@sideboard-ai/core 0.1.174 → 0.1.175

package/dist/{chunk-XXIH6XYR.js → chunk-NQTKRAUF.js}

@@ -2,6 +2,9 @@ import {
   isElectronLikeCommand,
   wrapElectronAsNodeLaunch
 } from "./chunk-4TR3HZFT.js";
+import {
+  appDataDir
+} from "./chunk-EFVFB2AH.js";
 import {
   run
 } from "./chunk-UFHNSFAS.js";
@@ -301,14 +304,139 @@ function formatTurnExitError(exitCode, stderrSummary) {
   return `exit ${code}: ${detail}`;
 }
 
+// src/http/system-ca.ts
+import { spawnSync } from "child_process";
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "fs";
+import { dirname, join } from "path";
+import tls from "tls";
+var NODE_USE_SYSTEM_CA = "NODE_USE_SYSTEM_CA";
+var NODE_EXTRA_CA_CERTS = "NODE_EXTRA_CA_CERTS";
+var BUNDLE_NAME = "system-ca.pem";
+var BUNDLE_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var LINUX_CA_FILES = [
+  "/etc/ssl/certs/ca-certificates.crt",
+  "/etc/pki/tls/certs/ca-bundle.crt",
+  "/etc/ssl/ca-bundle.pem",
+  "/etc/ssl/cert.pem"
+];
+var PEM_CERT_RE = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
+function splitPemCertificates(pem) {
+  return pem.match(PEM_CERT_RE) ?? [];
+}
+function readExistingFile(path) {
+  try {
+    return existsSync(path) ? readFileSync(path, "utf8") : "";
+  } catch {
+    return "";
+  }
+}
+function darwinKeychainPem(spawn) {
+  const result = spawn("/usr/bin/security", ["find-certificate", "-a", "-p"], {
+    encoding: "utf8",
+    maxBuffer: 32 * 1024 * 1024,
+    timeout: 15e3
+  });
+  if (result.status !== 0) return "";
+  return typeof result.stdout === "string" ? result.stdout : "";
+}
+function linuxSystemCaPem() {
+  for (const path of LINUX_CA_FILES) {
+    const pem = readExistingFile(path);
+    if (splitPemCertificates(pem).length > 0) return pem;
+  }
+  return "";
+}
+function collectSystemCaPem(io = {}) {
+  const platform = io.platform ?? process.platform;
+  if (platform === "darwin") {
+    return darwinKeychainPem(io.spawn ?? spawnSync);
+  }
+  if (platform === "linux") {
+    return linuxSystemCaPem();
+  }
+  return "";
+}
+function systemCaBundlePath(io = {}) {
+  return join((io.appData ?? appDataDir)(), BUNDLE_NAME);
+}
+function bundleIsFresh(path, now) {
+  try {
+    if (!existsSync(path)) return false;
+    if (splitPemCertificates(readFileSync(path, "utf8")).length === 0) return false;
+    return now - statSync(path).mtimeMs < BUNDLE_MAX_AGE_MS;
+  } catch {
+    return false;
+  }
+}
+function materializeSystemCaBundle(io = {}) {
+  const inherited = process.env.NODE_EXTRA_CA_CERTS?.trim();
+  if (inherited && splitPemCertificates(readExistingFile(inherited)).length > 0) {
+    return inherited;
+  }
+  const platform = io.platform ?? process.platform;
+  if (platform === "linux") {
+    for (const path of LINUX_CA_FILES) {
+      if (splitPemCertificates(readExistingFile(path)).length > 0) return path;
+    }
+  }
+  const dest = systemCaBundlePath(io);
+  const now = (io.now ?? Date.now)();
+  if (bundleIsFresh(dest, now)) return dest;
+  const pem = collectSystemCaPem(io);
+  if (splitPemCertificates(pem).length === 0) {
+    return existsSync(dest) && splitPemCertificates(readExistingFile(dest)).length > 0 ? dest : void 0;
+  }
+  try {
+    mkdirSync(dirname(dest), { recursive: true });
+    writeFileSync(dest, pem.endsWith("\n") ? pem : `${pem}
+`, { mode: 384 });
+    return dest;
+  } catch {
+    return void 0;
+  }
+}
+function applySystemCaEnv(env) {
+  if (!String(env[NODE_USE_SYSTEM_CA] ?? "").trim()) {
+    env[NODE_USE_SYSTEM_CA] = "1";
+  }
+  if (String(env[NODE_EXTRA_CA_CERTS] ?? "").trim()) return;
+  const inherited = process.env.NODE_EXTRA_CA_CERTS?.trim();
+  if (inherited) env[NODE_EXTRA_CA_CERTS] = inherited;
+}
+function extraCertsFromBundle() {
+  const path = process.env.NODE_EXTRA_CA_CERTS?.trim();
+  if (path) return splitPemCertificates(readExistingFile(path));
+  const dest = systemCaBundlePath();
+  return splitPemCertificates(readExistingFile(dest));
+}
+function trustSystemCertificates(io = {}) {
+  try {
+    const api = tls;
+    if (typeof api.getCACertificates !== "function" || typeof api.setDefaultCACertificates !== "function") {
+      return false;
+    }
+    const current = api.getCACertificates("default");
+    const system = api.getCACertificates("system");
+    let extra = extraCertsFromBundle();
+    if (system.length === 0 && extra.length === 0) {
+      extra = splitPemCertificates(collectSystemCaPem(io));
+    }
+    if (system.length === 0 && extra.length === 0) return false;
+    api.setDefaultCACertificates([...current, ...system, ...extra]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // src/agents/node-launch.ts
-import { existsSync as existsSync2, readdirSync, realpathSync } from "fs";
+import { existsSync as existsSync3, readdirSync, realpathSync } from "fs";
 import { homedir } from "os";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 
 // src/agents/packaged-runtime.ts
-import { existsSync } from "fs";
-import { join } from "path";
+import { existsSync as existsSync2 } from "fs";
+import { join as join2 } from "path";
 function electronResourcesPath() {
   const resources = process.resourcesPath;
   if (typeof resources !== "string" || !resources) return null;
@@ -317,36 +445,36 @@ function electronResourcesPath() {
 function packagedCursorRuntimeDir() {
   const resources = electronResourcesPath();
   if (!resources) return null;
-  const dir = join(resources, "cursor-runtime");
-  if (!existsSync(join(dir, "core-dist", "agents", "cursor-runner.js"))) return null;
+  const dir = join2(resources, "cursor-runtime");
+  if (!existsSync2(join2(dir, "core-dist", "agents", "cursor-runner.js"))) return null;
   return dir;
 }
 function packagedCursorRunnerPath() {
   const dir = packagedCursorRuntimeDir();
-  return dir ? join(dir, "core-dist", "agents", "cursor-runner.js") : null;
+  return dir ? join2(dir, "core-dist", "agents", "cursor-runner.js") : null;
 }
 function packagedMcpDir() {
   const resources = electronResourcesPath();
   if (!resources) return null;
-  const dir = join(resources, "sideboard-mcp");
-  if (!existsSync(join(dir, "core-dist", "mcp", "run-stdio.js"))) return null;
+  const dir = join2(resources, "sideboard-mcp");
+  if (!existsSync2(join2(dir, "core-dist", "mcp", "run-stdio.js"))) return null;
   return dir;
 }
 function packagedMcpStdioPath() {
   const dir = packagedMcpDir();
-  return dir ? join(dir, "core-dist", "mcp", "run-stdio.js") : null;
+  return dir ? join2(dir, "core-dist", "mcp", "run-stdio.js") : null;
 }
 function packagedBundledNodePath() {
   const resources = electronResourcesPath();
   if (!resources) return null;
-  const bin = join(resources, "node", "bin", "node");
-  if (!existsSync(bin)) return null;
+  const bin = join2(resources, "node", "bin", "node");
+  if (!existsSync2(bin)) return null;
   return bin;
 }
 function packagedCursorRipgrepCandidate(platformPkg, binName) {
   const dir = packagedCursorRuntimeDir();
   if (!dir) return null;
-  return join(dir, "node_modules", platformPkg, "bin", binName);
+  return join2(dir, "node_modules", platformPkg, "bin", binName);
 }
 
