@sideboard-ai/core 0.1.174 → 0.1.175

package/dist/mcp/run-stdio.cjs

@@ -491,24 +491,156 @@ var init_paths = __esm({
   }
 });
 
+// src/http/system-ca.ts
+function splitPemCertificates(pem) {
+  return pem.match(PEM_CERT_RE) ?? [];
+}
+function readExistingFile(path) {
+  try {
+    return (0, import_node_fs5.existsSync)(path) ? (0, import_node_fs5.readFileSync)(path, "utf8") : "";
+  } catch {
+    return "";
+  }
+}
+function darwinKeychainPem(spawn2) {
+  const result = spawn2("/usr/bin/security", ["find-certificate", "-a", "-p"], {
+    encoding: "utf8",
+    maxBuffer: 32 * 1024 * 1024,
+    timeout: 15e3
+  });
+  if (result.status !== 0) return "";
+  return typeof result.stdout === "string" ? result.stdout : "";
+}
+function linuxSystemCaPem() {
+  for (const path of LINUX_CA_FILES) {
+    const pem = readExistingFile(path);
+    if (splitPemCertificates(pem).length > 0) return pem;
+  }
+  return "";
+}
+function collectSystemCaPem(io = {}) {
+  const platform = io.platform ?? process.platform;
+  if (platform === "darwin") {
+    return darwinKeychainPem(io.spawn ?? import_node_child_process.spawnSync);
+  }
+  if (platform === "linux") {
+    return linuxSystemCaPem();
+  }
+  return "";
+}
+function systemCaBundlePath(io = {}) {
+  return (0, import_node_path6.join)((io.appData ?? appDataDir)(), BUNDLE_NAME);
+}
+function bundleIsFresh(path, now) {
+  try {
+    if (!(0, import_node_fs5.existsSync)(path)) return false;
+    if (splitPemCertificates((0, import_node_fs5.readFileSync)(path, "utf8")).length === 0) return false;
+    return now - (0, import_node_fs5.statSync)(path).mtimeMs < BUNDLE_MAX_AGE_MS;
+  } catch {
+    return false;
+  }
+}
+function materializeSystemCaBundle(io = {}) {
+  const inherited = process.env.NODE_EXTRA_CA_CERTS?.trim();
+  if (inherited && splitPemCertificates(readExistingFile(inherited)).length > 0) {
+    return inherited;
+  }
+  const platform = io.platform ?? process.platform;
+  if (platform === "linux") {
+    for (const path of LINUX_CA_FILES) {
+      if (splitPemCertificates(readExistingFile(path)).length > 0) return path;
+    }
+  }
+  const dest = systemCaBundlePath(io);
+  const now = (io.now ?? Date.now)();
+  if (bundleIsFresh(dest, now)) return dest;
+  const pem = collectSystemCaPem(io);
+  if (splitPemCertificates(pem).length === 0) {
+    return (0, import_node_fs5.existsSync)(dest) && splitPemCertificates(readExistingFile(dest)).length > 0 ? dest : void 0;
+  }
+  try {
+    (0, import_node_fs5.mkdirSync)((0, import_node_path6.dirname)(dest), { recursive: true });
+    (0, import_node_fs5.writeFileSync)(dest, pem.endsWith("\n") ? pem : `${pem}
+`, { mode: 384 });
+    return dest;
+  } catch {
+    return void 0;
+  }
+}
+function applySystemCaEnv(env) {
+  if (!String(env[NODE_USE_SYSTEM_CA] ?? "").trim()) {
+    env[NODE_USE_SYSTEM_CA] = "1";
+  }
+  if (String(env[NODE_EXTRA_CA_CERTS] ?? "").trim()) return;
+  const inherited = process.env.NODE_EXTRA_CA_CERTS?.trim();
+  if (inherited) env[NODE_EXTRA_CA_CERTS] = inherited;
+}
+function extraCertsFromBundle() {
+  const path = process.env.NODE_EXTRA_CA_CERTS?.trim();
+  if (path) return splitPemCertificates(readExistingFile(path));
+  const dest = systemCaBundlePath();
+  return splitPemCertificates(readExistingFile(dest));
+}
+function trustSystemCertificates(io = {}) {
+  try {
+    const api = import_node_tls.default;
+    if (typeof api.getCACertificates !== "function" || typeof api.setDefaultCACertificates !== "function") {
+      return false;
+    }
+    const current = api.getCACertificates("default");
+    const system = api.getCACertificates("system");
+    let extra = extraCertsFromBundle();
+    if (system.length === 0 && extra.length === 0) {
+      extra = splitPemCertificates(collectSystemCaPem(io));
+    }
+    if (system.length === 0 && extra.length === 0) return false;
+    api.setDefaultCACertificates([...current, ...system, ...extra]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var import_node_child_process, import_node_fs5, import_node_path6, import_node_tls, NODE_USE_SYSTEM_CA, NODE_EXTRA_CA_CERTS, BUNDLE_NAME, BUNDLE_MAX_AGE_MS, LINUX_CA_FILES, PEM_CERT_RE;
+var init_system_ca = __esm({
+  "src/http/system-ca.ts"() {
+    "use strict";
+    import_node_child_process = require("child_process");
+    import_node_fs5 = require("fs");
+    import_node_path6 = require("path");
+    import_node_tls = __toESM(require("tls"), 1);
+    init_paths();
+    NODE_USE_SYSTEM_CA = "NODE_USE_SYSTEM_CA";
+    NODE_EXTRA_CA_CERTS = "NODE_EXTRA_CA_CERTS";
+    BUNDLE_NAME = "system-ca.pem";
+    BUNDLE_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+    LINUX_CA_FILES = [
+      "/etc/ssl/certs/ca-certificates.crt",
+      "/etc/pki/tls/certs/ca-bundle.crt",
+      "/etc/ssl/ca-bundle.pem",
+      "/etc/ssl/cert.pem"
+    ];
+    PEM_CERT_RE = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
+  }
+});
+
 // src/store/private-file.ts
 function writePrivateFile(path, contents) {
-  (0, import_node_fs5.mkdirSync)((0, import_node_path6.dirname)(path), { recursive: true });
-  (0, import_node_fs5.writeFileSync)(path, contents, { encoding: "utf8", mode: PRIVATE_FILE_MODE });
+  (0, import_node_fs6.mkdirSync)((0, import_node_path7.dirname)(path), { recursive: true });
+  (0, import_node_fs6.writeFileSync)(path, contents, { encoding: "utf8", mode: PRIVATE_FILE_MODE });
   chmodOwnerOnly(path);
 }
 function chmodOwnerOnly(path) {
   try {
-    (0, import_node_fs5.chmodSync)(path, PRIVATE_FILE_MODE);
+    (0, import_node_fs6.chmodSync)(path, PRIVATE_FILE_MODE);
   } catch {
   }
 }
-var import_node_fs5, import_node_path6, PRIVATE_FILE_MODE;
+var import_node_fs6, import_node_path7, PRIVATE_FILE_MODE;
 var init_private_file = __esm({
