@sentry/junior 0.93.0 → 0.94.0

package/dist/app.js

@@ -106,7 +106,7 @@ import {
   shouldEmitDevAgentTrace,
   shouldPropagateSandboxEgressTrace,
   startOAuthFlow
-} from "./chunk-JJUJ4CO2.js";
+} from "./chunk-KRMANDHI.js";
 import {
   CooperativeTurnYieldError,
   TurnInputCommitLostError,
@@ -3916,24 +3916,28 @@ async function resumeSlackTurn(args) {
     }
     const activeReplyContext = runArgs.replyContext;
     if (!activeReplyContext) {
-      throw new Error(
-        "Resumed turn requires replyContext.routing.actor.userId"
-      );
-    }
-    const resumeActor = activeReplyContext.routing.actor;
-    if (!isUserActor(resumeActor)) {
-      throw new Error(
-        "Resumed turn requires replyContext.routing.actor.userId"
-      );
+      throw new Error("Resumed turn requires replyContext");
     }
     const credentialContext = activeReplyContext.routing.credentialContext;
     if (!credentialContext) {
       throw new Error("Resumed turn requires replyContext.credentialContext");
     }
-    if (!("type" in credentialContext.actor) || credentialContext.actor.userId !== resumeActor.userId) {
-      throw new Error(
-        "Resumed turn credential actor must match replyContext.routing.actor.userId"
-      );
+    const routingActor = activeReplyContext.routing.actor;
+    let resumeActor;
+    if ("type" in credentialContext.actor) {
+      if (!isUserActor(routingActor) || credentialContext.actor.userId !== routingActor.userId) {
+        throw new Error(
+          "Resumed turn credential actor must match replyContext.routing.actor.userId"
+        );
+      }
+      resumeActor = routingActor;
+    } else {
+      if (routingActor && (routingActor.platform !== "system" || routingActor.name !== credentialContext.actor.name)) {
+        throw new Error(
+          "Resumed turn system credential actor must match replyContext.routing.actor"
+        );
+      }
+      resumeActor = credentialContext.actor;
     }
     if (runArgs.messageTs) {
       processingReaction = await startSlackProcessingReactionForMessage({
@@ -3975,7 +3979,7 @@ async function resumeSlackTurn(args) {
         deferredPauseKind = "auth";
         deferredAuthInfo = {
           providerDisplayName: outcome.providerDisplayName,
-          actorId: resumeActor.userId
+          actorId: isUserActor(resumeActor) ? resumeActor.userId : void 0
         };
         deferredPauseHandler = async () => {
           await onAuthPause({
@@ -4027,7 +4031,7 @@ async function resumeSlackTurn(args) {
           currentUsage: reply.diagnostics.usage,
           destination: replyContext.routing.destination,
           source: replyContext.routing.source,
-          actor: replyContext.routing.actor,
+          actor: resumeActor,
           surface: "slack",
           logContext: {
             threadId: replyContext.routing.correlation.threadId,
@@ -9836,7 +9840,7 @@ function createReplyToThread(deps) {
             startedAtMs: turnStartedAtMs,
             state: "running",
             surface: "slack",
-            actor,
+            actor: executionActor,
             destination,
             destinationVisibility,
             source,
@@ -11162,19 +11166,32 @@ async function continueSlackAgentRun(payload, options) {
           payload.destination,
           "Slack continuation"
         );
-        const actor = await resolveContinuationActor({
-          conversationId: payload.conversationId,
-          sessionRecordActor: activeSessionRecord.actor,
-          teamId: destination.teamId,
-          userId: userMessage2.author.userId
-        });
-        if (!actor) {
-          await failStrandedSessionWithFallback({
+        const systemActor = activeSessionRecord.actor?.platform === "system" ? activeSessionRecord.actor : void 0;
+        let actor;
+        let credentialContext;
+        if (systemActor) {
+          credentialContext = { actor: systemActor };
+        } else {
+          actor = await resolveContinuationActor({
             conversationId: payload.conversationId,
-            errorMessage: "Stored Slack actor missing for continuation",
-            sessionRecord: activeSessionRecord
+            sessionRecordActor: activeSessionRecord.actor,
+            teamId: destination.teamId,
+            userId: userMessage2.author.userId
           });
-          return false;
+          if (!actor) {
+            await failStrandedSessionWithFallback({
+              conversationId: payload.conversationId,
+              errorMessage: "Stored Slack actor missing for continuation",
+              sessionRecord: activeSessionRecord
+            });
+            return false;
+          }
+          credentialContext = {
+            actor: {
+              type: "user",
+              userId: actor.userId
+            }
+          };
         }
         if (!activeSessionRecord.source) {
           await failAgentTurnSessionRecord({
@@ -11195,13 +11212,8 @@ async function continueSlackAgentRun(payload, options) {
               ...getTurnUserReplyAttachmentContext(userMessage2)
             },
             routing: {
-              credentialContext: {
-                actor: {
-                  type: "user",
-                  userId: actor.userId
-                }
-              },
-              actor,
+              credentialContext,
+              ...actor ? { actor } : {},
               destination: payload.destination,
               source: activeSessionRecord.source,
               correlation: {
@@ -11209,7 +11221,7 @@ async function continueSlackAgentRun(payload, options) {
                 turnId: payload.sessionId,
                 channelId: thread.channelId,
                 threadTs: thread.threadTs,
-                actorId: actor.userId
+                ...actor ? { actorId: actor.userId } : {}
               },
               toolChannelId: artifacts.assistantContextChannelId ?? thread.channelId
             },

