@sentry/junior 0.255.0 → 0.257.0

package/dist/{assistant-reply-BddmM66R.js → assistant-reply-CbTPebzL.js}

@@ -1,4 +1,4 @@
-import { st as extractAssistantText } from "./tasks-dJooqiip.js";
+import { ct as extractAssistantText } from "./tasks-D_WIJtvO.js";
 //#region src/chat/no-reply.ts
 const NO_REPLY_MARKER = "[[NO_REPLY]]";
 /**

package/dist/{briefs-iVq_8-ft.js → briefs-oLOldnDM.js}

@@ -1,7 +1,7 @@
-import { r as completeObject } from "./client-Clj7onnT.js";
+import { r as completeObject } from "./client-D8HnkOQX.js";
 import { r as defaultModelId } from "./model-profile-BwU8mqwD.js";
-import { U as parseBriefInput, d as conversationDetailReportSchema, p as conversationEventPageSchema, z as briefCodeChangeSchema } from "./conversation-T18Xlkx9.js";
-import { n as briefEntriesFromReportEvents, s as generateBrief, t as BRIEF_PROMPT } from "./prompt-C04mP1hu.js";
+import { U as parseBriefInput, d as conversationDetailReportSchema, p as conversationEventPageSchema, z as briefCodeChangeSchema } from "./conversation-CKNLYBJt.js";
+import { n as briefEntriesFromReportEvents, s as generateBrief, t as BRIEF_PROMPT } from "./prompt-DyoEj9c2.js";
 import { CLI_USAGE } from "./cli/run.js";
 import path from "node:path";
 import { z } from "zod";
@@ -269,7 +269,7 @@ async function parseRunOptions(argv) {
 * `DATABASE_URL` at import, and `briefs pull` must work with only a token.
 */
 async function configuredDefaultModelId() {
-	const { botConfig } = await import("./config-BDAfLTI9.js").then((n) => n.r);
+	const { botConfig } = await import("./config-CJRnWK9H.js").then((n) => n.r);
 	return defaultModelId(botConfig);
 }
 function apiUrl(baseUrl, pathname) {

package/dist/{catalog-runtime-hKmI-iZa.js → catalog-runtime-CZzhGQ7F.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-B4FMCO8f.js";
-import { t as createPluginCatalogRuntime } from "./registry-CmKmKHpp.js";
+import { t as createPluginCatalogRuntime } from "./registry-sLTr-sV9.js";
 //#region src/chat/plugins/catalog-runtime.ts
 var catalog_runtime_exports = /* @__PURE__ */ __exportAll({ pluginCatalogRuntime: () => pluginCatalogRuntime });
 const pluginCatalogRuntime = createPluginCatalogRuntime();

