@sentry/junior 0.258.0 → 0.260.0

package/dist/api.js

@@ -1,27 +1,30 @@
-import { K as listChildAgents, L as editEventAutomation, Lt as createUserTokenStore, O as parseSlackThreadId, P as editScheduledAutomation, R as AutomationEditError, T as readLiveAttachment, V as resolveTaskOutcomes, bt as conversationSubtreeColumns, g as readStats, ot as getChildAgentLabel, yt as conversationSubtree, z as eventAutomationTriggerAvailable } from "./agent-runner-DGsFQw72.js";
-import { f as logException, m as logWarn, p as logInfo } from "./logging-DsHONhVm.js";
+import { D as AutomationConflictError, E as sameDefinitionValue, L as loadTurnProjection, O as automationRevision, S as automationDefinition, T as readAutomationVersion, a as saveScheduledAutomation, bn as createUserTokenStore, k as requireAutomationRevision, rr as piMessageFromHistoryItem, v as saveEventAutomation, y as setEventAutomationStatus } from "./tasks-CjrS098O.js";
+import { p as escapeXml } from "./client-JeyzRwsT.js";
+import { f as logException, m as logWarn, p as logInfo } from "./logging-DSMmkHXG.js";
 import { d as parseSlackTeamId, g as parseSlackMessageTs, l as parseSlackChannelId } from "./actor-tlxzqaRe.js";
-import { C as addAgentTurnUsage, D as hasAgentTurnUsage, E as agentTurnUsageSchema, O as resolveRootConversationId, S as parseSessionSource, c as getConversationEventStore, d as getDb, f as getSqlExecutor, h as loadConversationSlackTenantId, i as resolveViewerUser, m as withConversationEventLock, o as updateViewerDisplayName, t as findUserByEmail, u as getConversationStore, v as locationFromRow } from "./viewer-CGvvRqKp.js";
+import { C as addAgentTurnUsage, D as hasAgentTurnUsage, E as agentTurnUsageSchema, O as resolveRootConversationId, S as parseSessionSource, c as getConversationEventStore, d as getDb, f as getSqlExecutor, h as loadConversationSlackTenantIds, i as resolveViewerUser, m as withConversationEventLock, o as updateViewerDisplayName, t as findUserByEmail, u as getConversationStore, v as locationFromRow } from "./viewer-C-J0ewlH.js";
 import { c as juniorIdentities, d as juniorDestinations, l as juniorUsers, o as conversationReadColumns, s as juniorConversations } from "./agent-invocations-Qfz7dWgU.js";
-import { f as juniorConversationBriefs, g as juniorApiTokens, h as juniorConversationEvents, m as juniorConversationMetrics, u as juniorConversationParticipants, v as juniorCodeChanges, y as juniorCodeRepositories } from "./executor-RvG6kVe1.js";
+import { f as juniorConversationBriefs, g as juniorApiTokens, h as juniorConversationEvents, m as juniorConversationMetrics, u as juniorConversationParticipants, v as juniorCodeChanges, y as juniorCodeRepositories } from "./executor-BoGNVEDn.js";
 import { d as contextProvenance } from "./history-AY8rs-FR.js";
-import { At as loadTurnProjection, D as AutomationConflictError, E as sameDefinitionValue, O as automationRevision, S as automationDefinition, T as readAutomationVersion, a as saveScheduledAutomation, k as requireAutomationRevision, pn as piMessageFromHistoryItem, v as saveEventAutomation, y as setEventAutomationStatus } from "./tasks-CEXKTASS.js";
-import { C as WorkspaceValidationError, Ct as readLatestConversationBrief, Ht as getSlackClient, Lt as lookupSlackUser, M as workspaceRepoCheckoutPath, Nt as listConversationAnnotations, O as SANDBOX_RUNTIME, Pt as listConversationAnnotationsById, S as updateWorkspace, Tt as buildSentryConversationUrl, _ as deleteWorkspace, _t as conversationHasParticipantEmail, b as listWorkspaces, bt as conversationNotArchivedForUser, ft as createPluginLogger, g as createWorkspace, gt as conversationArchivedForUser, ht as conversationArchivedForEmail, mt as conversationArchiveTimes, pt as readConversationAccessFromSql, qt as withSlackRetries, u as getPlugins, v as getWorkspace, vt as conversationHasParticipantUser, wt as readConversationEventPage, x as listWorkspacesByRepository, xt as viewerConversationMembership, yt as conversationNotArchivedForEmail } from "./agent-hooks-BJ_5mlRH.js";
-import { A as forkConversationBodySchema, F as readMessageAttachments, I as INPUT_IMAGE_TYPES, O as createConversationBodySchema, T as conversationStatsReportSchema, _ as conversationParamsSchema, a as cancelConversationPendingMessagesBodySchema, c as conversationAttachmentParamsSchema, d as conversationDetailReportSchema, g as conversationFeedSchema, h as conversationFeedQuerySchema, i as archiveConversationResponseSchema, j as forkConversationResponseSchema, k as createConversationMessageBodySchema, m as conversationEventsQuerySchema, o as cancelConversationPendingMessagesResponseSchema, p as conversationEventPageSchema, r as archiveConversationBodySchema, t as acceptedConversationMessageSchema, u as conversationDetailQuerySchema, x as conversationPendingMessagesReportSchema } from "./conversation-DjN3mlog.js";
-import { n as hash, t as create } from "./profile-DpYjfKke.js";
-import { l as getEventCatalog, y as automationEventCatalog } from "./session-stop-CIoFiwwe.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-Bpcs2b2L.js";
+import { F as AutomationEditError, I as eventAutomationTriggerAvailable, P as editEventAutomation, R as resolveTaskOutcomes, S as readLiveAttachment, T as parseSlackThreadId, U as listChildAgents, _t as conversationSubtreeColumns, gt as conversationSubtree, j as editScheduledAutomation, m as readStats, rt as getChildAgentLabel } from "./agent-runner-DvTUyGTY.js";
+import { At as conversationHasParticipantUser, C as WorkspaceValidationError, Dt as conversationArchivedForEmail, Et as conversationArchiveTimes, Ft as readLatestConversationBrief, Gt as listConversationAnnotations, It as readConversationEventPage, Kt as listConversationAnnotationsById, Lt as buildSentryConversationUrl, M as workspaceRepoCheckoutPath, Mt as conversationNotArchivedForUser, Nt as viewerConversationMembership, O as SANDBOX_RUNTIME, Ot as conversationArchivedForUser, S as updateWorkspace, Tt as readConversationAccessFromSql, Yt as lookupSlackUser, _ as deleteWorkspace, b as listWorkspaces, ct as getSlackClient, g as createWorkspace, jt as conversationNotArchivedForEmail, kt as conversationHasParticipantEmail, pt as withSlackRetries, u as getPlugins, v as getWorkspace, wt as createPluginLogger, x as listWorkspacesByRepository } from "./agent-hooks-V4Hfc2tB.js";
 import { t as getFirstRunAtMs } from "./cadence-R7Em4RjE.js";
-import { t as getCachedSnapshot } from "./resolve-ClCIgh8E.js";
-import { a as getVercelConversationWorkQueue } from "./job-queue-DVe37it2.js";
