@sentry/junior 0.29.0 → 0.31.0

package/dist/app.js

@@ -2,9 +2,8 @@ import {
   discoverSkills,
   findSkillByName,
   loadSkillsByName,
-  logCapabilityCatalogLoadedOnce,
   parseSkillInvocation
-} from "./chunk-ICIRAL6Y.js";
+} from "./chunk-3SH2A7VQ.js";
 import {
   GEN_AI_PROVIDER_NAME,
   MISSING_GATEWAY_CREDENTIALS_ERROR,
@@ -40,6 +39,8 @@ import {
   createRequestContext,
   extractGenAiUsageSummary,
   getActiveTraceId,
+  getPluginCapabilityProviders,
+  getPluginCatalogSignature,
   getPluginDefinition,
   getPluginMcpProviders,
   getPluginOAuthConfig,
@@ -392,6 +393,26 @@ function defaultConversationState() {
     }
   };
 }
+function coercePendingAuthState(value) {
+  if (!isRecord(value)) {
+    return void 0;
+  }
+  const kind = value.kind;
+  const provider = toOptionalString(value.provider);
+  const requesterId = toOptionalString(value.requesterId);
+  const sessionId = toOptionalString(value.sessionId);
+  const linkSentAtMs = toOptionalNumber(value.linkSentAtMs);
+  if (kind !== "mcp" && kind !== "plugin" || !provider || !requesterId || !sessionId || typeof linkSentAtMs !== "number") {
+    return void 0;
+  }
+  return {
+    kind,
+    provider,
+    requesterId,
+    sessionId,
+    linkSentAtMs
+  };
+}
 function coerceThreadConversationState(value) {
   if (!isRecord(value)) {
     return defaultConversationState();
@@ -442,7 +463,8 @@ function coerceThreadConversationState(value) {
   const rawProcessing = isRecord(rawConversation.processing) ? rawConversation.processing : {};
   const processing = {
     activeTurnId: toOptionalString(rawProcessing.activeTurnId),
-    lastCompletedAtMs: toOptionalNumber(rawProcessing.lastCompletedAtMs)
+    lastCompletedAtMs: toOptionalNumber(rawProcessing.lastCompletedAtMs),
+    pendingAuth: coercePendingAuthState(rawProcessing.pendingAuth)
   };
   const rawStats = isRecord(rawConversation.stats) ? rawConversation.stats : {};
   const stats = {
@@ -2001,11 +2023,13 @@ function buildThreadParticipants(messages) {
   return participants;
 }
 
