@sentry/junior 0.258.0 → 0.259.0

package/dist/api.js

@@ -1,27 +1,30 @@
-import { K as listChildAgents, L as editEventAutomation, Lt as createUserTokenStore, O as parseSlackThreadId, P as editScheduledAutomation, R as AutomationEditError, T as readLiveAttachment, V as resolveTaskOutcomes, bt as conversationSubtreeColumns, g as readStats, ot as getChildAgentLabel, yt as conversationSubtree, z as eventAutomationTriggerAvailable } from "./agent-runner-DGsFQw72.js";
-import { f as logException, m as logWarn, p as logInfo } from "./logging-DsHONhVm.js";
+import { It as createUserTokenStore, K as listChildAgents, L as editEventAutomation, O as parseSlackThreadId, P as editScheduledAutomation, R as AutomationEditError, T as readLiveAttachment, V as resolveTaskOutcomes, bt as conversationSubtreeColumns, g as readStats, ot as getChildAgentLabel, yt as conversationSubtree, z as eventAutomationTriggerAvailable } from "./agent-runner-CPSd7rKm.js";
+import { p as escapeXml } from "./client-BZdxgKyL.js";
+import { f as logException, m as logWarn, p as logInfo } from "./logging-BStXN56b.js";
 import { d as parseSlackTeamId, g as parseSlackMessageTs, l as parseSlackChannelId } from "./actor-tlxzqaRe.js";
-import { C as addAgentTurnUsage, D as hasAgentTurnUsage, E as agentTurnUsageSchema, O as resolveRootConversationId, S as parseSessionSource, c as getConversationEventStore, d as getDb, f as getSqlExecutor, h as loadConversationSlackTenantId, i as resolveViewerUser, m as withConversationEventLock, o as updateViewerDisplayName, t as findUserByEmail, u as getConversationStore, v as locationFromRow } from "./viewer-CGvvRqKp.js";
+import { C as addAgentTurnUsage, D as hasAgentTurnUsage, E as agentTurnUsageSchema, O as resolveRootConversationId, S as parseSessionSource, c as getConversationEventStore, d as getDb, f as getSqlExecutor, h as loadConversationSlackTenantId, i as resolveViewerUser, m as withConversationEventLock, o as updateViewerDisplayName, t as findUserByEmail, u as getConversationStore, v as locationFromRow } from "./viewer-B2_ABsYi.js";
 import { c as juniorIdentities, d as juniorDestinations, l as juniorUsers, o as conversationReadColumns, s as juniorConversations } from "./agent-invocations-Qfz7dWgU.js";
-import { f as juniorConversationBriefs, g as juniorApiTokens, h as juniorConversationEvents, m as juniorConversationMetrics, u as juniorConversationParticipants, v as juniorCodeChanges, y as juniorCodeRepositories } from "./executor-RvG6kVe1.js";
+import { f as juniorConversationBriefs, g as juniorApiTokens, h as juniorConversationEvents, m as juniorConversationMetrics, u as juniorConversationParticipants, v as juniorCodeChanges, y as juniorCodeRepositories } from "./executor-Bb3eQb8q.js";
 import { d as contextProvenance } from "./history-AY8rs-FR.js";
-import { At as loadTurnProjection, D as AutomationConflictError, E as sameDefinitionValue, O as automationRevision, S as automationDefinition, T as readAutomationVersion, a as saveScheduledAutomation, k as requireAutomationRevision, pn as piMessageFromHistoryItem, v as saveEventAutomation, y as setEventAutomationStatus } from "./tasks-CEXKTASS.js";
-import { C as WorkspaceValidationError, Ct as readLatestConversationBrief, Ht as getSlackClient, Lt as lookupSlackUser, M as workspaceRepoCheckoutPath, Nt as listConversationAnnotations, O as SANDBOX_RUNTIME, Pt as listConversationAnnotationsById, S as updateWorkspace, Tt as buildSentryConversationUrl, _ as deleteWorkspace, _t as conversationHasParticipantEmail, b as listWorkspaces, bt as conversationNotArchivedForUser, ft as createPluginLogger, g as createWorkspace, gt as conversationArchivedForUser, ht as conversationArchivedForEmail, mt as conversationArchiveTimes, pt as readConversationAccessFromSql, qt as withSlackRetries, u as getPlugins, v as getWorkspace, vt as conversationHasParticipantUser, wt as readConversationEventPage, x as listWorkspacesByRepository, xt as viewerConversationMembership, yt as conversationNotArchivedForEmail } from "./agent-hooks-BJ_5mlRH.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-B8SuFPGb.js";
+import { At as loadTurnProjection, D as AutomationConflictError, E as sameDefinitionValue, O as automationRevision, S as automationDefinition, T as readAutomationVersion, a as saveScheduledAutomation, k as requireAutomationRevision, pn as piMessageFromHistoryItem, v as saveEventAutomation, y as setEventAutomationStatus } from "./tasks-DieKX3d4.js";
+import { C as WorkspaceValidationError, Ct as readLatestConversationBrief, Ht as getSlackClient, Lt as lookupSlackUser, M as workspaceRepoCheckoutPath, Nt as listConversationAnnotations, O as SANDBOX_RUNTIME, Pt as listConversationAnnotationsById, S as updateWorkspace, Tt as buildSentryConversationUrl, _ as deleteWorkspace, _t as conversationHasParticipantEmail, b as listWorkspaces, bt as conversationNotArchivedForUser, ft as createPluginLogger, g as createWorkspace, gt as conversationArchivedForUser, ht as conversationArchivedForEmail, mt as conversationArchiveTimes, pt as readConversationAccessFromSql, qt as withSlackRetries, u as getPlugins, v as getWorkspace, vt as conversationHasParticipantUser, wt as readConversationEventPage, x as listWorkspacesByRepository, xt as viewerConversationMembership, yt as conversationNotArchivedForEmail } from "./agent-hooks-B00FaKdP.js";
 import { A as forkConversationBodySchema, F as readMessageAttachments, I as INPUT_IMAGE_TYPES, O as createConversationBodySchema, T as conversationStatsReportSchema, _ as conversationParamsSchema, a as cancelConversationPendingMessagesBodySchema, c as conversationAttachmentParamsSchema, d as conversationDetailReportSchema, g as conversationFeedSchema, h as conversationFeedQuerySchema, i as archiveConversationResponseSchema, j as forkConversationResponseSchema, k as createConversationMessageBodySchema, m as conversationEventsQuerySchema, o as cancelConversationPendingMessagesResponseSchema, p as conversationEventPageSchema, r as archiveConversationBodySchema, t as acceptedConversationMessageSchema, u as conversationDetailQuerySchema, x as conversationPendingMessagesReportSchema } from "./conversation-DjN3mlog.js";
-import { n as hash, t as create } from "./profile-DpYjfKke.js";
-import { l as getEventCatalog, y as automationEventCatalog } from "./session-stop-CIoFiwwe.js";
+import { n as hash, t as create } from "./profile-qBM6B_-V.js";
+import { l as getEventCatalog, y as automationEventCatalog } from "./session-stop-CV65ZlU3.js";
 import { t as getFirstRunAtMs } from "./cadence-R7Em4RjE.js";
-import { t as getCachedSnapshot } from "./resolve-ClCIgh8E.js";
-import { a as getVercelConversationWorkQueue } from "./job-queue-DVe37it2.js";
-import { a as cancelHumanFacingPendingMessages, h as getConversation } from "./store-DJLwq4x8.js";
+import { t as getCachedSnapshot } from "./resolve-BzpuLh8c.js";
+import { a as getVercelConversationWorkQueue } from "./job-queue-vdGU-5ge.js";
+import { a as cancelHumanFacingPendingMessages, h as getConversation } from "./store-B1GES4gC.js";
+import { n as finishServiceAccountSignIn, o as serviceAccountPlugins, r as getServiceAccountStatus, s as startServiceAccountSignIn, t as disconnectServiceAccount } from "./service-account-BzhW7kXu.js";
 import { M as compileScheduleIntent, P as weekdaySchema, _ as automationSummarySchema, b as automationVersionListSchema, c as automationLifecycleSchema, d as automationParamsSchema, f as automationRunListSchema, g as automationSchedulePreviewSchema, h as automationScheduleIntentSchema, i as automationExecutionListSchema, j as ScheduleIntentError, l as automationListQuerySchema, n as automationEditSchema, r as automationEventCatalogSchema, t as automationEditErrorSchema, u as automationListSchema, v as automationUpdateSchema, x as automationVersionParamsSchema, y as automationVersionActivateSchema } from "./automation-DWBFBenG.js";
 import { C as skillReportsSchema, a as fillUtcHours, b as pluginsSchema, c as sumUtcHoursIntoSixHours, d as trailingUtcSixHourWindow, f as utcDayKey, h as pluginOperationalReportFeedSchema, i as fillUtcDays, l as trailingUtcDayWindow, m as healthReportSchema, n as DAY_MS$1, o as fillUtcSixHours, p as utcHourKey, r as HOUR_MS$1, s as startOfUtcHour, u as trailingUtcHourWindow, x as runtimeInfoReportSchema } from "./web-message-id-CJSUiksE.js";
-import { B as readHealthReport, I as createVercelAttachmentStorage, _ as readViewerAutomationRuns, a as recordWebConversationActivity, b as readViewerAutomations, d as resolveSlackConversationContextFromThreadId, g as readViewerAutomationExecutions, h as readConversationSourceTask, i as createConversationId, k as stopConversationTurn, l as getProductionSlackAdapter, m as deleteViewerTask, o as webActorFromEmail, p as ViewerTaskNotFoundError, r as createAndEnqueueConversation, t as appendAndEnqueueWebMessage, u as formatSlackConversationRedactedLabel, v as readViewerAutomationSummary, w as clearSlackPendingReactions, x as resolveViewerTaskCandidate, y as readViewerAutomationVersions } from "./web-input-Keb5GRWj.js";
-import { F as conversationAggregateColumns, I as conversationRangeColumns, M as readAutomationTitlesByConversationId, P as conversationActiveDaysColumn } from "./task-runner-D3qJh4fK.js";
-import { d as legacyWebMailboxMetadataSchema } from "./result-BBbKA61B.js";
-import { a as startConnection, l as getWebAuthorization, n as isConnectableProvider, r as listConnections, t as disconnectConnection } from "./connections-ag_1JOhB.js";
-import { t as decodeInputImages } from "./images-C2J_bj2g.js";
