@sentry/junior 0.85.0 → 0.87.0

package/dist/chat/tools/slack/channel-access.d.ts

@@ -0,0 +1,29 @@
+import type { ConversationPrivacy } from "@/chat/conversation-privacy";
+/** Minimal persisted-visibility port for cross-conversation read gates. */
+export interface DestinationVisibilityReader {
+    getDestinationVisibility(args: {
+        provider: string;
+        providerDestinationId: string;
+        providerTenantId?: string;
+    }): Promise<ConversationPrivacy | undefined>;
+}
+export type SlackChannelReadAccess = {
+    allowed: true;
+} | {
+    allowed: false;
+    error: string;
+};
+/**
+ * Decide whether the model may read Slack content from a target channel.
+ *
+ * The current conversation is always readable. Any other channel requires
+ * persisted `public` visibility in the same workspace: channel-id prefixes
+ * cannot prove a channel public (modern Slack private channels also use `C`
+ * ids), so missing or private destinations fail closed.
+ */
+export declare function checkSlackChannelReadAccess(args: {
+    currentChannelIds: Array<string | undefined>;
+    store?: DestinationVisibilityReader;
+    targetChannelId: string;
+    teamId: string;
+}): Promise<SlackChannelReadAccess>;

package/dist/chat/tools/slack/thread-read.d.ts

@@ -1,6 +1,9 @@
+import { type DestinationVisibilityReader } from "@/chat/tools/slack/channel-access";
 import type { SlackToolContext } from "@/chat/tools/slack/context";
 /** Create a tool that reads a Slack thread from a shared message URL or explicit coordinates. */
-export declare function createSlackThreadReadTool(context: SlackToolContext): import("@/chat/tools/definition").ToolDefinition<import("@sinclair/typebox").TObject<{
+export declare function createSlackThreadReadTool(context: SlackToolContext, deps?: {
+    visibilityStore?: DestinationVisibilityReader;
+}): import("@/chat/tools/definition").ToolDefinition<import("@sinclair/typebox").TObject<{
     url: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     channel_id: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     ts: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;

package/dist/{chunk-UVNV67EC.js → chunk-2NFV5FMB.js}

@@ -1,10 +1,10 @@
 import {
   createPluginLogger,
   createPluginState
-} from "./chunk-MTE5NRPJ.js";
+} from "./chunk-BRSQQRG6.js";
 import {
   getDb
-} from "./chunk-QTTTRBNB.js";
+} from "./chunk-6I6HBOQM.js";
 import {
   SANDBOX_WORKSPACE_ROOT
 } from "./chunk-G3E7SCME.js";
@@ -13,12 +13,12 @@ import {
   isConversationScopedChannel,
   isDmChannel,
   normalizeSlackConversationId
-} from "./chunk-C2PSUWK3.js";
+} from "./chunk-GGD6WK6V.js";
 import {
   botConfig,
   completeObject,
   embedTexts
-} from "./chunk-BU2AWPEN.js";
+} from "./chunk-ZU2ALUVQ.js";
 import {
   isActorUserId,
   parseActorUserId

package/dist/{chunk-QTTTRBNB.js → chunk-6I6HBOQM.js}

@@ -1,17 +1,17 @@
 import {
   parseDestination,
   sameDestination
-} from "./chunk-C2PSUWK3.js";
+} from "./chunk-GGD6WK6V.js";
 import {
   getChatConfig
-} from "./chunk-BU2AWPEN.js";
+} from "./chunk-ZU2ALUVQ.js";
 import {
   parseStoredSlackRequester
 } from "./chunk-IXTBFABZ.js";
 
 // src/chat/conversations/sql/store.ts
 import { randomUUID } from "crypto";
-import { asc, desc, eq, sql as sql2 } from "drizzle-orm";
+import { and, asc, desc, eq, sql as sql2 } from "drizzle-orm";
 