-// src/chat/runtime/turn.ts
+// src/chat/state/turn-id.ts
 function buildDeterministicTurnId(messageId) {
   const sanitized = messageId.replace(/[^a-zA-Z0-9_-]/g, "_");
   return `turn_${sanitized}`;
 }
+
+// src/chat/runtime/turn.ts
 var RetryableTurnError = class extends Error {
   code = "retryable_turn";
   metadata;
@@ -2031,12 +2055,16 @@ function startActiveTurn(args) {
   args.updateConversationStats(args.conversation);
 }
 function markTurnCompleted(args) {
-  args.conversation.processing.activeTurnId = void 0;
+  if (!args.sessionId || args.conversation.processing.activeTurnId === args.sessionId) {
+    args.conversation.processing.activeTurnId = void 0;
+  }
   args.conversation.processing.lastCompletedAtMs = args.nowMs;
   args.updateConversationStats(args.conversation);
 }
 function markTurnFailed(args) {
-  args.conversation.processing.activeTurnId = void 0;
+  if (!args.sessionId || args.conversation.processing.activeTurnId === args.sessionId) {
+    args.conversation.processing.activeTurnId = void 0;
+  }
   args.conversation.processing.lastCompletedAtMs = args.nowMs;
   args.markConversationMessage(args.conversation, args.userMessageId, {
     replied: false,
@@ -2856,18 +2884,21 @@ function formatConfigurationValue(value) {
 function renderIdentityBlock(tag, fields) {
   const lines = Object.entries(fields).filter(([, value]) => Boolean(value)).map(([key, value]) => `- ${key}: ${escapeXml(value)}`);
   if (lines.length === 0) {
-    return [`<${tag}>`, "none", `</${tag}>`].join("\n");
+    return [`<${tag}>`, "none", `</${tag}>`];
   }
-  return [`<${tag}>`, ...lines, `</${tag}>`].join("\n");
+  return [`<${tag}>`, ...lines, `</${tag}>`];
+}
+function renderTag(tag, lines) {
+  return [`<${tag}>`, ...lines, `</${tag}>`];
 }
-function renderTag(tag, content) {
+function renderTagBlock(tag, content) {
   return [`<${tag}>`, content, `</${tag}>`].join("\n");
 }
 function formatAvailableSkillsForPrompt(skills) {
   if (skills.length === 0) {
-    return "<available_skills>\n</available_skills>";
+    return "<available-skills>\n</available-skills>";
   }
-  const lines = ["<available_skills>"];
+  const lines = ["<available-skills>"];
   for (const skill of skills) {
     const skillLocation = `${workspaceSkillDir(skill.name)}/SKILL.md`;
     lines.push("  <skill>");
@@ -2879,45 +2910,37 @@ function formatAvailableSkillsForPrompt(skills) {
     if (skill.pluginProvider) {
       lines.push(`    <provider>${escapeXml(skill.pluginProvider)}</provider>`);
     }
-    if (skill.usesConfig && skill.usesConfig.length > 0) {
-      lines.push(
-        `    <uses_config>${escapeXml(skill.usesConfig.join(" "))}</uses_config>`
-      );
-    }
     lines.push("  </skill>");
   }
-  lines.push("</available_skills>");
+  lines.push("</available-skills>");
   return lines.join("\n");
 }
 function formatLoadedSkillsForPrompt(skills) {
   if (skills.length === 0) {
-    return "<loaded_skills>\n</loaded_skills>";
+    return "<loaded-skills>\n</loaded-skills>";
   }
-  const lines = ["<loaded_skills>"];
+  const lines = ["<loaded-skills>"];
   for (const skill of skills) {
     const skillDir = workspaceSkillDir(skill.name);
     lines.push(
       `  <skill name="${escapeXml(skill.name)}" location="${escapeXml(`${skillDir}/SKILL.md`)}">`
     );
     lines.push(`References are relative to ${escapeXml(skillDir)}.`);
-    if (skill.usesConfig && skill.usesConfig.length > 0) {
-      lines.push(
-        `Uses config keys: ${escapeXml(skill.usesConfig.join(", "))}.`
-      );
-    }
     lines.push("");
     lines.push(skill.body);
     lines.push("  </skill>");
   }
-  lines.push("</loaded_skills>");
+  lines.push("</loaded-skills>");
   return lines.join("\n");
 }
 function formatProviderCatalogForPrompt() {
   const providers = getPluginProviders().map((plugin) => plugin.manifest);
   if (providers.length === 0) {
-    return "- none";
+    return null;
   }
-  const lines = [];
+  const lines = [
+    "Config keys and default targets per provider; use after a skill is loaded."
+  ];
   for (const provider of providers) {
     lines.push(`- provider: ${escapeXml(provider.name)}`);
     lines.push(
@@ -2931,288 +2954,260 @@ function formatProviderCatalogForPrompt() {
   }
   return lines.join("\n");
 }
-function baseSystemPrompt() {
-  return [
-    "You are a Slack-based helper assistant.",
-    "Identity, tone, and domain defaults are defined in the personality block.",
-    "",
-    "- Be concise, practical, and specific.",
-    "- Prefer actionable next steps over generic explanations.",
-    "- When the user gives a clear task, execute it immediately in this turn.",
-    "- Do not ask for permission to proceed when the request is already clear.",
-    "- Keep user-visible progress communication concise and useful.",
-    "- In thread follow-ups, answer using prior thread context directly; do not repeat unresolved clarifying questions unless the user asks to refine.",
-    "- If the user asks what you just said or means by the previous answer, summarize your prior assistant reply plainly.",
-    "- Never ask the user to re-tag or re-invoke for a clear task; continue execution in this turn.",
-    "- Never claim you cannot access tools in this turn. If prior results are empty, run tools now.",
-    "- If critical input is missing and cannot be discovered with tools, ask one direct clarifying question.",
-    "- Always gather evidence from available sources (tools or skills) before answering factual questions.",
-    "- When a loaded skill exposes MCP capabilities, those tools are registered as callable tools. Call them directly by name.",
-    "- Use `searchTools` only when you need to rediscover or filter active MCP tools.",
-    "- Never guess. If you cannot verify with available sources, say it is unverified.",
-    "- Never claim a lookup succeeded unless a tool result supports it.",
-    "- Do not give up when unsure how to do something; find a viable path, gather evidence, and provide the best actionable way forward.",
-    "- When active skills are present, follow their instructions before default behavior."
-  ].join("\n");
+function formatActiveMcpCatalogsForPrompt(catalogs) {
+  if (catalogs.length === 0) {
+    return null;
+  }
+  const lines = [
+    "Active MCP provider catalogs are available through `searchMcpTools`. Call it with provider to list descriptors or with query to narrow results, then pass the exact returned `tool_name` to `callMcpTool`."
+  ];
+  for (const catalog of catalogs) {
+    lines.push("  <catalog>");
+    lines.push(`    <provider>${escapeXml(catalog.provider)}</provider>`);
+    lines.push(
+      `    <available_tool_count>${catalog.available_tool_count}</available_tool_count>`
+    );
+    lines.push("  </catalog>");
+  }
+  return lines.join("\n");
 }
-function formatReferenceFilesSection() {
+function formatReferenceFilesLines() {
   const files = listReferenceFiles();
   if (files.length === 0) {
-    return [];
+    return null;
   }
-  const fileNames = files.map((filePath) => {
+  return files.map((filePath) => {
     const name = path2.basename(filePath);
     return `- ${escapeXml(name)} (${escapeXml(`${SANDBOX_DATA_ROOT}/${name}`)})`;
   });
-  return [
-    renderTag(
-      "reference-files",
-      [
-        "Additional reference documents available in the sandbox. Read them with `readFile` when relevant.",
-        ...fileNames
-      ].join("\n")
-    )
-  ];
 }
-function buildSystemPrompt(params) {
-  const {
-    availableSkills,
-    activeSkills,
-    activeTools,
-    invocation,
-    requester,
-    assistant,
-    artifactState,
-    configuration,
-    relevantConfigurationKeys,
-    runtimeMetadata,
-    threadParticipants
-  } = params;
-  const assistantSection = renderIdentityBlock("assistant", {
-    user_name: assistant?.userName ?? botConfig.userName,
-    user_id: assistant?.userId
-  });
-  const requesterSection = renderIdentityBlock("requester", {
-    full_name: requester?.fullName,
-    user_name: requester?.userName,
-    user_id: requester?.userId
-  });
-  const availableSkillsSection = [
-    "The following skills provide specialized instructions for specific tasks.",
-    "Call `loadSkill` when the task matches a skill description.",
-    "When a skill references a relative path, resolve it against `skill_dir` and use that path with `bash`.",
-    "",
-    formatAvailableSkillsForPrompt(availableSkills)
-  ].join("\n");
-  const activeSkillsSection = [
-    "Loaded skills for this turn:",
-    formatLoadedSkillsForPrompt(activeSkills)
-  ].join("\n");
-  const activeToolNames = (activeTools ?? []).map((tool2) => tool2.tool_name);
-  const activeToolsSection = activeToolNames.length > 0 ? `Active MCP tools registered for this turn: ${activeToolNames.join(", ")}. Call them directly by name.` : "";
-  const configurationKeys = Object.keys(configuration ?? {}).sort(
+function formatArtifactsLines(artifactState) {
+  if (!artifactState) return null;
+  const lines = [];
+  if (artifactState.lastCanvasId) {
+    lines.push(`- last_canvas_id: ${escapeXml(artifactState.lastCanvasId)}`);
+  }
+  if (artifactState.lastCanvasUrl) {
+    lines.push(`- last_canvas_url: ${escapeXml(artifactState.lastCanvasUrl)}`);
+  }
+  if (artifactState.recentCanvases && artifactState.recentCanvases.length > 0) {
+    lines.push("- recent_canvases:");
+    for (const canvas of artifactState.recentCanvases) {
+      lines.push(`  - id: ${escapeXml(canvas.id)}`);
+      if (canvas.title) lines.push(`    title: ${escapeXml(canvas.title)}`);
+      if (canvas.url) lines.push(`    url: ${escapeXml(canvas.url)}`);
+      if (canvas.createdAt) {
+        lines.push(`    created_at: ${escapeXml(canvas.createdAt)}`);
+      }
+    }
+  }
+  if (artifactState.lastListId) {
+    lines.push(`- last_list_id: ${escapeXml(artifactState.lastListId)}`);
+  }
+  if (artifactState.lastListUrl) {
+    lines.push(`- last_list_url: ${escapeXml(artifactState.lastListUrl)}`);
+  }
+  return lines.length > 0 ? lines : null;
+}
+function formatConfigurationLines(configuration) {
+  const keys = Object.keys(configuration ?? {}).sort(
     (a, b) => a.localeCompare(b)
   );
-  const relevantConfigSet = new Set(
-    (relevantConfigurationKeys ?? []).filter(
-      (key) => Object.prototype.hasOwnProperty.call(configuration ?? {}, key)
-    )
+  if (keys.length === 0) return null;
+  return keys.map(
+    (key) => `- ${escapeXml(key)}: ${formatConfigurationValue(configuration?.[key])}`
+  );
+}
+function formatThreadParticipantsLines(participants) {
+  if (!participants || participants.length === 0) return null;
+  return participants.map((p) => {
+    const parts = [];
+    if (p.userId) {
+      parts.push(`user_id: ${escapeXml(p.userId)}`);
+      parts.push(`slack_mention: <@${p.userId}>`);
+    }
+    if (p.userName) parts.push(`user_name: ${escapeXml(p.userName)}`);
+    if (p.fullName) parts.push(`full_name: ${escapeXml(p.fullName)}`);
+    return `- ${parts.join(", ")}`;
+  });
+}
+var HEADER = "You are a Slack-based helper assistant. The behavior and output blocks below are authoritative; the personality block sets voice only.";
+var BEHAVIOR_RULES = [
+  "- Load the best-matching skill/tool when relevant, then use it before answering; do not preload multiple skills or claim tool use that did not happen.",
+  "- After `loadSkill`, resolve references under `skill_dir`; for active MCP catalogs, use `searchMcpTools` then `callMcpTool` with exact returned tool names.",
+  "- Default to acting in-turn: use relevant available skills/tools to satisfy the request, continue until done or blocked, and only ask the user when access or required input is missing. If a fact cannot be verified, say so.",
+  "- In thread follow-ups, answer from prior thread context; do not repeat resolved clarifying questions.",
+  "- Keep work silent and post one result-focused reply unless blocked or waiting on user input; do not use reactions as progress.",
+  "- Do not claim an attachment, canvas, or channel post succeeded unless the tool returned success this turn; when it did, include any link the tool returned.",
+  "- Run authenticated provider commands directly; resolve target defaults first and let the runtime handle auth pauses/resumes.",
+  "- On resumed turns, post a brief continuation notice, then the resumed answer as a separate message.",
+  "- For tool/runtime failures, run the named check before diagnosing and report the exact failed command plus stderr/exit code.",
+  "- Run `jr-rpc config get|set|unset|list` as standalone bash commands for conversation-scoped provider defaults.",
+  "- For explicit channel-post or emoji-reaction requests, skip the text reply."
+];
+function buildOutputSection() {
+  const openTag = `<output format="slack-mrkdwn" max_inline_chars="${slackOutputPolicy.maxInlineChars}" max_inline_lines="${slackOutputPolicy.maxInlineLines}">`;
+  return [
+    openTag,
+    "- Use Slack-friendly mrkdwn: bolded section labels instead of headings, no markdown tables or markdown links, and plain URLs.",
+    "- Keep replies brief and scannable; use bullets or short code blocks when helpful, and one compact thread reply when it fits.",
+    "- When a research or document-style answer would benefit from continuation, multiple sections, or future reference value, create a Slack canvas and keep the thread reply to a short summary plus the canvas link.",
+    "- End every turn with a final user-facing markdown response.",
+    "</output>"
+  ].join("\n");
+}
+function buildContextSection(params) {
+  const blocks = [];
+  if (JUNIOR_WORLD) {
+    blocks.push(renderTag("world", [JUNIOR_WORLD.trim()]));
+  }
+  const referenceLines = formatReferenceFilesLines();
+  if (referenceLines) {
+    blocks.push(
+      renderTag("reference-files", [
+        "Additional reference documents available in the sandbox. Read them with `readFile` when relevant.",
+        ...referenceLines
+      ])
+    );
+  }
+  const runtimeVersion = getRuntimeMetadata().version;
+  if (runtimeVersion) {
+    blocks.push([`<runtime version="${escapeXml(runtimeVersion)}" />`]);
+  }
+  blocks.push(
+    renderIdentityBlock("assistant", {
+      user_name: params.assistant?.userName ?? botConfig.userName,
+      user_id: params.assistant?.userId
+    })
   );
-  const relevantConfigLines = configurationKeys.filter((key) => relevantConfigSet.has(key)).map(
-    (key) => `  - ${escapeXml(key)}: ${formatConfigurationValue(configuration?.[key])}`
+  blocks.push(
+    renderIdentityBlock("requester", {
+      full_name: params.requester?.fullName,
+      user_name: params.requester?.userName,
+      user_id: params.requester?.userId
+    })
   );
-  const otherConfigLines = configurationKeys.filter((key) => !relevantConfigSet.has(key)).map(
-    (key) => `  - ${escapeXml(key)}: ${formatConfigurationValue(configuration?.[key])}`
+  const participantLines = formatThreadParticipantsLines(
+    params.threadParticipants
   );
-  const configurationSection = [
-    "Use these conversation-scoped defaults when the user has not provided explicit values in this turn.",
-    "If explicit user input conflicts with configuration, follow explicit user input.",
-    configurationKeys.length === 0 ? "- none" : [
-      ...relevantConfigLines.length > 0 ? ["- relevant_for_active_skills:", ...relevantConfigLines] : [],
-      ...otherConfigLines.length > 0 ? ["- other_available_keys:", ...otherConfigLines] : []
-    ].join("\n")
-  ].join("\n");
+  if (participantLines) {
+    blocks.push(
+      renderTag("thread-participants", [
+        "Known participants. When you mention one of these people, use the provided `<@USERID>` token exactly; do not write a bare `@name`.",
+        ...participantLines
+      ])
+    );
+  }
+  const artifactLines = formatArtifactsLines(params.artifactState);
+  if (artifactLines) {
+    blocks.push(renderTag("artifacts", artifactLines));
+  }
+  const configLines = formatConfigurationLines(params.configuration);
+  if (configLines) {
+    blocks.push(
+      renderTag("configuration", [
+        "Conversation-scoped defaults. Follow explicit user input when it conflicts.",
+        ...configLines
+      ])
+    );
+  }
+  if (params.turnState === "resumed") {
+    blocks.push([
+      "<turn-state>resumed</turn-state>",
+      "This turn continues from a prior checkpoint. Prior tool results and assistant messages are already in the conversation history."
+    ]);
+  }
+  if (params.invocation) {
+    blocks.push([
+      `<explicit-skill-trigger>/${escapeXml(params.invocation.skillName)}</explicit-skill-trigger>`
+    ]);
+  }
+  const body = blocks.map((block) => block.join("\n")).join("\n\n");
+  return renderTagBlock("context", body);
+}
+function buildCapabilitiesSection(params) {
+  const blocks = [];
+  blocks.push(formatAvailableSkillsForPrompt(params.availableSkills));
+  blocks.push(formatLoadedSkillsForPrompt(params.activeSkills));
+  const activeCatalogs = formatActiveMcpCatalogsForPrompt(
+    params.activeMcpCatalogs
+  );
+  if (activeCatalogs) {
+    blocks.push(renderTagBlock("active-mcp-catalogs", activeCatalogs));
+  }
+  const providerCatalog = formatProviderCatalogForPrompt();
+  if (providerCatalog) {
+    blocks.push(renderTagBlock("providers", providerCatalog));
+  }
+  return renderTagBlock("capabilities", blocks.join("\n\n"));
+}
+function buildSystemPrompt(params) {