 // src/agents/node-launch.ts
@@ -367,6 +495,7 @@ function applyAgentRunnerHeapEnv(env) {
     env.NODE_OPTIONS,
     AGENT_RUNNER_MAX_OLD_SPACE_MB
   );
+  applySystemCaEnv(env);
 }
 function envWithAgentHeap(env) {
   const next = { ...env };
@@ -381,7 +510,7 @@ function unpackedAsarPath(filePath) {
   if (!isAsarPath(filePath)) return null;
   const unpacked = filePath.replace(/\.asar(?=[/\\])/, ".asar.unpacked");
   if (unpacked === filePath) return null;
-  return existsSync2(unpacked) ? unpacked : null;
+  return existsSync3(unpacked) ? unpacked : null;
 }
 function nodeReadableScriptPath(scriptPath) {
   return unpackedAsarPath(scriptPath) ?? scriptPath;
@@ -422,7 +551,7 @@ function pickPreferredNode(candidates) {
   return best;
 }
 function versionDirNodeBins(root, toBin) {
-  if (!existsSync2(root)) return [];
+  if (!existsSync3(root)) return [];
   try {
     return readdirSync(root).map(toBin);
   } catch {
@@ -431,28 +560,28 @@ function versionDirNodeBins(root, toBin) {
 }
 function defaultNodeBinCandidates(home = homedir()) {
   const kegs = ["/opt/homebrew", "/usr/local"].flatMap(
-    (prefix) => PREFERRED_LTS_MAJORS.map((major) => join2(prefix, "opt", `node@${major}`, "bin", "node"))
+    (prefix) => PREFERRED_LTS_MAJORS.map((major) => join3(prefix, "opt", `node@${major}`, "bin", "node"))
   );
   return [
     ...kegs,
     "/opt/homebrew/bin/node",
     "/usr/local/bin/node",
-    join2(home, ".local/share/fnm/aliases/default/bin/node"),
-    join2(home, ".nvm/current/bin/node"),
-    join2(home, ".volta/bin/node"),
-    join2(home, ".asdf/shims/node"),
-    join2(home, ".local/share/mise/shims/node"),
+    join3(home, ".local/share/fnm/aliases/default/bin/node"),
+    join3(home, ".nvm/current/bin/node"),
+    join3(home, ".volta/bin/node"),
+    join3(home, ".asdf/shims/node"),
+    join3(home, ".local/share/mise/shims/node"),
     ...versionDirNodeBins(
-      join2(home, ".nvm", "versions", "node"),
-      (name) => join2(home, ".nvm", "versions", "node", name, "bin", "node")
+      join3(home, ".nvm", "versions", "node"),
+      (name) => join3(home, ".nvm", "versions", "node", name, "bin", "node")
     ),
     ...versionDirNodeBins(
-      join2(home, ".local/share/fnm", "node-versions"),
-      (name) => join2(home, ".local/share/fnm", "node-versions", name, "installation", "bin", "node")
+      join3(home, ".local/share/fnm", "node-versions"),
+      (name) => join3(home, ".local/share/fnm", "node-versions", name, "installation", "bin", "node")
     ),
     ...versionDirNodeBins(
-      join2(home, ".volta", "tools", "image", "node"),
-      (name) => join2(home, ".volta", "tools", "image", "node", name, "bin", "node")
+      join3(home, ".volta", "tools", "image", "node"),
+      (name) => join3(home, ".volta", "tools", "image", "node", name, "bin", "node")
     )
   ];
 }
@@ -461,7 +590,7 @@ function uniqueExistingNodeBins(paths) {
   const out = [];
   for (const raw of paths) {
     const p = raw.trim();
-    if (!p || !existsSync2(p) || isElectronLikeCommand(p)) continue;
+    if (!p || !existsSync3(p) || isElectronLikeCommand(p)) continue;
     let key = p;
     try {
       key = realpathSync(p);
@@ -854,9 +983,9 @@ function parseCursorRunnerLine(line) {
 }
 
