@sideboard-ai/core 0.1.173 → 0.1.175

package/dist/{chunk-WE34LOLO.js → chunk-JIWRBNSO.js}

@@ -24,7 +24,7 @@ import {
   stripBrightsyNdjsonNoise,
   sumUsageList,
   toolDescription
-} from "./chunk-3F7AXVIL.js";
+} from "./chunk-QTJ2ERA6.js";
 import {
   SLACK_REPLY_FORMATTING,
   addWorkspace,
@@ -47,7 +47,7 @@ import {
   stageAbsolutePathsAsAttachments,
   stageBuffersAsAttachments,
   syncWorkspacesFromThreads
-} from "./chunk-2RM6BZQ2.js";
+} from "./chunk-NA7P3SZL.js";
 import {
   addPrStackLayer,
   allocateTeamName,
@@ -97,7 +97,7 @@ import {
   worktreeDisplayLabelForGroup,
   worktreeNameFromPath,
   worktreeSlugForTicket
-} from "./chunk-QYZYDO3F.js";
+} from "./chunk-7JIYKYLL.js";
 import {
   ATTACHMENTS_DIR,
   DETACHED_JOBS_DIR,
@@ -106,7 +106,7 @@ import {
 } from "./chunk-6K64FJDD.js";
 import {
   httpFetch
-} from "./chunk-ELBYOGVA.js";
+} from "./chunk-N7WZ6NIN.js";
 import {
   createAgentStreamCoalescer
 } from "./chunk-AXQ4ZWHK.js";
@@ -124,7 +124,7 @@ import {
   shouldRetryFailedAgentTurn,
   summarizeTurnStderr,
   turnFailChatText
-} from "./chunk-XXIH6XYR.js";
+} from "./chunk-NQTKRAUF.js";
 import {
   assertOrchestratorCapableAgent,
   childEnvWithAppSettings,
@@ -466,7 +466,7 @@ async function continueSourceThread(threadId, prompt) {
       await continueOnReply(threadId, prompt);
       return;
     }
-    const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-PEOUSLAY.js");
+    const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-PDEU75EE.js");
     await getOrchestrator2().send(threadId, prompt);
   } catch {
   }
@@ -800,9 +800,9 @@ async function spawnAgentTurn(thread, input, onEvent) {
       `Cannot spawn ${thread.agent}: thread ${thread.id} has no worktreePath`
     );
   }
-  const { isGlobalThread: isGlobalThread2 } = await import("./global-workspace-CMYSFRCM.js");
+  const { isGlobalThread: isGlobalThread2 } = await import("./global-workspace-KPROJ54C.js");
   if (isGlobalThread2(thread)) {
-    const { ensureGlobalCoordinatorCwd: ensureGlobalCoordinatorCwd2 } = await import("./coordinator-prompt-7CTI6HRH.js");
+    const { ensureGlobalCoordinatorCwd: ensureGlobalCoordinatorCwd2 } = await import("./coordinator-prompt-7OHKB5WV.js");
     ensureGlobalCoordinatorCwd2(
       isOrchestratorThread(thread) ? { orchestratorThreadId: thread.id } : void 0
     );
@@ -1381,7 +1381,7 @@ function buildSessionSeed(messages, opts) {
   for (let i = blocks.length - 1; i >= 0; i--) {
     if (keep[i]) continue;
     const next = used + blocks[i].length + 2;
-    if (next > maxChars && used > 0) break;
+    if (next > maxChars && used > 0) continue;
     keep[i] = true;
     used = next;
   }
@@ -2770,7 +2770,7 @@ function jobAlive(pid) {
 }
 function processGroupAlive(pgid) {
   if (process.platform === "win32") return false;
-  if (!Number.isInteger(pgid) || pgid <= 0) return false;
+  if (!Number.isInteger(pgid) || pgid <= 1) return false;
   try {
     process.kill(-pgid, 0);
     return true;
@@ -2813,7 +2813,7 @@ function listRunningDetachedJobs(worktreePath) {
   for (const id of ids) {
     const dir = resolveJobDir(root, id);
     const pid = readIntFile(join11(dir, "pid"));
-    if (pid != null && jobAlive(pid)) running.push(id);
+    if (jobTreeAlive(pid)) running.push(id);
   }
   return running.sort();
 }
@@ -3684,7 +3684,7 @@ async function createThread(input, _onSetupLine) {
   let sourceIsFork = false;