   const sections = [
-    baseSystemPrompt(),
-    renderTag(
-      "personality",
-      [
-        "Always follow the personality guidance for tone/style unless safety or policy constraints require otherwise.",
-        "",
-        JUNIOR_PERSONALITY.trim()
-      ].join("\n")
-    ),
-    ...JUNIOR_WORLD ? [
-      renderTag(
-        "world",
-        [
-          "Use this as the assistant's operational/domain context.",
-          "",
-          JUNIOR_WORLD.trim()
-        ].join("\n")
-      )
-    ] : [],
-    ...formatReferenceFilesSection(),
-    renderTag(
-      "identity-context",
-      [
-        "Use these blocks as authoritative metadata for identity questions.",
-        assistantSection,
-        requesterSection,
-        ...threadParticipants && threadParticipants.length > 0 ? [
-          renderTag(
-            "thread-participants",
-            [
-              "Known participants in this thread. When you mention one of these people, use the provided Slack mention token exactly as `<@USERID>` and do not write a bare `@name` form.",
-              ...threadParticipants.map((p) => {
-                const parts = [];
-                if (p.userId) {
-                  parts.push(`user_id: ${escapeXml(p.userId)}`);
-                  parts.push(`slack_mention: <@${p.userId}>`);
-                }
-                if (p.userName)
-                  parts.push(`user_name: ${escapeXml(p.userName)}`);
-                if (p.fullName)
-                  parts.push(`full_name: ${escapeXml(p.fullName)}`);
-                return `- ${parts.join(", ")}`;
-              })
-            ].join("\n")
-          )
-        ] : []
-      ].join("\n")
-    ),
-    renderTag(
-      "artifact-context",
-      [
-        "Use this thread-scoped memory for follow-up updates to existing Slack artifacts.",
-        artifactState ? [
-          artifactState.lastCanvasId ? `- last_canvas_id: ${escapeXml(artifactState.lastCanvasId)}` : "- last_canvas_id: none",
-          artifactState.lastCanvasUrl ? `- last_canvas_url: ${escapeXml(artifactState.lastCanvasUrl)}` : "- last_canvas_url: none",
-          artifactState.recentCanvases && artifactState.recentCanvases.length > 0 ? [
-            "- recent_canvases:",
-            ...artifactState.recentCanvases.map(
-              (canvas) => [
-                `  - id: ${escapeXml(canvas.id)}`,
-                canvas.title ? `    title: ${escapeXml(canvas.title)}` : "    title: [unknown]",
-                canvas.url ? `    url: ${escapeXml(canvas.url)}` : "    url: [unknown]",
-                canvas.createdAt ? `    created_at: ${escapeXml(canvas.createdAt)}` : "    created_at: [unknown]"
-              ].join("\n")
-            )
-          ].join("\n") : "- recent_canvases: none",
-          artifactState.lastListId ? `- last_list_id: ${escapeXml(artifactState.lastListId)}` : "- last_list_id: none",
-          artifactState.lastListUrl ? `- last_list_url: ${escapeXml(artifactState.lastListUrl)}` : "- last_list_url: none"
-        ].join("\n") : "- none"
-      ].join("\n")
-    ),
-    renderTag("configuration-context", configurationSection),
-    renderTag(
-      "runtime-metadata",
-      [
-        "Use this for runtime version questions about the deployed assistant.",
-        `- version: ${escapeXml(runtimeMetadata?.version ?? "unknown")}`
-      ].join("\n")
-    ),
-    renderTag(
-      "provider-config",
-      [
-        "Use this catalog to map already-chosen provider work to valid config keys and provider defaults.",
-        "Do not use this catalog by itself to decide which domain skill matches an operational task.",
-        "When user intent is to set a provider default, choose a config key from this catalog and use jr-rpc config set.",
-        "The `jr-rpc` config command is a built-in bash custom command when conversation config is available; do not claim it is missing just because no `jr-rpc` skill is loaded.",
-        formatProviderCatalogForPrompt()
-      ].join("\n")
-    ),
-    renderTag(
-      "skill-routing",
-      [
-        "- Choose the skill that matches the requested operation, not incidental nouns, product names, organization names, or channel context.",
-        "- When multiple skills seem adjacent, prefer the one whose description matches the user's requested action most directly.",
-        "- If the task needs evidence from a specialized external system or workflow, load the matching skill before drawing conclusions.",
-        "- The provider-config catalog is for exact config keys and provider defaults after skill selection. It is not a shortcut for choosing a domain.",
-        "- Never start provider auth speculatively. First load the skill that owns the operation, then let runtime-managed credential injection handle authenticated provider commands for that skill."
-      ].join("\n")
-    ),
-    renderTag(
-      "tool-usage",
-      [
-        "- For factual or external questions, run tools/skills first, then answer from evidence.",
-        "- Use tool descriptions as the source of truth for when each tool should or should not be called.",
-        "- When using CLI tools through `bash`, prefer deterministic non-interactive flags and avoid commands that wait for prompts or editors.",
-        "- Keep routine setup and research steps silent in user-facing replies. Do not narrate duplicate checks, credential issuance, file writes, or similar internal progress unless the result is user-relevant.",
-        "- If a routine prerequisite check finds nothing notable, omit it entirely from the final reply and report only the user-relevant outcome.",
-        "- Prefer a single result-focused reply after tool work completes. Only send an interim reply when you need user input or have a concrete blocking problem to report.",
-        "- For external/factual research requests that require tools, do not send any preliminary conclusion, 'let me check', or progress narration before the evidence-gathering work is done. Use assistant status for in-progress work and make the first visible reply the researched answer.",
-        "- For evidence-gathering tasks, never state a factual conclusion before you have actually gathered and checked the sources.",
-        "- When the user provides multiple sources, synthesize them explicitly as one combined answer instead of anchoring the reply on a single page or API call.",
-        "- When the user provides explicit URLs or named sources, briefly anchor the answer to those provided sources (for example, 'Across the provided Slack docs...') so the summary reads as researched rather than generic memory.",
-        "- Do not include internal process chatter such as 'let me find', 'fetching now', 'good, I have sources', 'trying smaller limits', or 'I now have sufficient context' in the final user-facing reply.",
-        "- Never claim a screenshot/file is attached unless `attachFile` succeeded in this turn.",
-        "- If `attachFile` fails, explain the failure and do not say the file was shared.",
-        "- When you create or update a Slack artifact in this turn (for example a canvas, list, posted message, or attached file), mention it explicitly in the final reply and include its link when the tool returned one.",
-        "- For explicit in-channel post requests, prefer no thread text reply after a successful channel post. A reaction-only acknowledgment is acceptable when useful.",
-        "- When the user explicitly asks for an emoji reaction instead of text, react and skip the text reply.",
-        "- After the matching plugin-owned skill is loaded, authenticated bash commands for that skill get provider credentials injected automatically for the current turn.",
-        "- Resolve repo/project/org defaults before authenticated provider commands so the runtime can narrow injected credentials correctly.",
-        "- If no loaded skill clearly owns the authenticated command, load the matching skill first instead of guessing from the provider catalog.",
-        "- If provider authorization is required, the runtime sends the private authorization link itself and resumes the paused turn after authorization.",
-        "- Do not try to manage provider auth directly. Run the real provider command and let the runtime handle authorization, reconnect, and resume behavior.",
-        "- Provider-targeted commands may need `--target <value>` or a provider-specific configured default target key when the provider catalog shows one.",
-        "- To persist or read conversation defaults, choose a config key from the provider catalog or active skill metadata and run `jr-rpc config get|set|unset|list ...` as a bash command.",
-        "- `jr-rpc` config commands are built into the bash runtime for conversation-scoped config work; they do not require a separate helper binary in the sandbox.",
-        "- When your work is complete, provide the exact user-facing markdown response.",
-        "- Do not use reaction-based progress signals; Assistants API status already covers in-progress UX.",
-        "- Never call side-effecting tools when the user only asked for analysis or options.",
-        "- When the user asks for their conversation ID, trace ID, or a reference for Sentry lookup, use the IDs from `<session-context>` and `<turn-context>` in the user turn."
-      ].join("\n")
-    ),
-    renderTag(
-      "skills",
-      [
-        "- Explicit skill triggers may appear as `/skillname`.",
-        "- If explicitly invoked skill instructions are already present in <loaded_skills>, apply them immediately.",
-        "- If an explicitly invoked skill is present in <loaded_skills>, never say the skill is unavailable, missing, or unsupported in this environment.",
-        "- Otherwise, for an explicitly invoked skill, call `loadSkill` for that exact skill before applying skill-specific behavior.",
-        "- For requests without an explicit trigger where a skill clearly matches, call `loadSkill` before applying skill-specific behavior.",
-        "- When multiple skills appear relevant, prefer the skill whose description best matches the requested action rather than incidental domain nouns in the prompt.",
-        "- For explicit config tasks, you may load the helper skill that owns config commands, but do not use helper skills to choose the provider for unrelated operational work.",
-        "- Do not claim to have used a skill unless it is present in <loaded_skills> or `loadSkill` succeeded in this turn.",
-        "- Never apply skill-specific behavior unless the skill is present in <loaded_skills> or `loadSkill` succeeded in this turn.",
-        "- Load only the best matching skill first; do not load multiple skills upfront.",
-        "- After `loadSkill`, use `skill_dir` as the root for any referenced files you read via `bash`.",
-        "- If a loaded skill exposes MCP tools, they are registered as callable tools after `loadSkill` returns. Call them directly by name (for example `mcp__provider__tool_name`).",
-        "- If no skill is a clear fit, continue with normal tool usage."
-      ].join("\n")
-    ),
-    renderTag(
-      "output-contract",
-      [
-        "Always produce output that follows this contract:",
-        `<output format="slack-mrkdwn" max_inline_chars="${slackOutputPolicy.maxInlineChars}" max_inline_lines="${slackOutputPolicy.maxInlineLines}">`,
-        "- Use Slack-friendly markdown, not full CommonMark. Prefer bold section labels over markdown headings, and use bullets and short code blocks when helpful.",
-        "- Keep normal responses brief and scannable.",
-        "- If depth is needed, start with a concise summary and then provide fuller detail.",
-        "- Prefer a single compact thread reply when the full answer comfortably fits within this inline budget.",
-        "- When canvas creation is available and a research or document-style answer would likely need continuation, multiple sections, or future reference value, create a Slack canvas and keep the thread reply to a short summary plus the canvas link.",
-        "- Typical canvas-first cases include long-form research summaries, timelines, bios or profiles, structured notes, plans, comparisons, and other reusable reference documents.",
-        "- Do not create a canvas for short factual answers that fit cleanly in one normal thread reply.",
-        "- For tool-heavy research, discovery, or source-checking requests, do not send an initial acknowledgment. Start the visible reply only once you can present the actual answer.",
-        "- Do not narrate tool execution or repeated status updates in the visible reply.",
-        "- Avoid tables and markdown links like `[label](url)` unless explicitly requested. Prefer plain URLs or Slack-native entities when exact rendering matters.",
-        "- End every turn with a final user-facing markdown response.",
-        "</output>"
-      ].join("\n")
-    ),
-    availableSkillsSection,
-    activeSkillsSection,
-    ...activeToolsSection ? [activeToolsSection] : [],
-    renderTag(
-      "invocation-context",
-      invocation ? `Explicit skill trigger detected: /${invocation.skillName}` : "No explicit skill trigger detected."
-    )
+    HEADER,
+    renderTagBlock("personality", JUNIOR_PERSONALITY.trim()),
+    buildContextSection({
+      assistant: params.assistant,
+      requester: params.requester,
+      artifactState: params.artifactState,
+      configuration: params.configuration,
+      threadParticipants: params.threadParticipants,
+      invocation: params.invocation,
+      turnState: params.turnState
+    }),
+    buildCapabilitiesSection({
+      availableSkills: params.availableSkills,
+      activeSkills: params.activeSkills,
+      activeMcpCatalogs: params.activeMcpCatalogs ?? []
+    }),
+    renderTagBlock("behavior", BEHAVIOR_RULES.join("\n")),
+    buildOutputSection()
   ];
   return sections.join("\n\n");
 }
 
+// src/chat/capabilities/catalog.ts
+var cachedCatalog;
+function getCapabilityCatalog() {
+  const signature = getPluginCatalogSignature();
+  if (cachedCatalog?.signature === signature) return cachedCatalog;
+  const providers = getPluginCapabilityProviders();
+  const capabilityToProvider = /* @__PURE__ */ new Map();
+  for (const provider of providers) {
+    for (const capability of provider.capabilities) {
+      if (capabilityToProvider.has(capability)) {
+        throw new Error(
+          `Duplicate capability registration for "${capability}"`
+        );
+      }
+      capabilityToProvider.set(capability, provider);
+    }
+  }
+  cachedCatalog = { signature, providers, capabilityToProvider };
+  return cachedCatalog;
+}
+var catalogLogged = false;
+function logCapabilityCatalogLoadedOnce() {
+  if (catalogLogged) return;
+  catalogLogged = true;
+  const { providers } = getCapabilityCatalog();
+  const capabilityNames = providers.flatMap((p) => p.capabilities).sort();
+  const configKeys = [
+    ...new Set(providers.flatMap((p) => p.configKeys))
+  ].sort();
+  logInfo(
+    "capability_catalog_loaded",
+    {},
+    {
+      "app.capability.providers": providers.map((p) => p.provider),
+      "app.capability.count": capabilityNames.length,
+      "app.capability.names": capabilityNames,
+      "app.config.key_count": configKeys.length,
+      "app.config.keys": configKeys
+    },
+    "Loaded capability provider catalog"
+  );
+}
+
 // src/chat/capabilities/router.ts
 var ProviderCredentialRouter = class {
   brokersByProvider;
@@ -3938,6 +3933,27 @@ var MCP_CLIENT_INFO = {
   name: "junior-mcp-client",
   version: "1.0.0"
 };
+var MCP_TOOLS_CALL_METHOD = "tools/call";
+function getDefaultPort(url) {
+  if (url.protocol === "https:") {
+    return 443;
+  }
+  if (url.protocol === "http:") {
+    return 80;
+  }
+  return void 0;
+}
+function getMcpNetworkAttributes(url) {
+  const port = url.port ? Number(url.port) : getDefaultPort(url);
+  return {
+    "server.address": url.hostname,
+    ...port !== void 0 ? { "server.port": port } : {},
+    ...url.protocol === "http:" || url.protocol === "https:" ? {
+      "network.protocol.name": "http",
+      "network.transport": "tcp"
+    } : {}
+  };
+}
 var McpAuthorizationRequiredError = class extends Error {
   provider;
   constructor(provider, message) {
@@ -3987,10 +4003,22 @@ var PluginMcpClient = class {
   async callTool(name, args) {
     return await this.withSessionRecovery(async () => {
       const client2 = await this.getClient();
+      const mcp = this.plugin.manifest.mcp;
+      if (mcp) {
+        const url = new URL(mcp.url);
+        setSpanAttributes({
+          "mcp.method.name": MCP_TOOLS_CALL_METHOD,
+          "gen_ai.operation.name": "execute_tool",
+          "gen_ai.tool.name": name,
+          ...this.transport?.sessionId ? { "mcp.session.id": this.transport.sessionId } : {},
+          ...this.transport?.protocolVersion ? { "mcp.protocol.version": this.transport.protocolVersion } : {},
+          ...getMcpNetworkAttributes(url)
+        });
+      }
       const result = await this.wrapAuth(
         client2.callTool({
           name,
-          ...args && Object.keys(args).length > 0 ? { arguments: args } : {}
+          arguments: args ?? {}
         })
       );
       await this.syncTransportSessionId();
@@ -4103,13 +4131,24 @@ var PluginMcpClient = class {
   }
 };
 
