@sentry/junior 0.66.3 → 0.67.1

package/dist/app.js

@@ -4,14 +4,22 @@ import {
   SlackActionError,
   TURN_CONTEXT_TAG,
   abandonAgentTurnSessionRecord,
+  bindSlackDirectCredentialSubject,
   buildSentryConversationUrl,
   buildSlackOutputMessage,
   buildSystemPrompt,
   buildTurnContextPrompt,
   commitMessages,
+  createAgentPluginHookRunner,
+  createAgentPluginLogger,
+  createPluginState,
   downloadPrivateSlackFile,
   escapeXml,
   failAgentTurnSessionRecord,
+  getAgentPluginRoutes,
+  getAgentPluginSlackConversationLink,
+  getAgentPluginTools,
+  getAgentPlugins,
   getAgentTurnSessionRecord,
   getFilePermalink,
   getHeaderString,
@@ -32,17 +40,20 @@ import {
   recordMcpProviderConnected,
   resolveSlackChannelTypeFromMessage,
   resolveSlackConversationContext,
+  setAgentPlugins,
   splitSlackReplyText,
   truncateStatusText,
   upsertAgentTurnSessionRecord,
+  validateAgentPlugins,
+  verifySlackDirectCredentialSubject,
   withSlackRetries
-} from "./chunk-DG2I6GXC.js";
+} from "./chunk-5UIDU7XR.js";
 import {
   discoverSkills,
   findSkillByName,
   loadSkillsByName,
   parseSkillInvocation
-} from "./chunk-YL5G5YC4.js";
+} from "./chunk-V47RLIO2.js";
 import {
   buildNonInteractiveShellScript,
   createSandboxInstance,
@@ -51,7 +62,7 @@ import {
   isSnapshotMissingError,
   resolveRuntimeDependencySnapshot,
   runNonInteractiveCommand
-} from "./chunk-JA5QR3N4.js";
+} from "./chunk-YGGH2742.js";
 import {
   ACTIVE_LOCK_TTL_MS,
   FUNCTION_TIMEOUT_BUFFER_SECONDS,
@@ -74,6 +85,7 @@ import {
   getSlackClientSecret,
   getSlackSigningSecret,
   getStateAdapter,
+  normalizeSlackEmojiName,
   parseSlackThreadId,
   resolveConversationPrivacy,
   resolveGatewayModel,
@@ -86,9 +98,10 @@ import {
   toGenAiPayloadMetadata,
   toGenAiPayloadTraceAttributes,
   toGenAiTextMetadata
-} from "./chunk-SAYCFF7O.js";
+} from "./chunk-MT23VNOH.js";
 import {
   CredentialUnavailableError,
+  buildActorIdentity,
   buildOAuthTokenRequest,
   buildTurnFailureResponse,
   createChatSdkLogger,
@@ -105,6 +118,7 @@ import {
   getPluginOAuthConfig,
   getPluginProviders,
   hasRequiredOAuthScope,
+  isActorUserId,
   isPluginConfigKey,
   isPluginProvider,
   isRecord,
@@ -113,6 +127,7 @@ import {
   logInfo,
   logWarn,
   normalizeGenAiFinishReason,
+  parseActorUserId,
   parseCredentialContext,
   parseOAuthTokenResponse,
   resolveAuthTokenPlaceholder,
@@ -123,11 +138,12 @@ import {
   setSpanAttributes,
   setSpanStatus,
   setTags,
+  slackActorIdentity,
   toOptionalNumber,
   toOptionalString,
   withContext,
   withSpan
-} from "./chunk-6QWWMZCK.js";
+} from "./chunk-OIIXZOOC.js";
 import {
   sentry_exports
 } from "./chunk-Z3YD6NHK.js";
@@ -178,588 +194,6 @@ function getConfigDefaults() {
   return cloneDefaults(installDefaults);
 }
 
