@sentry/junior 0.92.0 → 0.93.0

package/dist/{chunk-7DVIELX3.js → chunk-JJUJ4CO2.js}

@@ -11,7 +11,7 @@ import {
   persistRunningSessionRecord,
   persistTimeoutSessionRecord,
   persistYieldSessionRecord
-} from "./chunk-OJP53WIU.js";
+} from "./chunk-HDNWZMUN.js";
 import {
   JUNIOR_THREAD_STATE_TTL_MS
 } from "./chunk-PFXC67GJ.js";
@@ -23,7 +23,7 @@ import {
   isSnapshotMissingError,
   resolveRuntimeDependencySnapshot,
   runNonInteractiveCommand
-} from "./chunk-H7KUZAMZ.js";
+} from "./chunk-6H4PP63X.js";
 import {
   JUNIOR_PERSONALITY,
   buildPluginSystemPromptContributions,
@@ -33,15 +33,17 @@ import {
   formatSlackLink,
   isNoReplyMarker,
   stripNoReplyMarker
-} from "./chunk-BMQ5DXHV.js";
+} from "./chunk-LE5ANBUZ.js";
 import {
+  instructionActors,
+  instructionProvenanceFor,
   loadConnectedMcpProviders,
   recordAuthorizationRequested,
   recordMcpProviderConnected,
   recordSubagentEnded,
   recordSubagentStarted,
   recordToolExecutionStarted
-} from "./chunk-7FS3K243.js";
+} from "./chunk-QL66APYJ.js";
 import {
   SlackActionError,
   createPluginHookRunner,
@@ -58,10 +60,10 @@ import {
   normalizeSlackConversationId,
   resolveChannelCapabilities,
   withSlackRetries
-} from "./chunk-VY7TVOIK.js";
+} from "./chunk-UUB3D2XI.js";
 import {
   createPluginLogger
-} from "./chunk-OZJXGX4U.js";
+} from "./chunk-TNUUATT7.js";
 import {
   SANDBOX_DATA_ROOT,
   SANDBOX_SKILLS_ROOT,
@@ -72,11 +74,11 @@ import {
 import {
   acquireActiveLock,
   getStateAdapter
-} from "./chunk-ZATRYQLR.js";
+} from "./chunk-7STN2ZSK.js";
 import {
   getConversationStore,
   getDb
-} from "./chunk-NIFONS4W.js";
+} from "./chunk-NFXSLTYG.js";
 import {
   GEN_AI_PROVIDER_NAME,
   GEN_AI_SERVER_ADDRESS,
@@ -101,7 +103,7 @@ import {
   renderCurrentInstruction,
   resolveGatewayModel,
   stripRuntimeTurnContext
-} from "./chunk-3F54A3YM.js";
+} from "./chunk-NAPITCZ6.js";
 import {
   parseSlackThreadId,
   resolveConversationPrivacy,
@@ -451,7 +453,7 @@ var SkillSandbox = class {
 // src/chat/pi/traced-stream.ts
 import {
   streamSimple
-} from "@earendil-works/pi-ai";
+} from "@earendil-works/pi-ai/compat";
 function attributeModeForPrivacy(conversationPrivacy) {
   return conversationPrivacy === "public" ? "content" : "metadata";
 }
@@ -8077,7 +8079,7 @@ function createWebFetchTool(hooks, options = {}) {
 import { z as z35 } from "zod";
 import { generateText } from "ai";
 import { createGatewayProvider } from "@ai-sdk/gateway";
-import { getModel } from "@earendil-works/pi-ai";
+import { getModel } from "@earendil-works/pi-ai/compat";
 var SEARCH_TIMEOUT_MS = 6e4;
 var MAX_RESULTS2 = 5;
 var DEFAULT_SEARCH_MODEL = getModel("vercel-ai-gateway", "openai/gpt-5.4").id;
@@ -8668,280 +8670,10 @@ import { PluginToolInputError } from "@sentry/junior-plugin-api";
 // src/chat/services/plugin-auth-orchestration.ts
 import { THREAD_STATE_TTL_MS as THREAD_STATE_TTL_MS2 } from "chat";
 
-// src/chat/mcp/auth-store.ts
-import {
-  sourceSchema
-} from "@sentry/junior-plugin-api";
-var MCP_AUTH_SESSION_PREFIX = "junior:mcp_auth_session";
-var MCP_AUTH_CREDENTIALS_PREFIX = "junior:mcp_auth_credentials";
-var MCP_AUTH_SESSION_INDEX_PREFIX = "junior:mcp_auth_session_index";
-var MCP_SERVER_SESSION_PREFIX = "junior:mcp_server_session";
-var MCP_AUTH_SESSION_TTL_MS = 24 * 60 * 60 * 1e3;
-var MCP_AUTH_CREDENTIALS_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
-var MCP_SERVER_SESSION_TTL_MS = 24 * 60 * 60 * 1e3;
-function sessionKey(authSessionId) {
-  return `${MCP_AUTH_SESSION_PREFIX}:${authSessionId}`;
-}
-function credentialsKey(userId, provider) {
-  return `${MCP_AUTH_CREDENTIALS_PREFIX}:${userId}:${provider}`;
-}
-function sessionIndexKey(userId, provider) {
-  return `${MCP_AUTH_SESSION_INDEX_PREFIX}:${userId}:${provider}`;
-}
-function serverSessionKey(userId, provider) {
-  return `${MCP_SERVER_SESSION_PREFIX}:${userId}:${provider}`;
-}
-function parseSessionIndex(value) {
-  if (typeof value !== "string") {
-    return [];
-  }
-  try {
-    const parsed = JSON.parse(value);
-    if (!Array.isArray(parsed)) {
-      return [];
-    }
-    return [
-      ...new Set(parsed.filter((id) => typeof id === "string"))
-    ];
-  } catch {
-    return [];
-  }
-}
-function parseMcpAuthSession(value) {
-  if (typeof value !== "string") {
-    return void 0;
-  }