-import { a as cancelHumanFacingPendingMessages, h as getConversation } from "./store-DJLwq4x8.js";
-import { M as compileScheduleIntent, P as weekdaySchema, _ as automationSummarySchema, b as automationVersionListSchema, c as automationLifecycleSchema, d as automationParamsSchema, f as automationRunListSchema, g as automationSchedulePreviewSchema, h as automationScheduleIntentSchema, i as automationExecutionListSchema, j as ScheduleIntentError, l as automationListQuerySchema, n as automationEditSchema, r as automationEventCatalogSchema, t as automationEditErrorSchema, u as automationListSchema, v as automationUpdateSchema, x as automationVersionParamsSchema, y as automationVersionActivateSchema } from "./automation-DWBFBenG.js";
+import { A as forkConversationResponseSchema, B as readMessageAttachments, D as createConversationBodySchema, O as createConversationMessageBodySchema, V as INPUT_IMAGE_TYPES, _ as conversationParamsSchema, a as cancelConversationPendingMessagesBodySchema, c as conversationAttachmentParamsSchema, d as conversationDetailReportSchema, g as conversationFeedSchema, h as conversationFeedQuerySchema, i as archiveConversationResponseSchema, k as forkConversationBodySchema, m as conversationEventsQuerySchema, o as cancelConversationPendingMessagesResponseSchema, p as conversationEventPageSchema, r as archiveConversationBodySchema, t as acceptedConversationMessageSchema, u as conversationDetailQuerySchema, x as conversationPendingMessagesReportSchema } from "./conversation-CvuKJ3tA.js";
+import { n as hash, t as create } from "./profile-ByWkAY7L.js";
+import { d as getEventCatalog, x as automationEventCatalog } from "./session-stop-HfKx-pky.js";
+import { d as getSandboxResources, t as getCachedSnapshot } from "./resolve-HuPG2VMB.js";
+import { a as getVercelConversationWorkQueue } from "./job-queue-CbdVyaCo.js";
+import { a as cancelHumanFacingPendingMessages, h as getConversation } from "./store-DzRbd5VT.js";
+import { n as finishServiceAccountSignIn, o as serviceAccountPlugins, r as getServiceAccountStatus, s as startServiceAccountSignIn, t as disconnectServiceAccount } from "./service-account-Ko1Xs--F.js";
+import { M as compileScheduleIntent, P as weekdaySchema, _ as automationSummarySchema, b as automationVersionListSchema, c as automationLifecycleSchema, d as automationParamsSchema, f as automationRunListSchema, g as automationSchedulePreviewSchema, h as automationScheduleIntentSchema, i as automationExecutionListSchema, j as ScheduleIntentError, l as automationListQuerySchema, n as automationEditSchema, r as automationEventCatalogSchema, t as automationEditErrorSchema, u as automationListSchema, v as automationUpdateSchema, x as automationVersionParamsSchema, y as automationVersionActivateSchema } from "./automation-DrpcA-SX.js";
 import { C as skillReportsSchema, a as fillUtcHours, b as pluginsSchema, c as sumUtcHoursIntoSixHours, d as trailingUtcSixHourWindow, f as utcDayKey, h as pluginOperationalReportFeedSchema, i as fillUtcDays, l as trailingUtcDayWindow, m as healthReportSchema, n as DAY_MS$1, o as fillUtcSixHours, p as utcHourKey, r as HOUR_MS$1, s as startOfUtcHour, u as trailingUtcHourWindow, x as runtimeInfoReportSchema } from "./web-message-id-CJSUiksE.js";
-import { B as readHealthReport, I as createVercelAttachmentStorage, _ as readViewerAutomationRuns, a as recordWebConversationActivity, b as readViewerAutomations, d as resolveSlackConversationContextFromThreadId, g as readViewerAutomationExecutions, h as readConversationSourceTask, i as createConversationId, k as stopConversationTurn, l as getProductionSlackAdapter, m as deleteViewerTask, o as webActorFromEmail, p as ViewerTaskNotFoundError, r as createAndEnqueueConversation, t as appendAndEnqueueWebMessage, u as formatSlackConversationRedactedLabel, v as readViewerAutomationSummary, w as clearSlackPendingReactions, x as resolveViewerTaskCandidate, y as readViewerAutomationVersions } from "./web-input-Keb5GRWj.js";
-import { F as conversationAggregateColumns, I as conversationRangeColumns, M as readAutomationTitlesByConversationId, P as conversationActiveDaysColumn } from "./task-runner-D3qJh4fK.js";
-import { d as legacyWebMailboxMetadataSchema } from "./result-BBbKA61B.js";
-import { a as startConnection, l as getWebAuthorization, n as isConnectableProvider, r as listConnections, t as disconnectConnection } from "./connections-ag_1JOhB.js";
-import { t as decodeInputImages } from "./images-C2J_bj2g.js";
-import { C as locationParamsSchema, E as activitySixHours$1, H as conversationChildAgentsReportSchema, I as codeOverviewReportSchema, L as codePersonReportSchema, M as startConnectionResponseSchema, O as connectionListSchema, R as codeRepositoryParamsSchema, S as locationDirectoryReportSchema, T as activityHours$1, U as stopConversationTurnResponseSchema, W as apiErrorSchema, _ as actorProfileReportSchema, a as workspaceBodySchema, d as createdPersonalTokenSchema, f as personalTokenListSchema, g as actorDirectoryReportSchema, h as revokePersonalTokenResponseSchema, i as deleteWorkspaceResponseSchema, j as disconnectConnectionResponseSchema, k as connectionParamsSchema, l as workspaceSchema, m as personalTokenParamsSchema, n as statsReportSchema, o as workspaceListSchema, s as workspaceParamsSchema, u as createPersonalTokenBodySchema, v as personParamsSchema, w as activityDays$1, x as locationDetailReportSchema, y as personalSpendReportSchema, z as codeRepositoryReportSchema } from "./schema-DrMh3NtR.js";
+import { B as readHealthReport, I as createVercelAttachmentStorage, _ as readViewerAutomationRuns, a as recordWebConversationActivity, b as readViewerAutomations, d as resolveSlackConversationContextFromThreadId, g as readViewerAutomationExecutions, h as readConversationSourceTask, i as createConversationId, k as stopConversationTurn, l as getProductionSlackAdapter, m as deleteViewerTask, o as webActorFromEmail, p as ViewerTaskNotFoundError, r as createAndEnqueueConversation, t as appendAndEnqueueWebMessage, u as formatSlackConversationRedactedLabel, v as readViewerAutomationSummary, w as clearSlackPendingReactions, x as resolveViewerTaskCandidate, y as readViewerAutomationVersions } from "./web-input-C_xB3RXp.js";
+import { F as conversationAggregateColumns, I as conversationRangeColumns, M as readAutomationTitlesByConversationId, P as conversationActiveDaysColumn } from "./task-runner-DGnd_B5X.js";
+import { d as legacyWebMailboxMetadataSchema } from "./result-DS7V4a3-.js";