package/dist/cli/chat.js

@@ -1,4 +1,4 @@
-import { n as executeAgentRun, t as createAgentRunner } from "../agent-runner-Caiof09f.js";
+import { n as executeAgentRun, t as createAgentRunner } from "../agent-runner-D7OboVb3.js";
 import { t as loadAppPluginSet } from "../plugin-module-CVvEUSMH.js";
 import path from "node:path";
 import { createHash, randomUUID } from "node:crypto";
@@ -100,10 +100,10 @@ async function loadLocalPluginSet() {
 async function configureLocalChatPlugins(pluginSet) {
 	const [pluginsModule, agentHooksModule, catalogRuntimeModule, validationModule, databaseModule] = await Promise.all([
 		import("../plugins-egKWjgue.js").then((n) => n.o),
-		import("../agent-hooks-CDVx26Uu.js").then((n) => n.t),
-		import("../catalog-runtime-hKmI-iZa.js").then((n) => n.t),
-		import("../validation-LzIilOb6.js").then((n) => n.r),
-		import("../viewer-Rnim7alE.js").then((n) => n.s)
+		import("../agent-hooks-BjtTzvru.js").then((n) => n.t),
+		import("../catalog-runtime-CZzhGQ7F.js").then((n) => n.t),
+		import("../validation-CXYxaNYx.js").then((n) => n.r),
+		import("../viewer-DSZXygMU.js").then((n) => n.c)
 	]);
 	const resolvedPluginSet = pluginSet === void 0 ? await loadLocalPluginSet() : pluginSet ?? void 0;
 	const plugins = pluginsModule.pluginRuntimeRegistrationsFromPluginSet(resolvedPluginSet);
@@ -153,21 +153,21 @@ function localDevServerUrl() {
 async function prepareLocalChatRun(io, pluginSet) {
 	defaultStateAdapterForLocalChat();
 	await configureLocalChatPlugins(pluginSet);
-	const { setExperimentalFeatures } = await import("../experimental-Qn9rKLgx.js").then((n) => n.t);
+	const { setExperimentalFeatures } = await import("../experimental-CQIvMUO7.js").then((n) => n.t);
 	setExperimentalFeatures({ subagents: true });
-	const { setBriefsConfig } = await import("../agent-hooks-CDVx26Uu.js").then((n) => n.m);
+	const { setBriefsConfig } = await import("../agent-hooks-BjtTzvru.js").then((n) => n.m);
 	setBriefsConfig({ enabled: true });
-	const { runLocalAgentTurn } = await import("../runner-CmzoXEI4.js");
-	const { startLocalOAuthCallbackServer } = await import("../oauth-callback-server-i5qdAou6.js");
+	const { runLocalAgentTurn } = await import("../runner-CzYImdOF.js");
+	const { startLocalOAuthCallbackServer } = await import("../oauth-callback-server-Dj5UJODo.js");
 	const { createLocalOAuthState } = await import("../oauth-relay-CdCnu80W.js").then((n) => n.t);
-	const { createLocalSandboxEgressSignalTransport } = await import("../sandbox-egress-signals-DjMNKLZz.js");
-	const { bindSpawnAgent } = await import("../spawn-OgTwBUj0.js").then((n) => n.n);
-	const { bindMessageAgent } = await import("../message-B9xqD2BP.js").then((n) => n.n);
-	const { createAgentInvocationWorker, routeAgentInvocationWork } = await import("../work-BAn43SsN.js").then((n) => n.a);
-	const { startAgentInvocationsForChildInput } = await import("../result-Df5nEDX2.js").then((n) => n.r);
-	const { skipInputBeforeConversationStop } = await import("../session-stop-BEBfE97J.js").then((n) => n.r);
+	const { createLocalSandboxEgressSignalTransport } = await import("../sandbox-egress-signals-CZbMINHI.js");
+	const { bindSpawnAgent } = await import("../spawn-DY9CLXDL.js").then((n) => n.n);
+	const { bindMessageAgent } = await import("../message-TUOdbSBW.js").then((n) => n.n);
+	const { createAgentInvocationWorker, routeAgentInvocationWork } = await import("../work-nAfDSUFP.js").then((n) => n.a);
+	const { startAgentInvocationsForChildInput } = await import("../result-C883vngT.js").then((n) => n.r);
+	const { skipInputBeforeConversationStop } = await import("../session-stop-CQjKd4a2.js").then((n) => n.r);
 	const { createLocalConversationWork } = await import("../conversation-work-C6y3T5Hx.js");
-	const { processConversationWork } = await import("../worker-mBXq4_zg.js").then((n) => n.n);
+	const { processConversationWork } = await import("../worker-vGXZ6XFT.js").then((n) => n.n);
 	let agentRunner;
 	const localConversationWork = createLocalConversationWork(async (message) => {
 		if (!agentRunner) throw new Error("Local agent runner is not ready");

package/dist/cli/check.js

@@ -1,6 +1,6 @@
-import { D as JUNIOR_HEARTBEAT_ROUTE, M as LEGACY_JUNIOR_CONVERSATION_WORK_FUNCTION, T as JUNIOR_CONVERSATION_WORK_CALLBACK_ROUTE } from "../logging-D3aYP0aG.js";
-import { _ as parsePluginManifest, g as parseInlinePluginManifest } from "../registry-CmKmKHpp.js";
-import { i as parseSkillFile } from "../skills-Dc-AMYi4.js";
+import { E as JUNIOR_CONVERSATION_WORK_CALLBACK_ROUTE, N as LEGACY_JUNIOR_CONVERSATION_WORK_FUNCTION, O as JUNIOR_HEARTBEAT_ROUTE } from "../logging-CWxiIuCF.js";
+import { v as parseInlinePluginManifest, y as parsePluginManifest } from "../registry-sLTr-sV9.js";
+import { i as parseSkillFile } from "../skills-C22SLruK.js";
 import path from "node:path";
 import fs from "node:fs/promises";
 import { pathToFileURL } from "node:url";

package/dist/cli/main.js

@@ -25,10 +25,10 @@ async function runChat(argv, pluginSet) {
 	return await (await import("./chat.js")).runChat(argv, void 0, { pluginSet });
 }
 async function runAdmin(argv) {
-	return await (await import("../admin-CeJh4SuR.js")).runAdmin(argv);
+	return await (await import("../admin-DgIkm6Vy.js")).runAdmin(argv);
 }
 async function runBriefs(argv) {
-	return await (await import("../briefs-iVq_8-ft.js")).runBriefs(argv);
+	return await (await import("../briefs-oLOldnDM.js")).runBriefs(argv);
 }
 function topLevelCommand(argv) {
 	return (argv[0] === "--" ? argv.slice(1) : argv)[0];

package/dist/cli/plugins.js

@@ -1,7 +1,7 @@
-import { d as getDb } from "../viewer-Rnim7alE.js";
-import { n as pluginCatalogRuntime } from "../catalog-runtime-hKmI-iZa.js";
-import { d as setPlugins, f as validatePlugins, ft as createPluginLogger } from "../agent-hooks-CDVx26Uu.js";
-import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "../validation-LzIilOb6.js";
+import { f as getDb } from "../viewer-DSZXygMU.js";
+import { n as pluginCatalogRuntime } from "../catalog-runtime-CZzhGQ7F.js";
+import { d as setPlugins, f as validatePlugins, ft as createPluginLogger } from "../agent-hooks-BjtTzvru.js";
+import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "../validation-CXYxaNYx.js";
 import { a as pluginRuntimeRegistrationsFromPluginSet, i as pluginCliRegistrationsFromPluginSet, r as pluginCatalogConfigFromPluginSet } from "../plugins-egKWjgue.js";
 import { t as loadAppPluginSet } from "../plugin-module-CVvEUSMH.js";
 import { stderr, stdout } from "node:process";