-  try {
-    const parsed = JSON.parse(value);
-    if (!isRecord(parsed)) {
-      return void 0;
-    }
-    if (typeof parsed.authSessionId !== "string" || typeof parsed.provider !== "string" || typeof parsed.userId !== "string" || typeof parsed.conversationId !== "string" || typeof parsed.sessionId !== "string" || typeof parsed.userMessage !== "string" || typeof parsed.createdAtMs !== "number" || typeof parsed.updatedAtMs !== "number") {
-      return void 0;
-    }
-    const destination = parsed.destination === void 0 ? void 0 : parseDestination(parsed.destination);
-    if (parsed.destination !== void 0 && !destination) {
-      return void 0;
-    }
-    const source = parsed.source === void 0 ? void 0 : sourceSchema.safeParse(parsed.source);
-    if (parsed.source !== void 0 && (!source || !source.success)) {
-      return void 0;
-    }
-    return {
-      authSessionId: parsed.authSessionId,
-      provider: parsed.provider,
-      userId: parsed.userId,
-      conversationId: parsed.conversationId,
-      ...destination ? { destination } : {},
-      ...source?.success ? { source: source.data } : {},
-      sessionId: parsed.sessionId,
-      userMessage: parsed.userMessage,
-      createdAtMs: parsed.createdAtMs,
-      updatedAtMs: parsed.updatedAtMs,
-      ...typeof parsed.channelId === "string" ? { channelId: parsed.channelId } : {},
-      ...typeof parsed.threadTs === "string" ? { threadTs: parsed.threadTs } : {},
-      ...typeof parsed.toolChannelId === "string" ? { toolChannelId: parsed.toolChannelId } : {},
-      ...isRecord(parsed.configuration) ? { configuration: parsed.configuration } : {},
-      ...isRecord(parsed.artifactState) ? { artifactState: parsed.artifactState } : {},
-      ...typeof parsed.authorizationUrl === "string" ? { authorizationUrl: parsed.authorizationUrl } : {},
-      ...typeof parsed.codeVerifier === "string" ? { codeVerifier: parsed.codeVerifier } : {}
-    };
-  } catch {
-    return void 0;
-  }
-}
-function parseServerSession(value) {
-  if (typeof value !== "string") {
-    return void 0;
-  }
-  try {
-    const parsed = JSON.parse(value);
-    if (!isRecord(parsed) || typeof parsed.sessionId !== "string" || typeof parsed.updatedAtMs !== "number") {
-      return void 0;
-    }
-    return {
-      sessionId: parsed.sessionId,
-      updatedAtMs: parsed.updatedAtMs
-    };
-  } catch {
-    return void 0;
-  }
-}
-function parseStoredCredentials(value) {
-  if (typeof value !== "string") {
-    return void 0;
-  }
-  try {
-    const parsed = JSON.parse(value);
-    if (!isRecord(parsed)) {
-      return void 0;
-    }
-    return {
-      ...isRecord(parsed.clientInformation) ? {
-        clientInformation: parsed.clientInformation
-      } : {},
-      ...isRecord(parsed.discoveryState) ? {
-        discoveryState: parsed.discoveryState
-      } : {},
-      ...isRecord(parsed.tokens) ? { tokens: parsed.tokens } : {}
-    };
-  } catch {
-    return void 0;
-  }
-}
-async function getConnectedStateAdapter() {
-  const stateAdapter = getStateAdapter();
-  await stateAdapter.connect();
-  return stateAdapter;
-}
-async function getMcpAuthSession(authSessionId) {
-  const stateAdapter = await getConnectedStateAdapter();
-  return parseMcpAuthSession(await stateAdapter.get(sessionKey(authSessionId)));
-}
-async function putMcpAuthSession(session, ttlMs2 = MCP_AUTH_SESSION_TTL_MS) {
-  const stateAdapter = await getConnectedStateAdapter();
-  await stateAdapter.set(
-    sessionKey(session.authSessionId),
-    JSON.stringify(session),
-    ttlMs2
-  );
-  const nextIndex = parseSessionIndex(
-    await stateAdapter.get(sessionIndexKey(session.userId, session.provider))
-  );
-  if (!nextIndex.includes(session.authSessionId)) {
-    nextIndex.push(session.authSessionId);
-  }
-  await stateAdapter.set(
-    sessionIndexKey(session.userId, session.provider),
-    JSON.stringify(nextIndex),
-    ttlMs2
-  );
-}
-async function patchMcpAuthSession(authSessionId, patch) {
-  const current = await getMcpAuthSession(authSessionId);
-  if (!current) {
-    throw new Error(`Unknown MCP auth session: ${authSessionId}`);
-  }
-  const next = {
-    ...current,
-    ...patch,
-    authSessionId: current.authSessionId,
-    provider: current.provider,
-    userId: current.userId,
-    conversationId: current.conversationId,
