJob, an as isInvalidConversationRecordError, b as unpublishedArtifactHeaders, c as deleteMcpAuthSessionsForUserProvider, ct as listPendingAgentInvocationResults, dn as shouldPropagateSandboxEgressTrace, fn as SANDBOX_EGRESS_PROXY_PATH, gn as parseSandboxEgressCredentialToken, hn as consumeSandboxEgressPermissionDeniedSignal, i as executeCredentialedEgressRequest, l as deleteMcpServerSessionId, ln as resolveSandboxEgressProviderForHost, mn as consumeSandboxEgressAuthRequiredSignal, n as executeAgentRun, on as renderTaskInput, pn as clearSandboxEgressSignals, rn as hasRunnableConversationWork$1, st as listPendingAgentInvocationMailboxAppends, t as createAgentRunner, tn as CONVERSATION_WORK_STALE_ENQUEUE_MS, u as deleteMcpStoredOAuthCredentials, un as normalizeSandboxEgressTracePropagationDomains, v as publicArtifactHeaders, vn as formatProviderLabel, vt as ingestEvent, w as collectAttachmentGarbage, wt as slackChannelMessageEvent, x as lookupSlackUserProfile, xn as startOAuthFlow, y as readPublicArtifact } from "./agent-runner-DSKpHjHW.js";
+import { C as withLogContext, O as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE, S as withContext, d as logException, f as logInfo, j as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, p as logWarn, r as createRequestContext, v as setSpanAttributes, w as withSpan, y as setSpanStatus } from "./logging-DVtMYOdD.js";
+import { n as captureMessage, r as continueTrace } from "./sentry-CgWZM_kV.js";
+import { t as JUNIOR_VERSION } from "./version-Deub4try.js";
+import { _ as snapshotRuntimeConfig, d as restoreRuntimeConfig, f as setBotModelConfig, g as setSlackReactionConfig, h as setRuntimeLimits, i as getChatConfig, m as setProfiles, n as botConfig, o as getSlackBotToken, p as setCrossActorMidRunMode, u as resetRuntimeConfig } from "./config-BK53Ip5C.js";
 import { _ as slackMessageTsSchema, d as parseSlackTeamId, f as parseSlackUserId, h as slackUserIdSchema, m as slackTeamIdSchema, o as parseActorUserId, p as slackChannelIdSchema } from "./actor-BTtLaeWy.js";
-import { D as deleteProviderIdentityForSlackUser, c as getConversationEventStore, d as getDb, f as getSqlExecutor, g as withConversationMutationLock, m as withConversationEventLock, r as readActorIdentity, u as getConversationStore } from "./viewer-BBnCMR1g.js";
+import { D as deleteProviderIdentityForSlackUser, c as getConversationEventStore, d as getDb, f as getSqlExecutor, g as withConversationMutationLock, m as withConversationEventLock, r as readActorIdentity, u as getConversationStore } from "./viewer-D5hbx6TE.js";
 import { a as juniorAgentInvocations, d as juniorDestinations, i as juniorAgentBindings, s as juniorConversations } from "./agent-invocations-BO6ddZax.js";
-import { _ as juniorConversationEvents, a as juniorSchedulerRuns, m as juniorConversationBriefs, o as juniorSchedulerTasks } from "./executor-DA7eHhmC.js";
-import { n as pluginCatalogRuntime } from "./catalog-runtime-CpxhLwZG.js";
-import { Gt as settleConversationTitleWork, H as slackEntitySchema, Ht as projectConversationMessages, N as slackMention, U as slackExternalRefIdSchema, a as readScheduledAutomation, c as scheduledRunId, d as collectEventAutomationMatchKeys, h as findMatchingEventAutomations, l as withScheduledAutomationLock, n as listScheduledAutomations, r as listScheduledAutomationsForTeam, s as saveScheduledAutomationInLock, zt as appendConversationMessages } from "./tasks-DBZAgTx7.js";
-import { $ as verifySlackDirectCredentialSubject, At as listConversationAnnotations, Dt as resolveRootVisibility, G as findMatchingWatches, Gt as getWorkspaceTeamId, J as bindEventAutomationCredentialSubject, Kt as runWithWorkspaceTeamId, Q as verifyScheduledAutomationCredentialSubject, V as collectEventMatchKeys, Vt as isDmChannel, X as bindSlackDirectCredentialSubject, Y as bindScheduledAutomationCredentialSubject, Z as verifyEventAutomationCredentialSubject, a as getPluginRoutes, at as setDashboardConversationLinkOptions, d as setPlugins, f as validatePlugins, h as setBriefsConfig, i as getPluginApiRoutes, it as getDashboardTaskLink, lt as createPluginLogger, nt as getDashboardConversationLink, ot as createPluginState, q as takeDueTimerWatches, u as getPlugins, ut as readConversationAccessFromSql, z as cancelSubscriptions, zt as getSlackClient } from "./agent-hooks-Cj_rSeWd.js";
-import { V as annotationCard } from "./conversation-BxvgH64Q.js";
-import { O as withLock$1, w as getStateAdapter } from "./profile-yeKVNECl.js";
-import { c as getThreadStopDecision } from "./pending-auth-OndKPW4M.js";
+import { _ as juniorConversationEvents, a as juniorSchedulerRuns, m as juniorConversationBriefs, o as juniorSchedulerTasks } from "./executor-bmmuRY-w.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-CTaQXYqS.js";