   if (!input.cowboy && sourceType === "branch" && (!sourceRef || sourceRef === "HEAD" || sourceRef === "default")) {
     if (isAbleTimeConnected() && getIssueSource() === "abletime") {
-      const { ensureAbleTimeTask, issueAttachmentForAbleTimeTask } = await import("./abletime-7VW4EGPT.js");
+      const { ensureAbleTimeTask, issueAttachmentForAbleTimeTask } = await import("./abletime-INEHQH6K.js");
       const task = await ensureAbleTimeTask({
         title: title?.trim() || "Untitled work",
         description: input.prompt?.trim() || void 0
@@ -3782,7 +3782,7 @@ async function createThread(input, _onSetupLine) {
   return readThread(thread.id) ?? thread;
 }
 async function listLinearIssues(agent, repoPath) {
-  const { getAdapter: getAdapter2 } = await import("./agents-7UTRNLXQ.js");
+  const { getAdapter: getAdapter2 } = await import("./agents-AWSFDB47.js");
   await requireAgent(agent, { requireLinear: true });
   const adapter = getAdapter2(agent);
   if (!adapter.listLinearIssues) {
@@ -4204,7 +4204,7 @@ async function adoptThread(input) {
     messages: input.messages ?? []
   });
   writeThread(thread);
-  const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-UYSD2STS.js");
+  const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-TEBTNS2M.js");
   await ensureWorkspace2(repoPath);
   const { ensureWorktreeSideboardIgnored: ensureWorktreeSideboardIgnored2 } = await import("./worktree-exclude-X54WSOXM.js");
   await ensureWorktreeSideboardIgnored2(input.worktreePath);
@@ -6686,7 +6686,7 @@ function formatScheduledPrompt(name, prompt) {
 ${prompt}`;
 }
 async function defaultDeps() {
-  const { getOrchestrator: getOrchestrator2, startOrchestration: startOrchestration2 } = await import("./orchestrator-PEOUSLAY.js");
+  const { getOrchestrator: getOrchestrator2, startOrchestration: startOrchestration2 } = await import("./orchestrator-PDEU75EE.js");
   const orch = getOrchestrator2();
   return {
     findThread: (id) => findThreadByRef(id),
@@ -7474,9 +7474,10 @@ var Orchestrator = class {
       ts: (/* @__PURE__ */ new Date()).toISOString()
     });
     thread = this.requireThread(threadId);
+    const gitPrompt = expandCanonicalGitRequest(prompt);
     const { agentPrompt: expandedPrompt } = expandComposerPrompt(
       thread.worktreePath,
-      prompt,
+      gitPrompt,
       {
         attachments: sentAttachments ?? thread.attachments
       }
@@ -7518,13 +7519,13 @@ var Orchestrator = class {
       artifactReminder,
       longRunningReminder
     ].filter(Boolean).join("\n\n") || void 0;
-    const prGateDirective = thread.agent !== "brightsy" && !isOrchestratorThread(thread) && mentionsPrGoal(expandedPrompt) ? formatPrGateDirective() : null;
+    const prGateDirective = thread.agent !== "brightsy" && !isOrchestratorThread(thread) && mentionsPrGoal(prompt) ? formatPrGateDirective() : null;
     const agentPrompt = [
       thread.planMode ? PLAN_MODE_INSTRUCTION : null,
       orchestrationReminder,
       prGateDirective,
       slackReplyContext,
-      expandCanonicalGitRequest(expandedPrompt)
+      expandedPrompt
     ].filter(Boolean).join("\n\n");
     if (thread.attachments.length > 0) {
       updateThread(threadId, { attachments: [] });
@@ -8771,7 +8772,7 @@ var Orchestrator = class {
     this.emit({ type: "status_changed", threadId: archived.id, status: "archived" });
     if (thread.repoPath && !isGlobalRepoPath(thread.repoPath)) {
       try {
-        const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-UYSD2STS.js");
