@sentry/junior 0.99.0 → 0.101.0

package/dist/{chunk-PYK7R5A7.js → chunk-UWGTSF5O.js}

@@ -1,6 +1,7 @@
 import {
   CooperativeTurnYieldError,
   TurnInputCommitLostError,
+  abandonReplacedPendingAuth,
   canReusePendingAuthLink,
   getInterruptionMarker,
   isTurnInputCommitLostError,
@@ -10,14 +11,14 @@ import {
   persistRunningSessionRecord,
   persistTimeoutSessionRecord,
   persistYieldSessionRecord
-} from "./chunk-WJ7STXT6.js";
+} from "./chunk-XVR4O24H.js";
 import {
   JUNIOR_THREAD_STATE_TTL_MS
-} from "./chunk-6DTVCPLO.js";
+} from "./chunk-XIMUQ4IU.js";
 import {
   addAgentTurnUsage,
   hasAgentTurnUsage
-} from "./chunk-OL6XQ23W.js";
+} from "./chunk-IVXL57YF.js";
 import {
   loadConnectedMcpProviders,
   loadConversationProjection,
@@ -25,12 +26,12 @@ import {
   recordAuthorizationRequested,
   recordMcpProviderConnected,
   recordToolExecutionStarted
-} from "./chunk-DHHU2WSG.js";
+} from "./chunk-IQIBZXGB.js";
 import {
   estimateTextTokens,
   getAgentContextCompactionTriggerTokens,
   updateConversationStats
-} from "./chunk-IO65E4ZD.js";
+} from "./chunk-JPQISMMJ.js";
 import {
   buildNonInteractiveShellScript,
   createSandboxInstance,
@@ -40,7 +41,7 @@ import {
   isSnapshotMissingError,
   resolveRuntimeDependencySnapshot,
   runNonInteractiveCommand
-} from "./chunk-H66UCBPW.js";
+} from "./chunk-XJA7BPHS.js";
 import {
   privateTraceResultAttributes
 } from "./chunk-CM5EZD5F.js";
@@ -52,7 +53,7 @@ import {
   getPlugins,
   getSlackToolContext,
   resolveChannelCapabilities
-} from "./chunk-FTTFV6DC.js";
+} from "./chunk-TPTJEHUE.js";
 import {
   SlackActionError,
   downloadPrivateSlackFile,
@@ -62,10 +63,10 @@ import {
   isDmChannel,
   normalizeSlackConversationId,
   withSlackRetries
-} from "./chunk-WTYEKPXU.js";
+} from "./chunk-FP5N5OWZ.js";
 import {
   createPluginLogger
-} from "./chunk-EOWXRY5E.js";
+} from "./chunk-PWC24W5F.js";
 import {
   contextProvenance,
   getAgentStepStore,
@@ -74,7 +75,7 @@ import {
   getDb,
   instructionActors,
   instructionProvenanceFor
-} from "./chunk-OGHXZ4KQ.js";
+} from "./chunk-VHRM6GNH.js";
 import {
   SANDBOX_DATA_ROOT,
   SANDBOX_SKILLS_ROOT,
@@ -94,6 +95,7 @@ import {
   ModelProfileNotConfiguredError,
   STANDARD_MODEL_PROFILE,
   TURN_CONTEXT_TAG,
+  TURN_REASONING_LEVELS,
   acquireActiveLock,
   botConfig,
   completeObject,
@@ -119,7 +121,7 @@ import {
   stripRuntimeTurnContext,
   trimTrailingAssistantMessages,
   unwrapCurrentInstruction
-} from "./chunk-EEZCY5WX.js";
+} from "./chunk-A7X2FDUO.js";
 import {
   parseSlackThreadId,
   resolveConversationPrivacy,
@@ -687,7 +689,7 @@ function buildTurnResult(input) {
     shouldTrace,
     spanContext,
     usage,
-    thinkingSelection,
+    reasoningSelection,
     correlation,
     assistantUserName,
     modelId
@@ -817,7 +819,7 @@ function buildTurnResult(input) {
     outcome: resolvedOutcome,
     modelId,
     assistantMessageCount: assistantMessages.length,
-    thinkingLevel: thinkingSelection.thinkingLevel,
+    reasoningLevel: reasoningSelection.reasoningLevel,
     toolCalls,
     toolResultCount: toolResults.length,
     toolErrorCount,
@@ -840,20 +842,13 @@ function buildTurnResult(input) {
   };
 }
 
-// src/chat/services/turn-thinking-level.ts
+// src/chat/services/turn-reasoning-level.ts
 import { z } from "zod";
 var CLASSIFIER_CONFIDENCE_THRESHOLD = 0.75;
 var MAX_ROUTER_CONTEXT_CHARS = 8e3;
 var ROUTER_CONTEXT_HEAD_CHARS = 3e3;
 var ROUTER_CONTEXT_TAIL_CHARS = 5e3;
 var TRUNCATION_MARKER = "\n\u2026[truncated]\u2026\n";
-var TURN_THINKING_LEVELS = [
-  "none",
-  "low",
-  "medium",
-  "high",
-  "xhigh"
-];
 var CONFIDENCE_LABELS = {
   low: 0.5,
   medium: CLASSIFIER_CONFIDENCE_THRESHOLD,
@@ -874,15 +869,15 @@ function coerceClassifierConfidence(value) {
   return CONFIDENCE_LABELS[trimmed] ?? value;
 }
 var turnExecutionProfileSchema = z.object({
-  thinking_level: z.enum(TURN_THINKING_LEVELS),
+  reasoning_level: z.enum(TURN_REASONING_LEVELS),
   confidence: z.preprocess(
     coerceClassifierConfidence,
     z.number().min(0).max(1)
   ),
   reason: z.string().min(1)
 });
-var DEFAULT_THINKING_LEVEL = "medium";
-var THINKING_LEVEL_RANK = {
+var CLASSIFIER_FALLBACK_REASONING_LEVEL = "medium";
+var REASONING_LEVEL_RANK = {
   none: 0,
   low: 1,
   medium: 2,
@@ -911,7 +906,7 @@ function trimContextForRouter(text) {
 }
 function buildClassifierSystemPrompt() {
   return [
-    "You route assistant turns to the thinking level most likely to produce a complete, source-grounded answer.",
+    "You route assistant turns to the reasoning level most likely to produce a complete, source-grounded answer.",
     "Choose exactly one bucket: none, low, medium, high, or xhigh.",
     "",
     "Use none only for greetings, acknowledgments, and turns that need no substantive assistant work.",
@@ -923,7 +918,7 @@ function buildClassifierSystemPrompt() {
     "",
     "Classify based on the substance of the task, not the length of the current message. When the current instruction is a short affirmation (for example: 'go', 'do it', 'yes please', 'proceed') and prior thread context contains a pending task, classify the pending task \u2014 not the affirmation.",
     "",
-    "Return JSON only with thinking_level, confidence, and reason.",
+    "Return JSON only with reasoning_level, confidence, and reason.",
     "confidence must be a number from 0 to 1, not a word label."