+import { C as eventAutomationRunLimitReason, F as slackMention, G as slackExternalRefIdSchema, S as admitEventAutomationRun, Vt as appendConversationMessages, W as slackEntitySchema, Wt as projectConversationMessages, a as readScheduledAutomation, c as scheduledRunId, d as collectEventAutomationMatchKeys, h as findMatchingEventAutomations, l as withScheduledAutomationLock, n as listScheduledAutomations, qt as settleConversationTitleWork, r as listScheduledAutomationsForTeam, s as saveScheduledAutomationInLock, u as blockEventAutomation } from "./tasks-B9OIjl2K.js";
+import { $ as verifySlackDirectCredentialSubject, At as listConversationAnnotations, Dt as resolveRootVisibility, G as findMatchingWatches, Gt as getWorkspaceTeamId, J as bindEventAutomationCredentialSubject, Kt as runWithWorkspaceTeamId, Q as verifyScheduledAutomationCredentialSubject, V as collectEventMatchKeys, Vt as isDmChannel, X as bindSlackDirectCredentialSubject, Y as bindScheduledAutomationCredentialSubject, Z as verifyEventAutomationCredentialSubject, a as getPluginRoutes, at as setDashboardConversationLinkOptions, d as setPlugins, f as validatePlugins, h as setBriefsConfig, i as getPluginApiRoutes, it as getDashboardTaskLink, lt as createPluginLogger, nt as getDashboardConversationLink, ot as createPluginState, q as takeDueTimerWatches, u as getPlugins, ut as readConversationAccessFromSql, z as cancelSubscriptions, zt as getSlackClient } from "./agent-hooks-DpklSWZg.js";
+import { H as annotationCard } from "./conversation-CvBG57Io.js";
+import { O as withLock$1, w as getStateAdapter } from "./profile-BevMNSlr.js";
+import { c as getThreadStopDecision } from "./pending-auth-BuQLZ6dK.js";
 import { n as getNextRunAtMs } from "./cadence-D00SCzT1.js";
-import { f as setSandboxResourceConfig, u as getSandboxResourceConfig } from "./resolve-4u5gEU04.js";
-import { a as getVercelConversationWorkQueue, g as isConversationQueueMessageRejectedError, h as conversationQueueMessageSchema, i as verifyWorkspaceSnapshotJobMessage, o as resolveConversationWorkQueueTopic, s as verifyConversationQueueMessage, t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-mVyF9jgv.js";
+import { f as setSandboxResourceConfig, u as getSandboxResourceConfig } from "./resolve-qPhrznTf.js";
+import { a as getVercelConversationWorkQueue, g as isConversationQueueMessageRejectedError, h as conversationQueueMessageSchema, i as verifyWorkspaceSnapshotJobMessage, o as resolveConversationWorkQueueTopic, s as verifyConversationQueueMessage, t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-Cz3M7gg4.js";
 import { D as scheduledRunSchema } from "./automation-gznOMaQ2.js";
 import { i as setExperimentalFeatures, n as getExperimentalFeatures, r as isExperimentalFeatureEnabled } from "./experimental-Qn9rKLgx.js";
-import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "./validation-DcsBjzdi.js";
+import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "./validation-Dg0Ihxzo.js";
 import { a as pluginRuntimeRegistrationsFromPluginSet, n as pluginCatalogConfigFromEnv, r as pluginCatalogConfigFromPluginSet, t as defineJuniorPlugins } from "./plugins-egKWjgue.js";
-import { A as withNormalizedThreadId, B as enqueueAgentDispatch, C as buildSlackInboundMessage, D as isSlackMessageStopped, E as verifySlackSignature, F as parseContent, I as renderSlackObjectCard, L as createVercelAttachmentStorage, N as THREAD_OPTOUT_ACK, O as stopSlackThread, P as startProcessingReaction, R as enqueueAgentInvocationResult, S as recordSkippedConversationMessage, T as runWithSlackInstallation, V as GET$3, a as recordWebConversationActivity, c as createProductionSlackWebhookServices, f as createSlackWebApiStatusSender, j as getAuthPausedConversationTurnId, k as normalizeIncomingSlackThreadId, l as getProductionSlackAdapter, n as conversationTurnIdForMessage, o as webActorFromEmail, s as createProductionConversationWorkOptions, t as appendAndEnqueueWebMessage, v as readViewerAutomationSummary, w as clearSlackPendingReactions } from "./web-input-CIsRGF07.js";
-import { _ as markDispatchFailed, a as confirmDispatchMailboxAppend, d as getPluginDispatchProjection, f as isTerminalDispatchStatus, k as recordAutomationExecution, l as getDispatchRecord, o as createOrGetDispatch, p as listPendingDispatchMailboxAppends, s as getDispatchConversationId, t as processPluginTask, y as notifyAutomationBlocked } from "./task-runner-D4jvUpFV.js";
-import { r as enqueueAgentInvocation } from "./work-fje9VXgQ.js";
-import { s as coerceThreadConversationState } from "./thread-state-hj70P2Cp.js";
-import { a as GET$4, i as publishAppHomeView, r as GET$5, t as receiveLocalOAuthCredential } from "./credential-sync-Bsn-6m16.js";
-import { a as registerVercelPluginTaskDevConsumer, n as createVercelPluginTaskCallback, s as queueCallback } from "./task-queue-BQ0vnumm.js";
-import { t as processConversationWork } from "./worker-Byd2Et9r.js";
-import { t as bindSpawnAgent } from "./spawn-DYg7jhhR.js";