+        const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-TEBTNS2M.js");
         await ensureWorkspace2(thread.repoPath);
       } catch {
       }
@@ -8825,7 +8826,7 @@ var Orchestrator = class {
           `Cowboy checkout missing: ${thread.worktreePath}. Re-add the project folder, then restore.`
         );
       }
-      const { createThreadWorktree: createThreadWorktree2 } = await import("./worktree-WVEDT3FM.js");
+      const { createThreadWorktree: createThreadWorktree2 } = await import("./worktree-UTDBQXSS.js");
       const slug = thread.worktreePath.split("/").pop();
       const dest = thread.worktreePath;
       await withRepoGitLock(thread.repoPath, async () => {
@@ -8935,7 +8936,7 @@ async function startOrchestration(opts) {
     sourceRef: "default",
     ...createOpts
   }).catch(async () => {
-    const { resolveDefaultBranch: resolveDefaultBranch2, resolveRepoRoot: resolveRepoRoot2 } = await import("./worktree-WVEDT3FM.js");
+    const { resolveDefaultBranch: resolveDefaultBranch2, resolveRepoRoot: resolveRepoRoot2 } = await import("./worktree-UTDBQXSS.js");
     const repo = await resolveRepoRoot2(repoPath);
     const def = await resolveDefaultBranch2(repo);
     return orch.createThread({

package/dist/{chunk-ELBYOGVA.js → chunk-N7WZ6NIN.js}

@@ -3,17 +3,26 @@ var injected = null;
 function setHttpFetchImpl(fetchImpl) {
   injected = fetchImpl;
 }
+var TLS_ISSUER_RE = /UNABLE_TO_GET_ISSUER_CERT|UNABLE_TO_VERIFY_LEAF_SIGNATURE|SELF_SIGNED_CERT_IN_CHAIN/i;
+var TLS_ISSUER_HINT = " \u2014 Node rejected the TLS certificate (corporate VPN/proxy CA). Desktop Linear can still work; reconnecting the API key will not fix this.";
+function tlsIssuerHint(code, message) {
+  const text = `${code ?? ""} ${message}`;
+  return TLS_ISSUER_RE.test(text) ? TLS_ISSUER_HINT : "";
+}
 function formatFetchError(err, url) {
   if (!(err instanceof Error)) return `${String(err)} (${url})`;
   const cause = err.cause;
   let detail = "";
+  let hint = tlsIssuerHint(void 0, err.message);
   if (cause instanceof Error) {
     const code = typeof cause.code === "string" ? cause.code : void 0;
     detail = code ? ` [${code}: ${cause.message}]` : ` [${cause.message}]`;
+    hint = tlsIssuerHint(code, `${err.message} ${cause.message}`) || hint;
   } else if (cause != null) {
     detail = ` [${String(cause)}]`;
+    hint = tlsIssuerHint(void 0, String(cause)) || hint;
   }
-  return `${err.message}${detail} (${url})`;
+  return `${err.message}${detail} (${url})${hint}`;
 }
 async function httpFetch(input, init) {
   const url = typeof input === "string" ? input : input.href;

package/dist/{chunk-2RM6BZQ2.js → chunk-NA7P3SZL.js}

@@ -5,7 +5,7 @@ import {
   resolveRepoRoot,
   takenSlugsFromThread,
   teamSlugFromName
-} from "./chunk-QYZYDO3F.js";
+} from "./chunk-7JIYKYLL.js";
 import {
   ATTACHMENTS_DIR,
   attachmentsGitignoreBody
@@ -390,7 +390,7 @@ var COORDINATOR_TOOL_PLAYBOOK = [
   "Workspaces:",
   "- add_workspace / remove_workspace \u2014 register or unregister a git repo",
   "Worktree threads (chats):",
-  "- create_thread \u2014 create a worktree + chat from branch | pr | ticket (appears on Home). Do not create a second worktree for a ticket, PR, or named branch that already has one \u2014 that call returns the live thread (alreadyStarted=true). Creating from the default branch still opens a new isolated worktree. Pass repoPath + parentThreadId; omit agent and model to use Sideboard Account defaults (Settings \u2192 Default agent, model & effort). If the repo has a setup script, Sideboard runs it in the background (does not block send_to_thread). If you are Codex, do not set agent=codex (nested Codex deadlocks)",
