@sideboard-ai/core 0.1.148 → 0.1.150

package/dist/{chunk-KPIYENTF.js → chunk-FNQNJOHY.js}

@@ -99,17 +99,93 @@ function withExportedPath(command, pathValue) {
   return `export PATH=${posixShellSingleQuote(pathValue)} && ${trimmed}`;
 }
 
+// src/git/github-agent-auth.ts
+import { chmodSync, existsSync as existsSync2, mkdirSync, writeFileSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname, join as join2 } from "path";
+function githubAgentAuthDir() {
+  const override = process.env.SIDEBOARD_GIT_AUTH_DIR?.trim();
+  if (override) return override;
+  return join2(homedir2(), ".sideboard-git-auth");
+}
+function githubCredentialStorePath() {
+  return join2(githubAgentAuthDir(), "git-credentials");
+}
+function githubGhConfigDir() {
+  return join2(githubAgentAuthDir(), "gh");
+}
+function writePrivateFile(file, body) {
+  mkdirSync(dirname(file), { recursive: true, mode: 448 });
+  try {
+    chmodSync(dirname(file), 448);
+  } catch {
+  }
+  writeFileSync(file, body, { encoding: "utf8", mode: 384 });
+  try {
+    chmodSync(file, 384);
+  } catch {
+  }
+}
+function gitCredentialStoreContents(token) {
+  return `https://x-access-token:${encodeURIComponent(token)}@github.com
+`;
+}
+function ghHostsYml(token, user = "x-access-token") {
+  const u = user.replace(/[^A-Za-z0-9._-]/g, "") || "x-access-token";
+  return [
+    "github.com:",
+    "    git_protocol: https",
+    `    user: ${u}`,
+    `    oauth_token: ${token}`,
+    "    users:",
+    `        ${u}:`,
+    `            oauth_token: ${token}`,
+    ""
+  ].join("\n");
+}
+function materializeGithubAgentAuth(token, user) {
+  const trimmed = token.trim();
+  if (!trimmed) return;
+  const root = githubAgentAuthDir();
+  mkdirSync(root, { recursive: true, mode: 448 });
+  try {
+    chmodSync(root, 448);
+  } catch {
+  }
+  writePrivateFile(githubCredentialStorePath(), gitCredentialStoreContents(trimmed));
+  const ghDir = githubGhConfigDir();
+  mkdirSync(ghDir, { recursive: true, mode: 448 });
+  writePrivateFile(join2(ghDir, "hosts.yml"), ghHostsYml(trimmed, user));
+  writePrivateFile(join2(ghDir, "config.yml"), "git_protocol: https\nprompt: disabled\n");
+}
+function githubAgentAuthReady() {
+  return existsSync2(githubCredentialStorePath()) && existsSync2(join2(githubGhConfigDir(), "hosts.yml"));
+}
+function githubCredentialHelperGitConfig() {
+  const file = githubCredentialStorePath();
+  return [
+    { key: "credential.helper", value: "" },
+    { key: "credential.helper", value: `store --file=${file}` }
+  ];
+}
+function githubGhConfigEnv() {
+  return {
+    GH_CONFIG_DIR: githubGhConfigDir(),
+    GH_PROMPT_DISABLED: "1"
+  };
+}
+
 // src/git/stale-lock.ts
-import { existsSync as existsSync2, statSync, unlinkSync } from "fs";
-import { join as join2 } from "path";
+import { existsSync as existsSync3, statSync, unlinkSync } from "fs";
+import { join as join3 } from "path";
 var STALE_INDEX_LOCK_MS = 2e4;
 function isIndexLockError(text) {
   return /Unable to create ['"][^'"]*index\.lock['"]: File exists/i.test(text);
 }
 function clearStaleIndexLock(gitDir, maxAgeMs = STALE_INDEX_LOCK_MS, now = Date.now()) {
-  const lockPath = join2(gitDir, "index.lock");
+  const lockPath = join3(gitDir, "index.lock");
   try {
-    if (!existsSync2(lockPath)) return null;
+    if (!existsSync3(lockPath)) return null;
     if (now - statSync(lockPath).mtimeMs < maxAgeMs) return null;
     unlinkSync(lockPath);
     return lockPath;
@@ -211,7 +287,10 @@ async function gh(args, cwd, opts) {
     timeoutMs: opts?.timeoutMs,
     env: {
       GH_PROMPT_DISABLED: "1",
-      GIT_TERMINAL_PROMPT: "0"
+      GIT_TERMINAL_PROMPT: "0",
+      // Isolated hosts.yml uses git_protocol: https so `gh pr create` does not
+      // shell out over SSH when Settings → Git is SSH (ask_git in Electron).
+      ...githubAgentAuthReady() ? githubGhConfigEnv() : {}
     }
   });
 }
@@ -230,6 +309,11 @@ export {
   posixShellSingleQuote,
   resolveCommandBinarySync,
   withExportedPath,
+  githubAgentAuthDir,
+  materializeGithubAgentAuth,
+  githubAgentAuthReady,
+  githubCredentialHelperGitConfig,
+  githubGhConfigEnv,
   clearStaleIndexLocks,
   run,
   resolveGitDirsForLockRecovery,