+import { A as withNormalizedThreadId, B as enqueueAgentDispatch, C as buildSlackInboundMessage, D as isSlackMessageStopped, E as verifySlackSignature, F as startProcessingReaction, I as parseContent, L as renderSlackObjectCard, M as getAuthPausedConversationTurnId, O as stopSlackThread, P as THREAD_OPTOUT_ACK, R as createVercelAttachmentStorage, S as recordSkippedConversationMessage, T as runWithSlackInstallation, V as GET$3, a as recordWebConversationActivity, c as createProductionSlackWebhookServices, f as createSlackWebApiStatusSender, j as stopConversationTurn, k as normalizeIncomingSlackThreadId, l as getProductionSlackAdapter, n as conversationTurnIdForMessage, o as webActorFromEmail, s as createProductionConversationWorkOptions, t as appendAndEnqueueWebMessage, v as readViewerAutomationSummary, w as clearSlackPendingReactions } from "./web-input-0sorYVLh.js";
+import { _ as markDispatchFailed, a as confirmDispatchMailboxAppend, d as getPluginDispatchProjection, f as isTerminalDispatchStatus, k as recordAutomationExecution, l as getDispatchRecord, o as createOrGetDispatch, p as listPendingDispatchMailboxAppends, s as getDispatchConversationId, t as processPluginTask, y as notifyAutomationBlocked } from "./task-runner-T51kll0U.js";
+import { r as enqueueAgentInvocation } from "./work-rm2X7jj4.js";
+import { s as coerceThreadConversationState } from "./thread-state-AGZtVyXp.js";
+import { r as enqueueAgentInvocationResult, t as bindMessageAgent } from "./message-BSN-Ma5f.js";
+import { a as GET$4, i as publishAppHomeView, r as GET$5, t as receiveLocalOAuthCredential } from "./credential-sync-BiuhC9Ds.js";
+import { a as registerVercelPluginTaskDevConsumer, n as createVercelPluginTaskCallback, s as queueCallback } from "./task-queue-BX4vG6uA.js";
+import { t as processConversationWork } from "./worker-bnGsAOP3.js";
+import { t as bindSpawnAgent } from "./spawn-C3efZSx3.js";
 import { createRequire } from "node:module";
 import { Hono } from "hono";
 import { z } from "zod";
@@ -1439,12 +1440,20 @@ async function getJwks(issuer) {
 	});
 	return jwks;
 }
-/** Verify Vercel signed this Sandbox firewall proxy request for the active VM session. */
-async function verifyVercelSandboxOidcToken(token) {
+/**
+* Verify Vercel signed this Sandbox firewall proxy request for the active VM session.
+*
+* `currentDate` is the time for the `exp` and `nbf` checks. It defaults to
+* now. Evals pass the real time because they replace `Date`.
+*/
+async function verifyVercelSandboxOidcToken(token, options = {}) {
 	const unverified = decodeJwt(token);
 	if (typeof unverified.iss !== "string") throw new Error("Vercel OIDC token did not include an issuer");
 	const jwks = await getJwks(unverified.iss);
-	return (await jwtVerify(token, jwks, { issuer: unverified.iss })).payload;
+	return (await jwtVerify(token, jwks, {
+		issuer: unverified.iss,
+		...options.currentDate ? { currentDate: options.currentDate } : void 0
+	})).payload;
 }
 //#endregion
 //#region src/chat/sandbox/egress/proxy.ts
@@ -1693,7 +1702,8 @@ async function proxySandboxEgressRequest(request, deps = {}) {
 async function ALL(request, options = {}) {
 	return await proxySandboxEgressRequest(request, {
 		interceptHttp: options.interceptHttp,
-		tracePropagation: options.tracePropagation
+		tracePropagation: options.tracePropagation,
+		verifyOidc: options.verifyOidc
 	});
 }
 /** Return whether a request should be routed through sandbox egress proxying. */
@@ -1913,43 +1923,6 @@ const slackInteractivePayloadSchema = z.object({
 	}).optional()
 });
 //#endregion
-//#region src/chat/conversations/stop.ts
-/** Stop the current Conversation Turn and wake an idle resume when needed. */
-async function stopConversationTurn(args) {
-	const nowMs = args.nowMs ?? Date.now();
-	const stop = async () => await stopConversationWork({
-		conversationId: args.conversationId,
-		conversationStore: args.conversationStore,
-		nowMs,
-		state: args.state
-	});
-	let result = await stop();
-	if (result.status === "no_work" && await getAuthPausedConversationTurnId(args.conversationId)) {
-		const conversation = await getConversation({
-			conversationId: args.conversationId,
-			state: args.state
-		});
-		await requestConversationWork({
-			conversationId: args.conversationId,
-			conversationStore: args.conversationStore,
-			destination: conversation?.destination,
-			nowMs,
-			state: args.state
-		});
-		result = await stop();
-	}
-	if (result.status === "requested") await ensureConversationWake({
-		conversationId: args.conversationId,
-		conversationStore: args.conversationStore,
-		idempotencyKey: `conversation-stop:${args.conversationId}:${result.runId}`,
-		nowMs,
-		queue: args.queue,
-		replaceExistingWake: true,
-		state: args.state
-	});
-	return result;
-}
-//#endregion
 //#region src/chat/ingress/bot-mention.ts
 /**
 * Detect Slack bot @mentions that should activate Junior.
