test(junior): Resolve testing cleanup merge

Merge latest main into the testing architecture cleanup.

Keep resume, reporting, scheduler, and Slack tests aligned with current testing policy.

Co-Authored-By: GPT-5 Codex <codex@openai.com>

Author: dcramer

.github/workflows/ci.yml

@@ -3,6 +3,8 @@ name: CI
 permissions:
   contents: read
   actions: write
+  statuses: write
+  pull-requests: read
 
 on:
   push:
@@ -42,10 +44,20 @@ jobs:
       - run: pnpm install --frozen-lockfile
       - run: pnpm release:check
       - run: pnpm lint
-      - run: pnpm test
+      - run: pnpm test:ci
       - run: pnpm --filter @sentry/junior-example build
       - run: pnpm docs:check
 
+      - name: Upload coverage and test results
+        if: ${{ !cancelled() }}
+        uses: getsentry/codecov-action@03112cc3b486a3397dc8d17a58680008721fc86f # v0.3.7
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          files: packages/junior/coverage/coverage-final.json,packages/junior-dashboard/coverage/coverage-final.json
+          coverage-format: istanbul
+          disable-search: true
+          junit-xml-pattern: packages/**/coverage/results.junit.xml
+
       - name: Pack release artifacts
         if: github.event_name == 'push'
         run: |

AGENTS.md

@@ -61,6 +61,7 @@ Co-Authored-By: (agent model name) <email>
 
 - `policies/README.md` (when to add a policy doc and how policy docs should stay scoped)
 - `policies/code-comments.md` (repo default for code comments, docstrings, and exported-function JSDoc)
+- `policies/context-bound-systems.md` (explicit actor/destination/context propagation across runtime boundaries)
 - `policies/evals.md` (evals as behavior integration tests and rubric authoring boundaries)
 - `policies/frontend-components.md` (Tailwind colocation and component-owned frontend styling)
 - `policies/interface-design.md` (naming, module paths, and minimal interface boundaries)
@@ -85,7 +86,7 @@ Co-Authored-By: (agent model name) <email>
 - Do not leak third-party SDK types across chat subsystem boundaries when a small local interface will do; keep vendor SDKs inside infrastructure modules.
 - Service modules must depend on small injected ports for Slack behavior, not import Slack infrastructure directly.
 - Slack modules must not import runtime modules.
-- `runtime/` orchestrates turns and turn-scoped formatting, `services/` do domain work (reply policy, delivery planning, channel intent, attachment validation), `state/` persists by concern, `ingress/` only normalizes/routes.
+- `runtime/` orchestrates turns and turn-scoped formatting, `services/` do domain work (reply policy, delivery planning, channel intent, attachment validation), `state/` persists by concern, `ingress/` only parses, classifies, and routes source events.
 - **Feature-based colocation**: group files by domain feature, not by technical role. Within a module, create subdirectories for each feature domain (e.g., `tools/slack/`, `tools/web/`, `tools/sandbox/`, `tools/skill/`). Shared contracts and cross-cutting utilities live at the module root. Only extract to a shared location when 2+ features need the same code.
 - Do not use barrel `index.ts` re-exports inside feature subdirectories — import directly from the source file. A module-root `index.ts` is acceptable as a composition root that wires features together.
 - Queue and worker paths must depend on injected runtime interfaces or factories, not import the production singleton from `@/chat/app/production`.
@@ -115,6 +116,7 @@ Co-Authored-By: (agent model name) <email>
 - `specs/agent-turn-handling.md` (agent user-message response policy: reply/silence, tool use, Slack side effects, resumed turns, and completion)
 - `specs/slack-agent-delivery.md` (Slack entry surfaces, reply delivery, continuation, files, images, and resume behavior contract)
 - `specs/slack-outbound-contract.md` (Slack outbound boundary, message/file/reaction safety rules, and markdown-to-`mrkdwn` ownership)
+- `specs/identity.md` (current actor, system actor, requester, author, creator, credential subject, service principal, and display identity contract)
 - `specs/credential-injection.md` (requester-bound provider credential injection contract)
 - `specs/oauth-flows.md` (OAuth authorization code flow + Slack UX contract)
 - `specs/agent-prompt.md` (core prompt ownership, execution-bias, and bloat-control contract)