+  "- create_thread \u2014 create a worktree + chat from branch | pr | ticket (appears on Home). Do not create a second worktree for a ticket, PR, or named branch that already has one \u2014 that call returns the live thread (alreadyStarted=true). Creating from the default branch still opens a new isolated worktree. Pass repoPath + parentThreadId; omit agent and model so Sideboard applies Settings \u2192 Default agent, model & effort (never pass your own agent or agent=cursor). If the repo has a setup script, Sideboard runs it in the background (does not block send_to_thread). Nested Codex (you are Codex and the child is Codex) deadlocks \u2014 omit agent; Sideboard coerces that case",
   "- start_board_card \u2014 same as create_thread for a ticket/PR/named branch (attaches issue text when resolvable). Then send_to_thread.",
   "- fork_worktree \u2014 fork a worktree chat into a NEW git worktree + chat (transcript attached); optional agent; leave model unset (Auto) unless you have a reason. Not for orchestration chats.",
   "- fork_chat \u2014 fork a worktree chat (same worktree tab) OR a Global orchestration chat (new orchestration tab); optional agent; leave model unset (Auto) unless you have a reason. Remote coordinators: use this to continue another orchestration chat on a different agent after session limits.",
@@ -531,8 +531,8 @@ function ensureGlobalCoordinatorCwd(opts) {
     "",
     "When creating threads, pass `repoPath` from `list_workspaces` (or the path you just registered).",
     orchId ? `Pass parentThreadId="${orchId}" (or omit it). Never invent another parentThreadId.` : "Pass `parentThreadId` for children (this chat's id from the turn reminder).",
-    "Omit `agent` / `model` on `create_thread` unless you have a reason to override Account defaults.",
-    "Never pass `agent=codex` when you yourself are Codex \u2014 nested Codex deadlocks on shared ~/.codex locks. Omit agent (Account default) or use cursor/claude.",
+    "Omit `agent` / `model` on `create_thread`. Sideboard applies Settings \u2192 Default agent, model & effort. Do not pass your own agent or `agent=cursor` \u2014 those are ignored.",
+    "Never pass `agent=codex` when you yourself are Codex \u2014 nested Codex deadlocks on shared ~/.codex locks. Omit agent; Sideboard applies Account defaults (and coerces only that nested-Codex case).",
     "Typical flow (Home board): list_board \u2192 create_thread (sourceType=ticket|pr|branch) \u2192 send_to_thread \u2192 wait_for_turn (loop while stillRunning) \u2192 ask_git create-draft \u2192 wait_for_turn. Merge only if the user explicitly asked (`ask_git` merge).",
     "Typical flow (branch / explicit source): list_workspaces \u2192 list_branches|list_prs|list_issues \u2192 create_thread \u2192 send_to_thread \u2192 wait_for_turn (loop while stillRunning) \u2192 ask_git create-draft.",
     "Typical flow (find work): list_workspaces \u2192 pick repo(s) matching account / project context \u2192 Sideboard list_issues / linear_* (tickets) or list_prs(queue=review) (reviews) \u2192 show the options. Never wait on Claude Linear MCP. Only create_thread + send_to_thread when they asked to start (e.g. \u201Cfind me work and start it\u201D) \u2014 then wait_for_turn (loop while stillRunning) \u2192 ask_git create-draft.",