-    ...current.destination ? { destination: current.destination } : {},
-    sessionId: current.sessionId,
-    userMessage: current.userMessage,
-    createdAtMs: current.createdAtMs,
-    updatedAtMs: Date.now()
-  };
-  await putMcpAuthSession(next);
-  return next;
-}
-async function deleteMcpAuthSession(authSessionId) {
-  const stateAdapter = await getConnectedStateAdapter();
-  const current = parseMcpAuthSession(
-    await stateAdapter.get(sessionKey(authSessionId))
-  );
-  await stateAdapter.delete(sessionKey(authSessionId));
-  if (!current) {
-    return;
-  }
-  const nextIndex = parseSessionIndex(
-    await stateAdapter.get(sessionIndexKey(current.userId, current.provider))
-  ).filter((id) => id !== authSessionId);
-  if (nextIndex.length > 0) {
-    await stateAdapter.set(
-      sessionIndexKey(current.userId, current.provider),
-      JSON.stringify(nextIndex),
-      MCP_AUTH_SESSION_TTL_MS
-    );
-    return;
-  }
-  await stateAdapter.delete(sessionIndexKey(current.userId, current.provider));
-}
-async function deleteMcpAuthSessionsForUserProvider(userId, provider) {
-  const stateAdapter = await getConnectedStateAdapter();
-  const indexKey = sessionIndexKey(userId, provider);
-  const authSessionIds = parseSessionIndex(await stateAdapter.get(indexKey));
-  for (const authSessionId of authSessionIds) {
-    await stateAdapter.delete(sessionKey(authSessionId));
-  }
-  await stateAdapter.delete(indexKey);
-}
-async function getLatestMcpAuthSessionForUserProvider(userId, provider) {
-  const stateAdapter = await getConnectedStateAdapter();
-  const authSessionIds = parseSessionIndex(
-    await stateAdapter.get(sessionIndexKey(userId, provider))
-  );
-  let latestSession;
-  for (const authSessionId of authSessionIds) {
-    const session = parseMcpAuthSession(
-      await stateAdapter.get(sessionKey(authSessionId))
-    );
-    if (!session) {
-      continue;
-    }
-    if (!latestSession || session.updatedAtMs > latestSession.updatedAtMs) {
-      latestSession = session;
-    }
-  }
-  return latestSession;
-}
-async function getMcpStoredOAuthCredentials(userId, provider) {
-  const stateAdapter = await getConnectedStateAdapter();
-  return parseStoredCredentials(
-    await stateAdapter.get(credentialsKey(userId, provider))
-  );
-}
-async function putMcpStoredOAuthCredentials(userId, provider, value, ttlMs2 = MCP_AUTH_CREDENTIALS_TTL_MS) {
-  const stateAdapter = await getConnectedStateAdapter();
-  await stateAdapter.set(
-    credentialsKey(userId, provider),
-    JSON.stringify(value),
-    ttlMs2
-  );
-}
-async function deleteMcpStoredOAuthCredentials(userId, provider) {
-  const stateAdapter = await getConnectedStateAdapter();
-  await stateAdapter.delete(credentialsKey(userId, provider));
-}
-async function getMcpServerSessionId(userId, provider) {
-  const stateAdapter = await getConnectedStateAdapter();
-  return parseServerSession(
-    await stateAdapter.get(serverSessionKey(userId, provider))
-  )?.sessionId;
-}
-async function putMcpServerSessionId(userId, provider, sessionId, ttlMs2 = MCP_SERVER_SESSION_TTL_MS) {
-  const stateAdapter = await getConnectedStateAdapter();
-  await stateAdapter.set(
-    serverSessionKey(userId, provider),
-    JSON.stringify({
-      sessionId,
-      updatedAtMs: Date.now()
-    }),
-    ttlMs2
-  );
-}
-async function deleteMcpServerSessionId(userId, provider) {
-  const stateAdapter = await getConnectedStateAdapter();
-  await stateAdapter.delete(serverSessionKey(userId, provider));
-}
-
-// src/chat/credentials/unlink-provider.ts
-async function unlinkProvider(userId, provider, userTokenStore) {
-  await Promise.all([
-    userTokenStore.delete(userId, provider),
-    deleteMcpStoredOAuthCredentials(userId, provider),
-    deleteMcpServerSessionId(userId, provider),
-    deleteMcpAuthSessionsForUserProvider(userId, provider)
-  ]);
-}
-
 // src/chat/oauth-flow.ts
 import { randomBytes } from "crypto";
 import {
-  sourceSchema as sourceSchema2
+  sourceSchema
 } from "@sentry/junior-plugin-api";
 
 // src/chat/oauth-authorization-message.ts
@@ -8965,7 +8697,7 @@ function parseOAuthStatePayload(value) {
   if (value.destination !== void 0 && !destination) {
     return void 0;
   }
-  const source = value.source === void 0 ? void 0 : sourceSchema2.safeParse(value.source);
