@sentry/junior 0.255.0 → 0.257.0

package/dist/app.js

@@ -1,38 +1,40 @@
-import { At as consumeSandboxEgressPermissionDeniedSignal, B as effectiveTaskOutcomes, Ct as ingestEvent, Dt as SANDBOX_EGRESS_PROXY_PATH, E as requestAttachmentDeletion, Et as shouldPropagateSandboxEgressTrace, F as logScheduledAutomationRunSkipped, I as scheduledAutomationRunAttributes, It as startOAuthFlow, Kt as getConfigDefaults, Lt as createUserTokenStore, Nt as formatProviderLabel, O as parseSlackThreadId, Ot as clearSandboxEgressSignals, St as processWorkspaceSnapshotJob, Tt as normalizeSandboxEgressTracePropagationDomains, U as stopConversationSession, W as recordSubagentEnded, b as unpublishedArtifactHeaders, i as executeCredentialedEgressRequest, jt as parseSandboxEgressCredentialToken, kt as consumeSandboxEgressAuthRequiredSignal, lt as listPendingAgentInvocationMailboxAppends, n as executeAgentRun, qt as setConfigDefaults, t as createAgentRunner, ut as listPendingAgentInvocationResults, v as publicArtifactHeaders, w as collectAttachmentGarbage, wt as resolveSandboxEgressProviderForHost, x as lookupSlackUserProfile, y as readPublicArtifact } from "./agent-runner-Caiof09f.js";
-import { C as withLogContext, O as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE, S as withContext, d as logException, f as logInfo, j as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, p as logWarn, r as createRequestContext, v as setSpanAttributes, w as withSpan, y as setSpanStatus } from "./logging-D3aYP0aG.js";
+import { At as consumeSandboxEgressPermissionDeniedSignal, B as effectiveTaskOutcomes, Ct as ingestEvent, Dt as SANDBOX_EGRESS_PROXY_PATH, E as requestAttachmentDeletion, Et as shouldPropagateSandboxEgressTrace, F as logScheduledAutomationRunSkipped, I as scheduledAutomationRunAttributes, It as resolveBaseUrl, Jt as setConfigDefaults, Lt as startOAuthFlow, Nt as deliverPrivateMessage, O as parseSlackThreadId, Ot as clearSandboxEgressSignals, Pt as formatProviderLabel, Rt as createUserTokenStore, St as processWorkspaceSnapshotJob, Tt as normalizeSandboxEgressTracePropagationDomains, U as stopConversationSession, W as recordSubagentEnded, b as unpublishedArtifactHeaders, i as executeCredentialedEgressRequest, jt as parseSandboxEgressCredentialToken, kt as consumeSandboxEgressAuthRequiredSignal, lt as listPendingAgentInvocationMailboxAppends, n as executeAgentRun, qt as getConfigDefaults, t as createAgentRunner, ut as listPendingAgentInvocationResults, v as publicArtifactHeaders, w as collectAttachmentGarbage, wt as resolveSandboxEgressProviderForHost, x as lookupSlackUserProfile, y as readPublicArtifact } from "./agent-runner-D7OboVb3.js";
+import { f as escapeXml } from "./client-D8HnkOQX.js";
+import { C as withContext, M as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, R as normalizeIdentityEmail, T as withSpan, b as setSpanStatus, f as logException, k as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE, m as logWarn, p as logInfo, r as createRequestContext, v as setSentryUser, w as withLogContext, y as setSpanAttributes } from "./logging-CWxiIuCF.js";
 import { n as captureMessage, r as continueTrace } from "./sentry-CgWZM_kV.js";
-import { t as JUNIOR_VERSION } from "./version-CDM8Rq6E.js";
-import { _ as snapshotRuntimeConfig, d as restoreRuntimeConfig, f as setBotModelConfig, g as setSlackReactionConfig, h as setRuntimeLimits, i as getChatConfig, m as setProfiles, n as botConfig, o as getSlackBotToken, p as setCrossActorMidRunMode, u as resetRuntimeConfig } from "./config-BDAfLTI9.js";
+import { t as JUNIOR_VERSION } from "./version-BcdZy2zg.js";
+import { _ as snapshotRuntimeConfig, d as restoreRuntimeConfig, f as setBotModelConfig, g as setSlackReactionConfig, h as setRuntimeLimits, i as getChatConfig, m as setProfiles, n as botConfig, o as getSlackBotToken, p as setCrossActorMidRunMode, u as resetRuntimeConfig } from "./config-CJRnWK9H.js";
 import { _ as slackMessageTsSchema, d as parseSlackTeamId, f as parseSlackUserId, h as slackUserIdSchema, m as slackTeamIdSchema, o as parseActorUserId, p as slackChannelIdSchema } from "./actor-BTtLaeWy.js";
-import { c as getConversationEventStore, d as getDb, f as getSqlExecutor, g as withConversationMutationLock, m as withConversationEventLock, r as readActorIdentity, u as getConversationStore } from "./viewer-Rnim7alE.js";
-import { a as juniorAgentInvocations, d as juniorDestinations, i as juniorAgentBindings, s as juniorConversations } from "./agent-invocations-BY60iNw-.js";
-import { f as juniorConversationBriefs, h as juniorConversationEvents, o as juniorAutomationRuns, s as juniorAutomations } from "./executor-Dh4Ofsnx.js";
-import { n as pluginCatalogRuntime } from "./catalog-runtime-hKmI-iZa.js";
-import { Gt as projectConversationMessages, H as slackEntitySchema, Ht as appendConversationMessages, Jt as settleConversationTitleWork, N as slackMention, U as slackExternalRefIdSchema, b as admitEventAutomationRun, c as withScheduledAutomationLock, i as readScheduledAutomation, l as blockEventAutomation, n as listScheduledAutomationsForTeam, o as saveScheduledAutomationInLock, p as findMatchingEventAutomations, s as scheduledRunId, u as collectEventAutomationMatchKeys, x as eventAutomationRunLimitReason } from "./tasks-dJooqiip.js";
-import { $ as bindSlackDirectCredentialSubject, At as resolveRootVisibility, Ht as getSlackClient, Jt as getWorkspaceTeamId, Nt as listConversationAnnotations, Q as bindScheduledAutomationCredentialSubject, U as collectEventMatchKeys, Wt as isDmChannel, X as takeDueTimerWatches, Yt as runWithWorkspaceTeamId, Z as bindEventAutomationCredentialSubject, a as getPluginRoutes, at as getDashboardConversationLink, ct as setDashboardConversationLinkOptions, d as setPlugins, et as verifyEventAutomationCredentialSubject, f as validatePlugins, ft as createPluginLogger, h as setBriefsConfig, i as getPluginApiRoutes, lt as createPluginState, nt as verifySlackDirectCredentialSubject, pt as readConversationAccessFromSql, q as findMatchingWatches, st as getDashboardTaskLink, tt as verifyScheduledAutomationCredentialSubject, u as getPlugins } from "./agent-hooks-CDVx26Uu.js";
-import { W as annotationCard } from "./conversation-T18Xlkx9.js";
-import { O as withLock$1, w as getStateAdapter } from "./profile-DnkX3e2S.js";
-import { c as getThreadStopDecision } from "./pending-auth-D2t1Moxf.js";
-import { O as renderTaskInput, f as slackChannelMessageEvent, l as getEventCatalog, p as slackChannelMessageReplyThreadTs, u as SLACK_EVENT_NAMESPACE, y as eventGuidance } from "./session-stop-BEBfE97J.js";