   ].join("\n");
 }
@@ -952,7 +947,13 @@ function buildClassifierPrompt(args) {
   }
   return sections.join("\n");
 }
-async function selectTurnThinkingLevel(args) {
+function configuredTurnReasoningLevel(reasoningLevel, source) {
+  return {
+    reasoningLevel,
+    reason: `configured:${source}`
+  };
+}
+async function selectTurnReasoningLevel(args) {
   const trimmedContext = trimContextForRouter(args.conversationContext);
   const instructionLength = args.messageText.trim().length;
   const turnBlockCount = (args.currentTurnBlocks ?? []).filter(
@@ -971,8 +972,8 @@ async function selectTurnThinkingLevel(args) {
     modelId: args.fastModelId
   };
   return withSpan(
-    "chat.route_thinking",
-    "chat.route_thinking",
+    "chat.route_reasoning",
+    "chat.route_reasoning",
     logContext,
     async () => {
       setSpanAttributes({
@@ -994,29 +995,29 @@ async function selectTurnThinkingLevel(args) {
         },
         prompt
       });
-      const normalizedSelection = applyThinkingFloor(selection, {
+      const normalizedSelection = applyReasoningFloor(selection, {
         minimum: trimmedContext || turnBlockCount > 0 ? "medium" : void 0
       });
       setSpanAttributes({
-        "app.ai.thinking_level": normalizedSelection.thinkingLevel,
-        "app.ai.thinking_level_reason": normalizedSelection.reason,
+        "app.ai.reasoning_level": normalizedSelection.reasoningLevel,
+        "app.ai.reasoning_level_reason": normalizedSelection.reason,
         ...normalizedSelection.confidence !== void 0 ? {
-          "app.ai.thinking_level_confidence": normalizedSelection.confidence
+          "app.ai.reasoning_level_confidence": normalizedSelection.confidence
         } : {}
       });
       return normalizedSelection;
     }
   );
 }
-function applyThinkingFloor(selection, args) {
+function applyReasoningFloor(selection, args) {
   const minimum = args.minimum;
-  if (!minimum || selection.thinkingLevel === "none" || THINKING_LEVEL_RANK[selection.thinkingLevel] >= THINKING_LEVEL_RANK[minimum]) {
+  if (!minimum || selection.reasoningLevel === "none" || REASONING_LEVEL_RANK[selection.reasoningLevel] >= REASONING_LEVEL_RANK[minimum]) {
     return selection;
   }
   return {
     ...selection,
-    thinkingLevel: minimum,
-    reason: `thinking_floor:${minimum}:${selection.reason}`
+    reasoningLevel: minimum,
+    reason: `reasoning_floor:${minimum}:${selection.reason}`
   };
 }
 async function classifyTurn(args) {
@@ -1036,23 +1037,23 @@ async function classifyTurn(args) {
     if (parsed.confidence < CLASSIFIER_CONFIDENCE_THRESHOLD) {
       return {
         confidence: parsed.confidence,
-        thinkingLevel: DEFAULT_THINKING_LEVEL,
+        reasoningLevel: CLASSIFIER_FALLBACK_REASONING_LEVEL,
         reason: `low_confidence_medium_default:${reason}`
       };
     }
     return {
       confidence: parsed.confidence,
-      thinkingLevel: parsed.thinking_level,
+      reasoningLevel: parsed.reasoning_level,
       reason
     };
   } catch {
     return {
-      thinkingLevel: DEFAULT_THINKING_LEVEL,
+      reasoningLevel: CLASSIFIER_FALLBACK_REASONING_LEVEL,
       reason: "classifier_error_default"
     };
   }
 }
-function toAgentThinkingLevel(level) {
+function toPiReasoningLevel(level) {
   switch (level) {
     case "none":
       return "off";
@@ -3151,6 +3152,7 @@ var PluginMcpClient = class {
   plugin;
   options;
   client;
+  clientPromise;
   lastAttemptedTransportSessionId;
   transport;
   listedTools;
@@ -3227,6 +3229,20 @@ var PluginMcpClient = class {
     if (this.client) {
       return this.client;
     }
+    if (this.clientPromise) {
+      return await this.clientPromise;
+    }
+    const clientPromise = this.connectClient();
+    this.clientPromise = clientPromise;
+    try {
+      return await clientPromise;
+    } finally {
+      if (this.clientPromise === clientPromise) {
+        this.clientPromise = void 0;
+      }
+    }
+  }
+  async connectClient() {
     const mcp = this.plugin.manifest.mcp;
     if (!mcp) {
       throw new Error(
@@ -3289,6 +3305,7 @@ var PluginMcpClient = class {
     this.listedTools = void 0;
     this.transport = void 0;
     this.client = void 0;
+    this.clientPromise = void 0;
     if (transport) {
       await transport.close();
     }
@@ -3337,6 +3354,9 @@ function getMcpAwareTelemetryMessage(error, privacy) {
 }
 
 // src/chat/mcp/tool-manager.ts
+var MAX_TOOL_RESULT_TOKENS = 1e4;
+var MAX_TOOL_RESULT_BYTES = 32 * 1024;
+var CHARS_PER_ESTIMATED_TOKEN = 4;
 function normalizeMcpToolName(provider, toolName) {
   return `mcp__${provider}__${toolName}`;
 }
@@ -3407,16 +3427,80 @@ function toAgentToolContent(result) {
   }
   return [{ type: "text", text: "ok" }];
 }
+function utf8Bytes(value) {
+  return Buffer.byteLength(value, "utf8");
+}
+function prefixWithin(value, maxChars, maxBytes) {
+  let low = 0;