package/dist/{chunk-ED4UPEJX.js → chunk-G7SIQFBQ.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-S42XV45P.js";
 import {
   run
-} from "./chunk-KPIYENTF.js";
+} from "./chunk-FNQNJOHY.js";
 import {
   appDataDir
 } from "./chunk-BD2ICC4D.js";

package/dist/{chunk-3QRGCKYL.js → chunk-HAS5EPBS.js}

@@ -1,10 +1,10 @@
 import {
   isGlobalRepoPath
-} from "./chunk-R4JP32P5.js";
+} from "./chunk-AF6O55PJ.js";
 import {
   ensureGhPreferOrigin,
   resolveRepoRoot
-} from "./chunk-YP3CSOZ6.js";
+} from "./chunk-ZGFYFVJF.js";
 import {
   appDataDir
 } from "./chunk-QZQEXME2.js";

package/dist/{chunk-WT5HSFOU.js → chunk-HEII7W3Q.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-4TR3HZFT.js";
 import {
   run
-} from "./chunk-DVM4ID64.js";
+} from "./chunk-UFHNSFAS.js";
 
 // src/agents/error-detail.ts
 function formatUnknownDetail(err) {
@@ -139,7 +139,7 @@ function looksLikeRetryableRunnerCrash(text) {
   const lower = text.trim().toLowerCase();
   if (/cannot find (?:package|module)|err_module_not_found/.test(lower)) return false;
   if (!lower) return true;
-  return /uv_run|spineventloopinternal|libuv|homebrew node \+ shared libuv|cursor runner crashed in node|hascustomhostobject|electroninitializeicuandstartnode|nested chromium|truncated crash dump|connection stalled|sig(?:segv|abrt|ill)|segmentation fault|illegal instruction|fatal error/.test(
+  return /uv_run|spineventloopinternal|libuv|homebrew node \+ shared libuv|cursor runner crashed in node|hascustomhostobject|electroninitializeicuandstartnode|nested chromium|truncated crash dump|connection stalled|network request failed|cursor startup failed:.+\(retryable\)|sig(?:segv|abrt|ill)|segmentation fault|illegal instruction|fatal error/.test(
     lower
   );
 }
@@ -207,6 +207,9 @@ function humanizeAgentFailDetail(detail) {
   if (/connection stalled/.test(lower)) {
     return /retry the turn/i.test(raw) ? raw : `${raw} \u2014 retry the turn (Sideboard will start a fresh Cursor session).`;
   }
+  if (/network request failed|cursor startup failed:.+\(retryable\)/.test(lower)) {
+    return /retry the turn/i.test(raw) ? raw : `${raw} \u2014 retry the turn (a transient Cursor SDK network error).`;
+  }
   return raw;
 }
 function turnFailChatText(opts) {