+import { F as recordGoogleSignIn, L as slackUserHasGoogleSignIn, M as findSlackIdentityUserId, R as upsertIdentity, d as getConversationStore, f as getDb, h as withConversationEventLock, i as readActorIdentity, l as getConversationEventStore, n as findUserByEmailFromSql, p as getSqlExecutor, v as withConversationMutationLock } from "./viewer-DSZXygMU.js";
+import { a as juniorAgentInvocations, d as juniorDestinations, i as juniorAgentBindings, s as juniorConversations } from "./agent-invocations-Bdu3ROfo.js";
+import { a as juniorAutomationRuns, f as juniorConversationBriefs, h as juniorConversationEvents, s as juniorAutomations } from "./executor-Do0THDRR.js";
+import { m as credentialLogContext } from "./registry-sLTr-sV9.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-CZzhGQ7F.js";
+import { C as automationVersionOf, Kt as projectConversationMessages, P as slackMention, U as slackEntitySchema, Ut as appendConversationMessages, W as slackExternalRefIdSchema, Yt as settleConversationTitleWork, b as admitEventAutomationRun, c as withScheduledAutomationLock, i as readScheduledAutomation, j as formatSlackLink, l as blockEventAutomation, n as listScheduledAutomationsForTeam, o as saveScheduledAutomationInLock, p as findMatchingEventAutomations, s as scheduledRunId, u as collectEventAutomationMatchKeys, x as eventAutomationRunLimitReason } from "./tasks-D_WIJtvO.js";
+import { $ as bindSlackDirectCredentialSubject, At as resolveRootVisibility, Ht as getSlackClient, Jt as getWorkspaceTeamId, Nt as listConversationAnnotations, Q as bindScheduledAutomationCredentialSubject, U as collectEventMatchKeys, Wt as isDmChannel, X as takeDueTimerWatches, Yt as runWithWorkspaceTeamId, Z as bindEventAutomationCredentialSubject, a as getPluginRoutes, at as getDashboardConversationLink, ct as setDashboardConversationLinkOptions, d as setPlugins, et as verifyEventAutomationCredentialSubject, f as validatePlugins, ft as createPluginLogger, h as setBriefsConfig, i as getPluginApiRoutes, lt as createPluginState, nt as verifySlackDirectCredentialSubject, pt as readConversationAccessFromSql, q as findMatchingWatches, st as getDashboardTaskLink, tt as verifyScheduledAutomationCredentialSubject, u as getPlugins } from "./agent-hooks-BjtTzvru.js";
+import { W as annotationCard } from "./conversation-CKNLYBJt.js";
+import { O as withLock$1, w as getStateAdapter } from "./profile-h-72wM78.js";
+import { c as getThreadStopDecision } from "./pending-auth-s_QFribU.js";
+import { b as eventGuidance, f as slackChannelMessageEvent, k as renderTaskInput, l as getEventCatalog, m as slackChannelMessageRunsAutomation, p as slackChannelMessageReplyThreadTs, u as SLACK_EVENT_NAMESPACE } from "./session-stop-CQjKd4a2.js";
 import { n as getNextRunAtMs } from "./cadence-D00SCzT1.js";
-import { f as setSandboxResourceConfig, u as getSandboxResourceConfig } from "./resolve-jfNHtEBx.js";
-import { a as getVercelConversationWorkQueue, g as isConversationQueueMessageRejectedError, h as conversationQueueMessageSchema, i as verifyWorkspaceSnapshotJobMessage, o as resolveConversationWorkQueueTopic, s as verifyConversationQueueMessage, t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-BaCL36FY.js";
-import { A as hasRunnableConversationWork$1, M as isInvalidConversationRecordError, O as CONVERSATION_WORK_STALE_ENQUEUE_MS, S as removeActiveConversation, _ as hasRunnableConversationWork, c as clearExpiredConversationLease, g as getConversationWorkState, h as getConversation, m as ensureConversationWake, r as appendAndEnqueueInboundMessage, v as listActiveConversationIds } from "./store-BashBewg.js";
+import { f as setSandboxResourceConfig, u as getSandboxResourceConfig } from "./resolve-ncQPZROQ.js";
+import { a as getVercelConversationWorkQueue, g as isConversationQueueMessageRejectedError, h as conversationQueueMessageSchema, i as verifyWorkspaceSnapshotJobMessage, o as resolveConversationWorkQueueTopic, s as verifyConversationQueueMessage, t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-B6SV9uVa.js";
+import { A as hasRunnableConversationWork$1, M as isInvalidConversationRecordError, O as CONVERSATION_WORK_STALE_ENQUEUE_MS, S as removeActiveConversation, _ as hasRunnableConversationWork, c as clearExpiredConversationLease, g as getConversationWorkState, h as getConversation, m as ensureConversationWake, r as appendAndEnqueueInboundMessage, v as listActiveConversationIds } from "./store-DXFIQy-G.js";
 import { D as scheduledRunSchema } from "./automation-CHdlHVZP.js";
-import { i as setExperimentalFeatures, n as getExperimentalFeatures, r as isExperimentalFeatureEnabled } from "./experimental-Qn9rKLgx.js";
-import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "./validation-LzIilOb6.js";
+import { i as setExperimentalFeatures, n as getExperimentalFeatures, r as isExperimentalFeatureEnabled } from "./experimental-CQIvMUO7.js";
+import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "./validation-CXYxaNYx.js";
 import { a as pluginRuntimeRegistrationsFromPluginSet, n as pluginCatalogConfigFromEnv, r as pluginCatalogConfigFromPluginSet, t as defineJuniorPlugins } from "./plugins-egKWjgue.js";
-import { A as withNormalizedThreadId, C as buildSlackInboundMessage, D as isSlackMessageStopped, E as verifySlackSignature, F as renderSlackObjectCard, I as createVercelAttachmentStorage, M as THREAD_OPTOUT_ACK, N as startProcessingReaction, O as stopSlackThread, P as parseContent, R as enqueueAgentDispatch, S as recordSkippedConversationMessage, T as runWithSlackInstallation, a as recordWebConversationActivity, c as createProductionSlackWebhookServices, f as createSlackWebApiStatusSender, j as stopConversationTurn, k as normalizeIncomingSlackThreadId, l as getProductionSlackAdapter, n as conversationTurnIdForMessage, o as webActorFromEmail, s as createProductionConversationWorkOptions, t as appendAndEnqueueWebMessage, v as readViewerAutomationSummary, w as clearSlackPendingReactions, z as GET$3 } from "./web-input-Dc1VwcT4.js";
-import { M as recordAutomationExecution, S as existingConversationId, a as confirmDispatchMailboxAppend, b as notifyAutomationBlocked, f as getPluginDispatchProjection, m as listPendingDispatchMailboxAppends, o as createOrGetDispatch, p as isTerminalDispatchStatus, s as getDispatchConversationId, t as processPluginTask, u as getDispatchRecord, v as markDispatchFailed } from "./task-runner-D2CpD6GN.js";
-import { o as getAuthPausedConversationTurnId, t as enqueueAgentInvocationResult } from "./result-Df5nEDX2.js";
-import { r as enqueueAgentInvocation } from "./work-BAn43SsN.js";
-import { s as coerceThreadConversationState } from "./thread-state-CsMC-ob0.js";
-import { o as unlinkProvider } from "./connections-BC0RTejT.js";
-import { a as GET$4, i as publishAppHomeView, r as GET$5, t as receiveLocalOAuthCredential } from "./credential-sync-BZuqqIHk.js";