-import { C as locationParamsSchema, E as activitySixHours$1, H as conversationChildAgentsReportSchema, I as codeOverviewReportSchema, L as codePersonReportSchema, M as startConnectionResponseSchema, O as connectionListSchema, R as codeRepositoryParamsSchema, S as locationDirectoryReportSchema, T as activityHours$1, U as stopConversationTurnResponseSchema, W as apiErrorSchema, _ as actorProfileReportSchema, a as workspaceBodySchema, d as createdPersonalTokenSchema, f as personalTokenListSchema, g as actorDirectoryReportSchema, h as revokePersonalTokenResponseSchema, i as deleteWorkspaceResponseSchema, j as disconnectConnectionResponseSchema, k as connectionParamsSchema, l as workspaceSchema, m as personalTokenParamsSchema, n as statsReportSchema, o as workspaceListSchema, s as workspaceParamsSchema, u as createPersonalTokenBodySchema, v as personParamsSchema, w as activityDays$1, x as locationDetailReportSchema, y as personalSpendReportSchema, z as codeRepositoryReportSchema } from "./schema-DrMh3NtR.js";
+import { B as readHealthReport, I as createVercelAttachmentStorage, _ as readViewerAutomationRuns, a as recordWebConversationActivity, b as readViewerAutomations, d as resolveSlackConversationContextFromThreadId, g as readViewerAutomationExecutions, h as readConversationSourceTask, i as createConversationId, k as stopConversationTurn, l as getProductionSlackAdapter, m as deleteViewerTask, o as webActorFromEmail, p as ViewerTaskNotFoundError, r as createAndEnqueueConversation, t as appendAndEnqueueWebMessage, u as formatSlackConversationRedactedLabel, v as readViewerAutomationSummary, w as clearSlackPendingReactions, x as resolveViewerTaskCandidate, y as readViewerAutomationVersions } from "./web-input-BZDyxpzR.js";
+import { F as conversationAggregateColumns, I as conversationRangeColumns, M as readAutomationTitlesByConversationId, P as conversationActiveDaysColumn } from "./task-runner-BlGhcQPi.js";
+import { d as legacyWebMailboxMetadataSchema } from "./result-DEZH_AnZ.js";
+import { a as startConnection, l as getWebAuthorization, n as isConnectableProvider, r as listConnections, t as disconnectConnection, u as htmlCallbackResponse } from "./connections-9gJkfS85.js";
+import { t as decodeInputImages } from "./images-BbSdVHC6.js";
+import { A as activityHours$1, C as personParamsSchema, D as locationDirectoryReportSchema, E as locationDetailReportSchema, H as codePersonReportSchema, I as disconnectConnectionResponseSchema, J as stopConversationTurnResponseSchema, L as startConnectionResponseSchema, N as connectionListSchema, O as locationParamsSchema, P as connectionParamsSchema, S as actorProfileReportSchema, U as codeRepositoryParamsSchema, V as codeOverviewReportSchema, W as codeRepositoryReportSchema, Y as apiErrorSchema, _ as personalTokenListSchema, a as workspaceBodySchema, b as revokePersonalTokenResponseSchema, d as serviceAccountListSchema, f as serviceAccountParamsSchema, g as createdPersonalTokenSchema, h as createPersonalTokenBodySchema, i as deleteWorkspaceResponseSchema, j as activitySixHours$1, k as activityDays$1, l as workspaceSchema, m as startServiceAccountSignInResponseSchema, n as statsReportSchema, o as workspaceListSchema, q as conversationChildAgentsReportSchema, s as workspaceParamsSchema, u as disconnectServiceAccountResponseSchema, w as personalSpendReportSchema, x as actorDirectoryReportSchema, y as personalTokenParamsSchema } from "./schema-CF9HqNRY.js";
 import { Hono } from "hono";
 import path from "node:path";
 import { z } from "zod";
@@ -75,6 +78,13 @@ const requireViewer = createMiddleware(async (context, next) => {
 	if (!context.get("viewer")) throwApiError(401, "Authentication required.");
 	await next();
 });
+/** Require a Junior admin viewer. */
+const requireAdmin = createMiddleware(async (context, next) => {
+	const viewer = context.get("viewer");
+	if (!viewer) throwApiError(401, "Authentication required.");
+	if (viewer.isAdmin !== true) throwApiError(403, "Only Junior admins can do this.");
+	await next();
+});
 // src/api/conversations/archive.ts
 async function setViewerArchive(args) {
 	const executor = getSqlExecutor();
@@ -3633,7 +3643,7 @@ async function readPeoplePluginReports(args) {
 		reports: [],
 		source: "plugins"
 	});
-	const { getPluginProfileReports } = await import("./agent-hooks-BJ_5mlRH.js").then((n) => n.t);
+	const { getPluginProfileReports } = await import("./agent-hooks-B00FaKdP.js").then((n) => n.t);
 	return pluginOperationalReportFeedSchema.parse({
 		generatedAt: new Date(nowMs).toISOString(),
 		reports: await getPluginProfileReports({
@@ -4011,6 +4021,66 @@ function createPersonalTokenRoutes() {
 	});
 	return app;
 }
+// src/api/service-accounts/routes.ts
+/**
+* Public URL of the OAuth callback for one plugin's service account.
+*
+* It uses the request origin unless `JUNIOR_BASE_URL` is set, so the
+* provider sends the Admin back to the dashboard session that started it.
+*/
+function callbackUrl(request, provider) {
+	const base = process.env.JUNIOR_BASE_URL?.trim() || new URL(request.url).origin;
+	return new URL(`api/service-accounts/${encodeURIComponent(provider)}/callback`, base.endsWith("/") ? base : `${base}/`).toString();
+}
+function requirePlugin(provider) {
+	const plugin = pluginCatalogRuntime.getDefinition(provider);
+	if (!plugin?.manifest.accounts?.serviceAccount) throwApiError(404, "Service account not found.");
+	return plugin;
+}
+function callbackPage(title, message, status) {
+	return htmlCallbackResponse(escapeXml(title), escapeXml(message), status, { footerMessage: "You can close this tab and return to the dashboard." });
+}
+/**
+* Create admin-only routes that list, connect, and disconnect plugin service
+* accounts.
+*
+* Whoever signs in decides which account everyone falls back to, so every
+* route, including the OAuth callback, requires a Junior admin. The callback
+* also accepts only a sign-in that the same Admin started.
+*/
+function createServiceAccountRoutes() {
+	const app = new Hono();
+	app.get("/", requireAdmin, async () => jsonResponse(serviceAccountListSchema, { serviceAccounts: await Promise.all(serviceAccountPlugins(pluginCatalogRuntime.getProviders()).map(getServiceAccountStatus)) }));
+	app.post("/:provider", requireAdmin, validateRequest("param", serviceAccountParamsSchema, "Invalid provider."), async (context) => {
+		const { provider } = context.req.valid("param");
+		const { authorizationUrl } = await startServiceAccountSignIn({
+			plugin: requirePlugin(provider),
+			redirectUrl: callbackUrl(context.req.raw, provider),
+			startedBy: context.get("viewer").email
+		});
+		return jsonResponse(startServiceAccountSignInResponseSchema, { authorizationUrl: authorizationUrl.toString() });
+	});
+	app.get("/:provider/callback", requireAdmin, validateRequest("param", serviceAccountParamsSchema, "Invalid provider."), async (context) => {
+		const { provider } = context.req.valid("param");
+		const plugin = requirePlugin(provider);
+		const viewer = context.get("viewer");
+		const result = await finishServiceAccountSignIn({
+			callback: new URL(context.req.url).searchParams,
+			connectedBy: viewer.email,
+			plugin
+		});
+		if (!result.ok) return callbackPage("Connection failed", result.message, 400);
+		logInfo("dashboard.service_account.connected", { "app.credential.provider": provider });
+		return callbackPage(`${plugin.manifest.displayName} service account connected`, `People who have not connected ${plugin.manifest.displayName} now use this account for what its policy allows.`, 200);
+	});
+	app.delete("/:provider", requireAdmin, validateRequest("param", serviceAccountParamsSchema, "Invalid provider."), async (context) => {
+		const { provider } = context.req.valid("param");
+		await disconnectServiceAccount(requirePlugin(provider));
+		logInfo("dashboard.service_account.disconnected", { "app.credential.provider": provider });
+		return jsonResponse(disconnectServiceAccountResponseSchema, { disconnected: true });
+	});
+	return app;
+}
 // src/chat/plugins/user-pages.ts
 /**
 * Runtime ownership for plugin user pages.
@@ -4581,7 +4651,7 @@ function readDescriptionText(home) {
 }
 /** Read discovered skill names for authenticated runtime diagnostics. */
 async function readSkillReports() {
-	const { discoverSkills } = await import("./skills-DyQBLIrK.js").then((n) => n.o);
+	const { discoverSkills } = await import("./skills-CiWS5_Ub.js").then((n) => n.o);
 	const skills = await discoverSkills();
 	return skillReportsSchema.parse(skills.map((skill) => ({
 		name: skill.name,
@@ -4590,7 +4660,7 @@ async function readSkillReports() {
 }
 /** Read safe configured plugin metadata for authenticated runtime diagnostics. */
 async function readPlugins() {
-	const { pluginCatalogRuntime } = await import("./catalog-runtime-BN4DVxco.js").then((n) => n.t);
+	const { pluginCatalogRuntime } = await import("./catalog-runtime-B8SuFPGb.js").then((n) => n.t);
 	return pluginsSchema.parse(pluginCatalogRuntime.getProviders().map((plugin) => ({
 		configKeys: plugin.manifest.configKeys ?? [],
 		description: plugin.manifest.description,
@@ -4602,7 +4672,7 @@ async function readPlugins() {
 async function readRuntimeInfoReport() {
 	const [{ homeDir }, { pluginCatalogRuntime }, plugins, skills] = await Promise.all([
 		import("./package-discovery-DJBompdd.js").then((n) => n.r),
-		import("./catalog-runtime-BN4DVxco.js").then((n) => n.t),
+		import("./catalog-runtime-B8SuFPGb.js").then((n) => n.t),
 		readPlugins(),
 		readSkillReports()
 	]);
@@ -4619,7 +4689,7 @@ async function readRuntimeInfoReport() {
 /** Read sanitized operational summaries contributed by plugins. */
 async function readPluginOperationalReportFeed() {
 	const nowMs = Date.now();
-	const { getPluginOperationalReports } = await import("./agent-hooks-BJ_5mlRH.js").then((n) => n.t);
+	const { getPluginOperationalReports } = await import("./agent-hooks-B00FaKdP.js").then((n) => n.t);
 	return pluginOperationalReportFeedSchema.parse({
 		source: "plugins",
 		generatedAt: new Date(nowMs).toISOString(),
@@ -4643,6 +4713,7 @@ function createJuniorApi(options = {}) {
 	app.route("/api/code", createCodeRoutes());
 	app.route("/api/connections", createConnectionRoutes());
 	app.route("/api/personal-tokens", createPersonalTokenRoutes());
+	app.route("/api/service-accounts", createServiceAccountRoutes());
 	app.route("/api/people", createPeopleRoutes());
 	app.route("/api/locations", createLocationRoutes());
 	app.route("/api/user-pages", createUserPageRoutes());