@@ -2028,6 +2001,120 @@ function textMentionsBot(text, botUserId) {
 	return new RegExp(`<@${id}(?:\\|[^>]+)?>`).test(outside);
 }
 //#endregion
+//#region src/chat/event-automations/ingest.ts
+/**
+* Owns event matching and durable event-automation dispatch.
+*
+* Each matching automation is independently idempotent. Aggregate failures propagate
+* so the provider can retry the original delivery.
+*/
+/** Bind provider delivery identity to one automation's durable dispatch. */
+function eventAutomationDispatchKey(taskId, namespace, eventKey) {
+	return `event-automation:${createHash("sha256").update(`${taskId}\0${namespace}\0${eventKey}`).digest("hex").slice(0, 32)}`;
+}
+function oneLine(value) {
+	return value.replace(/[\r\n]+/g, " ").replace(/\s+/g, " ").trim().slice(0, 512);
+}
+/** Compact destination-visible context for event-automation replies. */
+function replyAttribution(task) {
+	const detail = oneLine(task.trigger.label).slice(0, 128).trim();
+	return detail ? {
+		label: "Event automation",
+		detail
+	} : { label: "Event automation" };
+}
+/** Render plain agent input for one matching event automation. */
+function eventInput(task, event, outcomes) {
+	const guidance = eventGuidance(getEventCatalog(), event.namespace, task.trigger.resourceType, event.eventType);
+	return renderTaskInput({
+		about: task.trigger.label,
+		creator: slackMention(task.createdBy.slackUserId),
+		instructions: task.task.text,
+		outcomes,
+		guidance,
+		trustedSummary: event.trustedSummary,
+		trustedSummaryMaxLength: EVENT_SUMMARY_MAX_LENGTH,
+		verifiedDetails: event.data,
+		externalText: event.untrustedText,
+		externalTextMaxLength: EVENT_TEXT_MAX_LENGTH
+	});
+}
+/** Match a normalized event and dispatch every matching automation. */
+async function ingestEventAutomations(input, options) {
+	const event = eventSchema.parse(input);
+	const db = getDb();
+	const nowMs = options.nowMs ?? Date.now();
+	const tasks = await findMatchingEventAutomations(db, event, options.teamId);
+	let dispatched = 0;
+	const errors = [];
+	for (const task of tasks) try {
+		const idempotencyKey = eventAutomationDispatchKey(task.id, event.namespace, event.eventKey);
+		if (await admitEventAutomationRun({
+			automationId: task.id,
+			nowMs,
+			runKey: idempotencyKey
+		}) === "limited") {
+			const reason = eventAutomationRunLimitReason();
+			logWarn("event_automation.run_limit.exceeded", {
+				"app.task.id": task.id,
+				"app.task.type": "event"
+			});
+			if (await blockEventAutomation(db, task.id, reason)) {
+				captureMessage("Event automation blocked by run limit", {
+					level: "warning",
+					fingerprint: ["event_automation.run_limit.blocked"],
+					tags: {
+						"app.event.namespace": event.namespace,
+						"app.task.type": "event"
+					},
+					extra: {
+						"app.event.event_type": event.eventType,
+						"app.event_automation.max_runs_per_hour": botConfig.maxEventAutomationRunsPerHour,
+						"app.event_automation.resource_type": task.trigger.resourceType,
+						"app.task.id": task.id
+					}
+				});
+				await notifyAutomationBlocked({
+					automationId: task.id,
+					kind: "event",
+					reason
+				});
+			}
+			continue;
+		}
+		const replyThreadTs = slackChannelMessageReplyThreadTs(event);
+		const destination = replyThreadTs ? {
+			...task.destination,
+			threadTs: replyThreadTs
+		} : task.destination;
+		const outcomes = effectiveTaskOutcomes(task.outcomes, destination);
+		const credentialSubject = task.credentialMode === "creator" ? {
+			type: "user",
+			userId: task.createdBy.slackUserId,
+			allowedWhen: "event-automation",
+			taskId: task.id
+		} : void 0;
+		if ((await dispatchEventAutomation({
+			conversationWorkQueue: options.queue,
+			nowMs,
+			options: {
+				idempotencyKey,
+				...credentialSubject ? { credentialSubject } : void 0,
+				destination,
+				destinationVisibility: task.destinationVisibility,
+				input: eventInput(task, event, outcomes),
+				metadata: { eventAutomationId: task.id },
+				replyAttribution: replyAttribution(task),
+				outcomes
+			}
+		})).status === "created") dispatched += 1;
+	} catch (error) {
+		errors.push(error);
+	}
+	if (errors.length > 0) throw new AggregateError(errors, "Failed to dispatch one or more event automations");
+	return { dispatched };
+}
+//#endregion
 //#region src/chat/ingress/workspace-membership.ts
 const MEMBER_TTL_MS = 3e5;
 const NON_MEMBER_TTL_MS = 3e4;
@@ -2492,12 +2579,13 @@ const SLACK_SESSION_STOP_ACK = "Stopped.";
 */
 async function handleSlackSessionStop(args) {
 	const canonicalThreadId = `slack:${args.channelId}:${args.threadTs}`;
+	const conversationId = await resolveSlackConversationId({
+		canonicalThreadId,
+		conversationStore: args.conversationStore,
+		installation: args.installation
+	});
 	const stopped = await stopConversationTurn({
-		conversationId: await resolveSlackConversationId({
-			canonicalThreadId,