+  let high = Math.min(value.length, maxChars);
+  while (low < high) {
+    const middle = Math.ceil((low + high) / 2);
+    if (utf8Bytes(value.slice(0, middle)) <= maxBytes) {
+      low = middle;
+    } else {
+      high = middle - 1;
+    }
+  }
+  if (low > 0 && /[\uD800-\uDBFF]/.test(value[low - 1])) {
+    low -= 1;
+  }
+  return value.slice(0, low);
+}
+function suffixWithin(value, maxChars, maxBytes) {
+  let low = Math.max(0, value.length - maxChars);
+  let high = value.length;
+  while (low < high) {
+    const middle = Math.floor((low + high) / 2);
+    if (utf8Bytes(value.slice(middle)) <= maxBytes) {
+      high = middle;
+    } else {
+      low = middle + 1;
+    }
+  }
+  if (low < value.length && /[\uDC00-\uDFFF]/.test(value[low])) {
+    low += 1;
+  }
+  return value.slice(low);
+}
+function boundMcpContent(content) {
+  const text = content.filter((part) => part.type === "text").map((part) => part.text).join("\n\n");
+  const originalBytes = utf8Bytes(text);
+  const originalTokens = Math.ceil(text.length / CHARS_PER_ESTIMATED_TOKEN);
+  if (originalTokens <= MAX_TOOL_RESULT_TOKENS && originalBytes <= MAX_TOOL_RESULT_BYTES) {
+    return content;
+  }
+  const warning = `
+
+Warning: truncated output (original token count: ${originalTokens}; original bytes: ${originalBytes})
+
+`;
+  const remainingChars = MAX_TOOL_RESULT_TOKENS * CHARS_PER_ESTIMATED_TOKEN - warning.length;
+  const remainingBytes = MAX_TOOL_RESULT_BYTES - utf8Bytes(warning);
+  const head = prefixWithin(
+    text,
+    Math.ceil(remainingChars / 2),
+    Math.ceil(remainingBytes / 2)
+  );
+  const tail = suffixWithin(
+    text.slice(head.length),
+    remainingChars - head.length,
+    remainingBytes - utf8Bytes(head)
+  );
+  return [
+    { type: "text", text: `${head}${warning}${tail}` },
+    ...content.filter((part) => part.type === "image")
+  ];
+}
 function toModelVisibleMcpContent(result) {
   const content = toAgentToolContent(result);
   if (content.some((part) => part.type === "image")) {
-    return content;
+    return boundMcpContent(content);
   }
   const structured = summarizeStructuredContent(result.structuredContent);
   if (structured) {
-    return [{ type: "text", text: structured }];
+    return boundMcpContent([{ type: "text", text: structured }]);
   }
-  return content;
+  return boundMcpContent(content);
 }
 function describeMcpTool(provider, tool) {
   const prefix = `[${provider}]`;
@@ -3453,6 +3537,7 @@ var McpToolManager = class {
   activeProviders = /* @__PURE__ */ new Set();
   authorizationPendingProviders = /* @__PURE__ */ new Set();
   clientsByProvider = /* @__PURE__ */ new Map();
+  clientPromisesByProvider = /* @__PURE__ */ new Map();
   toolsByProvider = /* @__PURE__ */ new Map();
   getActiveProviders() {
     return [...this.activeProviders].sort(
@@ -3545,6 +3630,21 @@ var McpToolManager = class {
     if (existing) {
       return existing;
     }
+    const pending = this.clientPromisesByProvider.get(plugin.manifest.name);
+    if (pending) {
+      return await pending;
+    }
+    const clientPromise = this.createClient(plugin);
+    this.clientPromisesByProvider.set(plugin.manifest.name, clientPromise);
+    try {
+      return await clientPromise;
+    } finally {
+      if (this.clientPromisesByProvider.get(plugin.manifest.name) === clientPromise) {
+        this.clientPromisesByProvider.delete(plugin.manifest.name);
+      }
+    }
+  }
+  async createClient(plugin) {
     const authProvider = this.options.authProviderFactory ? await this.options.authProviderFactory(plugin) : void 0;
     const client = new PluginMcpClient(plugin, {
       ...authProvider ? { authProvider } : {},
@@ -6680,7 +6780,9 @@ function stableSerialize(value) {
     return `[${value.map((entry) => stableSerialize(entry)).join(",")}]`;
   }
   if (value && typeof value === "object") {
-    const entries = Object.entries(value).sort((a, b) => a[0].localeCompare(b[0]));
+    const entries = Object.entries(value).sort(
+      (a, b) => a[0].localeCompare(b[0])
+    );
     return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${stableSerialize(entry)}`).join(",")}}`;
   }
   const serialized = JSON.stringify(value);
@@ -10004,13 +10106,19 @@ function createPluginAuthOrchestration(input) {
       }
     }
     if (input.sessionId && recordPendingAuth) {
-      await recordPendingAuth({
+      const nextPendingAuth = {
         kind: "plugin",
         provider,
         actorId: input.actorId,
         ...options?.scope ? { scope: options.scope } : {},
         sessionId: input.sessionId,
         linkSentAtMs: reusingPendingLink ? input.pendingAuth.linkSentAtMs : Date.now()
+      };
+      await recordPendingAuth(nextPendingAuth);
+      await abandonReplacedPendingAuth({
+        conversationId: input.conversationId,
+        previousPendingAuth: input.pendingAuth,
+        nextPendingAuth