package/dist/{app-PX2H1PxU.d.ts → app-Bbxrehjf.d.ts}

@@ -1,18 +1,19 @@
 import { n as ConversationWorkQueue, t as ConversationQueueMessage } from "./queue-C37RbDVc.js";
 import { t as ConversationStore } from "./store-CG0VJyye.js";
 import "./history-BgI33Kie.js";
-import { n as JuniorPluginSet } from "./plugins-B11Mfkmv.js";
+import { n as JuniorPluginSet } from "./plugins-B_0Cr0MO.js";
 import { Hono } from "hono";
 import "@earendil-works/pi-ai/compat";
 import "@earendil-works/pi-ai/api/anthropic-messages";
+import "ai";
 import { z } from "zod";
 import { Destination, OwnedObjectAnnotation, PluginRegistration, Source, User } from "@sentry/junior-plugin-api";
 import "@earendil-works/pi-agent-core";
 import "@earendil-works/pi-ai";
 import "@sinclair/typebox";
 import { Sandbox } from "@vercel/sandbox";
-import { Client } from "@modelcontextprotocol/sdk/client";
 import "@modelcontextprotocol/sdk/client/auth.js";
+import { Client } from "@modelcontextprotocol/sdk/client";
 import { Message, StateAdapter } from "chat";
 import "@chat-adapter/slack";
 declare const TURN_REASONING_LEVELS: readonly ["none", "low", "medium", "high", "xhigh"];
@@ -31,6 +32,8 @@ interface ModelProfileConfig {
 /** App-level profile input: a model id string or a full profile config. */
 type ModelProfileInput = string | ModelProfileConfig;
 interface BotModelConfig {
+  /** Decision model used by the passive reply router. */
+  decisionModelId?: string;
   /** Model used for embeddings. */
   embeddingModelId?: string;
   /** Model used for low-cost structured and utility calls. */

package/dist/app.d.ts

@@ -1,4 +1,4 @@
-import { i as ModelProfileInput, n as createApp, r as JuniorDashboardOptions, t as JuniorAppOptions } from "./app-PX2H1PxU.js";
-import { i as defineJuniorPlugins, n as JuniorPluginSet, r as JuniorPluginSetOptions, t as JuniorPluginInput } from "./plugins-B11Mfkmv.js";
+import { i as ModelProfileInput, n as createApp, r as JuniorDashboardOptions, t as JuniorAppOptions } from "./app-Bbxrehjf.js";
+import { i as defineJuniorPlugins, n as JuniorPluginSet, r as JuniorPluginSetOptions, t as JuniorPluginInput } from "./plugins-B_0Cr0MO.js";
 import { t as JUNIOR_VERSION } from "./version-Cc2OFd9G.js";
 export { JUNIOR_VERSION, JuniorAppOptions, type JuniorDashboardOptions, type JuniorPluginInput, type JuniorPluginSet, type JuniorPluginSetOptions, type ModelProfileInput, createApp, defineJuniorPlugins };