package/dist/cli/snapshot-create.js

@@ -1,6 +1,6 @@
-import { n as pluginCatalogRuntime } from "../catalog-runtime-hKmI-iZa.js";
-import { S as disconnectStateAdapter, t as create } from "../profile-DnkX3e2S.js";
-import { r as resolve } from "../resolve-jfNHtEBx.js";
+import { n as pluginCatalogRuntime } from "../catalog-runtime-CZzhGQ7F.js";
+import { S as disconnectStateAdapter, t as create } from "../profile-h-72wM78.js";
+import { r as resolve } from "../resolve-ncQPZROQ.js";
 //#region src/cli/snapshot-create.ts
 const DEFAULT_RUNTIME = "node22";
 const DEFAULT_TIMEOUT_MS = 6e5;

package/dist/cli/upgrade.js

@@ -1,6 +1,6 @@
-import { i as getChatConfig } from "../config-BDAfLTI9.js";
-import { t as createJuniorSqlExecutor } from "../executor-Dh4Ofsnx.js";
-import { t as createPluginCatalogRuntime } from "../registry-CmKmKHpp.js";
+import { i as getChatConfig } from "../config-CJRnWK9H.js";
+import { t as createJuniorSqlExecutor } from "../executor-Do0THDRR.js";
+import { t as createPluginCatalogRuntime } from "../registry-sLTr-sV9.js";
 import { n as pluginCatalogConfigFromEnv, r as pluginCatalogConfigFromPluginSet, t as defineJuniorPlugins } from "../plugins-egKWjgue.js";
 import { t as loadAppPluginSet } from "../plugin-module-CVvEUSMH.js";
 import { basename, dirname, join, resolve } from "node:path";

package/dist/{client-Clj7onnT.js → client-D8HnkOQX.js}

@@ -1,5 +1,5 @@
-import { d as logException, g as serializeGenAiAttribute, i as extractGenAiUsageAttributes, m as normalizeGenAiFinishReason, p as logWarn, w as withSpan } from "./logging-D3aYP0aG.js";
-import { a as toCanonicalInputMessage, n as getCurrentConversationPrivacy, o as toCanonicalOutputMessage, s as toGenAiMessagesTraceAttributes } from "./conversation-privacy-1ERtieuM.js";
+import { T as withSpan, _ as serializeGenAiAttribute, f as logException, h as normalizeGenAiFinishReason, i as extractGenAiUsageAttributes, m as logWarn } from "./logging-CWxiIuCF.js";
+import { a as toCanonicalInputMessage, n as getCurrentConversationPrivacy, o as toCanonicalOutputMessage, s as toGenAiMessagesTraceAttributes } from "./conversation-privacy-C8b1nphZ.js";
 import { calculateCost, completeSimple, getEnvApiKey, getModels, registerApiProvider } from "@earendil-works/pi-ai/compat";
 import { stream as streamAnthropic, streamSimple as streamSimpleAnthropic } from "@earendil-works/pi-ai/api/anthropic-messages";
 import { createGatewayProvider } from "@ai-sdk/gateway";

package/dist/{config-BDAfLTI9.js → config-CJRnWK9H.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-B4FMCO8f.js";
-import { S as toOptionalTrimmed, o as resolveGatewayModel } from "./client-Clj7onnT.js";
-import { p as logWarn } from "./logging-D3aYP0aG.js";
+import { S as toOptionalTrimmed, o as resolveGatewayModel } from "./client-D8HnkOQX.js";
+import { m as logWarn } from "./logging-CWxiIuCF.js";
 import { l as TURN_REASONING_LEVELS, s as modelProfileSchema, t as DEFAULT_MODEL_PROFILES, u as parseTurnReasoningLevel } from "./model-profile-BwU8mqwD.js";
 //#region src/chat/slack/emoji.ts
 const SLACK_EMOJI_NAME_RE = /^(?:[a-z0-9_+-]+)(?:::(?:skin-tone-[2-6]))?$/;