-// src/chat/plugins/logging.ts
-function createAgentPluginLogger(plugin) {
-  return {
-    info(message, metadata) {
-      logInfo(
-        "agent_plugin_log_info",
-        {},
-        { "app.plugin.name": plugin, ...metadata },
-        message
-      );
-    },
-    warn(message, metadata) {
-      logWarn(
-        "agent_plugin_log_warn",
-        {},
-        { "app.plugin.name": plugin, ...metadata },
-        message
-      );
-    },
-    error(message, metadata) {
-      logException(
-        new Error(message),
-        "agent_plugin_log_error",
-        {},
-        { "app.plugin.name": plugin, ...metadata },
-        message
-      );
-    }
-  };
-}
-
-// src/chat/plugins/state.ts
-import { createHash } from "crypto";
-var MAX_PLUGIN_STATE_KEY_LENGTH = 512;
-function hashKeyPart(value) {
-  return createHash("sha256").update(value).digest("hex").slice(0, 32);
-}
-function pluginStateKey(plugin, key) {
-  return `junior:plugin_state:${hashKeyPart(plugin)}:${hashKeyPart(key)}`;
-}
-function validatePluginStateKey(key) {
-  if (!key.trim()) {
-    throw new Error("Plugin state key is required");
-  }
-  if (key.length > MAX_PLUGIN_STATE_KEY_LENGTH) {
-    throw new Error("Plugin state key exceeds the maximum length");
-  }
-}
-function legacyStateKey(key, options) {
-  for (const prefix of options?.legacyStatePrefixes ?? []) {
-    const trimmed = prefix.trim();
-    if (!trimmed) {
-      continue;
-    }
-    if (key === trimmed || key.startsWith(`${trimmed}:`)) {
-      return key;
-    }
-  }
-  return void 0;
-}
-function createPluginState(plugin, options) {
-  return {
-    async delete(key) {
-      validatePluginStateKey(key);
-      const state = getStateAdapter();
-      await state.connect();
-      await state.delete(pluginStateKey(plugin, key));
-      const legacyKey = legacyStateKey(key, options);
-      if (legacyKey) {
-        await state.delete(legacyKey);
-      }
-    },
-    async get(key) {
-      validatePluginStateKey(key);
-      const state = getStateAdapter();
-      await state.connect();
-      const value = await state.get(pluginStateKey(plugin, key));
-      if (value !== null && value !== void 0) {
-        return value;
-      }
-      const legacyKey = legacyStateKey(key, options);
-      return legacyKey ? await state.get(legacyKey) ?? void 0 : void 0;
-    },
-    async set(key, value, ttlMs) {
-      validatePluginStateKey(key);
-      const state = getStateAdapter();
-      await state.connect();
-      await state.set(pluginStateKey(plugin, key), value, ttlMs);
-    },
-    async setIfNotExists(key, value, ttlMs) {
-      validatePluginStateKey(key);
-      const state = getStateAdapter();
-      await state.connect();
-      const legacyKey = legacyStateKey(key, options);
-      if (legacyKey) {
-        const existing = await state.get(legacyKey);
-        if (existing !== null && existing !== void 0) {
-          return false;
-        }
-      }
-      return await state.setIfNotExists(
-        pluginStateKey(plugin, key),
-        value,
-        ttlMs
-      );
-    },
-    async withLock(key, ttlMs, callback) {
-      validatePluginStateKey(key);
-      const state = getStateAdapter();
-      await state.connect();
-      const lockKey = legacyStateKey(key, options) ?? pluginStateKey(plugin, key);
-      const lock = await state.acquireLock(lockKey, ttlMs);
-      if (!lock) {
-        throw new Error(`Could not acquire plugin state lock for ${key}`);
-      }
-      try {
-        return await callback();
-      } finally {
-        await state.releaseLock(lock);
-      }
-    }
-  };
-}
-
-// src/chat/credentials/subject.ts
-import { createHmac, timingSafeEqual } from "crypto";
-var CREDENTIAL_SUBJECT_HMAC_CONTEXT = "junior.credential_subject.v1";
-var CREDENTIAL_SUBJECT_SIGNATURE_VERSION = "v1";
-function getCredentialSubjectSecret() {
-  return process.env.JUNIOR_SECRET?.trim() || void 0;
-}
-function buildPayload(input) {
-  return [
-    CREDENTIAL_SUBJECT_HMAC_CONTEXT,
-    input.allowedWhen,
-    input.teamId,
-    input.channelId,
-    input.userId
-  ].join("\0");
-}
-function signPayload(secret, payload) {
-  const digest = createHmac("sha256", secret).update(payload).digest("hex");
-  return `${CREDENTIAL_SUBJECT_SIGNATURE_VERSION}=${digest}`;
-}
-function timingSafeMatch(expected, actual) {
-  const expectedBuffer = Buffer.from(expected);
-  const actualBuffer = Buffer.from(actual);
-  if (expectedBuffer.length !== actualBuffer.length) {
-    return false;
-  }
-  return timingSafeEqual(expectedBuffer, actualBuffer);
-}
-function createSlackDirectCredentialSubject(input) {
-  const channelId = normalizeSlackConversationId(input.channelId);
-  const teamId = input.teamId?.trim();
-  const userId = input.userId?.trim();
-  if (!channelId || !teamId || !userId || !isDmChannel(channelId)) {
-    return void 0;
-  }
-  return {
-    type: "user",
-    userId,
-    allowedWhen: "private-direct-conversation"
-  };
-}
-function bindSlackDirectCredentialSubject(input) {
-  const channelId = normalizeSlackConversationId(input.channelId);
-  const teamId = input.teamId.trim();
-  const secret = getCredentialSubjectSecret();
-  const { subject } = input;
-  const userId = subject.userId.trim();
-  if (!channelId || !teamId || !secret || !isDmChannel(channelId) || subject.type !== "user" || !userId || subject.allowedWhen !== "private-direct-conversation") {
-    return void 0;
-  }
-  return {
-    type: "user",
-    userId,
-    allowedWhen: subject.allowedWhen,
-    binding: {
-      type: "slack-direct-conversation",
-      teamId,
-      channelId,
-      signature: signPayload(
-        secret,
-        buildPayload({
-          allowedWhen: subject.allowedWhen,
-          teamId,
-          channelId,
-          userId
-        })
-      )
-    }
-  };
-}
-function verifySlackDirectCredentialSubject(input) {
-  const channelId = normalizeSlackConversationId(input.channelId);
-  const secret = getCredentialSubjectSecret();
-  if (!channelId || !secret) {
-    return false;
-  }
-  const { subject } = input;
-  const binding = subject.binding;
-  if (subject.type !== "user" || typeof subject.userId !== "string" || !subject.userId || subject.allowedWhen !== "private-direct-conversation" || !binding || binding.type !== "slack-direct-conversation" || typeof binding.signature !== "string" || !binding.signature || binding.teamId !== input.teamId || binding.channelId !== channelId) {
-    return false;
-  }
-  const expected = signPayload(
-    secret,
-    buildPayload({
-      allowedWhen: subject.allowedWhen,
-      teamId: binding.teamId,
-      channelId: binding.channelId,
-      userId: subject.userId
-    })
-  );
-  return timingSafeMatch(expected, binding.signature);
-}
-
-// src/chat/plugins/agent-hooks.ts
-var AgentPluginHookDeniedError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "AgentPluginHookDeniedError";
-  }
-};
-var agentPlugins = [];
-var AGENT_PLUGIN_NAME_RE = /^[a-z][a-z0-9-]*$/;
-var AGENT_PLUGIN_TOOL_NAME_RE = /^[a-z][A-Za-z0-9]*$/;
-var AGENT_PLUGIN_ROUTE_METHODS = /* @__PURE__ */ new Set([
-  "GET",
-  "POST",
-  "PUT",
-  "PATCH",
-  "DELETE",
-  "HEAD",
-  "OPTIONS",
-  "ALL"
-]);
-function validateLegacyStatePrefixes(plugin) {
-  const prefixes = plugin.legacyStatePrefixes;
-  if (prefixes === void 0) {
-    return;
-  }
-  if (!Array.isArray(prefixes)) {
-    throw new Error(
-      `Trusted plugin "${plugin.name}" legacyStatePrefixes must be an array`
-    );
-  }
-  const allowedPrefix = `junior:${plugin.name}`;
-  for (const rawPrefix of prefixes) {
-    const prefix = typeof rawPrefix === "string" ? rawPrefix.trim() : "";
-    if (!prefix) {
-      throw new Error(
-        `Trusted plugin "${plugin.name}" legacy state prefixes must be non-empty strings`
-      );
-    }
-    if (prefix !== allowedPrefix && !prefix.startsWith(`${allowedPrefix}:`)) {
-      throw new Error(
-        `Trusted plugin "${plugin.name}" legacy state prefix "${prefix}" must stay under "${allowedPrefix}"`
-      );
-    }
-  }
-}
-function validateAgentPlugins(plugins) {
-  const seen = /* @__PURE__ */ new Set();
-  for (const plugin of plugins) {
-    if (!AGENT_PLUGIN_NAME_RE.test(plugin.name)) {
-      throw new Error(
-        `Trusted plugin name "${plugin.name}" must be a lowercase plugin identifier`
-      );
-    }
-    if (seen.has(plugin.name)) {
-      throw new Error(`Duplicate trusted plugin name "${plugin.name}"`);
-    }
-    seen.add(plugin.name);
-    validateLegacyStatePrefixes(plugin);
-  }
-}
-function setAgentPlugins(plugins) {
-  validateAgentPlugins(plugins);
-  const previous = agentPlugins;
-  agentPlugins = [...plugins].sort(
-    (left, right) => left.name.localeCompare(right.name)
-  );
-  return previous;
-}
-function getAgentPlugins() {
-  return [...agentPlugins];
-}
-function getAgentPluginTools(context) {
-  const tools = {};
-  for (const plugin of getAgentPlugins()) {
-    const hook = plugin.hooks?.tools;
-    if (!hook) {
-      continue;
-    }
-    const log = createAgentPluginLogger(plugin.name);
-    const credentialSubject = createSlackDirectCredentialSubject({
-      channelId: context.channelId,
-      teamId: context.teamId,
-      userId: context.requester?.userId
-    });
-    const pluginTools = hook({
-      plugin: { name: plugin.name },
-      log,
-      requester: context.requester,
-      channelCapabilities: context.channelCapabilities,
-      channelId: context.channelId,
-      ...credentialSubject ? { credentialSubject } : {},
-      teamId: context.teamId,
-      messageTs: context.messageTs,
-      threadTs: context.threadTs,
-      userText: context.userText,
-      state: createPluginState(plugin.name, {
-        legacyStatePrefixes: plugin.legacyStatePrefixes
-      })
-    });
-    for (const [name, tool2] of Object.entries(pluginTools)) {
-      if (!AGENT_PLUGIN_TOOL_NAME_RE.test(name)) {
-        throw new Error(
-          `Trusted plugin tool "${name}" from plugin "${plugin.name}" must be a camelCase identifier`
-        );
-      }
-      if (tools[name]) {
-        throw new Error(
-          `Duplicate trusted plugin tool "${name}" from plugin "${plugin.name}"`
-        );
-      }
-      tools[name] = tool2;
-    }
-  }
-  return tools;
-}
-function routeMethods(route, pluginName) {
-  const methods = Array.isArray(route.method) ? route.method : [route.method ?? "ALL"];
-  if (methods.length === 0) {
-    throw new Error(
-      `Trusted plugin route "${route.path}" from plugin "${pluginName}" must declare at least one method`
-    );
-  }
-  for (const method of methods) {
-    if (!AGENT_PLUGIN_ROUTE_METHODS.has(method)) {
-      throw new Error(
-        `Trusted plugin route "${route.path}" from plugin "${pluginName}" has invalid method "${String(method)}"`
-      );
-    }
-  }
-  if (methods.includes("ALL") && methods.length > 1) {
-    throw new Error(
-      `Trusted plugin route "${route.path}" from plugin "${pluginName}" must not combine ALL with explicit methods`
-    );
-  }
-  return methods;
-}
-function getAgentPluginRoutes() {
-  const routes = [];
-  const seen = /* @__PURE__ */ new Set();
-  const methodsByPath = /* @__PURE__ */ new Map();
-  for (const plugin of getAgentPlugins()) {
-    const hook = plugin.hooks?.routes;
-    if (!hook) {
-      continue;
-    }
-    const log = createAgentPluginLogger(plugin.name);
-    const pluginRoutes = hook({
-      plugin: { name: plugin.name },
-      log
-    });
-    if (!Array.isArray(pluginRoutes)) {
-      throw new Error(
-        `Trusted plugin routes hook from plugin "${plugin.name}" must return an array`
-      );
-    }
-    for (const route of pluginRoutes) {
-      if (!isRecord2(route)) {
-        throw new Error(
-          `Trusted plugin route from plugin "${plugin.name}" must be an object`
-        );
-      }
-      if (typeof route.path !== "string" || !route.path.startsWith("/")) {
-        throw new Error(
-          `Trusted plugin route "${route.path}" from plugin "${plugin.name}" must start with /`
-        );
-      }
-      if (typeof route.handler !== "function") {
-        throw new Error(
-          `Trusted plugin route "${route.path}" from plugin "${plugin.name}" must provide a handler`
-        );
-      }
-      const methods = routeMethods(route, plugin.name);
-      const pathMethods = methodsByPath.get(route.path) ?? /* @__PURE__ */ new Set();
-      if (pathMethods.has("ALL") || methods.includes("ALL") && pathMethods.size > 0) {
-        throw new Error(
-          `Trusted plugin route "${route.path}" conflicts with an ALL route for the same path`
-        );
-      }
-      for (const method of methods) {
-        const key = `${method}:${route.path}`;
-        if (seen.has(key)) {
-          throw new Error(
-            `Duplicate trusted plugin route "${method} ${route.path}"`
-          );
-        }
-        seen.add(key);
-        pathMethods.add(method);
-      }
-      methodsByPath.set(route.path, pathMethods);
-      routes.push({
-        ...route,
-        pluginName: plugin.name
-      });
-    }
-  }
-  return routes;
-}
-function trustedSlackConversationUrl(pluginName, link) {
-  const url = typeof link?.url === "string" ? link.url.trim() : "";
-  if (!url) {
-    return void 0;
-  }
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch (error) {
-    throw new Error(
-      `Trusted plugin "${pluginName}" slackConversationLink must return an absolute http(s) URL`,
-      { cause: error }
-    );
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new Error(
-      `Trusted plugin "${pluginName}" slackConversationLink must return an absolute http(s) URL`
-    );
-  }
-  return parsed.toString();
-}
-function getAgentPluginSlackConversationLink(conversationId) {
-  for (const plugin of getAgentPlugins()) {
-    const hook = plugin.hooks?.slackConversationLink;
-    if (!hook) {
-      continue;
-    }
-    const log = createAgentPluginLogger(plugin.name);
-    const link = hook({
-      plugin: { name: plugin.name },
-      log,
-      conversationId
-    });
-    const url = trustedSlackConversationUrl(plugin.name, link);
-    if (url) {
-      return { url };
-    }
-  }
-  return void 0;
-}
-function isRecord2(value) {
-  return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-function normalizeEnv(value) {
-  if (!isRecord2(value)) {
-    return {};
-  }
-  const env = {};
-  for (const [key, rawValue] of Object.entries(value)) {
-    if (typeof rawValue === "string") {
-      env[key] = rawValue;
-    }
-  }
-  return env;
-}
-function createSandboxCapability(sandbox) {
-  return {
-    root: SANDBOX_WORKSPACE_ROOT,
-    juniorRoot: `${SANDBOX_WORKSPACE_ROOT}/.junior`,
-    async readFile(filePath) {
-      return await sandbox.readFileToBuffer({ path: filePath }) ?? null;
-    },
-    async run(input) {
-      const result = await sandbox.runCommand(input);
-      const [stdout, stderr] = await Promise.all([
-        result.stdout(),
-        result.stderr()
-      ]);
-      return {
-        exitCode: result.exitCode,
-        stdout,
-        stderr
-      };
-    },
-    async writeFile(input) {
-      await sandbox.writeFiles([
-        {
-          path: input.path,
-          content: input.content,
-          ...input.mode !== void 0 ? { mode: input.mode } : {}
-        }
-      ]);
-    }
-  };
-}
-function createAgentPluginHookRunner(input = {}) {
-  const loaded = getAgentPlugins();
-  return {
-    async prepareSandbox(sandbox) {
-      const sandboxCapability = createSandboxCapability(sandbox);
-      for (const plugin of loaded) {
-        const hook = plugin.hooks?.sandboxPrepare;
-        if (!hook) {
-          continue;
-        }
-        logInfo(
-          "agent_plugin_hook_sandbox_prepare",
-          {},
-          { "app.plugin.name": plugin.name },
-          "Running agent plugin sandbox prepare hook"
-        );
-        await hook({
-          plugin: { name: plugin.name },
-          log: createAgentPluginLogger(plugin.name),
-          requester: input.requester,
-          sandbox: sandboxCapability
-        });
-      }
-    },
-    async beforeToolExecute(tool2) {
-      let nextInput = { ...tool2.input };
-      const env = normalizeEnv(nextInput.env);
-      for (const plugin of loaded) {
-        const hook = plugin.hooks?.beforeToolExecute;
-        if (!hook) {
-          continue;
-        }
-        let replacement;
-        let denied;
-        await hook({
-          plugin: { name: plugin.name },
-          log: createAgentPluginLogger(plugin.name),
-          requester: input.requester,
-          tool: {
-            name: tool2.name,
-            input: nextInput
-          },
-          env: {
-            get(key) {
-              return env[key];
-            },
-            set(key, value) {
-              env[key] = value;
-            }
-          },
-          decision: {
-            deny(message) {
-              denied = message;
-            },
-            replaceInput(input2) {
-              replacement = input2;
-            }
-          }
-        });
-        if (denied) {
-          throw new AgentPluginHookDeniedError(denied);
-        }
-        if (replacement !== void 0) {
-          if (!isRecord2(replacement)) {
-            throw new Error(
-              `Plugin "${plugin.name}" replaced tool input with a non-object value`
-            );
-          }
-          nextInput = { ...replacement };
-          Object.assign(env, normalizeEnv(nextInput.env));
-        }
-      }
-      return {
-        input: {
-          ...nextInput,
-          ...Object.keys(env).length > 0 ? { env } : {}
-        },
-        env
-      };
-    }
-  };
-}
-
 // src/chat/respond.ts
 import { Agent as Agent2 } from "@earendil-works/pi-agent-core";
 import { THREAD_STATE_TTL_MS as THREAD_STATE_TTL_MS3 } from "chat";
@@ -1915,7 +1349,7 @@ function parseMcpProviderFromToolName(toolName) {
 