       });
     }
     if (input.conversationId && input.sessionId) {
@@ -12578,9 +12686,9 @@ import { StreamableHTTPClientTransport as StreamableHTTPClientTransport2 } from
 import {
   sourceSchema as sourceSchema2
 } from "@sentry/junior-plugin-api";
-var MCP_AUTH_SESSION_PREFIX = "junior:mcp_auth_session";
+var MCP_AUTH_SESSION_PREFIX = "junior:mcp_oauth_attempt:v2";
 var MCP_AUTH_CREDENTIALS_PREFIX = "junior:mcp_auth_credentials";
-var MCP_AUTH_SESSION_INDEX_PREFIX = "junior:mcp_auth_session_index";
+var MCP_AUTH_SESSION_INDEX_PREFIX = "junior:mcp_oauth_attempt_index:v2";
 var MCP_SERVER_SESSION_PREFIX = "junior:mcp_server_session";
 var MCP_AUTH_SESSION_TTL_MS = 24 * 60 * 60 * 1e3;
 var MCP_AUTH_CREDENTIALS_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
@@ -12622,7 +12730,7 @@ function parseMcpAuthSession(value) {
     if (!isRecord(parsed)) {
       return void 0;
     }
-    if (typeof parsed.authSessionId !== "string" || typeof parsed.provider !== "string" || typeof parsed.userId !== "string" || typeof parsed.conversationId !== "string" || typeof parsed.sessionId !== "string" || typeof parsed.userMessage !== "string" || typeof parsed.createdAtMs !== "number" || typeof parsed.updatedAtMs !== "number") {
+    if (parsed.schemaVersion !== 2 || typeof parsed.authSessionId !== "string" || typeof parsed.provider !== "string" || typeof parsed.userId !== "string" || typeof parsed.conversationId !== "string" || typeof parsed.sessionId !== "string" || typeof parsed.userMessage !== "string" || typeof parsed.createdAtMs !== "number" || typeof parsed.updatedAtMs !== "number") {
       return void 0;
     }
     const destination = parsed.destination === void 0 ? void 0 : parseDestination(parsed.destination);
@@ -12634,6 +12742,7 @@ function parseMcpAuthSession(value) {
       return void 0;
     }
     return {
+      schemaVersion: 2,
       authSessionId: parsed.authSessionId,
       provider: parsed.provider,
       userId: parsed.userId,
@@ -12731,6 +12840,7 @@ async function patchMcpAuthSession(authSessionId, patch) {
   const next = {
     ...current,
     ...patch,
+    schemaVersion: 2,
     authSessionId: current.authSessionId,
     provider: current.provider,
     userId: current.userId,
@@ -12775,25 +12885,6 @@ async function deleteMcpAuthSessionsForUserProvider(userId, provider) {
   }
   await stateAdapter.delete(indexKey);
 }
-async function getLatestMcpAuthSessionForUserProvider(userId, provider) {
-  const stateAdapter = await getConnectedStateAdapter();
-  const authSessionIds = parseSessionIndex(
-    await stateAdapter.get(sessionIndexKey(userId, provider))
-  );
-  let latestSession;
-  for (const authSessionId of authSessionIds) {
-    const session = parseMcpAuthSession(
-      await stateAdapter.get(sessionKey(authSessionId))
-    );
-    if (!session) {
-      continue;
-    }
-    if (!latestSession || session.updatedAtMs > latestSession.updatedAtMs) {
-      latestSession = session;
-    }
-  }
-  return latestSession;
-}
 async function getMcpStoredOAuthCredentials(userId, provider) {
   const stateAdapter = await getConnectedStateAdapter();
   return parseStoredCredentials(
@@ -12852,15 +12943,17 @@ function clientAllowsRedirectUri(clientInformation, callbackUrl) {
   return redirectUris.includes(callbackUrl);
 }
 var StateBackedMcpOAuthClientProvider = class {
-  constructor(authSessionId, callbackUrl, sessionContext) {
+  constructor(authSessionId, callbackUrl, sessionContext, runCredentialMutation) {
     this.authSessionId = authSessionId;
     this.callbackUrl = callbackUrl;
     this.sessionContext = sessionContext;
+    this.runCredentialMutation = runCredentialMutation;
     this.clientMetadata = createClientMetadata(callbackUrl);
   }
   authSessionId;
   callbackUrl;
   sessionContext;
+  runCredentialMutation;
   clientMetadata;
   get redirectUrl() {
     return this.callbackUrl;
@@ -12884,11 +12977,16 @@ var StateBackedMcpOAuthClientProvider = class {
     return void 0;
   }
   async saveClientInformation(clientInformation) {
-    const session = await this.getCredentialContext();
-    const credentials = await getMcpStoredOAuthCredentials(session.userId, session.provider) ?? {};
-    await putMcpStoredOAuthCredentials(session.userId, session.provider, {
-      ...credentials,
-      clientInformation
+    await this.mutateCredentials(async () => {
+      const session = await this.getCredentialContext();
+      const credentials = await getMcpStoredOAuthCredentials(
+        session.userId,
+        session.provider
+      ) ?? {};
+      await putMcpStoredOAuthCredentials(session.userId, session.provider, {
+        ...credentials,
+        clientInformation
+      });
     });
   }
   async tokens() {
@@ -12900,19 +12998,32 @@ var StateBackedMcpOAuthClientProvider = class {
     return credentials?.tokens;
   }
   async saveTokens(tokens) {