+  const source = value.source === void 0 ? void 0 : sourceSchema.safeParse(value.source);
   if (value.source !== void 0 && (!source || !source.success)) {
     return void 0;
   }
@@ -9306,9 +9038,6 @@ function createPluginAuthOrchestration(input) {
         );
       }
     }
-    if (options?.unlinkExistingProvider && input.actorId && input.userTokenStore) {
-      await unlinkProvider(input.actorId, provider, input.userTokenStore);
-    }
     if (input.sessionId && recordPendingAuth) {
       await recordPendingAuth({
         kind: "plugin",
@@ -9376,10 +9105,10 @@ function createPluginAuthOrchestration(input) {
           signal.message ?? `${formatProviderLabel(provider)} credentials are required but the provider is not configured for OAuth.`
         );
       }
-      await startAuthorizationPause(authorization.provider, {
-        ...authorization.scope ? { scope: authorization.scope } : {},
-        unlinkExistingProvider: true
-      });
+      await startAuthorizationPause(
+        authorization.provider,
+        authorization.scope ? { scope: authorization.scope } : void 0
+      );
     },
     getPendingPause: () => pendingPause
   };
@@ -11704,132 +11433,392 @@ function createSandboxExecutor(options) {
     );
     return { result };
   };
-  const executeFindFilesTool = async (rawInput) => {
-    const pattern = String(rawInput.pattern ?? "");
-    if (!pattern) {
-      throw new ToolInputError("pattern is required");
-    }
-    logSandboxBootRequest("tool.findFiles");
-    const limit = positiveInteger(rawInput.limit);
-    const executors = await sessionManager.ensureToolExecutors();
-    const result = await withSandboxToolSpan(
-      "sandbox.findFiles",
-      "sandbox.fs.find",
-      {
-        "app.sandbox.pattern.length": pattern.length
-      },
-      async () => {
-        const response = await findFiles({
-          fs: executors.fs,
-          pattern,
-          ...typeof rawInput.path === "string" ? { path: rawInput.path } : {},
-          ...limit ? { limit } : {}
-        });
-        setSpanStatus("ok");
-        return response;
-      }
+  const executeFindFilesTool = async (rawInput) => {
+    const pattern = String(rawInput.pattern ?? "");
+    if (!pattern) {
+      throw new ToolInputError("pattern is required");
+    }
+    logSandboxBootRequest("tool.findFiles");
+    const limit = positiveInteger(rawInput.limit);
+    const executors = await sessionManager.ensureToolExecutors();
+    const result = await withSandboxToolSpan(
+      "sandbox.findFiles",
+      "sandbox.fs.find",
+      {
+        "app.sandbox.pattern.length": pattern.length
+      },
+      async () => {
+        const response = await findFiles({
+          fs: executors.fs,
+          pattern,
+          ...typeof rawInput.path === "string" ? { path: rawInput.path } : {},
+          ...limit ? { limit } : {}
+        });
+        setSpanStatus("ok");
+        return response;
+      }
+    );
+    return { result };
+  };
+  const executeListDirTool = async (rawInput) => {
+    logSandboxBootRequest("tool.listDir");
+    const limit = positiveInteger(rawInput.limit);
+    const executors = await sessionManager.ensureToolExecutors();
+    const result = await withSandboxToolSpan(
+      "sandbox.listDir",
+      "sandbox.fs.list",
+      {},
+      async () => {
+        const response = await listDir({
+          fs: executors.fs,
+          ...typeof rawInput.path === "string" ? { path: rawInput.path } : {},
+          ...limit ? { limit } : {}
+        });
+        setSpanStatus("ok");
+        return response;
+      }
+    );
+    return { result };
+  };
+  const execute = async (params) => {
+    const rawInput = params.input ?? {};
+    const bashCommand = params.toolName === "bash" ? String(rawInput.command ?? "").trim() : void 0;
+    if (params.toolName === "bash") {
+      if (!bashCommand) {
+        throw new ToolInputError("command is required");
+      }
+      if (options?.runBashCustomCommand) {
+        const custom = await options.runBashCustomCommand(bashCommand);
+        if (custom.handled) {
+          if (!custom.result) {
+            throw new Error("Custom bash command handler returned no result.");
+          }
+          return { result: bashToolResult(custom.result) };
+        }
+      }