 // src/chat/pi/derived-state.ts
 var MCP_BRIDGE_TOOLS = /* @__PURE__ */ new Set(["callMcpTool", "searchMcpTools"]);
-function isRecord3(value) {
+function isRecord2(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 function providerFromToolName(value) {
@@ -1937,7 +1371,7 @@ function addBridgeToolProvider(toolName, value, providers) {
   if (bridgeTool === "searchMcpTools") {
     for (const argsKey of ["input", "args", "arguments", "params"]) {
       const args = value[argsKey];
-      if (isRecord3(args)) {
+      if (isRecord2(args)) {
         addString(providers, args.provider);
       }
     }
@@ -1946,7 +1380,7 @@ function addBridgeToolProvider(toolName, value, providers) {
   if (bridgeTool === "callMcpTool") {
     for (const argsKey of ["input", "args", "arguments", "params"]) {
       const args = value[argsKey];
-      if (isRecord3(args)) {
+      if (isRecord2(args)) {
         addString(providers, providerFromToolName(args.tool_name));
       }
     }
@@ -1959,18 +1393,18 @@ function addMcpResultProvider(message, providers) {
     return;
   }
   if (toolName === "loadSkill") {
-    if (isRecord3(message.details)) {
+    if (isRecord2(message.details)) {
       addString(providers, message.details.mcp_provider);
     }
     addString(providers, message.mcp_provider);
     return;
   }
   if (toolName === "searchMcpTools") {
-    if (isRecord3(message.details)) {
+    if (isRecord2(message.details)) {
       addString(providers, message.details.provider);
       if (Array.isArray(message.details.tools)) {
         for (const tool2 of message.details.tools) {
-          if (isRecord3(tool2)) {
+          if (isRecord2(tool2)) {
             addString(providers, providerFromToolName(tool2.tool_name));
           }
         }
@@ -1982,11 +1416,11 @@ function addMcpResultProvider(message, providers) {
   if (toolName === "callMcpTool") {
     for (const argsKey of ["input", "args", "arguments", "params"]) {
       const args = message[argsKey];
-      if (isRecord3(args)) {
+      if (isRecord2(args)) {
         addString(providers, providerFromToolName(args.tool_name));
       }
     }
-    if (isRecord3(message.details)) {
+    if (isRecord2(message.details)) {
       addString(providers, message.details.provider);
       addString(providers, providerFromToolName(message.details.tool_name));
     }
@@ -1994,7 +1428,7 @@ function addMcpResultProvider(message, providers) {
   }
 }
 function scanMcpProviders(message, providers) {
-  if (!isRecord3(message)) {
+  if (!isRecord2(message)) {
     return;
   }
   if (message.role === "toolResult") {
@@ -2006,15 +1440,15 @@ function scanMcpProviders(message, providers) {
     return;
   }
   for (const part of content) {
-    if (!isRecord3(part)) {
+    if (!isRecord2(part)) {
       continue;
     }
     addBridgeToolProvider(getToolName(part), part, providers);
   }
 }
 function scanLoadedSkills(message, skills) {
-  if (isRecord3(message) && message.role === "toolResult" && message.toolName === "loadSkill" && message.isError !== true) {
-    if (isRecord3(message.details)) {
+  if (isRecord2(message) && message.role === "toolResult" && message.toolName === "loadSkill" && message.isError !== true) {
+    if (isRecord2(message.details)) {
       addString(skills, message.details.skill_name);
     }
     addString(skills, message.skill_name);
@@ -3906,17 +3340,6 @@ function createSlackChannelListMessagesTool(context) {
 // src/chat/tools/slack/channel-post-message.ts
 import { Type as Type14 } from "@sinclair/typebox";
 
-// src/chat/slack/emoji.ts
-var SLACK_EMOJI_NAME_RE = /^(?:[a-z0-9_+-]+)(?:::(?:skin-tone-[2-6]))?$/;
-function normalizeSlackEmojiName(value) {
-  const trimmed = value.trim().toLowerCase();
-  if (!trimmed) {
-    return null;
-  }
-  const normalized = trimmed.startsWith(":") && trimmed.endsWith(":") ? trimmed.slice(1, -1) : trimmed;
-  return SLACK_EMOJI_NAME_RE.test(normalized) ? normalized : null;
-}
-
 // src/chat/slack/outbound.ts
 var MAX_SLACK_MESSAGE_TEXT_CHARS = 4e4;
 function requireSlackConversationId(channelId, action) {
@@ -4024,7 +3447,7 @@ async function postSlackEphemeralMessage(input) {
     input.channelId,
     "Slack ephemeral message posting"
   );
-  const userId = input.userId.trim();
+  const userId = parseActorUserId(input.userId);
   if (!userId) {
     throw new Error("Slack ephemeral message posting requires a user ID");
   }
@@ -7308,7 +6731,7 @@ async function startOAuthFlow(provider, input) {
 }
 