-// src/chat/mcp/tool-manager.ts
+// src/chat/mcp/errors.ts
 var McpToolError = class extends Error {
   constructor(message) {
     super(message);
     this.name = "McpToolError";
   }
 };
+function getMcpAwareErrorType(error, fallback) {
+  if (error instanceof McpToolError) {
+    return "tool_error";
+  }
+  return error instanceof Error ? error.name : fallback;
+}
+function getMcpAwareErrorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/chat/mcp/tool-manager.ts
 function normalizeMcpToolName(provider, toolName) {
   return `mcp__${provider}__${toolName}`;
 }
@@ -4275,24 +4314,6 @@ var McpToolManager = class {
       (tool2) => this.toToolDescriptor(tool2)
     );
   }
-  searchTools(skills, query, options = {}) {
-    const resolved = this.getResolvedActiveTools(skills, options);
-    const trimmedQuery = query.trim();
-    if (!trimmedQuery || trimmedQuery === "*") {
-      return resolved.slice(0, Math.max(1, options.limit ?? 8)).map((tool2) => this.toToolDescriptor(tool2));
-    }
-    const normalizedQuery = trimmedQuery.toLowerCase();
-    const queryTokens = normalizedQuery.split(/\s+/).map((token) => token.trim()).filter((token) => token.length > 0);
-    return resolved.map((tool2) => ({
-      tool: tool2,
-      score: this.scoreToolMatch(tool2, normalizedQuery, queryTokens)
-    })).filter((entry) => entry.score > 0).sort((left, right) => {
-      if (right.score !== left.score) {
-        return right.score - left.score;
-      }
-      return left.tool.name.localeCompare(right.tool.name);
-    }).slice(0, Math.max(1, options.limit ?? 8)).map((entry) => this.toToolDescriptor(entry.tool));
-  }
   filterListedTools(plugin, tools) {
     const allowedTools = plugin.manifest.mcp?.allowedTools;
     if (!allowedTools || allowedTools.length === 0) {
@@ -4324,6 +4345,8 @@ var McpToolManager = class {
     return client2;
   }
   toManagedTool(plugin, client2, tool2) {
+    const outputSchema = toOptionalRecord(tool2.outputSchema);
+    const annotations = toOptionalRecord(tool2.annotations);
     return {
       name: normalizeMcpToolName(plugin.manifest.name, tool2.name),
       description: describeMcpTool(plugin.manifest.name, tool2),
@@ -4331,8 +4354,15 @@ var McpToolManager = class {
       provider: plugin.manifest.name,
       rawName: tool2.name,
       ...tool2.title?.trim() ? { title: tool2.title.trim() } : {},
+      ...outputSchema ? { outputSchema } : {},
+      ...annotations ? { annotations } : {},
       execute: async (args) => {
         const resolvedArgs = typeof args === "object" && args !== null ? args : {};
+        const baseAttributes = {
+          "gen_ai.tool.name": tool2.name,
+          "mcp.method.name": "tools/call"
+        };
+        setSpanAttributes(baseAttributes);
         try {
           const result = await client2.callTool(tool2.name, resolvedArgs);
           if ("isError" in result && result.isError) {
@@ -4368,6 +4398,20 @@ var McpToolManager = class {
               }
             };
           }
+          const errorAttributes = {
+            ...baseAttributes,
+            "error.type": getMcpAwareErrorType(error, "mcp_tool_error"),
+            "error.message": getMcpAwareErrorMessage(error)
+          };
+          setSpanAttributes(errorAttributes);
+          if (error instanceof McpToolError) {
+            logWarn(
+              "mcp_tool_call_failed",
+              {},
+              errorAttributes,
+              "MCP tool call failed"
+            );
+          }
           throw error;
         }
       }
@@ -4414,37 +4458,19 @@ var McpToolManager = class {
   toToolDescriptor(tool2) {
     return {
       name: tool2.name,
+      rawName: tool2.rawName,
+      ...tool2.title ? { title: tool2.title } : {},
       description: tool2.description,
       parameters: tool2.parameters,
+      ...tool2.outputSchema ? { outputSchema: tool2.outputSchema } : {},
+      ...tool2.annotations ? { annotations: tool2.annotations } : {},
       provider: tool2.provider
     };
   }
-  scoreToolMatch(tool2, normalizedQuery, queryTokens) {
-    const exactCandidates = [tool2.name, tool2.rawName, tool2.title].filter((value) => Boolean(value)).map((value) => value.toLowerCase());
-    if (exactCandidates.includes(normalizedQuery)) {
-      return 100;
-    }
-    let score = 0;
-    const searchableText = [
-      tool2.name,
-      tool2.rawName,
-      tool2.title,
-      tool2.description,
-      tool2.provider
-    ].filter((value) => Boolean(value)).join(" ").toLowerCase();
-    for (const candidate of exactCandidates) {
-      if (candidate.startsWith(normalizedQuery)) {
-        score = Math.max(score, 60);
-      }
-    }
-    for (const token of queryTokens) {
-      if (searchableText.includes(token)) {
-        score += 10;
-      }
-    }
-    return score;
-  }
 };
+function toOptionalRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
 
 // src/chat/tools/definition.ts
 function tool(definition) {
@@ -4757,8 +4783,61 @@ function createImageGenerateTool(hooks, deps = {}) {
   });
 }
 
-// src/chat/tools/skill/load-skill.ts
+// src/chat/tools/skill/call-mcp-tool.ts
 import { Type as Type4 } from "@sinclair/typebox";
+function resolveMcpArguments(input) {
+  const extraKeys = Object.keys(input).filter(
+    (key) => key !== "tool_name" && key !== "arguments"
+  );
+  if (extraKeys.length > 0) {
+    throw new Error(
+      `callMcpTool MCP arguments must be nested under arguments, not top-level fields: ${extraKeys.join(", ")}`
+    );
+  }
+  if ("arguments" in input) {
+    const args = input.arguments;
+    if (args === void 0) {
+      return {};
+    }
+    if (!args || typeof args !== "object" || Array.isArray(args)) {
+      throw new Error("callMcpTool arguments must be an object when provided");
+    }
+    return args;
+  }
+  return {};
+}
+function createCallMcpToolTool(mcpToolManager, getActiveSkills) {
+  return tool({
+    description: "Call an active MCP tool by exact tool_name. Use loadSkill to activate the provider, then searchMcpTools to discover tool names and schemas; authorization is handled by the runtime when required.",
+    inputSchema: Type4.Object(
+      {
+        tool_name: Type4.String({
+          minLength: 1,
+          description: "Exact MCP tool_name from searchMcpTools."
+        }),
+        arguments: Type4.Optional(
+          Type4.Record(Type4.String(), Type4.Unknown(), {
+            description: "Arguments matching the disclosed MCP tool schema."
+          })
+        )
+      },
+      { additionalProperties: false }
+    ),
+    execute: async (input) => {
+      const { tool_name } = input;
+      const mcpTool = mcpToolManager.getResolvedActiveTools(getActiveSkills()).find((candidate) => candidate.name === tool_name);
+      if (!mcpTool) {
+        throw new Error(`MCP tool is not active for this turn: ${tool_name}`);
+      }
+      return await mcpTool.execute(
+        resolveMcpArguments(input)
+      );
+    }
+  });
+}
+
+// src/chat/tools/skill/load-skill.ts
+import { Type as Type5 } from "@sinclair/typebox";
 function toLoadedSkill(result, availableSkills) {
   if (result.ok !== true || typeof result.skill_name !== "string" || typeof result.description !== "string" || typeof result.skill_dir !== "string" || typeof result.instructions !== "string") {
     return null;
@@ -4770,7 +4849,6 @@ function toLoadedSkill(result, availableSkills) {
     skillPath: metadata?.skillPath ?? result.skill_dir,
     ...metadata?.pluginProvider ? { pluginProvider: metadata.pluginProvider } : {},
     ...metadata?.allowedTools ? { allowedTools: metadata.allowedTools } : {},
-    ...metadata?.usesConfig ? { usesConfig: metadata.usesConfig } : {},
     body: result.instructions
   };
 }
@@ -4803,9 +4881,9 @@ async function loadSkillFromHost(availableSkills, skillName) {
 }
 function createLoadSkillTool(availableSkills, options) {
   return tool({
-    description: "Load a skill by name so its instructions are available for this turn. The result includes `available_tools` when the skill exposes MCP tools for this turn. Use when a request clearly matches a known skill. Do not use when no skill is relevant.",
-    inputSchema: Type4.Object({
-      skill_name: Type4.String({
+    description: "Load a skill by name so its instructions and provider tool catalog are available for this turn. When the result includes mcp_provider and available_tool_count, use searchMcpTools to list or search descriptors before callMcpTool. Use when a request clearly matches a known skill.",
+    inputSchema: Type5.Object({
+      skill_name: Type5.String({
         minLength: 1,
         description: "Skill name to load, without the leading slash."
       })
@@ -4824,53 +4902,87 @@ function createLoadSkillTool(availableSkills, options) {
   });
 }
 
-// src/chat/tools/sandbox/read-file.ts
-import { Type as Type5 } from "@sinclair/typebox";
-function createReadFileTool() {
-  return tool({
-    description: "Read a file from the sandbox workspace. Use when you need exact file contents to verify facts or make edits safely. Do not use for broad discovery when search tools are better.",
-    inputSchema: Type5.Object(
-      {
-        path: Type5.String({
-          minLength: 1,
-          description: "Path to the file in the sandbox workspace."
-        })
-      },
-      { additionalProperties: false }
-    ),
-    execute: async () => {
-      throw new Error(
-        "readFile can only run when sandbox execution is enabled."
-      );
-    }
-  });
-}
-
-// src/chat/tools/runtime/report-progress.ts
+// src/chat/tools/skill/search-mcp-tools.ts
 import { Type as Type6 } from "@sinclair/typebox";
-function createReportProgressTool() {
-  return tool({
-    description: "Update the user-visible assistant loading message with a short progress phase. For every non-trivial turn, call this early with the initial major work phase, then call it again only when the major phase meaningfully changes. Messages must be written in sentence case with a present-participle verb (e.g. 'Searching docs', 'Reviewing results', 'Running checks'). Skip trivial direct answers, generic filler, and minor substeps.",
-    inputSchema: Type6.Object({
-      message: Type6.String({
-        minLength: 1,
-        description: "Short user-facing progress message."
-      })
-    })
-  });
-}
-
-// src/chat/tools/skill/search-tools.ts
-import { Type as Type7 } from "@sinclair/typebox";
 
 // src/chat/tools/skill/mcp-tool-summary.ts
-function summarizeInputSchema(schema) {
-  const properties = schema.properties && typeof schema.properties === "object" ? schema.properties : {};
-  const required = Array.isArray(schema.required) ? new Set(
+function getSchemaProperties(schema) {
+  return schema.properties && typeof schema.properties === "object" ? schema.properties : {};
+}
+function getRequiredFields(schema) {
+  return Array.isArray(schema.required) ? new Set(
     schema.required.filter(
       (value) => typeof value === "string"
     )
   ) : /* @__PURE__ */ new Set();
+}
+function formatSchemaType(schema) {
+  if (!schema || typeof schema !== "object") {
+    return "unknown";
+  }
+  const typed = schema;
+  const type = typed.type;
+  if (typeof type === "string") {
+    if (type === "array") {
+      return `${formatSchemaType(typed.items)}[]`;
+    }
+    return type;
+  }
+  if (Array.isArray(type)) {
+    return type.filter((value) => typeof value === "string").join(" | ");
+  }
+  if (Array.isArray(typed.enum) && typed.enum.length > 0) {
+    return typed.enum.map((value) => JSON.stringify(value)).join(" | ");
+  }
+  return "unknown";
+}
+function formatArgumentPlaceholder(name, schema) {
+  const type = formatSchemaType(schema);
+  if (type === "string") {
+    return `<${name}>`;
+  }
+  if (type === "number" || type === "integer") {
+    return "<number>";
+  }
+  if (type === "boolean") {
+    return "<boolean>";
+  }
+  if (type.endsWith("[]")) {
+    return "<array>";
+  }
+  if (type === "object") {
+    return "<object>";
+  }
+  return `<${type}>`;
+}
+function formatMcpToolSignature(toolName, schema) {
+  const properties = getSchemaProperties(schema);
+  const required = getRequiredFields(schema);
+  const fields = Object.entries(properties).map(([name, propertySchema]) => {
+    const marker = required.has(name) ? "" : "?";
+    return `${name}${marker}: ${formatSchemaType(propertySchema)}`;
+  });
+  if (fields.length === 0) {
+    return `${toolName}()`;
+  }
+  return `${toolName}({ ${fields.join(", ")} })`;
+}
+function formatMcpToolCallExample(toolName, schema) {
+  return {
+    tool_name: toolName,
+    arguments: Object.fromEntries(
+      Object.entries(getSchemaProperties(schema)).map(
+        ([name, propertySchema]) => [
+          name,
+          formatArgumentPlaceholder(name, propertySchema)
+        ]
+      )
+    )
+  };
+}
+function summarizeInputSchema(schema) {
+  const properties = getSchemaProperties(schema);
+  const required = getRequiredFields(schema);
   const propertyNames = Object.keys(properties);
   if (propertyNames.length === 0) {
     return "No arguments.";
@@ -4880,59 +4992,190 @@ function summarizeInputSchema(schema) {
 function toExposedToolSummary(toolDef) {
   return {
     tool_name: toolDef.name,
+    mcp_tool_name: toolDef.rawName,
     provider: toolDef.provider,
+    ...toolDef.title ? { title: toolDef.title } : {},
     description: toolDef.description,
+    signature: formatMcpToolSignature(toolDef.name, toolDef.parameters),
+    call: formatMcpToolCallExample(toolDef.name, toolDef.parameters),
     input_schema: toolDef.parameters,
-    input_schema_summary: summarizeInputSchema(toolDef.parameters)
-  };
+    input_schema_summary: summarizeInputSchema(toolDef.parameters),
+    ...toolDef.outputSchema ? { output_schema: toolDef.outputSchema } : {},
+    ...toolDef.annotations ? { annotations: toolDef.annotations } : {}
+  };
+}
+function toActiveMcpCatalogSummaries(toolDefs) {
+  const countsByProvider = /* @__PURE__ */ new Map();
+  for (const toolDef of toolDefs) {
+    countsByProvider.set(
+      toolDef.provider,
+      (countsByProvider.get(toolDef.provider) ?? 0) + 1
+    );
+  }
+  return [...countsByProvider.entries()].map(([provider, availableToolCount]) => ({
+    provider,
+    available_tool_count: availableToolCount
+  })).sort((left, right) => left.provider.localeCompare(right.provider));
+}
+
+// src/chat/tools/skill/search-mcp-tools.ts
+var DEFAULT_MAX_RESULTS = 5;
+var MAX_RESULTS = 20;
+function normalize(value) {
+  return value.toLowerCase().replace(/[^a-z0-9_]+/g, " ").trim();
+}
+function searchableToolText(toolDef) {
+  return normalize(
+    [
+      toolDef.name,
+      toolDef.rawName,
+      toolDef.title,
+      toolDef.provider,
+      toolDef.description,
+      JSON.stringify(toolDef.parameters),
+      JSON.stringify(toolDef.outputSchema),
+      JSON.stringify(toolDef.annotations)
+    ].filter(Boolean).join(" ")
+  );
 }
-
-// src/chat/tools/skill/search-tools.ts
-var DEFAULT_LIMIT = 5;
-var MAX_LIMIT = 20;
-function createSearchToolsTool(mcpToolManager, getActiveSkills) {
+function scoreTool(toolDef, query) {
+  const normalizedQuery = normalize(query);
+  if (!normalizedQuery) {
+    return 0;
+  }
+  const normalizedName = normalize(toolDef.name);
+  const normalizedRawName = normalize(toolDef.rawName);
+  const text = searchableToolText(toolDef);
+  let score = 0;
+  if (normalizedName === normalizedQuery || normalizedRawName === normalizedQuery) {
+    score += 100;
+  }
+  if (normalizedName.includes(normalizedQuery)) {
+    score += 50;
+  }
+  if (normalizedRawName.includes(normalizedQuery)) {
+    score += 45;
+  }
+  if (text.includes(normalizedQuery)) {
+    score += 25;
+  }
+  for (const term of normalizedQuery.split(/\s+/).filter(Boolean)) {
+    if (normalizedName.includes(term)) {
+      score += 12;
+    }
+    if (normalizedRawName.includes(term)) {
+      score += 10;
+    }
+    if (text.includes(term)) {
+      score += 4;
+    }
+  }
+  return score;
+}
+function searchMcpCatalog(tools, query) {
+  if (!normalize(query)) {
+    return [...tools].sort(
+      (left, right) => left.name.localeCompare(right.name)
+    );
+  }
+  return tools.map(
+    (toolDef) => ({
+      tool: toolDef,
+      score: scoreTool(toolDef, query)
+    })
+  ).filter((ranked) => ranked.score > 0).sort((left, right) => {
+    if (right.score !== left.score) {
+      return right.score - left.score;
+    }
+    return left.tool.name.localeCompare(right.tool.name);
+  }).map((ranked) => ranked.tool);
+}
+function createSearchMcpToolsTool(mcpToolManager, getActiveSkills) {
   return tool({
-    description: "Search active MCP tools exposed by the currently loaded skills. Use when you need to rediscover or filter active tools.",
-    inputSchema: Type7.Object(
+    description: "List or search active MCP tools and return full descriptors, including input/output schemas and annotations. Use after loadSkill when choosing a provider tool or when callMcpTool arguments are unclear.",
+    inputSchema: Type6.Object(
       {
-        query: Type7.String({
-          minLength: 1,
-          description: "Search query for matching MCP tool names or descriptions."
-        }),
-        provider: Type7.Optional(
-          Type7.String({
+        query: Type6.Optional(
+          Type6.String({
+            minLength: 1,
+            description: "Optional search terms describing the MCP tool or arguments needed."
+          })
+        ),
+        provider: Type6.Optional(
+          Type6.String({
             minLength: 1,
-            description: "Optional MCP provider filter, for example notion or sentry."
+            description: "Optional provider name to list or search within."
           })
         ),
-        limit: Type7.Optional(
-          Type7.Integer({
+        max_results: Type6.Optional(
+          Type6.Integer({
             minimum: 1,
-            maximum: MAX_LIMIT,
-            description: "Maximum number of matching tools to return."
+            maximum: MAX_RESULTS,
+            description: "Maximum matching tool descriptors to return."
           })
         )
       },
       { additionalProperties: false }
     ),
-    execute: async ({ query, provider, limit }) => {
-      const results = mcpToolManager.searchTools(getActiveSkills(), query, {
-        ...provider ? { provider } : {},
-        limit: limit ?? DEFAULT_LIMIT
-      }).map(toExposedToolSummary);
+    execute: async ({ query, provider, max_results }) => {
+      const catalog = mcpToolManager.getActiveToolCatalog(
+        getActiveSkills(),
+        provider ? { provider } : {}
+      );
+      const maxResults = max_results ?? DEFAULT_MAX_RESULTS;
+      const matches = searchMcpCatalog(catalog, query ?? "").slice(
+        0,
+        maxResults
+      );
       return {
-        ok: true,
-        query,
-        ...provider ? { provider } : {},
-        result_count: results.length,
-        results
+        query: query ?? null,
+        provider: provider ?? null,
+        total_active_tools: catalog.length,
+        returned_tools: matches.length,
+        tools: matches.map(toExposedToolSummary)
       };
     }
   });
 }
 