package/dist/{chunk-EGDRPA4B.js → chunk-NOTANBYC.js}

@@ -1,9 +1,9 @@
 import {
   resolveGithubRepoSlug
-} from "./chunk-YP3CSOZ6.js";
+} from "./chunk-ZGFYFVJF.js";
 import {
   resolveThreadDefaults
-} from "./chunk-I77RYPOH.js";
+} from "./chunk-4XNSGDXE.js";
 import {
   globalAgentCwd,
   sideboardReposDir
@@ -45,8 +45,8 @@ var COORDINATOR_TOOL_PLAYBOOK = [
   "Discover:",
   "- list_workspaces \u2014 registered repos (path + github slug when known)",
   "- list_board \u2014 Home Kanban of worktrees (New / Draft / Review / Merged; one card per checkout). Path to merge: no PR \u2192 draft PR \u2192 open PR \u2192 merged. Archive removes the card to Settings \u2192 History. Queued/running are activity on the card, not columns. Orchestration chats are not on the board. Filters: query, repoPath, kind, column, limit.",
-  "- list_branches / list_prs / list_issues \u2014 pass repoPath from list_workspaces (issues: Linear, AbleTime MCP, or GitHub Issues)",
-  "- linear_list_teams / linear_get_issue / linear_create_issue / linear_update_issue / linear_comment \u2014 Linear Account connection; call linear_list_teams for team key and workflow states; pass ENG-123 or uuid. linear_get_issue returns comments, relations, parent/children, and the rest of the issue metadata. If mutations fail with a scope error, Disconnect and Connect Linear in Account settings.",
+  "- list_branches / list_prs / list_issues \u2014 pass repoPath from list_workspaces (issues: Linear, AbleTime MCP, or GitHub Issues). list_issues accepts query and assignee (me / unassigned / all / user id) so Linear is not limited to tickets assigned to you.",
+  "- linear_list_teams / linear_search_issues / linear_get_issue / linear_create_issue / linear_update_issue / linear_comment \u2014 Linear Account connection; call linear_list_teams for team key and workflow states; pass ENG-123 or uuid. linear_search_issues finds unassigned and other people's open issues (assignee=unassigned|all|me|user). linear_get_issue returns comments, relations, parent/children, and the rest of the issue metadata. If mutations fail with a scope error, Disconnect and Connect Linear in Account settings.",
   "- abletime_orientation / abletime_list_projects / abletime_list_tasks / abletime_search_tasks / abletime_get_task / abletime_create_task / abletime_ensure_task \u2014 AbleTime Account personal access token (hosted MCP). Call orientation first. If work has no task yet, abletime_ensure_task creates one to track against (or create_thread from the default branch does that automatically when AbleTime is the preferred issue source).",
   "- list_teams / slack_list_channels / slack_list_users / slack_search / slack_read / slack_post / slack_replies \u2014 Slack workspaces from Settings \u2192 Remote; pass team_id from list_teams",
   "- Optional connectors (Vercel, Supabase, PostHog, Sentry) in Settings \u2192 Connectors inject tokens into worktree agent env when connected. Prefer official CLIs (`vercel`, `supabase`, `sentry-cli`) with those env vars. PostHog has no first-class CLI \u2014 use the HTTP API (`POSTHOG_PERSONAL_API_KEY`). If a CLI is missing, the user can Install CLI on that row (not auto-installed on Connect). Do not add vendor MCPs or ask the user to paste tokens again. Git (`gh`) stays Settings \u2192 Git; issue tracking stays Settings \u2192 Issues; Slack stays Settings \u2192 Remote (Sideboard MCP).",
@@ -65,7 +65,7 @@ var COORDINATOR_TOOL_PLAYBOOK = [
   "- fork_worktree \u2014 fork a worktree chat into a NEW git worktree + chat (transcript attached); optional agent; leave model unset (Auto) unless you have a reason. Not for orchestration chats.",
   "- fork_chat \u2014 fork a worktree chat (same worktree tab) OR a Global orchestration chat (new orchestration tab); optional agent; leave model unset (Auto) unless you have a reason. Remote coordinators: use this to continue another orchestration chat on a different agent after session limits.",
   "- send_to_thread \u2014 queue a prompt (start/continue a chat turn). force_stop: true only to replace a wrong in-flight request \u2014 never to check in, resume after a halt notice, or because wait_for_turn returned stillRunning (that kills the child mid-thought)",