-    const session = await this.getCredentialContext();
-    const credentials = await getMcpStoredOAuthCredentials(session.userId, session.provider) ?? {};
-    await putMcpStoredOAuthCredentials(session.userId, session.provider, {
-      ...credentials,
-      tokens
+    await this.mutateCredentials(async () => {
+      const session = await this.getCredentialContext();
+      const credentials = await getMcpStoredOAuthCredentials(
+        session.userId,
+        session.provider
+      ) ?? {};
+      await putMcpStoredOAuthCredentials(session.userId, session.provider, {
+        ...credentials,
+        tokens
+      });
     });
   }
   async redirectToAuthorization(authorizationUrl) {
+    const existing = await getMcpAuthSession(this.authSessionId);
+    if (existing?.authorizationUrl && existing.authorizationUrl !== authorizationUrl.toString()) {
+      throw new Error("MCP OAuth authorization attempt is already initialized");
+    }
     await this.ensureSession({
       authorizationUrl: authorizationUrl.toString()
     });
   }
   async saveCodeVerifier(codeVerifier) {
+    const existing = await getMcpAuthSession(this.authSessionId);
+    if (existing?.codeVerifier && existing.codeVerifier !== codeVerifier) {
+      throw new Error("MCP OAuth authorization attempt is already initialized");
+    }
     await this.ensureSession({ codeVerifier });
   }
   async codeVerifier() {
@@ -12923,11 +13034,16 @@ var StateBackedMcpOAuthClientProvider = class {
     return session.codeVerifier;
   }
   async saveDiscoveryState(state) {
-    const session = await this.getCredentialContext();
-    const credentials = await getMcpStoredOAuthCredentials(session.userId, session.provider) ?? {};
-    await putMcpStoredOAuthCredentials(session.userId, session.provider, {
-      ...credentials,
-      discoveryState: state
+    await this.mutateCredentials(async () => {
+      const session = await this.getCredentialContext();
+      const credentials = await getMcpStoredOAuthCredentials(
+        session.userId,
+        session.provider
+      ) ?? {};
+      await putMcpStoredOAuthCredentials(session.userId, session.provider, {
+        ...credentials,
+        discoveryState: state
+      });
     });
   }
   async discoveryState() {
@@ -12939,34 +13055,36 @@ var StateBackedMcpOAuthClientProvider = class {
     return credentials?.discoveryState;
   }
   async invalidateCredentials(scope) {
-    const session = await this.getCredentialContext();
-    const credentials = await getMcpStoredOAuthCredentials(session.userId, session.provider) ?? {};
-    await putMcpStoredOAuthCredentials(session.userId, session.provider, {
-      ...scope === "tokens" || scope === "all" ? {} : credentials.tokens ? { tokens: credentials.tokens } : {},
-      ...scope === "client" || scope === "all" ? {} : credentials.clientInformation ? { clientInformation: credentials.clientInformation } : {},
-      ...scope === "discovery" || scope === "all" ? {} : credentials.discoveryState ? { discoveryState: credentials.discoveryState } : {}
+    await this.mutateCredentials(async () => {
+      const session = await this.getCredentialContext();
+      const credentials = await getMcpStoredOAuthCredentials(
+        session.userId,
+        session.provider
+      ) ?? {};
+      await putMcpStoredOAuthCredentials(session.userId, session.provider, {
+        ...scope === "tokens" || scope === "all" ? {} : credentials.tokens ? { tokens: credentials.tokens } : {},
+        ...scope === "client" || scope === "all" ? {} : credentials.clientInformation ? { clientInformation: credentials.clientInformation } : {},
+        ...scope === "discovery" || scope === "all" ? {} : credentials.discoveryState ? { discoveryState: credentials.discoveryState } : {}
+      });
     });
-    if (scope === "verifier" || scope === "all") {
-      const authSession = await getMcpAuthSession(this.authSessionId);
-      if (authSession) {
-        await patchMcpAuthSession(this.authSessionId, {
-          codeVerifier: void 0,
-          ...scope === "all" ? { authorizationUrl: void 0 } : {}
-        });
-      }
-    }
   }
   async getMcpServerSessionId() {
     const session = await this.getCredentialContext();
     return await getMcpServerSessionId(session.userId, session.provider);
   }
   async saveMcpServerSessionId(sessionId) {
-    const session = await this.getCredentialContext();
-    if (!sessionId) {
-      await deleteMcpServerSessionId(session.userId, session.provider);
-      return;
-    }
-    await putMcpServerSessionId(session.userId, session.provider, sessionId);
+    await this.mutateCredentials(async () => {
+      const session = await this.getCredentialContext();
+      if (!sessionId) {
+        await deleteMcpServerSessionId(session.userId, session.provider);
+        return;
+      }
+      await putMcpServerSessionId(session.userId, session.provider, sessionId);