 // src/chat/sandbox/egress-session.ts
-import { createHmac as createHmac2, randomUUID, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHmac, randomUUID, timingSafeEqual } from "crypto";
 var SANDBOX_EGRESS_PROXY_PATH = "/api/internal/sandbox-egress";
 var SANDBOX_EGRESS_TOKEN_VERSION = "v1";
 var SANDBOX_EGRESS_HMAC_CONTEXT = "junior.sandbox_egress.v1";
@@ -7332,16 +6755,16 @@ function base64Url(input) {
 function fromBase64Url(input) {
   return Buffer.from(input, "base64url").toString("utf8");
 }
-function signPayload2(payload) {
-  return createHmac2("sha256", getSandboxEgressSecret()).update(`${SANDBOX_EGRESS_HMAC_CONTEXT}:${payload}`).digest("base64url");
+function signPayload(payload) {
+  return createHmac("sha256", getSandboxEgressSecret()).update(`${SANDBOX_EGRESS_HMAC_CONTEXT}:${payload}`).digest("base64url");
 }
-function timingSafeMatch2(expected, actual) {
+function timingSafeMatch(expected, actual) {
   const expectedBuffer = Buffer.from(expected);
   const actualBuffer = Buffer.from(actual);
   if (expectedBuffer.length !== actualBuffer.length) {
     return false;
   }
-  return timingSafeEqual2(expectedBuffer, actualBuffer);
+  return timingSafeEqual(expectedBuffer, actualBuffer);
 }
 function parseSandboxEgressContext(value) {
   if (!value || typeof value !== "object") {
@@ -7400,7 +6823,7 @@ function createSandboxEgressCredentialToken(input) {
   const payload = `${SANDBOX_EGRESS_TOKEN_VERSION}.${base64Url(
     JSON.stringify(context)
   )}`;
-  return `${payload}.${signPayload2(payload)}`;
+  return `${payload}.${signPayload(payload)}`;
 }
 function parseSandboxEgressCredentialToken(token) {
   if (!token) {
@@ -7416,7 +6839,7 @@ function parseSandboxEgressCredentialToken(token) {
     return void 0;
   }
   const payload = `${parts[0]}.${encodedSession}`;
-  if (!timingSafeMatch2(signPayload2(payload), signature)) {
+  if (!timingSafeMatch(signPayload(payload), signature)) {
     return void 0;
   }
   try {
@@ -11125,6 +10548,7 @@ async function persistRunningSessionRecord(args) {
       sliceId: args.sliceId,
       state: "running",
       piMessages: args.messages,
+      ...args.surface ?? latestSessionRecord?.surface ? { surface: args.surface ?? latestSessionRecord?.surface } : {},
       ...args.loadedSkillNames ? { loadedSkillNames: args.loadedSkillNames } : {},
       ...args.requester ?? latestSessionRecord?.requester ? { requester: args.requester ?? latestSessionRecord?.requester } : {},
       ...getActiveTraceId() ?? latestSessionRecord?.traceId ? { traceId: getActiveTraceId() ?? latestSessionRecord?.traceId } : {}
@@ -11164,6 +10588,7 @@ async function persistCompletedSessionRecord(args) {
       sliceId: args.sliceId,
       state: "completed",
       piMessages: args.allMessages,
+      ...args.surface ?? latestSessionRecord?.surface ? { surface: args.surface ?? latestSessionRecord?.surface } : {},
       ...args.loadedSkillNames ? { loadedSkillNames: args.loadedSkillNames } : {},
       ...args.requester ?? latestSessionRecord?.requester ? { requester: args.requester ?? latestSessionRecord?.requester } : {},
       ...getActiveTraceId() ?? latestSessionRecord?.traceId ? { traceId: getActiveTraceId() ?? latestSessionRecord?.traceId } : {}
@@ -11209,6 +10634,7 @@ async function persistAuthPauseSessionRecord(args) {
       sliceId: nextSliceId,
       state: "awaiting_resume",
       piMessages,
+      ...args.surface ?? latestSessionRecord?.surface ? { surface: args.surface ?? latestSessionRecord?.surface } : {},
       ...args.loadedSkillNames ? { loadedSkillNames: args.loadedSkillNames } : {},
       resumeReason: "auth",
       resumedFromSliceId: args.currentSliceId,
@@ -11264,6 +10690,7 @@ async function persistTimeoutSessionRecord(args) {
         sliceId: args.currentSliceId,
         state: "failed",
         piMessages,
+        ...args.surface ?? latestSessionRecord?.surface ? { surface: args.surface ?? latestSessionRecord?.surface } : {},
         ...args.loadedSkillNames ? { loadedSkillNames: args.loadedSkillNames } : {},
         resumeReason: "timeout",
         resumedFromSliceId: latestSessionRecord?.resumedFromSliceId,
@@ -11281,6 +10708,7 @@ async function persistTimeoutSessionRecord(args) {
       sliceId: nextSliceId,
       state: "awaiting_resume",
       piMessages,
+      ...args.surface ?? latestSessionRecord?.surface ? { surface: args.surface ?? latestSessionRecord?.surface } : {},
       ...args.loadedSkillNames ? { loadedSkillNames: args.loadedSkillNames } : {},
       resumeReason: "timeout",
       resumedFromSliceId: args.currentSliceId,
@@ -11330,6 +10758,7 @@ async function persistYieldSessionRecord(args) {
       sliceId: args.currentSliceId,
       state: "awaiting_resume",
       piMessages,
+      ...args.surface ?? latestSessionRecord?.surface ? { surface: args.surface ?? latestSessionRecord?.surface } : {},
       ...args.loadedSkillNames ? { loadedSkillNames: args.loadedSkillNames } : {},
       resumeReason: "yield",
       resumedFromSliceId: latestSessionRecord?.resumedFromSliceId,
@@ -11789,13 +11218,34 @@ function extractSliceUsage(messages, beforeMessageCount) {
   return hasAgentTurnUsage(usage) ? usage : void 0;
 }
 function requesterFromContext(requester, requesterId) {
-  const identity = {
-    ...requester?.email ? { email: requester.email } : {},
-    ...requester?.fullName ? { fullName: requester.fullName } : {},
-    ...requesterId ?? requester?.userId ? { slackUserId: requesterId ?? requester?.userId } : {},
-    ...requester?.userName ? { slackUserName: requester.userName } : {}
+  const identity = actorRequesterFromContext(requester, requesterId);
+  const agentRequester = {
+    ...identity?.email ? { email: identity.email } : {},
+    ...identity?.fullName ? { fullName: identity.fullName } : {},
+    ...identity?.userId ? { slackUserId: identity.userId } : {},
+    ...identity?.userName ? { slackUserName: identity.userName } : {}
   };
-  return Object.keys(identity).length > 0 ? identity : void 0;
+  return Object.keys(agentRequester).length > 0 ? agentRequester : void 0;
+}
+function actorRequesterFromContext(requester, requesterId) {
+  return buildActorIdentity(requester, requesterId);
+}
+function surfaceFromContext(context) {
+  if (context.surface) {
+    return context.surface;
+  }
+  const conversationId = context.correlation?.conversationId ?? context.correlation?.threadId ?? context.correlation?.runId;
+  if (context.slackConversation || (conversationId ? parseSlackThreadId(conversationId) : void 0)) {
+    return "slack";
+  }
+  const actor = context.credentialContext?.actor;
+  if (actor?.type === "system" && actor.id === "scheduler") {
+    return "scheduler";
+  }
+  if (conversationId) {
+    return "api";
+  }
+  return void 0;
 }
 function supportsRouterTextPreview(mediaType) {
   const baseMediaType = mediaType.split(";", 1)[0]?.trim().toLowerCase();
@@ -11912,6 +11362,11 @@ async function generateAssistantReply(messageText2, context = {}) {
     context.requester,
     context.correlation?.requesterId
   );
+  const actorRequester = actorRequesterFromContext(
+    context.requester,
+    context.correlation?.requesterId
+  );
+  const surface = surfaceFromContext(context);
   const credentialActor = context.credentialContext?.actor;
   const credentialActorLogContext = credentialActor ? {
     actorType: credentialActor.type,
@@ -12040,7 +11495,7 @@ async function generateAssistantReply(messageText2, context = {}) {
     const authRequesterId = context.credentialContext?.actor.type === "user" ? context.credentialContext.actor.userId : void 0;
     const userTokenStore = createUserTokenStore();
     const agentPluginHooks = createAgentPluginHookRunner({
-      requester: context.requester
+      requester: actorRequester
     });
     sandboxExecutor = createSandboxExecutor({
       sandboxId: context.sandbox?.sandboxId,
@@ -12057,7 +11512,7 @@ async function generateAssistantReply(messageText2, context = {}) {
         const result = await maybeExecuteJrRpcCustomCommand(command, {
           activeSkill: skillSandbox.getActiveSkill(),
           channelConfiguration: context.channelConfiguration,
-          requesterId: context.requester?.userId,
+          requesterId: actorRequester?.userId,
           onConfigurationValueChanged: (key, value) => {
             if (value === void 0) {
               delete configurationValues[key];
@@ -12293,7 +11748,7 @@ async function generateAssistantReply(messageText2, context = {}) {
       {
         channelId: toolChannelId,
         channelCapabilities,
-        requester: context.requester,
+        requester: actorRequester,
         teamId: context.correlation?.teamId,
         messageTs: context.correlation?.messageTs,
         threadTs: context.correlation?.threadTs,
@@ -12356,7 +11811,7 @@ async function generateAssistantReply(messageText2, context = {}) {
         slackConversation: context.slackConversation
       },
       invocation: skillInvocation,
-      requester: context.requester,
+      requester: actorRequester,
       artifactState: context.artifactState,
       configuration: configurationValues
     }) : null;
@@ -12437,7 +11892,8 @@ async function generateAssistantReply(messageText2, context = {}) {
         messages,
         loadedSkillNames: loadedSkillNamesForResume,
         logContext: sessionRecordLogContext,
-        requester
+        requester,
+        ...surface ? { surface } : {}
       });
       if (!persisted) {
         return false;
@@ -12750,7 +12206,8 @@ async function generateAssistantReply(messageText2, context = {}) {
         allMessages: agent.state.messages,
         loadedSkillNames: loadedSkillNamesForResume,
         logContext: sessionRecordLogContext,
-        requester
+        requester,
+        ...surface ? { surface } : {}
       });
     }
     return buildTurnResult({
@@ -12785,7 +12242,8 @@ async function generateAssistantReply(messageText2, context = {}) {
         errorMessage: error.message,
         loadedSkillNames: loadedSkillNamesForResume,
         logContext: sessionRecordLogContext,
-        requester
+        requester,
+        ...surface ? { surface } : {}
       });
       if (!sessionRecord) {
         throw new Error(
@@ -12808,7 +12266,8 @@ async function generateAssistantReply(messageText2, context = {}) {
         errorMessage: error instanceof Error ? error.message : String(error),
         loadedSkillNames: loadedSkillNamesForResume,
         logContext: sessionRecordLogContext,
-        requester
+        requester,
+        ...surface ? { surface } : {}
       });
       if (!sessionRecord) {
         throw new Error(
@@ -12850,7 +12309,8 @@ async function generateAssistantReply(messageText2, context = {}) {
         errorMessage: error.message,
         loadedSkillNames: loadedSkillNamesForResume,
         logContext: sessionRecordLogContext,
-        requester
+        requester,
+        ...surface ? { surface } : {}
       });
       if (sessionRecord) {
         throw new RetryableTurnError(
@@ -12987,6 +12447,7 @@ var CONTEXT_MIN_LIVE_MESSAGES = 12;
 var CONTEXT_COMPACTION_BATCH_SIZE = 24;
 var CONTEXT_MAX_COMPACTIONS = 16;
 var CONTEXT_MAX_MESSAGE_CHARS = 3200;
+var SLACK_USER_ID_DISPLAY_PATTERN = /^[UW][A-Z0-9]{5,}$/;
 function generateConversationId(prefix) {
   return `${prefix}_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
 }
@@ -13006,7 +12467,7 @@ function buildImageContextSuffix(message, conversation) {
   return ` [image context: ${summaries.join(" | ")}]`;
 }
 function renderConversationMessageLine(message, conversation) {
-  const displayName = message.author?.fullName || message.author?.userName || (message.role === "assistant" ? botConfig.userName : message.role);
+  const displayName = conversationAuthorDisplayName(message);
   const markers = [];
   if (message.meta?.replied === false) {
     markers.push(
@@ -13020,6 +12481,18 @@ function renderConversationMessageLine(message, conversation) {
   const imageContext = buildImageContextSuffix(message, conversation);
   return `[${message.role}] ${displayName}: ${message.text}${imageContext}${markerSuffix}`;
 }
+function conversationAuthorDisplayName(message) {
+  const author = message.author;
+  const fullName = authorDisplayField(author?.fullName, author?.userId);
+  const userName = authorDisplayField(author?.userName, author?.userId);
+  return fullName ?? userName ?? (message.role === "assistant" ? botConfig.userName : message.role);
+}
+function authorDisplayField(value, userId) {
+  if (!value || value === userId || SLACK_USER_ID_DISPLAY_PATTERN.test(value)) {
+    return void 0;
+  }
+  return value;
+}
 function updateConversationStats(conversation) {
   const contextText = buildConversationContext(conversation);
   conversation.stats.estimatedContextTokens = estimateTextTokens(
@@ -13089,11 +12562,12 @@ function buildConversationContext(conversation, options = {}) {
     }
     lines.push("<thread-transcript>");
     for (const [index, message] of messages.entries()) {
-      const author = escapeXml(message.author?.userName ?? message.role);
+      const author = escapeXml(conversationAuthorDisplayName(message));
+      const actorIdAttr = message.author?.userId ? ` actor_id="${escapeXml(message.author.userId)}"` : "";
       const ts = new Date(message.createdAtMs).toISOString();
       const slackTsAttr = message.meta?.slackTs ? ` slack_ts="${escapeXml(message.meta.slackTs)}"` : "";
       lines.push(
-        `  <message index="${index + 1}" ts="${ts}" role="${message.role}" author="${author}"${slackTsAttr}>`,
+        `  <message index="${index + 1}" ts="${ts}" role="${message.role}" author="${author}"${actorIdAttr}${slackTsAttr}>`,
         renderConversationMessageLine(message, conversation),
         "  </message>"
       );
@@ -13630,7 +13104,7 @@ function finalizeFailedTurnReply(args) {
 }
 