package/dist/{chunk-XXIH6XYR.js → chunk-NQTKRAUF.js}

@@ -2,6 +2,9 @@ import {
   isElectronLikeCommand,
   wrapElectronAsNodeLaunch
 } from "./chunk-4TR3HZFT.js";
+import {
+  appDataDir
+} from "./chunk-EFVFB2AH.js";
 import {
   run
 } from "./chunk-UFHNSFAS.js";
@@ -301,14 +304,139 @@ function formatTurnExitError(exitCode, stderrSummary) {
   return `exit ${code}: ${detail}`;
 }
 
+// src/http/system-ca.ts
+import { spawnSync } from "child_process";
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "fs";
+import { dirname, join } from "path";
+import tls from "tls";
+var NODE_USE_SYSTEM_CA = "NODE_USE_SYSTEM_CA";
+var NODE_EXTRA_CA_CERTS = "NODE_EXTRA_CA_CERTS";
+var BUNDLE_NAME = "system-ca.pem";
+var BUNDLE_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var LINUX_CA_FILES = [
+  "/etc/ssl/certs/ca-certificates.crt",
+  "/etc/pki/tls/certs/ca-bundle.crt",
+  "/etc/ssl/ca-bundle.pem",
+  "/etc/ssl/cert.pem"
+];
+var PEM_CERT_RE = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
+function splitPemCertificates(pem) {
+  return pem.match(PEM_CERT_RE) ?? [];
+}
+function readExistingFile(path) {
+  try {
+    return existsSync(path) ? readFileSync(path, "utf8") : "";
+  } catch {
+    return "";
+  }
+}
+function darwinKeychainPem(spawn) {
+  const result = spawn("/usr/bin/security", ["find-certificate", "-a", "-p"], {
+    encoding: "utf8",
+    maxBuffer: 32 * 1024 * 1024,
+    timeout: 15e3
+  });
+  if (result.status !== 0) return "";
+  return typeof result.stdout === "string" ? result.stdout : "";
+}
+function linuxSystemCaPem() {
+  for (const path of LINUX_CA_FILES) {
+    const pem = readExistingFile(path);
+    if (splitPemCertificates(pem).length > 0) return pem;
+  }
+  return "";
+}
+function collectSystemCaPem(io = {}) {
+  const platform = io.platform ?? process.platform;
+  if (platform === "darwin") {
+    return darwinKeychainPem(io.spawn ?? spawnSync);
+  }
+  if (platform === "linux") {
+    return linuxSystemCaPem();
+  }
+  return "";
+}
+function systemCaBundlePath(io = {}) {
+  return join((io.appData ?? appDataDir)(), BUNDLE_NAME);
+}
+function bundleIsFresh(path, now) {
+  try {
+    if (!existsSync(path)) return false;
+    if (splitPemCertificates(readFileSync(path, "utf8")).length === 0) return false;
+    return now - statSync(path).mtimeMs < BUNDLE_MAX_AGE_MS;
+  } catch {
+    return false;
+  }
+}
+function materializeSystemCaBundle(io = {}) {
+  const inherited = process.env.NODE_EXTRA_CA_CERTS?.trim();
+  if (inherited && splitPemCertificates(readExistingFile(inherited)).length > 0) {
+    return inherited;
+  }
+  const platform = io.platform ?? process.platform;
+  if (platform === "linux") {
+    for (const path of LINUX_CA_FILES) {
+      if (splitPemCertificates(readExistingFile(path)).length > 0) return path;
+    }
+  }
+  const dest = systemCaBundlePath(io);
+  const now = (io.now ?? Date.now)();
+  if (bundleIsFresh(dest, now)) return dest;
+  const pem = collectSystemCaPem(io);
+  if (splitPemCertificates(pem).length === 0) {
+    return existsSync(dest) && splitPemCertificates(readExistingFile(dest)).length > 0 ? dest : void 0;
+  }
+  try {
+    mkdirSync(dirname(dest), { recursive: true });
+    writeFileSync(dest, pem.endsWith("\n") ? pem : `${pem}
+`, { mode: 384 });
+    return dest;
+  } catch {
+    return void 0;