-			conversationStore: args.conversationStore,
-			installation: args.installation
-		}),
+		conversationId,
 		conversationStore: args.conversationStore,
 		queue: args.queue,
 		state: args.state
@@ -2531,7 +2619,26 @@ async function routeParsedMessage(args) {
 	const isDirectMessage = isDmEvent(args.event);
 	const isSubscribed = !isDirectMessage && !isMention && await args.state.isSubscribed(canonicalThreadId);
 	const route = isDirectMessage || isMention ? "mention" : isSubscribed ? "subscribed" : void 0;
-	if (!route) return;
+	if (!route) {
+		const channelMessage = args.event.type === "message" && args.event.channel && args.event.ts ? slackChannelMessageEvent({
+			botId: args.event.bot_id,
+			channelId: args.event.channel,
+			subtype: args.event.subtype,
+			text: args.event.text,
+			threadTs: args.event.thread_ts,
+			ts: args.event.ts,
+			userId: message.author.userId
+		}) : void 0;
+		const teamId = args.installation.teamId;
+		if (channelMessage && teamId) await ingestEventAutomations({
+			...channelMessage,
+			namespace: SLACK_EVENT_NAMESPACE
+		}, {
+			queue: args.queue,
+			teamId
+		});
+		return;
+	}
 	const stopDecision = getThreadStopDecision({
 		botUserName: botConfig.userName,
 		rawText: args.event.text ?? "",
@@ -3012,81 +3119,6 @@ async function publicArtifactGET(args) {
 	}
 }
 //#endregion
-//#region src/chat/event-automations/ingest.ts
-/**
-* Owns event matching and durable event-automation dispatch.
-*
-* Each matching automation is independently idempotent. Aggregate failures propagate
-* so the provider can retry the original delivery.
-*/
-/** Bind provider delivery identity to one automation's durable dispatch. */
-function eventAutomationDispatchKey(taskId, namespace, eventKey) {
-	return `event-automation:${createHash("sha256").update(`${taskId}\0${namespace}\0${eventKey}`).digest("hex").slice(0, 32)}`;
-}
-function oneLine(value) {
-	return value.replace(/[\r\n]+/g, " ").replace(/\s+/g, " ").trim().slice(0, 512);
-}
-/** Compact destination-visible context for event-automation replies. */
-function replyAttribution(task) {
-	const detail = oneLine(task.trigger.label).slice(0, 128).trim();
-	return detail ? {
-		label: "Event automation",
-		detail
-	} : { label: "Event automation" };
-}
-/** Render plain agent input for one matching event automation. */
-function eventInput(task, event) {
-	const guidance = eventGuidance(getEventCatalog(), event.namespace, task.trigger.resourceType, event.eventType);
-	return renderTaskInput({
-		about: task.trigger.label,
-		creator: slackMention(task.createdBy.slackUserId),
-		instructions: task.task.text,
-		outcomes: effectiveTaskOutcomes(task.outcomes, task.destination),
-		guidance,
-		trustedSummary: event.trustedSummary,
-		trustedSummaryMaxLength: EVENT_SUMMARY_MAX_LENGTH,
-		verifiedDetails: event.data,
-		externalText: event.untrustedText,
-		externalTextMaxLength: EVENT_TEXT_MAX_LENGTH
-	});
-}
-/** Match a normalized event and dispatch every matching automation. */
-async function ingestEventAutomations(input, options) {
-	const event = eventSchema.parse(input);
-	const db = getDb();
-	const nowMs = options.nowMs ?? Date.now();
-	const tasks = await findMatchingEventAutomations(db, event, options.teamId);
-	let dispatched = 0;
-	const errors = [];
-	for (const task of tasks) try {
-		const idempotencyKey = eventAutomationDispatchKey(task.id, event.namespace, event.eventKey);
-		const credentialSubject = task.credentialMode === "creator" ? {
-			type: "user",
-			userId: task.createdBy.slackUserId,
-			allowedWhen: "event-automation",
-			taskId: task.id
-		} : void 0;
-		if ((await dispatchEventAutomation({
-			conversationWorkQueue: options.queue,
-			nowMs,
-			options: {
-				idempotencyKey,
-				...credentialSubject ? { credentialSubject } : void 0,
-				destination: task.destination,
-				destinationVisibility: task.destinationVisibility,
-				input: eventInput(task, event),
-				metadata: { eventAutomationId: task.id },
-				replyAttribution: replyAttribution(task),
-				outcomes: effectiveTaskOutcomes(task.outcomes, task.destination)
-			}
-		})).status === "created") dispatched += 1;
-	} catch (error) {
-		errors.push(error);
-	}
-	if (errors.length > 0) throw new AggregateError(errors, "Failed to dispatch one or more event automations");
-	return { dispatched };
-}
-//#endregion
 //#region src/chat/events/workspace.ts
 /**
 * Resolve the single-bot Slack team id for event-automation indexing.
@@ -5241,6 +5273,7 @@ async function createApp(options) {
 	const attachmentStorage = createVercelAttachmentStorage();
 	const agentRunner = createAgentRunner(executeAgentRun, {
 		attachmentStorage,
+		bindMessageAgent: (request) => bindMessageAgent(request, { queue: conversationWorkQueue }),
 		bindSpawnAgent: (request) => bindSpawnAgent(request, { queue: conversationWorkQueue }),
 		tracePropagation
 	});