 // src/chat/agent-dispatch/signing.ts
-import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var DISPATCH_CALLBACK_PATH = "/api/internal/agent-dispatch";
 var DISPATCH_HMAC_CONTEXT = "junior.agent_dispatch.v1";
 var DISPATCH_SIGNATURE_VERSION = "v1";
@@ -13645,16 +13119,16 @@ function buildSignedPayload(timestamp, body) {
   return `${DISPATCH_HMAC_CONTEXT}:${timestamp}:${body}`;
 }
 function signBody(secret, timestamp, body) {
-  const digest = createHmac3("sha256", secret).update(buildSignedPayload(timestamp, body)).digest("hex");
+  const digest = createHmac2("sha256", secret).update(buildSignedPayload(timestamp, body)).digest("hex");
   return `${DISPATCH_SIGNATURE_VERSION}=${digest}`;
 }
-function timingSafeMatch3(expected, actual) {
+function timingSafeMatch2(expected, actual) {
   const expectedBuffer = Buffer.from(expected);
   const actualBuffer = Buffer.from(actual);
   if (expectedBuffer.length !== actualBuffer.length) {
     return false;
   }
-  return timingSafeEqual3(expectedBuffer, actualBuffer);
+  return timingSafeEqual2(expectedBuffer, actualBuffer);
 }
 function parseDispatchCallback(value) {
   if (!value || typeof value !== "object") {
@@ -13713,7 +13187,7 @@ async function verifyDispatchCallbackRequest(request) {
   }
   const body = await request.text();
   const expectedSignature = signBody(secret, timestamp, body);
-  if (!timingSafeMatch3(expectedSignature, signature)) {
+  if (!timingSafeMatch2(expectedSignature, signature)) {
     return void 0;
   }
   try {
@@ -13724,7 +13198,7 @@ async function verifyDispatchCallbackRequest(request) {
 }
 
 // src/chat/agent-dispatch/store.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash } from "crypto";
 var DISPATCH_PREFIX = "junior:agent_dispatch";
 var DISPATCH_LOCK_TTL_MS = 10 * 60 * 1e3;
 var DISPATCH_INDEX_LOCK_TTL_MS = 1e4;
@@ -13752,7 +13226,7 @@ function normalizeMetadata(metadata) {
   return entries.length > 0 ? Object.fromEntries(entries) : void 0;
 }
 function buildDispatchId(plugin, idempotencyKey) {
-  const digest = createHash2("sha256").update(plugin).update("\0").update(idempotencyKey).digest("hex").slice(0, 32);
+  const digest = createHash("sha256").update(plugin).update("\0").update(idempotencyKey).digest("hex").slice(0, 32);
   return `dispatch_${digest}`;
 }
 function getDispatchDestinationLockId(destination) {
@@ -14059,6 +13533,7 @@ async function runAgentDispatchSlice(callback, deps = {}) {
         channelId: dispatch.destination.channelId,
         teamId: dispatch.destination.teamId
       },
+      surface: dispatch.actor.id === "scheduler" ? "scheduler" : "api",
       toolChannelId: dispatch.destination.channelId,
       sandbox: {
         sandboxId,
@@ -14234,10 +13709,10 @@ async function POST(request, waitUntil) {
 }
 
 // src/handlers/heartbeat.ts
-import { timingSafeEqual as timingSafeEqual5 } from "crypto";
+import { timingSafeEqual as timingSafeEqual4 } from "crypto";
 
 // src/chat/services/timeout-resume.ts
-import { createHmac as createHmac4, timingSafeEqual as timingSafeEqual4 } from "crypto";
+import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual3 } from "crypto";
 
 // src/chat/task-execution/store.ts
 import { randomUUID as randomUUID4 } from "crypto";
@@ -14836,16 +14311,16 @@ function buildSignedPayload2(timestamp, body) {
   return `${TURN_TIMEOUT_RESUME_HMAC_CONTEXT}:${timestamp}:${body}`;
 }
 function signTurnTimeoutResumeBody(secret, timestamp, body) {
-  const digest = createHmac4("sha256", secret).update(buildSignedPayload2(timestamp, body)).digest("hex");
+  const digest = createHmac3("sha256", secret).update(buildSignedPayload2(timestamp, body)).digest("hex");
   return `${TURN_TIMEOUT_RESUME_SIGNATURE_VERSION}=${digest}`;
 }
-function timingSafeMatch4(expected, actual) {
+function timingSafeMatch3(expected, actual) {
   const expectedBuffer = Buffer.from(expected);
   const actualBuffer = Buffer.from(actual);
   if (expectedBuffer.length !== actualBuffer.length) {
     return false;
   }
-  return timingSafeEqual4(expectedBuffer, actualBuffer);
+  return timingSafeEqual3(expectedBuffer, actualBuffer);
 }
 function parseTurnTimeoutResumeRequest(value) {
   if (!value || typeof value !== "object") {
@@ -14900,7 +14375,7 @@ async function verifyTurnTimeoutResumeRequest(request) {
   }
   const body = await request.text();
   const expectedSignature = signTurnTimeoutResumeBody(secret, timestamp, body);
-  if (!timingSafeMatch4(expectedSignature, signature)) {
+  if (!timingSafeMatch3(expectedSignature, signature)) {
     return void 0;
   }
   try {
@@ -15052,7 +14527,7 @@ function validateDispatchOptions(options) {
     if (options.credentialSubject.type !== "user") {
       throw new Error("Dispatch credentialSubject type must be user");
     }
-    if (!options.credentialSubject.userId.trim()) {
+    if (!isActorUserId(options.credentialSubject.userId)) {
       throw new Error("Dispatch credentialSubject userId is required");
     }
     if (options.credentialSubject.allowedWhen !== "private-direct-conversation") {
@@ -15402,7 +14877,7 @@ function verifyHeartbeatRequest(request) {
   }
   const actual = Buffer.from(authorization.slice("Bearer ".length));
   const expected = Buffer.from(secret);
-  return actual.length === expected.length && timingSafeEqual5(actual, expected);
+  return actual.length === expected.length && timingSafeEqual4(actual, expected);
 }
 async function GET2(request, waitUntil, options = {}) {
   if (!verifyHeartbeatRequest(request)) {
@@ -16005,15 +15480,13 @@ function getTeamId(message) {
 }
 