-// src/chat/tools/slack/channel-list-messages.ts
+// src/chat/tools/sandbox/read-file.ts
+import { Type as Type7 } from "@sinclair/typebox";
+function createReadFileTool() {
+  return tool({
+    description: "Read a file from the sandbox workspace. Use when you need exact file contents to verify facts or make edits safely. Do not use for broad discovery when search tools are better.",
+    inputSchema: Type7.Object(
+      {
+        path: Type7.String({
+          minLength: 1,
+          description: "Path to the file in the sandbox workspace."
+        })
+      },
+      { additionalProperties: false }
+    ),
+    execute: async () => {
+      throw new Error(
+        "readFile can only run when sandbox execution is enabled."
+      );
+    }
+  });
+}
+
+// src/chat/tools/runtime/report-progress.ts
 import { Type as Type8 } from "@sinclair/typebox";
+function createReportProgressTool() {
+  return tool({
+    description: "Update the user-visible assistant loading message with a short progress phase. For every non-trivial turn, call this early with the initial major work phase, then call it again only when the major phase meaningfully changes. Messages must be written in sentence case with a present-participle verb (e.g. 'Searching docs', 'Reviewing results', 'Running checks'). Skip trivial direct answers, generic filler, and minor substeps.",
+    inputSchema: Type8.Object({
+      message: Type8.String({
+        minLength: 1,
+        description: "Short user-facing progress message."
+      })
+    })
+  });
+}
+
+// src/chat/tools/slack/channel-list-messages.ts
+import { Type as Type9 } from "@sinclair/typebox";
 
 // src/chat/slack/channel.ts
 async function listChannelMessages(input) {
@@ -5021,39 +5264,39 @@ async function listThreadReplies(input) {
 function createSlackChannelListMessagesTool(context) {
   return tool({
     description: "List channel messages from Slack history in the active channel context. Use when the user asks for recent or historical channel context outside this thread. Do not use for live monitoring or when current thread context already answers the question.",
-    inputSchema: Type8.Object({
-      limit: Type8.Optional(
-        Type8.Integer({
+    inputSchema: Type9.Object({
+      limit: Type9.Optional(
+        Type9.Integer({
           minimum: 1,
           maximum: 1e3,
           description: "Maximum number of messages to return across pages."
         })
       ),
-      cursor: Type8.Optional(
-        Type8.String({
+      cursor: Type9.Optional(
+        Type9.String({
           minLength: 1,
           description: "Optional cursor to continue from a prior call."
         })
       ),
-      oldest: Type8.Optional(
-        Type8.String({
+      oldest: Type9.Optional(
+        Type9.String({
           minLength: 1,
           description: "Optional oldest message timestamp (Slack ts) for range filtering."
         })
       ),
-      latest: Type8.Optional(
-        Type8.String({
+      latest: Type9.Optional(
+        Type9.String({
           minLength: 1,
           description: "Optional latest message timestamp (Slack ts) for range filtering."
         })
       ),
-      inclusive: Type8.Optional(
-        Type8.Boolean({
+      inclusive: Type9.Optional(
+        Type9.Boolean({
           description: "Whether oldest/latest bounds should be inclusive."
         })
       ),
-      max_pages: Type8.Optional(
-        Type8.Integer({
+      max_pages: Type9.Optional(
+        Type9.Integer({
           minimum: 1,
           maximum: 10,
           description: "Maximum number of API pages to traverse in a single call."
@@ -5107,7 +5350,7 @@ function createSlackChannelListMessagesTool(context) {
 }
 
 // src/chat/tools/slack/channel-post-message.ts
-import { Type as Type9 } from "@sinclair/typebox";
+import { Type as Type10 } from "@sinclair/typebox";
 
 // src/chat/tools/idempotency.ts
 function stableSerialize(value) {
@@ -5129,8 +5372,8 @@ function createOperationKey(toolName, input) {
 function createSlackChannelPostMessageTool(context, state) {
   return tool({
     description: "Post a message in the active Slack channel context (outside the thread). Use this only when the user explicitly asks to post/send/share/say something in the current channel. Do not use it for normal thread replies, speculative broadcasts, or requests targeting another named channel; explain that limitation instead. Do not claim a channel message was posted unless this tool succeeds in this turn.",
-    inputSchema: Type9.Object({
-      text: Type9.String({
+    inputSchema: Type10.Object({
+      text: Type10.String({
         minLength: 1,
         maxLength: 4e4,
         description: "Slack mrkdwn text to post."
@@ -5173,12 +5416,12 @@ function createSlackChannelPostMessageTool(context, state) {
 }
 
 // src/chat/tools/slack/message-add-reaction.ts
-import { Type as Type10 } from "@sinclair/typebox";
+import { Type as Type11 } from "@sinclair/typebox";
 function createSlackMessageAddReactionTool(context, state) {
   return tool({
     description: "Add an emoji reaction to the current inbound Slack message. Use sparingly for lightweight acknowledgements. Provide a Slack emoji alias name (for example `thumbsup`, `white_check_mark`, or `thumbsup::skin-tone-6`), not a unicode emoji glyph. The target message is injected by runtime context; do not use this for arbitrary historical messages.",
-    inputSchema: Type10.Object({
-      emoji: Type10.String({
+    inputSchema: Type11.Object({
+      emoji: Type11.String({
         minLength: 1,
         maxLength: 64,
         description: "Slack emoji alias name to react with (for example `thumbsup`, `white_check_mark`, or `thumbsup::skin-tone-6`). Optional surrounding colons are allowed."
@@ -5236,7 +5479,7 @@ function createSlackMessageAddReactionTool(context, state) {
 }
 
 // src/chat/tools/slack/canvas-tools.ts
-import { Type as Type11 } from "@sinclair/typebox";
+import { Type as Type12 } from "@sinclair/typebox";
 
 // src/chat/tools/slack/canvases.ts
 function normalizeCanvasMarkdown(markdown) {
@@ -5452,13 +5695,13 @@ function mergeRecentCanvases(existing, created) {
 function createSlackCanvasCreateTool(context, state) {
   return tool({
     description: "Create a Slack canvas for long-form output in the active assistant context channel. Use when the answer is better as a reusable document than a thread reply: long-form research, timelines, bios/profiles, structured notes, plans, comparisons, or anything likely to exceed one compact Slack reply. After creating it, keep the thread reply brief and include the canvas link. Do not use for short answers that fit cleanly in one normal thread reply.",
-    inputSchema: Type11.Object({
-      title: Type11.String({
+    inputSchema: Type12.Object({
+      title: Type12.String({
         minLength: 1,
         maxLength: 160,
         description: "Canvas title."
       }),
-      markdown: Type11.String({
+      markdown: Type12.String({
         minLength: 1,
         description: "Canvas markdown body content."
       })
@@ -5524,29 +5767,29 @@ function createSlackCanvasCreateTool(context, state) {
 function createSlackCanvasUpdateTool(state, _context) {
   return tool({
     description: "Update the active Slack canvas tracked in artifact context. Use when continuing or correcting a document already tracked in this thread. Do not use to create a brand-new long-form artifact.",
-    inputSchema: Type11.Object({
-      markdown: Type11.String({
+    inputSchema: Type12.Object({
+      markdown: Type12.String({
         minLength: 1,
         description: "Markdown content to insert or use as replacement text."
       }),
-      operation: Type11.Optional(
-        Type11.Union(
+      operation: Type12.Optional(
+        Type12.Union(
           [
-            Type11.Literal("insert_at_end"),
-            Type11.Literal("insert_at_start"),
-            Type11.Literal("replace")
+            Type12.Literal("insert_at_end"),
+            Type12.Literal("insert_at_start"),
+            Type12.Literal("replace")
           ],
           { description: "Canvas update mode." }
         )
       ),
-      section_id: Type11.Optional(
-        Type11.String({
+      section_id: Type12.Optional(
+        Type12.String({
           minLength: 1,
           description: "Optional section ID required for targeted replace operations."
         })
       ),
-      section_contains_text: Type11.Optional(
-        Type11.String({
+      section_contains_text: Type12.Optional(
+        Type12.String({
           minLength: 1,
           description: "Optional helper text used to find the target section when section_id is not provided."
         })
@@ -5612,8 +5855,8 @@ function createSlackCanvasUpdateTool(state, _context) {
 function createSlackCanvasReadTool() {
   return tool({
     description: "Read a Slack canvas the bot has access to (including canvases the bot created) by canvas ID or Slack canvas/docs URL. Use when the user shares a Slack canvas link (https://*.slack.com/docs/... or /canvas/...) or references a canvas ID and you need its contents. Do not use for generic web pages \u2014 use webFetch for those.",
-    inputSchema: Type11.Object({
-      canvas: Type11.String({
+    inputSchema: Type12.Object({
+      canvas: Type12.String({
         minLength: 1,
         description: "Canvas/file ID (e.g. `F0ABCDEF`) or Slack canvas/docs URL (e.g. `https://team.slack.com/docs/T.../F...`)."
       })
@@ -5663,7 +5906,7 @@ function createSlackCanvasReadTool() {
 }
 
 // src/chat/tools/slack/list-tools.ts
-import { Type as Type12 } from "@sinclair/typebox";
+import { Type as Type13 } from "@sinclair/typebox";
 
 // src/chat/tools/slack/lists.ts
 function normalizeKey(value) {
@@ -5837,8 +6080,8 @@ async function updateListItem(input) {
 function createSlackListCreateTool(state) {
   return tool({
     description: "Create a Slack todo list for action tracking. Use when the user needs structured tasks with ownership/completion tracking. Do not use for one-off notes without task management needs.",
-    inputSchema: Type12.Object({
-      name: Type12.String({
+    inputSchema: Type13.Object({
+      name: Type13.String({
         minLength: 1,
         maxLength: 160,
         description: "Name for the new Slack list."
@@ -5873,20 +6116,20 @@ function createSlackListCreateTool(state) {
 function createSlackListAddItemsTool(state) {
   return tool({
     description: "Add tasks to the active Slack list tracked in artifact context. Use when the user wants actionable items recorded in the current thread list. Do not use when no list exists and list creation was not requested.",
-    inputSchema: Type12.Object({
-      items: Type12.Array(Type12.String({ minLength: 1 }), {
+    inputSchema: Type13.Object({
+      items: Type13.Array(Type13.String({ minLength: 1 }), {
         minItems: 1,
         maxItems: 25,
         description: "List item titles to create."
       }),
-      assignee_user_id: Type12.Optional(
-        Type12.String({
+      assignee_user_id: Type13.Optional(
+        Type13.String({
           minLength: 1,
           description: "Optional Slack user ID assigned to all created items."
         })
       ),
-      due_date: Type12.Optional(
-        Type12.String({
+      due_date: Type13.Optional(
+        Type13.String({
           pattern: "^\\d{4}-\\d{2}-\\d{2}$",
           description: "Optional due date in YYYY-MM-DD format."
         })
@@ -5935,9 +6178,9 @@ function createSlackListAddItemsTool(state) {
 function createSlackListGetItemsTool(state) {
   return tool({
     description: "Read items from the active Slack list tracked in artifact context. Use when the user asks for task status, open items, or list contents. Do not use when list state is already known from the immediately prior result.",
-    inputSchema: Type12.Object({
-      limit: Type12.Optional(
-        Type12.Integer({
+    inputSchema: Type13.Object({
+      limit: Type13.Optional(
+        Type13.Integer({
           minimum: 1,
           maximum: 200,
           description: "Maximum number of list items to return."
@@ -5962,19 +6205,19 @@ function createSlackListGetItemsTool(state) {
 function createSlackListUpdateItemTool(state) {
   return tool({
     description: "Update an item in the active Slack list tracked in artifact context (title/completion). Use when the user asks to mark progress or rename a tracked task. Do not use to add new tasks.",
-    inputSchema: Type12.Object(
+    inputSchema: Type13.Object(
       {
-        item_id: Type12.String({
+        item_id: Type13.String({
           minLength: 1,
           description: "ID of the Slack list item to update."
         }),
-        completed: Type12.Optional(
-          Type12.Boolean({
+        completed: Type13.Optional(
+          Type13.Boolean({
             description: "Optional completion status update."
           })
         ),
-        title: Type12.Optional(
-          Type12.String({
+        title: Type13.Optional(
+          Type13.String({
             minLength: 1,
             description: "Optional new item title."
           })
@@ -6024,11 +6267,11 @@ function createSlackListUpdateItemTool(state) {
 }
 
 // src/chat/tools/system-time.ts
-import { Type as Type13 } from "@sinclair/typebox";
+import { Type as Type14 } from "@sinclair/typebox";
 function createSystemTimeTool() {
   return tool({
     description: "Return current system time in UTC and local ISO formats. Use when the user asks for current time/date context. Do not use as a substitute for historical or timezone-conversion research.",
-    inputSchema: Type13.Object({}),
+    inputSchema: Type14.Object({}),
     execute: async () => {
       const now = /* @__PURE__ */ new Date();
       return {
@@ -6043,7 +6286,7 @@ function createSystemTimeTool() {
 }
 
 // src/chat/tools/web/fetch-tool.ts
-import { Type as Type14 } from "@sinclair/typebox";
+import { Type as Type15 } from "@sinclair/typebox";
 