-  "- wait_for_turn / get_turn_result \u2014 wait for and read the agent reply (includes last-turn usage / costUsd when the child agent reported it). wait_for_turn returns within ~45s even if the child is still working (MCP clients kill longer tool calls). If stillRunning is true, progress is a live snapshot of tools/thinking \u2014 call wait_for_turn again. status=queued with no lastActivityAt means the child has not started yet (concurrency cap) \u2014 keep waiting; do not force_stop or send a check-in. Do not send \u201Care you stuck?\u201D or assume a hang while lastActivityAt is recent. On status error, lastError (and text) is the failure \u2014 switch agent, tell the user, or retry; do not treat empty text as success. On status stopped or broken (or incomplete=true), the child was interrupted or died \u2014 resume with send_to_thread or tell the user; never treat stopped as a finished turn. Sideboard also injects a notice into this chat when a child stops unexpectedly.",
+  "- wait_for_turn / get_turn_result \u2014 wait for and read the agent reply (includes last-turn usage / costUsd when the child agent reported it). wait_for_turn returns within ~45s even if the child is still working (MCP clients kill longer tool calls). stillRunning is the source of truth \u2014 if it is false, the child is not working; do not tell the user it is running or \u201Cwaiting for a gate,\u201D even if status still says running/queued. If stillRunning is true, progress is a live snapshot of tools/thinking \u2014 call wait_for_turn again. status=queued with no lastActivityAt means the child has not started yet (concurrency cap) \u2014 keep waiting; do not force_stop or send a check-in. Do not send \u201Care you stuck?\u201D or assume a hang while lastActivityAt is recent. If stillRunning stays true across many waits with the same lastActivityAt, the child is stuck \u2014 tell the user; do not invent a gate. On status error, lastError (and text) is the failure \u2014 switch agent, tell the user, or retry; do not treat empty text as success. On status stopped or broken (or incomplete=true), the child was interrupted or died \u2014 resume with send_to_thread or tell the user; never treat stopped as a finished turn. Sideboard also injects a notice into this chat when a child stops unexpectedly.",
   "- stop_thread \u2014 force-stop: kill in-flight turn AND clear queued prompts (do not leave stale queue after an interrupt)",
   "- archive_thread / restore_thread \u2014 archive (tears down worktree when last tab) or restore",
   "Setup / run:",
@@ -74,7 +74,7 @@ var COORDINATOR_TOOL_PLAYBOOK = [
   "Inspect / review / PRs:",
   "- get_diff \u2014 compact diff summary",
   '- request_review \u2014 open a Review chat tab on a worktree thread (attaches .claude/skills/review/SKILL.md when present, else seeds that skill / local guidelines; sends "Review changes in this workspace."); then wait_for_turn (loop while stillRunning) / get_turn_result on the returned id',
-  "- ask_git \u2014 commit & push, open a draft PR, resolve conflicts, or merge. When the worktree is clean, Sideboard pushes / opens the PR itself. When dirty, it queues the worktree agent \u2014 then wait_for_turn (loop while stillRunning). Prefer this over paraphrasing.",
+  "- ask_git \u2014 commit & push, open a draft PR, resolve conflicts, or merge. When the worktree is clean, Sideboard pushes / opens the PR itself. When dirty, it queues the worktree agent \u2014 then wait_for_turn (loop while stillRunning). Prefer this over paraphrasing. If ask_git / get_thread lastError says the GraphQL/PR body is too long, the branch is already pushed \u2014 send_to_thread so the worktree agent runs `gh pr create --body-file` with a short description. Do not invent SSH or auth failures from that error.",
   '- Merge (`ask_git` action=merge / send_to_thread "Merge PR.") only when the user explicitly asked to merge that PR. Do not merge because the work looks done, CI is green, or a typical flow includes it.',
   '- Or send_to_thread with those exact phrases: "Commit and push.", "Commit, push, and open a draft PR.", "Merge the remote branch (main) into your branch and resolve conflicts. Then, commit and push your changes.", "Merge PR." (draft PRs: `gh pr create --draft -R <origin-owner/name>` using the workspace `github:` slug \u2014 never upstream). Never run git/gh from this orchestration cwd, and never merge the PR yourself.',
   "Process guides:",