 // src/chat/runtime/processing-reaction.ts
-var PROCESSING_REACTION_EMOJI = "eyes";
-var COMPLETED_REACTION_EMOJI = "white_check_mark";
 var noProcessingReaction = {
   complete: async () => void 0,
   keep: () => void 0,
   stop: async () => void 0
 };
 function isProcessingReactionEmoji(value) {
-  return typeof value === "string" && normalizeSlackEmojiName(value) === PROCESSING_REACTION_EMOJI;
+  return typeof value === "string" && normalizeSlackEmojiName(value) === botConfig.processingReactionEmoji;
 }
 function shouldKeepProcessingReactionForToolInvocation(input) {
   return input.toolName === "slackMessageAddReaction" && isProcessingReactionEmoji(input.params.emoji);
@@ -16039,7 +15512,7 @@ async function startSlackProcessingReactionForMessage(args) {
     await addReactionToMessage({
       channelId: args.channelId,
       timestamp: args.timestamp,
-      emoji: PROCESSING_REACTION_EMOJI
+      emoji: botConfig.processingReactionEmoji
     });
   } catch (error) {
     args.logException(
@@ -16064,7 +15537,7 @@ async function startSlackProcessingReactionForMessage(args) {
       await removeReactionFromMessage({
         channelId: args.channelId,
         timestamp: args.timestamp,
-        emoji: PROCESSING_REACTION_EMOJI
+        emoji: botConfig.processingReactionEmoji
       });
       return true;
     } catch (error) {
@@ -16091,7 +15564,7 @@ async function startSlackProcessingReactionForMessage(args) {
         await addReactionToMessage({
           channelId: args.channelId,
           timestamp: args.timestamp,
-          emoji: COMPLETED_REACTION_EMOJI
+          emoji: botConfig.completedReactionEmoji
         });
       } catch (error) {
         args.logException(
@@ -16538,6 +16011,87 @@ function htmlCallbackResponse(title, message, status) {
   });
 }
 
+// src/chat/slack/user.ts
+var USER_CACHE_TTL_MS = 5 * 60 * 1e3;
+var userCache = /* @__PURE__ */ new Map();
+function readFromCache(userId) {
+  const hit = userCache.get(userId);
+  if (!hit) return null;
+  if (hit.expiresAt < Date.now()) {
+    userCache.delete(userId);
+    return null;
+  }
+  return hit.value;
+}
+function writeToCache(userId, value) {
+  userCache.set(userId, {
+    value,
+    expiresAt: Date.now() + USER_CACHE_TTL_MS
+  });
+}
+async function lookupSlackUser(userId) {
+  if (!userId) {
+    return null;
+  }
+  const cached = readFromCache(userId);
+  if (cached) {
+    return cached;
+  }
+  const token = getSlackBotToken();
+  if (!token) {
+    return null;
+  }
+  try {
+    const response = await fetch(
+      `https://slack.com/api/users.info?user=${encodeURIComponent(userId)}`,
+      {
+        headers: {
+          authorization: `Bearer ${token}`
+        }
+      }
+    );
+    if (!response.ok) {
+      logWarn(
+        "slack_user_lookup_failed",
+        {},
+        {
+          "enduser.id": userId,
+          "http.response.status_code": response.status
+        },
+        "Slack user lookup request failed"
+      );
+      return null;
+    }
+    const payload = await response.json();
+    if (!payload.ok || !payload.user) {
+      return null;
+    }
+    const userName = payload.user.name?.trim() || void 0;
+    const fullName = payload.user.profile?.display_name?.trim() || payload.user.profile?.real_name?.trim() || payload.user.real_name?.trim() || void 0;
+    const result = {
+      userName,
+      fullName,
+      email: payload.user.profile?.email?.trim() || void 0
+    };
+    writeToCache(userId, result);
+    return result;
+  } catch (error) {
+    logWarn(
+      "slack_user_lookup_failed",
+      {},
+      {
+        "enduser.id": userId,
+        "exception.message": error instanceof Error ? error.message : String(error)
+      },
+      "Slack user lookup failed with exception"
+    );
+    return null;
+  }
+}
+async function lookupSlackActorIdentity(userId) {
+  return slackActorIdentity(userId, await lookupSlackUser(userId));
+}
+
 // src/handlers/mcp-oauth-callback.ts
 var CALLBACK_PAGES = {
   missing_state: {
@@ -16738,6 +16292,7 @@ async function resumeAuthorizedMcpTurn(args) {
         }),
         ttlMs: THREAD_STATE_TTL_MS4
       });
+      const requester = await lookupSlackActorIdentity(authSession.userId);
       return {
         messageText: lockedUserMessage.text,
         messageTs: getTurnUserSlackMessageTs(lockedUserMessage),
@@ -16745,11 +16300,7 @@ async function resumeAuthorizedMcpTurn(args) {
           credentialContext: {
             actor: { type: "user", userId: authSession.userId }
           },
-          requester: {
-            userId: authSession.userId,
-            userName: lockedUserMessage.author?.userName,
-            fullName: lockedUserMessage.author?.fullName
-          },
+          requester,
           correlation: {
             conversationId: authSession.conversationId,
             turnId: lockedSessionId,
@@ -17232,6 +16783,9 @@ async function resumeOAuthSessionRecordTurn(stored) {
         }),
         ttlMs: THREAD_STATE_TTL_MS5
       });
+      const requester = await lookupSlackActorIdentity(
+        lockedUserMessage.author.userId
+      );
       return {
         messageText: stored.pendingMessage ?? lockedUserMessage.text,
         messageTs: getTurnUserSlackMessageTs(lockedUserMessage),
@@ -17242,11 +16796,7 @@ async function resumeOAuthSessionRecordTurn(stored) {
               userId: lockedUserMessage.author.userId
             }
           },
-          requester: {
-            userId: lockedUserMessage.author.userId,
-            userName: lockedUserMessage.author.userName,
-            fullName: lockedUserMessage.author.fullName
-          },
+          requester,
           correlation: {
             conversationId: stored.resumeConversationId,
             turnId: lockedSessionId,
@@ -17342,6 +16892,7 @@ async function resumePendingOAuthMessage(stored) {
   const conversationContext = buildConversationContext(conversation, {
     excludeMessageId: latestUserMessage?.id
   });
+  const requester = await lookupSlackActorIdentity(stored.userId);
   await resumeAuthorizedRequest({
     messageText: stored.pendingMessage,
     channelId: stored.channelId,
@@ -17352,7 +16903,7 @@ async function resumePendingOAuthMessage(stored) {
       credentialContext: {
         actor: { type: "user", userId: stored.userId }
       },
-      requester: { userId: stored.userId },
+      requester,
       conversationContext,
       piMessages: conversation.piMessages,
       configuration: stored.configuration
@@ -18231,6 +17782,9 @@ async function resumeTimedOutTurn(payload, options = {}) {
         excludeMessageId: userMessage2.id
       });
       const sandbox = getPersistedSandboxState(currentState);
+      const requester = await lookupSlackActorIdentity(
+        userMessage2.author.userId
+      );
       return {
         messageText: userMessage2.text,
         messageTs: getTurnUserSlackMessageTs(userMessage2),
@@ -18241,11 +17795,7 @@ async function resumeTimedOutTurn(payload, options = {}) {
               userId: userMessage2.author.userId
             }
           },
-          requester: {
-            userId: userMessage2.author.userId,
-            userName: userMessage2.author.userName,
-            fullName: userMessage2.author.fullName
-          },
+          requester,
           correlation: {
             conversationId: payload.conversationId,
             turnId: payload.sessionId,
@@ -18735,6 +18285,60 @@ function combineTurnText(queuedMessages, latestText) {
   };
 }
 
+// src/chat/services/message-actor-identity.ts
+var messageActors = /* @__PURE__ */ new WeakMap();
+function canonicalUserId(author, identity) {
+  const authorUserId = parseActorUserId(author.userId);
+  const identityUserId = parseActorUserId(identity.userId);
+  if (authorUserId && identityUserId && authorUserId !== identityUserId) {
+    throw new Error("Message actor identity user id mismatch");
+  }
+  const userId = authorUserId ?? identityUserId;
+  if (!userId) {
+    throw new Error("Message actor identity requires a user id");
+  }
+  return userId;
+}
+function actorIdentityFromAuthor(author) {
+  const userId = parseActorUserId(author.userId);
+  return userId ? { userId } : void 0;
+}
+function applyIdentityToAuthor(author, identity) {
+  if (!isActorUserId(identity.userId)) {
+    throw new Error("Message actor identity requires a user id");
+  }
+  author.userId = identity.userId;
+  author.userName = identity.userName ?? "";
+  author.fullName = identity.fullName ?? "";
+}
+function bindMessageActorIdentity(message, identity) {
+  const userId = canonicalUserId(message.author, identity);
+  const actorIdentity = buildActorIdentity(identity, userId);
+  if (!actorIdentity?.userId) {
+    throw new Error("Message actor identity requires a user id");
+  }
+  messageActors.set(message, actorIdentity);
+  applyIdentityToAuthor(message.author, actorIdentity);
+  return actorIdentity;
+}
+function getMessageActorIdentity(message) {
+  return messageActors.get(message) ?? actorIdentityFromAuthor(message.author);
+}
+async function ensureSlackMessageActorIdentity(message, lookupSlackUser2) {
+  const existing = messageActors.get(message);
+  if (existing) {
+    return existing;
+  }
+  const userId = parseActorUserId(message.author.userId);
+  if (!userId) {
+    throw new Error("Slack message actor identity requires a user id");
+  }
+  return bindMessageActorIdentity(
+    message,
+    slackActorIdentity(userId, await lookupSlackUser2(userId))
+  );
+}
+
 // src/chat/runtime/slack-runtime.ts
 var THREAD_OPTOUT_ACK = "Understood. I'll stay out of this thread unless someone @mentions me again.";
 async function maybeHandleThreadOptOutDecision(args) {
@@ -18794,6 +18398,9 @@ function buildLogContext(deps, args) {
     modelId: deps.modelId
   };
 }
+function requesterUserName(message) {
+  return getMessageActorIdentity(message)?.userName;
+}
 function createSlackTurnRuntime(deps) {
   const logContext = (args) => buildLogContext(deps, args);
   const createToolInvocationHook = (processingReaction, hooks) => {
@@ -18867,7 +18474,7 @@ function createSlackTurnRuntime(deps) {
       logContext({
         threadId: args.context.threadId,
         requesterId: args.context.requesterId,
-        requesterUserName: args.message.author.userName,
+        requesterUserName: requesterUserName(args.message),
         channelId: args.context.channelId,
         runId: args.context.runId
       }),
@@ -18909,7 +18516,7 @@ function createSlackTurnRuntime(deps) {
           threadId,
           channelId,
           requesterId: message.author.userId,
-          requesterUserName: message.author.userName,
+          requesterUserName: requesterUserName(message),
           runId
         });
         processingReaction = await processingReactions.start(context, message);
@@ -18969,7 +18576,7 @@ function createSlackTurnRuntime(deps) {
         const errorContext = logContext({
           threadId: deps.getThreadId(thread, message),
           requesterId: message.author.userId,
-          requesterUserName: message.author.userName,
+          requesterUserName: requesterUserName(message),
           channelId: deps.getChannelId(thread, message),
           runId: deps.getRunId(thread, message)
         });
@@ -19025,7 +18632,7 @@ function createSlackTurnRuntime(deps) {
         const turnContext = logContext({
           threadId,
           requesterId: message.author.userId,
-          requesterUserName: message.author.userName,
+          requesterUserName: requesterUserName(message),
           channelId,
           runId
         });
@@ -19175,7 +18782,7 @@ function createSlackTurnRuntime(deps) {
         const errorContext = logContext({
           threadId: deps.getThreadId(thread, message),
           requesterId: message.author.userId,
-          requesterUserName: message.author.userName,
+          requesterUserName: requesterUserName(message),
           channelId: deps.getChannelId(thread, message),
           runId: deps.getRunId(thread, message)
         });
@@ -19533,84 +19140,6 @@ function createContextCompactor(deps) {
   };
 }
 