package/dist/chat/egress/credentialed.d.ts

@@ -15,7 +15,7 @@ export type CredentialedEgressHttpInterceptor = (input: {
 }) => Promise<Response | undefined>;
 /** Runtime dependencies for the credentialed provider forwarding step. */
 export interface CredentialedEgressDeps {
-    clearCredentialLease?: (provider: string, grantName: string, credentialContext: SandboxEgressCredentialContext) => Promise<void>;
+    clearCredentialLease?: (provider: string, grant: SandboxEgressCredentialLease["grant"], credentialContext: SandboxEgressCredentialContext) => Promise<void>;
     fetch?: typeof fetch;
     issueCredentialLease?: (provider: string, selection: SandboxEgressGrantSelection, credentialContext: SandboxEgressCredentialContext) => Promise<SandboxEgressCredentialLease>;
     interceptHttp?: CredentialedEgressHttpInterceptor;

package/dist/chat/sandbox/egress/schemas.d.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 export declare const sandboxEgressGrantSchema: z.ZodObject<{
     access: z.ZodUnion<readonly [z.ZodLiteral<"read">, z.ZodLiteral<"write">]>;
+    leaseScope: z.ZodOptional<z.ZodString>;
     name: z.ZodString;
     reason: z.ZodOptional<z.ZodString>;
     requirements: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -45,6 +46,7 @@ export declare const sandboxEgressCredentialLeaseSchema: z.ZodObject<{
     }, z.core.$strict>>;
     grant: z.ZodObject<{
         access: z.ZodUnion<readonly [z.ZodLiteral<"read">, z.ZodLiteral<"write">]>;
+        leaseScope: z.ZodOptional<z.ZodString>;
         name: z.ZodString;
         reason: z.ZodOptional<z.ZodString>;
         requirements: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -64,6 +66,7 @@ export declare const sandboxEgressAuthRequiredSignalSchema: z.ZodObject<{
     }, z.core.$strict>>;
     grant: z.ZodObject<{
         access: z.ZodUnion<readonly [z.ZodLiteral<"read">, z.ZodLiteral<"write">]>;
+        leaseScope: z.ZodOptional<z.ZodString>;
         name: z.ZodString;
         reason: z.ZodOptional<z.ZodString>;
         requirements: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -85,6 +88,7 @@ export declare const sandboxEgressPermissionDeniedSignalSchema: z.ZodObject<{
     acceptedPermissions: z.ZodOptional<z.ZodString>;
     grant: z.ZodObject<{
         access: z.ZodUnion<readonly [z.ZodLiteral<"read">, z.ZodLiteral<"write">]>;
+        leaseScope: z.ZodOptional<z.ZodString>;
         name: z.ZodString;
         reason: z.ZodOptional<z.ZodString>;
         requirements: z.ZodOptional<z.ZodArray<z.ZodString>>;