 // src/agents/cursor-ripgrep.ts
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { createRequire } from "module";
-import { dirname, isAbsolute, join as join3, parse, resolve as resolvePath } from "path";
+import { dirname as dirname2, isAbsolute, join as join4, parse, resolve as resolvePath } from "path";
 var RIPGREP_ENV = "CURSOR_RIPGREP_PATH";
 function rgBinaryName() {
   return process.platform === "win32" ? "rg.exe" : "rg";
@@ -868,19 +997,19 @@ function usableRipgrepPath(candidate) {
   const raw = candidate?.trim();
   if (!raw || !isAbsolute(raw)) return null;
   const readable = nodeReadableScriptPath(raw);
-  if (!existsSync3(readable) || isAsarPath(readable)) return null;
+  if (!existsSync4(readable) || isAsarPath(readable)) return null;
   return readable;
 }
 function walkForBundledRipgrep(startFile) {
   if (!startFile) return null;
   const pkg = platformRipgrepPackage();
   const name = rgBinaryName();
-  let dir = dirname(resolvePath(startFile));
+  let dir = dirname2(resolvePath(startFile));
   const root = parse(dir).root;
   while (dir !== root) {
-    const hit = usableRipgrepPath(join3(dir, "node_modules", pkg, "bin", name));
+    const hit = usableRipgrepPath(join4(dir, "node_modules", pkg, "bin", name));
     if (hit) return hit;
-    const next = dirname(dir);
+    const next = dirname2(dir);
     if (next === dir) break;
     dir = next;
   }
@@ -890,7 +1019,7 @@ function requireResolveBundledRipgrep(fromFile) {
   try {
     const req = createRequire(fromFile);
     const pkgJson = req.resolve(`${platformRipgrepPackage()}/package.json`);
-    return usableRipgrepPath(join3(dirname(pkgJson), "bin", rgBinaryName()));
+    return usableRipgrepPath(join4(dirname2(pkgJson), "bin", rgBinaryName()));
   } catch {
     return null;
   }
@@ -934,6 +1063,9 @@ export {
   shouldFeedErrorBackToAgent,
   formatAgentErrorContinuePrompt,
   formatTurnExitError,
+  materializeSystemCaBundle,
+  applySystemCaEnv,
+  trustSystemCertificates,
   packagedCursorRunnerPath,
   packagedMcpDir,
   packagedMcpStdioPath,