+      return await executeBashTool(rawInput, bashCommand, params.signal);
+    }
+    try {
+      if (params.toolName === "readFile") {
+        return await executeReadFileTool(rawInput);
+      }
+      if (params.toolName === "editFile") {
+        return await executeEditFileTool(rawInput);
+      }
+      if (params.toolName === "grep") {
+        return await executeGrepTool(rawInput);
+      }
+      if (params.toolName === "findFiles") {
+        return await executeFindFilesTool(rawInput);
+      }
+      if (params.toolName === "listDir") {
+        return await executeListDirTool(rawInput);
+      }
+      if (params.toolName === "writeFile") {
+        return await executeWriteFileTool(rawInput);
+      }
+    } catch (error) {
+      if (!isSandboxCommandStreamInterruptedError(error)) {
+        throw error;
+      }
+      return { result: sandboxStreamInterruptedResult(params.toolName) };
+    }
+    throw new Error(`unsupported sandbox tool: ${params.toolName}`);
+  };
+  return {
+    configureSkills(skills) {
+      availableSkills = [...skills];
+      sessionManager.configureSkills(skills);
+    },
+    configureReferenceFiles(files) {
+      referenceFiles = [...files];
+      sessionManager.configureReferenceFiles(files);
+    },
+    getSandboxId() {
+      return sessionManager.getSandboxId();
+    },
+    getDependencyProfileHash() {
+      return sessionManager.getDependencyProfileHash();
+    },
+    canExecute(toolName) {
+      return SANDBOX_TOOL_NAMES.has(toolName);
+    },
+    async createSandbox() {
+      return await sessionManager.createSandbox();
+    },
+    execute,
+    async dispose() {
+      await sessionManager.dispose();
+    }
+  };
+}
+
+// src/chat/services/mcp-auth-orchestration.ts
+import { THREAD_STATE_TTL_MS as THREAD_STATE_TTL_MS3 } from "chat";
+
+// src/chat/mcp/oauth.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { StreamableHTTPClientTransport as StreamableHTTPClientTransport2 } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+
+// src/chat/mcp/auth-store.ts
+import {
+  sourceSchema as sourceSchema2
+} from "@sentry/junior-plugin-api";
+var MCP_AUTH_SESSION_PREFIX = "junior:mcp_auth_session";
+var MCP_AUTH_CREDENTIALS_PREFIX = "junior:mcp_auth_credentials";
+var MCP_AUTH_SESSION_INDEX_PREFIX = "junior:mcp_auth_session_index";
+var MCP_SERVER_SESSION_PREFIX = "junior:mcp_server_session";
+var MCP_AUTH_SESSION_TTL_MS = 24 * 60 * 60 * 1e3;
+var MCP_AUTH_CREDENTIALS_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+var MCP_SERVER_SESSION_TTL_MS = 24 * 60 * 60 * 1e3;
+function sessionKey(authSessionId) {
+  return `${MCP_AUTH_SESSION_PREFIX}:${authSessionId}`;
+}
+function credentialsKey(userId, provider) {
+  return `${MCP_AUTH_CREDENTIALS_PREFIX}:${userId}:${provider}`;
+}
+function sessionIndexKey(userId, provider) {
+  return `${MCP_AUTH_SESSION_INDEX_PREFIX}:${userId}:${provider}`;
+}
+function serverSessionKey(userId, provider) {
+  return `${MCP_SERVER_SESSION_PREFIX}:${userId}:${provider}`;
+}
+function parseSessionIndex(value) {
+  if (typeof value !== "string") {
+    return [];
+  }
+  try {
+    const parsed = JSON.parse(value);
+    if (!Array.isArray(parsed)) {
+      return [];
+    }
+    return [
+      ...new Set(parsed.filter((id) => typeof id === "string"))
+    ];
+  } catch {
+    return [];
+  }
+}
+function parseMcpAuthSession(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  try {
+    const parsed = JSON.parse(value);
+    if (!isRecord(parsed)) {
+      return void 0;
+    }
+    if (typeof parsed.authSessionId !== "string" || typeof parsed.provider !== "string" || typeof parsed.userId !== "string" || typeof parsed.conversationId !== "string" || typeof parsed.sessionId !== "string" || typeof parsed.userMessage !== "string" || typeof parsed.createdAtMs !== "number" || typeof parsed.updatedAtMs !== "number") {
+      return void 0;
+    }
+    const destination = parsed.destination === void 0 ? void 0 : parseDestination(parsed.destination);
+    if (parsed.destination !== void 0 && !destination) {
+      return void 0;
+    }
+    const source = parsed.source === void 0 ? void 0 : sourceSchema2.safeParse(parsed.source);
+    if (parsed.source !== void 0 && (!source || !source.success)) {
+      return void 0;
+    }
+    return {
+      authSessionId: parsed.authSessionId,