package/dist/{connections-BC0RTejT.js → connections-ClYrKzpX.js}

@@ -1,12 +1,12 @@
-import { It as startOAuthFlow, c as deleteMcpAuthSessionsForUserProvider, l as deleteMcpServerSessionId, u as deleteMcpStoredOAuthCredentials } from "./agent-runner-Caiof09f.js";
-import { D as deleteProviderIdentityForSlackUser, c as getConversationEventStore, f as getSqlExecutor } from "./viewer-Rnim7alE.js";
-import { u as hasRequiredOAuthScope } from "./registry-CmKmKHpp.js";
-import { n as pluginCatalogRuntime } from "./catalog-runtime-hKmI-iZa.js";
-import { G as loadTurnCheckpoint, X as getTurnRecord, Y as failTurnRecord } from "./tasks-dJooqiip.js";
-import { w as getStateAdapter } from "./profile-DnkX3e2S.js";
-import { a as getVercelConversationWorkQueue } from "./job-queue-BaCL36FY.js";
-import { m as ensureConversationWake, w as requestConversationWork } from "./store-BashBewg.js";
-import { n as resolveTurnSessionRouting } from "./turn-session-routing-BAh_qsBJ.js";
+import { Lt as startOAuthFlow, c as deleteMcpAuthSessionsForUserProvider, l as deleteMcpServerSessionId, u as deleteMcpStoredOAuthCredentials } from "./agent-runner-D7OboVb3.js";
+import { A as deleteProviderIdentityForSlackUser, j as deleteProviderIdentityForUser, l as getConversationEventStore, p as getSqlExecutor } from "./viewer-DSZXygMU.js";
+import { u as hasRequiredOAuthScope } from "./registry-sLTr-sV9.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-CZzhGQ7F.js";
+import { K as loadTurnCheckpoint, X as failTurnRecord, Z as getTurnRecord } from "./tasks-D_WIJtvO.js";
+import { w as getStateAdapter } from "./profile-h-72wM78.js";
+import { a as getVercelConversationWorkQueue } from "./job-queue-B6SV9uVa.js";
+import { m as ensureConversationWake, w as requestConversationWork } from "./store-DXFIQy-G.js";
+import { n as resolveTurnSessionRouting } from "./turn-session-routing-B3LWooK5.js";
 import { z } from "zod";
 import { randomBytes, randomUUID } from "node:crypto";
 //#region src/chat/task-execution/authorized-turn.ts
@@ -231,8 +231,13 @@ async function startConnection(provider, actor) {
 		authorizationUrl: request.authorizationUrl
 	};
 }
-/** Remove the user's stored connection for one provider. */
-async function disconnectConnection(userId, provider, userTokenStore) {
+/**
+* Remove the user's stored connection for one provider and the provider
+* identity that the connection linked to the viewer's user.
+*/
+async function disconnectConnection(userId, provider, userTokenStore, viewerUserId) {
+	const tokens = await userTokenStore.get(userId, provider);
+	if (tokens?.account) await deleteProviderIdentityForUser(getSqlExecutor(), viewerUserId, provider, tokens.account.id);
 	await unlinkProvider(userId, provider, userTokenStore);
 }
 //#endregion

package/dist/{conversation-T18Xlkx9.js → conversation-CKNLYBJt.js}

@@ -528,6 +528,7 @@ const conversationReportMessageEventDataSchema = z.object({
 	]),
 	source: z.enum(["slack", "web"]).optional(),
 	actorIdentity: actorIdentitySchema.optional(),
+	mentions: z.array(actorIdentitySchema).optional(),
 	eventType: z.string().min(1).optional(),
 	eventObjectType: objectTypeSchema.optional(),
 	explicitMention: z.boolean().optional(),
@@ -541,9 +542,9 @@ const conversationReportMessageEventDataSchema = z.object({
 		code: "custom",
 		message: "message content must be text or explicitly redacted"
 	});
-	if (data.redacted && (data.actorIdentity || data.cards || data.attachments)) context.addIssue({
+	if (data.redacted && (data.actorIdentity || data.mentions || data.cards || data.attachments)) context.addIssue({
 		code: "custom",
-		message: "redacted messages must not expose actor identity, cards, or attachments"
+		message: "redacted messages must not expose actor identity, mentions, cards, or attachments"
 	});
 });
 const conversationReportMessageHandledEventDataSchema = z.object({

package/dist/{conversation-privacy-1ERtieuM.js → conversation-privacy-C8b1nphZ.js}

@@ -1,4 +1,4 @@
-import { p as logWarn } from "./logging-D3aYP0aG.js";
+import { m as logWarn } from "./logging-CWxiIuCF.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/chat/conversation-privacy.ts
 const SAFE_METADATA_KEY_LIMIT = 20;