-import { a as registerVercelPluginTaskDevConsumer, n as createVercelPluginTaskCallback, s as queueCallback } from "./task-queue-VvIKqlQ4.js";
-import { t as processConversationWork } from "./worker-mBXq4_zg.js";
-import { t as bindMessageAgent } from "./message-B9xqD2BP.js";
-import { t as bindSpawnAgent } from "./spawn-OgTwBUj0.js";
+import { A as THREAD_OPTOUT_ACK, C as buildSlackInboundMessage, D as normalizeIncomingSlackThreadId, E as stopSlackThread, F as renderSlackObjectCard, I as createVercelAttachmentStorage, M as parseContent, N as runWithSlackInstallation, O as withNormalizedThreadId, P as verifySlackSignature, R as enqueueAgentDispatch, S as recordSkippedConversationMessage, T as isSlackMessageStopped, a as recordWebConversationActivity, c as createProductionSlackWebhookServices, f as createSlackWebApiStatusSender, j as startProcessingReaction, k as stopConversationTurn, l as getProductionSlackAdapter, n as conversationTurnIdForMessage, o as webActorFromEmail, s as createProductionConversationWorkOptions, t as appendAndEnqueueWebMessage, v as readViewerAutomationSummary, w as clearSlackPendingReactions, z as GET$3 } from "./web-input-B9Bv0_lR.js";
+import { M as recordAutomationExecution, S as existingConversationId, a as confirmDispatchMailboxAppend, b as notifyAutomationBlocked, f as getPluginDispatchProjection, m as listPendingDispatchMailboxAppends, o as createOrGetDispatch, p as isTerminalDispatchStatus, s as getDispatchConversationId, t as processPluginTask, u as getDispatchRecord, v as markDispatchFailed } from "./task-runner-DUjvzYXj.js";
+import { o as getAuthPausedConversationTurnId, t as enqueueAgentInvocationResult } from "./result-C883vngT.js";
+import { r as enqueueAgentInvocation } from "./work-nAfDSUFP.js";
+import { s as coerceThreadConversationState } from "./thread-state-Ch4yuCqG.js";
+import { o as unlinkProvider } from "./connections-ClYrKzpX.js";
+import { a as GET$4, i as publishAppHomeView, o as htmlCallbackResponse, r as GET$5, t as receiveLocalOAuthCredential } from "./credential-sync-BXfohNmJ.js";
+import { a as registerVercelPluginTaskDevConsumer, n as createVercelPluginTaskCallback, s as queueCallback } from "./task-queue-B17vV0La.js";
+import { t as processConversationWork } from "./worker-vGXZ6XFT.js";
+import { t as bindMessageAgent } from "./message-TUOdbSBW.js";
+import { t as bindSpawnAgent } from "./spawn-DY9CLXDL.js";
 import { createRequire } from "node:module";
 import { Hono } from "hono";
 import { z } from "zod";
@@ -44,6 +46,8 @@ import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { createRemoteJWKSet, decodeJwt, jwtVerify } from "jose";
 import { ChannelImpl, ThreadImpl } from "chat";
 import * as acp from "@agentclientprotocol/sdk";
+import { createAuthMiddleware } from "better-auth/api";
+import { betterAuth } from "better-auth/minimal";
 //#region src/chat/events/timers.ts
 /** Publish a bounded batch of due timers; the mailbox owns agent execution. */
 async function runTimerWatchHeartbeat(args) {
@@ -345,14 +349,16 @@ async function getScheduledAutomationDispatch(id) {
 //#endregion
 //#region src/chat/event-automations/runs.ts
 /**
-* Record a dispatched event automation run and link its Conversation when it
-* exists. The dispatch can finish before this write, so a stored run, or a
-* retry of the same Event, keeps the row it has.
+* Record a dispatched event automation run with the Automation version it ran,
+* and link its Conversation when it exists. The dispatch can finish before
+* this write, so a stored run, or a retry of the same Event, keeps the row it
+* has.
 */
 async function recordEventAutomationRunStarted(db, args) {
 	await db.insert(juniorAutomationRuns).values({
 		id: args.dispatchId,
-		automationId: args.automationId,
+		automationId: args.automation.id,
+		automationVersion: automationVersionOf(args.automation),
 		conversationId: existingConversationId(getDispatchConversationId({ id: args.dispatchId })),
 		startedAtMs: args.nowMs,
 		status: "running"
@@ -419,9 +425,14 @@ async function readRun(db, runId) {
 	const rows = await db.select().from(juniorAutomationRuns).where(eq(juniorAutomationRuns.id, runId)).limit(1);
 	return rows[0] ? parseScheduledRunRow(rows[0]) : void 0;
 }
-async function writeRun(db, run) {
+/**
+* Save a Scheduled automation run. Pass `automationVersion` only when the run
+* is dispatched. Later writes keep the stored version.
+*/
+async function writeRun(db, run, automationVersion) {
 	const stored = scheduledRunSchema.parse(run);
 	const columns = {
+		...automationVersion ? { automationVersion } : void 0,
 		attempt: stored.attempt,
 		automationId: stored.taskId,
 		claimedAtMs: stored.claimedAtMs,
@@ -588,14 +599,14 @@ async function claimDueScheduledRun(db, args) {
 	for (const skipped of skippedRuns) logScheduledAutomationRunSkipped(skipped.task, skipped.run, { "app.task.run.error": skipped.errorMessage });
 	return claimed;
 }
-async function updateRun(db, runId, update) {
+async function updateRun(db, runId, update, automationVersion) {
 	return await db.transaction(async (tx) => {
 		await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtext(${`junior:scheduler:run:${runId}:lock`}))`);
 		const current = await readRun(tx, runId);
 		if (!current) return void 0;
 		const next = update(current);
 		if (!next) return void 0;
-		await writeRun(tx, next);
+		await writeRun(tx, next, automationVersion);
 		return next;
 	});
 }
@@ -603,14 +614,17 @@ function canFinishRun(run, startedAtMs) {
 	if (run.status === "pending") return startedAtMs === void 0;
 	return run.status === "running" && run.startedAtMs === startedAtMs;
 }
-/** Mark a pending run dispatched only for the active claim. */
+/**
+* Mark a pending run dispatched only for the active claim, and store the
+* version of `task` that the dispatch ran.
+*/
 async function markScheduledRunDispatched(db, args) {
 	return await updateRun(db, args.runId, (run) => run.status === "pending" && run.claimedAtMs === args.claimedAtMs ? {
 		...run,
 		dispatchId: args.dispatchId,
 		startedAtMs: args.nowMs,
 		status: "running"
-	} : void 0);
+	} : void 0, automationVersionOf(args.task));
 }
 /** Complete a run only for its active start timestamp. */
 async function markScheduledRunCompleted(db, args) {
@@ -972,7 +986,8 @@ async function runScheduledAutomationHeartbeat(args) {
 			claimedAtMs: run.claimedAtMs,
 			dispatchId: dispatch.id,
 			nowMs: args.nowMs,
-			runId: run.id
+			runId: run.id,
+			task
 		});
 		logInfo("scheduled_automation.run.dispatched", scheduledAutomationRunAttributes(task, dispatched ?? {
 			...run,
@@ -1604,11 +1619,26 @@ function buildUpstreamUrl(request) {
 		};
 	}
 }
+/**
+* Name the Conversation and the accountable person from the verified token.