package/dist/{chunk-CUA4S537.js → chunk-QTJ2ERA6.js}

@@ -1,6 +1,6 @@
 import {
   isOrchestratorThread
-} from "./chunk-ZY7K4T37.js";
+} from "./chunk-NA7P3SZL.js";
 import {
   codexUnattendedGitConfigArgs,
   mergeAgentGitAuthEnv,
@@ -12,10 +12,10 @@ import {
   brightsyMcpServerName,
   ensureCliTeamTracked,
   ensureConnectedBrightsyTeamTokens
-} from "./chunk-XD2BAANL.js";
+} from "./chunk-IEEAVWAP.js";
 import {
   loadBrightsyConfig
-} from "./chunk-M267JPEA.js";
+} from "./chunk-AN3THU7F.js";
 import {
   applyAgentRunnerHeapEnv,
   applyNodeLaunch,
@@ -29,7 +29,7 @@ import {
   packagedMcpStdioPath,
   parseCursorRunnerLine,
   resolveNodeLaunch
-} from "./chunk-XXIH6XYR.js";
+} from "./chunk-NQTKRAUF.js";
 import {
   claudeChromeEnabled,
   isAbleTimeConnected,
@@ -1898,7 +1898,7 @@ var claudeAdapter = {
       );
     }
     const mode = permissionMode(thread);
-    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-VDFSU3DD.js");
+    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-KPROJ54C.js");
     const isOrchestrator = isOrchestratorThread2(thread);
     const injectedServers = await buildInjectedMcpServers({
       includeSideboard: true,