package/dist/app.js

@@ -1,39 +1,39 @@
-import { At as consumeSandboxEgressPermissionDeniedSignal, B as effectiveTaskOutcomes, Ct as ingestEvent, Dt as SANDBOX_EGRESS_PROXY_PATH, E as requestAttachmentDeletion, Et as shouldPropagateSandboxEgressTrace, F as logScheduledAutomationRunSkipped, Ft as resolveBaseUrl, I as scheduledAutomationRunAttributes, It as startOAuthFlow, Kt as getConfigDefaults, Lt as createUserTokenStore, Nt as formatProviderLabel, O as parseSlackThreadId, Ot as clearSandboxEgressSignals, St as processWorkspaceSnapshotJob, Tt as normalizeSandboxEgressTracePropagationDomains, U as stopConversationSession, W as recordSubagentEnded, b as unpublishedArtifactHeaders, i as executeCredentialedEgressRequest, jt as parseSandboxEgressCredentialToken, kt as consumeSandboxEgressAuthRequiredSignal, lt as listPendingAgentInvocationMailboxAppends, n as executeAgentRun, qt as setConfigDefaults, t as createAgentRunner, ut as listPendingAgentInvocationResults, v as publicArtifactHeaders, w as collectAttachmentGarbage, wt as resolveSandboxEgressProviderForHost, x as lookupSlackUserProfile, y as readPublicArtifact } from "./agent-runner-DGsFQw72.js";
-import { C as withContext, M as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, R as normalizeIdentityEmail, T as withSpan, b as setSpanStatus, f as logException, k as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE, m as logWarn, p as logInfo, r as createRequestContext, v as setSentryUser, w as withLogContext, y as setSpanAttributes } from "./logging-DsHONhVm.js";
+import { At as parseSandboxEgressCredentialToken, B as effectiveTaskOutcomes, Ct as resolveSandboxEgressProviderForHost, Dt as clearSandboxEgressSignals, E as requestAttachmentDeletion, Et as SANDBOX_EGRESS_PROXY_PATH, F as logScheduledAutomationRunSkipped, Ft as startOAuthFlow, Gt as getConfigDefaults, I as scheduledAutomationRunAttributes, It as createUserTokenStore, Kt as setConfigDefaults, Mt as formatProviderLabel, O as parseSlackThreadId, Ot as consumeSandboxEgressAuthRequiredSignal, Pt as resolveBaseUrl, St as ingestEvent, Tt as shouldPropagateSandboxEgressTrace, U as stopConversationSession, W as recordSubagentEnded, b as unpublishedArtifactHeaders, i as executeCredentialedEgressRequest, kt as consumeSandboxEgressPermissionDeniedSignal, lt as listPendingAgentInvocationMailboxAppends, n as executeAgentRun, t as createAgentRunner, ut as listPendingAgentInvocationResults, v as publicArtifactHeaders, w as collectAttachmentGarbage, wt as normalizeSandboxEgressTracePropagationDomains, x as lookupSlackUserProfile, xt as processWorkspaceSnapshotJob, y as readPublicArtifact } from "./agent-runner-CPSd7rKm.js";
+import { C as withContext, M as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, R as normalizeIdentityEmail, T as withSpan, b as setSpanStatus, f as logException, k as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE, m as logWarn, p as logInfo, r as createRequestContext, v as setSentryUser, w as withLogContext, y as setSpanAttributes } from "./logging-BStXN56b.js";
 import { n as captureMessage, r as continueTrace } from "./sentry-BBUlHih9.js";
-import { t as JUNIOR_VERSION } from "./version-C0U6rHg0.js";
-import { _ as snapshotRuntimeConfig, d as restoreRuntimeConfig, f as setBotModelConfig, g as setSlackReactionConfig, h as setRuntimeLimits, i as getChatConfig, m as setProfiles, n as botConfig, o as getSlackBotToken, p as setCrossActorMidRunMode, u as resetRuntimeConfig } from "./config-_WO_AjCB.js";
+import { t as JUNIOR_VERSION } from "./version-B_XumRx-.js";
+import { _ as snapshotRuntimeConfig, d as restoreRuntimeConfig, f as setBotModelConfig, g as setSlackReactionConfig, h as setRuntimeLimits, i as getChatConfig, m as setProfiles, n as botConfig, o as getSlackBotToken, p as setCrossActorMidRunMode, u as resetRuntimeConfig } from "./config-Deqpfpg9.js";
 import { _ as slackMessageTsSchema, d as parseSlackTeamId, f as parseSlackUserId, h as slackUserIdSchema, m as slackTeamIdSchema, o as parseActorUserId, p as slackChannelIdSchema } from "./actor-tlxzqaRe.js";
-import { N as recordGoogleSignIn, _ as withConversationMutationLock, c as getConversationEventStore, d as getDb, f as getSqlExecutor, m as withConversationEventLock, r as readActorIdentity, u as getConversationStore } from "./viewer-CGvvRqKp.js";
+import { N as recordGoogleSignIn, _ as withConversationMutationLock, c as getConversationEventStore, d as getDb, f as getSqlExecutor, m as withConversationEventLock, r as readActorIdentity, u as getConversationStore } from "./viewer-B2_ABsYi.js";
 import { a as juniorAgentInvocations, d as juniorDestinations, i as juniorAgentBindings, s as juniorConversations } from "./agent-invocations-Qfz7dWgU.js";
-import { a as juniorAutomationRuns, f as juniorConversationBriefs, h as juniorConversationEvents, s as juniorAutomations } from "./executor-RvG6kVe1.js";
-import { m as credentialLogContext } from "./registry-Du566MtJ.js";
-import { n as pluginCatalogRuntime } from "./catalog-runtime-BN4DVxco.js";
-import { C as automationVersionOf, Kt as projectConversationMessages, P as slackMention, U as slackEntitySchema, Ut as appendConversationMessages, W as slackExternalRefIdSchema, Yt as settleConversationTitleWork, b as admitEventAutomationRun, c as withScheduledAutomationLock, i as readScheduledAutomation, l as blockEventAutomation, n as listScheduledAutomationsForTeam, o as saveScheduledAutomationInLock, p as findMatchingEventAutomations, s as scheduledRunId, u as collectEventAutomationMatchKeys, x as eventAutomationRunLimitReason } from "./tasks-CEXKTASS.js";
-import { $ as bindSlackDirectCredentialSubject, At as resolveRootVisibility, Ht as getSlackClient, Jt as getWorkspaceTeamId, Nt as listConversationAnnotations, Q as bindScheduledAutomationCredentialSubject, U as collectEventMatchKeys, Wt as isDmChannel, X as takeDueTimerWatches, Yt as runWithWorkspaceTeamId, Z as bindEventAutomationCredentialSubject, a as getPluginRoutes, at as getDashboardConversationLink, ct as setDashboardConversationLinkOptions, d as setPlugins, et as verifyEventAutomationCredentialSubject, f as validatePlugins, ft as createPluginLogger, h as setBriefsConfig, i as getPluginApiRoutes, lt as createPluginState, nt as verifySlackDirectCredentialSubject, pt as readConversationAccessFromSql, q as findMatchingWatches, st as getDashboardTaskLink, tt as verifyScheduledAutomationCredentialSubject, u as getPlugins } from "./agent-hooks-BJ_5mlRH.js";
+import { a as juniorAutomationRuns, f as juniorConversationBriefs, h as juniorConversationEvents, s as juniorAutomations } from "./executor-Bb3eQb8q.js";
+import { m as credentialLogContext } from "./registry-B_M_x_iS.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-B8SuFPGb.js";
+import { C as automationVersionOf, Kt as projectConversationMessages, P as slackMention, U as slackEntitySchema, Ut as appendConversationMessages, W as slackExternalRefIdSchema, Yt as settleConversationTitleWork, b as admitEventAutomationRun, c as withScheduledAutomationLock, i as readScheduledAutomation, l as blockEventAutomation, n as listScheduledAutomationsForTeam, o as saveScheduledAutomationInLock, p as findMatchingEventAutomations, s as scheduledRunId, u as collectEventAutomationMatchKeys, x as eventAutomationRunLimitReason } from "./tasks-DieKX3d4.js";
+import { $ as bindSlackDirectCredentialSubject, At as resolveRootVisibility, Ht as getSlackClient, Jt as getWorkspaceTeamId, Nt as listConversationAnnotations, Q as bindScheduledAutomationCredentialSubject, U as collectEventMatchKeys, Wt as isDmChannel, X as takeDueTimerWatches, Yt as runWithWorkspaceTeamId, Z as bindEventAutomationCredentialSubject, a as getPluginRoutes, at as getDashboardConversationLink, ct as setDashboardConversationLinkOptions, d as setPlugins, et as verifyEventAutomationCredentialSubject, f as validatePlugins, ft as createPluginLogger, h as setBriefsConfig, i as getPluginApiRoutes, lt as createPluginState, nt as verifySlackDirectCredentialSubject, pt as readConversationAccessFromSql, q as findMatchingWatches, st as getDashboardTaskLink, tt as verifyScheduledAutomationCredentialSubject, u as getPlugins } from "./agent-hooks-B00FaKdP.js";