+* Each proxy request is a new HTTP request with no run log context, so the
+* proxy binds the same fields that the run binds.
+*/
+function sandboxEgressLogContext(context) {
+	return {
+		...context.conversationId ? { conversationId: context.conversationId } : void 0,
+		...credentialLogContext(context.credentials)
+	};
+}
 /** Continue inbound trace context only after sandbox egress verification succeeds. */
-function continueSandboxEgressTrace(request, upstreamHost, tracePropagation, callback) {
+function continueSandboxEgressTrace(request, upstreamHost, tracePropagation, credentialContext, callback) {
 	const sentryTrace = request.headers.get("sentry-trace") ?? void 0;
 	const baggage = request.headers.get("baggage") ?? void 0;
-	const run = () => withSpan("sandbox.egress", "http.server", {}, callback, {
+	const logContext = sandboxEgressLogContext(credentialContext);
+	const run = () => withSpan("sandbox.egress", "http.server", logContext, async () => {
+		setSentryUser(logContext.userId ? { id: logContext.userId } : void 0);
+		return await callback();
+	}, {
 		"http.request.method": request.method,
 		"url.path": redactedProxyPath(new URL(request.url).pathname)
 	});
@@ -1697,7 +1727,7 @@ async function proxySandboxEgressRequest(request, deps = {}) {
 		});
 		return jsonError("Sandbox egress credential context is not authorized", 403);
 	}
-	return await continueSandboxEgressTrace(request, upstreamUrl.hostname, deps.tracePropagation ?? {}, async () => await executeCredentialedEgressRequest({
+	return await continueSandboxEgressTrace(request, upstreamUrl.hostname, deps.tracePropagation ?? {}, credentialContext, async () => await executeCredentialedEgressRequest({
 		activeEgressId,
 		credentialContext,
 		deps,
@@ -1933,6 +1963,174 @@ const slackInteractivePayloadSchema = z.object({
 	}).optional()
 });
 //#endregion
+//#region src/chat/ingress/slash-command.ts
+async function postEphemeral(event, text) {
+	await event.channel.postEphemeral(event.userId, text, { fallbackToDM: false });
+}
+function getCommandName() {
+	return getChatConfig().slack.slashCommand;
+}
+async function handleLink(event, provider) {
+	if (!pluginCatalogRuntime.isProvider(provider)) {
+		await postEphemeral(event, `Unknown provider: \`${provider}\``);
+		return;
+	}
+	if (!pluginCatalogRuntime.getOAuthConfig(provider)) {
+		await postEphemeral(event, `${formatProviderLabel(provider)} doesn't support account linking.`);
+		return;
+	}
+	const result = await startOAuthFlow(provider, {
+		actorId: event.userId,
+		actor: {
+			platform: "slack",
+			teamId: event.teamId,
+			userId: event.userId
+		},
+		channelId: event.channelId
+	});
+	if (!result.ok) {
+		await postEphemeral(event, `Failed to start linking: ${result.error}`);
+		return;
+	}
+	if (result.delivery === "fallback_dm") await postEphemeral(event, `Check your DMs for a ${formatProviderLabel(provider)} authorization link.`);
+	else if (result.delivery === false) await postEphemeral(event, "I wasn't able to send you a private authorization link. Please try again in a direct message.");
+}
+async function handleUnlink(event, provider) {
+	if (!pluginCatalogRuntime.isProvider(provider)) {
+		await postEphemeral(event, `Unknown provider: \`${provider}\``);
+		return;
+	}
+	if (!(Boolean(pluginCatalogRuntime.getOAuthConfig(provider)) || Boolean(pluginCatalogRuntime.getDefinition(provider)?.manifest.mcp))) {
+		await postEphemeral(event, `${formatProviderLabel(provider)} doesn't support account unlinking.`);
+		return;
+	}
+	const tokenStore = createUserTokenStore();
+	await unlinkProvider(event.userId, provider, tokenStore, event.teamId);
+	logInfo("slash_command.credential.unlinked", { "app.credential.provider": provider });
+	await postEphemeral(event, `Your ${formatProviderLabel(provider)} account has been unlinked.`);
+}
+/** Route link and unlink slash commands to the appropriate OAuth flow. */
+async function handleSlashCommand(event) {
+	const [subcommand, provider, ...rest] = event.text.trim().split(/\s+/);
+	if (!subcommand || !["link", "unlink"].includes(subcommand)) {
+		await postEphemeral(event, `Usage: \`${getCommandName()} link <provider>\` or \`${getCommandName()} unlink <provider>\``);
+		return;
+	}
+	if (!provider || rest.length > 0) {
+		await postEphemeral(event, `Usage: \`${getCommandName()} ${subcommand} <provider>\``);
+		return;
+	}
+	const normalized = provider.toLowerCase();
+	if (subcommand === "link") await handleLink(event, normalized);
+	else await handleUnlink(event, normalized);
+}
+//#endregion
+//#region src/chat/ingress/slack-form.ts
+function parseJson$1(body) {
+	try {
+		return JSON.parse(body);
+	} catch {
+		return;
+	}
+}
+function requireSlackPayloadUserId(value, source) {
+	const userId = parseActorUserId(value);
+	if (!userId) throw new Error(`${source} is missing a Slack user id`);
+	return userId;
+}
+async function handleSlashCommandForm(args) {
+	const { channel_id: channelId, team_id: teamId, user_id: userId } = args.form;
+	const channel = new ChannelImpl({
+		id: `slack:${channelId}`,
+		adapter: args.adapter,
+		stateAdapter: args.state
+	});
+	await withSpan("chat.slash_command", "chat.slash_command", { userId }, async () => {
+		await handleSlashCommand({
+			channel,
+			channelId,
+			teamId,
+			text: args.form.text,
+			userId
+		});
+	});
+}
+async function handleInteractivePayload(args) {
+	if (args.payload.type !== "block_actions") return;
+	const action = args.payload.actions?.find((candidate) => candidate.action_id === "app_home_disconnect");
+	const provider = action?.selected_option?.value ?? action?.value;
+	if (!provider) return;
+	const userId = requireSlackPayloadUserId(args.payload.user?.id, "Slack app home disconnect payload");
+	await withSpan("chat.app_home_disconnect", "chat.app_home_disconnect", { userId }, async () => {
+		try {
+			await unlinkProvider(userId, provider, args.userTokenStore, getWorkspaceTeamId());
+		} catch (error) {
+			logException(error, "app_home.disconnect_unlink.failed", { "app.credential.provider": provider });
+		}
+		try {
+			await publishAppHomeView(getSlackClient(), userId, args.userTokenStore);
+		} catch (error) {
+			logException(error, "app_home.disconnect_publish.failed", { "app.credential.provider": provider });
+		}
+	});
+}
+function installationFromInteractive(payload) {
+	return { teamId: payload.team?.id ?? payload.user?.team_id };
+}
+/** Handle a Slack slash command or interactive payload form. */
+async function handleSlackForm(args) {
+	const params = new URLSearchParams(args.body);
+	const { adapter, state } = args;
+	await state.connect();
+	if (params.has("command") && !params.has("payload")) {
+		const result = slackSlashCommandSchema.safeParse(Object.fromEntries(params));
+		if (!result.success) return new Response("Invalid slash command payload", { status: 400 });
+		const form = result.data;
+		const installation = {
+			teamId: form.team_id,
+			enterpriseId: form.enterprise_id,
+			isEnterpriseInstall: form.is_enterprise_install === "true"
+		};
+		args.waitUntil(withLogContext({
+			platform: "slack",
+			userId: form.user_id
+		}, () => runWithWorkspaceTeamId(installation.teamId, () => runWithSlackInstallation({
+			adapter,
+			installation,
+			state,
+			task: () => handleSlashCommandForm({
+				adapter,
+				form,
+				state
+			})
+		})).catch((error) => {
+			logException(error, "slash_command.failed");
+		})));
+		return new Response("", { status: 200 });
+	}
+	const rawPayload = params.get("payload");
+	if (!rawPayload) return new Response("Missing payload", { status: 400 });
+	const result = slackInteractivePayloadSchema.safeParse(parseJson$1(rawPayload));
+	if (!result.success) return new Response("Invalid payload JSON", { status: 400 });
+	const payload = result.data;
+	const installation = installationFromInteractive(payload);
+	args.waitUntil(withLogContext({
+		platform: "slack",
+		userId: payload.user?.id?.trim() || void 0
+	}, () => runWithWorkspaceTeamId(installation.teamId, () => runWithSlackInstallation({
+		adapter,
+		installation,
+		state,
+		task: () => handleInteractivePayload({
+			payload,
+			userTokenStore: args.getUserTokenStore()
+		})
+	})).catch((error) => {
+		logException(error, "slack.interactive.payload.failed");
+	})));
+	return new Response("", { status: 200 });
+}
+//#endregion
 //#region src/chat/ingress/bot-mention.ts
 /**
 * Detect Slack bot @mentions that should activate Junior.