+import { a as startConnection, l as getWebAuthorization, n as isConnectableProvider, r as listConnections, t as disconnectConnection, u as htmlCallbackResponse } from "./connections-CZ7HhEmN.js";
+import { t as decodeInputImages } from "./images-BBmDXQCB.js";
+import { A as activityHours$1, C as personParamsSchema, D as locationDirectoryReportSchema, E as locationDetailReportSchema, H as codePersonReportSchema, I as disconnectConnectionResponseSchema, J as stopConversationTurnResponseSchema, L as startConnectionResponseSchema, N as connectionListSchema, O as locationParamsSchema, P as connectionParamsSchema, S as actorProfileReportSchema, U as codeRepositoryParamsSchema, V as codeOverviewReportSchema, W as codeRepositoryReportSchema, X as apiErrorSchema, Y as conversationStatsReportSchema, _ as personalTokenListSchema, a as workspaceBodySchema, b as revokePersonalTokenResponseSchema, d as serviceAccountListSchema, f as serviceAccountParamsSchema, g as createdPersonalTokenSchema, h as createPersonalTokenBodySchema, i as deleteWorkspaceResponseSchema, j as activitySixHours$1, k as activityDays$1, l as workspaceSchema, m as startServiceAccountSignInResponseSchema, n as statsReportSchema, o as workspaceListSchema, q as conversationChildAgentsReportSchema, s as workspaceParamsSchema, u as disconnectServiceAccountResponseSchema, w as personalSpendReportSchema, x as actorDirectoryReportSchema, y as personalTokenParamsSchema } from "./schema-OzL8Zw4H.js";
 import { Hono } from "hono";
 import path from "node:path";
 import { z } from "zod";
@@ -75,6 +78,13 @@ const requireViewer = createMiddleware(async (context, next) => {
 	if (!context.get("viewer")) throwApiError(401, "Authentication required.");
 	await next();
 });
+/** Require a Junior admin viewer. */
+const requireAdmin = createMiddleware(async (context, next) => {
+	const viewer = context.get("viewer");
+	if (!viewer) throwApiError(401, "Authentication required.");
+	if (viewer.isAdmin !== true) throwApiError(403, "Only Junior admins can do this.");
+	await next();
+});
 // src/api/conversations/archive.ts
 async function setViewerArchive(args) {
 	const executor = getSqlExecutor();
@@ -877,22 +887,42 @@ function decodeConversationCursor(args) {
 		return;
 	}
 }
-// src/api/conversations/message-mentions.ts
+// src/api/mentions.ts
 const SLACK_USER_MENTION_RE = /<@([UW][A-Z0-9]+)(?:\|[^<>]*)?>/g;
-function mentionedSlackUserIds(text) {
-	if (!text) return [];
-	return [...new Set([...text.matchAll(SLACK_USER_MENTION_RE)].map((m) => m[1]))];
+function mentionedSlackUserIds(texts) {
+	const ids = texts.flatMap((text) => text ? [...text.matchAll(SLACK_USER_MENTION_RE)].map((m) => m[1]) : []);
+	return [...new Set(ids)];
 }
-function messageMentionText(data) {
-	return [data.text, data.trustedSummary].filter(Boolean).join("\n");
+/**
+* Resolve the people that each source mentions, in source order. Every API
+* that returns display text uses this, so the dashboard can show the same
+* names and People links everywhere. It does one identity query per Slack
+* workspace.
+*/
+async function resolveMentions(executor, sources) {
+	const idsBySource = sources.map((source) => mentionedSlackUserIds(source.texts));
+	const idsByTenant = /* @__PURE__ */ new Map();
+	sources.forEach((source, index) => {
+		if (idsBySource[index].length === 0) return;
+		const ids = idsByTenant.get(source.tenantId) ?? /* @__PURE__ */ new Set();
+		for (const id of idsBySource[index]) ids.add(id);
+		idsByTenant.set(source.tenantId, ids);
+	});
+	const peopleByTenant = new Map(await Promise.all([...idsByTenant].map(async ([tenantId, ids]) => [tenantId, await readMentionedPeople(executor, tenantId, [...ids])])));
+	return sources.map((source, index) => {
+		const people = peopleByTenant.get(source.tenantId);
+		return idsBySource[index].flatMap((id) => {
+			const person = people?.get(id);
+			return person ? [person] : [];
+		});
+	});
 }
 /**
 * Read current names for mentioned Slack users. Known Junior identities come
 * first. The email is set only for a linked, verified Junior user, because
 * that email is the People profile route.
 */
-async function resolveSlackMentions(executor, conversationId, userIds) {
-	const tenantId = await loadConversationSlackTenantId(executor, conversationId);
+async function readMentionedPeople(executor, tenantId, userIds) {
 	const rows = await executor.db().select({
 		displayName: juniorIdentities.displayName,
 		emailVerified: juniorIdentities.emailVerified,
@@ -932,26 +962,67 @@ async function resolveSlackMentions(executor, conversationId, userIds) {
 	}
 	return people;
 }
-/** Attach the people that each visible message mentions, resolved at read time. */
-async function attachMessageMentions(executor, conversationId, events) {
-	const idsByIndex = events.map((event) => event.data.type === "message" && !event.data.redacted ? mentionedSlackUserIds(messageMentionText(event.data)) : []);
-	const allIds = [...new Set(idsByIndex.flat())];
-	if (allIds.length === 0) return events;
-	const people = await resolveSlackMentions(executor, conversationId, allIds);
-	return events.map((event, index) => {
-		if (event.data.type !== "message") return event;
-		const mentions = idsByIndex[index].flatMap((id) => {
-			const person = people.get(id);
-			return person ? [person] : [];
-		});
-		return mentions.length > 0 ? {
-			...event,
-			data: {
-				...event.data,
-				mentions
-			}
-		} : event;
+// src/api/conversations/mentions.ts
+/** Text in one event that the dashboard renders with mentions. */
+function eventMentionTexts(data) {
+	switch (data.type) {
+		case "message": return data.redacted ? [] : [
+			data.text,
+			data.trustedSummary,
+			...(data.events ?? []).map((event) => event.trustedSummary)
+		];
+		case "assistant_message": return data.parts.map((part) => part.text);
+		case "compaction":
+		case "handoff": return [data.summary];
+		case "structured_event": return [data.presentation.preview, ...(data.presentation.details ?? []).map((detail) => detail.description)];
+		default: return [];
+	}
+}
+function briefMentionTexts(brief) {
+	return [
+		brief.summary,
+		brief.intent,
+		brief.outcome.text,
+		...brief.decisions.flatMap((decision) => [decision.text, decision.by]),
+		...brief.openDecisions.flatMap((decision) => [decision.text, decision.owner]),
+		...brief.facts
+	];
+}
+function withMentions(value, mentions) {
+	return mentions.length > 0 ? {
+		...value,
+		mentions
+	} : value;
+}
+/**
+* Attach the people that each event and the Brief of one conversation
+* mention, resolved at read time.