   "src/store/private-file.ts"() {
     "use strict";
-    import_node_fs5 = require("fs");
-    import_node_path6 = require("path");
+    import_node_fs6 = require("fs");
+    import_node_path7 = require("path");
     PRIVATE_FILE_MODE = 384;
   }
 });
@@ -517,7 +649,7 @@ var init_private_file = __esm({
 function persistVaultKeyInKeychain(key) {
   if (process.platform !== "darwin" || key.length !== 32) return;
   try {
-    (0, import_node_child_process.execFileSync)(
+    (0, import_node_child_process2.execFileSync)(
       "security",
       [
         "add-generic-password",
@@ -542,7 +674,7 @@ function hexKey(value) {
 function keychainKey(create) {
   if (process.platform !== "darwin") return null;
   try {
-    const out = (0, import_node_child_process.execFileSync)(
+    const out = (0, import_node_child_process2.execFileSync)(
       "security",
       ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-a", KEYCHAIN_ACCOUNT, "-w"],
       { encoding: "utf8", timeout: 5e3, stdio: ["ignore", "pipe", "pipe"] }
@@ -594,11 +726,11 @@ function decryptEnvelope(envelope, key) {
   return JSON.parse(plaintext.toString("utf8"));
 }
 function readSecureJson(path) {
-  if (!(0, import_node_fs6.existsSync)(path)) return null;
+  if (!(0, import_node_fs7.existsSync)(path)) return null;
   chmodOwnerOnly(path);
   let parsed;
   try {
-    parsed = JSON.parse((0, import_node_fs6.readFileSync)(path, "utf8"));
+    parsed = JSON.parse((0, import_node_fs7.readFileSync)(path, "utf8"));
   } catch {
     return null;
   }
@@ -618,20 +750,20 @@ function writeSecureJson(path, value) {
 `);
 }
 function isSecureFileEncrypted(path) {
-  if (!(0, import_node_fs6.existsSync)(path)) return false;
+  if (!(0, import_node_fs7.existsSync)(path)) return false;
   try {
-    return isEnvelope(JSON.parse((0, import_node_fs6.readFileSync)(path, "utf8")));
+    return isEnvelope(JSON.parse((0, import_node_fs7.readFileSync)(path, "utf8")));
   } catch {
     return false;
   }
 }
-var import_node_child_process, import_node_crypto, import_node_fs6, KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, ALG, injectedKey;
+var import_node_child_process2, import_node_crypto, import_node_fs7, KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, ALG, injectedKey;
 var init_secure_file = __esm({
   "src/store/secure-file.ts"() {
     "use strict";
-    import_node_child_process = require("child_process");
+    import_node_child_process2 = require("child_process");
     import_node_crypto = require("crypto");
-    import_node_fs6 = require("fs");
+    import_node_fs7 = require("fs");
     init_private_file();
     KEYCHAIN_SERVICE = "ai.sideboard.app";
     KEYCHAIN_ACCOUNT = "secret-vault-v1";
@@ -756,7 +888,7 @@ function createEmptyThread(partial) {
 }
 async function withThreadLock(id, fn) {
   const lockPath = threadLockPath(id);
-  (0, import_node_fs7.writeFileSync)(lockPath, "", { flag: "a" });
+  (0, import_node_fs8.writeFileSync)(lockPath, "", { flag: "a" });
   let release;
   try {
     release = await import_proper_lockfile.default.lock(lockPath, {
@@ -777,7 +909,7 @@ function cacheForDir() {
 }
 function fileMtimeMs(path) {
   try {
-    return (0, import_node_fs7.statSync)(path).mtimeMs;
+    return (0, import_node_fs8.statSync)(path).mtimeMs;
   } catch {
     return null;
   }
@@ -805,7 +937,7 @@ function readThread(id) {
   const cache = cacheForDir();
   const cached = cache.byId.get(id);
   if (cached && cache.mtimeMs.get(id) === mtimeMs) return cached;
-  const raw = (0, import_node_fs7.readFileSync)(path, "utf8");
+  const raw = (0, import_node_fs8.readFileSync)(path, "utf8");
   const thread = normalizeThread(JSON.parse(raw));
   rememberThread(thread, mtimeMs);
   return thread;
@@ -814,20 +946,20 @@ function writeThread(thread) {
   const path = threadFilePath(idPath(thread.id));
   const tmp = `${path}.${process.pid}.tmp`;
   const next = { ...thread, updatedAt: nowIso() };
-  (0, import_node_fs7.writeFileSync)(tmp, JSON.stringify(next, null, 2), "utf8");
-  (0, import_node_fs7.renameSync)(tmp, path);
+  (0, import_node_fs8.writeFileSync)(tmp, JSON.stringify(next, null, 2), "utf8");
+  (0, import_node_fs8.renameSync)(tmp, path);
   rememberThread(next, fileMtimeMs(path) ?? Date.now());
 }
 function idPath(id) {
   return id;
 }
 function isThreadRecordFile(nameOrPath) {
-  const name = (0, import_node_path7.basename)(nameOrPath);
+  const name = (0, import_node_path8.basename)(nameOrPath);
   return name.endsWith(".json") && !name.endsWith(".live.json");
 }
 function listThreads(opts) {
   const cache = cacheForDir();
-  const files = (0, import_node_fs7.readdirSync)(threadsDir()).filter(isThreadRecordFile);
+  const files = (0, import_node_fs8.readdirSync)(threadsDir()).filter(isThreadRecordFile);
   const seen = /* @__PURE__ */ new Set();
   for (const f of files) {
     const id = f.replace(/\.json$/, "");
@@ -850,11 +982,11 @@ function listThreads(opts) {
 function deleteThreadRecord(id) {
   forgetThread(id);
   const path = threadFilePath(id);
-  if ((0, import_node_fs7.existsSync)(path)) (0, import_node_fs7.unlinkSync)(path);
+  if ((0, import_node_fs8.existsSync)(path)) (0, import_node_fs8.unlinkSync)(path);
   const lock = threadLockPath(id);
-  if ((0, import_node_fs7.existsSync)(lock)) {
+  if ((0, import_node_fs8.existsSync)(lock)) {
     try {
-      (0, import_node_fs7.unlinkSync)(lock);
+      (0, import_node_fs8.unlinkSync)(lock);
     } catch {
     }
   }
@@ -880,13 +1012,13 @@ function findThreadByRef(ref) {
     (t) => t.id === ref || t.id.startsWith(ref) || t.branchName === ref || t.title === ref
   ) ?? null;
 }
-var import_node_crypto2, import_node_fs7, import_node_path7, import_proper_lockfile, listCache;
+var import_node_crypto2, import_node_fs8, import_node_path8, import_proper_lockfile, listCache;