@@ -2043,7 +2241,7 @@ async function ingestEventAutomations(input, options) {
 	const event = eventSchema.parse(input);
 	const db = getDb();
 	const nowMs = options.nowMs ?? Date.now();
-	const tasks = await findMatchingEventAutomations(db, event, options.teamId);
+	const tasks = (await findMatchingEventAutomations(db, event, options.teamId)).filter((task) => slackChannelMessageRunsAutomation(event, task));
 	let dispatched = 0;
 	const errors = [];
 	for (const task of tasks) try {
@@ -2108,7 +2306,7 @@ async function ingestEventAutomations(input, options) {
 			}
 		});
 		await recordEventAutomationRunStarted(db, {
-			automationId: task.id,
+			automation: task,
 			dispatchId: dispatch.id,
 			nowMs
 		});
@@ -2167,6 +2365,170 @@ async function isSlackWorkspaceMember(raw, state) {
 	return result.value;
 }
 //#endregion
+//#region src/chat/sign-in/allowlist.ts
+/** Google accounts that may sign in. The dashboard uses the same list. */
+/**
+* Read a list env var the same way as the dashboard: a JSON string array or
+* comma-separated values.
+*/
+function readEnvList(name) {
+	const value = process.env[name]?.trim();
+	if (!value) return void 0;
+	if (!value.startsWith("[")) return value.split(",");
+	let parsed;
+	try {
+		parsed = JSON.parse(value);
+	} catch (error) {
+		throw new Error(`${name} must be a JSON string array`, { cause: error });
+	}
+	const list = z.array(z.string()).safeParse(parsed);
+	if (!list.success) throw new Error(`${name} must be a JSON string array`);
+	return list.data;
+}
+/**
+* Resolve the sign-in allowlist. Use the same values as the dashboard: its
+* options when set, else its environment variables.
+*/
+function resolveSignInAllowlist(options = {}) {
+	const list = (values, name) => (values ?? readEnvList(name) ?? []).map((value) => value.trim().toLowerCase()).filter(Boolean);
+	return {
+		domains: list(options.allowedGoogleDomains, "JUNIOR_DASHBOARD_GOOGLE_DOMAINS"),
+		emails: list(options.allowedEmails, "JUNIOR_DASHBOARD_ALLOWED_EMAILS")
+	};
+}
+/** Return whether a normalized Google email is on the allowlist. */
+function isSignInAllowed(email, allowlist) {
+	const domain = email.slice(email.lastIndexOf("@") + 1);
+	return allowlist.emails.includes(email) || allowlist.domains.includes(domain);
+}
+//#endregion
+//#region src/chat/sign-in/slack.ts
+/**
+* Slack sign-in through the shared Google sign-in session.
+*
+* Slack sends a person here when they have no recent Google sign-in. The page
+* uses the browser session that the dashboard also uses. When the person has
+* no session, or an old one, it starts a Google sign-in and comes back here.
+* The sign-in counts only when its Google email belongs to the user of the
+* Slack identity that got the link.
+*/
+const SLACK_SIGN_IN_PATH = "/api/sign-in/slack";
+const SIGN_IN_STATE_TTL_MS = 6e5;
+const signInStateSchema = z.object({
+	redirected: z.boolean(),
+	slackTeamId: z.string().min(1),
+	slackUserId: z.string().min(1)
+});
+function stateKey(state) {
+	return `sign-in:v2:${state}`;
+}
+function page(title, message, status) {
+	return htmlCallbackResponse(escapeXml(title), escapeXml(message), status);
+}
+/** Store one Slack sign-in request and return its link. */
+async function createSlackSignInUrl(args) {
+	const state = randomBytes(24).toString("base64url");
+	await args.state.set(stateKey(state), {
+		redirected: false,
+		slackTeamId: args.slackTeamId,
+		slackUserId: args.slackUserId
+	}, SIGN_IN_STATE_TTL_MS);
+	const url = new URL(SLACK_SIGN_IN_PATH, args.baseURL);
+	url.searchParams.set("state", state);
+	return url.toString();
+}
+/**
+* Finish a Slack sign-in when the browser has a recent Google sign-in for the
+* user of the Slack identity. Otherwise start one Google sign-in.
+*/
+async function handleSlackSignIn(args) {
+	const token = new URL(args.request.url).searchParams.get("state");
+	const parsed = token ? signInStateSchema.safeParse(await args.state.get(stateKey(token))) : void 0;
+	if (!token || !parsed?.success) return page("Sign-in link expired", `Mention ${botConfig.userName} in Slack again to get a new link.`, 400);
+	const stored = parsed.data;
+	const session = await args.auth.getSession(args.request);
+	const email = session?.user.emailVerified ? normalizeIdentityEmail(session.user.email) : void 0;
+	let failure;
+	if (email && !isSignInAllowed(email, args.allowlist)) failure = page("Account not allowed", `${email} cannot use ${botConfig.userName}. Sign in with your work account.`, 403);
+	else if (email) {
+		const executor = getSqlExecutor();
+		const userId = await findSlackIdentityUserId(executor, stored.slackTeamId, stored.slackUserId);
+		const user = await findUserByEmailFromSql(executor.db(), email);
+		if (!userId || user?.id !== userId) failure = page("Slack account does not match", `Your Slack email is not ${email}. Sign in with the account that matches your Slack email.`, 403);
+		else if (await slackUserHasGoogleSignIn(executor, {
+			signedInSince: new Date(Date.now() - args.signIn.maxAgeMs),
+			slackTeamId: stored.slackTeamId,
+			slackUserId: stored.slackUserId
+		})) {
+			await args.state.delete(stateKey(token));
+			return page("You are signed in", "Return to Slack and send your message again.", 200);
+		}
+	}
+	if (stored.redirected) return failure ?? page("Sign-in failed", "Google sign-in did not finish. Sign in with your work account.", 400);
+	await args.state.set(stateKey(token), {
+		...stored,
+		redirected: true
+	}, SIGN_IN_STATE_TTL_MS);
+	const returnUrl = new URL(SLACK_SIGN_IN_PATH, args.signIn.baseURL);
+	returnUrl.searchParams.set("state", token);
+	return await args.auth.signInWithGoogle(args.request, returnUrl.toString(), returnUrl.toString());
+}
+//#endregion
+//#region src/chat/ingress/slack-sign-in.ts
+/** Require a recent Google sign-in before a Slack user can start a Turn. */
+/**
+* Return whether this Slack user may start work.