+*/
+async function attachConversationMentions(executor, conversationId, content) {
+	const tenantId = (await loadConversationSlackTenantIds(executor, [conversationId])).get(conversationId);
+	const sources = content.events.map((event) => ({
+		tenantId,
+		texts: eventMentionTexts(event.data)
+	}));
+	if (content.brief) sources.push({
+		tenantId,
+		texts: briefMentionTexts(content.brief)
 	});
+	const mentions = await resolveMentions(executor, sources);
+	return {
+		briefMentions: content.brief ? mentions.at(-1) : [],
+		events: content.events.map((event, index) => withMentions(event, mentions[index]))
+	};
+}
+/** Attach the people that each activity preview mentions, resolved at read time. */
+async function attachActivityPreviewMentions(executor, previews) {
+	const entries = [...previews];
+	const tenants = await loadConversationSlackTenantIds(executor, entries.map(([conversationId]) => conversationId));
+	const mentions = await resolveMentions(executor, entries.map(([conversationId, preview]) => ({
+		tenantId: tenants.get(conversationId),
+		texts: [preview.text]
+	})));
+	return new Map(entries.map(([conversationId, preview], index) => [conversationId, withMentions(preview, mentions[index])]));
 }
 // src/api/conversations/shared.ts
 /** Format a Slack destination without exposing private channel names. */
@@ -1427,6 +1498,7 @@ async function readConversationFeedFromSql(options = {}) {
 		readConversationActivityPreviews(db, conversationIds),
 		readAutomationTitlesByConversationId(conversations)
 	]);
+	const visibleActivityPreviews = await attachActivityPreviewMentions(getSqlExecutor(), new Map([...activityPreviewByConversation].filter(([conversationId]) => accessByConversation.get(conversationId)?.canViewPrivateContent)));
 	const sidebarAnnotationsByConversation = await listConversationSidebarAnnotations(conversationIds, new Map(conversationIds.map((conversationId) => [conversationId, accessByConversation.get(conversationId)?.canViewPrivateContent ? annotationsByConversation.get(conversationId) ?? [] : []])));
 	const assignedWork = new Set(conversationWork.assignedIds);
 	const unfinishedWork = new Set(conversationWork.unfinishedIds);
@@ -1456,7 +1528,7 @@ async function readConversationFeedFromSql(options = {}) {
 				...unfinishedWork.has(conversation.conversationId) ? { unfinishedWork: true } : void 0
 			};
 			const annotations = access?.canViewPrivateContent ? annotationsByConversation.get(conversation.conversationId) ?? [] : [];
-			const activityPreview = access?.canViewPrivateContent ? activityPreviewByConversation.get(conversation.conversationId) : void 0;
+			const activityPreview = visibleActivityPreviews.get(conversation.conversationId);
 			const participants = access?.canViewPrivateContent ? participantsByConversation.get(conversation.conversationId) : void 0;
 			return {
 				...summary,
@@ -1649,7 +1721,11 @@ async function readConversationDetailFromSql(conversationId, options) {
 		conversationId,
 		limit: options.limit
 	}) : { events: [] };
-	const events = await attachMessageMentions(executor, conversationId, page.events);
+	const brief = access?.canViewPrivateContent ? briefVersion?.content : void 0;
+	const { briefMentions, events } = await attachConversationMentions(executor, conversationId, {
+		...brief ? { brief } : void 0,
+		events: page.events
+	});
 	const metrics = metricsByConversation.get(conversationId);
 	const auxiliaryCosts = auxiliaryCostsByConversation.get(conversationId);
 	const childAgentTotals = childAgentTotalsReport(metrics, auxiliaryCosts);
@@ -1664,6 +1740,7 @@ async function readConversationDetailFromSql(conversationId, options) {
 		...childAgentTotals ? { childAgentTotals } : void 0,
 		...briefVersion ? { brief: {
 			content: briefVersion.content,
+			...briefMentions.length > 0 ? { mentions: briefMentions } : void 0,
 			updatedAt: briefVersion.createdAt.toISOString(),
 			version: briefVersion.version
 		} } : void 0,
@@ -1710,7 +1787,7 @@ async function readConversationEvents(conversationId, beforeValue, options = {})
 		limit: options.limit ?? 500
 	}) : { events: [] };
 	return conversationEventPageSchema.parse({
-		events: await attachMessageMentions(getSqlExecutor(), conversationId, page.events),
+		events: (await attachConversationMentions(getSqlExecutor(), conversationId, { events: page.events })).events,
 		eventHistory: conversationEventHistory({
 			canExposePayload,
 			...transcriptPurgedAtMs === void 0 ? void 0 : { transcriptPurgedAtMs }
@@ -3633,7 +3710,7 @@ async function readPeoplePluginReports(args) {
 		reports: [],
 		source: "plugins"
 	});
-	const { getPluginProfileReports } = await import("./agent-hooks-BJ_5mlRH.js").then((n) => n.t);
+	const { getPluginProfileReports } = await import("./agent-hooks-V4Hfc2tB.js").then((n) => n.t);
 	return pluginOperationalReportFeedSchema.parse({
 		generatedAt: new Date(nowMs).toISOString(),
 		reports: await getPluginProfileReports({
@@ -4011,6 +4088,66 @@ function createPersonalTokenRoutes() {
 	});
 	return app;
 }
+// src/api/service-accounts/routes.ts
+/**
+* Public URL of the OAuth callback for one plugin's service account.
+*
+* It uses the request origin unless `JUNIOR_BASE_URL` is set, so the
+* provider sends the Admin back to the dashboard session that started it.
+*/
+function callbackUrl(request, provider) {
+	const base = process.env.JUNIOR_BASE_URL?.trim() || new URL(request.url).origin;
+	return new URL(`api/service-accounts/${encodeURIComponent(provider)}/callback`, base.endsWith("/") ? base : `${base}/`).toString();
+}
+function requirePlugin(provider) {
+	const plugin = pluginCatalogRuntime.getDefinition(provider);
+	if (!plugin?.manifest.accounts?.serviceAccount) throwApiError(404, "Service account not found.");
+	return plugin;
+}
+function callbackPage(title, message, status) {
+	return htmlCallbackResponse(escapeXml(title), escapeXml(message), status, { footerMessage: "You can close this tab and return to the dashboard." });
+}
+/**
+* Create admin-only routes that list, connect, and disconnect plugin service
+* accounts.
+*
+* Whoever signs in decides which account everyone falls back to, so every
+* route, including the OAuth callback, requires a Junior admin. The callback
+* also accepts only a sign-in that the same Admin started.
+*/
+function createServiceAccountRoutes() {
+	const app = new Hono();
+	app.get("/", requireAdmin, async () => jsonResponse(serviceAccountListSchema, { serviceAccounts: await Promise.all(serviceAccountPlugins(pluginCatalogRuntime.getProviders()).map(getServiceAccountStatus)) }));
+	app.post("/:provider", requireAdmin, validateRequest("param", serviceAccountParamsSchema, "Invalid provider."), async (context) => {
+		const { provider } = context.req.valid("param");
+		const { authorizationUrl } = await startServiceAccountSignIn({
+			plugin: requirePlugin(provider),
+			redirectUrl: callbackUrl(context.req.raw, provider),
+			startedBy: context.get("viewer").email
+		});
+		return jsonResponse(startServiceAccountSignInResponseSchema, { authorizationUrl: authorizationUrl.toString() });
+	});
+	app.get("/:provider/callback", requireAdmin, validateRequest("param", serviceAccountParamsSchema, "Invalid provider."), async (context) => {
+		const { provider } = context.req.valid("param");
+		const plugin = requirePlugin(provider);
+		const viewer = context.get("viewer");
+		const result = await finishServiceAccountSignIn({
+			callback: new URL(context.req.url).searchParams,
+			connectedBy: viewer.email,
+			plugin
+		});
+		if (!result.ok) return callbackPage("Connection failed", result.message, 400);
+		logInfo("dashboard.service_account.connected", { "app.credential.provider": provider });
+		return callbackPage(`${plugin.manifest.displayName} service account connected`, `People who have not connected ${plugin.manifest.displayName} now use this account for what its policy allows.`, 200);
+	});
+	app.delete("/:provider", requireAdmin, validateRequest("param", serviceAccountParamsSchema, "Invalid provider."), async (context) => {
+		const { provider } = context.req.valid("param");
+		await disconnectServiceAccount(requirePlugin(provider));
+		logInfo("dashboard.service_account.disconnected", { "app.credential.provider": provider });
+		return jsonResponse(disconnectServiceAccountResponseSchema, { disconnected: true });
+	});
+	return app;
+}
 // src/chat/plugins/user-pages.ts
 /**
 * Runtime ownership for plugin user pages.