package/dist/{briefs-BMzTiGJO.js → briefs-cZ5vWqP_.js}

@@ -1,7 +1,7 @@
-import { r as completeObject } from "./client-BVaGEb1-.js";
+import { r as completeObject } from "./client--xtsAxKP.js";
 import { r as defaultModelId } from "./model-profile-BwU8mqwD.js";
-import { B as parseBriefInput, I as briefCodeChangeSchema, d as conversationDetailReportSchema, p as conversationEventPageSchema } from "./conversation-BxvgH64Q.js";
-import { n as briefEntriesFromReportEvents, s as generateBrief, t as BRIEF_PROMPT } from "./prompt-CX36ZlbV.js";
+import { L as briefCodeChangeSchema, V as parseBriefInput, d as conversationDetailReportSchema, p as conversationEventPageSchema } from "./conversation-CvBG57Io.js";
+import { n as briefEntriesFromReportEvents, s as generateBrief, t as BRIEF_PROMPT } from "./prompt-C9Q9cjD3.js";
 import { CLI_USAGE } from "./cli/run.js";
 import path from "node:path";
 import { z } from "zod";
@@ -269,7 +269,7 @@ async function parseRunOptions(argv) {
 * `DATABASE_URL` at import, and `briefs pull` must work with only a token.
 */
 async function configuredDefaultModelId() {
-	const { botConfig } = await import("./config-q9xXVN_5.js").then((n) => n.r);
+	const { botConfig } = await import("./config-BK53Ip5C.js").then((n) => n.r);
 	return defaultModelId(botConfig);
 }
 function apiUrl(baseUrl, pathname) {

package/dist/{catalog-runtime-CpxhLwZG.js → catalog-runtime-CTaQXYqS.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-B4FMCO8f.js";
-import { t as createPluginCatalogRuntime } from "./registry-DvzzL8-v.js";
+import { t as createPluginCatalogRuntime } from "./registry-C2rSEio1.js";
 //#region src/chat/plugins/catalog-runtime.ts
 var catalog_runtime_exports = /* @__PURE__ */ __exportAll({ pluginCatalogRuntime: () => pluginCatalogRuntime });
 const pluginCatalogRuntime = createPluginCatalogRuntime();

package/dist/cli/chat.js

@@ -1,4 +1,4 @@
-import { n as executeAgentRun, t as createAgentRunner } from "../agent-runner-DtEtbaOb.js";
+import { n as executeAgentRun, t as createAgentRunner } from "../agent-runner-DSKpHjHW.js";
 import { t as loadAppPluginSet } from "../plugin-module-CVvEUSMH.js";
 import path from "node:path";
 import { createHash, randomUUID } from "node:crypto";
@@ -100,10 +100,10 @@ async function loadLocalPluginSet() {
 async function configureLocalChatPlugins(pluginSet) {
 	const [pluginsModule, agentHooksModule, catalogRuntimeModule, validationModule, databaseModule] = await Promise.all([
 		import("../plugins-egKWjgue.js").then((n) => n.o),
-		import("../agent-hooks-Cj_rSeWd.js").then((n) => n.t),
-		import("../catalog-runtime-CpxhLwZG.js").then((n) => n.t),
-		import("../validation-DcsBjzdi.js").then((n) => n.r),
-		import("../viewer-BBnCMR1g.js").then((n) => n.s)
+		import("../agent-hooks-DpklSWZg.js").then((n) => n.t),
+		import("../catalog-runtime-CTaQXYqS.js").then((n) => n.t),
+		import("../validation-Dg0Ihxzo.js").then((n) => n.r),
+		import("../viewer-D5hbx6TE.js").then((n) => n.s)
 	]);
 	const resolvedPluginSet = pluginSet === void 0 ? await loadLocalPluginSet() : pluginSet ?? void 0;
 	const plugins = pluginsModule.pluginRuntimeRegistrationsFromPluginSet(resolvedPluginSet);
@@ -155,16 +155,17 @@ async function prepareLocalChatRun(io, pluginSet) {
 	await configureLocalChatPlugins(pluginSet);
 	const { setExperimentalFeatures } = await import("../experimental-Qn9rKLgx.js").then((n) => n.t);
 	setExperimentalFeatures({ subagents: true });
-	const { setBriefsConfig } = await import("../agent-hooks-Cj_rSeWd.js").then((n) => n.m);
+	const { setBriefsConfig } = await import("../agent-hooks-DpklSWZg.js").then((n) => n.m);
 	setBriefsConfig({ enabled: true });
-	const { runLocalAgentTurn } = await import("../runner-Y6A6pww4.js");
-	const { startLocalOAuthCallbackServer } = await import("../oauth-callback-server-_MfOtSxS.js");
+	const { runLocalAgentTurn } = await import("../runner-CNh5eMWx.js");
+	const { startLocalOAuthCallbackServer } = await import("../oauth-callback-server-BrUo6w1e.js");
 	const { createLocalOAuthState } = await import("../oauth-relay-CdCnu80W.js").then((n) => n.t);
-	const { createLocalSandboxEgressSignalTransport } = await import("../sandbox-egress-signals-D7AOkuoe.js");
-	const { bindSpawnAgent } = await import("../spawn-DYg7jhhR.js").then((n) => n.n);
-	const { createAgentInvocationWorker, routeAgentInvocationWork } = await import("../work-fje9VXgQ.js").then((n) => n.a);
+	const { createLocalSandboxEgressSignalTransport } = await import("../sandbox-egress-signals-BnDEKu8d.js");
+	const { bindSpawnAgent } = await import("../spawn-C3efZSx3.js").then((n) => n.n);
+	const { bindMessageAgent } = await import("../message-BSN-Ma5f.js").then((n) => n.n);
+	const { createAgentInvocationWorker, routeAgentInvocationWork } = await import("../work-rm2X7jj4.js").then((n) => n.a);
 	const { createLocalConversationWork } = await import("../conversation-work-C6y3T5Hx.js");
-	const { processConversationWork } = await import("../worker-Byd2Et9r.js").then((n) => n.n);
+	const { processConversationWork } = await import("../worker-bnGsAOP3.js").then((n) => n.n);
 	let agentRunner;
 	const localConversationWork = createLocalConversationWork(async (message) => {
 		if (!agentRunner) throw new Error("Local agent runner is not ready");
@@ -179,7 +180,10 @@ async function prepareLocalChatRun(io, pluginSet) {
 			run
 		});
 	});
-	agentRunner = createAgentRunner(executeAgentRun, { bindSpawnAgent: (request) => bindSpawnAgent(request, { queue: localConversationWork.queue }) });
+	agentRunner = createAgentRunner(executeAgentRun, {
+		bindMessageAgent: (request) => request.source.kind === "agent_invocation" ? void 0 : bindMessageAgent(request, { queue: localConversationWork.queue }),
+		bindSpawnAgent: (request) => bindSpawnAgent(request, { queue: localConversationWork.queue })
+	});
 	const oauthCallback = await startLocalOAuthCallbackServer();
 	const deps = {
 		agentRunner,