 var init_thread_store = __esm({
   "src/store/thread-store.ts"() {
     "use strict";
     import_node_crypto2 = require("crypto");
-    import_node_fs7 = require("fs");
-    import_node_path7 = require("path");
+    import_node_fs8 = require("fs");
+    import_node_path8 = require("path");
     import_proper_lockfile = __toESM(require("proper-lockfile"), 1);
     init_thinking_effort();
     init_paths();
@@ -938,13 +1070,13 @@ var init_api = __esm({
 
 // src/slack/reply-target.ts
 function storePath() {
-  return (0, import_node_path8.join)(appDataDir(), "slack-reply-to.json");
+  return (0, import_node_path9.join)(appDataDir(), "slack-reply-to.json");
 }
 function readStore() {
   const path = storePath();
-  if (!(0, import_node_fs8.existsSync)(path)) return {};
+  if (!(0, import_node_fs9.existsSync)(path)) return {};
   try {
-    const parsed = isSecureFileEncrypted(path) ? readSecureJson(path) : JSON.parse((0, import_node_fs8.readFileSync)(path, "utf8"));
+    const parsed = isSecureFileEncrypted(path) ? readSecureJson(path) : JSON.parse((0, import_node_fs9.readFileSync)(path, "utf8"));
     return parsed?.targets && typeof parsed.targets === "object" ? parsed.targets : {};
   } catch {
     return {};
@@ -953,12 +1085,12 @@ function readStore() {
 function getSlackReplyTarget(threadId) {
   return readStore()[threadId] ?? null;
 }
-var import_node_fs8, import_node_path8;
+var import_node_fs9, import_node_path9;
 var init_reply_target = __esm({
   "src/slack/reply-target.ts"() {
     "use strict";
-    import_node_fs8 = require("fs");
-    import_node_path8 = require("path");
+    import_node_fs9 = require("fs");
+    import_node_path9 = require("path");
     init_paths();
     init_private_file();
     init_secure_file();
@@ -967,7 +1099,7 @@ var init_reply_target = __esm({
 
 // src/slack/workspaces.ts
 function storePath2() {
-  return (0, import_node_path9.join)(appDataDir(), "slack-workspaces.json");
+  return (0, import_node_path10.join)(appDataDir(), "slack-workspaces.json");
 }
 function readStore2() {
   try {
@@ -1028,11 +1160,11 @@ function requireSlackWorkspace(teamId) {
   }
   return ws;
 }
-var import_node_path9;
+var import_node_path10;
 var init_workspaces = __esm({
   "src/slack/workspaces.ts"() {
     "use strict";
-    import_node_path9 = require("path");
+    import_node_path10 = require("path");
     init_paths();
     init_secure_file();
     init_api();
@@ -1041,7 +1173,7 @@ var init_workspaces = __esm({
 
 // src/slack/outbound-watch.ts
 function storePath3() {
-  return (0, import_node_path10.join)(appDataDir(), "slack-outbound-watch.json");
+  return (0, import_node_path11.join)(appDataDir(), "slack-outbound-watch.json");
 }
 function watchId(teamId, channelId, ts) {
   return `${teamId}:${channelId}:${ts}`;
@@ -1054,9 +1186,9 @@ function tsNewer(a, b) {
 }
 function readStore3() {
   const path = storePath3();
-  if (!(0, import_node_fs9.existsSync)(path)) return [];
+  if (!(0, import_node_fs10.existsSync)(path)) return [];
   try {
-    const parsed = isSecureFileEncrypted(path) ? readSecureJson(path) : JSON.parse((0, import_node_fs9.readFileSync)(path, "utf8"));
+    const parsed = isSecureFileEncrypted(path) ? readSecureJson(path) : JSON.parse((0, import_node_fs10.readFileSync)(path, "utf8"));
     return Array.isArray(parsed?.watches) ? parsed.watches : [];
   } catch {
     return [];
@@ -1378,12 +1510,12 @@ async function pollSlackOutboundWatches(opts) {
   }
   if (changed) writeStore(watches);
 }
-var import_node_fs9, import_node_path10, MAX_WATCHES, MAX_REPLIES_PER_WATCH, WATCH_TTL_MS, POLL_INTERVAL_MS, lastPollMs, nameCache, continueOnReply;
+var import_node_fs10, import_node_path11, MAX_WATCHES, MAX_REPLIES_PER_WATCH, WATCH_TTL_MS, POLL_INTERVAL_MS, lastPollMs, nameCache, continueOnReply;
 var init_outbound_watch = __esm({
   "src/slack/outbound-watch.ts"() {
     "use strict";
-    import_node_fs9 = require("fs");
-    import_node_path10 = require("path");
+    import_node_fs10 = require("fs");
+    import_node_path11 = require("path");
     init_paths();
     init_private_file();
     init_secure_file();
@@ -1703,64 +1835,64 @@ var init_error_detail = __esm({
 
 // src/agents/path.ts
 function prependPathDir(env, dir) {
-  if (!dir || !(0, import_node_fs10.existsSync)(dir)) return;
+  if (!dir || !(0, import_node_fs11.existsSync)(dir)) return;
   const current = env.PATH ?? "";
-  const parts = current.split(import_node_path11.delimiter).filter(Boolean);
+  const parts = current.split(import_node_path12.delimiter).filter(Boolean);
   if (parts.includes(dir)) {
     env.PATH = current;
     return;
   }
-  env.PATH = [dir, ...parts].join(import_node_path11.delimiter);
+  env.PATH = [dir, ...parts].join(import_node_path12.delimiter);
 }
 function conductorBundledBinDir(home = process.env.HOME || process.env.USERPROFILE || (0, import_node_os3.homedir)()) {
-  return (0, import_node_path11.join)(home, "Library", "Application Support", "com.conductor.app", "bin");
+  return (0, import_node_path12.join)(home, "Library", "Application Support", "com.conductor.app", "bin");
 }
 function ensureAgentPath(env = process.env) {
   const home = env.HOME || env.USERPROFILE || (0, import_node_os3.homedir)();
   const current = env.PATH ?? "";
-  const parts = current.split(import_node_path11.delimiter).filter(Boolean);
+  const parts = current.split(import_node_path12.delimiter).filter(Boolean);
   const seen = new Set(parts);
   const extras = [
-    ...EXTRA_BIN_DIRS.map((rel) => (0, import_node_path11.join)(home, rel)),
+    ...EXTRA_BIN_DIRS.map((rel) => (0, import_node_path12.join)(home, rel)),
     "/opt/homebrew/bin",
     "/usr/local/bin",
     // Keep after Homebrew/npm so a user-installed CLI still wins.