@@ -4334,6 +4471,18 @@ async function previewAutomationSchedule(user, id, intent) {
 		throw error;
 	}
 }
+// src/api/automations/mentions.ts
+/** Attach the people that each Automation instruction mentions, resolved at read time. */
+async function attachAutomationMentions(executor, automations) {
+	const mentions = await resolveMentions(executor, automations.map((automation) => ({
+		tenantId: automation.destination.teamId,
+		texts: [automation.instruction]
+	})));
+	return automations.map((automation, index) => mentions[index].length > 0 ? {
+		...automation,
+		mentions: mentions[index]
+	} : automation);
+}
 // src/api/automations/routes.ts
 /** Translate expected edit failures; unexpected failures stay at the API boundary. */
 function editErrorResponse(error) {
@@ -4358,7 +4507,11 @@ function createAutomationRoutes() {
 	app.get("/", requireViewer, validateRequest("query", automationListQuerySchema, "Invalid task list query."), async (context) => {
 		const user = context.get("viewer");
 		const query = context.req.valid("query");
-		return jsonResponse(automationListSchema, await readViewerAutomations(user, query));
+		const list = await readViewerAutomations(user, query);
+		return jsonResponse(automationListSchema, {
+			...list,
+			automations: await attachAutomationMentions(getSqlExecutor(), list.automations)
+		});
 	});
 	app.get("/event-catalog", requireViewer, () => {
 		return jsonResponse(automationEventCatalogSchema, readAutomationEventCatalog());
@@ -4378,7 +4531,12 @@ function createAutomationRoutes() {
 		const user = context.get("viewer");
 		const params = context.req.valid("param");
 		try {
-			return jsonResponse(automationExecutionListSchema, await readViewerAutomationExecutions(user, params.id));
+			const list = await readViewerAutomationExecutions(user, params.id);
+			const [automation] = await attachAutomationMentions(getSqlExecutor(), [list.automation]);
+			return jsonResponse(automationExecutionListSchema, {
+				...list,
+				automation
+			});
 		} catch (error) {
 			if (error instanceof ViewerTaskNotFoundError) return jsonResponse(apiErrorSchema, { error: error.message }, { status: 404 });
 			throw error;
@@ -4444,7 +4602,7 @@ function createAutomationRoutes() {
 	});
 	app.get("/:id", requireViewer, async (context) => {
 		const automation = await readViewerAutomationSummary(context.get("viewer"), context.req.param("id"));
-		return automation ? jsonResponse(automationSummarySchema, automation) : jsonResponse(apiErrorSchema, { error: "Automation was not found." }, { status: 404 });
+		return automation ? jsonResponse(automationSummarySchema, (await attachAutomationMentions(getSqlExecutor(), [automation]))[0]) : jsonResponse(apiErrorSchema, { error: "Automation was not found." }, { status: 404 });
 	});
 	app.delete("/:id", requireViewer, validateRequest("param", automationParamsSchema, "Invalid task."), async (context) => {
 		const user = context.get("viewer");
@@ -4494,6 +4652,7 @@ function view(workspace) {
 		id: workspace.id,
 		name: workspace.name,
 		setupScript: workspace.setupScript,
+		vcpus: workspace.vcpus,
 		repos: workspace.repos.map((repo) => ({
 			provider: repo.provider,
 			repo: repo.repo,
@@ -4519,6 +4678,7 @@ function createWorkspaceRoutes() {
 		const [baselineSnapshot, workspaces] = await Promise.all([baselineSnapshotView(), listWorkspaces(getDb())]);
 		return jsonResponse(workspaceListSchema, {
 			baselineSnapshot,
+			defaultVcpus: getSandboxResources()?.vcpus ?? null,
 			workspaces: workspaces.map(view)
 		});
 	});
@@ -4581,7 +4741,7 @@ function readDescriptionText(home) {
 }
 /** Read discovered skill names for authenticated runtime diagnostics. */
 async function readSkillReports() {
-	const { discoverSkills } = await import("./skills-DyQBLIrK.js").then((n) => n.o);
+	const { discoverSkills } = await import("./skills-D6_bcAuW.js").then((n) => n.o);
 	const skills = await discoverSkills();
 	return skillReportsSchema.parse(skills.map((skill) => ({
 		name: skill.name,
@@ -4590,7 +4750,7 @@ async function readSkillReports() {
 }
 /** Read safe configured plugin metadata for authenticated runtime diagnostics. */
 async function readPlugins() {
-	const { pluginCatalogRuntime } = await import("./catalog-runtime-BN4DVxco.js").then((n) => n.t);
+	const { pluginCatalogRuntime } = await import("./catalog-runtime-Bpcs2b2L.js").then((n) => n.t);
 	return pluginsSchema.parse(pluginCatalogRuntime.getProviders().map((plugin) => ({
 		configKeys: plugin.manifest.configKeys ?? [],
 		description: plugin.manifest.description,
@@ -4602,7 +4762,7 @@ async function readPlugins() {
 async function readRuntimeInfoReport() {
 	const [{ homeDir }, { pluginCatalogRuntime }, plugins, skills] = await Promise.all([
 		import("./package-discovery-DJBompdd.js").then((n) => n.r),
-		import("./catalog-runtime-BN4DVxco.js").then((n) => n.t),
+		import("./catalog-runtime-Bpcs2b2L.js").then((n) => n.t),
 		readPlugins(),
 		readSkillReports()
 	]);
@@ -4619,7 +4779,7 @@ async function readRuntimeInfoReport() {
 /** Read sanitized operational summaries contributed by plugins. */
 async function readPluginOperationalReportFeed() {
 	const nowMs = Date.now();
-	const { getPluginOperationalReports } = await import("./agent-hooks-BJ_5mlRH.js").then((n) => n.t);
+	const { getPluginOperationalReports } = await import("./agent-hooks-V4Hfc2tB.js").then((n) => n.t);
 	return pluginOperationalReportFeedSchema.parse({
 		source: "plugins",
 		generatedAt: new Date(nowMs).toISOString(),
@@ -4643,6 +4803,7 @@ function createJuniorApi(options = {}) {
 	app.route("/api/code", createCodeRoutes());
 	app.route("/api/connections", createConnectionRoutes());
 	app.route("/api/personal-tokens", createPersonalTokenRoutes());
+	app.route("/api/service-accounts", createServiceAccountRoutes());
 	app.route("/api/people", createPeopleRoutes());
 	app.route("/api/locations", createLocationRoutes());
 	app.route("/api/user-pages", createUserPageRoutes());

package/dist/{app-PX2H1PxU.d.ts → app-BsBUs3rF.d.ts}

@@ -1,18 +1,19 @@
 import { n as ConversationWorkQueue, t as ConversationQueueMessage } from "./queue-C37RbDVc.js";
 import { t as ConversationStore } from "./store-CG0VJyye.js";