package/dist/{credential-sync-BZuqqIHk.js → credential-sync-BXfohNmJ.js}

@@ -1,19 +1,19 @@
-import { Ft as resolveBaseUrl, Lt as createUserTokenStore, Nt as formatProviderLabel, Pt as parseOAuthStatePayload, _ as resolvePluginOAuthAccount, d as getMcpAuthSession, f as getMcpStoredOAuthCredentials, o as finalizeMcpAuthorization, p as putMcpStoredOAuthCredentials, s as deleteMcpAuthSession, x as lookupSlackUserProfile, xt as getMcpProviderErrorAttributes } from "./agent-runner-Caiof09f.js";
-import { f as escapeXml } from "./client-Clj7onnT.js";
-import { d as logException, h as runBestEffort, p as logWarn } from "./logging-D3aYP0aG.js";
-import { a as getRuntimeMetadata, n as botConfig } from "./config-BDAfLTI9.js";
+import { Ft as parseOAuthStatePayload, It as resolveBaseUrl, Pt as formatProviderLabel, Rt as createUserTokenStore, _ as resolvePluginOAuthAccount, d as getMcpAuthSession, f as getMcpStoredOAuthCredentials, o as finalizeMcpAuthorization, p as putMcpStoredOAuthCredentials, s as deleteMcpAuthSession, x as lookupSlackUserProfile, xt as getMcpProviderErrorAttributes } from "./agent-runner-D7OboVb3.js";
+import { f as escapeXml } from "./client-D8HnkOQX.js";
+import { L as isNativeIdentityProvider, f as logException, g as runBestEffort, m as logWarn } from "./logging-CWxiIuCF.js";
+import { a as getRuntimeMetadata, n as botConfig } from "./config-CJRnWK9H.js";
 import { f as parseSlackUserId } from "./actor-BTtLaeWy.js";
-import { A as upsertIdentity, f as getSqlExecutor, j as upsertLinkedIdentity } from "./viewer-Rnim7alE.js";
+import { N as findUserByVerifiedEmails, R as upsertIdentity, p as getSqlExecutor, x as identityFromActor, z as upsertLinkedIdentity } from "./viewer-DSZXygMU.js";
 import { i as homeDir } from "./package-discovery-BVvSnQBB.js";
-import { n as buildOAuthTokenRequest, r as parseOAuthTokenResponse, u as hasRequiredOAuthScope } from "./registry-CmKmKHpp.js";
-import { n as pluginCatalogRuntime } from "./catalog-runtime-hKmI-iZa.js";
-import { t as discoverSkills } from "./skills-Dc-AMYi4.js";
-import { Ft as recordAuthorizationCompleted, Pt as recordAuthenticationLinked, X as getTurnRecord, z as postSlackMessage } from "./tasks-dJooqiip.js";
-import { Ht as getSlackClient } from "./agent-hooks-CDVx26Uu.js";
-import { E as acquireActiveLock, w as getStateAdapter } from "./profile-DnkX3e2S.js";
-import { i as getConversationPendingAuth } from "./pending-auth-D2t1Moxf.js";
-import { r as getPersistedThreadState, s as coerceThreadConversationState } from "./thread-state-CsMC-ob0.js";
-import { c as deleteWebAuthorization, f as wakeAuthorizedTurn, i as readConnectedOAuthTokens, p as wakePausedTurn } from "./connections-BC0RTejT.js";
+import { n as buildOAuthTokenRequest, r as parseOAuthTokenResponse, u as hasRequiredOAuthScope } from "./registry-sLTr-sV9.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-CZzhGQ7F.js";
+import { t as discoverSkills } from "./skills-C22SLruK.js";
+import { B as postSlackMessage, Ft as recordAuthenticationLinked, It as recordAuthorizationCompleted, Z as getTurnRecord } from "./tasks-D_WIJtvO.js";
+import { Ht as getSlackClient } from "./agent-hooks-BjtTzvru.js";
+import { E as acquireActiveLock, w as getStateAdapter } from "./profile-h-72wM78.js";
+import { i as getConversationPendingAuth } from "./pending-auth-s_QFribU.js";
+import { r as getPersistedThreadState, s as coerceThreadConversationState } from "./thread-state-Ch4yuCqG.js";
+import { c as deleteWebAuthorization, f as wakeAuthorizedTurn, i as readConnectedOAuthTokens, p as wakePausedTurn } from "./connections-ClYrKzpX.js";
 import { n as relayLocalOAuthCallback } from "./oauth-relay-CdCnu80W.js";
 import path from "node:path";
 import { z } from "zod";
@@ -558,6 +558,57 @@ function oauthTokenErrorAttributes(provider, endpoint, status) {
 function pluginAuthorizationId(args) {
 	return `${args.sessionId}:plugin:${args.provider}`;
 }
+/** Return the Junior user of the person who started the OAuth connection. */
+async function resolveOAuthActorUserId(actor) {
+	if (actor.platform === "web") {
+		const observation = identityFromActor(actor.email ? {
+			email: actor.email,
+			...actor.fullName ? { fullName: actor.fullName } : void 0
+		} : void 0);
+		return observation ? (await upsertIdentity(getSqlExecutor(), observation)).userId : void 0;
+	}
+	const slackUserId = parseSlackUserId(actor.userId);
+	if (!slackUserId) throw new Error("OAuth Slack actor user id is invalid");
+	const profile = await lookupSlackUserProfile(slackUserId);
+	return (await upsertIdentity(getSqlExecutor(), {
+		kind: "user",
+		provider: "slack",
+		providerTenantId: actor.teamId,
+		providerSubjectId: profile.id,
+		displayName: profile.real_name || profile.display_name,
+		handle: profile.name,
+		...profile.email ? {
+			email: profile.email,
+			emailVerified: true
+		} : void 0