     conductorBundledBinDir(home)
   ];
   for (const dir of extras.reverse()) {
-    if (!dir || seen.has(dir) || !(0, import_node_fs10.existsSync)(dir)) continue;
+    if (!dir || seen.has(dir) || !(0, import_node_fs11.existsSync)(dir)) continue;
     parts.unshift(dir);
     seen.add(dir);
   }
-  const next = parts.join(import_node_path11.delimiter);
+  const next = parts.join(import_node_path12.delimiter);
   env.PATH = next;
   return next;
 }
 function enrichPathWithNpmGlobalBin(env = process.env) {
   ensureAgentPath(env);
   try {
-    const prefix = (0, import_node_child_process2.execFileSync)("npm", ["prefix", "-g"], {
+    const prefix = (0, import_node_child_process3.execFileSync)("npm", ["prefix", "-g"], {
       encoding: "utf8",
       env: { ...process.env, ...env },
       timeout: 8e3,
       stdio: ["ignore", "pipe", "ignore"]
     }).trim().split(/\r?\n/).find(Boolean);
     if (prefix) {
-      const binDir = process.platform === "win32" ? prefix : (0, import_node_path11.join)(prefix, "bin");
+      const binDir = process.platform === "win32" ? prefix : (0, import_node_path12.join)(prefix, "bin");
       prependPathDir(env, binDir);
     }
   } catch {
   }
   return env.PATH ?? "";
 }
-var import_node_fs10, import_node_child_process2, import_node_os3, import_node_path11, EXTRA_BIN_DIRS;
+var import_node_fs11, import_node_child_process3, import_node_os3, import_node_path12, EXTRA_BIN_DIRS;
 var init_path = __esm({
   "src/agents/path.ts"() {
     "use strict";
-    import_node_fs10 = require("fs");
-    import_node_child_process2 = require("child_process");
+    import_node_fs11 = require("fs");
+    import_node_child_process3 = require("child_process");
     import_node_os3 = require("os");
-    import_node_path11 = require("path");
+    import_node_path12 = require("path");
     EXTRA_BIN_DIRS = [
       ".local/bin",
       ".cargo/bin",
@@ -1781,23 +1913,23 @@ var init_path = __esm({
 function githubAgentAuthDir() {
   const override = process.env.SIDEBOARD_GIT_AUTH_DIR?.trim();
   if (override) return override;
-  return (0, import_node_path12.join)((0, import_node_os4.homedir)(), ".sideboard-git-auth");
+  return (0, import_node_path13.join)((0, import_node_os4.homedir)(), ".sideboard-git-auth");
 }
 function githubCredentialStorePath() {
-  return (0, import_node_path12.join)(githubAgentAuthDir(), "git-credentials");
+  return (0, import_node_path13.join)(githubAgentAuthDir(), "git-credentials");
 }
 function githubGhConfigDir() {
-  return (0, import_node_path12.join)(githubAgentAuthDir(), "gh");
+  return (0, import_node_path13.join)(githubAgentAuthDir(), "gh");
 }
 function writePrivateFile2(file, body) {
-  (0, import_node_fs11.mkdirSync)((0, import_node_path12.dirname)(file), { recursive: true, mode: 448 });
+  (0, import_node_fs12.mkdirSync)((0, import_node_path13.dirname)(file), { recursive: true, mode: 448 });
   try {
-    (0, import_node_fs11.chmodSync)((0, import_node_path12.dirname)(file), 448);
+    (0, import_node_fs12.chmodSync)((0, import_node_path13.dirname)(file), 448);
   } catch {
   }
-  (0, import_node_fs11.writeFileSync)(file, body, { encoding: "utf8", mode: 384 });
+  (0, import_node_fs12.writeFileSync)(file, body, { encoding: "utf8", mode: 384 });
   try {
-    (0, import_node_fs11.chmodSync)(file, 384);
+    (0, import_node_fs12.chmodSync)(file, 384);
   } catch {
   }
 }
@@ -1822,19 +1954,19 @@ function materializeGithubAgentAuth(token, user) {
   const trimmed = token.trim();
   if (!trimmed) return;
   const root = githubAgentAuthDir();
-  (0, import_node_fs11.mkdirSync)(root, { recursive: true, mode: 448 });
+  (0, import_node_fs12.mkdirSync)(root, { recursive: true, mode: 448 });
   try {
-    (0, import_node_fs11.chmodSync)(root, 448);
+    (0, import_node_fs12.chmodSync)(root, 448);
   } catch {
   }
   writePrivateFile2(githubCredentialStorePath(), gitCredentialStoreContents(trimmed));
   const ghDir = githubGhConfigDir();
-  (0, import_node_fs11.mkdirSync)(ghDir, { recursive: true, mode: 448 });
-  writePrivateFile2((0, import_node_path12.join)(ghDir, "hosts.yml"), ghHostsYml(trimmed, user));
-  writePrivateFile2((0, import_node_path12.join)(ghDir, "config.yml"), "git_protocol: https\nprompt: disabled\n");
+  (0, import_node_fs12.mkdirSync)(ghDir, { recursive: true, mode: 448 });
+  writePrivateFile2((0, import_node_path13.join)(ghDir, "hosts.yml"), ghHostsYml(trimmed, user));
+  writePrivateFile2((0, import_node_path13.join)(ghDir, "config.yml"), "git_protocol: https\nprompt: disabled\n");
 }
 function githubAgentAuthReady() {
-  return (0, import_node_fs11.existsSync)(githubCredentialStorePath()) && (0, import_node_fs11.existsSync)((0, import_node_path12.join)(githubGhConfigDir(), "hosts.yml"));
+  return (0, import_node_fs12.existsSync)(githubCredentialStorePath()) && (0, import_node_fs12.existsSync)((0, import_node_path13.join)(githubGhConfigDir(), "hosts.yml"));
 }
 function githubCredentialHelperGitConfig() {
   const file = githubCredentialStorePath();
@@ -1849,13 +1981,13 @@ function githubGhConfigEnv() {
     GH_PROMPT_DISABLED: "1"
   };
 }
-var import_node_fs11, import_node_os4, import_node_path12;
+var import_node_fs12, import_node_os4, import_node_path13;
 var init_github_agent_auth = __esm({
   "src/git/github-agent-auth.ts"() {
     "use strict";
-    import_node_fs11 = require("fs");
+    import_node_fs12 = require("fs");
     import_node_os4 = require("os");
-    import_node_path12 = require("path");
+    import_node_path13 = require("path");
   }
 });
 
@@ -1864,11 +1996,11 @@ function isIndexLockError(text7) {