 import "./history-BgI33Kie.js";
-import { n as JuniorPluginSet } from "./plugins-B11Mfkmv.js";
+import { n as JuniorPluginSet } from "./plugins-B_0Cr0MO.js";
 import { Hono } from "hono";
 import "@earendil-works/pi-ai/compat";
 import "@earendil-works/pi-ai/api/anthropic-messages";
+import "ai";
 import { z } from "zod";
 import { Destination, OwnedObjectAnnotation, PluginRegistration, Source, User } from "@sentry/junior-plugin-api";
 import "@earendil-works/pi-agent-core";
+import { Sandbox } from "@vercel/sandbox";
 import "@earendil-works/pi-ai";
 import "@sinclair/typebox";
-import { Sandbox } from "@vercel/sandbox";
-import { Client } from "@modelcontextprotocol/sdk/client";
 import "@modelcontextprotocol/sdk/client/auth.js";
+import { Client } from "@modelcontextprotocol/sdk/client";
 import { Message, StateAdapter } from "chat";
 import "@chat-adapter/slack";
 declare const TURN_REASONING_LEVELS: readonly ["none", "low", "medium", "high", "xhigh"];
@@ -31,6 +32,8 @@ interface ModelProfileConfig {
 /** App-level profile input: a model id string or a full profile config. */
 type ModelProfileInput = string | ModelProfileConfig;
 interface BotModelConfig {
+  /** Decision model used by the passive reply router. */
+  decisionModelId?: string;
   /** Model used for embeddings. */
   embeddingModelId?: string;
   /** Model used for low-cost structured and utility calls. */

package/dist/app.d.ts

@@ -1,4 +1,4 @@
-import { i as ModelProfileInput, n as createApp, r as JuniorDashboardOptions, t as JuniorAppOptions } from "./app-PX2H1PxU.js";
-import { i as defineJuniorPlugins, n as JuniorPluginSet, r as JuniorPluginSetOptions, t as JuniorPluginInput } from "./plugins-B11Mfkmv.js";
+import { i as ModelProfileInput, n as createApp, r as JuniorDashboardOptions, t as JuniorAppOptions } from "./app-BsBUs3rF.js";
+import { i as defineJuniorPlugins, n as JuniorPluginSet, r as JuniorPluginSetOptions, t as JuniorPluginInput } from "./plugins-B_0Cr0MO.js";
 import { t as JUNIOR_VERSION } from "./version-Cc2OFd9G.js";
 export { JUNIOR_VERSION, JuniorAppOptions, type JuniorDashboardOptions, type JuniorPluginInput, type JuniorPluginSet, type JuniorPluginSetOptions, type ModelProfileInput, createApp, defineJuniorPlugins };

package/dist/app.js

@@ -1,39 +1,37 @@
-import { At as consumeSandboxEgressPermissionDeniedSignal, B as effectiveTaskOutcomes, Ct as ingestEvent, Dt as SANDBOX_EGRESS_PROXY_PATH, E as requestAttachmentDeletion, Et as shouldPropagateSandboxEgressTrace, F as logScheduledAutomationRunSkipped, Ft as resolveBaseUrl, I as scheduledAutomationRunAttributes, It as startOAuthFlow, Kt as getConfigDefaults, Lt as createUserTokenStore, Nt as formatProviderLabel, O as parseSlackThreadId, Ot as clearSandboxEgressSignals, St as processWorkspaceSnapshotJob, Tt as normalizeSandboxEgressTracePropagationDomains, U as stopConversationSession, W as recordSubagentEnded, b as unpublishedArtifactHeaders, i as executeCredentialedEgressRequest, jt as parseSandboxEgressCredentialToken, kt as consumeSandboxEgressAuthRequiredSignal, lt as listPendingAgentInvocationMailboxAppends, n as executeAgentRun, qt as setConfigDefaults, t as createAgentRunner, ut as listPendingAgentInvocationResults, v as publicArtifactHeaders, w as collectAttachmentGarbage, wt as resolveSandboxEgressProviderForHost, x as lookupSlackUserProfile, y as readPublicArtifact } from "./agent-runner-DGsFQw72.js";
-import { C as withContext, M as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, R as normalizeIdentityEmail, T as withSpan, b as setSpanStatus, f as logException, k as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE, m as logWarn, p as logInfo, r as createRequestContext, v as setSentryUser, w as withLogContext, y as setSpanAttributes } from "./logging-DsHONhVm.js";
+import { $ as projectConversationMessages, C as automationVersionOf, Cn as resolveSandboxEgressProviderForHost, Dn as clearSandboxEgressSignals, En as SANDBOX_EGRESS_PROXY_PATH, Hn as slackMention, In as resolveBaseUrl, Ln as startOAuthFlow, On as consumeSandboxEgressAuthRequiredSignal, Pn as formatProviderLabel, Tn as shouldPropagateSandboxEgressTrace, X as appendConversationMessages, Xn as slackEntitySchema, Zn as slackExternalRefIdSchema, _n as isExperimentalFeatureEnabled, ar as setConfigDefaults, b as admitEventAutomationRun, bn as createUserTokenStore, c as withScheduledAutomationLock, cn as SubscribedReplyReason, dn as getThreadStopDecision, gn as getExperimentalFeatures, i as readScheduledAutomation, ir as getConfigDefaults, jn as parseSandboxEgressCredentialToken, kn as consumeSandboxEgressPermissionDeniedSignal, l as blockEventAutomation, n as listScheduledAutomationsForTeam, nt as settleConversationTitleWork, o as saveScheduledAutomationInLock, p as findMatchingEventAutomations, s as scheduledRunId, u as collectEventAutomationMatchKeys, vn as setExperimentalFeatures, wn as normalizeSandboxEgressTracePropagationDomains, x as eventAutomationRunLimitReason, yn as executeCredentialedEgressRequest } from "./tasks-CjrS098O.js";
+import { C as withContext, M as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, R as normalizeIdentityEmail, T as withSpan, b as setSpanStatus, f as logException, k as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE, m as logWarn, p as logInfo, r as createRequestContext, v as setSentryUser, w as withLogContext, y as setSpanAttributes } from "./logging-DSMmkHXG.js";
 import { n as captureMessage, r as continueTrace } from "./sentry-BBUlHih9.js";
-import { t as JUNIOR_VERSION } from "./version-C0U6rHg0.js";
-import { _ as snapshotRuntimeConfig, d as restoreRuntimeConfig, f as setBotModelConfig, g as setSlackReactionConfig, h as setRuntimeLimits, i as getChatConfig, m as setProfiles, n as botConfig, o as getSlackBotToken, p as setCrossActorMidRunMode, u as resetRuntimeConfig } from "./config-_WO_AjCB.js";
+import { t as JUNIOR_VERSION } from "./version-Ct049vav.js";
+import { _ as snapshotRuntimeConfig, d as restoreRuntimeConfig, f as setBotModelConfig, g as setSlackReactionConfig, h as setRuntimeLimits, i as getChatConfig, m as setProfiles, n as botConfig, o as getSlackBotToken, p as setCrossActorMidRunMode, u as resetRuntimeConfig } from "./config-ULs6Zl9b.js";