+  }
+}
+function applySystemCaEnv(env) {
+  if (!String(env[NODE_USE_SYSTEM_CA] ?? "").trim()) {
+    env[NODE_USE_SYSTEM_CA] = "1";
+  }
+  if (String(env[NODE_EXTRA_CA_CERTS] ?? "").trim()) return;
+  const inherited = process.env.NODE_EXTRA_CA_CERTS?.trim();
+  if (inherited) env[NODE_EXTRA_CA_CERTS] = inherited;
+}
+function extraCertsFromBundle() {
+  const path = process.env.NODE_EXTRA_CA_CERTS?.trim();
+  if (path) return splitPemCertificates(readExistingFile(path));
+  const dest = systemCaBundlePath();
+  return splitPemCertificates(readExistingFile(dest));
+}
+function trustSystemCertificates(io = {}) {
+  try {
+    const api = tls;
+    if (typeof api.getCACertificates !== "function" || typeof api.setDefaultCACertificates !== "function") {
+      return false;
+    }
+    const current = api.getCACertificates("default");
+    const system = api.getCACertificates("system");
+    let extra = extraCertsFromBundle();
+    if (system.length === 0 && extra.length === 0) {
+      extra = splitPemCertificates(collectSystemCaPem(io));
+    }
+    if (system.length === 0 && extra.length === 0) return false;
+    api.setDefaultCACertificates([...current, ...system, ...extra]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // src/agents/node-launch.ts
-import { existsSync as existsSync2, readdirSync, realpathSync } from "fs";
+import { existsSync as existsSync3, readdirSync, realpathSync } from "fs";
 import { homedir } from "os";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 
 // src/agents/packaged-runtime.ts
-import { existsSync } from "fs";
-import { join } from "path";
+import { existsSync as existsSync2 } from "fs";
+import { join as join2 } from "path";
 function electronResourcesPath() {
   const resources = process.resourcesPath;
   if (typeof resources !== "string" || !resources) return null;
@@ -317,36 +445,36 @@ function electronResourcesPath() {
 function packagedCursorRuntimeDir() {
   const resources = electronResourcesPath();
   if (!resources) return null;
-  const dir = join(resources, "cursor-runtime");
-  if (!existsSync(join(dir, "core-dist", "agents", "cursor-runner.js"))) return null;
+  const dir = join2(resources, "cursor-runtime");
+  if (!existsSync2(join2(dir, "core-dist", "agents", "cursor-runner.js"))) return null;
   return dir;
 }
 function packagedCursorRunnerPath() {
   const dir = packagedCursorRuntimeDir();
-  return dir ? join(dir, "core-dist", "agents", "cursor-runner.js") : null;
+  return dir ? join2(dir, "core-dist", "agents", "cursor-runner.js") : null;
 }
 function packagedMcpDir() {
   const resources = electronResourcesPath();
   if (!resources) return null;
-  const dir = join(resources, "sideboard-mcp");
-  if (!existsSync(join(dir, "core-dist", "mcp", "run-stdio.js"))) return null;
+  const dir = join2(resources, "sideboard-mcp");
+  if (!existsSync2(join2(dir, "core-dist", "mcp", "run-stdio.js"))) return null;
   return dir;
 }
 function packagedMcpStdioPath() {
   const dir = packagedMcpDir();
-  return dir ? join(dir, "core-dist", "mcp", "run-stdio.js") : null;
+  return dir ? join2(dir, "core-dist", "mcp", "run-stdio.js") : null;
 }
 function packagedBundledNodePath() {
   const resources = electronResourcesPath();
   if (!resources) return null;
-  const bin = join(resources, "node", "bin", "node");
-  if (!existsSync(bin)) return null;
+  const bin = join2(resources, "node", "bin", "node");
+  if (!existsSync2(bin)) return null;