   return /Unable to create ['"][^'"]*index\.lock['"]: File exists/i.test(text7);
 }
 function clearStaleIndexLock(gitDir, maxAgeMs = STALE_INDEX_LOCK_MS, now = Date.now()) {
-  const lockPath = (0, import_node_path13.join)(gitDir, "index.lock");
+  const lockPath = (0, import_node_path14.join)(gitDir, "index.lock");
   try {
-    if (!(0, import_node_fs12.existsSync)(lockPath)) return null;
-    if (now - (0, import_node_fs12.statSync)(lockPath).mtimeMs < maxAgeMs) return null;
-    (0, import_node_fs12.unlinkSync)(lockPath);
+    if (!(0, import_node_fs13.existsSync)(lockPath)) return null;
+    if (now - (0, import_node_fs13.statSync)(lockPath).mtimeMs < maxAgeMs) return null;
+    (0, import_node_fs13.unlinkSync)(lockPath);
     return lockPath;
   } catch {
     return null;
@@ -1883,12 +2015,12 @@ function clearStaleIndexLocks(gitDirs, maxAgeMs = STALE_INDEX_LOCK_MS) {
   }
   return removed;
 }
-var import_node_fs12, import_node_path13, STALE_INDEX_LOCK_MS;
+var import_node_fs13, import_node_path14, STALE_INDEX_LOCK_MS;
 var init_stale_lock = __esm({
   "src/git/stale-lock.ts"() {
     "use strict";
-    import_node_fs12 = require("fs");
-    import_node_path13 = require("path");
+    import_node_fs13 = require("fs");
+    import_node_path14 = require("path");
     STALE_INDEX_LOCK_MS = 2e4;
   }
 });
@@ -2998,11 +3130,11 @@ async function ensureWorktreeSideboardIgnored(worktreePath) {
   if (gitDir.exitCode !== 0) return;
   const dir = gitDir.stdout.trim();
   if (!dir) return;
-  const excludePath = (0, import_node_path14.join)(dir, "info", "exclude");
-  (0, import_node_fs13.mkdirSync)((0, import_node_path14.dirname)(excludePath), { recursive: true });
+  const excludePath = (0, import_node_path15.join)(dir, "info", "exclude");
+  (0, import_node_fs14.mkdirSync)((0, import_node_path15.dirname)(excludePath), { recursive: true });
   let body = "";
   try {
-    body = (0, import_node_fs13.readFileSync)(excludePath, "utf8");
+    body = (0, import_node_fs14.readFileSync)(excludePath, "utf8");
   } catch {
     body = "";
   }
@@ -3018,7 +3150,7 @@ async function ensureWorktreeSideboardIgnored(worktreePath) {
 ` : body;
     const header = body.includes(EXCLUDE_COMMENT) ? "" : `${EXCLUDE_COMMENT}
 `;
-    (0, import_node_fs13.writeFileSync)(excludePath, `${prefix}${header}${missing.join("\n")}
+    (0, import_node_fs14.writeFileSync)(excludePath, `${prefix}${header}${missing.join("\n")}
 `, "utf8");
   }
   const listed = await git(["ls-files", "-z", "--", ".sideboard"], worktreePath, {
@@ -3033,12 +3165,12 @@ async function ensureWorktreeSideboardIgnored(worktreePath) {
     timeoutMs: 8e3
   });
 }
-var import_node_fs13, import_node_path14, WORKTREE_SIDEBOARD_EXCLUDE, WORKTREE_CONTEXT_EXCLUDE, EXCLUDE_COMMENT;
+var import_node_fs14, import_node_path15, WORKTREE_SIDEBOARD_EXCLUDE, WORKTREE_CONTEXT_EXCLUDE, EXCLUDE_COMMENT;
 var init_worktree_exclude = __esm({
   "src/git/worktree-exclude.ts"() {
     "use strict";
-    import_node_fs13 = require("fs");
-    import_node_path14 = require("path");
+    import_node_fs14 = require("fs");
+    import_node_path15 = require("path");
     init_run();
     WORKTREE_SIDEBOARD_EXCLUDE = ".sideboard/";
     WORKTREE_CONTEXT_EXCLUDE = ".context/";
@@ -3189,7 +3321,7 @@ var init_account_profile = __esm({
 
 // src/store/secret-vault.ts
 function secretVaultPath() {
-  return (0, import_node_path15.join)(appDataDir(), "secrets.json");
+  return (0, import_node_path16.join)(appDataDir(), "secrets.json");
 }
 function loadSecretVault() {
   const parsed = readSecureJson(secretVaultPath());
@@ -3248,11 +3380,11 @@ function normalizeVault(raw) {
   }
   return out;
 }
-var import_node_path15;
+var import_node_path16;
 var init_secret_vault = __esm({
   "src/store/secret-vault.ts"() {
     "use strict";
-    import_node_path15 = require("path");
+    import_node_path16 = require("path");
     init_paths();
     init_secure_file();
   }
@@ -3433,10 +3565,10 @@ function toPublicAppSettings(settings) {
   };
 }
 function appSettingsPath() {
-  return (0, import_node_path16.join)(appDataDir(), "settings.json");
+  return (0, import_node_path17.join)(appDataDir(), "settings.json");
 }
 function claudeUserSettingsPath() {
-  return (0, import_node_path16.join)((0, import_node_os5.homedir)(), ".claude", "settings.json");
+  return (0, import_node_path17.join)((0, import_node_os5.homedir)(), ".claude", "settings.json");
 }
 function normalizeClaude(raw) {
   if (!raw || typeof raw !== "object") return {};
@@ -3444,7 +3576,7 @@ function normalizeClaude(raw) {
   const out = {};
   if (typeof source.executablePath === "string") {
     const path = source.executablePath.trim();
-    if (path && (0, import_node_path16.isAbsolute)(path)) out.executablePath = path;
+    if (path && (0, import_node_path17.isAbsolute)(path)) out.executablePath = path;
   }
   if (typeof source.chromeEnabled === "boolean") {
     out.chromeEnabled = source.chromeEnabled;
@@ -3457,13 +3589,13 @@ function normalizeCliExecutable(raw) {
   const out = {};
   if (typeof source.executablePath === "string") {
     const path = source.executablePath.trim();
-    if (path && (0, import_node_path16.isAbsolute)(path)) out.executablePath = path;
+    if (path && (0, import_node_path17.isAbsolute)(path)) out.executablePath = path;
   }
   return out;
 }
 function absoluteExecutablePath(value) {
   const path = value.trim();
-  if (!(0, import_node_path16.isAbsolute)(path)) {
+  if (!(0, import_node_path17.isAbsolute)(path)) {
     throw new Error("Executable path must be absolute. Leave it empty to use the system CLI.");