+	})).userId;
+}
+/**
+* Link a connected provider account to the person who connected it.
+*
+* The actor's user wins. A provider-verified email that matches exactly one
+* user links the account when the actor has no user, and is saved on the
+* identity when it matches the actor's user.
+*/
+async function linkOAuthAccountIdentity(args) {
+	const executor = getSqlExecutor();
+	const actorUserId = await resolveOAuthActorUserId(args.actor);
+	const emailMatch = await findUserByVerifiedEmails(executor, args.verifiedEmails);
+	const userId = actorUserId ?? emailMatch?.userId;
+	if (!userId) throw new Error("OAuth account has no Junior user to link");
+	const email = emailMatch?.userId === userId ? emailMatch.email : void 0;
+	await upsertLinkedIdentity(executor, userId, {
+		kind: "user",
+		provider: args.provider,
+		providerSubjectId: args.account.id,
+		displayName: args.account.displayName,
+		handle: args.account.handle ?? args.account.label,
+		...email ? {
+			email,
+			emailVerified: true
+		} : void 0
+	});
+}
 /** Queue the pending Turn, including a newer Turn that reused this auth link. */
 async function wakeAuthorizedPluginTurn(stored, options) {
 	if (!stored.resumeConversationId || !stored.resumeSessionId || !stored.destination) return;
@@ -640,8 +691,9 @@ async function GET(request, provider, waitUntil, options) {
 		return htmlErrorResponse("Connection failed", "The token exchange with the provider failed. Please try again.", 500);
 	}
 	let parsedTokenResponse;
+	let tokenData;
 	try {
-		const tokenData = await tokenResponse.json();
+		tokenData = await tokenResponse.json();
 		parsedTokenResponse = parseOAuthTokenResponse(tokenData, requestedScope, { treatEmptyScopeAsUnreported: providerConfig.treatEmptyScopeAsUnreported });
 	} catch {
 		logWarn("oauth.token_exchange.failed", oauthTokenErrorAttributes(provider, providerConfig.tokenEndpoint, tokenResponse.status));
@@ -650,11 +702,18 @@ async function GET(request, provider, waitUntil, options) {
 	if (!hasRequiredOAuthScope(parsedTokenResponse.scope, requestedScope)) return htmlErrorResponse("Connection failed", `The ${providerLabel} authorization did not grant the access Junior requires. Return to Junior and connect your ${providerLabel} account again.`, 400);
 	const userTokenStore = createUserTokenStore();
 	let account;
+	let verifiedEmails = [];
 	try {
-		account = await resolvePluginOAuthAccount({
+		const resolved = await resolvePluginOAuthAccount({
 			provider,
+			tokenResponse: tokenData,
 			tokens: parsedTokenResponse
 		});
+		if (resolved) {
+			const { verifiedEmails: emails, ...rest } = resolved;
+			account = rest;
+			verifiedEmails = emails ?? [];
+		}
 	} catch {
 		return htmlErrorResponse("Connection failed", `Junior could not verify the connected ${providerLabel} account. Please try again.`, 500);
 	}
@@ -662,30 +721,13 @@ async function GET(request, provider, waitUntil, options) {
 		...parsedTokenResponse,
 		...account ? { account } : void 0
 	});
-	const slackActor = stored.actor?.platform === "slack" ? stored.actor : void 0;
-	if (account && slackActor) await runBestEffort(async () => {
-		const slackUserId = parseSlackUserId(slackActor.userId);
-		if (!slackUserId) throw new Error("OAuth Slack actor user id is invalid");
-		const profile = await lookupSlackUserProfile(slackUserId);
-		const slackIdentity = await upsertIdentity(getSqlExecutor(), {
-			kind: "user",
-			provider: "slack",
-			providerTenantId: slackActor.teamId,
-			providerSubjectId: profile.id,
-			displayName: profile.real_name || profile.display_name,
-			handle: profile.name,
-			...profile.email ? {
-				email: profile.email,
-				emailVerified: true
-			} : void 0
-		});
-		if (!slackIdentity.userId) throw new Error("OAuth Slack identity is not linked to a user");
-		await upsertLinkedIdentity(getSqlExecutor(), slackIdentity.userId, {
-			kind: "user",
+	const linkActor = stored.actor;
+	if (account && !isNativeIdentityProvider(provider) && (linkActor?.platform === "slack" || linkActor?.platform === "web")) await runBestEffort(async () => {
+		await linkOAuthAccountIdentity({
+			account,
+			actor: linkActor,
 			provider,
-			providerSubjectId: account.id,
-			displayName: account.displayName,
-			handle: account.handle ?? account.label
+			verifiedEmails
 		});
 	}, "oauth.callback.identity_link.failed", { "app.credential.provider": provider });
 	const resumeConversationId = stored.resumeConversationId;
@@ -813,4 +855,4 @@ async function receiveLocalOAuthCredential(request) {
 	return new Response(null, { status: 204 });
 }
 //#endregion
-export { GET$1 as a, publishAppHomeView as i, syncLocalOAuthCredential as n, GET as r, receiveLocalOAuthCredential as t };
+export { GET$1 as a, publishAppHomeView as i, syncLocalOAuthCredential as n, htmlCallbackResponse as o, GET as r, receiveLocalOAuthCredential as t };