-// src/chat/slack/user.ts
-var USER_CACHE_TTL_MS = 5 * 60 * 1e3;
-var userCache = /* @__PURE__ */ new Map();
-function readFromCache(userId) {
-  const hit = userCache.get(userId);
-  if (!hit) return null;
-  if (hit.expiresAt < Date.now()) {
-    userCache.delete(userId);
-    return null;
-  }
-  return hit.value;
-}
-function writeToCache(userId, value) {
-  userCache.set(userId, {
-    value,
-    expiresAt: Date.now() + USER_CACHE_TTL_MS
-  });
-}
-async function lookupSlackUser(userId) {
-  if (!userId) {
-    return null;
-  }
-  const cached = readFromCache(userId);
-  if (cached) {
-    return cached;
-  }
-  const token = getSlackBotToken();
-  if (!token) {
-    return null;
-  }
-  try {
-    const response = await fetch(
-      `https://slack.com/api/users.info?user=${encodeURIComponent(userId)}`,
-      {
-        headers: {
-          authorization: `Bearer ${token}`
-        }
-      }
-    );
-    if (!response.ok) {
-      logWarn(
-        "slack_user_lookup_failed",
-        {},
-        {
-          "enduser.id": userId,
-          "http.response.status_code": response.status
-        },
-        "Slack user lookup request failed"
-      );
-      return null;
-    }
-    const payload = await response.json();
-    if (!payload.ok || !payload.user) {
-      return null;
-    }
-    const userName = payload.user.name?.trim() || void 0;
-    const fullName = payload.user.profile?.display_name?.trim() || payload.user.profile?.real_name?.trim() || payload.user.real_name?.trim() || void 0;
-    const result = {
-      userName,
-      fullName,
-      email: payload.user.profile?.email?.trim() || void 0
-    };
-    writeToCache(userId, result);
-    return result;
-  } catch (error) {
-    logWarn(
-      "slack_user_lookup_failed",
-      {},
-      {
-        "enduser.id": userId,
-        "exception.message": error instanceof Error ? error.message : String(error)
-      },
-      "Slack user lookup failed with exception"
-    );
-    return null;
-  }
-}
-
 // src/chat/services/subscribed-reply-policy.ts
 function createSubscribedReplyPolicy(deps) {
   return async (args) => {
@@ -20334,14 +19863,14 @@ function collectCanvasUrls(artifacts) {
     ].filter((url) => typeof url === "string" && url !== "")
   );
 }
-function turnRequester(args) {
+function turnRequester(identity) {
   const requester = {
-    ...args.email ? { email: args.email } : {},
-    ...args.fullName ? { fullName: args.fullName } : {},
-    ...args.userId ? { slackUserId: args.userId } : {},
-    ...args.userName ? { slackUserName: args.userName } : {}
+    ...identity.email ? { email: identity.email } : {},
+    ...identity.fullName ? { fullName: identity.fullName } : {},
+    ...identity.userId ? { slackUserId: identity.userId } : {},
+    ...identity.userName ? { slackUserName: identity.userName } : {}
   };
-  return Object.keys(requester).length > 0 ? requester : void 0;
+  return requester;
 }
 async function resolveChannelName(thread) {
   const existingName = thread.channel.name?.trim();
@@ -20450,6 +19979,19 @@ function createReplyToThread(deps) {
           options.queuedMessages ?? [],
           currentText
         ).userText;
+        await Promise.all(
+          (options.queuedMessages ?? []).map(
+            (queued) => ensureSlackMessageActorIdentity(
+              queued.message,
+              deps.services.lookupSlackUser
+            )
+          )
+        );
+        const requesterIdentity = await ensureSlackMessageActorIdentity(
+          message,
+          deps.services.lookupSlackUser
+        );
+        const requester = turnRequester(requesterIdentity);
         const preparedState = options.preparedState ?? await deps.prepareTurnState({
           thread,
           message,
@@ -20467,15 +20009,6 @@ function createReplyToThread(deps) {
         });
         const slackMessageTs = getSlackMessageTs(message);
         const turnId = buildDeterministicTurnId(message.id);
-        const fallbackIdentity = await deps.services.lookupSlackUser(
-          message.author.userId
-        );
-        const requester = turnRequester({
-          email: fallbackIdentity?.email,
-          fullName: message.author.fullName ?? fallbackIdentity?.fullName,
-          userId: message.author.userId,
-          userName: message.author.userName ?? fallbackIdentity?.userName
-        });
         const turnTraceContext = {
           conversationId,
           slackThreadId: threadId,
@@ -20630,6 +20163,7 @@ function createReplyToThread(deps) {
             sliceId: 1,
             startedAtMs: message.metadata.dateSent.getTime(),
             state: "running",
+            surface: "slack",
             requester,
             traceId: getActiveTraceId()
           }).catch((error) => {
@@ -20662,16 +20196,15 @@ function createReplyToThread(deps) {
           conversation: preparedState.conversation
         });
         await options.onTurnStatePersisted?.();
-        const resolvedUserName = message.author.userName ?? fallbackIdentity?.userName;
         if (message.author.userId) {
           setSentryUser({
             id: message.author.userId,
-            ...resolvedUserName ? { username: resolvedUserName } : {},
-            ...fallbackIdentity?.email ? { email: fallbackIdentity.email } : {}
+            ...requesterIdentity.userName ? { username: requesterIdentity.userName } : {},
+            ...requesterIdentity.email ? { email: requesterIdentity.email } : {}
           });
         }
-        if (resolvedUserName) {
-          setTags({ slackUserName: resolvedUserName });
+        if (requesterIdentity.userName) {
+          setTags({ slackUserName: requesterIdentity.userName });
         }
         const turnAttachments = collectTurnAttachments(
           message,
@@ -20801,12 +20334,7 @@ function createReplyToThread(deps) {
               credentialContext: {
                 actor: { type: "user", userId: message.author.userId }
               },
-              requester: {
-                userId: message.author.userId,
-                userName: message.author.userName ?? fallbackIdentity?.userName,
-                fullName: message.author.fullName ?? fallbackIdentity?.fullName,
-                email: fallbackIdentity?.email
-              },
+              requester: requesterIdentity,
               conversationContext: preparedState.conversationContext,
               artifactState: preparedState.artifacts,
               piMessages,
@@ -20817,6 +20345,7 @@ function createReplyToThread(deps) {
               omittedImageAttachmentCount,
               userAttachments,
               slackConversation,
+              surface: "slack",
               turnDeadlineAtMs: getTurnRequestDeadline()?.deadlineAtMs,
               correlation: {
                 conversationId,
@@ -21212,6 +20741,7 @@ function resolveMessageText(args) {
   return text || NON_TEXT_MESSAGE_TEXT;
 }
 function toConversationMessage(args) {
+  const actor = getMessageActorIdentity(args.entry);
   const messageHasPotentialImageAttachment = hasPotentialImageAttachment(
     args.entry.attachments
   );
@@ -21222,9 +20752,9 @@ function toConversationMessage(args) {
     text: resolveMessageText(args),
     createdAtMs: args.entry.metadata.dateSent.getTime(),
     author: {
-      userId: args.entry.author.userId,
-      userName: args.entry.author.userName,
-      fullName: args.entry.author.fullName,
+      ...actor?.userId ? { userId: actor.userId } : {},
+      ...actor?.userName ? { userName: actor.userName } : {},
+      ...actor?.fullName ? { fullName: actor.fullName } : {},
       isBot: typeof args.entry.author.isBot === "boolean" ? args.entry.author.isBot : void 0
     },
     meta: {
@@ -21641,6 +21171,13 @@ async function runWithSlackInstallation(args) {
 }
 