 // src/chat/conversations/sql/migrations.ts
 import { createHash } from "crypto";
@@ -298,8 +298,20 @@ CREATE INDEX IF NOT EXISTS junior_conversations_origin_idx
   ON junior_conversations (origin_type, origin_id, last_activity_at DESC)
 `
 ];
+var destinationVisibilityBackfillStatements = [
+  `
+UPDATE junior_destinations
+  SET visibility = 'private'
+  WHERE provider = 'slack'
+    AND visibility = 'public'
+`
+];
 var migrations = [
-  defineMigration("0001_conversation_core", coreMetadataStatements)
+  defineMigration("0001_conversation_core", coreMetadataStatements),
+  defineMigration(
+    "0002_slack_destination_visibility_backfill",
+    destinationVisibilityBackfillStatements
+  )
 ];
 function parseStoredMigrationRecord(value) {
   return migrationRecordSchema.parse(value);
@@ -436,13 +448,13 @@ function destinationUpsertFromDestination(args) {
   if (destination.platform === "slack") {
     const channelId = destination.channelId;
     const channelKind = channelId.startsWith("D") ? "dm" : channelId.startsWith("G") ? "group" : "channel";
-    const visibility = channelId.startsWith("D") ? "direct" : channelId.startsWith("G") ? "private" : "public";
     return {
       kind: channelKind,
       provider: "slack",
       providerTenantId: destination.teamId,
       providerDestinationId: channelId,
-      visibility,
+      refreshVisibility: args.visibility !== void 0,
+      visibility: args.visibility ?? "private",
       ...args.channelName ? { displayName: args.channelName } : {},
       metadata: { platform: "slack" }
     };
@@ -452,6 +464,7 @@ function destinationUpsertFromDestination(args) {
     provider: "local",
     providerTenantId: localWorkspaceFromConversationId(destination.conversationId) ?? localWorkspaceFromConversationId(args.conversationId ?? ""),
     providerDestinationId: destination.conversationId,
+    refreshVisibility: true,
     visibility: "direct",
     metadata: { platform: "local" }
   };
@@ -462,7 +475,15 @@ function executionStatusFromValue(value) {
   }
   throw new Error("Conversation record execution status is invalid");
 }
-function conversationFromRow(row) {
+function privacyFromRow(row) {
+  if (row.destinationVisibility === null) {
+    return void 0;
+  }
+  return row.destinationVisibility === "public" ? "public" : "private";
+}
+function conversationFromRow(readRow) {
+  const row = readRow.conversation;
+  const visibility = privacyFromRow(readRow);
   if (row.schemaVersion !== 1) {
     throw new Error("Conversation record schema version is invalid");
   }
@@ -496,7 +517,8 @@ function conversationFromRow(row) {
     ...requester ? { requester } : {},
     ...row.channelName ? { channelName: row.channelName } : {},
     ...source ? { source } : {},
-    ...row.title ? { title: row.title } : {}
+    ...row.title ? { title: row.title } : {},
+    ...visibility ? { visibility } : {}
   };
 }
 function emptyConversation(args) {
@@ -572,9 +594,10 @@ var SqlStore = class {
         nowMs,
         source: args.source
       });
+      const { visibility: _persisted, ...currentWithoutVisibility } = current2;
       await this.upsertConversation({
         conversation: {
-          ...current2,
+          ...currentWithoutVisibility,
           destination: current2.destination ?? args.destination,
           source: current2.source ?? args.source,
           channelName: current2.channelName ?? args.channelName,
@@ -585,7 +608,8 @@ var SqlStore = class {
           execution: {
             ...current2.execution,
             updatedAtMs: current2.execution.updatedAtMs ?? nowMs
-          }
+          },
+          ...args.visibility ? { visibility: args.visibility } : {}
         }
       });
     });
@@ -604,13 +628,15 @@ var SqlStore = class {
           ...args.requester ? { requester: args.requester } : {},
           ...args.source ? { source: args.source } : {},
           ...args.title ? { title: args.title } : {},
+          ...args.visibility ? { visibility: args.visibility } : {},
           execution: args.execution
         }
       });
     });
   }
   /** Copy one conversation record into SQL during backfill. */
-  async backfillConversation(conversation) {
+  async backfillConversation(sourceConversation) {
+    const { visibility: _visibility, ...conversation } = sourceConversation;
     await this.withConversationMutation(
       conversation.conversationId,
       async () => {
@@ -646,7 +672,13 @@ var SqlStore = class {
     );
   }
   async listByActivity(args = {}) {
-    const rows = await this.executor.db().select().from(juniorConversations).orderBy(
+    const rows = await this.executor.db().select({
+      conversation: juniorConversations,
+      destinationVisibility: juniorDestinations.visibility
+    }).from(juniorConversations).leftJoin(
+      juniorDestinations,
+      eq(juniorDestinations.id, juniorConversations.destinationId)
+    ).orderBy(
       desc(juniorConversations.lastActivityAt),
       asc(juniorConversations.conversationId)
     ).limit(Math.max(0, args.limit ?? 1e4)).offset(Math.max(0, args.offset ?? 0));
@@ -656,6 +688,28 @@ var SqlStore = class {
     }
     return conversations;
   }
+  async getDestinationVisibility(args) {
+    const rows = await this.executor.db().select({
+      visibility: juniorDestinations.visibility
+    }).from(juniorDestinations).where(
+      and(
+        eq(juniorDestinations.provider, args.provider),
+        eq(
+          juniorDestinations.providerTenantId,
+          tenantId(args.providerTenantId)
+        ),
+        eq(
+          juniorDestinations.providerDestinationId,
+          args.providerDestinationId
+        )
+      )
+    );
+    const row = rows[0];
+    if (!row) {
+      return void 0;
+    }
+    return row.visibility === "public" ? "public" : "private";
+  }
   /** Serialize all durable mutations for one conversation inside a SQL transaction. */
   async withConversationMutation(conversationId, callback) {
     return await this.executor.withLock(
@@ -664,7 +718,13 @@ var SqlStore = class {
     );
   }
   async readConversationRow(conversationId) {
-    const rows = await this.executor.db().select().from(juniorConversations).where(eq(juniorConversations.conversationId, conversationId));
+    const rows = await this.executor.db().select({
+      conversation: juniorConversations,
+      destinationVisibility: juniorDestinations.visibility
+    }).from(juniorConversations).leftJoin(
+      juniorDestinations,
+      eq(juniorDestinations.id, juniorConversations.destinationId)
+    ).where(eq(juniorConversations.conversationId, conversationId));
     return rows[0];
   }
   /** Upsert the conversation row while preserving previously discovered nullable metadata fields. */
@@ -677,7 +737,8 @@ var SqlStore = class {
       destinationUpsertFromDestination({
         channelName: conversation.channelName,
         conversationId: conversation.conversationId,
-        destination: conversation.destination
+        destination: conversation.destination,
+        ...conversation.visibility ? { visibility: conversation.visibility } : {}
       }),
       conversation.updatedAtMs
     );
@@ -779,6 +840,7 @@ var SqlStore = class {
     if (!destination) {
       return void 0;
     }
+    const visibilityUpdate = destination.refreshVisibility ? sql2`excluded.visibility` : juniorDestinations.visibility;
     const rows = await this.executor.db().insert(juniorDestinations).values({
       id: randomUUID(),
       provider: destination.provider,
@@ -800,7 +862,10 @@ var SqlStore = class {
       set: {
         kind: sql2`excluded.kind`,
         displayName: sql2`coalesce(excluded.display_name, ${juniorDestinations.displayName})`,
-        visibility: sql2`excluded.visibility`,
+        // Signal-less writes insert as private but must not clobber an
+        // existing public/private value. Live source signals refresh this
+        // field so converted channels converge on the next message.
+        visibility: visibilityUpdate,
         metadata: sql2`coalesce(excluded.metadata_json, ${juniorDestinations.metadata})`,
         updatedAt: sql2`excluded.updated_at`
       }