   return bin;
 }
 function packagedCursorRipgrepCandidate(platformPkg, binName) {
   const dir = packagedCursorRuntimeDir();
   if (!dir) return null;
-  return join(dir, "node_modules", platformPkg, "bin", binName);
+  return join2(dir, "node_modules", platformPkg, "bin", binName);
 }
 
 // src/agents/node-launch.ts
@@ -367,6 +495,7 @@ function applyAgentRunnerHeapEnv(env) {
     env.NODE_OPTIONS,
     AGENT_RUNNER_MAX_OLD_SPACE_MB
   );
+  applySystemCaEnv(env);
 }
 function envWithAgentHeap(env) {
   const next = { ...env };
@@ -381,7 +510,7 @@ function unpackedAsarPath(filePath) {
   if (!isAsarPath(filePath)) return null;
   const unpacked = filePath.replace(/\.asar(?=[/\\])/, ".asar.unpacked");
   if (unpacked === filePath) return null;
-  return existsSync2(unpacked) ? unpacked : null;
+  return existsSync3(unpacked) ? unpacked : null;
 }
 function nodeReadableScriptPath(scriptPath) {
   return unpackedAsarPath(scriptPath) ?? scriptPath;
@@ -422,7 +551,7 @@ function pickPreferredNode(candidates) {
   return best;
 }
 function versionDirNodeBins(root, toBin) {
-  if (!existsSync2(root)) return [];
+  if (!existsSync3(root)) return [];
   try {
     return readdirSync(root).map(toBin);
   } catch {
@@ -431,28 +560,28 @@ function versionDirNodeBins(root, toBin) {
 }
 function defaultNodeBinCandidates(home = homedir()) {
   const kegs = ["/opt/homebrew", "/usr/local"].flatMap(
-    (prefix) => PREFERRED_LTS_MAJORS.map((major) => join2(prefix, "opt", `node@${major}`, "bin", "node"))
+    (prefix) => PREFERRED_LTS_MAJORS.map((major) => join3(prefix, "opt", `node@${major}`, "bin", "node"))
   );
   return [
     ...kegs,
     "/opt/homebrew/bin/node",
     "/usr/local/bin/node",
-    join2(home, ".local/share/fnm/aliases/default/bin/node"),
-    join2(home, ".nvm/current/bin/node"),
-    join2(home, ".volta/bin/node"),
-    join2(home, ".asdf/shims/node"),
-    join2(home, ".local/share/mise/shims/node"),
+    join3(home, ".local/share/fnm/aliases/default/bin/node"),
+    join3(home, ".nvm/current/bin/node"),
+    join3(home, ".volta/bin/node"),
+    join3(home, ".asdf/shims/node"),
+    join3(home, ".local/share/mise/shims/node"),
     ...versionDirNodeBins(
-      join2(home, ".nvm", "versions", "node"),
-      (name) => join2(home, ".nvm", "versions", "node", name, "bin", "node")
+      join3(home, ".nvm", "versions", "node"),
+      (name) => join3(home, ".nvm", "versions", "node", name, "bin", "node")
     ),
     ...versionDirNodeBins(
-      join2(home, ".local/share/fnm", "node-versions"),
-      (name) => join2(home, ".local/share/fnm", "node-versions", name, "installation", "bin", "node")
+      join3(home, ".local/share/fnm", "node-versions"),
+      (name) => join3(home, ".local/share/fnm", "node-versions", name, "installation", "bin", "node")
     ),
     ...versionDirNodeBins(
-      join2(home, ".volta", "tools", "image", "node"),
-      (name) => join2(home, ".volta", "tools", "image", "node", name, "bin", "node")
+      join3(home, ".volta", "tools", "image", "node"),
+      (name) => join3(home, ".volta", "tools", "image", "node", name, "bin", "node")
     )
   ];
 }
@@ -461,7 +590,7 @@ function uniqueExistingNodeBins(paths) {
   const out = [];
   for (const raw of paths) {
     const p = raw.trim();
-    if (!p || !existsSync2(p) || isElectronLikeCommand(p)) continue;
+    if (!p || !existsSync3(p) || isElectronLikeCommand(p)) continue;
     let key = p;
     try {
       key = realpathSync(p);