 import { W as annotationCard } from "./conversation-DjN3mlog.js";
-import { O as withLock$1, w as getStateAdapter } from "./profile-DpYjfKke.js";
-import { l as getThreadStopDecision, o as SubscribedReplyReason } from "./pending-auth-D8J1uJUS.js";
-import { b as eventGuidance, f as slackChannelMessageEvent, k as renderTaskInput, l as getEventCatalog, m as slackChannelMessageRunsAutomation, p as slackChannelMessageReplyThreadTs, u as SLACK_EVENT_NAMESPACE } from "./session-stop-CIoFiwwe.js";
+import { l as getThreadStopDecision, o as SubscribedReplyReason } from "./pending-auth-rG5U_QS1.js";
+import { b as eventGuidance, f as slackChannelMessageEvent, k as renderTaskInput, l as getEventCatalog, m as slackChannelMessageRunsAutomation, p as slackChannelMessageReplyThreadTs, u as SLACK_EVENT_NAMESPACE } from "./session-stop-CV65ZlU3.js";
+import { r as getStateAdapter, s as withLock$1 } from "./adapter-Bn0gFVSF.js";
 import { n as getNextRunAtMs } from "./cadence-R7Em4RjE.js";
-import { f as setSandboxResourceConfig, u as getSandboxResourceConfig } from "./resolve-ClCIgh8E.js";
-import { a as getVercelConversationWorkQueue, g as isConversationQueueMessageRejectedError, h as conversationQueueMessageSchema, i as verifyWorkspaceSnapshotJobMessage, o as resolveConversationWorkQueueTopic, s as verifyConversationQueueMessage, t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-DVe37it2.js";
-import { A as hasRunnableConversationWork$1, M as isInvalidConversationRecordError, O as CONVERSATION_WORK_STALE_ENQUEUE_MS, S as removeActiveConversation, _ as hasRunnableConversationWork, c as clearExpiredConversationLease, g as getConversationWorkState, h as getConversation, m as ensureConversationWake, r as appendAndEnqueueInboundMessage, v as listActiveConversationIds } from "./store-DJLwq4x8.js";
+import { f as setSandboxResourceConfig, u as getSandboxResourceConfig } from "./resolve-BzpuLh8c.js";
+import { a as getVercelConversationWorkQueue, g as isConversationQueueMessageRejectedError, h as conversationQueueMessageSchema, i as verifyWorkspaceSnapshotJobMessage, o as resolveConversationWorkQueueTopic, s as verifyConversationQueueMessage, t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-vdGU-5ge.js";
+import { A as hasRunnableConversationWork$1, M as isInvalidConversationRecordError, O as CONVERSATION_WORK_STALE_ENQUEUE_MS, S as removeActiveConversation, _ as hasRunnableConversationWork, c as clearExpiredConversationLease, g as getConversationWorkState, h as getConversation, m as ensureConversationWake, r as appendAndEnqueueInboundMessage, v as listActiveConversationIds } from "./store-B1GES4gC.js";
 import { D as scheduledRunSchema } from "./automation-DWBFBenG.js";
 import { i as setExperimentalFeatures, n as getExperimentalFeatures, r as isExperimentalFeatureEnabled } from "./experimental-BNK1l1jv.js";
-import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "./validation-BHRxa5G4.js";
+import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "./validation-23d7K9tX.js";
 import { a as pluginRuntimeRegistrationsFromPluginSet, n as pluginCatalogConfigFromEnv, r as pluginCatalogConfigFromPluginSet, t as defineJuniorPlugins } from "./plugins-DOm9Y6qI.js";
-import { A as THREAD_OPTOUT_ACK, C as buildSlackInboundMessage, D as normalizeIncomingSlackThreadId, E as stopSlackThread, F as renderSlackObjectCard, I as createVercelAttachmentStorage, M as parseContent, N as runWithSlackInstallation, O as withNormalizedThreadId, P as verifySlackSignature, R as enqueueAgentDispatch, S as recordSkippedConversationMessage, T as isSlackMessageStopped, a as recordWebConversationActivity, c as createProductionSlackWebhookServices, f as createSlackWebApiStatusSender, j as startProcessingReaction, k as stopConversationTurn, l as getProductionSlackAdapter, n as conversationTurnIdForMessage, o as webActorFromEmail, s as createProductionConversationWorkOptions, t as appendAndEnqueueWebMessage, v as readViewerAutomationSummary, w as clearSlackPendingReactions, z as GET$3 } from "./web-input-Keb5GRWj.js";
-import { C as existingConversationId, N as recordAutomationExecution, c as getDispatchConversationId, d as getDispatchRecord, h as listPendingDispatchMailboxAppends, i as buildDispatchId, m as isTerminalDispatchStatus, o as confirmDispatchMailboxAppend, p as getPluginDispatchProjection, s as createOrGetDispatch, t as processPluginTask, x as notifyAutomationBlocked, y as markDispatchFailed } from "./task-runner-D3qJh4fK.js";
-import { o as getAuthPausedConversationTurnId, t as enqueueAgentInvocationResult } from "./result-BBbKA61B.js";
-import { r as enqueueAgentInvocation } from "./work-DRcsJ3hV.js";
-import { s as coerceThreadConversationState } from "./thread-state-W3f6kAtz.js";
-import { o as unlinkProvider } from "./connections-ag_1JOhB.js";
-import { a as GET$4, i as publishAppHomeView, r as GET$5, t as receiveLocalOAuthCredential } from "./credential-sync-B-CPX_ag.js";
-import { a as registerVercelPluginTaskDevConsumer, n as createVercelPluginTaskCallback, s as queueCallback } from "./task-queue-BzW4MaWU.js";
-import { t as processConversationWork } from "./worker-Cjo-QqPq.js";
-import { t as bindMessageAgent } from "./message-DyitL8no.js";
-import { t as bindSpawnAgent } from "./spawn-Dqfeo7XP.js";
+import { A as THREAD_OPTOUT_ACK, C as buildSlackInboundMessage, D as normalizeIncomingSlackThreadId, E as stopSlackThread, F as renderSlackObjectCard, I as createVercelAttachmentStorage, M as parseContent, N as runWithSlackInstallation, O as withNormalizedThreadId, P as verifySlackSignature, R as enqueueAgentDispatch, S as recordSkippedConversationMessage, T as isSlackMessageStopped, a as recordWebConversationActivity, c as createProductionSlackWebhookServices, f as createSlackWebApiStatusSender, j as startProcessingReaction, k as stopConversationTurn, l as getProductionSlackAdapter, n as conversationTurnIdForMessage, o as webActorFromEmail, s as createProductionConversationWorkOptions, t as appendAndEnqueueWebMessage, v as readViewerAutomationSummary, w as clearSlackPendingReactions, z as GET$3 } from "./web-input-BZDyxpzR.js";
+import { C as existingConversationId, N as recordAutomationExecution, c as getDispatchConversationId, d as getDispatchRecord, h as listPendingDispatchMailboxAppends, i as buildDispatchId, m as isTerminalDispatchStatus, o as confirmDispatchMailboxAppend, p as getPluginDispatchProjection, s as createOrGetDispatch, t as processPluginTask, x as notifyAutomationBlocked, y as markDispatchFailed } from "./task-runner-BlGhcQPi.js";
+import { o as getAuthPausedConversationTurnId, t as enqueueAgentInvocationResult } from "./result-DEZH_AnZ.js";
+import { r as enqueueAgentInvocation } from "./work-D3QKiV0O.js";
+import { s as coerceThreadConversationState } from "./thread-state-DpSWS4Rr.js";
+import { o as unlinkProvider } from "./connections-9gJkfS85.js";
+import { a as GET$4, i as publishAppHomeView, r as GET$5, t as receiveLocalOAuthCredential } from "./credential-sync-BABGymK3.js";
+import { a as registerVercelPluginTaskDevConsumer, n as createVercelPluginTaskCallback, s as queueCallback } from "./task-queue-BAeGEMjJ.js";
+import { t as processConversationWork } from "./worker-C8mUjYf9.js";
+import { t as bindMessageAgent } from "./message-DRf6m4uO.js";
+import { t as bindSpawnAgent } from "./spawn-BSAQ7UQZ.js";
 import { createRequire } from "node:module";
 import { Hono } from "hono";
 import { z } from "zod";
@@ -5297,6 +5297,8 @@ function dashboardHostRoutePaths(dashboard, authenticatedRoutes = []) {
 		"/api/people/*",
 		"/api/personal-tokens",
 		"/api/personal-tokens/*",
+		"/api/service-accounts",
+		"/api/service-accounts/*",
 		"/api/workspaces",
 		"/api/workspaces/*",
 		"/api/config",