package/dist/cli/check.js

@@ -1,6 +1,6 @@
-import { D as JUNIOR_HEARTBEAT_ROUTE, M as LEGACY_JUNIOR_CONVERSATION_WORK_FUNCTION, T as JUNIOR_CONVERSATION_WORK_CALLBACK_ROUTE } from "../logging-z7_w-KN_.js";
-import { _ as parsePluginManifest, g as parseInlinePluginManifest } from "../registry-DvzzL8-v.js";
-import { i as parseSkillFile } from "../skills-DFduSvuO.js";
+import { D as JUNIOR_HEARTBEAT_ROUTE, M as LEGACY_JUNIOR_CONVERSATION_WORK_FUNCTION, T as JUNIOR_CONVERSATION_WORK_CALLBACK_ROUTE } from "../logging-DVtMYOdD.js";
+import { _ as parsePluginManifest, g as parseInlinePluginManifest } from "../registry-C2rSEio1.js";
+import { i as parseSkillFile } from "../skills-C6zJbudq.js";
 import path from "node:path";
 import fs from "node:fs/promises";
 import { pathToFileURL } from "node:url";

package/dist/cli/main.js

@@ -25,10 +25,10 @@ async function runChat(argv, pluginSet) {
 	return await (await import("./chat.js")).runChat(argv, void 0, { pluginSet });
 }
 async function runAdmin(argv) {
-	return await (await import("../admin-CF9lQg0M.js")).runAdmin(argv);
+	return await (await import("../admin-Bh-MYw-j.js")).runAdmin(argv);
 }
 async function runBriefs(argv) {
-	return await (await import("../briefs-BMzTiGJO.js")).runBriefs(argv);
+	return await (await import("../briefs-cZ5vWqP_.js")).runBriefs(argv);
 }
 function topLevelCommand(argv) {
 	return (argv[0] === "--" ? argv.slice(1) : argv)[0];

package/dist/cli/plugins.js

@@ -1,7 +1,7 @@
-import { d as getDb } from "../viewer-BBnCMR1g.js";
-import { n as pluginCatalogRuntime } from "../catalog-runtime-CpxhLwZG.js";
-import { d as setPlugins, f as validatePlugins, lt as createPluginLogger } from "../agent-hooks-Cj_rSeWd.js";
-import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "../validation-DcsBjzdi.js";
+import { d as getDb } from "../viewer-D5hbx6TE.js";
+import { n as pluginCatalogRuntime } from "../catalog-runtime-CTaQXYqS.js";
+import { d as setPlugins, f as validatePlugins, lt as createPluginLogger } from "../agent-hooks-DpklSWZg.js";
+import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "../validation-Dg0Ihxzo.js";
 import { a as pluginRuntimeRegistrationsFromPluginSet, i as pluginCliRegistrationsFromPluginSet, r as pluginCatalogConfigFromPluginSet } from "../plugins-egKWjgue.js";
 import { t as loadAppPluginSet } from "../plugin-module-CVvEUSMH.js";
 import { stderr, stdout } from "node:process";

package/dist/cli/snapshot-create.js

@@ -1,6 +1,6 @@
-import { n as pluginCatalogRuntime } from "../catalog-runtime-CpxhLwZG.js";
-import { S as disconnectStateAdapter, t as create } from "../profile-yeKVNECl.js";
-import { r as resolve } from "../resolve-4u5gEU04.js";
+import { n as pluginCatalogRuntime } from "../catalog-runtime-CTaQXYqS.js";
+import { S as disconnectStateAdapter, t as create } from "../profile-BevMNSlr.js";
+import { r as resolve } from "../resolve-qPhrznTf.js";
 //#region src/cli/snapshot-create.ts
 const DEFAULT_RUNTIME = "node22";
 const DEFAULT_TIMEOUT_MS = 6e5;

package/dist/cli/upgrade.js

@@ -1,6 +1,6 @@
-import { i as getChatConfig } from "../config-q9xXVN_5.js";
-import { t as createJuniorSqlExecutor } from "../executor-DA7eHhmC.js";
-import { t as createPluginCatalogRuntime } from "../registry-DvzzL8-v.js";
+import { i as getChatConfig } from "../config-BK53Ip5C.js";
+import { t as createJuniorSqlExecutor } from "../executor-bmmuRY-w.js";
+import { t as createPluginCatalogRuntime } from "../registry-C2rSEio1.js";
 import { n as pluginCatalogConfigFromEnv, r as pluginCatalogConfigFromPluginSet, t as defineJuniorPlugins } from "../plugins-egKWjgue.js";
 import { t as loadAppPluginSet } from "../plugin-module-CVvEUSMH.js";
 import { basename, dirname, join, resolve } from "node:path";