package.json

@@ -1,7 +1,7 @@
 {
   "name": "junior-monorepo",
   "private": true,
-  "packageManager": "pnpm@10.33.0",
+  "packageManager": "pnpm@10.30.2+sha512.36cdc707e7b7940a988c9c1ecf88d084f8514b5c3f085f53a2e244c2921d3b2545bc20dd4ebe1fc245feec463bb298aecea7a63ed1f7680b877dc6379d8d0cb4",
   "scripts": {
     "dev": "node scripts/dev-server.mjs",
     "dev:env": "pnpx vercel env pull .env.local --environment=development && pnpm run cloudflare:token",
@@ -23,7 +23,8 @@
     "evals": "pnpm --filter @sentry/junior-evals evals",
     "evals:record": "pnpm --filter @sentry/junior-evals evals:record",
     "typecheck": "pnpm --filter @sentry/junior-plugin-api typecheck && pnpm --filter @sentry/junior-scheduler typecheck && pnpm --filter @sentry/junior typecheck && pnpm --filter @sentry/junior-dashboard typecheck && pnpm --filter @sentry/junior-testing typecheck && pnpm --filter @sentry/junior-example typecheck",
-    "skills:check": "pnpm --filter @sentry/junior skills:check"
+    "skills:check": "pnpm --filter @sentry/junior skills:check",
+    "test:ci": "pnpm --filter @sentry/junior build && pnpm --filter @sentry/junior-dashboard build && pnpm --filter @sentry/junior test:coverage && pnpm --filter @sentry/junior-dashboard test:coverage"
   },
   "simple-git-hooks": {
     "pre-commit": "pnpm lint-staged"

packages/docs/src/content/docs/operate/dashboard.md

@@ -81,6 +81,7 @@ The dashboard package owns these routes:
 | ------------------ | --------------------------------------- |
 | `/`                | Authenticated command-center UI.        |
 | `/conversations`   | Authenticated conversation-history UI.  |
+| `/plugins`         | Authenticated plugin reporting UI.      |
 | `/api/dashboard/*` | Authenticated dashboard JSON APIs.      |
 | `/api/auth/*`      | Better Auth Google login and callbacks. |
 
@@ -95,12 +96,15 @@ The current dashboard API slices are:
 | `/api/dashboard/plugins`                     | Loaded plugin list.                                                                    |
 | `/api/dashboard/skills`                      | Discovered skill list.                                                                 |
 | `/api/dashboard/sessions`                    | Recent conversation feed from turn-session checkpoints.                                |
+| `/api/dashboard/conversation-stats`          | Aggregate conversation stats, people/place leaderboards, and sampling metadata.        |
+| `/api/dashboard/plugin-reports`              | Sanitized trusted-plugin operational summaries.                                        |
 | `/api/dashboard/conversations/:conversation` | Expiring conversation transcript; private conversations return redacted metadata only. |
 | `/api/dashboard/config`                      | Safe dashboard config signals and feature readiness.                                   |
 | `/api/dashboard/me`                          | Signed-in dashboard identity.                                                          |
 