+    });
+  }
+  /** Route shared credential writes through callback-owned freshness control. */
+  async mutateCredentials(mutation) {
+    return this.runCredentialMutation ? await this.runCredentialMutation(mutation) : await mutation();
   }
   async getCredentialContext() {
     return this.sessionContext ?? await this.requireSession();
@@ -12981,6 +13099,7 @@ var StateBackedMcpOAuthClientProvider = class {
     }
     const now = Date.now();
     const nextSession = {
+      schemaVersion: 2,
       authSessionId: this.authSessionId,
       ...this.sessionContext,
       ...patch,
@@ -13018,32 +13137,7 @@ async function createMcpOAuthClientProvider(input) {
       "Cannot determine base URL (set JUNIOR_BASE_URL or deploy to Vercel)"
     );
   }
-  const existingSession = await getLatestMcpAuthSessionForUserProvider(
-    input.userId,
-    input.provider
-  );
-  const reusableSession = existingSession && existingSession.conversationId === input.conversationId && existingSession.sessionId === input.sessionId ? existingSession : void 0;
-  const now = Date.now();
-  const authSessionId = reusableSession?.authSessionId ?? randomUUID3();
-  await putMcpAuthSession({
-    authSessionId,
-    provider: input.provider,
-    userId: input.userId,
-    conversationId: input.conversationId,
-    ...input.destination ? { destination: input.destination } : {},
-    ...input.source ? { source: input.source } : {},
-    sessionId: input.sessionId,
-    userMessage: input.userMessage,
-    ...input.channelId ? { channelId: input.channelId } : {},
-    ...input.threadTs ? { threadTs: input.threadTs } : {},
-    ...input.toolChannelId ? { toolChannelId: input.toolChannelId } : {},
-    ...input.configuration ? { configuration: input.configuration } : {},
-    ...input.artifactState ? { artifactState: input.artifactState } : {},
-    ...reusableSession?.authorizationUrl ? { authorizationUrl: reusableSession.authorizationUrl } : {},
-    ...reusableSession?.codeVerifier ? { codeVerifier: reusableSession.codeVerifier } : {},
-    createdAtMs: reusableSession?.createdAtMs ?? now,
-    updatedAtMs: now
-  });
+  const authSessionId = randomUUID3();
   return new StateBackedMcpOAuthClientProvider(
     authSessionId,
     `${baseUrl}${getMcpOAuthCallbackPath(input.provider)}`,
@@ -13052,6 +13146,7 @@ async function createMcpOAuthClientProvider(input) {
       userId: input.userId,
       conversationId: input.conversationId,
       ...input.destination ? { destination: input.destination } : {},
+      ...input.source ? { source: input.source } : {},
       sessionId: input.sessionId,
       userMessage: input.userMessage,
       ...input.channelId ? { channelId: input.channelId } : {},
@@ -13062,7 +13157,7 @@ async function createMcpOAuthClientProvider(input) {
     }
   );
 }
-async function finalizeMcpAuthorization(provider, authSessionId, authorizationCode) {
+async function finalizeMcpAuthorization(provider, authSessionId, authorizationCode, runCredentialMutation) {
   const plugin = requirePluginWithMcp(provider);
   const mcp = plugin.manifest.mcp;
   if (!mcp) {
@@ -13086,7 +13181,9 @@ async function finalizeMcpAuthorization(provider, authSessionId, authorizationCo
   const callbackUrl = `${baseUrl}${getMcpOAuthCallbackPath(provider)}`;
   const authProvider = new StateBackedMcpOAuthClientProvider(
     authSessionId,
-    callbackUrl
+    callbackUrl,
+    void 0,
+    runCredentialMutation
   );
   const requestInit = {};
   if (mcp.headers && Object.keys(mcp.headers).length > 0) {
@@ -13169,16 +13266,6 @@ function createMcpAuthOrchestration(input) {
         `Missing pending auth recorder for MCP authorization pause "${provider}"`
       );
     }
-    const latestArtifactState = input.getMergedArtifactState();
-    await patchMcpAuthSession(authSessionId, {
-      configuration: { ...input.getConfiguration() },
-      artifactState: latestArtifactState,
-      toolChannelId: input.toolChannelId ?? latestArtifactState.assistantContextChannelId ?? input.channelId
-    });
-    const authSession = await getMcpAuthSession(authSessionId);
-    if (!authSession?.authorizationUrl) {
-      throw new Error(`Missing MCP authorization URL for plugin "${provider}"`);
-    }
     const reusingPendingLink = canReusePendingAuthLink({
       pendingAuth: input.pendingAuth,
       kind: "mcp",
@@ -13186,8 +13273,31 @@ function createMcpAuthOrchestration(input) {
       actorId,
       sessionId
     });
+    const reusedAuthSessionId = reusingPendingLink && input.pendingAuth?.kind === "mcp" ? input.pendingAuth.authSessionId : void 0;
+    const activeAuthSessionId = reusedAuthSessionId ?? authSessionId;
+    const latestArtifactState = input.getMergedArtifactState();
+    await patchMcpAuthSession(activeAuthSessionId, {
+      configuration: { ...input.getConfiguration() },
+      artifactState: latestArtifactState,