package/dist/chat/sandbox/egress/session.d.ts

@@ -31,9 +31,9 @@ export declare function setSandboxEgressCredentialLease(context: SandboxEgressCr
 /**
  * Load cached credential header transforms for the exact actor/context/grant.
  */
-export declare function getSandboxEgressCredentialLease(provider: string, grantName: string, context: SandboxEgressCredentialContext): Promise<SandboxEgressCredentialLease | undefined>;
+export declare function getSandboxEgressCredentialLease(provider: string, grant: SandboxEgressCredentialLease["grant"], context: SandboxEgressCredentialContext): Promise<SandboxEgressCredentialLease | undefined>;
 /** Clear a cached lease after the upstream provider rejects its auth headers. */
-export declare function clearSandboxEgressCredentialLease(provider: string, grantName: string, context: SandboxEgressCredentialContext): Promise<void>;
+export declare function clearSandboxEgressCredentialLease(provider: string, grant: SandboxEgressCredentialLease["grant"], context: SandboxEgressCredentialContext): Promise<void>;
 /**
  * Record that credential issuance needs user authorization for this command.
  *

package/dist/{chunk-JJUJ4CO2.js → chunk-KRMANDHI.js}

@@ -7327,7 +7327,7 @@ function createStateAdvisorSessionStore() {
 
 // src/chat/tools/advisor/tool.ts
 import { z as z33 } from "zod";
-var ADVISOR_TOOL_DESCRIPTION = "Second-opinion advisor for hard technical work. Call when you reach a consequential workflow moment: after enough exploration to frame a non-obvious plan; before a non-trivial code change or broad refactor; after repeated failures or when requirements or next steps feel ambiguous or risky; and when verifying a complex change before declaring it done, opening a PR, or reporting results. Ask a focused question and pass curated context: exact evidence, constraints, relevant code snippets, command output, diffs, current plan, and alternatives considered. The advisor has its own history, does not automatically receive the parent transcript, and may use read-only tools to verify. Follow up only with new evidence or changed constraints. Do not use for greetings, simple deterministic edits, routine formatting, or when fresh output makes the next action obvious.";
+var ADVISOR_TOOL_DESCRIPTION = "High-reasoning technical advisor for planning and reviewing non-trivial work. Use it at two high-leverage checkpoints: (1) after enough investigation to understand the problem, but before implementation, to challenge the proposed approach, architecture, risks, alternatives, and verification plan; and (2) after implementation and initial validation, but before finalizing, committing, opening a PR, or reporting completion, to review the diff and results for correctness, regressions, omissions, and insufficient testing. Also consult it when requirements remain ambiguous, risk is unusually high, or repeated attempts have failed. Ask a focused question and provide self-contained, curated context such as requirements, exact evidence, constraints, relevant code, command output, proposed plan, alternatives considered, diff, and validation results. The advisor does not automatically receive the parent transcript and may use read-only tools to verify supplied context. For follow-ups, include new evidence, changes made, or the specific unresolved concern. Do not use it for greetings, routine formatting, simple deterministic edits, or as a substitute for direct investigation and validation.";
 var ADVISOR_SYSTEM_PROMPT = [
   "You are a senior technical advisor for the executor.",
   "Analyze the executor-supplied context deeply. Use read-only tools when direct inspection or verification would materially improve the advice.",
@@ -9726,10 +9726,11 @@ var SANDBOX_EGRESS_AUTH_SIGNAL_PREFIX = "sandbox-egress-auth-required";
 var SANDBOX_EGRESS_PERMISSION_SIGNAL_PREFIX = "sandbox-egress-permission-denied";
 var SANDBOX_EGRESS_LEASE_PREFIX = "sandbox-egress-lease";
 var DEFAULT_SESSION_TTL_MS = 30 * 60 * 1e3;
-function leaseKey(provider, grantName, context) {
+function leaseKey(provider, grant, context) {
   const actor = context.credentials.actor;
   const actorKey = "type" in actor ? `user:${actor.userId}` : `system:${actor.name}`;
-  return `${SANDBOX_EGRESS_LEASE_PREFIX}:${provider}:${grantName}:${actorKey}:${context.egressId}:${context.contextId}`;
+  const grantKey = grant.leaseScope ? `${grant.name}:${grant.leaseScope}` : grant.name;
+  return `${SANDBOX_EGRESS_LEASE_PREFIX}:${provider}:${grantKey}:${actorKey}:${context.egressId}:${context.contextId}`;
 }
 function authSignalKey(egressId, access) {
   return `${SANDBOX_EGRESS_AUTH_SIGNAL_PREFIX}:${egressId}:${access}`;
@@ -9830,21 +9831,17 @@ async function setSandboxEgressCredentialLease(context, lease) {
   );
   const state = getStateAdapter();
   await state.connect();
-  await state.set(
-    leaseKey(lease.provider, lease.grant.name, context),
-    lease,
-    ttlMs2
-  );
+  await state.set(leaseKey(lease.provider, lease.grant, context), lease, ttlMs2);
 }
-async function getSandboxEgressCredentialLease(provider, grantName, context) {
+async function getSandboxEgressCredentialLease(provider, grant, context) {
   const state = getStateAdapter();
   await state.connect();
-  return parseLease(await state.get(leaseKey(provider, grantName, context)));
+  return parseLease(await state.get(leaseKey(provider, grant, context)));
 }
-async function clearSandboxEgressCredentialLease(provider, grantName, context) {
+async function clearSandboxEgressCredentialLease(provider, grant, context) {
   const state = getStateAdapter();
   await state.connect();
-  await state.delete(leaseKey(provider, grantName, context));
+  await state.delete(leaseKey(provider, grant, context));
 }
 async function setSandboxEgressAuthRequiredSignal(context, signal) {
   const ttlMs2 = Math.max(1, context.expiresAtMs - Date.now());
@@ -12494,7 +12491,7 @@ async function sandboxEgressCredentialLease(provider, selection, context) {
   const { grant } = selection;
   const cached = await getSandboxEgressCredentialLease(
     provider,
-    grant.name,
+    grant,
     context
   );
   if (cached) {
@@ -13096,7 +13093,7 @@ async function executeCredentialedEgressRequest(input) {
     if (!isEgressAuthRequired(error)) {
       throw error;
     }
-    await clearCredentialLease(provider, lease.grant.name, credentialContext);
+    await clearCredentialLease(provider, lease.grant, credentialContext);
     await recordAuthRequired({
       credentialContext,
       provider,
@@ -13153,7 +13150,7 @@ async function executeCredentialedEgressRequest(input) {
       upstream.status === UPSTREAM_TOKEN_REJECTION_STATUS ? "Sandbox egress upstream auth rejected injected credential" : "Sandbox egress upstream permission denied"
     );
     if (upstream.status === UPSTREAM_TOKEN_REJECTION_STATUS) {
-      await clearCredentialLease(provider, lease.grant.name, credentialContext);
+      await clearCredentialLease(provider, lease.grant, credentialContext);
       await recordAuthRequired({
         credentialContext,
         provider,
@@ -13169,7 +13166,7 @@ async function executeCredentialedEgressRequest(input) {
 `
       });
     } else {
-      await clearCredentialLease(provider, lease.grant.name, credentialContext);
+      await clearCredentialLease(provider, lease.grant, credentialContext);
       await recordPermissionDenied({
         credentialContext,
         provider,