-The dashboard UI is a React client using React Router for browser views and TanStack Query to poll dashboard APIs. `/` shows command-center health and recent turn durations; `/conversations` shows conversation history; `/conversations/:conversation` shows the transcript and turn/tool-call detail for one conversation. The dashboard does not wrap Slack webhooks, provider OAuth callbacks, sandbox egress, or `/api/internal/*`.
+The dashboard UI is a React client using React Router for browser views and TanStack Query to poll dashboard APIs. `/` shows command-center health, aggregate conversation stats, and recent turn durations; `/conversations` shows conversation history; `/conversations/:conversation` shows the transcript and turn/tool-call detail for one conversation; `/plugins` shows loaded plugin inventory and trusted plugin operational summaries. The dashboard does not wrap Slack webhooks, provider OAuth callbacks, sandbox egress, or `/api/internal/*`.
 The conversation feed is a bounded metadata index with the same expiration policy as turn-session checkpoints. Conversation detail reads transcript data from the expiring checkpoint message store, so old transcripts disappear when checkpoint state expires. When `SENTRY_DSN` initializes the runtime and `SENTRY_ORG_SLUG` is set, conversation rows include a Sentry conversation link; when the runtime captures a trace ID, conversation detail shows it with the turn metadata.
+The conversation stats endpoint is separate from the recent feed and includes `sampleLimit`, `sampleSize`, and `truncated` fields so the UI can mark bounded aggregates.
 Dashboard dates use `JUNIOR_TIMEZONE`, defaulting to `America/Los_Angeles`.
 
 For local dashboard visual QA, pass `mockConversations: true` to `juniorDashboardPlugin()` or set `JUNIOR_DASHBOARD_MOCK_CONVERSATIONS=true` for the env-configured path. The sample conversations are read-only reporting fixtures and appear before real session records.

packages/docs/src/content/docs/reference/config-and-env.md

@@ -19,6 +19,7 @@ related:
 | `REDIS_URL`                                 | Yes         | Queue and runtime state storage.                                                                                                                      |
 | `JUNIOR_SECRET`                             | Yes         | Signs internal timeout-resume and agent-dispatch callbacks, plus sandbox egress requester context.                                                    |
 | `JUNIOR_BOT_NAME`                           | No          | Bot display/config naming.                                                                                                                            |
+| `JUNIOR_SLASH_COMMAND`                      | No          | Slack slash command for account-management flows. Defaults to `/jr`; the Slack app command must match this value.                                     |
 | `AI_MODEL`                                  | No          | Primary model selection override for main assistant turns. Defaults to `openai/gpt-5.4`; Junior chooses the reasoning effort per turn automatically.  |
 | `AI_FAST_MODEL`                             | No          | Faster model for lightweight tasks and routing/classification passes before the main turn begins. Defaults to `openai/gpt-5.4-mini`.                  |
 | `AI_VISION_MODEL`                           | No          | Dedicated image-understanding model; unset disables vision features.                                                                                  |

packages/docs/src/content/docs/start-here/deploy-to-vercel.md

@@ -107,7 +107,7 @@ Apply the URL to:
 
 - Event Subscriptions
 - Interactivity
-- `/jr` slash command
+- Slash command configured by `JUNIOR_SLASH_COMMAND` (defaults to `/jr`)
 
 Reinstall the Slack app if scopes changed.
 

packages/docs/src/content/docs/start-here/quickstart.md

@@ -63,6 +63,7 @@ Set these values before running real turns:
 | `REDIS_URL`               | Yes                    | Queue and runtime state storage.                               |
 | `JUNIOR_SECRET`           | Yes                    | Signs internal resume callbacks and sandbox requester context. |
 | `JUNIOR_BOT_NAME`         | No                     | Bot display/config name.                                       |
+| `JUNIOR_SLASH_COMMAND`    | No                     | Slack slash command name. Defaults to `/jr`.                   |
 | `AI_MODEL`                | No                     | Primary assistant model override.                              |
 | `AI_FAST_MODEL`           | No                     | Lightweight routing/classification model override.             |
 | `AI_VISION_MODEL`         | No                     | Enables image understanding when set.                          |

packages/docs/src/content/docs/start-here/slack-app-setup.md

@@ -34,16 +34,16 @@ Use `SLACK_BOT_TOKEN` for normal bot replies. Use `SLACK_BOT_USER_TOKEN` only wh
 
 Grant the smallest scopes that cover the Slack features you enable. A typical Junior installation needs scopes for mentions, posting replies, reading thread context, reactions, user lookup, file workflows, and slash command handling.
 