 import { _ as slackMessageTsSchema, d as parseSlackTeamId, f as parseSlackUserId, h as slackUserIdSchema, m as slackTeamIdSchema, o as parseActorUserId, p as slackChannelIdSchema } from "./actor-tlxzqaRe.js";
-import { N as recordGoogleSignIn, _ as withConversationMutationLock, c as getConversationEventStore, d as getDb, f as getSqlExecutor, m as withConversationEventLock, r as readActorIdentity, u as getConversationStore } from "./viewer-CGvvRqKp.js";
+import { N as recordGoogleSignIn, _ as withConversationMutationLock, c as getConversationEventStore, d as getDb, f as getSqlExecutor, m as withConversationEventLock, r as readActorIdentity, u as getConversationStore } from "./viewer-C-J0ewlH.js";
 import { a as juniorAgentInvocations, d as juniorDestinations, i as juniorAgentBindings, s as juniorConversations } from "./agent-invocations-Qfz7dWgU.js";
-import { a as juniorAutomationRuns, f as juniorConversationBriefs, h as juniorConversationEvents, s as juniorAutomations } from "./executor-RvG6kVe1.js";
-import { m as credentialLogContext } from "./registry-Du566MtJ.js";
-import { n as pluginCatalogRuntime } from "./catalog-runtime-BN4DVxco.js";
-import { C as automationVersionOf, Kt as projectConversationMessages, P as slackMention, U as slackEntitySchema, Ut as appendConversationMessages, W as slackExternalRefIdSchema, Yt as settleConversationTitleWork, b as admitEventAutomationRun, c as withScheduledAutomationLock, i as readScheduledAutomation, l as blockEventAutomation, n as listScheduledAutomationsForTeam, o as saveScheduledAutomationInLock, p as findMatchingEventAutomations, s as scheduledRunId, u as collectEventAutomationMatchKeys, x as eventAutomationRunLimitReason } from "./tasks-CEXKTASS.js";
-import { $ as bindSlackDirectCredentialSubject, At as resolveRootVisibility, Ht as getSlackClient, Jt as getWorkspaceTeamId, Nt as listConversationAnnotations, Q as bindScheduledAutomationCredentialSubject, U as collectEventMatchKeys, Wt as isDmChannel, X as takeDueTimerWatches, Yt as runWithWorkspaceTeamId, Z as bindEventAutomationCredentialSubject, a as getPluginRoutes, at as getDashboardConversationLink, ct as setDashboardConversationLinkOptions, d as setPlugins, et as verifyEventAutomationCredentialSubject, f as validatePlugins, ft as createPluginLogger, h as setBriefsConfig, i as getPluginApiRoutes, lt as createPluginState, nt as verifySlackDirectCredentialSubject, pt as readConversationAccessFromSql, q as findMatchingWatches, st as getDashboardTaskLink, tt as verifyScheduledAutomationCredentialSubject, u as getPlugins } from "./agent-hooks-BJ_5mlRH.js";
-import { W as annotationCard } from "./conversation-DjN3mlog.js";
-import { O as withLock$1, w as getStateAdapter } from "./profile-DpYjfKke.js";
-import { l as getThreadStopDecision, o as SubscribedReplyReason } from "./pending-auth-D8J1uJUS.js";
-import { b as eventGuidance, f as slackChannelMessageEvent, k as renderTaskInput, l as getEventCatalog, m as slackChannelMessageRunsAutomation, p as slackChannelMessageReplyThreadTs, u as SLACK_EVENT_NAMESPACE } from "./session-stop-CIoFiwwe.js";
+import { a as juniorAutomationRuns, f as juniorConversationBriefs, h as juniorConversationEvents, s as juniorAutomations } from "./executor-BoGNVEDn.js";
+import { m as credentialLogContext } from "./registry-BL-osYWN.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-Bpcs2b2L.js";
+import { B as stopConversationSession, C as requestAttachmentDeletion, L as effectiveTaskOutcomes, M as logScheduledAutomationRunSkipped, N as scheduledAutomationRunAttributes, T as parseSlackThreadId, V as recordSubagentEnded, _ as unpublishedArtifactHeaders, g as readPublicArtifact, h as publicArtifactHeaders, n as executeAgentRun, ot as listPendingAgentInvocationMailboxAppends, st as listPendingAgentInvocationResults, t as createAgentRunner, v as lookupSlackUserProfile, vt as processWorkspaceSnapshotJob, x as collectAttachmentGarbage, yt as ingestEvent } from "./agent-runner-DvTUyGTY.js";
+import { $ as bindSlackDirectCredentialSubject, Gt as listConversationAnnotations, Ht as resolveRootVisibility, Q as bindScheduledAutomationCredentialSubject, Tt as readConversationAccessFromSql, U as collectEventMatchKeys, X as takeDueTimerWatches, Z as bindEventAutomationCredentialSubject, _t as getDashboardConversationLink, a as getPluginRoutes, bt as setDashboardConversationLinkOptions, ct as getSlackClient, d as setPlugins, et as verifyEventAutomationCredentialSubject, f as validatePlugins, h as setBriefsConfig, ht as runWithWorkspaceTeamId, i as getPluginApiRoutes, mt as getWorkspaceTeamId, nt as verifySlackDirectCredentialSubject, q as findMatchingWatches, tt as verifyScheduledAutomationCredentialSubject, u as getPlugins, ut as isDmChannel, wt as createPluginLogger, xt as createPluginState, yt as getDashboardTaskLink } from "./agent-hooks-V4Hfc2tB.js";
 import { n as getNextRunAtMs } from "./cadence-R7Em4RjE.js";
-import { f as setSandboxResourceConfig, u as getSandboxResourceConfig } from "./resolve-ClCIgh8E.js";
-import { a as getVercelConversationWorkQueue, g as isConversationQueueMessageRejectedError, h as conversationQueueMessageSchema, i as verifyWorkspaceSnapshotJobMessage, o as resolveConversationWorkQueueTopic, s as verifyConversationQueueMessage, t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-DVe37it2.js";
-import { A as hasRunnableConversationWork$1, M as isInvalidConversationRecordError, O as CONVERSATION_WORK_STALE_ENQUEUE_MS, S as removeActiveConversation, _ as hasRunnableConversationWork, c as clearExpiredConversationLease, g as getConversationWorkState, h as getConversation, m as ensureConversationWake, r as appendAndEnqueueInboundMessage, v as listActiveConversationIds } from "./store-DJLwq4x8.js";
-import { D as scheduledRunSchema } from "./automation-DWBFBenG.js";
-import { i as setExperimentalFeatures, n as getExperimentalFeatures, r as isExperimentalFeatureEnabled } from "./experimental-BNK1l1jv.js";
-import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "./validation-BHRxa5G4.js";
+import { M as annotationCard } from "./conversation-CvuKJ3tA.js";
+import { r as getStateAdapter, s as withLock$1 } from "./adapter-Dj5BTJRd.js";