   }
   return path;
@@ -3474,7 +3606,7 @@ function normalizeBrightsy(raw) {
   const out = {};
   if (typeof source.executablePath === "string") {
     const path = source.executablePath.trim();
-    if (path && (0, import_node_path16.isAbsolute)(path)) out.executablePath = path;
+    if (path && (0, import_node_path17.isAbsolute)(path)) out.executablePath = path;
   }
   if (typeof source.cloudConnectEnabled === "boolean") {
     out.cloudConnectEnabled = source.cloudConnectEnabled;
@@ -3818,10 +3950,10 @@ function normalizeSettings(raw) {
 }
 function readSettingsFile() {
   const path = appSettingsPath();
-  if (!(0, import_node_fs14.existsSync)(path)) return { ...EMPTY_SETTINGS };
+  if (!(0, import_node_fs15.existsSync)(path)) return { ...EMPTY_SETTINGS };
   try {
     chmodOwnerOnly(path);
-    const parsed = JSON.parse((0, import_node_fs14.readFileSync)(path, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs15.readFileSync)(path, "utf8"));
     return normalizeSettings(parsed);
   } catch {
     return { ...EMPTY_SETTINGS };
@@ -4744,14 +4876,14 @@ function childEnvWithAppSettings(extra) {
 function harnessEnvKey(harness) {
   return HARNESS_ENV_KEYS[harness];
 }
-var import_node_crypto3, import_node_fs14, import_node_os5, import_node_path16, HARNESS_ENV_KEYS, DEFAULT_AGENTS, GITHUB_GIT_AUTH_MODES, FOLLOW_UP_BEHAVIORS, CLOUD_CONNECT_AGENTS, ISSUE_SOURCES, GIT_AUTH_MODES, EMPTY_SETTINGS, CONFIRM_ACCOUNT, CONFIRM_PROJECT, DEFAULT_CLI_BIN;
+var import_node_crypto3, import_node_fs15, import_node_os5, import_node_path17, HARNESS_ENV_KEYS, DEFAULT_AGENTS, GITHUB_GIT_AUTH_MODES, FOLLOW_UP_BEHAVIORS, CLOUD_CONNECT_AGENTS, ISSUE_SOURCES, GIT_AUTH_MODES, EMPTY_SETTINGS, CONFIRM_ACCOUNT, CONFIRM_PROJECT, DEFAULT_CLI_BIN;
 var init_app_settings = __esm({
   "src/store/app-settings.ts"() {
     "use strict";
     import_node_crypto3 = require("crypto");
-    import_node_fs14 = require("fs");
+    import_node_fs15 = require("fs");
     import_node_os5 = require("os");
-    import_node_path16 = require("path");
+    import_node_path17 = require("path");
     init_orchestrator_capable();
     init_thinking_effort();
     init_nested_electron_env();
@@ -4917,7 +5049,7 @@ async function warmGithubAgentAuth(opts) {
 }
 function normalizeWritableRoot(raw) {
   const trimmed = raw.trim().replace(/\/+$/, "");
-  return trimmed && (0, import_node_path17.isAbsolute)(trimmed) ? trimmed : null;
+  return trimmed && (0, import_node_path18.isAbsolute)(trimmed) ? trimmed : null;
 }
 async function resolveCodexGitWritableRoots(cwd) {
   const roots = /* @__PURE__ */ new Set();
@@ -4995,11 +5127,11 @@ function formatGitAuthModeDirective(mode) {
       ].join("\n");
   }
 }
-var import_node_path17, HTTPS_REWRITE, TOKEN_TTL_MS, tokenMemo, GITHUB_CHILD_TOKEN_KEYS;
+var import_node_path18, HTTPS_REWRITE, TOKEN_TTL_MS, tokenMemo, GITHUB_CHILD_TOKEN_KEYS;
 var init_git_auth_mode = __esm({
   "src/git/git-auth-mode.ts"() {
     "use strict";
-    import_node_path17 = require("path");
+    import_node_path18 = require("path");
     init_app_settings();
     init_github_agent_auth();
     init_run();
@@ -5823,7 +5955,7 @@ async function resolveRepoRoot(cwd) {
 }
 function canonicalizeRepoPath(path) {
   try {
-    return (0, import_node_fs15.realpathSync)(path);
+    return (0, import_node_fs16.realpathSync)(path);
   } catch {
     return path.replace(/\/+$/, "");
   }
@@ -6667,8 +6799,8 @@ async function refreshOriginAndMaybeFastForwardMain(repoPath, sourceRef) {
 }
 async function createThreadWorktree(opts) {
   let branchName = `thread/${opts.slug}`;
-  const worktreePath = (0, import_node_path18.join)(worktreesRoot(opts.repoPath), opts.slug);
-  if ((0, import_node_fs15.existsSync)(worktreePath)) {
+  const worktreePath = (0, import_node_path19.join)(worktreesRoot(opts.repoPath), opts.slug);
+  if ((0, import_node_fs16.existsSync)(worktreePath)) {
     throw new Error(`Worktree already exists at ${worktreePath}`);
   }
   await ensureGhPreferOrigin(opts.repoPath);
@@ -6709,8 +6841,8 @@ ${add.stdout}`;
 async function createExistingBranchWorktree(opts) {
   const branchName = opts.branchName.trim();
   if (!branchName) throw new Error("branch name required");
-  const worktreePath = (0, import_node_path18.join)(worktreesRoot(opts.repoPath), opts.slug);
-  if ((0, import_node_fs15.existsSync)(worktreePath)) {
+  const worktreePath = (0, import_node_path19.join)(worktreesRoot(opts.repoPath), opts.slug);
+  if ((0, import_node_fs16.existsSync)(worktreePath)) {
     throw new Error(`Worktree already exists at ${worktreePath}`);
   }
   await ensureGhPreferOrigin(opts.repoPath);
@@ -6991,11 +7123,11 @@ async function createOrUpdatePr(worktreePath, opts) {
   const headRef = ghHeadRef(slug, opts.head);
   const branchOnly = opts.head.trim().replace(/^refs\/heads\//, "");
   const bodyText = clampGithubPrBody(opts.body ?? opts.title);
-  const bodyFile = (0, import_node_path18.join)(
+  const bodyFile = (0, import_node_path19.join)(
     (0, import_node_os6.tmpdir)(),
     `sideboard-pr-body-${process.pid}-${(0, import_node_crypto4.randomBytes)(6).toString("hex")}.md`
   );
-  (0, import_node_fs15.writeFileSync)(bodyFile, bodyText.endsWith("\n") ? bodyText : `${bodyText}
+  (0, import_node_fs16.writeFileSync)(bodyFile, bodyText.endsWith("\n") ? bodyText : `${bodyText}
 `, "utf8");
   const bodyArgs = ["--body-file", bodyFile];
   try {
@@ -7009,7 +7141,7 @@ async function createOrUpdatePr(worktreePath, opts) {
     });
   } finally {
     try {
-      (0, import_node_fs15.unlinkSync)(bodyFile);