-| Capability                                        | Slack scopes to verify                                                       |
-| ------------------------------------------------- | ---------------------------------------------------------------------------- |
-| Mentions                                          | `app_mentions:read`                                                          |
-| Thread replies and private auth prompts           | `chat:write`                                                                 |
-| Processing reactions                              | `reactions:write`                                                            |
-| User lookup and App Home ownership                | `users:read`                                                                 |
-| Slash command `/jr`                               | `commands`                                                                   |
-| Thread context in public/private channels and DMs | `channels:history`, `groups:history`, `im:history`, `mpim:history` as needed |
-| File/image context and generated files            | `files:read`, `files:write` when file workflows are enabled                  |
-| Slack assistant status/title surfaces             | Assistant scopes required by your Slack app configuration                    |
+| Capability                                         | Slack scopes to verify                                                       |
+| -------------------------------------------------- | ---------------------------------------------------------------------------- |
+| Mentions                                           | `app_mentions:read`                                                          |
+| Thread replies and private auth prompts            | `chat:write`                                                                 |
+| Processing reactions                               | `reactions:write`                                                            |
+| User lookup and App Home ownership                 | `users:read`                                                                 |
+| Slash command configured by `JUNIOR_SLASH_COMMAND` | `commands`                                                                   |
+| Thread context in public/private channels and DMs  | `channels:history`, `groups:history`, `im:history`, `mpim:history` as needed |
+| File/image context and generated files             | `files:read`, `files:write` when file workflows are enabled                  |
+| Slack assistant status/title surfaces              | Assistant scopes required by your Slack app configuration                    |
 
 Slack requires reinstalling the app after scope changes. Reinstall before debugging runtime behavior.
 
@@ -78,15 +78,15 @@ https://<your-domain>/api/webhooks/slack
 
 Junior uses interactivity for App Home actions such as disconnecting provider accounts.
 
-## Add the `/jr` slash command
+## Add the slash command
 
-Create a `/jr` slash command with this request URL:
+Create the slash command configured by `JUNIOR_SLASH_COMMAND` with this request URL. The default command is `/jr`:
 
 ```text
 https://<your-domain>/api/webhooks/slack
 ```
 
-Junior uses `/jr link` and `/jr unlink` for provider account management flows.
+Junior uses `<command> link` and `<command> unlink` for provider account management flows.
 
 ## Verify locally
 
@@ -96,7 +96,7 @@ For local development, expose your dev server with a tunnel:
 cloudflared tunnel --url http://localhost:3000
 ```
 
-Then set Slack Event Subscriptions, Interactivity, and `/jr` to the tunnel URL plus `/api/webhooks/slack`.
+Then set Slack Event Subscriptions, Interactivity, and the configured slash command to the tunnel URL plus `/api/webhooks/slack`.
 
 Verify the setup:
 

packages/junior-agent-browser/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-agent-browser",
-  "version": "0.66.0",
+  "version": "0.68.0",
   "private": false,
   "publishConfig": {
     "access": "public"

packages/junior-dashboard/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-dashboard",
-  "version": "0.66.0",
+  "version": "0.68.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -37,7 +37,8 @@
     "prepare": "pnpm run build",
     "prepack": "pnpm run build",
     "test": "vitest run -c vitest.config.ts",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "test:coverage": "vitest run -c vitest.config.ts --coverage --reporter=default --reporter=junit --outputFile.junit=coverage/results.junit.xml"
   },
   "dependencies": {
     "@sentry/junior": "workspace:*",
@@ -58,6 +59,7 @@
     "@types/node": "^25.9.1",
     "@types/react": "^19.2.15",
     "@types/react-dom": "^19.2.3",
+    "@vitest/coverage-v8": "^4.1.7",
     "tailwindcss": "^4.3.0",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",