+import { M as renderTaskInput, S as eventGuidance, d as getEventCatalog, f as SLACK_EVENT_NAMESPACE, g as slackChannelMessageRunsAutomation, h as slackChannelMessageReplyThreadTs, m as slackChannelMessageEvent } from "./session-stop-HfKx-pky.js";
+import { f as setSandboxResourceConfig, u as getSandboxResourceConfig } from "./resolve-HuPG2VMB.js";
+import { a as getVercelConversationWorkQueue, g as isConversationQueueMessageRejectedError, h as conversationQueueMessageSchema, i as verifyWorkspaceSnapshotJobMessage, o as resolveConversationWorkQueueTopic, s as verifyConversationQueueMessage, t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-CbdVyaCo.js";
+import { A as hasRunnableConversationWork$1, M as isInvalidConversationRecordError, O as CONVERSATION_WORK_STALE_ENQUEUE_MS, S as removeActiveConversation, _ as hasRunnableConversationWork, c as clearExpiredConversationLease, g as getConversationWorkState, h as getConversation, m as ensureConversationWake, r as appendAndEnqueueInboundMessage, v as listActiveConversationIds } from "./store-DzRbd5VT.js";
+import { D as scheduledRunSchema } from "./automation-DrpcA-SX.js";
+import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "./validation-BrXMYPyo.js";
 import { a as pluginRuntimeRegistrationsFromPluginSet, n as pluginCatalogConfigFromEnv, r as pluginCatalogConfigFromPluginSet, t as defineJuniorPlugins } from "./plugins-DOm9Y6qI.js";
-import { A as THREAD_OPTOUT_ACK, C as buildSlackInboundMessage, D as normalizeIncomingSlackThreadId, E as stopSlackThread, F as renderSlackObjectCard, I as createVercelAttachmentStorage, M as parseContent, N as runWithSlackInstallation, O as withNormalizedThreadId, P as verifySlackSignature, R as enqueueAgentDispatch, S as recordSkippedConversationMessage, T as isSlackMessageStopped, a as recordWebConversationActivity, c as createProductionSlackWebhookServices, f as createSlackWebApiStatusSender, j as startProcessingReaction, k as stopConversationTurn, l as getProductionSlackAdapter, n as conversationTurnIdForMessage, o as webActorFromEmail, s as createProductionConversationWorkOptions, t as appendAndEnqueueWebMessage, v as readViewerAutomationSummary, w as clearSlackPendingReactions, z as GET$3 } from "./web-input-Keb5GRWj.js";
-import { C as existingConversationId, N as recordAutomationExecution, c as getDispatchConversationId, d as getDispatchRecord, h as listPendingDispatchMailboxAppends, i as buildDispatchId, m as isTerminalDispatchStatus, o as confirmDispatchMailboxAppend, p as getPluginDispatchProjection, s as createOrGetDispatch, t as processPluginTask, x as notifyAutomationBlocked, y as markDispatchFailed } from "./task-runner-D3qJh4fK.js";
-import { o as getAuthPausedConversationTurnId, t as enqueueAgentInvocationResult } from "./result-BBbKA61B.js";
-import { r as enqueueAgentInvocation } from "./work-DRcsJ3hV.js";
-import { s as coerceThreadConversationState } from "./thread-state-W3f6kAtz.js";
-import { o as unlinkProvider } from "./connections-ag_1JOhB.js";
-import { a as GET$4, i as publishAppHomeView, r as GET$5, t as receiveLocalOAuthCredential } from "./credential-sync-B-CPX_ag.js";
-import { a as registerVercelPluginTaskDevConsumer, n as createVercelPluginTaskCallback, s as queueCallback } from "./task-queue-BzW4MaWU.js";
-import { t as processConversationWork } from "./worker-Cjo-QqPq.js";
-import { t as bindMessageAgent } from "./message-DyitL8no.js";
-import { t as bindSpawnAgent } from "./spawn-Dqfeo7XP.js";
+import { A as THREAD_OPTOUT_ACK, C as buildSlackInboundMessage, D as normalizeIncomingSlackThreadId, E as stopSlackThread, F as renderSlackObjectCard, I as createVercelAttachmentStorage, M as parseContent, N as runWithSlackInstallation, O as withNormalizedThreadId, P as verifySlackSignature, R as enqueueAgentDispatch, S as recordSkippedConversationMessage, T as isSlackMessageStopped, a as recordWebConversationActivity, c as createProductionSlackWebhookServices, f as createSlackWebApiStatusSender, j as startProcessingReaction, k as stopConversationTurn, l as getProductionSlackAdapter, n as conversationTurnIdForMessage, o as webActorFromEmail, s as createProductionConversationWorkOptions, t as appendAndEnqueueWebMessage, v as readViewerAutomationSummary, w as clearSlackPendingReactions, z as GET$3 } from "./web-input-C_xB3RXp.js";
+import { C as existingConversationId, N as recordAutomationExecution, c as getDispatchConversationId, d as getDispatchRecord, h as listPendingDispatchMailboxAppends, i as buildDispatchId, m as isTerminalDispatchStatus, o as confirmDispatchMailboxAppend, p as getPluginDispatchProjection, s as createOrGetDispatch, t as processPluginTask, x as notifyAutomationBlocked, y as markDispatchFailed } from "./task-runner-DGnd_B5X.js";
+import { o as getAuthPausedConversationTurnId, t as enqueueAgentInvocationResult } from "./result-DS7V4a3-.js";
+import { r as enqueueAgentInvocation } from "./work-D829Ue7k.js";
+import { s as coerceThreadConversationState } from "./thread-state-CqkYowEz.js";
+import { o as unlinkProvider } from "./connections-CZ7HhEmN.js";
+import { a as GET$4, i as publishAppHomeView, r as GET$5, t as receiveLocalOAuthCredential } from "./credential-sync-BKcv5rBe.js";
+import { a as registerVercelPluginTaskDevConsumer, n as createVercelPluginTaskCallback, s as queueCallback } from "./task-queue-9LICOzcL.js";
+import { t as processConversationWork } from "./worker-BRTYzlpk.js";
+import { t as bindMessageAgent } from "./message-zaj5gBbS.js";
+import { t as bindSpawnAgent } from "./spawn-BWqK6EwM.js";
 import { createRequire } from "node:module";
 import { Hono } from "hono";
 import { z } from "zod";
@@ -5297,6 +5295,8 @@ function dashboardHostRoutePaths(dashboard, authenticatedRoutes = []) {
 		"/api/people/*",
 		"/api/personal-tokens",
 		"/api/personal-tokens/*",
+		"/api/service-accounts",
+		"/api/service-accounts/*",
 		"/api/workspaces",
 		"/api/workspaces/*",
 		"/api/config",

package/dist/{assistant-reply-H1M-91oF.js → assistant-reply-CEOMzsWy.js}

@@ -1,4 +1,4 @@
-import { ct as extractAssistantText } from "./tasks-CEXKTASS.js";
+import { Gt as extractAssistantText } from "./tasks-CjrS098O.js";
 // src/chat/no-reply.ts
 const NO_REPLY_MARKER = "[[NO_REPLY]]";
 /**