+      (0, import_node_fs16.unlinkSync)(bodyFile);
     } catch {
     }
   }
@@ -7091,10 +7223,10 @@ function sameRepoPath(a, b) {
   return normalizeWorktreePath(a) === normalizeWorktreePath(b);
 }
 function listLocalThreadBranchSlugs(repoPath) {
-  const refsDir = (0, import_node_path18.join)(repoPath, ".git", "refs", "heads", "thread");
-  if (!(0, import_node_fs15.existsSync)(refsDir)) return [];
+  const refsDir = (0, import_node_path19.join)(repoPath, ".git", "refs", "heads", "thread");
+  if (!(0, import_node_fs16.existsSync)(refsDir)) return [];
   try {
-    return (0, import_node_fs15.readdirSync)(refsDir).filter((name) => !name.startsWith(".")).map((name) => normalizeTakenSlug(name));
+    return (0, import_node_fs16.readdirSync)(refsDir).filter((name) => !name.startsWith(".")).map((name) => normalizeTakenSlug(name));
   } catch {
     return [];
   }
@@ -7102,8 +7234,8 @@ function listLocalThreadBranchSlugs(repoPath) {
 function collectTakenTeamSlugs(repoPath) {
   const taken = /* @__PURE__ */ new Set();
   const root = worktreesRoot(repoPath);
-  if ((0, import_node_fs15.existsSync)(root)) {
-    for (const entry of (0, import_node_fs15.readdirSync)(root, { withFileTypes: true })) {
+  if ((0, import_node_fs16.existsSync)(root)) {
+    for (const entry of (0, import_node_fs16.readdirSync)(root, { withFileTypes: true })) {
       if (entry.isDirectory() && entry.name !== ".DS_Store") {
         for (const slug of takenSlugsFromThread({ worktreePath: entry.name })) {
           taken.add(slug);
@@ -7128,20 +7260,20 @@ function allocateTeamSlug(repoPath) {
   const taken = collectTakenTeamSlugs(repoPath);
   for (let attempt = 0; attempt < 32; attempt++) {
     const team = allocateTeamName(taken);
-    const path = (0, import_node_path18.join)(worktreesRoot(repoPath), team.slug);
-    if (!(0, import_node_fs15.existsSync)(path)) return team;
+    const path = (0, import_node_path19.join)(worktreesRoot(repoPath), team.slug);
+    if (!(0, import_node_fs16.existsSync)(path)) return team;
     taken.add(team.slug);
   }
   throw new Error("No available soccer team worktree directories left");
 }
-var import_node_crypto4, import_node_fs15, import_node_os6, import_node_path18, PR_DETAILS_JSON_FIELDS;
+var import_node_crypto4, import_node_fs16, import_node_os6, import_node_path19, PR_DETAILS_JSON_FIELDS;
 var init_worktree = __esm({
   "src/git/worktree.ts"() {
     "use strict";
     import_node_crypto4 = require("crypto");
-    import_node_fs15 = require("fs");
+    import_node_fs16 = require("fs");
     import_node_os6 = require("os");
-    import_node_path18 = require("path");
+    import_node_path19 = require("path");
     init_paths();
     init_thread_store();
     init_teams();
@@ -7213,7 +7345,7 @@ var init_cloud_connect_constants = __esm({
 
 // src/composer/stage-files.ts
 function fileExtension(filePath) {
-  const base = (0, import_node_path19.basename)(filePath).toLowerCase();
+  const base = (0, import_node_path20.basename)(filePath).toLowerCase();
   return base.includes(".") ? base.split(".").pop() || "" : "";
 }
 function isImageFilePath(filePath) {
@@ -7223,22 +7355,22 @@ function imageMimeType(filePath) {
   return IMAGE_MIME_BY_EXT[fileExtension(filePath)] || "image/png";
 }
 function ensureAttachmentsDir(worktreePath) {
-  const dir = (0, import_node_path19.join)(worktreePath, ATTACHMENTS_DIR);
-  (0, import_node_fs16.mkdirSync)(dir, { recursive: true });
-  const gi = (0, import_node_path19.join)(dir, ".gitignore");
-  if (!(0, import_node_fs16.existsSync)(gi)) {
-    (0, import_node_fs16.writeFileSync)(gi, attachmentsGitignoreBody(), "utf8");
+  const dir = (0, import_node_path20.join)(worktreePath, ATTACHMENTS_DIR);
+  (0, import_node_fs17.mkdirSync)(dir, { recursive: true });
+  const gi = (0, import_node_path20.join)(dir, ".gitignore");
+  if (!(0, import_node_fs17.existsSync)(gi)) {
+    (0, import_node_fs17.writeFileSync)(gi, attachmentsGitignoreBody(), "utf8");
   }
   return dir;
 }
 function uniqueAttachmentName(dir, originalName) {
   const safe = originalName.replace(/[/\\]/g, "_") || "file";
-  if (!(0, import_node_fs16.existsSync)((0, import_node_path19.join)(dir, safe))) return safe;
-  const ext = (0, import_node_path19.extname)(safe);
+  if (!(0, import_node_fs17.existsSync)((0, import_node_path20.join)(dir, safe))) return safe;
+  const ext = (0, import_node_path20.extname)(safe);
   const stem = ext ? safe.slice(0, -ext.length) : safe;
   for (let i = 1; i < 1e4; i++) {
     const candidate = `${stem}-${i}${ext}`;
-    if (!(0, import_node_fs16.existsSync)((0, import_node_path19.join)(dir, candidate))) return candidate;
+    if (!(0, import_node_fs17.existsSync)((0, import_node_path20.join)(dir, candidate))) return candidate;
   }
   return `${stem}-${(0, import_node_crypto5.randomUUID)()}${ext}`;
 }
@@ -7294,15 +7426,15 @@ function stageAbsolutePathsAsAttachments(worktreePath, absolutePaths) {
   const dir = ensureAttachmentsDir(worktreePath);
   const out = [];
   for (const abs of absolutePaths) {
-    const originalName = (0, import_node_path19.basename)(abs);
+    const originalName = (0, import_node_path20.basename)(abs);
     try {
-      const st = (0, import_node_fs16.statSync)(abs);
+      const st = (0, import_node_fs17.statSync)(abs);
       if (!st.isFile()) continue;
       const name = uniqueAttachmentName(dir, originalName);
-      const destAbs = (0, import_node_path19.join)(dir, name);
-      (0, import_node_fs16.copyFileSync)(abs, destAbs);
+      const destAbs = (0, import_node_path20.join)(dir, name);
+      (0, import_node_fs17.copyFileSync)(abs, destAbs);