 // src/chat/tools/web/constants.ts
 var USER_AGENT = "junior-bot/0.1";
@@ -6391,13 +6634,13 @@ function extractHttpStatusFromMessage(message) {
 function createWebFetchTool(hooks) {
   return tool({
     description: "Fetch and extract readable content from a specific URL. Use when you need details from a known page or document. Do not use for discovery when search is the first step.",
-    inputSchema: Type14.Object({
-      url: Type14.String({
+    inputSchema: Type15.Object({
+      url: Type15.String({
         minLength: 1,
         description: "HTTP(S) URL to fetch."
       }),
-      max_chars: Type14.Optional(
-        Type14.Integer({
+      max_chars: Type15.Optional(
+        Type15.Integer({
           minimum: 500,
           maximum: MAX_FETCH_CHARS,
           description: "Optional maximum number of extracted characters to return."
@@ -6457,9 +6700,9 @@ function createWebFetchTool(hooks) {
 // src/chat/tools/web/search.ts
 import { generateText } from "ai";
 import { createGatewayProvider } from "@ai-sdk/gateway";
-import { Type as Type15 } from "@sinclair/typebox";
+import { Type as Type16 } from "@sinclair/typebox";
 var SEARCH_TIMEOUT_MS = 6e4;
-var MAX_RESULTS = 5;
+var MAX_RESULTS2 = 5;
 var DEFAULT_SEARCH_MODEL = "xai/grok-4-fast-reasoning";
 var SEARCH_TOOL_NAME = "parallelSearch";
 function asString(value) {
@@ -6500,16 +6743,16 @@ function isAuthFailure(message) {
 function createWebSearchTool() {
   return tool({
     description: "Search public web sources and return top snippets/URLs. Use when you need discovery or source candidates. Do not use when the user already provided a specific URL to inspect.",
-    inputSchema: Type15.Object({
-      query: Type15.String({
+    inputSchema: Type16.Object({
+      query: Type16.String({
         minLength: 1,
         maxLength: 500,
         description: "Search query."
       }),
-      max_results: Type15.Optional(
-        Type15.Integer({
+      max_results: Type16.Optional(
+        Type16.Integer({
           minimum: 1,
-          maximum: MAX_RESULTS,
+          maximum: MAX_RESULTS2,
           description: "Max results to return."
         })
       )
@@ -6573,17 +6816,17 @@ function createWebSearchTool() {
 }
 
 // src/chat/tools/sandbox/write-file.ts
-import { Type as Type16 } from "@sinclair/typebox";
+import { Type as Type17 } from "@sinclair/typebox";
 function createWriteFileTool() {
   return tool({
     description: "Write UTF-8 content to a file in the sandbox workspace. Use for intentional file creation or replacement after validation. Do not use for exploratory analysis-only turns.",
-    inputSchema: Type16.Object(
+    inputSchema: Type17.Object(
       {
-        path: Type16.String({
+        path: Type17.String({
           minLength: 1,
           description: "Path to write in the sandbox workspace."
         }),
-        content: Type16.String({
+        content: Type17.String({
           description: "UTF-8 file content to write."
         })
       },
@@ -6658,7 +6901,11 @@ function createTools(availableSkills, hooks = {}, context) {
     slackListUpdateItem: createSlackListUpdateItemTool(state)
   };
   if (context.mcpToolManager && context.getActiveSkills) {
-    tools.searchTools = createSearchToolsTool(
+    tools.searchMcpTools = createSearchMcpToolsTool(
+      context.mcpToolManager,
+      context.getActiveSkills
+    );
+    tools.callMcpTool = createCallMcpToolTool(
       context.mcpToolManager,
       context.getActiveSkills
     );
@@ -8221,134 +8468,21 @@ function shouldEmitDevAgentTrace() {
   return process.env.NODE_ENV === "development";
 }
 
-// src/chat/credentials/unlink-provider.ts
-async function unlinkProvider(userId, provider, userTokenStore) {
-  await Promise.all([
-    userTokenStore.delete(userId, provider),
-    deleteMcpStoredOAuthCredentials(userId, provider),
-    deleteMcpServerSessionId(userId, provider),
-    deleteMcpAuthSessionsForUserProvider(userId, provider)
-  ]);
-}
-
-// src/chat/services/plugin-auth-orchestration.ts
-var PluginAuthorizationPauseError = class extends Error {
+// src/chat/services/auth-pause.ts
+var AuthorizationPauseError = class extends Error {
+  disposition;
+  kind;
   provider;
-  constructor(provider) {
-    super(`Plugin authorization started for ${provider}`);
-    this.name = "PluginAuthorizationPauseError";
+  constructor(kind, provider, disposition) {
+    super(
+      kind === "mcp" ? `MCP authorization started for ${provider}` : `Plugin authorization started for ${provider}`
+    );
+    this.name = kind === "mcp" ? "McpAuthorizationPauseError" : "PluginAuthorizationPauseError";
+    this.disposition = disposition;
+    this.kind = kind;
     this.provider = provider;
   }
 };
-function isCommandAuthFailure(details) {
-  if (!details || typeof details !== "object") {
-    return false;
-  }
-  const result = details;
-  if (typeof result.exit_code !== "number" || result.exit_code === 0) {
-    return false;
-  }
-  const text = `${typeof result.stdout === "string" ? result.stdout : ""}
-${typeof result.stderr === "string" ? result.stderr : ""}`.toLowerCase();
-  if (!text.trim()) {
-    return false;
-  }
-  return [
-    /\b401\b/,
-    /\bunauthorized\b/,
-    /\bbad credentials\b/,
-    /\binvalid token\b/,
-    /\btoken (?:expired|revoked)\b/,
-    /\bexpired token\b/,
-    /\bmissing scopes?\b/,
-    /\binsufficient scope\b/,
-    /\binvalid grant\b/,
-    /\breauthoriz/
-  ].some((pattern) => pattern.test(text));
-}
-function commandTargetsProvider(provider, command, details) {
-  const normalizedCommand = command.trim().toLowerCase();
-  if (!normalizedCommand) {
-    return false;
-  }
-  if (provider === "github" && /^(gh|git)\b/.test(normalizedCommand)) {
-    return true;
-  }
-  const plugin = getPluginDefinition(provider);
-  const candidates = /* @__PURE__ */ new Set([provider.toLowerCase()]);
-  const credentials = plugin?.manifest.credentials;
-  if (credentials) {
-    candidates.add(credentials.authTokenEnv.toLowerCase());
-    for (const domain of credentials.apiDomains) {
-      candidates.add(domain.toLowerCase());
-    }
-  }
-  const combinedText = `${normalizedCommand}
-${details.stdout?.toLowerCase() ?? ""}
-${details.stderr?.toLowerCase() ?? ""}`;
-  return [...candidates].some((candidate) => combinedText.includes(candidate));
-}
-function createPluginAuthOrchestration(deps, abortAgent) {
-  let pendingPause;
-  const startAuthorizationPause = async (provider, activeSkill, options) => {
-    if (pendingPause) {
-      throw pendingPause;
-    }
-    if (!deps.requesterId || !getPluginOAuthConfig(provider)) {
-      throw new Error(`Cannot start plugin authorization for ${provider}`);
-    }
-    const providerLabel = formatProviderLabel(provider);
-    const oauthResult = await startOAuthFlow(provider, {
-      requesterId: deps.requesterId,
-      channelId: deps.channelId,
-      threadTs: deps.threadTs,
-      userMessage: deps.userMessage,
-      channelConfiguration: deps.channelConfiguration,
-      activeSkillName: activeSkill?.name ?? void 0,
-      resumeConversationId: deps.conversationId,
-      resumeSessionId: deps.sessionId
-    });
-    if (!oauthResult.ok) {
-      throw new Error(oauthResult.error);
-    }
-    if (!oauthResult.delivery) {
-      throw new Error(
-        `I need to connect your ${providerLabel} account first, but I wasn't able to send you a private authorization link. Please send me a direct message and try again.`
-      );
-    }
-    if (options?.unlinkExistingProvider && deps.requesterId && deps.userTokenStore) {
-      await unlinkProvider(deps.requesterId, provider, deps.userTokenStore);
-    }
-    pendingPause = new PluginAuthorizationPauseError(provider);
-    abortAgent();
-    throw pendingPause;
-  };
-  const handleCredentialUnavailable = async (input) => {
-    if (pendingPause) {
-      throw pendingPause;
-    }
-    if (!deps.requesterId || !getPluginOAuthConfig(input.error.provider)) {
-      throw input.error;
-    }
-    return await startAuthorizationPause(
-      input.error.provider,
-      input.activeSkill
-    );
-  };
-  return {
-    handleCredentialUnavailable,
-    handleCommandFailure: async (input) => {
-      const provider = input.activeSkill?.pluginProvider;
-      if (!provider || !deps.requesterId || !deps.userTokenStore || !getPluginOAuthConfig(provider) || !isCommandAuthFailure(input.details) || !commandTargetsProvider(provider, input.command, input.details)) {
-        return;
-      }
-      await startAuthorizationPause(provider, input.activeSkill, {
-        unlinkExistingProvider: true
-      });
-    },
-    getPendingPause: () => pendingPause
-  };
-}
 
 // src/chat/runtime/report-progress.ts
 function buildReportedProgressStatus(input) {
@@ -8396,15 +8530,16 @@ function resolveCredentialInjection(toolName, command, capabilityRuntime, sandbo
     const headerDomains = (headerTransforms ?? []).map(
       (transform) => transform.domain
     );
+    const skillName = sandbox.getActiveSkill()?.name;
     logInfo(
       "credential_inject_start",
       {},
       {
-        "app.skill.name": sandbox.getActiveSkill()?.name,
+        "app.skill.name": skillName,
         "app.credential.delivery": "header_transform",
         "app.credential.header_domains": headerDomains
       },
-      "Injecting scoped credential headers for sandbox command"
+      `Injecting scoped credential headers for sandbox command (${skillName ?? "unknown skill"} \u2192 ${headerDomains.join(", ")})`
     );
   }
   return { headerTransforms, env };
@@ -8460,8 +8595,10 @@ function getToolErrorAttributes(error) {
   };
 }
 function handleToolExecutionError(error, toolName, toolCallId, shouldTrace, traceContext) {
+  const errorType = getMcpAwareErrorType(error, "tool_execution_error");
+  const errorMessage = getMcpAwareErrorMessage(error);
   setSpanAttributes({
-    "error.type": error instanceof Error ? error.name : "tool_execution_error"
+    "error.type": errorType
   });
   if (shouldTrace) {
     logWarn(
@@ -8472,8 +8609,8 @@ function handleToolExecutionError(error, toolName, toolCallId, shouldTrace, trac
         "gen_ai.operation.name": "execute_tool",
         "gen_ai.tool.name": toolName,
         ...toolCallId ? { "gen_ai.tool.call.id": toolCallId } : {},
-        "error.type": error instanceof Error ? error.name : "tool_execution_error",
-        "error.message": error instanceof Error ? error.message : String(error)
+        "error.type": errorType,
+        "error.message": errorMessage
       },
       "Agent tool call failed"
     );
@@ -8507,7 +8644,6 @@ function createAgentTools(tools, sandbox, spanContext, onStatus, sandboxExecutor
     execute: async (toolCallId, params) => {
       const normalizedToolCallId = typeof toolCallId === "string" && toolCallId.length > 0 ? toolCallId : void 0;
       const toolArgumentsAttribute = serializeGenAiAttribute(params);
-      onToolCall?.(toolName);
       const traceToolContext = {
         ...spanContext,
         conversationId: spanContext.conversationId,
@@ -8526,6 +8662,7 @@ function createAgentTools(tools, sandbox, spanContext, onStatus, sandboxExecutor
         spanContext,
         async () => {
           const parsed = params;
+          onToolCall?.(toolName, parsed);
           try {
             if (typeof toolDef.execute !== "function") {
               const resultDetails = { ok: true };
@@ -8577,7 +8714,7 @@ function createAgentTools(tools, sandbox, spanContext, onStatus, sandboxExecutor
             }
             return normalized;
           } catch (error) {
-            if (error instanceof PluginAuthorizationPauseError) {
+            if (error instanceof AuthorizationPauseError) {
               throw error;
             }
             handleToolExecutionError(
@@ -8788,14 +8925,6 @@ function getTerminalAssistantMessages(messages) {
   }
   return messages.slice(lastToolResultIndex + 1).filter(isAssistantMessage);
 }
-function hasCompletedAssistantTurn(messages) {
-  const message = getTerminalAssistantMessages(messages).at(-1);
-  if (!message) {
-    return false;
-  }
-  const stopReason = message.stopReason;
-  return typeof stopReason === "string" && stopReason !== "error" && extractAssistantText(message).trim().length > 0;
-}
 function upsertActiveSkill(activeSkills, next) {
   const existing = activeSkills.find((skill) => skill.name === next.name);
   if (existing) {
@@ -8803,24 +8932,11 @@ function upsertActiveSkill(activeSkills, next) {
     existing.description = next.description;
     existing.skillPath = next.skillPath;
     existing.allowedTools = next.allowedTools;
-    existing.usesConfig = next.usesConfig;
     existing.pluginProvider = next.pluginProvider;
     return;
   }
   activeSkills.push(next);
 }
-function collectRelevantConfigurationKeys(activeSkills, explicitSkill) {
-  const keys = /* @__PURE__ */ new Set();
-  for (const skill of [
-    ...activeSkills,
-    ...explicitSkill ? [explicitSkill] : []
-  ]) {
-    for (const key of skill.usesConfig ?? []) {
-      keys.add(key);
-    }
-  }
-  return [...keys].sort((a, b) => a.localeCompare(b));
-}
 function trimTrailingAssistantMessages(messages) {
   let end = messages.length;
   while (end > 0 && getPiMessageRole(messages[end - 1]) === "assistant") {
@@ -9023,7 +9139,10 @@ function buildTurnResult(input) {
 // src/chat/services/turn-thinking-level.ts
 import { z } from "zod";
 var CLASSIFIER_CONFIDENCE_THRESHOLD = 0.75;
-var MAX_ROUTER_CONTEXT_CHARS = 1200;
+var MAX_ROUTER_CONTEXT_CHARS = 8e3;
+var ROUTER_CONTEXT_HEAD_CHARS = 3e3;
+var ROUTER_CONTEXT_TAIL_CHARS = 5e3;
+var TRUNCATION_MARKER = "\n\u2026[truncated]\u2026\n";
 var TURN_THINKING_LEVELS = ["none", "low", "medium", "high"];
 var turnExecutionProfileSchema = z.object({
   thinking_level: z.enum(TURN_THINKING_LEVELS),
@@ -9034,9 +9153,22 @@ var DEFAULT_THINKING_LEVEL = "low";
 function trimContextForRouter(text) {
   const trimmed = text?.trim();
   if (!trimmed) {
-    return void 0;
+    return null;
+  }
+  if (trimmed.length <= MAX_ROUTER_CONTEXT_CHARS) {
+    return {
+      text: trimmed,
+      truncated: false,
+      originalCharCount: trimmed.length
+    };
   }
-  return trimmed.length <= MAX_ROUTER_CONTEXT_CHARS ? trimmed : trimmed.slice(-MAX_ROUTER_CONTEXT_CHARS);
+  const head = trimmed.slice(0, ROUTER_CONTEXT_HEAD_CHARS).trimEnd();
+  const tail = trimmed.slice(-ROUTER_CONTEXT_TAIL_CHARS).trimStart();
+  return {
+    text: `${head}${TRUNCATION_MARKER}${tail}`,
+    truncated: true,
+    originalCharCount: trimmed.length
+  };
 }
 function buildClassifierSystemPrompt() {
   return [
@@ -9048,22 +9180,23 @@ function buildClassifierSystemPrompt() {
     "Use medium for investigations, ambiguous asks, multi-step analysis, or likely multi-tool work.",
     "Use high for code changes, debugging/root-cause analysis, research-heavy work, non-trivial drafting, or explicit requests to be thorough.",
     "",
+    "Classify based on the substance of the task, not the length of the current message. When the current instruction is a short affirmation (for example: 'go', 'do it', 'yes please', 'proceed') and the thread-background contains a pending task, classify the pending task \u2014 not the affirmation.",
+    "",
     "Return JSON only with thinking_level, confidence, and reason."
   ].join("\n");
 }
 function buildClassifierPrompt(args) {
   const sections = [];
-  const context = trimContextForRouter(args.conversationContext);
-  if (context) {
-    sections.push("<thread-background>", context, "</thread-background>", "");
+  if (args.conversationContext) {
+    sections.push(
+      "<thread-background>",
+      args.conversationContext.text,
+      "</thread-background>",
+      ""
+    );
   }
   sections.push(
-    "<turn-context>",
-    `- active_skills: ${args.activeSkillNames.join(", ") || "none"}`,
-    `- attachment_count: ${args.attachmentCount}`,
-    "</turn-context>",
-    "",
-    '<current-instruction priority="highest">',
+    "<current-instruction>",
     args.messageText.trim() || "[empty]",
     "</current-instruction>"
   );
@@ -9077,42 +9210,81 @@ function buildClassifierPrompt(args) {
   return sections.join("\n");
 }
 async function selectTurnThinkingLevel(args) {
-  const activeSkillNames = [...new Set(args.activeSkillNames ?? [])].sort();
+  const trimmedContext = trimContextForRouter(args.conversationContext);
+  const instructionLength = args.messageText.trim().length;
+  const turnBlockCount = (args.currentTurnBlocks ?? []).filter(
+    (block) => block.trim().length > 0
+  ).length;
+  const prompt = buildClassifierPrompt({
+    conversationContext: trimmedContext,
+    currentTurnBlocks: args.currentTurnBlocks,
+    messageText: args.messageText
+  });
+  const logContext = {
+    slackThreadId: args.context?.threadId,
+    slackChannelId: args.context?.channelId,
+    slackUserId: args.context?.requesterId,
+    runId: args.context?.runId,
+    modelId: args.fastModelId
+  };
+  return withSpan(
+    "chat.route_thinking",
+    "chat.route_thinking",
+    logContext,
+    async () => {
+      setSpanAttributes({
+        "app.ai.router.prompt_char_count": prompt.length,
+        "app.ai.router.instruction_char_count": instructionLength,
+        "app.ai.router.context_char_count": trimmedContext?.originalCharCount ?? 0,
+        "app.ai.router.context_trimmed": trimmedContext?.truncated ?? false,
+        "app.ai.router.turn_block_count": turnBlockCount
+      });
+      const selection = await classifyTurn({
+        completeObject: args.completeObject,
+        fastModelId: args.fastModelId,
+        metadata: {
+          modelId: args.fastModelId,
+          threadId: args.context?.threadId ?? "",
+          channelId: args.context?.channelId ?? "",
+          requesterId: args.context?.requesterId ?? "",
+          runId: args.context?.runId ?? ""
+        },
+        prompt
+      });
+      setSpanAttributes({
+        "app.ai.thinking_level": selection.thinkingLevel,
+        "app.ai.thinking_level_reason": selection.reason,
+        ...selection.confidence !== void 0 ? { "app.ai.thinking_level_confidence": selection.confidence } : {}
+      });
+      return selection;
+    }
+  );
+}
+async function classifyTurn(args) {
   try {
     const result = await args.completeObject({
       modelId: args.fastModelId,
       schema: turnExecutionProfileSchema,
       maxTokens: 120,
-      metadata: {
-        modelId: args.fastModelId,
-        threadId: args.context?.threadId ?? "",
-        channelId: args.context?.channelId ?? "",
-        requesterId: args.context?.requesterId ?? "",
-        runId: args.context?.runId ?? ""
-      },
-      prompt: buildClassifierPrompt({
-        activeSkillNames,
-        attachmentCount: args.attachmentCount ?? 0,
-        conversationContext: args.conversationContext,
-        currentTurnBlocks: args.currentTurnBlocks,
-        messageText: args.messageText
-      }),
+      metadata: args.metadata,
+      prompt: args.prompt,
       thinkingLevel: "low",
       system: buildClassifierSystemPrompt(),
       temperature: 0
     });
     const parsed = turnExecutionProfileSchema.parse(result.object);
+    const reason = parsed.reason.trim();
     if (parsed.confidence < CLASSIFIER_CONFIDENCE_THRESHOLD) {
       return {
         confidence: parsed.confidence,
         thinkingLevel: DEFAULT_THINKING_LEVEL,
-        reason: `low_confidence_default:${parsed.reason.trim()}`
+        reason: `low_confidence_default:${reason}`
       };
     }
     return {
       confidence: parsed.confidence,
       thinkingLevel: parsed.thinking_level,
-      reason: parsed.reason.trim()
+      reason
     };
   } catch {
     return {
@@ -9150,7 +9322,7 @@ function parseAgentTurnSessionCheckpoint(value) {
       return void 0;
     }
     const status = parsed.state;
-    if (status !== "running" && status !== "awaiting_resume" && status !== "completed" && status !== "failed") {
+    if (status !== "running" && status !== "awaiting_resume" && status !== "completed" && status !== "failed" && status !== "superseded") {
       return void 0;
     }
     const conversationId = parsed.conversationId;
@@ -9222,6 +9394,26 @@ async function upsertAgentTurnSessionCheckpoint(args) {
   );
   return checkpoint;
 }
+async function supersedeAgentTurnSessionCheckpoint(args) {
+  const existing = await getAgentTurnSessionCheckpoint(
+    args.conversationId,
+    args.sessionId
+  );
+  if (!existing || existing.state === "completed" || existing.state === "failed" || existing.state === "superseded") {
+    return void 0;
+  }
+  return await upsertAgentTurnSessionCheckpoint({
+    conversationId: existing.conversationId,
+    sessionId: existing.sessionId,
+    sliceId: existing.sliceId,
+    state: "superseded",
+    piMessages: existing.piMessages,
+    loadedSkillNames: existing.loadedSkillNames,
+    resumeReason: existing.resumeReason,
+    resumedFromSliceId: existing.resumedFromSliceId,
+    errorMessage: args.errorMessage ?? existing.errorMessage
+  });
+}
 