package/dist/{assistant-reply-H1M-91oF.js → assistant-reply-CqthTerd.js}

@@ -1,4 +1,4 @@
-import { ct as extractAssistantText } from "./tasks-CEXKTASS.js";
+import { ct as extractAssistantText } from "./tasks-DieKX3d4.js";
 // src/chat/no-reply.ts
 const NO_REPLY_MARKER = "[[NO_REPLY]]";
 /**

package/dist/{briefs-vYoK85rJ.js → briefs-DNYbQ9cD.js}

@@ -1,4 +1,4 @@
-import { r as completeObject } from "./client-DbyHuMFU.js";
+import { i as completeObject } from "./client-BZdxgKyL.js";
 import { r as defaultModelId } from "./model-profile-Bg8EoCKD.js";
 import { U as parseBriefInput, d as conversationDetailReportSchema, p as conversationEventPageSchema, z as briefCodeChangeSchema } from "./conversation-DjN3mlog.js";
 import { n as briefEntriesFromReportEvents, s as generateBrief, t as BRIEF_PROMPT } from "./prompt-xgpyMtg7.js";
@@ -267,7 +267,7 @@ async function parseRunOptions(argv) {
 * `DATABASE_URL` at import, and `briefs pull` must work with only a token.
 */
 async function configuredDefaultModelId() {
-	const { botConfig } = await import("./config-_WO_AjCB.js").then((n) => n.r);
+	const { botConfig } = await import("./config-Deqpfpg9.js").then((n) => n.r);
 	return defaultModelId(botConfig);
 }
 function apiUrl(baseUrl, pathname) {