@@ -854,9 +983,9 @@ function parseCursorRunnerLine(line) {
 }
 
 // src/agents/cursor-ripgrep.ts
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { createRequire } from "module";
-import { dirname, isAbsolute, join as join3, parse, resolve as resolvePath } from "path";
+import { dirname as dirname2, isAbsolute, join as join4, parse, resolve as resolvePath } from "path";
 var RIPGREP_ENV = "CURSOR_RIPGREP_PATH";
 function rgBinaryName() {
   return process.platform === "win32" ? "rg.exe" : "rg";
@@ -868,19 +997,19 @@ function usableRipgrepPath(candidate) {
   const raw = candidate?.trim();
   if (!raw || !isAbsolute(raw)) return null;
   const readable = nodeReadableScriptPath(raw);
-  if (!existsSync3(readable) || isAsarPath(readable)) return null;
+  if (!existsSync4(readable) || isAsarPath(readable)) return null;
   return readable;
 }
 function walkForBundledRipgrep(startFile) {
   if (!startFile) return null;
   const pkg = platformRipgrepPackage();
   const name = rgBinaryName();
-  let dir = dirname(resolvePath(startFile));
+  let dir = dirname2(resolvePath(startFile));
   const root = parse(dir).root;
   while (dir !== root) {
-    const hit = usableRipgrepPath(join3(dir, "node_modules", pkg, "bin", name));
+    const hit = usableRipgrepPath(join4(dir, "node_modules", pkg, "bin", name));
     if (hit) return hit;
-    const next = dirname(dir);
+    const next = dirname2(dir);
     if (next === dir) break;
     dir = next;
   }
@@ -890,7 +1019,7 @@ function requireResolveBundledRipgrep(fromFile) {
   try {
     const req = createRequire(fromFile);
     const pkgJson = req.resolve(`${platformRipgrepPackage()}/package.json`);
-    return usableRipgrepPath(join3(dirname(pkgJson), "bin", rgBinaryName()));
+    return usableRipgrepPath(join4(dirname2(pkgJson), "bin", rgBinaryName()));
   } catch {
     return null;
   }
@@ -934,6 +1063,9 @@ export {
   shouldFeedErrorBackToAgent,
   formatAgentErrorContinuePrompt,
   formatTurnExitError,
+  materializeSystemCaBundle,
+  applySystemCaEnv,
+  trustSystemCertificates,
   packagedCursorRunnerPath,
   packagedMcpDir,
   packagedMcpStdioPath,

package/dist/{chunk-3F7AXVIL.js → chunk-QTJ2ERA6.js}

@@ -1,21 +1,21 @@
 import {
   isOrchestratorThread
-} from "./chunk-2RM6BZQ2.js";
+} from "./chunk-NA7P3SZL.js";
 import {
   codexUnattendedGitConfigArgs,
   mergeAgentGitAuthEnv,
   resolveAgentGitAuthEnv,
   resolveCodexGitWritableRoots
-} from "./chunk-QYZYDO3F.js";
+} from "./chunk-7JIYKYLL.js";
 import {
   applyConnectedTeamToCli,
   brightsyMcpServerName,
   ensureCliTeamTracked,
   ensureConnectedBrightsyTeamTokens
-} from "./chunk-XD2BAANL.js";
+} from "./chunk-IEEAVWAP.js";
 import {
   loadBrightsyConfig
-} from "./chunk-M267JPEA.js";
+} from "./chunk-AN3THU7F.js";
 import {
   applyAgentRunnerHeapEnv,
   applyNodeLaunch,
@@ -29,7 +29,7 @@ import {
   packagedMcpStdioPath,
   parseCursorRunnerLine,
   resolveNodeLaunch
-} from "./chunk-XXIH6XYR.js";
+} from "./chunk-NQTKRAUF.js";
 import {
   claudeChromeEnabled,
   isAbleTimeConnected,
@@ -1898,7 +1898,7 @@ var claudeAdapter = {
       );
     }
     const mode = permissionMode(thread);
-    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-CMYSFRCM.js");
+    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-KPROJ54C.js");
     const isOrchestrator = isOrchestratorThread2(thread);
     const injectedServers = await buildInjectedMcpServers({
       includeSideboard: true,