 // src/chat/services/turn-checkpoint.ts
 async function loadTurnCheckpoint(ctx) {
@@ -9334,77 +9526,299 @@ async function persistTimeoutCheckpoint(args) {
     );
     return void 0;
   }
-}
-
-// src/chat/services/mcp-auth-orchestration.ts
-var McpAuthorizationPauseError = class extends Error {
-  provider;
-  constructor(provider) {
-    super(`MCP authorization started for ${provider}`);
-    this.name = "McpAuthorizationPauseError";
-    this.provider = provider;
+}
+
+// src/chat/services/pending-auth.ts
+var AUTH_LINK_REUSE_WINDOW_MS = 10 * 60 * 1e3;
+function canReusePendingAuthLink(args) {
+  const { pendingAuth } = args;
+  if (!pendingAuth) {
+    return false;
+  }
+  return pendingAuth.kind === args.kind && pendingAuth.provider === args.provider && pendingAuth.requesterId === args.requesterId && pendingAuth.linkSentAtMs + AUTH_LINK_REUSE_WINDOW_MS > (args.nowMs ?? Date.now());
+}
+function buildAuthPauseReplyText(args) {
+  const providerLabel = args.provider ? formatProviderLabel(args.provider) : "";
+  if (args.disposition === "link_already_sent") {
+    return providerLabel ? `I still need your ${providerLabel} access to continue. I already sent you a private link.` : "I still need additional access to continue. I already sent you a private link.";
+  }
+  return providerLabel ? `I need your ${providerLabel} access to continue. I sent you a private link.` : "I need additional access to continue. I sent you a private link.";
+}
+function getConversationPendingAuth(args) {
+  const pendingAuth = args.conversation.processing.pendingAuth;
+  if (!pendingAuth) {
+    return void 0;
+  }
+  if (pendingAuth.kind !== args.kind || pendingAuth.provider !== args.provider || pendingAuth.requesterId !== args.requesterId) {
+    return void 0;
+  }
+  return pendingAuth;
+}
+function clearPendingAuth(conversation, sessionId) {
+  if (!conversation.processing.pendingAuth) {
+    return;
+  }
+  if (sessionId && conversation.processing.pendingAuth.sessionId !== sessionId) {
+    return;
+  }
+  conversation.processing.pendingAuth = void 0;
+}
+async function applyPendingAuthUpdate(args) {
+  const previousPendingAuth = args.conversation.processing.pendingAuth;
+  args.conversation.processing.pendingAuth = args.nextPendingAuth;
+  if (previousPendingAuth && previousPendingAuth.sessionId !== args.nextPendingAuth.sessionId && args.conversationId) {
+    await supersedeAgentTurnSessionCheckpoint({
+      conversationId: args.conversationId,
+      sessionId: previousPendingAuth.sessionId,
+      errorMessage: "Superseded by a newer auth-blocked request in the same conversation."
+    });
+  }
+}
+function isPendingAuthLatestRequest(conversation, pendingAuth) {
+  for (let index = conversation.messages.length - 1; index >= 0; index -= 1) {
+    const message = conversation.messages[index];
+    if (message?.role !== "user") {
+      continue;
+    }
+    return buildDeterministicTurnId(message.id) === pendingAuth.sessionId;
+  }
+  return false;
+}
+
+// src/chat/services/mcp-auth-orchestration.ts
+var McpAuthorizationPauseError = class extends AuthorizationPauseError {
+  constructor(provider, disposition) {
+    super("mcp", provider, disposition);
+  }
+};
+function createMcpAuthOrchestration(deps, abortAgent) {
+  let pendingPause;
+  const authSessionIdsByProvider = /* @__PURE__ */ new Map();
+  const authProviderFactory = async (plugin) => {
+    if (!deps.conversationId || !deps.sessionId || !deps.requesterId) {
+      return void 0;
+    }
+    const provider = await createMcpOAuthClientProvider({
+      provider: plugin.manifest.name,
+      conversationId: deps.conversationId,
+      sessionId: deps.sessionId,
+      userId: deps.requesterId,
+      userMessage: deps.userMessage,
+      ...deps.channelId ? { channelId: deps.channelId } : {},
+      ...deps.threadTs ? { threadTs: deps.threadTs } : {},
+      ...deps.toolChannelId ? { toolChannelId: deps.toolChannelId } : {},
+      configuration: deps.getConfiguration(),
+      artifactState: deps.getArtifactState()
+    });
+    authSessionIdsByProvider.set(plugin.manifest.name, provider.authSessionId);
+    return provider;
+  };
+  const onAuthorizationRequired = async (provider) => {
+    if (pendingPause) {
+      return true;
+    }
+    const authSessionId = authSessionIdsByProvider.get(provider);
+    if (!authSessionId || !deps.requesterId) {
+      throw new Error(
+        `Missing MCP auth session context for plugin "${provider}"`
+      );
+    }
+    const latestArtifactState = deps.getMergedArtifactState();
+    await patchMcpAuthSession(authSessionId, {
+      configuration: { ...deps.getConfiguration() },
+      artifactState: latestArtifactState,
+      toolChannelId: deps.toolChannelId ?? latestArtifactState.assistantContextChannelId ?? deps.channelId
+    });
+    const authSession = await getMcpAuthSession(authSessionId);
+    if (!authSession?.authorizationUrl) {
+      throw new Error(`Missing MCP authorization URL for plugin "${provider}"`);
+    }
+    const reusingPendingLink = canReusePendingAuthLink({
+      pendingAuth: deps.currentPendingAuth,
+      kind: "mcp",
+      provider,
+      requesterId: deps.requesterId
+    });
+    if (!reusingPendingLink) {
+      const delivery = await deliverPrivateMessage({
+        channelId: authSession.channelId,
+        threadTs: authSession.threadTs,
+        userId: authSession.userId,
+        text: `<${authSession.authorizationUrl}|Click here to link your ${formatProviderLabel(provider)} MCP access>. Once you've authorized, this thread will continue automatically.`
+      });
+      if (!delivery) {
+        throw new Error(
+          `Unable to deliver MCP authorization link for plugin "${provider}"`
+        );
+      }
+    } else {
+      await deleteMcpAuthSession(authSessionId);
+    }
+    if (deps.sessionId && deps.requesterId) {
+      await deps.onPendingAuth?.({
+        kind: "mcp",
+        provider,
+        requesterId: deps.requesterId,
+        sessionId: deps.sessionId,
+        linkSentAtMs: reusingPendingLink ? deps.currentPendingAuth.linkSentAtMs : Date.now()
+      });
+    }
+    pendingPause = new McpAuthorizationPauseError(
+      provider,
+      reusingPendingLink ? "link_already_sent" : "link_sent"
+    );
+    abortAgent();
+    return true;
+  };
+  return {
+    authProviderFactory,
+    onAuthorizationRequired,
+    getPendingPause: () => pendingPause
+  };
+}
+
+// src/chat/credentials/unlink-provider.ts
+async function unlinkProvider(userId, provider, userTokenStore) {
+  await Promise.all([
+    userTokenStore.delete(userId, provider),
+    deleteMcpStoredOAuthCredentials(userId, provider),
+    deleteMcpServerSessionId(userId, provider),
+    deleteMcpAuthSessionsForUserProvider(userId, provider)
+  ]);
+}
+
+// src/chat/services/plugin-auth-orchestration.ts
+var PluginAuthorizationPauseError = class extends AuthorizationPauseError {
+  constructor(provider, disposition) {
+    super("plugin", provider, disposition);
+  }
+};
+function isCommandAuthFailure(details) {
+  if (!details || typeof details !== "object") {
+    return false;
+  }
+  const result = details;
+  if (typeof result.exit_code !== "number" || result.exit_code === 0) {
+    return false;
+  }
+  const text = `${typeof result.stdout === "string" ? result.stdout : ""}
+${typeof result.stderr === "string" ? result.stderr : ""}`.toLowerCase();
+  if (!text.trim()) {
+    return false;
+  }
+  return [
+    /\b401\b/,
+    /\bunauthorized\b/,
+    /\bbad credentials\b/,
+    /\binvalid token\b/,
+    /\btoken (?:expired|revoked)\b/,
+    /\bexpired token\b/,
+    /\bmissing scopes?\b/,
+    /\binsufficient scope\b/,
+    /\binvalid grant\b/,
+    /\breauthoriz/
+  ].some((pattern) => pattern.test(text));
+}
+function commandTargetsProvider(provider, command, details) {
+  const normalizedCommand = command.trim().toLowerCase();
+  if (!normalizedCommand) {
+    return false;
+  }
+  if (provider === "github" && /^(gh|git)\b/.test(normalizedCommand)) {
+    return true;
   }
-};
-function createMcpAuthOrchestration(deps, abortAgent) {
-  let pendingPause;
-  const authSessionIdsByProvider = /* @__PURE__ */ new Map();
-  const authProviderFactory = async (plugin) => {
-    if (!deps.conversationId || !deps.sessionId || !deps.requesterId) {
-      return void 0;
+  const plugin = getPluginDefinition(provider);
+  const candidates = /* @__PURE__ */ new Set([provider.toLowerCase()]);
+  const credentials = plugin?.manifest.credentials;
+  if (credentials) {
+    candidates.add(credentials.authTokenEnv.toLowerCase());
+    for (const domain of credentials.apiDomains) {
+      candidates.add(domain.toLowerCase());
     }
-    const provider = await createMcpOAuthClientProvider({
-      provider: plugin.manifest.name,
-      conversationId: deps.conversationId,
-      sessionId: deps.sessionId,
-      userId: deps.requesterId,
-      userMessage: deps.userMessage,
-      ...deps.channelId ? { channelId: deps.channelId } : {},
-      ...deps.threadTs ? { threadTs: deps.threadTs } : {},
-      ...deps.toolChannelId ? { toolChannelId: deps.toolChannelId } : {},
-      configuration: deps.getConfiguration(),
-      artifactState: deps.getArtifactState()
-    });
-    authSessionIdsByProvider.set(plugin.manifest.name, provider.authSessionId);
-    return provider;
-  };
-  const onAuthorizationRequired = async (provider) => {
+  }
+  const combinedText = `${normalizedCommand}
+${details.stdout?.toLowerCase() ?? ""}
+${details.stderr?.toLowerCase() ?? ""}`;
+  return [...candidates].some((candidate) => combinedText.includes(candidate));
+}
+function createPluginAuthOrchestration(deps, abortAgent) {
+  let pendingPause;
+  const startAuthorizationPause = async (provider, activeSkill, options) => {
     if (pendingPause) {
-      return true;
+      throw pendingPause;
     }
-    const authSessionId = authSessionIdsByProvider.get(provider);
-    if (!authSessionId || !deps.requesterId) {
-      throw new Error(
-        `Missing MCP auth session context for plugin "${provider}"`
-      );
+    if (!deps.requesterId || !getPluginOAuthConfig(provider)) {
+      throw new Error(`Cannot start plugin authorization for ${provider}`);
     }
-    const latestArtifactState = deps.getMergedArtifactState();
-    await patchMcpAuthSession(authSessionId, {
-      configuration: { ...deps.getConfiguration() },
-      artifactState: latestArtifactState,
-      toolChannelId: deps.toolChannelId ?? latestArtifactState.assistantContextChannelId ?? deps.channelId
+    const providerLabel = formatProviderLabel(provider);
+    const reusingPendingLink = canReusePendingAuthLink({
+      pendingAuth: deps.currentPendingAuth,
+      kind: "plugin",
+      provider,
+      requesterId: deps.requesterId
     });
-    const authSession = await getMcpAuthSession(authSessionId);
-    if (!authSession?.authorizationUrl) {
-      throw new Error(`Missing MCP authorization URL for plugin "${provider}"`);
+    if (!reusingPendingLink) {
+      const oauthResult = await startOAuthFlow(provider, {
+        requesterId: deps.requesterId,
+        channelId: deps.channelId,
+        threadTs: deps.threadTs,
+        userMessage: deps.userMessage,
+        channelConfiguration: deps.channelConfiguration,
+        activeSkillName: activeSkill?.name ?? void 0,
+        resumeConversationId: deps.conversationId,
+        resumeSessionId: deps.sessionId
+      });
+      if (!oauthResult.ok) {
+        throw new Error(oauthResult.error);
+      }
+      if (!oauthResult.delivery) {
+        throw new Error(
+          `I need to connect your ${providerLabel} account first, but I wasn't able to send you a private authorization link. Please send me a direct message and try again.`
+        );
+      }
     }
-    const delivery = await deliverPrivateMessage({
-      channelId: authSession.channelId,
-      threadTs: authSession.threadTs,
-      userId: authSession.userId,
-      text: `<${authSession.authorizationUrl}|Click here to link your ${formatProviderLabel(provider)} MCP access>. Once you've authorized, this thread will continue automatically.`
-    });
-    if (!delivery) {
-      throw new Error(
-        `Unable to deliver MCP authorization link for plugin "${provider}"`
-      );
+    if (options?.unlinkExistingProvider && deps.requesterId && deps.userTokenStore) {
+      await unlinkProvider(deps.requesterId, provider, deps.userTokenStore);
+    }
+    if (deps.sessionId) {
+      await deps.onPendingAuth?.({
+        kind: "plugin",
+        provider,
+        requesterId: deps.requesterId,
+        sessionId: deps.sessionId,
+        linkSentAtMs: reusingPendingLink ? deps.currentPendingAuth.linkSentAtMs : Date.now()
+      });
     }
-    pendingPause = new McpAuthorizationPauseError(provider);
+    pendingPause = new PluginAuthorizationPauseError(
+      provider,
+      reusingPendingLink ? "link_already_sent" : "link_sent"
+    );
     abortAgent();
-    return true;
+    throw pendingPause;
+  };
+  const handleCredentialUnavailable = async (input) => {
+    if (pendingPause) {
+      throw pendingPause;
+    }
+    if (!deps.requesterId || !getPluginOAuthConfig(input.error.provider)) {
+      throw input.error;
+    }
+    return await startAuthorizationPause(
+      input.error.provider,
+      input.activeSkill
+    );
   };
   return {
-    authProviderFactory,
-    onAuthorizationRequired,
+    handleCredentialUnavailable,
+    handleCommandFailure: async (input) => {
+      const provider = input.activeSkill?.pluginProvider;
+      if (!provider || !deps.requesterId || !deps.userTokenStore || !getPluginOAuthConfig(provider) || !isCommandAuthFailure(input.details) || !commandTargetsProvider(provider, input.command, input.details)) {
+        return;
+      }
+      await startAuthorizationPause(provider, input.activeSkill, {
+        unlinkExistingProvider: true
+      });
+    },
     getPendingPause: () => pendingPause
   };
 }
@@ -9505,26 +9919,13 @@ function buildUserTurnInput(args) {
   }
   return { routerBlocks, userContentParts };
 }
-function mcpToolsToDefinitions(mcpTools) {
-  const defs = {};
-  for (const tool2 of mcpTools) {
-    defs[tool2.name] = {
-      description: tool2.description,
-      // Raw JSON Schema from MCP servers — not a TypeBox TSchema, but
-      // pi-agent-core validates with AJV and the Anthropic provider reads
-      // .properties/.required, so raw JSON Schema works at runtime.
-      inputSchema: tool2.parameters,
-      execute: async (args) => tool2.execute(args)
-    };
-  }
-  return defs;
-}
 async function generateAssistantReply(messageText, context = {}) {
   const replyStartedAtMs = Date.now();
   let timeoutResumeConversationId;
   let timeoutResumeSessionId;
   let timeoutResumeSliceId = 1;
   let timeoutResumeMessages = [];
+  let beforeMessageCount = 0;
   let lastKnownSandboxId = context.sandbox?.sandboxId;
   let lastKnownSandboxDependencyProfileHash = context.sandbox?.sandboxDependencyProfileHash;
   let loadedSkillNamesForResume = [];
@@ -9717,8 +10118,6 @@ async function generateAssistantReply(messageText, context = {}) {
       userTurnText
     });
     thinkingSelection = await selectTurnThinkingLevel({
-      activeSkillNames: activeSkills.map((skill) => skill.name),
-      attachmentCount: context.userAttachments?.length,
       completeObject,
       conversationContext: context.conversationContext,
       context: {
@@ -9754,9 +10153,11 @@ async function generateAssistantReply(messageText, context = {}) {
         threadTs: context.correlation?.threadTs,
         toolChannelId: context.toolChannelId,
         userMessage: userInput,
+        currentPendingAuth: context.pendingAuth,
         getConfiguration: () => configurationValues,
         getArtifactState: () => context.artifactState,
-        getMergedArtifactState: () => mergeArtifactsState(context.artifactState ?? {}, artifactStatePatch)
+        getMergedArtifactState: () => mergeArtifactsState(context.artifactState ?? {}, artifactStatePatch),
+        onPendingAuth: context.onAuthPending
       },
       () => agent?.abort()
     );
@@ -9769,6 +10170,8 @@ async function generateAssistantReply(messageText, context = {}) {
         threadTs: context.correlation?.threadTs,
         userMessage: userInput,
         channelConfiguration: context.channelConfiguration,
+        currentPendingAuth: context.pendingAuth,
+        onPendingAuth: context.onAuthPending,
         userTokenStore
       },
       () => agent?.abort()
@@ -9849,11 +10252,18 @@ async function generateAssistantReply(messageText, context = {}) {
           if (!effective.pluginProvider) {
             return void 0;
           }
-          syncMcpAgentTools();
-          return {
-            available_tools: turnMcpToolManager.getActiveToolCatalog(activeSkills, {
+          if (!turnMcpToolManager.getActiveProviders().includes(effective.pluginProvider)) {
+            return void 0;
+          }
+          const availableToolCount = turnMcpToolManager.getActiveToolCatalog(
+            activeSkills,
+            {
               provider: effective.pluginProvider
-            }).map(toExposedToolSummary)
+            }
+          ).length;
+          return {
+            mcp_provider: effective.pluginProvider,
+            available_tool_count: availableToolCount
           };
         }
       },
@@ -9883,22 +10293,20 @@ async function generateAssistantReply(messageText, context = {}) {
       await enableSkillCredentials(skill, `skill:${skill.name}:turn:resume`);
     }
     syncResumeState();
-    const activeToolSummaries = turnMcpToolManager.getActiveToolCatalog(activeSkills).map(toExposedToolSummary);
+    const activeMcpCatalogs = toActiveMcpCatalogSummaries(
+      turnMcpToolManager.getActiveToolCatalog(activeSkills)
+    );
     baseInstructions = buildSystemPrompt({
       availableSkills,
       activeSkills,
-      activeTools: activeToolSummaries,
+      activeMcpCatalogs,
       invocation: skillInvocation,
       assistant: context.assistant,
       requester: context.requester,
       artifactState: context.artifactState,
       configuration: configurationValues,
-      relevantConfigurationKeys: collectRelevantConfigurationKeys(
-        activeSkills,
-        invokedSkill
-      ),
-      runtimeMetadata: getRuntimeMetadata(),
-      threadParticipants: context.threadParticipants
+      threadParticipants: context.threadParticipants,
+      turnState: resumedFromCheckpoint ? "resumed" : "fresh"
     });
     const inputMessagesAttribute = serializeGenAiAttribute([
       {
@@ -9910,10 +10318,23 @@ async function generateAssistantReply(messageText, context = {}) {
         content: userContentParts.map((part) => toObservablePromptPart(part))
       }
     ]);
-    const onToolCall = (toolName) => {
+    const onToolCall = (toolName, params) => {
       toolCalls.push(toolName);
+      try {
+        context.onToolInvocation?.({ toolName, params });
+      } catch (error) {
+        logWarn(
+          "tool_invocation_observer_failed",
+          spanContext,
+          {
+            "gen_ai.tool.name": toolName,
+            "error.message": error instanceof Error ? error.message : String(error)
+          },
+          "Tool invocation observer failed"
+        );
+      }
     };
-    const baseAgentTools = createAgentTools(
+    const agentTools = createAgentTools(
       tools,
       skillSandbox,
       spanContext,
@@ -9923,24 +10344,6 @@ async function generateAssistantReply(messageText, context = {}) {
       pluginAuth,
       onToolCall
     );
-    const agentTools = [...baseAgentTools];
-    const syncMcpAgentTools = () => {
-      const mcpTools = turnMcpToolManager.getResolvedActiveTools(activeSkills);
-      const mcpDefs = mcpToolsToDefinitions(mcpTools);
-      const mcpAgentTools = createAgentTools(
-        mcpDefs,
-        skillSandbox,
-        spanContext,
-        context.onStatus,
-        sandboxExecutor,
-        capabilityRuntime,
-        pluginAuth,
-        onToolCall
-      );
-      agentTools.length = 0;
-      agentTools.push(...baseAgentTools, ...mcpAgentTools);
-    };
-    syncMcpAgentTools();
     agent = new Agent({
       getApiKey: () => getPiGatewayApiKeyOverride(),
       initialState: {
@@ -9987,9 +10390,8 @@ async function generateAssistantReply(messageText, context = {}) {
         );
       });
     });
-    let beforeMessageCount = agent.state.messages.length;
     let newMessages = [];
-    let completedAssistantTurn = false;
+    beforeMessageCount = agent.state.messages.length;
     try {
       if (resumedFromCheckpoint) {
         agent.state.messages = existingCheckpoint.piMessages;
@@ -10056,11 +10458,6 @@ async function generateAssistantReply(messageText, context = {}) {
             }
           }
           newMessages = agent.state.messages.slice(beforeMessageCount);
-          completedAssistantTurn = hasCompletedAssistantTurn(newMessages);
-          if (getPendingAuthPause() && !completedAssistantTurn) {
-            timeoutResumeMessages = [...agent.state.messages];
-            throw getPendingAuthPause();
-          }
           const outputMessages = newMessages.filter(isAssistantMessage);
           const outputMessagesAttribute = serializeGenAiAttribute(outputMessages);
           const usageSummary = extractGenAiUsageSummary(
@@ -10076,6 +10473,10 @@ async function generateAssistantReply(messageText, context = {}) {
             ...usageSummary.inputTokens !== void 0 ? { "gen_ai.usage.input_tokens": usageSummary.inputTokens } : {},
             ...usageSummary.outputTokens !== void 0 ? { "gen_ai.usage.output_tokens": usageSummary.outputTokens } : {}
           });
+          if (getPendingAuthPause()) {
+            timeoutResumeMessages = [...agent.state.messages];
+            throw getPendingAuthPause();
+          }
         },
         {
           "gen_ai.provider.name": GEN_AI_PROVIDER_NAME,
@@ -10088,9 +10489,6 @@ async function generateAssistantReply(messageText, context = {}) {
     } finally {
       unsubscribe();
     }
-    if (getPendingAuthPause() && !completedAssistantTurn) {
-      throw getPendingAuthPause();
-    }
     if (checkpointState.canUseTurnSession && sessionConversationId && sessionId) {
       await persistCompletedCheckpoint({
         conversationId: sessionConversationId,
@@ -10148,7 +10546,15 @@ async function generateAssistantReply(messageText, context = {}) {
         );
       }
     }
-    if ((error instanceof McpAuthorizationPauseError || error instanceof PluginAuthorizationPauseError) && timeoutResumeConversationId && timeoutResumeSessionId) {
+    if (error instanceof AuthorizationPauseError && timeoutResumeConversationId && timeoutResumeSessionId) {
+      if (!turnUsage && timeoutResumeMessages.length > 0) {
+        const fallbackUsage = extractGenAiUsageSummary(
+          ...timeoutResumeMessages.slice(beforeMessageCount).filter(isAssistantMessage)
+        );
+        turnUsage = Object.values(fallbackUsage).some(
+          (value) => value !== void 0
+        ) ? fallbackUsage : void 0;
+      }
       const nextSliceId = await persistAuthPauseCheckpoint({
         conversationId: timeoutResumeConversationId,
         sessionId: timeoutResumeSessionId,
@@ -10166,9 +10572,15 @@ async function generateAssistantReply(messageText, context = {}) {
         }
       });
       throw new RetryableTurnError(
-        error instanceof PluginAuthorizationPauseError ? "plugin_auth_resume" : "mcp_auth_resume",
+        error.kind === "plugin" ? "plugin_auth_resume" : "mcp_auth_resume",
         `conversation=${timeoutResumeConversationId} session=${timeoutResumeSessionId} slice=${nextSliceId}`,
         {
+          authDisposition: error.disposition,
+          authDurationMs: Date.now() - replyStartedAtMs,
+          authKind: error.kind,
+          authProvider: error.provider,
+          authThinkingLevel: thinkingSelection?.thinkingLevel,
+          authUsage: turnUsage,
           conversationId: timeoutResumeConversationId,
           sessionId: timeoutResumeSessionId,
           sliceId: nextSliceId
@@ -11041,6 +11453,82 @@ async function resumeAuthorizedRequest(args) {
   });
 }
 