package/dist/{catalog-runtime-BN4DVxco.js → catalog-runtime-B8SuFPGb.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-nwUcYXjP.js";
-import { t as createPluginCatalogRuntime } from "./registry-Du566MtJ.js";
+import { t as createPluginCatalogRuntime } from "./registry-B_M_x_iS.js";
 // src/chat/plugins/catalog-runtime.ts
 var catalog_runtime_exports = /* @__PURE__ */ __exportAll({ pluginCatalogRuntime: () => pluginCatalogRuntime });
 const pluginCatalogRuntime = createPluginCatalogRuntime();

package/dist/cli/chat.d.ts

@@ -1,4 +1,4 @@
-import { n as JuniorPluginSet } from "../plugins-B11Mfkmv.js";
+import { n as JuniorPluginSet } from "../plugins-B_0Cr0MO.js";
 export declare const CHAT_USAGE = "usage: junior chat\n       junior chat -p <message>";
 export type ChatCommandOptions = {
   mode: "interactive";

package/dist/cli/chat.js

@@ -1,4 +1,4 @@
-import { n as executeAgentRun, t as createAgentRunner } from "../agent-runner-DGsFQw72.js";
+import { n as executeAgentRun, t as createAgentRunner } from "../agent-runner-CPSd7rKm.js";
 import { t as loadAppPluginSet } from "../plugin-module-Cf5gVPWP.js";
 import path from "node:path";
 import { createHash, randomUUID } from "node:crypto";
@@ -99,10 +99,10 @@ async function loadLocalPluginSet() {
 async function configureLocalChatPlugins(pluginSet) {
 	const [pluginsModule, agentHooksModule, catalogRuntimeModule, validationModule, databaseModule] = await Promise.all([
 		import("../plugins-DOm9Y6qI.js").then((n) => n.o),
-		import("../agent-hooks-BJ_5mlRH.js").then((n) => n.t),
-		import("../catalog-runtime-BN4DVxco.js").then((n) => n.t),
-		import("../validation-BHRxa5G4.js").then((n) => n.r),
-		import("../viewer-CGvvRqKp.js").then((n) => n.s)
+		import("../agent-hooks-B00FaKdP.js").then((n) => n.t),
+		import("../catalog-runtime-B8SuFPGb.js").then((n) => n.t),
+		import("../validation-23d7K9tX.js").then((n) => n.r),
+		import("../viewer-B2_ABsYi.js").then((n) => n.s)
 	]);
 	const resolvedPluginSet = pluginSet === void 0 ? await loadLocalPluginSet() : pluginSet ?? void 0;
 	const plugins = pluginsModule.pluginRuntimeRegistrationsFromPluginSet(resolvedPluginSet);
@@ -154,19 +154,19 @@ async function prepareLocalChatRun(io, pluginSet) {
 	await configureLocalChatPlugins(pluginSet);
 	const { setExperimentalFeatures } = await import("../experimental-BNK1l1jv.js").then((n) => n.t);
 	setExperimentalFeatures({ subagents: true });
-	const { setBriefsConfig } = await import("../agent-hooks-BJ_5mlRH.js").then((n) => n.m);
+	const { setBriefsConfig } = await import("../agent-hooks-B00FaKdP.js").then((n) => n.m);
 	setBriefsConfig({ enabled: true });
-	const { runLocalAgentTurn } = await import("../runner-CCuqFSqx.js");
-	const { startLocalOAuthCallbackServer } = await import("../oauth-callback-server-CDby-pCn.js");
+	const { runLocalAgentTurn } = await import("../runner-BqQlG10t.js");
+	const { startLocalOAuthCallbackServer } = await import("../oauth-callback-server-JmOgLcGl.js");
 	const { createLocalOAuthState } = await import("../oauth-relay-CTygMkNx.js").then((n) => n.t);
-	const { createLocalSandboxEgressSignalTransport } = await import("../sandbox-egress-signals-DY1mbKF4.js");
-	const { bindSpawnAgent } = await import("../spawn-Dqfeo7XP.js").then((n) => n.n);
-	const { bindMessageAgent } = await import("../message-DyitL8no.js").then((n) => n.n);
-	const { createAgentInvocationWorker, routeAgentInvocationWork } = await import("../work-DRcsJ3hV.js").then((n) => n.a);
-	const { startAgentInvocationsForChildInput } = await import("../result-BBbKA61B.js").then((n) => n.r);
-	const { skipInputBeforeConversationStop } = await import("../session-stop-CIoFiwwe.js").then((n) => n.r);
+	const { createLocalSandboxEgressSignalTransport } = await import("../sandbox-egress-signals-DCq3WLs5.js");
+	const { bindSpawnAgent } = await import("../spawn-BSAQ7UQZ.js").then((n) => n.n);
+	const { bindMessageAgent } = await import("../message-DRf6m4uO.js").then((n) => n.n);
+	const { createAgentInvocationWorker, routeAgentInvocationWork } = await import("../work-D3QKiV0O.js").then((n) => n.a);
+	const { startAgentInvocationsForChildInput } = await import("../result-DEZH_AnZ.js").then((n) => n.r);
+	const { skipInputBeforeConversationStop } = await import("../session-stop-CV65ZlU3.js").then((n) => n.r);
 	const { createLocalConversationWork } = await import("../conversation-work-BaT_T6EB.js");
-	const { processConversationWork } = await import("../worker-Cjo-QqPq.js").then((n) => n.n);
+	const { processConversationWork } = await import("../worker-C8mUjYf9.js").then((n) => n.n);
 	let agentRunner;
 	const localConversationWork = createLocalConversationWork(async (message) => {
 		if (!agentRunner) throw new Error("Local agent runner is not ready");

package/dist/cli/check.js

@@ -1,6 +1,6 @@
-import { E as JUNIOR_CONVERSATION_WORK_CALLBACK_ROUTE, N as LEGACY_JUNIOR_CONVERSATION_WORK_FUNCTION, O as JUNIOR_HEARTBEAT_ROUTE } from "../logging-DsHONhVm.js";
-import { v as parseInlinePluginManifest, y as parsePluginManifest } from "../registry-Du566MtJ.js";
-import { i as parseSkillFile } from "../skills-DyQBLIrK.js";
+import { E as JUNIOR_CONVERSATION_WORK_CALLBACK_ROUTE, N as LEGACY_JUNIOR_CONVERSATION_WORK_FUNCTION, O as JUNIOR_HEARTBEAT_ROUTE } from "../logging-BStXN56b.js";
+import { v as parseInlinePluginManifest, y as parsePluginManifest } from "../registry-B_M_x_iS.js";
+import { i as parseSkillFile } from "../skills-CiWS5_Ub.js";
 import path from "node:path";
 import fs from "node:fs/promises";
 import { pathToFileURL } from "node:url";

package/dist/cli/main.js

@@ -25,10 +25,13 @@ async function runChat(argv, pluginSet) {
 	return await (await import("./chat.js")).runChat(argv, void 0, { pluginSet });
 }
 async function runAdmin(argv) {
-	return await (await import("../admin-My1SLGVO.js")).runAdmin(argv);
+	return await (await import("../admin-C8xz2f10.js")).runAdmin(argv);
+}
+async function runServiceAccount(argv) {
+	return await (await import("../service-account-BqTBkyD7.js")).runServiceAccount(argv);
 }
 async function runBriefs(argv) {
-	return await (await import("../briefs-vYoK85rJ.js")).runBriefs(argv);
+	return await (await import("../briefs-DNYbQ9cD.js")).runBriefs(argv);
 }
 function topLevelCommand(argv) {
 	return (argv[0] === "--" ? argv.slice(1) : argv)[0];
@@ -45,6 +48,7 @@ async function runMain(argv, options = {}) {
 	const exitCode = await runCli(argv, {
 		runAdmin,
 		runBriefs,
+		runServiceAccount,
 		runChat: async (chatArgv) => await runChat(chatArgv, pluginSet),
 		runInit,
 		runSnapshotCreate,