package/dist/{executor-Dh4Ofsnx.js → executor-Do0THDRR.js}

@@ -1,7 +1,7 @@
-import { d as logException } from "./logging-D3aYP0aG.js";
+import { f as logException } from "./logging-CWxiIuCF.js";
 import { g as startSpanManual } from "./sentry-CgWZM_kV.js";
-import "./config-BDAfLTI9.js";
-import { a as juniorAgentInvocations, c as juniorIdentities, d as juniorDestinations, f as timestamptz, i as juniorAgentBindings, l as juniorUsers, s as juniorConversations } from "./agent-invocations-BY60iNw-.js";
+import "./config-CJRnWK9H.js";
+import { a as juniorAgentInvocations, c as juniorIdentities, d as juniorDestinations, f as timestamptz, i as juniorAgentBindings, l as juniorUsers, s as juniorConversations } from "./agent-invocations-Bdu3ROfo.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { sql } from "drizzle-orm";
 import { bigint, boolean, check, date, doublePrecision, foreignKey, index, integer, jsonb, pgTable, primaryKey, text, uniqueIndex, uuid } from "drizzle-orm/pg-core";
@@ -338,6 +338,25 @@ const juniorAutomations = pgTable("junior_automations", {
 	index("junior_automations_match_idx").on(table.namespace, table.identifier, table.createdAtMs, table.id).where(sql`${table.status} <> 'deleted'`)
 ]);
 //#endregion
+//#region src/db/schema/automation-versions.ts
+/** One saved Automation definition. Lifecycle and scheduler state are not versioned. */
+const juniorAutomationVersions = pgTable("junior_automation_versions", {
+	automationId: text("automation_id").notNull(),
+	/** Starts at 1 and increases by 1 for each saved definition change. */
+	version: integer("version").notNull(),
+	createdAtMs: bigint("created_at_ms", { mode: "number" }).notNull(),
+	/** Slack principal that saved this definition. Null when unknown. */
+	editedBy: jsonb("edited_by"),
+	definition: jsonb("definition").notNull()
+}, (table) => [primaryKey({
+	name: "junior_automation_versions_pk",
+	columns: [table.automationId, table.version]
+}), foreignKey({
+	name: "junior_automation_versions_automation_id_fk",
+	columns: [table.automationId],
+	foreignColumns: [juniorAutomations.id]
+}).onDelete("cascade")]);
+//#endregion
 //#region src/db/schema/automation-runs.ts
 /**
 * One dispatch of an Automation, from claim or dispatch to its outcome. A
@@ -345,12 +364,17 @@ const juniorAutomations = pgTable("junior_automations", {
 * automation run id is its dispatch id. Automation code sets
 * `conversation_id` when it dispatches the run. A run that was skipped, or
 * that failed before dispatch, has no Conversation.
+*
+* `automation_version` is the Automation version that the run dispatched. It
+* shows which instruction ran and who saved it after the definition changes.
+* It is null before dispatch, and when no saved version matched.
 */
 const juniorAutomationRuns = pgTable("junior_automation_runs", {
 	id: text("id").primaryKey(),
 	automationId: text("automation_id").notNull().references(() => juniorAutomations.id, { onDelete: "cascade" }),
 	conversationId: text("conversation_id").unique().references(() => juniorConversations.conversationId),
 	status: text("status").$type().notNull(),
+	automationVersion: integer("automation_version"),
 	scheduledForMs: bigint("scheduled_for_ms", { mode: "number" }),
 	attempt: integer("attempt"),
 	claimedAtMs: bigint("claimed_at_ms", { mode: "number" }),
@@ -360,31 +384,17 @@ const juniorAutomationRuns = pgTable("junior_automation_runs", {
 	errorMessage: text("error_message"),
 	resultMessageTs: text("result_message_ts")
 }, (table) => [
+	foreignKey({
+		name: "junior_automation_runs_automation_version_fk",
+		columns: [table.automationId, table.automationVersion],
+		foreignColumns: [juniorAutomationVersions.automationId, juniorAutomationVersions.version]
+	}),
 	check("junior_automation_runs_status_check", sql`${table.status} in ('pending', 'running', 'completed', 'failed', 'blocked', 'skipped')`),
 	index("junior_automation_runs_automation_idx").on(table.automationId, table.completedAtMs),
 	index("junior_automation_runs_completed_idx").on(table.completedAtMs),
 	index("junior_automation_runs_incomplete_idx").on(table.automationId, table.scheduledForMs).where(sql`${table.status} in ('pending', 'running')`)
 ]);
 //#endregion
-//#region src/db/schema/automation-versions.ts
-/** One saved Automation definition. Lifecycle and scheduler state are not versioned. */
-const juniorAutomationVersions = pgTable("junior_automation_versions", {
-	automationId: text("automation_id").notNull(),
-	/** Starts at 1 and increases by 1 for each saved definition change. */
-	version: integer("version").notNull(),
-	createdAtMs: bigint("created_at_ms", { mode: "number" }).notNull(),
-	/** Slack principal that saved this definition. Null when unknown. */
-	editedBy: jsonb("edited_by"),
-	definition: jsonb("definition").notNull()
-}, (table) => [primaryKey({
-	name: "junior_automation_versions_pk",
-	columns: [table.automationId, table.version]
-}), foreignKey({
-	name: "junior_automation_versions_automation_id_fk",
-	columns: [table.automationId],
-	foreignColumns: [juniorAutomations.id]
-}).onDelete("cascade")]);
-//#endregion
 //#region src/db/schema/workspaces.ts
 /** Named recipe used to prepare a reusable Sandbox. */
 const juniorWorkspaces = pgTable("junior_workspaces", {
@@ -1006,4 +1016,4 @@ function createJuniorSqlExecutor(args) {
 	});
 }
 //#endregion
-export { juniorConversationAnnotations as _, juniorAutomationVersions as a, juniorAttachments as b, juniorStats as c, juniorConversationBindings as d, juniorConversationBriefs as f, juniorApiTokens as g, juniorConversationEvents as h, juniorWorkspaces as i, juniorLocationConfigurations as l, juniorConversationMetrics as m, juniorSnapshots as n, juniorAutomationRuns as o, CONVERSATION_METRICS as p, juniorWorkspaceRepos as r, juniorAutomations as s, createJuniorSqlExecutor as t, juniorConversationParticipants as u, juniorCodeChanges as v, juniorArtifacts as x, juniorCodeRepositories as y };
+export { juniorConversationAnnotations as _, juniorAutomationRuns as a, juniorAttachments as b, juniorStats as c, juniorConversationBindings as d, juniorConversationBriefs as f, juniorApiTokens as g, juniorConversationEvents as h, juniorWorkspaces as i, juniorLocationConfigurations as l, juniorConversationMetrics as m, juniorSnapshots as n, juniorAutomationVersions as o, CONVERSATION_METRICS as p, juniorWorkspaceRepos as r, juniorAutomations as s, createJuniorSqlExecutor as t, juniorConversationParticipants as u, juniorCodeChanges as v, juniorArtifacts as x, juniorCodeRepositories as y };