package/dist/{chunk-YEPVWJ3R.js → chunk-RCICB4OM.js}

@@ -33,7 +33,7 @@ import {
   summarizeTurnStderr,
   toolDescription,
   turnFailChatText
-} from "./chunk-TPPZXZTA.js";
+} from "./chunk-ZXHV3NHY.js";
 import {
   extractPresentedPlan,
   readPlanFile,
@@ -64,7 +64,7 @@ import {
   stageAbsolutePathsAsAttachments,
   stageBuffersAsAttachments,
   syncWorkspacesFromThreads
-} from "./chunk-VCVBICMZ.js";
+} from "./chunk-TNOLCU5B.js";
 import {
   addPrStackLayer,
   allocateTeamName,
@@ -401,7 +401,7 @@ async function continueSourceThread(threadId, prompt) {
       await continueOnReply(threadId, prompt);
       return;
     }
-    const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-DMSSC4SV.js");
+    const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-QSNGJ2ER.js");
     await getOrchestrator2().send(threadId, prompt);
   } catch {
   }
@@ -794,9 +794,9 @@ async function spawnAgentTurn(thread, input, onEvent) {
       `Cannot spawn ${thread.agent}: thread ${thread.id} has no worktreePath`
     );
   }
-  const { isGlobalThread: isGlobalThread2 } = await import("./global-workspace-KA7T26F5.js");
+  const { isGlobalThread: isGlobalThread2 } = await import("./global-workspace-WSQNEALF.js");
   if (isGlobalThread2(thread)) {
-    const { ensureGlobalCoordinatorCwd: ensureGlobalCoordinatorCwd2 } = await import("./coordinator-prompt-K3HXEPFD.js");
+    const { ensureGlobalCoordinatorCwd: ensureGlobalCoordinatorCwd2 } = await import("./coordinator-prompt-XCQCGUED.js");
     ensureGlobalCoordinatorCwd2(
       isOrchestratorThread(thread) ? { orchestratorThreadId: thread.id } : void 0
     );
@@ -3555,7 +3555,7 @@ async function createThread(input, _onSetupLine) {
   let sourceIsFork = false;
   if (!input.cowboy && sourceType === "branch" && (!sourceRef || sourceRef === "HEAD" || sourceRef === "default")) {
     if (isAbleTimeConnected() && getIssueSource() === "abletime") {
-      const { ensureAbleTimeTask, issueAttachmentForAbleTimeTask } = await import("./abletime-PCLL36HW.js");
+      const { ensureAbleTimeTask, issueAttachmentForAbleTimeTask } = await import("./abletime-BFIDZR3O.js");
       const task = await ensureAbleTimeTask({
         title: title?.trim() || "Untitled work",
         description: input.prompt?.trim() || void 0
@@ -4063,7 +4063,7 @@ async function adoptThread(input) {
     messages: input.messages ?? []
   });
   writeThread(thread);
-  const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-GOGBPATJ.js");
+  const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-P66DGCZE.js");
   await ensureWorkspace2(repoPath);
   const { ensureWorktreeSideboardIgnored: ensureWorktreeSideboardIgnored2 } = await import("./worktree-exclude-N5X5I422.js");
   await ensureWorktreeSideboardIgnored2(input.worktreePath);
@@ -6339,7 +6339,7 @@ function formatScheduledPrompt(name, prompt) {
 ${prompt}`;
 }
 async function defaultDeps() {
-  const { getOrchestrator: getOrchestrator2, startOrchestration: startOrchestration2 } = await import("./orchestrator-DMSSC4SV.js");
+  const { getOrchestrator: getOrchestrator2, startOrchestration: startOrchestration2 } = await import("./orchestrator-QSNGJ2ER.js");
   const orch = getOrchestrator2();
   return {
     findThread: (id) => findThreadByRef(id),
@@ -8425,7 +8425,7 @@ var Orchestrator = class {
     this.emit({ type: "status_changed", threadId: archived.id, status: "archived" });
     if (thread.repoPath && !isGlobalRepoPath(thread.repoPath)) {
       try {
-        const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-GOGBPATJ.js");
+        const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-P66DGCZE.js");
         await ensureWorkspace2(thread.repoPath);
       } catch {
       }

package/dist/{chunk-CMJ2FBBV.js → chunk-RE2YWFUQ.js}

@@ -1,6 +1,6 @@
 import {
   httpFetch
-} from "./chunk-ELBYOGVA.js";
+} from "./chunk-N7WZ6NIN.js";
 import {
   getAbleTimeAccessToken,
   getAbleTimeHost,