+*
+* The user of the Slack identity must have signed in with Google, in Slack or
+* in the dashboard, within `signIn.maxAgeMs`. When it has not, save the Slack
+* identity with the email from the Slack profile, so the sign-in page can match
+* it, and check again. Then send the user a private sign-in link and drop the
+* message.
+*/
+async function hasSlackSignIn(args) {
+	if (!args.signIn) return true;
+	const teamId = args.installation.teamId;
+	const channelId = args.event.channel;
+	const userId = parseSlackUserId(args.event.user);
+	if (!teamId || !channelId || !userId) return false;
+	const executor = getSqlExecutor();
+	const signedInSince = new Date(Date.now() - args.signIn.maxAgeMs);
+	const hasSignIn = () => slackUserHasGoogleSignIn(executor, {
+		signedInSince,
+		slackTeamId: teamId,
+		slackUserId: userId
+	});
+	if (await hasSignIn()) return true;
+	const profile = await lookupSlackUserProfile(userId);
+	await upsertIdentity(executor, {
+		kind: "user",
+		provider: "slack",
+		providerTenantId: teamId,
+		providerSubjectId: userId,
+		...profile.real_name ? { displayName: profile.real_name } : void 0,
+		...profile.name ? { handle: profile.name } : void 0,
+		...profile.email ? {
+			email: profile.email,
+			emailVerified: true
+		} : void 0,
+		metadata: { platform: "slack" }
+	});
+	if (await hasSignIn()) return true;
+	const link = await createSlackSignInUrl({
+		baseURL: args.signIn.baseURL,
+		slackTeamId: teamId,
+		slackUserId: userId,
+		state: args.state
+	});
+	await deliverPrivateMessage({
+		channelId,
+		...args.event.thread_ts ? { threadTs: args.event.thread_ts } : void 0,
+		userId,
+		text: `${formatSlackLink(link, `Sign in to use ${botConfig.userName}`)}. Sign in with your work Google account, then send your message again.`
+	});
+	return false;
+}
+//#endregion
 //#region src/chat/ingress/slack-message-telemetry.ts
 function field(value, pattern) {
 	if (value === void 0) return "missing";
@@ -2192,68 +2554,6 @@ function slackMessageAttributes(body) {
 	};
 }
 //#endregion
-//#region src/chat/ingress/slash-command.ts
-async function postEphemeral(event, text) {
-	await event.channel.postEphemeral(event.userId, text, { fallbackToDM: false });
-}
-function getCommandName() {
-	return getChatConfig().slack.slashCommand;
-}
-async function handleLink(event, provider) {
-	if (!pluginCatalogRuntime.isProvider(provider)) {
-		await postEphemeral(event, `Unknown provider: \`${provider}\``);
-		return;
-	}
-	if (!pluginCatalogRuntime.getOAuthConfig(provider)) {
-		await postEphemeral(event, `${formatProviderLabel(provider)} doesn't support account linking.`);
-		return;
-	}
-	const result = await startOAuthFlow(provider, {
-		actorId: event.userId,
-		actor: {
-			platform: "slack",
-			teamId: event.teamId,
-			userId: event.userId
-		},
-		channelId: event.channelId
-	});
-	if (!result.ok) {
-		await postEphemeral(event, `Failed to start linking: ${result.error}`);
-		return;
-	}
-	if (result.delivery === "fallback_dm") await postEphemeral(event, `Check your DMs for a ${formatProviderLabel(provider)} authorization link.`);
-	else if (result.delivery === false) await postEphemeral(event, "I wasn't able to send you a private authorization link. Please try again in a direct message.");
-}
-async function handleUnlink(event, provider) {
-	if (!pluginCatalogRuntime.isProvider(provider)) {
-		await postEphemeral(event, `Unknown provider: \`${provider}\``);
-		return;
-	}
-	if (!(Boolean(pluginCatalogRuntime.getOAuthConfig(provider)) || Boolean(pluginCatalogRuntime.getDefinition(provider)?.manifest.mcp))) {
-		await postEphemeral(event, `${formatProviderLabel(provider)} doesn't support account unlinking.`);
-		return;
-	}
-	const tokenStore = createUserTokenStore();
-	await unlinkProvider(event.userId, provider, tokenStore, event.teamId);
-	logInfo("slash_command.credential.unlinked", { "app.credential.provider": provider });
-	await postEphemeral(event, `Your ${formatProviderLabel(provider)} account has been unlinked.`);
-}
-/** Route link and unlink slash commands to the appropriate OAuth flow. */
-async function handleSlashCommand(event) {
-	const [subcommand, provider, ...rest] = event.text.trim().split(/\s+/);
-	if (!subcommand || !["link", "unlink"].includes(subcommand)) {
-		await postEphemeral(event, `Usage: \`${getCommandName()} link <provider>\` or \`${getCommandName()} unlink <provider>\``);
-		return;
-	}
-	if (!provider || rest.length > 0) {
-		await postEphemeral(event, `Usage: \`${getCommandName()} ${subcommand} <provider>\``);
-		return;
-	}
-	const normalized = provider.toLowerCase();
-	if (subcommand === "link") await handleLink(event, normalized);
-	else await handleUnlink(event, normalized);
-}
-//#endregion
 //#region src/chat/slack/automation-details.ts
 function textField(key, label, value) {
 	return {
@@ -2651,6 +2951,7 @@ async function routeParsedMessage(args) {
 		});
 		return;
 	}
+	if (route === "mention" && !await hasSlackSignIn(args)) return;
 	if (isSubscribed && !isExperimentalFeatureEnabled("passive-routing")) {
 		const content = parseContent(message);
 		const conversation = coerceThreadConversationState(void 0);
@@ -2767,6 +3068,7 @@ async function handleSlackEvent(args) {
 					conversationStore: args.services.conversationStore,
 					queue: args.services.queue,
 					receivedAtMs,
+					signIn: args.services.signIn,
 					state
 				}), {
 					keepAlive: true,
@@ -2776,103 +3078,6 @@ async function handleSlackEvent(args) {
 		}
 	}));
 }
-function requireSlackPayloadUserId(value, source) {
-	const userId = parseActorUserId(value);
-	if (!userId) throw new Error(`${source} is missing a Slack user id`);
-	return userId;
-}
-async function handleSlashCommandForm(args) {
-	const { channel_id: channelId, team_id: teamId, user_id: userId } = args.form;
-	const channel = new ChannelImpl({
-		id: `slack:${channelId}`,
-		adapter: args.adapter,
-		stateAdapter: args.state
-	});
-	await withSpan("chat.slash_command", "chat.slash_command", { userId }, async () => {
-		await handleSlashCommand({
-			channel,
-			channelId,
-			teamId,
-			text: args.form.text,
-			userId
-		});
-	});
-}
-async function handleInteractivePayload(args) {
-	if (args.payload.type !== "block_actions") return;
-	const action = args.payload.actions?.find((candidate) => candidate.action_id === "app_home_disconnect");
-	const provider = action?.selected_option?.value ?? action?.value;
-	if (!provider) return;
-	const userId = requireSlackPayloadUserId(args.payload.user?.id, "Slack app home disconnect payload");
-	await withSpan("chat.app_home_disconnect", "chat.app_home_disconnect", { userId }, async () => {
-		try {
-			await unlinkProvider(userId, provider, args.userTokenStore, getWorkspaceTeamId());
-		} catch (error) {
-			logException(error, "app_home.disconnect_unlink.failed", { "app.credential.provider": provider });
-		}
-		try {