package/dist/cli/chat.js

@@ -1,7 +1,7 @@
 import {
   createAgentRunner,
   executeAgentRun
-} from "../chunk-JJUJ4CO2.js";
+} from "../chunk-KRMANDHI.js";
 import "../chunk-HDNWZMUN.js";
 import "../chunk-PFXC67GJ.js";
 import "../chunk-6H4PP63X.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior",
-  "version": "0.93.0",
+  "version": "0.94.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -78,7 +78,7 @@
     "pg": "^8.16.3",
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
-    "@sentry/junior-plugin-api": "0.93.0"
+    "@sentry/junior-plugin-api": "0.94.0"
   },
   "devDependencies": {
     "@emnapi/core": "^1.10.0",
@@ -94,10 +94,10 @@
     "typescript": "^6.0.3",
     "vercel": "^54.4.0",
     "vitest": "^4.1.7",
-    "@sentry/junior-memory": "0.93.0",
-    "@sentry/junior-testing": "0.0.0",
-    "@sentry/junior-github": "0.93.0",
-    "@sentry/junior-scheduler": "0.93.0"
+    "@sentry/junior-github": "0.94.0",
+    "@sentry/junior-memory": "0.94.0",
+    "@sentry/junior-scheduler": "0.94.0",
+    "@sentry/junior-testing": "0.0.0"
   },
   "scripts": {
     "build": "tsup && tsc -p tsconfig.build.json --emitDeclarationOnly",