package/dist/{chunk-VCVBICMZ.js → chunk-TNOLCU5B.js}

@@ -345,7 +345,7 @@ var COORDINATOR_TOOL_PLAYBOOK = [
   "Workspaces:",
   "- add_workspace / remove_workspace \u2014 register or unregister a git repo",
   "Worktree threads (chats):",
-  "- create_thread \u2014 create a worktree + chat from branch | pr | ticket (appears on Home). Do not create a second worktree for a ticket, PR, or named branch that already has one \u2014 that call returns the live thread (alreadyStarted=true). Creating from the default branch still opens a new isolated worktree. Pass repoPath + parentThreadId; omit agent and model to use Sideboard Account defaults (Settings \u2192 Default agent, model & effort). If the repo has a setup script, Sideboard runs it in the background (does not block send_to_thread). If you are Codex, do not set agent=codex (nested Codex deadlocks)",
+  "- create_thread \u2014 create a worktree + chat from branch | pr | ticket (appears on Home). Do not create a second worktree for a ticket, PR, or named branch that already has one \u2014 that call returns the live thread (alreadyStarted=true). Creating from the default branch still opens a new isolated worktree. Pass repoPath + parentThreadId; omit agent and model so Sideboard applies Settings \u2192 Default agent, model & effort (never pass your own agent or agent=cursor). If the repo has a setup script, Sideboard runs it in the background (does not block send_to_thread). Nested Codex (you are Codex and the child is Codex) deadlocks \u2014 omit agent; Sideboard coerces that case",
   "- start_board_card \u2014 same as create_thread for a ticket/PR/named branch (attaches issue text when resolvable). Then send_to_thread.",
   "- fork_worktree \u2014 fork a worktree chat into a NEW git worktree + chat (transcript attached); optional agent; leave model unset (Auto) unless you have a reason. Not for orchestration chats.",
   "- fork_chat \u2014 fork a worktree chat (same worktree tab) OR a Global orchestration chat (new orchestration tab); optional agent; leave model unset (Auto) unless you have a reason. Remote coordinators: use this to continue another orchestration chat on a different agent after session limits.",
@@ -486,8 +486,8 @@ function ensureGlobalCoordinatorCwd(opts) {
     "",
     "When creating threads, pass `repoPath` from `list_workspaces` (or the path you just registered).",
     orchId ? `Pass parentThreadId="${orchId}" (or omit it). Never invent another parentThreadId.` : "Pass `parentThreadId` for children (this chat's id from the turn reminder).",
-    "Omit `agent` / `model` on `create_thread` unless you have a reason to override Account defaults.",
-    "Never pass `agent=codex` when you yourself are Codex \u2014 nested Codex deadlocks on shared ~/.codex locks. Omit agent (Account default) or use cursor/claude.",
+    "Omit `agent` / `model` on `create_thread`. Sideboard applies Settings \u2192 Default agent, model & effort. Do not pass your own agent or `agent=cursor` \u2014 those are ignored.",
+    "Never pass `agent=codex` when you yourself are Codex \u2014 nested Codex deadlocks on shared ~/.codex locks. Omit agent; Sideboard applies Account defaults (and coerces only that nested-Codex case).",
     "Typical flow (Home board): list_board \u2192 create_thread (sourceType=ticket|pr|branch) \u2192 send_to_thread \u2192 wait_for_turn (loop while stillRunning) \u2192 ask_git create-draft \u2192 wait_for_turn. Merge only if the user explicitly asked (`ask_git` merge).",
     "Typical flow (branch / explicit source): list_workspaces \u2192 list_branches|list_prs|list_issues \u2192 create_thread \u2192 send_to_thread \u2192 wait_for_turn (loop while stillRunning) \u2192 ask_git create-draft.",
     "Typical flow (find work): list_workspaces \u2192 pick repo(s) matching account / project context \u2192 Sideboard list_issues / linear_* (tickets) or list_prs(queue=review) (reviews) \u2192 show the options. Never wait on Claude Linear MCP. Only create_thread + send_to_thread when they asked to start (e.g. \u201Cfind me work and start it\u201D) \u2014 then wait_for_turn (loop while stillRunning) \u2192 ask_git create-draft.",

package/dist/{chunk-6GN5WPYZ.js → chunk-VKQGAWHY.js}

@@ -3,17 +3,26 @@
 
 // src/http/fetch.ts
 var injected = null;
+var TLS_ISSUER_RE = /UNABLE_TO_GET_ISSUER_CERT|UNABLE_TO_VERIFY_LEAF_SIGNATURE|SELF_SIGNED_CERT_IN_CHAIN/i;
+var TLS_ISSUER_HINT = " \u2014 Node rejected the TLS certificate (corporate VPN/proxy CA). Desktop Linear can still work; reconnecting the API key will not fix this.";
+function tlsIssuerHint(code, message) {
+  const text = `${code ?? ""} ${message}`;
+  return TLS_ISSUER_RE.test(text) ? TLS_ISSUER_HINT : "";
+}
 function formatFetchError(err, url) {
   if (!(err instanceof Error)) return `${String(err)} (${url})`;
   const cause = err.cause;
   let detail = "";
+  let hint = tlsIssuerHint(void 0, err.message);
   if (cause instanceof Error) {
     const code = typeof cause.code === "string" ? cause.code : void 0;
     detail = code ? ` [${code}: ${cause.message}]` : ` [${cause.message}]`;
+    hint = tlsIssuerHint(code, `${err.message} ${cause.message}`) || hint;
   } else if (cause != null) {
     detail = ` [${String(cause)}]`;
+    hint = tlsIssuerHint(void 0, String(cause)) || hint;
   }
-  return `${err.message}${detail} (${url})`;
+  return `${err.message}${detail} (${url})${hint}`;
 }
 async function httpFetch(input, init) {
   const url = typeof input === "string" ? input : input.href;

package/dist/{chunk-S42XV45P.js → chunk-Y4MIXGPA.js}

@@ -2,7 +2,7 @@
 
 import {
   formatFetchError
-} from "./chunk-6GN5WPYZ.js";
+} from "./chunk-VKQGAWHY.js";
 
 // src/brightsy/config.ts
 import { existsSync, readFileSync, writeFileSync } from "fs";