+      toolChannelId: input.toolChannelId ?? latestArtifactState.assistantContextChannelId ?? input.channelId
+    });
     const providerLabel = formatProviderLabel(provider);
+    const nextPendingAuth = {
+      authSessionId: activeAuthSessionId,
+      kind: "mcp",
+      provider,
+      actorId,
+      sessionId,
+      linkSentAtMs: reusingPendingLink ? input.pendingAuth.linkSentAtMs : Date.now()
+    };
     if (!reusingPendingLink) {
+      const authSession = await getMcpAuthSession(authSessionId);
+      if (!authSession?.authorizationUrl) {
+        throw new Error(
+          `Missing MCP authorization URL for plugin "${provider}"`
+        );
+      }
+      await recordPendingAuth(nextPendingAuth);
       const delivery = await deliverPrivateMessage({
         channelId: authSession.channelId,
         threadTs: authSession.threadTs,
@@ -13199,20 +13309,21 @@ function createMcpAuthOrchestration(input) {
         })
       });
       if (!delivery) {
+        await deleteMcpAuthSession(authSessionId);
+        await recordPendingAuth(input.pendingAuth);
         throw new Error(
           `Unable to deliver MCP authorization link for plugin "${provider}"`
         );
       }
+      await abandonReplacedPendingAuth({
+        conversationId,
+        previousPendingAuth: input.pendingAuth,
+        nextPendingAuth
+      });
     } else {
       await deleteMcpAuthSession(authSessionId);
+      await recordPendingAuth(nextPendingAuth);
     }
-    await recordPendingAuth({
-      kind: "mcp",
-      provider,
-      actorId,
-      sessionId,
-      linkSentAtMs: reusingPendingLink ? input.pendingAuth.linkSentAtMs : Date.now()
-    });
     await recordAuthorizationRequested({
       conversationId,
       kind: "mcp",
@@ -15223,7 +15334,11 @@ async function executeAgentRunInPrivacyContext(request, conversationPrivacy) {
   let canRecordMcpProviders = false;
   let turnUsage;
   let handoffPhaseUsage;
-  let thinkingSelection;
+  const configuredReasoningLevel = policy.reasoningLevel ?? botConfig.reasoningLevel;
+  let reasoningSelection = configuredReasoningLevel ? configuredTurnReasoningLevel(
+    configuredReasoningLevel,
+    policy.reasoningLevel ? "agent_config" : "default"
+  ) : void 0;
   let activeModelProfile = STANDARD_MODEL_PROFILE;
   let activeModelId = modelIdForProfile(botConfig, activeModelProfile);
   const actor = actorFromRouting(routing);
@@ -15337,7 +15452,7 @@ async function executeAgentRunInPrivacyContext(request, conversationPrivacy) {
       destination: routing.destination,
       durability,
       getLoadedSkillNames: () => loadedSkillNamesForResume,
-      getReasoningLevel: () => thinkingSelection?.thinkingLevel,
+      getReasoningLevel: () => reasoningSelection?.reasoningLevel,
       logContext: sessionRecordLogContext,
       getModelId: () => activeModelId,
       recordActiveMcpProviders,
@@ -15394,7 +15509,7 @@ async function executeAgentRunInPrivacyContext(request, conversationPrivacy) {
     });
     const { routerBlocks, userContentParts } = buildPromptInput(input);
     const preAgentPromptMessages = () => existingSessionRecord?.piMessages ?? [...input.piMessages ?? []];
-    thinkingSelection = await selectTurnThinkingLevel({
+    reasoningSelection ??= await selectTurnReasoningLevel({
       completeObject,
       conversationContext: input.conversationContext,
       context: {
@@ -15409,10 +15524,10 @@ async function executeAgentRunInPrivacyContext(request, conversationPrivacy) {
     });
     setSpanAttributes({
       "gen_ai.request.model": activeModelId,
-      "gen_ai.request.reasoning.level": thinkingSelection.thinkingLevel,
-      "app.ai.thinking_level_reason": thinkingSelection.reason,
-      ...thinkingSelection.confidence !== void 0 ? {
-        "app.ai.thinking_level_confidence": thinkingSelection.confidence
+      "gen_ai.request.reasoning.level": reasoningSelection.reasoningLevel,
+      "app.ai.reasoning_level_reason": reasoningSelection.reason,
+      ...reasoningSelection.confidence !== void 0 ? {
+        "app.ai.reasoning_level_confidence": reasoningSelection.confidence
       } : {}
     });
     const generatedFiles = [];
@@ -15439,8 +15554,8 @@ async function executeAgentRunInPrivacyContext(request, conversationPrivacy) {
           modelProfile: profile
         };
         const handoffModel = resolveGatewayModel(target.modelId);
-        const handoffThinkingLevel = toAgentThinkingLevel(
-          thinkingSelection.thinkingLevel
+        const handoffThinkingLevel = toPiReasoningLevel(
+          reasoningSelection.reasoningLevel
         );
         void (async () => {
           await observers.onStatus?.({ text: "Switching models" });
@@ -15673,7 +15788,7 @@ async function executeAgentRunInPrivacyContext(request, conversationPrivacy) {
           runResume.adoptCommittedBoundary(replacement);