+// src/chat/runtime/auth-pause-reply.ts
+function buildAuthPauseSlackMessage(args) {
+  const footer = buildSlackReplyFooter({
+    conversationId: args.conversationId,
+    durationMs: args.durationMs,
+    thinkingLevel: args.thinkingLevel,
+    usage: args.usage
+  });
+  const blocks = buildSlackReplyBlocks(args.text, footer);
+  return blocks ? { text: args.text, blocks } : { text: args.text };
+}
+function completeAuthPauseTurn(args) {
+  markConversationMessage(
+    args.conversation,
+    getTurnUserMessageId(args.conversation, args.sessionId),
+    {
+      replied: true,
+      skippedReason: void 0
+    }
+  );
+  upsertConversationMessage(args.conversation, {
+    id: generateConversationId("assistant"),
+    role: "assistant",
+    text: normalizeConversationText(args.text) || "[empty response]",
+    createdAtMs: Date.now(),
+    author: {
+      userName: botConfig.userName,
+      isBot: true
+    },
+    meta: {
+      replied: true
+    }
+  });
+  markTurnCompleted({
+    conversation: args.conversation,
+    nowMs: Date.now(),
+    sessionId: args.sessionId,
+    updateConversationStats
+  });
+}
+async function persistAuthPauseReplyState(args) {
+  const currentState = await getPersistedThreadState(args.threadStateId);
+  const conversation = coerceThreadConversationState(currentState);
+  completeAuthPauseTurn({
+    conversation,
+    sessionId: args.sessionId,
+    text: args.text
+  });
+  await persistThreadStateById(args.threadStateId, { conversation });
+}
+async function deliverAuthPauseReply(args) {
+  const retryable = isRetryableTurnError(args.error) ? args.error : void 0;
+  const text = retryable ? buildAuthPauseReplyText({
+    disposition: retryable.metadata?.authDisposition,
+    provider: retryable.metadata?.authProvider
+  }) : buildAuthPauseReplyText({ provider: args.fallbackProvider });
+  const message = buildAuthPauseSlackMessage({
+    conversationId: args.conversationId,
+    durationMs: retryable?.metadata?.authDurationMs,
+    text,
+    thinkingLevel: retryable?.metadata?.authThinkingLevel,
+    usage: retryable?.metadata?.authUsage
+  });
+  await postSlackMessage({
+    channelId: args.channelId,
+    threadTs: args.threadTs,
+    text: message.text,
+    ...message.blocks ? { blocks: message.blocks } : {}
+  });
+  await persistAuthPauseReplyState({
+    sessionId: args.sessionId,
+    text,
+    threadStateId: args.threadStateId
+  });
+}
+
 // src/chat/services/timeout-resume.ts
 import { createHmac, timingSafeEqual } from "crypto";
 var TURN_TIMEOUT_RESUME_PATH = "/api/internal/turn-resume";
@@ -11213,6 +11701,7 @@ async function persistCompletedReplyState(channelId, threadTs, sessionId, reply)
   const artifacts = coerceThreadArtifactsState(currentState);
   const nextArtifacts = reply.artifactStatePatch ? mergeArtifactsState(artifacts, reply.artifactStatePatch) : void 0;
   const userMessageId = getTurnUserMessageId(conversation, sessionId);
+  clearPendingAuth(conversation, sessionId);
   markConversationMessage(conversation, userMessageId, {
     replied: true,
     skippedReason: void 0
@@ -11233,6 +11722,7 @@ async function persistCompletedReplyState(channelId, threadTs, sessionId, reply)
   markTurnCompleted({
     conversation,
     nowMs: Date.now(),
+    sessionId,
     updateConversationStats
   });
   await persistThreadStateById(threadId, {
@@ -11246,9 +11736,11 @@ async function persistFailedReplyState(channelId, threadTs, sessionId) {
   const threadId = `slack:${channelId}:${threadTs}`;
   const currentState = await getPersistedThreadState(threadId);
   const conversation = coerceThreadConversationState(currentState);
+  clearPendingAuth(conversation, sessionId);
   markTurnFailed({
     conversation,
     nowMs: Date.now(),
+    sessionId,
     userMessageId: getTurnUserMessageId(conversation, sessionId),
     markConversationMessage,
     updateConversationStats
@@ -11266,8 +11758,29 @@ async function resumeAuthorizedMcpTurn(args) {
   const currentState = await getPersistedThreadState(threadId);
   const conversation = coerceThreadConversationState(currentState);
   const artifacts = coerceThreadArtifactsState(currentState);
-  const userMessage = getTurnUserMessage(conversation, authSession.sessionId);
-  if (conversation.processing.activeTurnId !== authSession.sessionId) {
+  const pendingAuth = getConversationPendingAuth({
+    conversation,
+    kind: "mcp",
+    provider,
+    requesterId: authSession.userId
+  });
+  const resolvedSessionId = pendingAuth?.sessionId ?? authSession.sessionId;
+  const userMessage = getTurnUserMessage(conversation, resolvedSessionId);
+  if (pendingAuth) {
+    if (!isPendingAuthLatestRequest(conversation, pendingAuth)) {
+      clearPendingAuth(conversation, pendingAuth.sessionId);
+      await persistThreadStateById(threadId, { conversation });
+      await supersedeAgentTurnSessionCheckpoint({
+        conversationId: authSession.conversationId,
+        sessionId: pendingAuth.sessionId,
+        errorMessage: "Auth completed after a newer thread message superseded this blocked request."
+      });
+      return;
+    }
+  } else if (conversation.processing.activeTurnId !== authSession.sessionId) {
+    return;
+  }
+  if (!userMessage) {
     return;
   }
   const channelConfiguration = getChannelConfigurationServiceById(
@@ -11276,14 +11789,14 @@ async function resumeAuthorizedMcpTurn(args) {
   const conversationContext = await buildResumeConversationContext(
     authSession.channelId,
     authSession.threadTs,
-    authSession.sessionId
+    resolvedSessionId
   );
   await resumeAuthorizedRequest({
-    messageText: authSession.userMessage,
+    messageText: userMessage.text,
     channelId: authSession.channelId,
     threadTs: authSession.threadTs,
     lockKey: authSession.conversationId,
-    connectedText: `Your ${provider} MCP access is now connected. Continuing the original request...`,
+    connectedText: "",
     failureText: "MCP authorization completed, but resuming the request failed. Please retry the original command.",
     replyContext: {
       assistant: { userName: botConfig.userName },
@@ -11294,7 +11807,7 @@ async function resumeAuthorizedMcpTurn(args) {
       },
       correlation: {
         conversationId: authSession.conversationId,
-        turnId: authSession.sessionId,
+        turnId: resolvedSessionId,
         channelId: authSession.channelId,
         threadTs: authSession.threadTs,
         requesterId: authSession.userId
@@ -11303,9 +11816,18 @@ async function resumeAuthorizedMcpTurn(args) {
       conversationContext,
       artifactState: artifacts,
       configuration: authSession.configuration,
+      pendingAuth,
       channelConfiguration,
       sandbox: getPersistedSandboxState(currentState),
       threadParticipants: buildThreadParticipants(conversation.messages),
+      onAuthPending: async (nextPendingAuth) => {
+        await applyPendingAuthUpdate({
+          conversation,
+          conversationId: authSession.conversationId,
+          nextPendingAuth
+        });
+        await persistThreadStateById(threadId, { conversation });
+      },
       ...getTurnUserReplyAttachmentContext(userMessage)
     },
     onSuccess: async (reply) => {
@@ -11313,7 +11835,7 @@ async function resumeAuthorizedMcpTurn(args) {
         await persistCompletedReplyState(
           authSession.channelId,
           authSession.threadTs,
-          authSession.sessionId,
+          resolvedSessionId,
           reply
         );
       } catch (persistError) {
@@ -11338,7 +11860,7 @@ async function resumeAuthorizedMcpTurn(args) {
         await persistFailedReplyState(
           authSession.channelId,
           authSession.threadTs,
-          authSession.sessionId
+          resolvedSessionId
         );
       } catch (persistError) {
         logException(
@@ -11350,7 +11872,16 @@ async function resumeAuthorizedMcpTurn(args) {
         );
       }
     },
-    onAuthPause: async () => {
+    onAuthPause: async (error) => {
+      await deliverAuthPauseReply({
+        channelId: authSession.channelId,
+        conversationId: authSession.conversationId,
+        error,
+        fallbackProvider: provider,
+        sessionId: resolvedSessionId,
+        threadStateId: `slack:${authSession.channelId}:${authSession.threadTs}`,
+        threadTs: authSession.threadTs
+      });
       logWarn(
         "mcp_oauth_callback_resume_reparked_for_auth",
         {},
@@ -11385,7 +11916,7 @@ async function resumeAuthorizedMcpTurn(args) {
       }
       await scheduleTurnTimeoutResume({
         conversationId: authSession.conversationId,
-        sessionId: authSession.sessionId,
+        sessionId: resolvedSessionId,
         expectedCheckpointVersion: checkpointVersion
       });
     }
@@ -11610,6 +12141,7 @@ async function persistCompletedOAuthReplyState(args) {
   const artifacts = coerceThreadArtifactsState(currentState);
   const nextArtifacts = args.reply.artifactStatePatch ? mergeArtifactsState(artifacts, args.reply.artifactStatePatch) : void 0;
   const userMessage = getTurnUserMessage(conversation, args.sessionId);
+  clearPendingAuth(conversation, args.sessionId);
   markConversationMessage(conversation, userMessage?.id, {
     replied: true,
     skippedReason: void 0
@@ -11630,6 +12162,7 @@ async function persistCompletedOAuthReplyState(args) {
   markTurnCompleted({
     conversation,
     nowMs: Date.now(),
+    sessionId: args.sessionId,
     updateConversationStats
   });
   await persistThreadStateById(args.conversationId, {
@@ -11642,9 +12175,11 @@ async function persistCompletedOAuthReplyState(args) {
 async function persistFailedOAuthReplyState(args) {
   const currentState = await getPersistedThreadState(args.conversationId);
   const conversation = coerceThreadConversationState(currentState);
+  clearPendingAuth(conversation, args.sessionId);
   markTurnFailed({
     conversation,
     nowMs: Date.now(),
+    sessionId: args.sessionId,
     userMessageId: getTurnUserMessage(conversation, args.sessionId)?.id,
     markConversationMessage,
     updateConversationStats
@@ -11661,35 +12196,65 @@ async function resumeCheckpointedOAuthTurn(stored) {
     stored.resumeConversationId,
     stored.resumeSessionId
   );
-  if (!checkpoint || checkpoint.state !== "awaiting_resume" || checkpoint.resumeReason !== "auth") {
+  if (!checkpoint) {
     return false;
   }
+  if (checkpoint.state === "completed" || checkpoint.state === "failed" || checkpoint.state === "superseded") {
+    return true;
+  }
+  if (checkpoint.state !== "awaiting_resume" || checkpoint.resumeReason !== "auth") {
+    return true;
+  }
   const currentState = await getPersistedThreadState(
     stored.resumeConversationId
   );
   const conversation = coerceThreadConversationState(currentState);
   const artifacts = coerceThreadArtifactsState(currentState);
-  const userMessage = getTurnUserMessage(conversation, stored.resumeSessionId);
-  if (!userMessage?.author?.userId) {
-    return false;
+  const pendingAuth = getConversationPendingAuth({
+    conversation,
+    kind: "plugin",
+    provider: stored.provider,
+    requesterId: stored.userId
+  });
+  const resolvedSessionId = pendingAuth?.sessionId ?? stored.resumeSessionId;
+  const userMessage = resolvedSessionId ? getTurnUserMessage(conversation, resolvedSessionId) : void 0;
+  if (pendingAuth) {
+    if (!isPendingAuthLatestRequest(conversation, pendingAuth)) {
+      clearPendingAuth(conversation, pendingAuth.sessionId);
+      await persistThreadStateById(stored.resumeConversationId, {
+        conversation
+      });
+      await supersedeAgentTurnSessionCheckpoint({
+        conversationId: stored.resumeConversationId,
+        sessionId: pendingAuth.sessionId,
+        errorMessage: "Auth completed after a newer thread message superseded this blocked request."
+      });
+      return true;
+    }
+  } else {
+    if (!userMessage?.author?.userId) {
+      return false;
+    }
+    if (conversation.processing.activeTurnId !== stored.resumeSessionId) {
+      return true;
+    }
   }
-  if (conversation.processing.activeTurnId !== stored.resumeSessionId) {
-    return true;
+  if (!userMessage?.author?.userId || !resolvedSessionId) {
+    return false;
   }
   const conversationContext = await buildCheckpointConversationContext(
     stored.resumeConversationId,
-    stored.resumeSessionId
+    resolvedSessionId
   );
   const channelConfiguration = getChannelConfigurationServiceById(
     stored.channelId
   );
-  const providerLabel = formatProviderLabel(stored.provider);
   await resumeSlackTurn({
     messageText: stored.pendingMessage ?? userMessage.text,
     channelId: stored.channelId,
     threadTs: stored.threadTs,
     lockKey: stored.resumeConversationId,
-    initialText: `Your ${providerLabel} account is now connected. Processing your request...`,
+    initialText: "",
     failureText: "I connected your account but hit an error processing your request. Please try the command again.",
     replyContext: {
       assistant: { userName: botConfig.userName },
@@ -11705,10 +12270,21 @@ async function resumeCheckpointedOAuthTurn(stored) {
       },
       toolChannelId: artifacts.assistantContextChannelId ?? stored.channelId,
       artifactState: artifacts,
+      pendingAuth,
       conversationContext,
       channelConfiguration,
       sandbox: getPersistedSandboxState(currentState),
       threadParticipants: buildThreadParticipants(conversation.messages),
+      onAuthPending: async (nextPendingAuth) => {
+        await applyPendingAuthUpdate({
+          conversation,
+          conversationId: stored.resumeConversationId,
+          nextPendingAuth
+        });
+        await persistThreadStateById(stored.resumeConversationId, {
+          conversation
+        });
+      },
       ...getTurnUserReplyAttachmentContext(userMessage)
     },
     onSuccess: async (reply) => {
@@ -11720,11 +12296,11 @@ async function resumeCheckpointedOAuthTurn(stored) {
           "app.ai.outcome": reply.diagnostics.outcome,
           "app.ai.tool_calls": reply.diagnostics.toolCalls.length
         },
-        "Auto-resumed checkpointed turn after OAuth callback"
+        "OAuth callback auto-resumed checkpoint finished replying"
       );
       await persistCompletedOAuthReplyState({
         conversationId: stored.resumeConversationId,
-        sessionId: stored.resumeSessionId,
+        sessionId: resolvedSessionId,
         reply
       });
     },
@@ -11738,17 +12314,19 @@ async function resumeCheckpointedOAuthTurn(stored) {
       );
       await persistFailedOAuthReplyState({
         conversationId: stored.resumeConversationId,
-        sessionId: stored.resumeSessionId
+        sessionId: resolvedSessionId
       });
     },
     onAuthPause: async (error) => {
-      logException(
+      await deliverAuthPauseReply({
+        channelId: stored.channelId,
+        conversationId: stored.resumeConversationId,
         error,
-        "oauth_callback_resume_reparked_for_auth",
-        {},
-        { "app.credential.provider": stored.provider },
-        "Resumed OAuth turn requested another authorization flow"
-      );
+        fallbackProvider: stored.provider,
+        sessionId: resolvedSessionId,
+        threadStateId: stored.resumeConversationId,
+        threadTs: stored.threadTs
+      });
     },
     onTimeoutPause: async (error) => {
       if (!isRetryableTurnError(error, "turn_timeout_resume")) {
@@ -11768,7 +12346,7 @@ async function resumeCheckpointedOAuthTurn(stored) {
       }
       await scheduleTurnTimeoutResume({
         conversationId: stored.resumeConversationId,
-        sessionId: stored.resumeSessionId,
+        sessionId: resolvedSessionId,
         expectedCheckpointVersion: checkpointVersion
       });
     }
@@ -11777,7 +12355,6 @@ async function resumeCheckpointedOAuthTurn(stored) {
 }
 async function resumePendingOAuthMessage(stored) {
   if (!stored.pendingMessage || !stored.channelId || !stored.threadTs) return;
-  const providerLabel = formatProviderLabel(stored.provider);
   const conversationContext = await buildResumeConversationContext2(
     stored.channelId,
     stored.threadTs
@@ -11786,7 +12363,7 @@ async function resumePendingOAuthMessage(stored) {
     messageText: stored.pendingMessage,
     channelId: stored.channelId,
     threadTs: stored.threadTs,
-    connectedText: `Your ${providerLabel} account is now connected. Processing your request...`,
+    connectedText: "",
     failureText: `I connected your account but hit an error processing your request. Please try \`${stored.pendingMessage}\` again.`,
     replyContext: {
       requester: { userId: stored.userId },
@@ -11802,7 +12379,7 @@ async function resumePendingOAuthMessage(stored) {
           "app.ai.outcome": reply.diagnostics.outcome,
           "app.ai.tool_calls": reply.diagnostics.toolCalls.length
         },
-        "Auto-resumed pending message after OAuth callback"
+        "OAuth callback auto-resumed pending message finished replying"
       );
     },
     onFailure: async (error) => {
@@ -12051,6 +12628,7 @@ async function persistCompletedReplyState2(args) {
     conversation,
     args.checkpoint.sessionId
   );
+  clearPendingAuth(conversation, args.checkpoint.sessionId);
   markConversationMessage(conversation, userMessage?.id, {
     replied: true,
     skippedReason: void 0
@@ -12071,6 +12649,7 @@ async function persistCompletedReplyState2(args) {
   markTurnCompleted({
     conversation,
     nowMs: Date.now(),
+    sessionId: args.checkpoint.sessionId,
     updateConversationStats
   });
   await persistThreadStateById(args.checkpoint.conversationId, {
@@ -12083,9 +12662,11 @@ async function persistCompletedReplyState2(args) {
 async function persistFailedReplyState2(checkpoint) {
   const currentState = await getPersistedThreadState(checkpoint.conversationId);
   const conversation = coerceThreadConversationState(currentState);
+  clearPendingAuth(conversation, checkpoint.sessionId);
   markTurnFailed({
     conversation,
     nowMs: Date.now(),
+    sessionId: checkpoint.sessionId,
     userMessageId: getTurnUserMessage(conversation, checkpoint.sessionId)?.id,
     markConversationMessage,
     updateConversationStats
@@ -12149,10 +12730,21 @@ async function resumeTimedOutTurn(payload) {
       },
       toolChannelId: artifacts.assistantContextChannelId ?? thread.channelId,
       artifactState: artifacts,
+      pendingAuth: conversation.processing.pendingAuth,
       conversationContext,
       channelConfiguration,
       sandbox,
       threadParticipants: buildThreadParticipants(conversation.messages),
+      onAuthPending: async (nextPendingAuth) => {
+        await applyPendingAuthUpdate({
+          conversation,
+          conversationId: payload.conversationId,
+          nextPendingAuth
+        });
+        await persistThreadStateById(payload.conversationId, {
+          conversation
+        });
+      },
       ...getTurnUserReplyAttachmentContext(userMessage)
     },
     onSuccess: async (reply) => {
@@ -12184,7 +12776,15 @@ async function resumeTimedOutTurn(payload) {
       );
       await persistFailedReplyState2(checkpoint);
     },
-    onAuthPause: async () => {
+    onAuthPause: async (error) => {
+      await deliverAuthPauseReply({
+        channelId: thread.channelId,
+        conversationId: payload.conversationId,
+        error,
+        sessionId: payload.sessionId,
+        threadStateId: payload.conversationId,
+        threadTs: thread.threadTs
+      });
       logWarn(
         "timeout_resume_reparked_for_auth",
         {},
@@ -13923,6 +14523,7 @@ function createReplyToThread(deps) {
             },
             conversationContext: preparedState.routingContext ?? preparedState.conversationContext,
             artifactState: preparedState.artifacts,
+            pendingAuth: preparedState.conversation.processing.pendingAuth,
             configuration: preparedState.configuration,
             channelConfiguration: preparedState.channelConfiguration,
             inboundAttachmentCount: message.attachments.length,
@@ -13952,6 +14553,16 @@ function createReplyToThread(deps) {
             onArtifactStateUpdated: async (artifacts) => {
               await persistThreadState(thread, { artifacts });
             },
+            onAuthPending: async (pendingAuth) => {
+              await applyPendingAuthUpdate({
+                conversation: preparedState.conversation,
+                conversationId,
+                nextPendingAuth: pendingAuth
+              });
+              await persistThreadState(thread, {
+                conversation: preparedState.conversation
+              });
+            },
             threadParticipants,
             onStatus: (nextStatus) => status.update(nextStatus)
           });
@@ -14129,8 +14740,42 @@ function createReplyToThread(deps) {
           }
         } catch (error) {
           if (isRetryableTurnError(error, "mcp_auth_resume") || isRetryableTurnError(error, "plugin_auth_resume")) {
+            const authPauseText = buildAuthPauseReplyText({
+              disposition: error.metadata?.authDisposition,
+              provider: error.metadata?.authProvider
+            });
+            const authPauseFooter = buildSlackReplyFooter({
+              conversationId,
+              durationMs: error.metadata?.authDurationMs,
+              thinkingLevel: error.metadata?.authThinkingLevel,
+              usage: error.metadata?.authUsage
+            });
+            const useSlackFooterForAuthPause = Boolean(authPauseFooter) && Boolean(channelId && threadTs) && thread.adapter?.name === "slack";
+            if (useSlackFooterForAuthPause && channelId && threadTs) {
+              await beforeFirstResponsePost();
+              await postSlackApiReplyPosts({
+                channelId,
+                threadTs,
+                footer: authPauseFooter,
+                posts: [{ stage: "thread_reply", text: authPauseText }]
+              });
+            } else {
+              await postThreadReply(
+                buildSlackOutputMessage(authPauseText),
+                "thread_reply"
+              );
+            }
+            completeAuthPauseTurn({
+              conversation: preparedState.conversation,
+              sessionId: error.metadata?.sessionId ?? turnId,
+              text: authPauseText
+            });
+            await persistThreadState(thread, {
+              conversation: preparedState.conversation
+            });
+            persistedAtLeastOnce = true;
             shouldPersistFailureState = false;
-            throw error;
+            return;
           }
           if (isRetryableTurnError(error, "turn_timeout_resume")) {
             const conversationIdForResume = error.metadata?.conversationId;