+      provider: parsed.provider,
+      userId: parsed.userId,
+      conversationId: parsed.conversationId,
+      ...destination ? { destination } : {},
+      ...source?.success ? { source: source.data } : {},
+      sessionId: parsed.sessionId,
+      userMessage: parsed.userMessage,
+      createdAtMs: parsed.createdAtMs,
+      updatedAtMs: parsed.updatedAtMs,
+      ...typeof parsed.channelId === "string" ? { channelId: parsed.channelId } : {},
+      ...typeof parsed.threadTs === "string" ? { threadTs: parsed.threadTs } : {},
+      ...typeof parsed.toolChannelId === "string" ? { toolChannelId: parsed.toolChannelId } : {},
+      ...isRecord(parsed.configuration) ? { configuration: parsed.configuration } : {},
+      ...isRecord(parsed.artifactState) ? { artifactState: parsed.artifactState } : {},
+      ...typeof parsed.authorizationUrl === "string" ? { authorizationUrl: parsed.authorizationUrl } : {},
+      ...typeof parsed.codeVerifier === "string" ? { codeVerifier: parsed.codeVerifier } : {}
+    };
+  } catch {
+    return void 0;
+  }
+}
+function parseServerSession(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  try {
+    const parsed = JSON.parse(value);
+    if (!isRecord(parsed) || typeof parsed.sessionId !== "string" || typeof parsed.updatedAtMs !== "number") {
+      return void 0;
+    }
+    return {
+      sessionId: parsed.sessionId,
+      updatedAtMs: parsed.updatedAtMs
+    };
+  } catch {
+    return void 0;
+  }
+}
+function parseStoredCredentials(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  try {
+    const parsed = JSON.parse(value);
+    if (!isRecord(parsed)) {
+      return void 0;
+    }
+    return {
+      ...isRecord(parsed.clientInformation) ? {
+        clientInformation: parsed.clientInformation
+      } : {},
+      ...isRecord(parsed.discoveryState) ? {
+        discoveryState: parsed.discoveryState
+      } : {},
+      ...isRecord(parsed.tokens) ? { tokens: parsed.tokens } : {}
+    };
+  } catch {
+    return void 0;
+  }
+}
+async function getConnectedStateAdapter() {
+  const stateAdapter = getStateAdapter();
+  await stateAdapter.connect();
+  return stateAdapter;
+}
+async function getMcpAuthSession(authSessionId) {
+  const stateAdapter = await getConnectedStateAdapter();
+  return parseMcpAuthSession(await stateAdapter.get(sessionKey(authSessionId)));
+}
+async function putMcpAuthSession(session, ttlMs2 = MCP_AUTH_SESSION_TTL_MS) {
+  const stateAdapter = await getConnectedStateAdapter();
+  await stateAdapter.set(
+    sessionKey(session.authSessionId),
+    JSON.stringify(session),
+    ttlMs2
+  );
+  const nextIndex = parseSessionIndex(
+    await stateAdapter.get(sessionIndexKey(session.userId, session.provider))
+  );
+  if (!nextIndex.includes(session.authSessionId)) {
+    nextIndex.push(session.authSessionId);
+  }
+  await stateAdapter.set(
+    sessionIndexKey(session.userId, session.provider),
+    JSON.stringify(nextIndex),
+    ttlMs2
+  );
+}
+async function patchMcpAuthSession(authSessionId, patch) {
+  const current = await getMcpAuthSession(authSessionId);
+  if (!current) {
+    throw new Error(`Unknown MCP auth session: ${authSessionId}`);
+  }
+  const next = {
+    ...current,
+    ...patch,
+    authSessionId: current.authSessionId,
+    provider: current.provider,
+    userId: current.userId,
+    conversationId: current.conversationId,
+    ...current.destination ? { destination: current.destination } : {},
+    sessionId: current.sessionId,
+    userMessage: current.userMessage,
+    createdAtMs: current.createdAtMs,
+    updatedAtMs: Date.now()
+  };
+  await putMcpAuthSession(next);
+  return next;
+}
+async function deleteMcpAuthSession(authSessionId) {
+  const stateAdapter = await getConnectedStateAdapter();
+  const current = parseMcpAuthSession(
+    await stateAdapter.get(sessionKey(authSessionId))
+  );
+  await stateAdapter.delete(sessionKey(authSessionId));
+  if (!current) {
+    return;
+  }
+  const nextIndex = parseSessionIndex(
+    await stateAdapter.get(sessionIndexKey(current.userId, current.provider))
+  ).filter((id) => id !== authSessionId);
+  if (nextIndex.length > 0) {
+    await stateAdapter.set(
+      sessionIndexKey(current.userId, current.provider),
+      JSON.stringify(nextIndex),
+      MCP_AUTH_SESSION_TTL_MS
     );
-    return { result };