-			await publishAppHomeView(getSlackClient(), userId, args.userTokenStore);
-		} catch (error) {
-			logException(error, "app_home.disconnect_publish.failed", { "app.credential.provider": provider });
-		}
-	});
-}
-function installationFromInteractive(payload) {
-	return { teamId: payload.team?.id ?? payload.user?.team_id };
-}
-async function handleSlackForm(args) {
-	const params = new URLSearchParams(args.body);
-	const adapter = args.services.getSlackAdapter();
-	const state = args.services.state ?? getStateAdapter();
-	await state.connect();
-	if (params.has("command") && !params.has("payload")) {
-		const result = slackSlashCommandSchema.safeParse(Object.fromEntries(params));
-		if (!result.success) return new Response("Invalid slash command payload", { status: 400 });
-		const form = result.data;
-		const installation = {
-			teamId: form.team_id,
-			enterpriseId: form.enterprise_id,
-			isEnterpriseInstall: form.is_enterprise_install === "true"
-		};
-		enqueue(args.waitUntil, withLogContext({
-			platform: "slack",
-			userId: form.user_id
-		}, () => runWithWorkspaceTeamId(installation.teamId, () => runWithSlackInstallation({
-			adapter,
-			installation,
-			state,
-			task: () => handleSlashCommandForm({
-				adapter,
-				form,
-				state
-			})
-		})).catch((error) => {
-			logException(error, "slash_command.failed");
-		})));
-		return new Response("", { status: 200 });
-	}
-	const rawPayload = params.get("payload");
-	if (!rawPayload) return new Response("Missing payload", { status: 400 });
-	const result = slackInteractivePayloadSchema.safeParse(parseJson(rawPayload));
-	if (!result.success) return new Response("Invalid payload JSON", { status: 400 });
-	const payload = result.data;
-	const installation = installationFromInteractive(payload);
-	enqueue(args.waitUntil, withLogContext({
-		platform: "slack",
-		userId: payload.user?.id?.trim() || void 0
-	}, () => runWithWorkspaceTeamId(installation.teamId, () => runWithSlackInstallation({
-		adapter,
-		installation,
-		state,
-		task: () => handleInteractivePayload({
-			payload,
-			userTokenStore: getUserTokenStore(args.services)
-		})
-	})).catch((error) => {
-		logException(error, "slack.interactive.payload.failed");
-	})));
-	return new Response("", { status: 200 });
-}
 /** Handle Slack webhooks by enqueueing durable conversation work. */
 async function handleSlackWebhook(args) {
 	const adapter = args.services.getSlackAdapter();
@@ -2883,8 +3088,10 @@ async function handleSlackWebhook(args) {
 		request: args.request
 	})) return new Response("Invalid signature", { status: 401 });
 	if ((args.request.headers.get("content-type") || "").includes("application/x-www-form-urlencoded")) return await handleSlackForm({
+		adapter,
 		body,
-		services: args.services,
+		getUserTokenStore: () => getUserTokenStore(args.services),
+		state: args.services.state ?? getStateAdapter(),
 		waitUntil: args.waitUntil
 	});
 	const result = slackEventEnvelopeSchema.safeParse(parseJson(body));
@@ -4945,6 +5152,139 @@ async function handleAcpAuthorizationPage(args) {
 	return renderResult(args.agentName, result);
 }
 //#endregion
+//#region src/chat/sign-in/auth.ts
+/**
+* Google sign-in session shared by the dashboard and Slack.
+*
+* Better Auth runs the Google OAuth flow and keeps the browser session in an
+* encrypted cookie. Each sign-in also saves the native Google identity with its
+* sign-in time, so Slack can check a recent sign-in without the browser.
+*/
+const DEFAULT_AUTH_PATH = "/api/auth";
+const DEFAULT_SESSION_MAX_AGE_SECONDS = 28800;
+function trimSlashes(value, leading) {
+	let start = 0;
+	let end = value.length;
+	while (leading && start < end && value[start] === "/") start += 1;
+	while (end > start && value[end - 1] === "/") end -= 1;
+	return value.slice(start, end);
+}
+function withHttps(host) {
+	return /^https?:\/\//.test(host) ? host : `https://${host}`;
+}
+/** Resolve sign-in settings from dashboard options and environment. */
+function resolveSignInAuthConfig(agentName, options = {}) {
+	const authPath = `/${trimSlashes(options.authPath?.trim() || DEFAULT_AUTH_PATH, true)}`;
+	const baseURL = trimSlashes(withHttps(options.baseURL?.trim() || resolveBaseUrl() || "http://localhost:3000"), false);
+	return {
+		agentName,
+		allowlist: resolveSignInAllowlist(options),
+		authPath,
+		baseURL,
+		sessionMaxAgeSeconds: options.sessionMaxAgeSeconds,
+		trustedOrigins: options.trustedOrigins ?? readEnvList("JUNIOR_DASHBOARD_TRUSTED_ORIGINS") ?? []
+	};
+}
+function required(value, name) {
+	if (!value?.trim()) throw new Error(`${name} is required for Junior sign-in`);
+	return value.trim();
+}
+function createBetterAuth(config) {
+	const secret = required(config.secret ?? process.env.BETTER_AUTH_SECRET ?? process.env.JUNIOR_SECRET, "JUNIOR_SECRET or BETTER_AUTH_SECRET");
+	const sessionMaxAgeSeconds = config.sessionMaxAgeSeconds ?? DEFAULT_SESSION_MAX_AGE_SECONDS;
+	const { domains, emails } = config.allowlist;
+	const hostedDomain = domains.length === 1 && emails.length === 0 ? domains[0] : void 0;
+	return betterAuth({
+		appName: config.agentName,
+		baseURL: config.baseURL,
+		basePath: config.authPath,
+		secret,
+		trustedOrigins: config.trustedOrigins,
+		socialProviders: { google: {
+			clientId: required(config.googleClientId ?? process.env.GOOGLE_CLIENT_ID, "GOOGLE_CLIENT_ID"),
+			clientSecret: required(config.googleClientSecret ?? process.env.GOOGLE_CLIENT_SECRET, "GOOGLE_CLIENT_SECRET"),
+			hd: hostedDomain,
+			prompt: "select_account",
+			mapProfileToUser(profile) {
+				return {
+					email: profile.email,
+					emailVerified: profile.email_verified,
+					image: profile.picture,
+					name: profile.name
+				};
+			}
+		} },
+		account: {
+			storeStateStrategy: "cookie",
+			storeAccountCookie: false,
+			updateAccountOnSignIn: false
+		},
+		session: {
+			expiresIn: sessionMaxAgeSeconds,
+			disableSessionRefresh: true,
+			cookieCache: {
+				enabled: true,
+				strategy: "jwe",
+				maxAge: sessionMaxAgeSeconds,
+				refreshCache: false
+			}
+		},
+		hooks: { after: createAuthMiddleware(async (ctx) => {
+			const created = ctx.context.newSession;
+			if (!created || !ctx.path.startsWith("/callback/")) return;
+			const email = normalizeIdentityEmail(created.user.email);
+			if (!created.user.emailVerified || !email || !isSignInAllowed(email, config.allowlist)) return;
+			const google = (await ctx.context.internalAdapter.findAccounts(created.user.id)).find((account) => account.providerId === "google");
+			if (!google) throw new Error("Google sign-in has no Google account");
+			await recordGoogleSignIn(getSqlExecutor(), {
+				email,
+				subject: google.accountId,
+				displayName: created.user.name || void 0
+			});
+		}) }
+	});
+}
+/**
+* Create the shared Google sign-in session. Better Auth starts on first use,
+* so apps that never sign in need no Google credentials.