package/dist/{client-BVaGEb1-.js → client--xtsAxKP.js}

@@ -1,5 +1,5 @@
-import { d as logException, g as serializeGenAiAttribute, i as extractGenAiUsageAttributes, m as normalizeGenAiFinishReason, p as logWarn, w as withSpan } from "./logging-z7_w-KN_.js";
-import { a as toCanonicalInputMessage, n as getCurrentConversationPrivacy, o as toCanonicalOutputMessage, s as toGenAiMessagesTraceAttributes } from "./conversation-privacy-Dyh_63Ee.js";
+import { d as logException, g as serializeGenAiAttribute, i as extractGenAiUsageAttributes, m as normalizeGenAiFinishReason, p as logWarn, w as withSpan } from "./logging-DVtMYOdD.js";
+import { a as toCanonicalInputMessage, n as getCurrentConversationPrivacy, o as toCanonicalOutputMessage, s as toGenAiMessagesTraceAttributes } from "./conversation-privacy-BDBFw6Ws.js";
 import { calculateCost, completeSimple, getEnvApiKey, getModels, registerApiProvider } from "@earendil-works/pi-ai/compat";
 import { stream as streamAnthropic, streamSimple as streamSimpleAnthropic } from "@earendil-works/pi-ai/api/anthropic-messages";
 import { createGatewayProvider } from "@ai-sdk/gateway";

package/dist/{config-q9xXVN_5.js → config-BK53Ip5C.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-B4FMCO8f.js";
-import { S as toOptionalTrimmed, o as resolveGatewayModel } from "./client-BVaGEb1-.js";
-import { p as logWarn } from "./logging-z7_w-KN_.js";
+import { S as toOptionalTrimmed, o as resolveGatewayModel } from "./client--xtsAxKP.js";
+import { p as logWarn } from "./logging-DVtMYOdD.js";
 import { l as TURN_REASONING_LEVELS, s as modelProfileSchema, t as DEFAULT_MODEL_PROFILES, u as parseTurnReasoningLevel } from "./model-profile-BwU8mqwD.js";
 //#region src/chat/slack/emoji.ts
 const SLACK_EMOJI_NAME_RE = /^(?:[a-z0-9_+-]+)(?:::(?:skin-tone-[2-6]))?$/;
@@ -54,6 +54,13 @@ const MAX_TOOL_CALLS_PER_TURN = 250;
 * headroom to avoid pausing on legitimate longer-running automation.
 */
 const MAX_CONSECUTIVE_AUTOMATED_TURNS = 25;
+/**
+* Max runs one Event automation can start in a rolling hour. Each run is a
+* full agent turn, and Event automations skip the consecutive automated-turn
+* limit. Kept low so a broad trigger, such as every message in a channel,
+* blocks quickly instead of starting a turn for each Event.
+*/
+const MAX_EVENT_AUTOMATION_RUNS_PER_HOUR = 10;
 const DEFAULT_FUNCTION_MAX_DURATION_SECONDS = 300;
 const DEFAULT_SLACK_SLASH_COMMAND = "/jr";
 const DEFAULT_PROCESSING_REACTION_EMOJI = "eyes";
@@ -257,6 +264,7 @@ function readBotConfig(env, functionMaxDurationSeconds) {
 		maxSlicesPerTurn: MAX_SLICES_PER_TURN,
 		maxToolCallsPerTurn: MAX_TOOL_CALLS_PER_TURN,
 		maxConsecutiveAutomatedTurns: MAX_CONSECUTIVE_AUTOMATED_TURNS,
+		maxEventAutomationRunsPerHour: MAX_EVENT_AUTOMATION_RUNS_PER_HOUR,
 		turnTimeoutMs: parseAgentTurnTimeoutMs(env.AGENT_TURN_TIMEOUT_MS, maxTurnTimeoutMs),
 		webSearchModelId: validateGatewayModelId(env.AI_WEB_SEARCH_MODEL) ?? DEFAULT_WEB_SEARCH_MODEL_ID
 	};
@@ -370,6 +378,7 @@ function setRuntimeLimits(limits) {
 		bot.maxAgentDepth = limits.maxAgentDepth;
 	}
 	if (limits?.maxConsecutiveAutomatedTurns !== void 0) bot.maxConsecutiveAutomatedTurns = requirePositiveLimit("maxConsecutiveAutomatedTurns", limits.maxConsecutiveAutomatedTurns);
+	if (limits?.maxEventAutomationRunsPerHour !== void 0) bot.maxEventAutomationRunsPerHour = requirePositiveLimit("maxEventAutomationRunsPerHour", limits.maxEventAutomationRunsPerHour);
 	if (limits?.maxSlicesPerTurn !== void 0) bot.maxSlicesPerTurn = requirePositiveLimit("maxSlicesPerTurn", limits.maxSlicesPerTurn);
 	if (limits?.maxToolCallsPerTurn !== void 0) bot.maxToolCallsPerTurn = requirePositiveLimit("maxToolCallsPerTurn", limits.maxToolCallsPerTurn);
 	if (limits?.turnTimeoutMs !== void 0) bot.turnTimeoutMs = Math.min(requirePositiveLimit("turnTimeoutMs", limits.turnTimeoutMs), resolveMaxTurnTimeoutMs(chatConfig.functionMaxDurationSeconds));