-  };
-  const executeListDirTool = async (rawInput) => {
-    logSandboxBootRequest("tool.listDir");
-    const limit = positiveInteger(rawInput.limit);
-    const executors = await sessionManager.ensureToolExecutors();
-    const result = await withSandboxToolSpan(
-      "sandbox.listDir",
-      "sandbox.fs.list",
-      {},
-      async () => {
-        const response = await listDir({
-          fs: executors.fs,
-          ...typeof rawInput.path === "string" ? { path: rawInput.path } : {},
-          ...limit ? { limit } : {}
-        });
-        setSpanStatus("ok");
-        return response;
-      }
+    return;
+  }
+  await stateAdapter.delete(sessionIndexKey(current.userId, current.provider));
+}
+async function deleteMcpAuthSessionsForUserProvider(userId, provider) {
+  const stateAdapter = await getConnectedStateAdapter();
+  const indexKey = sessionIndexKey(userId, provider);
+  const authSessionIds = parseSessionIndex(await stateAdapter.get(indexKey));
+  for (const authSessionId of authSessionIds) {
+    await stateAdapter.delete(sessionKey(authSessionId));
+  }
+  await stateAdapter.delete(indexKey);
+}
+async function getLatestMcpAuthSessionForUserProvider(userId, provider) {
+  const stateAdapter = await getConnectedStateAdapter();
+  const authSessionIds = parseSessionIndex(
+    await stateAdapter.get(sessionIndexKey(userId, provider))
+  );
+  let latestSession;
+  for (const authSessionId of authSessionIds) {
+    const session = parseMcpAuthSession(
+      await stateAdapter.get(sessionKey(authSessionId))
     );
-    return { result };
-  };
-  const execute = async (params) => {
-    const rawInput = params.input ?? {};
-    const bashCommand = params.toolName === "bash" ? String(rawInput.command ?? "").trim() : void 0;
-    if (params.toolName === "bash") {
-      if (!bashCommand) {
-        throw new ToolInputError("command is required");
-      }
-      if (options?.runBashCustomCommand) {
-        const custom = await options.runBashCustomCommand(bashCommand);
-        if (custom.handled) {
-          if (!custom.result) {
-            throw new Error("Custom bash command handler returned no result.");
-          }
-          return { result: bashToolResult(custom.result) };
-        }
-      }
-      return await executeBashTool(rawInput, bashCommand, params.signal);
-    }
-    try {
-      if (params.toolName === "readFile") {
-        return await executeReadFileTool(rawInput);
-      }
-      if (params.toolName === "editFile") {
-        return await executeEditFileTool(rawInput);
-      }
-      if (params.toolName === "grep") {
-        return await executeGrepTool(rawInput);
-      }
-      if (params.toolName === "findFiles") {
-        return await executeFindFilesTool(rawInput);
-      }
-      if (params.toolName === "listDir") {
-        return await executeListDirTool(rawInput);
-      }
-      if (params.toolName === "writeFile") {
-        return await executeWriteFileTool(rawInput);
-      }
-    } catch (error) {
-      if (!isSandboxCommandStreamInterruptedError(error)) {
-        throw error;
-      }
-      return { result: sandboxStreamInterruptedResult(params.toolName) };
+    if (!session) {
+      continue;
     }
-    throw new Error(`unsupported sandbox tool: ${params.toolName}`);
-  };
-  return {
-    configureSkills(skills) {
-      availableSkills = [...skills];
-      sessionManager.configureSkills(skills);
-    },
-    configureReferenceFiles(files) {
-      referenceFiles = [...files];
-      sessionManager.configureReferenceFiles(files);
-    },
-    getSandboxId() {
-      return sessionManager.getSandboxId();
-    },
-    getDependencyProfileHash() {
-      return sessionManager.getDependencyProfileHash();
-    },
-    canExecute(toolName) {
-      return SANDBOX_TOOL_NAMES.has(toolName);
-    },
-    async createSandbox() {
-      return await sessionManager.createSandbox();
-    },
-    execute,
-    async dispose() {
-      await sessionManager.dispose();
+    if (!latestSession || session.updatedAtMs > latestSession.updatedAtMs) {
+      latestSession = session;
     }
-  };
+  }
+  return latestSession;
+}
+async function getMcpStoredOAuthCredentials(userId, provider) {
+  const stateAdapter = await getConnectedStateAdapter();
+  return parseStoredCredentials(