package/dist/{chunk-ENEWQMRJ.js → chunk-6O5UI3RG.js}

@@ -4,7 +4,7 @@ import {
 import {
   destinationKey,
   parseDestination
-} from "./chunk-C2PSUWK3.js";
+} from "./chunk-GGD6WK6V.js";
 
 // src/chat/task-execution/queue-signing.ts
 import { createHmac, timingSafeEqual } from "crypto";

package/dist/{chunk-GY7L6VCT.js → chunk-ACJJJEGG.js}

@@ -1,6 +1,6 @@
 import {
   getConversationStore
-} from "./chunk-QTTTRBNB.js";
+} from "./chunk-6I6HBOQM.js";
 import {
   SANDBOX_DATA_ROOT,
   SANDBOX_WORKSPACE_ROOT,
@@ -9,16 +9,16 @@ import {
 import {
   getConnectedStateContext,
   getStateAdapter
-} from "./chunk-RUB77TGS.js";
+} from "./chunk-GB5DFM4D.js";
 import {
   parseDestination
-} from "./chunk-C2PSUWK3.js";
+} from "./chunk-GGD6WK6V.js";
 import {
   TURN_CONTEXT_TAG,
   botConfig,
   escapeXml,
   getChatConfig
-} from "./chunk-BU2AWPEN.js";
+} from "./chunk-ZU2ALUVQ.js";
 import {
   parseRequester,
   storedSlackRequesterSchema,
@@ -659,16 +659,28 @@ async function commitMessages(args) {
   };
 }
 
-// src/chat/prompt.ts
-import fs from "fs";
-import path from "path";
-
 // src/chat/interruption-marker.ts
 var INTERRUPTED_MARKER = "\n\n[Response interrupted before completion]";
 function getInterruptionMarker() {
   return INTERRUPTED_MARKER;
 }
 