package/dist/{experimental-Qn9rKLgx.js → experimental-CQIvMUO7.js}

@@ -14,6 +14,7 @@ var experimental_exports = /* @__PURE__ */ __exportAll({
 const EXPERIMENTAL_FEATURES = [
 	"operator-tools",
 	"passive-routing",
+	"slack-sign-in",
 	"subagents"
 ];
 const EXPERIMENTAL_FEATURE_SET = new Set(EXPERIMENTAL_FEATURES);

package/dist/{images-C-WOnTc_.js → images-BN_BiBXF.js}

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./rolldown-runtime-B4FMCO8f.js";
-import { D as storeAttachment, T as readLiveAttachment } from "./agent-runner-Caiof09f.js";
-import { f as getSqlExecutor } from "./viewer-Rnim7alE.js";
-import { L as detectImageMediaType } from "./conversation-T18Xlkx9.js";
+import { D as storeAttachment, T as readLiveAttachment } from "./agent-runner-D7OboVb3.js";
+import { p as getSqlExecutor } from "./viewer-DSZXygMU.js";
+import { L as detectImageMediaType } from "./conversation-CKNLYBJt.js";
 //#region src/chat/attachments/images.ts
 var images_exports = /* @__PURE__ */ __exportAll({
 	decodeInputImages: () => decodeInputImages,

package/dist/instrumentation.js

@@ -1,6 +1,6 @@
-import { N as getDeploymentServiceVersion, P as getDeploymentTelemetryAttributes } from "./logging-D3aYP0aG.js";
+import { F as getDeploymentTelemetryAttributes, P as getDeploymentServiceVersion } from "./logging-CWxiIuCF.js";
 import { _ as vercelAIIntegration, a as getClient, b as withStreamedSpan, c as init, o as getGlobalScope } from "./sentry-CgWZM_kV.js";
-import { n as getCurrentConversationPrivacy } from "./conversation-privacy-1ERtieuM.js";
+import { n as getCurrentConversationPrivacy } from "./conversation-privacy-C8b1nphZ.js";
 import { t as consumePrivateTraceResultMarker } from "./private-trace-result-BLvBjy_e.js";
 //#region src/chat/sentry-payload-filter.ts
 const PAYLOAD_ATTRIBUTE_KEYS = /* @__PURE__ */ new Set([

package/dist/{job-queue-BaCL36FY.js → job-queue-B6SV9uVa.js}

@@ -1,4 +1,4 @@
-import { i as getChatConfig } from "./config-BDAfLTI9.js";
+import { i as getChatConfig } from "./config-CJRnWK9H.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { z } from "zod";
 import { createHash, createHmac, timingSafeEqual } from "node:crypto";