+    await stateAdapter.get(credentialsKey(userId, provider))
+  );
+}
+async function putMcpStoredOAuthCredentials(userId, provider, value, ttlMs2 = MCP_AUTH_CREDENTIALS_TTL_MS) {
+  const stateAdapter = await getConnectedStateAdapter();
+  await stateAdapter.set(
+    credentialsKey(userId, provider),
+    JSON.stringify(value),
+    ttlMs2
+  );
+}
+async function deleteMcpStoredOAuthCredentials(userId, provider) {
+  const stateAdapter = await getConnectedStateAdapter();
+  await stateAdapter.delete(credentialsKey(userId, provider));
+}
+async function getMcpServerSessionId(userId, provider) {
+  const stateAdapter = await getConnectedStateAdapter();
+  return parseServerSession(
+    await stateAdapter.get(serverSessionKey(userId, provider))
+  )?.sessionId;
+}
+async function putMcpServerSessionId(userId, provider, sessionId, ttlMs2 = MCP_SERVER_SESSION_TTL_MS) {
+  const stateAdapter = await getConnectedStateAdapter();
+  await stateAdapter.set(
+    serverSessionKey(userId, provider),
+    JSON.stringify({
+      sessionId,
+      updatedAtMs: Date.now()
+    }),
+    ttlMs2
+  );
+}
+async function deleteMcpServerSessionId(userId, provider) {
+  const stateAdapter = await getConnectedStateAdapter();
+  await stateAdapter.delete(serverSessionKey(userId, provider));
 }
-
-// src/chat/services/mcp-auth-orchestration.ts
-import { THREAD_STATE_TTL_MS as THREAD_STATE_TTL_MS3 } from "chat";
-
-// src/chat/mcp/oauth.ts
-import { randomUUID as randomUUID3 } from "crypto";
-import { StreamableHTTPClientTransport as StreamableHTTPClientTransport2 } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 
 // src/chat/mcp/oauth-provider.ts
 function createClientMetadata(callbackUrl) {
@@ -13358,7 +13347,8 @@ async function wireAgentTools(args) {
   const authActorId = args.routing.credentialContext && "type" in args.routing.credentialContext.actor ? args.routing.credentialContext.actor.userId : void 0;
   const userTokenStore = createUserTokenStore();
   const pluginHooks = createPluginHookRunner({
-    actor: args.currentActor
+    actor: args.currentActor,
+    actors: args.currentActors
   });
   const sandboxExecutor = createSandboxExecutor({
     sandboxId: args.state.sandbox?.sandboxId,
@@ -14002,6 +13992,11 @@ async function executeAgentRunInPrivacyContext(request, conversationPrivacy) {
       currentSliceId,
       existingSessionRecord
     } = await restoreSessionRecord(routing);
+    const committedInstructionProvenance = existingSessionRecord?.piMessageProvenance ? [
+      ...existingSessionRecord.piMessageProvenance,
+      ...resumedFromSessionRecord ? [] : [instructionProvenanceFor(actor)]
+    ] : [instructionProvenanceFor(actor)];
+    const runActors = () => instructionActors(committedInstructionProvenance);
     canRecordMcpProviders = Boolean(
       sessionRecordState.canUseTurnSession && sessionConversationId && sessionId
     );
@@ -14107,6 +14102,7 @@ async function executeAgentRunInPrivacyContext(request, conversationPrivacy) {
       abortAgent: () => agent?.abort(),
       activeSkills,
       currentActor: actor,
+      currentActors: runActors,
       artifactStatePatch,
       availableSkills,
       configurationValues,
@@ -14181,6 +14177,9 @@ async function executeAgentRunInPrivacyContext(request, conversationPrivacy) {
             [...agent.state.messages, ...piMessages],
             messages.map((message) => message.provenance)
           );
+          committedInstructionProvenance.push(
+            ...messages.map((message) => message.provenance)
+          );
           for (const message of piMessages) {
             agent.steer(message);
           }
@@ -14583,9 +14582,6 @@ export {
   removeReactionFromMessage,
   renderSlackLegacyAttachmentText,
   appendSlackLegacyAttachmentText,
-  deleteMcpAuthSession,
-  getMcpStoredOAuthCredentials,
-  unlinkProvider,
   parseOAuthStatePayload,
   formatProviderLabel,
   resolveBaseUrl,
@@ -14596,6 +14592,11 @@ export {
   normalizeSandboxEgressTracePropagationDomains,
   shouldPropagateSandboxEgressTrace,
   resolveSandboxEgressProviderForHost,
+  deleteMcpAuthSession,
+  deleteMcpAuthSessionsForUserProvider,
+  getMcpStoredOAuthCredentials,
+  deleteMcpStoredOAuthCredentials,
+  deleteMcpServerSessionId,
   finalizeMcpAuthorization,
   resolvePluginOAuthAccount,
   executeCredentialedEgressRequest,