package/dist/cli/plugins.d.ts

@@ -1,4 +1,4 @@
-import { n as JuniorPluginSet } from "../plugins-B11Mfkmv.js";
+import { n as JuniorPluginSet } from "../plugins-B_0Cr0MO.js";
 import { PluginCliIo } from "@sentry/junior-plugin-api";
 export type PluginCommandIo = PluginCliIo;
 export interface CliPluginCommandDispatcher {

package/dist/cli/plugins.js

@@ -1,7 +1,7 @@
-import { d as getDb } from "../viewer-CGvvRqKp.js";
-import { n as pluginCatalogRuntime } from "../catalog-runtime-BN4DVxco.js";
-import { d as setPlugins, f as validatePlugins, ft as createPluginLogger } from "../agent-hooks-BJ_5mlRH.js";
-import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "../validation-BHRxa5G4.js";
+import { d as getDb } from "../viewer-B2_ABsYi.js";
+import { n as pluginCatalogRuntime } from "../catalog-runtime-B8SuFPGb.js";
+import { d as setPlugins, f as validatePlugins, ft as createPluginLogger } from "../agent-hooks-B00FaKdP.js";
+import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "../validation-23d7K9tX.js";
 import { a as pluginRuntimeRegistrationsFromPluginSet, i as pluginCliRegistrationsFromPluginSet, r as pluginCatalogConfigFromPluginSet } from "../plugins-DOm9Y6qI.js";
 import { t as loadAppPluginSet } from "../plugin-module-Cf5gVPWP.js";
 import { stderr, stdout } from "node:process";

package/dist/cli/run.d.ts

@@ -1,7 +1,8 @@
-export declare const CLI_USAGE = "usage: junior init <dir>\n       junior admin list|grant <email>|revoke <email>\n       junior snapshot create\n       junior check [dir]\n       junior upgrade\n       junior chat\n       junior chat -p <message>\n       junior briefs pull <conversationId...> --base-url <url> [--token <token>] --out <dir>\n       junior briefs run <snapshot...> [--model <id>] [--prompt <file>] [--turn-by-turn] [--out <dir>]";
+export declare const CLI_USAGE = "usage: junior init <dir>\n       junior admin list|grant <email>|revoke <email>\n       junior service-account connect|status|disconnect <plugin>\n       junior snapshot create\n       junior check [dir]\n       junior upgrade\n       junior chat\n       junior chat -p <message>\n       junior briefs pull <conversationId...> --base-url <url> [--token <token>] --out <dir>\n       junior briefs run <snapshot...> [--model <id>] [--prompt <file>] [--turn-by-turn] [--out <dir>]";
 interface CliHandlers {
   runAdmin: (argv: string[]) => Promise<number>;
   runBriefs: (argv: string[]) => Promise<number>;
+  runServiceAccount: (argv: string[]) => Promise<number>;
   runChat: (argv: string[]) => Promise<number>;
   runInit: (dir: string) => Promise<void>;
   runSnapshotCreate: () => Promise<void>;

package/dist/cli/run.js

@@ -1,5 +1,5 @@
 // src/cli/run.ts
-const CLI_USAGE = "usage: junior init <dir>\n       junior admin list|grant <email>|revoke <email>\n       junior snapshot create\n       junior check [dir]\n       junior upgrade\n       junior chat\n       junior chat -p <message>\n       junior briefs pull <conversationId...> --base-url <url> [--token <token>] --out <dir>\n       junior briefs run <snapshot...> [--model <id>] [--prompt <file>] [--turn-by-turn] [--out <dir>]";
+const CLI_USAGE = "usage: junior init <dir>\n       junior admin list|grant <email>|revoke <email>\n       junior service-account connect|status|disconnect <plugin>\n       junior snapshot create\n       junior check [dir]\n       junior upgrade\n       junior chat\n       junior chat -p <message>\n       junior briefs pull <conversationId...> --base-url <url> [--token <token>] --out <dir>\n       junior briefs run <snapshot...> [--model <id>] [--prompt <file>] [--turn-by-turn] [--out <dir>]";
 const DEFAULT_IO = { error: console.error };
 /** Strip Node's leading argv separator while preserving command-level flags. */
 function normalizeCliArgv(argv) {
@@ -10,6 +10,7 @@ async function runCli(argv, handlers, io = DEFAULT_IO) {
 	const [command, subcommand, ...rest] = normalizeCliArgv(argv);
 	if (command === "chat") return await handlers.runChat(subcommand === void 0 ? [] : [subcommand, ...rest]);
 	if (command === "admin") return await handlers.runAdmin(subcommand === void 0 ? [] : [subcommand, ...rest]);
+	if (command === "service-account") return await handlers.runServiceAccount(subcommand === void 0 ? [] : [subcommand, ...rest]);
 	if (command === "briefs") return await handlers.runBriefs(subcommand === void 0 ? [] : [subcommand, ...rest]);
 	if (command === "init") {
 		if (!subcommand || rest.length > 0) {

package/dist/cli/snapshot-create.js

@@ -1,6 +1,7 @@
-import { n as pluginCatalogRuntime } from "../catalog-runtime-BN4DVxco.js";
-import { S as disconnectStateAdapter, t as create } from "../profile-DpYjfKke.js";
-import { r as resolve } from "../resolve-ClCIgh8E.js";
+import { n as pluginCatalogRuntime } from "../catalog-runtime-B8SuFPGb.js";
+import { t as create } from "../profile-qBM6B_-V.js";
+import { t as disconnectStateAdapter } from "../adapter-Bn0gFVSF.js";
+import { r as resolve } from "../resolve-BzpuLh8c.js";
 // src/cli/snapshot-create.ts
 const DEFAULT_RUNTIME = "node22";
 const DEFAULT_TIMEOUT_MS = 6e5;

package/dist/cli/upgrade.d.ts

@@ -1,5 +1,5 @@
 import "../db-BnRqQ7G5.js";
-import { n as JuniorPluginSet } from "../plugins-B11Mfkmv.js";
+import { n as JuniorPluginSet } from "../plugins-B_0Cr0MO.js";
 interface UpgradeIo {
   info: (line: string) => void;
 }

package/dist/cli/upgrade.js

@@ -1,6 +1,6 @@
-import { i as getChatConfig } from "../config-_WO_AjCB.js";
-import { t as createJuniorSqlExecutor } from "../executor-RvG6kVe1.js";
-import { t as createPluginCatalogRuntime } from "../registry-Du566MtJ.js";
+import { i as getChatConfig } from "../config-Deqpfpg9.js";
+import { t as createJuniorSqlExecutor } from "../executor-Bb3eQb8q.js";
+import { t as createPluginCatalogRuntime } from "../registry-B_M_x_iS.js";
 import { n as pluginCatalogConfigFromEnv, r as pluginCatalogConfigFromPluginSet, t as defineJuniorPlugins } from "../plugins-DOm9Y6qI.js";
 import { t as loadAppPluginSet } from "../plugin-module-Cf5gVPWP.js";
 import { basename, dirname, join, resolve } from "node:path";