           setSpanAttributes({
             "gen_ai.request.model": activeModelId,
-            "gen_ai.request.reasoning.level": thinkingSelection.thinkingLevel,
+            "gen_ai.request.reasoning.level": reasoningSelection.reasoningLevel,
             "app.ai.model_profile": activeModelProfile
           });
           update = {
@@ -15693,7 +15808,7 @@ async function executeAgentRunInPrivacyContext(request, conversationPrivacy) {
       initialState: {
         systemPrompt: baseInstructions,
         model: resolveGatewayModel(activeModelId),
-        thinkingLevel: toAgentThinkingLevel(thinkingSelection.thinkingLevel),
+        thinkingLevel: toPiReasoningLevel(reasoningSelection.reasoningLevel),
         tools: wiring.agentTools
       }
     });
@@ -15762,7 +15877,6 @@ async function executeAgentRunInPrivacyContext(request, conversationPrivacy) {
         "gen_ai.invoke_agent",
         spanContext,
         async () => {
-          let promptResult;
           const freshPromptMessage = {
             role: "user",
             content: promptContentParts,
@@ -15824,8 +15938,8 @@ async function executeAgentRunInPrivacyContext(request, conversationPrivacy) {
                     "gen_ai.provider.name": GEN_AI_PROVIDER_NAME,
                     "gen_ai.operation.name": "invoke_agent",
                     "gen_ai.request.model": activeModelId,
-                    ...thinkingSelection ? {
-                      "gen_ai.request.reasoning.level": thinkingSelection.thinkingLevel
+                    ...reasoningSelection ? {
+                      "gen_ai.request.reasoning.level": reasoningSelection.reasoningLevel
                     } : {},
                     "app.ai.turn_timeout_ms": turnTimeoutBudgetMs,
                     "app.ai.turn_deadline_remaining_ms": Math.max(
@@ -15870,7 +15984,7 @@ async function executeAgentRunInPrivacyContext(request, conversationPrivacy) {
           let run = shouldPromptAgent ? agent.prompt(freshPromptMessage) : agent.continue();
           let retryUsage;
           for (let attempt = 0; ; attempt += 1) {
-            promptResult = await runAgentStep(run);
+            await runAgentStep(run);
             signal?.throwIfAborted();
             if (runResume.cooperativeYieldError) {
               throw runResume.cooperativeYieldError;
@@ -15882,11 +15996,7 @@ async function executeAgentRunInPrivacyContext(request, conversationPrivacy) {
             const outputMessagesAttribute = serializeGenAiAttribute(
               conversationPrivacy !== "public" ? outputMessages.map(toGenAiMessageMetadata) : outputMessages.map(toCanonicalOutputMessage)
             );
-            const usageSummary = extractGenAiUsageSummary(
-              promptResult,
-              agent.state,
-              ...outputMessages
-            );
+            const usageSummary = extractGenAiUsageSummary(...outputMessages);
             const currentUsage = hasAgentTurnUsage(usageSummary) ? usageSummary : void 0;
             const currentPhaseUsage = addAgentTurnUsage(
               retryUsage,
@@ -15941,7 +16051,7 @@ async function executeAgentRunInPrivacyContext(request, conversationPrivacy) {
           ...sessionConversationId ? { "app.ai.session.conversation_id": sessionConversationId } : {},
           ...sessionId ? { "app.ai.turn.session_id": sessionId } : {},
           ...currentSliceId ? { "app.ai.turn.slice_id": currentSliceId } : {},
-          "gen_ai.request.reasoning.level": thinkingSelection.thinkingLevel,
+          "gen_ai.request.reasoning.level": reasoningSelection.reasoningLevel,
           ...toGenAiMessagesTraceAttributes("app.ai.input", inputMessages),
           ...inputMessagesAttribute ? { "gen_ai.input.messages": inputMessagesAttribute } : {}
         }
@@ -15967,7 +16077,7 @@ async function executeAgentRunInPrivacyContext(request, conversationPrivacy) {
         shouldTrace,
         spanContext,
         usage: turnUsage,
-        thinkingSelection,
+        reasoningSelection,
         correlation: routing.correlation,
         assistantUserName: botConfig.userName,
         modelId: activeModelId
@@ -16023,8 +16133,8 @@ async function executeAgentRunInPrivacyContext(request, conversationPrivacy) {
           outcome: "provider_error",
           modelId: activeModelId,
           assistantMessageCount: 0,
-          ...thinkingSelection ? {
-            thinkingLevel: thinkingSelection.thinkingLevel
+          ...reasoningSelection ? {
+            reasoningLevel: reasoningSelection.reasoningLevel
           } : {},
           toolCalls: [],
           toolResultCount: 0,
@@ -16101,6 +16211,7 @@ export {
   normalizeSandboxEgressTracePropagationDomains,
   shouldPropagateSandboxEgressTrace,
   resolveSandboxEgressProviderForHost,
+  getMcpAuthSession,
   deleteMcpAuthSession,
   deleteMcpAuthSessionsForUserProvider,
   getMcpStoredOAuthCredentials,