+// src/chat/prompt.ts
+import fs from "fs";
+import path from "path";
+
+// src/chat/no-reply.ts
+var NO_REPLY_MARKER = "[[NO_REPLY]]";
+function isNoReplyMarker(text) {
+  return text.trim() === NO_REPLY_MARKER;
+}
+function containsNoReplyMarker(text) {
+  return text.includes(NO_REPLY_MARKER);
+}
+function stripNoReplyMarker(text) {
+  return text.replaceAll(NO_REPLY_MARKER, "").trim();
+}
+
 // src/chat/slack/status-format.ts
 var SLACK_STATUS_MAX_LENGTH = 50;
 function truncateStatusText(text) {
@@ -1360,12 +1372,10 @@ var CONVERSATION_RULES = [
   "- Runtime owns continuation and authorization notices; on resumed turns, answer with the final requested content only."
 ];
 var SLACK_ACTION_RULES = [
-  "- Context-bound Slack tools use runtime-owned targets; do not invent channel, canvas, list, or message IDs.",
-  "- Use first-class Slack tools for Slack side effects; do not use bash, curl, or provider APIs to bypass Slack tool targeting.",
-  "- Use channel-post and emoji-reaction tools only when the user explicitly asks for that Slack side effect.",
-  "- For explicit channel-post or emoji-reaction requests, skip a duplicate thread text reply when the tool result already satisfies the request.",
-  "- Do not claim an attachment, canvas, channel post, list update, or reaction succeeded unless the tool returned success this turn; when it did, include any link the tool returned.",
-  "- Do not use reactions as progress indicators."
+  "- Slack tools target the current runtime context; if the requested Slack target differs, explain the limitation instead of calling the tool.",
+  "- Use channel-post and emoji-reaction tools only for explicit user-requested Slack side effects.",
+  "- Ambient reaction requests target the current inbound message; do not ask for a message reference.",
+  `- Side-effect-only completion for channel posts or reactions: call the requested tool first; if it succeeds and fully satisfies the request, final message must be exactly ${NO_REPLY_MARKER}.`
 ];
 var SAFETY_RULES = [
   "- Stay within the user's request and the runtime's available capabilities; do not pursue independent goals, persistence, replication, credential gathering, or access expansion.",
@@ -1416,7 +1426,7 @@ function buildOutputSection(platform) {
     "- Use Slack-flavored Markdown: **bold** section labels, `code`, [text](url) links, bullet lists, and fenced code blocks. No hash-prefixed headings and no tables. When the answer primarily lists several URLs, show each URL bare instead of as a labeled link.",
     "- Keep replies brief and scannable; use bullets or short code blocks when helpful, and one compact thread reply when it fits.",
     "- When a research or document-style answer would benefit from continuation, multiple sections, or future reference value, create a Slack canvas and keep the thread reply to one or two short sentences plus the link; do not recap the canvas contents.",
-    "- Unless a successful Slack side-effect tool intentionally satisfied the request by itself, end every turn with a final user-facing markdown response.",
+    "- End every turn with a final user-facing markdown response unless the Slack action rules allow a side-effect-only completion.",
     "</output>"
   ].join("\n");
 }
@@ -1847,7 +1857,8 @@ async function recordConversationActivityMetadata(args) {
       destination: args.summary.destination,
       nowMs: args.nowMs,
       requester: sessionLogRequester(args.summary.requester),
-      source
+      source,
+      visibility: args.destinationVisibility
     });
     await conversationStore.recordExecution({
       channelName: args.summary.channelName,
@@ -1858,7 +1869,8 @@ async function recordConversationActivityMetadata(args) {
       lastActivityAtMs: args.summary.updatedAtMs,
       requester: sessionLogRequester(args.summary.requester),
       source,
-      updatedAtMs: args.nowMs
+      updatedAtMs: args.nowMs,
+      visibility: args.destinationVisibility
     });
   } catch (error) {
     logWarn(
@@ -1998,6 +2010,7 @@ async function setStoredRecord(args) {
   await appendAgentTurnSessionSummary(summary, args.ttlMs);
   await recordConversationActivityMetadata({
     conversationStore: args.conversationStore,
+    destinationVisibility: args.destinationVisibility,
     nowMs: Date.now(),
     summary
   });
@@ -2054,6 +2067,7 @@ async function upsertAgentTurnSessionRecord(args) {
   });
   return await setStoredRecord({
     conversationStore: args.conversationStore,
+    destinationVisibility: args.destinationVisibility,
     piMessages: args.piMessages,
     ttlMs,
     record: buildStoredRecord({
@@ -2118,6 +2132,7 @@ async function recordAgentTurnSessionSummary(args) {
   await appendAgentTurnSessionSummary(summary, ttlMs);
   await recordConversationActivityMetadata({
     conversationStore: args.conversationStore,
+    destinationVisibility: args.destinationVisibility,
     nowMs,
     summary
   });
@@ -2180,6 +2195,9 @@ async function failAgentTurnSessionRecord(args) {
 }
 
 export {
+  isNoReplyMarker,
+  containsNoReplyMarker,
+  stripNoReplyMarker,
   getInterruptionMarker,
   truncateStatusText,
   normalizeSlackStatusText,