 // src/chat/task-execution/slack-work.ts
+function requireSlackAuthorId(message) {
+  const authorId = parseActorUserId(message.author.userId);
+  if (!authorId) {
+    throw new Error("Slack message requires an actor user id");
+  }
+  return authorId;
+}
 function getConnectedState3(stateAdapter) {
   return stateAdapter ?? getStateAdapter();
 }
@@ -21665,6 +21202,23 @@ function restoreMessage(args) {
   rehydrateAttachmentFetchers(message);
   return message;
 }
+async function bindSlackActorIdentities(args) {
+  const byAuthorId = /* @__PURE__ */ new Map();
+  for (const message of args.messages) {
+    const authorId = requireSlackAuthorId(message);
+    byAuthorId.set(authorId, [...byAuthorId.get(authorId) ?? [], message]);
+  }
+  await Promise.all(
+    [...byAuthorId].map(async ([authorId, messages]) => {
+      const profile = await args.lookupSlackUser(authorId);
+      await Promise.all(
+        messages.map(
+          (message) => ensureSlackMessageActorIdentity(message, async () => profile)
+        )
+      );
+    })
+  );
+}
 function restoreThread(args) {
   const threadId = normalizeIncomingSlackThreadId(
     args.threadJson.id,
@@ -21744,6 +21298,7 @@ function getPendingRecords(work) {
 function createSlackConversationWorker(options) {
   return async (context) => {
     const adapter = options.getSlackAdapter();
+    const actorLookup = options.lookupSlackUser ?? lookupSlackUser;
     const state = getConnectedState3(options.state);
     await state.connect();
     const resumeContinuation = options.resumeAwaitingContinuation ?? resumeAwaitingContinuation;
@@ -21781,6 +21336,10 @@ function createSlackConversationWorker(options) {
         const messages = records.map(
           (record) => restoreMessage({ adapter, record })
         );
+        await bindSlackActorIdentities({
+          lookupSlackUser: actorLookup,
+          messages
+        });
         const latestMessage = messages[messages.length - 1];
         if (!latestMessage) {
           return;
@@ -21867,6 +21426,7 @@ function createSlackConversationWorker(options) {
   };
 }
 function buildSlackInboundMessage(args) {
+  const authorId = requireSlackAuthorId(args.message);
   return {
     conversationId: args.conversationId,
     inboundMessageId: [
@@ -21880,7 +21440,7 @@ function buildSlackInboundMessage(args) {
     receivedAtMs: args.receivedAtMs,
     input: {
       text: args.message.text || " ",
-      authorId: args.message.author.userId,
+      authorId,
       attachments: args.message.attachments,
       metadata: {
         platform: "slack",
@@ -21999,7 +21559,8 @@ function extractMessageChangedMention(body, botUserId, adapter) {
   const channelId = event.channel;
   const messageTs = event.message.ts;
   const threadTs = event.message.thread_ts ?? messageTs;
-  const userId = event.message.user ?? "unknown";
+  const userId = parseActorUserId(event.message.user);
+  if (!userId) return null;
   const threadId = `slack:${channelId}:${threadTs}`;
   const teamId = typeof body.team_id === "string" ? body.team_id : void 0;
   const userTeam = typeof event.message.user_team === "string" ? event.message.user_team : void 0;
@@ -22024,8 +21585,9 @@ function extractMessageChangedMention(body, botUserId, adapter) {
     raw,
     author: {
       userId,
-      userName: userId,
-      fullName: userId,
+      // Raw message_changed payloads do not include profile fields.
+      userName: "",
+      fullName: "",
       isBot: false,
       isMe: false
     }
@@ -22055,7 +21617,17 @@ function isExternalSlackUser(raw) {
 async function postEphemeral(event, text) {
   await event.channel.postEphemeral(event.user, text, { fallbackToDM: false });
 }
-async function handleLink(event, provider) {
+function requireRequesterId(event) {
+  const userId = parseActorUserId(event.user.userId);
+  if (!userId) {
+    throw new Error("Slack slash command requires a requester user id");
+  }
+  return userId;
+}
+function getCommandName() {
+  return getChatConfig().slack.slashCommand;
+}
+async function handleLink(event, requesterId, provider) {
   if (!isPluginProvider(provider)) {
     await postEphemeral(event, `Unknown provider: \`${provider}\``);
     return;
@@ -22069,7 +21641,7 @@ async function handleLink(event, provider) {
   }
   const raw = event.raw;
   const result = await startOAuthFlow(provider, {
-    requesterId: event.user.userId,
+    requesterId,
     channelId: raw.channel_id
   });
   if (!result.ok) {
@@ -22088,7 +21660,7 @@ async function handleLink(event, provider) {
     );
   }
 }
-async function handleUnlink(event, provider) {
+async function handleUnlink(event, requesterId, provider) {
   if (!isPluginProvider(provider)) {
     await postEphemeral(event, `Unknown provider: \`${provider}\``);
     return;
@@ -22101,12 +21673,12 @@ async function handleUnlink(event, provider) {
     return;
   }
   const tokenStore = createUserTokenStore();
-  await tokenStore.delete(event.user.userId, provider);
+  await tokenStore.delete(requesterId, provider);
   logInfo(
     "slash_command_unlink",
-    { slackUserId: event.user.userId },
+    { slackUserId: requesterId },
     { "app.credential.provider": provider },
-    `Unlinked ${formatProviderLabel(provider)} account via /jr slash command`
+    `Unlinked ${formatProviderLabel(provider)} account via ${getCommandName()} slash command`
   );
   await postEphemeral(
     event,
@@ -22118,19 +21690,23 @@ async function handleSlashCommand(event) {
   if (!subcommand || !["link", "unlink"].includes(subcommand)) {
     await postEphemeral(
       event,
-      "Usage: `/jr link <provider>` or `/jr unlink <provider>`"
+      `Usage: \`${getCommandName()} link <provider>\` or \`${getCommandName()} unlink <provider>\``
     );
     return;
   }
   if (!provider || rest.length > 0) {
-    await postEphemeral(event, `Usage: \`/jr ${subcommand} <provider>\``);
+    await postEphemeral(
+      event,
+      `Usage: \`${getCommandName()} ${subcommand} <provider>\``
+    );
     return;
   }
   const normalized = provider.toLowerCase();
+  const requesterId = requireRequesterId(event);
   if (subcommand === "link") {
-    await handleLink(event, normalized);
+    await handleLink(event, requesterId, normalized);
   } else {
-    await handleUnlink(event, normalized);
+    await handleUnlink(event, requesterId, normalized);
   }
 }
 
@@ -22370,15 +21946,12 @@ async function handleSlackEvent(args) {
     })
   );
 }
-function buildAuthorFromInteractive(user) {
-  const userId = user?.id ?? "unknown";
-  return {
-    userId,
-    userName: user?.username ?? user?.name ?? userId,
-    fullName: user?.name ?? user?.username ?? userId,
-    isBot: false,
-    isMe: false
-  };
+function requireSlackPayloadUserId(value, source) {
+  const userId = parseActorUserId(value);
+  if (!userId) {
+    throw new Error(`${source} is missing a Slack user id`);
+  }
+  return userId;
 }
 async function handleSlashCommandForm(args) {
   const raw = Object.fromEntries(args.params);
@@ -22388,7 +21961,21 @@ async function handleSlashCommandForm(args) {
     adapter: args.adapter,
     stateAdapter: args.state
   });
-  const userId = args.params.get("user_id") || "unknown";
+  const userId = requireSlackPayloadUserId(
+    args.params.get("user_id"),
+    "Slack slash command payload"
+  );
+  const userIdentity = buildActorIdentity(
+    {
+      userId,
+      userName: args.params.get("user_name") ?? void 0,
+      fullName: args.params.get("user_name") ?? void 0
+    },
+    userId
+  );
+  if (!userIdentity?.userId) {
+    throw new Error("Slack slash command payload actor identity is invalid");
+  }
   await withSpan(
     "chat.slash_command",
     "chat.slash_command",
@@ -22403,8 +21990,8 @@ async function handleSlashCommandForm(args) {
         raw,
         user: {
           userId,
-          userName: args.params.get("user_name") || userId,
-          fullName: args.params.get("user_name") || userId,
+          userName: userIdentity.userName ?? "",
+          fullName: userIdentity.fullName ?? "",
           isBot: false,
           isMe: false
         },
@@ -22421,10 +22008,13 @@ async function handleInteractivePayload(args) {
     (candidate) => candidate.action_id === "app_home_disconnect"
   );
   const provider = action?.selected_option?.value ?? action?.value;
-  const userId = args.payload.user?.id;
-  if (!provider || !userId) {
+  if (!provider) {
     return;
   }
+  const userId = requireSlackPayloadUserId(
+    args.payload.user?.id,
+    "Slack app home disconnect payload"
+  );
   await withSpan(
     "chat.app_home_disconnect",
     "chat.app_home_disconnect",
@@ -22519,7 +22109,7 @@ async function handleSlackForm(args) {
       })
     ).catch((error) => {
       logException(error, "slack_interactive_payload_failed", {
-        slackUserId: buildAuthorFromInteractive(payload.user).userId
+        slackUserId: payload.user?.id?.trim() || void 0
       });
     })
   );
@@ -23242,16 +22832,16 @@ function mountAgentPluginRoutes(app, routes) {
 async function createApp(options) {
   const virtualConfig = await resolveVirtualConfig();
   const configuredPlugins = options?.plugins ?? virtualConfig?.pluginSet;
-  const agentPlugins2 = trustedPluginRegistrationsFromPluginSet(configuredPlugins);
+  const agentPlugins = trustedPluginRegistrationsFromPluginSet(configuredPlugins);
   const pluginConfig = configuredPlugins ? pluginCatalogConfigFromPluginSet(configuredPlugins) : virtualConfig?.plugins ?? resolveEnvPluginCatalogConfig();
   if (configuredPlugins) {
     validateBuildIncludesPluginPackages(pluginConfig, virtualConfig);
   }
-  validateBuildIncludesTrustedRegistrations(agentPlugins2, virtualConfig);
-  validateAgentPlugins(agentPlugins2);
+  validateBuildIncludesTrustedRegistrations(agentPlugins, virtualConfig);
+  validateAgentPlugins(agentPlugins);
   const shouldValidatePluginCatalog = hasConfiguredPluginCatalog(pluginConfig) || Boolean(configuredPlugins?.registrations.length) || Boolean(Object.keys(options?.configDefaults ?? {}).length);
   const previousPluginCatalogConfig = setPluginCatalogConfig(pluginConfig);
-  const previousAgentPlugins = setAgentPlugins(agentPlugins2);
+  const previousAgentPlugins = setAgentPlugins(agentPlugins);
   const previousConfigDefaults = getConfigDefaults();
   let agentPluginRoutes = [];
   try {