+*/
+function createSignInAuth(config) {
+	let auth;
+	const getAuth = () => auth ??= createBetterAuth(config);
+	return {
+		handler(request) {
+			return getAuth().handler(request);
+		},
+		async getSession(request) {
+			const session = await getAuth().api.getSession({ headers: request.headers });
+			if (!session) return null;
+			const { email, emailVerified, name } = session.user;
+			return { user: {
+				email,
+				emailVerified,
+				name
+			} };
+		},
+		async signInWithGoogle(request, callbackURL, errorCallbackURL) {
+			const result = await getAuth().api.signInSocial({
+				body: {
+					provider: "google",
+					callbackURL,
+					errorCallbackURL
+				},
+				headers: request.headers,
+				returnHeaders: true
+			});
+			if (!("url" in result.response) || !result.response.url) throw new Error("Google sign-in did not return a redirect URL");
+			result.headers.set("location", result.response.url);
+			return new Response(null, {
+				status: 302,
+				headers: result.headers
+			});
+		}
+	};
+}
+//#endregion
 //#region src/dashboard-routes.ts
 const DASHBOARD_PACKAGE_NAME = "@sentry/junior-dashboard";
 /** Mount the dashboard app on the dashboard-owned host paths. */
@@ -4952,6 +5292,7 @@ async function createDashboardRouteRegistrations(args) {
 	if (!args.dashboard || args.dashboard.disabled) return [];
 	const createDashboardApp = args.createDashboardApp ?? await loadDashboardAppFactory();
 	return dashboardRouteRegistrations({
+		auth: args.auth,
 		authenticatedRoutes: args.authenticatedRoutes,
 		conversationWorkQueue: args.conversationWorkQueue,
 		dashboard: args.dashboard,
@@ -5100,6 +5441,7 @@ function dashboardRouteRegistrations(args) {
 		const dashboardOptions = {
 			...args.dashboard,
 			agentName: botConfig.userName,
+			...args.auth ? { auth: args.auth } : void 0,
 			authenticatedRoutes: args.authenticatedRoutes,
 			conversationWorkQueue: args.conversationWorkQueue,
 			pluginRoutes: args.pluginRoutes
@@ -5236,6 +5578,8 @@ async function createApp(options) {
 		queue: conversationWorkQueue
 	}) });
 	let sandboxEgressTracePropagationDomains = [];
+	let signInConfig;
+	let slackSignIn;
 	try {
 		sandboxEgressTracePropagationDomains = normalizeSandboxEgressTracePropagationDomains(options?.sandbox?.egressTracePropagationDomains);
 		setSandboxResourceConfig(options?.sandbox);
@@ -5248,6 +5592,18 @@ async function createApp(options) {
 		setRuntimeLimits(options?.limits);
 		setSlackReactionConfig(options?.slack ?? {});
 		if (options?.slack?.crossActorMidRunMode) setCrossActorMidRunMode(options.slack.crossActorMidRunMode);
+		const dashboardMounted = Boolean(dashboard && !dashboard.disabled);
+		if (isExperimentalFeatureEnabled("slack-sign-in") || dashboardMounted) signInConfig = resolveSignInAuthConfig(botConfig.userName, dashboard);
+		if (signInConfig && isExperimentalFeatureEnabled("slack-sign-in")) {
+			const { allowlist } = signInConfig;
+			if (!allowlist.domains.length && !allowlist.emails.length) throw new Error("experimental.slack-sign-in requires allowed Google domains or emails");
+			const maxAgeDays = options?.slack?.signInMaxAgeDays ?? 7;
+			if (!(maxAgeDays > 0)) throw new Error("slack.signInMaxAgeDays must be greater than 0");
+			slackSignIn = {
+				baseURL: signInConfig.baseURL,
+				maxAgeMs: maxAgeDays * 24 * 60 * 60 * 1e3
+			};
+		}
 		if (shouldValidatePluginCatalog) {
 			pluginCatalogRuntime.getSignature();
 			validatePluginRegistrations(configuredPlugins?.registrations ?? []);
@@ -5335,10 +5691,14 @@ async function createApp(options) {
 		restoreRuntimeConfig$1();
 		throw error;
 	}
-	const slackWebhookServices = createProductionSlackWebhookServices({
-		queue: conversationWorkQueue,
-		services: runtimeServiceOverrides
-	});
+	const signInAuth = signInConfig ? createSignInAuth(signInConfig) : void 0;
+	const slackWebhookServices = {
+		...createProductionSlackWebhookServices({
+			queue: conversationWorkQueue,
+			services: runtimeServiceOverrides
+		}),
+		...slackSignIn ? { signIn: slackSignIn } : void 0
+	};
 	const app = new Hono();
 	app.onError((err, c) => {
 		logException(err, "route.unhandled.exception");
@@ -5354,9 +5714,13 @@ async function createApp(options) {
 	], "/api/acp", (c) => getAcpRuntime().handleRequest(c.req.raw));
 	mountRoutes(app, pluginRoutes);
 	mountRoutes(app, await createDashboardRouteRegistrations({
+		auth: signInAuth,
 		authenticatedRoutes,
 		conversationWorkQueue,
-		dashboard,
+		dashboard: dashboard && signInConfig ? {
+			...dashboard,
+			baseURL: signInConfig.baseURL
+		} : dashboard,
 		createDashboardApp: virtualConfig?.createDashboardApp,
 		pluginRoutes: pluginApiRoutes
 	}));
@@ -5372,6 +5736,19 @@ async function createApp(options) {
 	app.get("/api/oauth/callback/:provider", (c) => {
 		return GET$5(c.req.raw, c.req.param("provider"), waitUntil, { conversationWorkQueue });
 	});
+	if (signInAuth && signInConfig && slackSignIn) {
+		const auth = signInAuth;
+		if (!dashboard || dashboard.disabled) app.on(["GET", "POST"], `${signInConfig.authPath}/*`, (c) => auth.handler(c.req.raw));
+		const { allowlist } = signInConfig;
+		const signIn = slackSignIn;
+		app.get(SLACK_SIGN_IN_PATH, (c) => handleSlackSignIn({
+			allowlist,
+			auth,
+			signIn,
+			request: c.req.raw,
+			state: getStateAdapter()
+		}));
+	}
 	app.get("/api/internal/sandbox-egress/signals", (c) => {
 		return GET(c.req.raw);
 	});