       const rel = `${ATTACHMENTS_DIR}/${name}`;
-      const buf = (0, import_node_fs16.readFileSync)(destAbs);
+      const buf = (0, import_node_fs17.readFileSync)(destAbs);
       out.push(attachmentFromBuffer(name, buf, { path: rel, sourceLabel: abs }));
     } catch (err) {
       out.push({
@@ -7324,8 +7456,8 @@ function stageBuffersAsAttachments(worktreePath, buffers2) {
     try {
       const buf = Buffer.from(item.dataBase64, "base64");
       const name = uniqueAttachmentName(dir, originalName);
-      const destAbs = (0, import_node_path19.join)(dir, name);
-      (0, import_node_fs16.writeFileSync)(destAbs, buf);
+      const destAbs = (0, import_node_path20.join)(dir, name);
+      (0, import_node_fs17.writeFileSync)(destAbs, buf);
       const rel = `${ATTACHMENTS_DIR}/${name}`;
       out.push(attachmentFromBuffer(name, buf, { path: rel }));
     } catch (err) {
@@ -7386,18 +7518,18 @@ function attachmentsFromWorktreePaths(worktreePath, relativePaths) {
     if (!rel || rel.includes("..") || rel.startsWith("/")) {
       out.push({
         id: (0, import_node_crypto5.randomUUID)(),
-        name: (0, import_node_path19.basename)(rel) || "file",
+        name: (0, import_node_path20.basename)(rel) || "file",
         kind: "file",
         content: `(invalid path: ${rel})`
       });
       continue;
     }
-    const name = (0, import_node_path19.basename)(rel);
+    const name = (0, import_node_path20.basename)(rel);
     try {
-      const abs = (0, import_node_path19.join)(worktreePath, rel);
-      const st = (0, import_node_fs16.statSync)(abs);
+      const abs = (0, import_node_path20.join)(worktreePath, rel);
+      const st = (0, import_node_fs17.statSync)(abs);
       if (!st.isFile()) continue;
-      const buf = (0, import_node_fs16.readFileSync)(abs);
+      const buf = (0, import_node_fs17.readFileSync)(abs);
       out.push(attachmentFromBuffer(name, buf, { path: rel, sourceLabel: abs }));
     } catch (err) {
       out.push({
@@ -7410,12 +7542,12 @@ function attachmentsFromWorktreePaths(worktreePath, relativePaths) {
   }
   return out;
 }
-var import_node_fs16, import_node_path19, import_node_crypto5, IMAGE_EXTENSIONS, IMAGE_MIME_BY_EXT, MAX_INLINE_BYTES, MAX_PREVIEW_BYTES, IMAGE_HINT_RE, PLACEHOLDER_CONTENT_RE;
+var import_node_fs17, import_node_path20, import_node_crypto5, IMAGE_EXTENSIONS, IMAGE_MIME_BY_EXT, MAX_INLINE_BYTES, MAX_PREVIEW_BYTES, IMAGE_HINT_RE, PLACEHOLDER_CONTENT_RE;
 var init_stage_files = __esm({
   "src/composer/stage-files.ts"() {
     "use strict";
-    import_node_fs16 = require("fs");
-    import_node_path19 = require("path");
+    import_node_fs17 = require("fs");
+    import_node_path20 = require("path");
     import_node_crypto5 = require("crypto");
     init_workspace_scratch();
     IMAGE_EXTENSIONS = /* @__PURE__ */ new Set([
@@ -7455,38 +7587,38 @@ __export(workspaces_exports, {
   syncWorkspacesFromThreads: () => syncWorkspacesFromThreads
 });
 function workspacesFile() {
-  return (0, import_node_path20.join)(appDataDir(), "workspaces.json");
+  return (0, import_node_path21.join)(appDataDir(), "workspaces.json");
 }
 function removedWorkspacesFile() {
-  return (0, import_node_path20.join)(appDataDir(), "removed-workspaces.json");
+  return (0, import_node_path21.join)(appDataDir(), "removed-workspaces.json");
 }
 function readAll() {
   const path = workspacesFile();
-  if (!(0, import_node_fs17.existsSync)(path)) return [];
+  if (!(0, import_node_fs18.existsSync)(path)) return [];
   try {
-    const raw = JSON.parse((0, import_node_fs17.readFileSync)(path, "utf8"));
+    const raw = JSON.parse((0, import_node_fs18.readFileSync)(path, "utf8"));
     return Array.isArray(raw) ? raw : [];
   } catch {
     return [];
   }
 }
 function writeAll(list) {
-  (0, import_node_fs17.mkdirSync)(appDataDir(), { recursive: true });
-  (0, import_node_fs17.writeFileSync)(workspacesFile(), JSON.stringify(list, null, 2), "utf8");
+  (0, import_node_fs18.mkdirSync)(appDataDir(), { recursive: true });
+  (0, import_node_fs18.writeFileSync)(workspacesFile(), JSON.stringify(list, null, 2), "utf8");
 }
 function readRemoved() {
   const path = removedWorkspacesFile();
-  if (!(0, import_node_fs17.existsSync)(path)) return /* @__PURE__ */ new Set();
+  if (!(0, import_node_fs18.existsSync)(path)) return /* @__PURE__ */ new Set();
   try {
-    const raw = JSON.parse((0, import_node_fs17.readFileSync)(path, "utf8"));
+    const raw = JSON.parse((0, import_node_fs18.readFileSync)(path, "utf8"));
     return new Set(Array.isArray(raw) ? raw.filter((p) => typeof p === "string") : []);
   } catch {
     return /* @__PURE__ */ new Set();
   }
 }
 function writeRemoved(paths) {
-  (0, import_node_fs17.mkdirSync)(appDataDir(), { recursive: true });
-  (0, import_node_fs17.writeFileSync)(removedWorkspacesFile(), JSON.stringify([...paths].sort(), null, 2), "utf8");
+  (0, import_node_fs18.mkdirSync)(appDataDir(), { recursive: true });
+  (0, import_node_fs18.writeFileSync)(removedWorkspacesFile(), JSON.stringify([...paths].sort(), null, 2), "utf8");
 }
 function rememberRemoved(repoPath) {
   const next = readRemoved();
@@ -7509,7 +7641,7 @@ function listWorkspaces() {
 async function addWorkspace(repoPath) {
   const root = await resolveRepoRoot(repoPath);
   if (!root || root === "/") throw new Error(`Invalid repo path: ${repoPath}`);
-  if (!(0, import_node_fs17.existsSync)(root)) throw new Error(`Repo not found: ${root}`);
+  if (!(0, import_node_fs18.existsSync)(root)) throw new Error(`Repo not found: ${root}`);
   forgetRemoved(root);
   await ensureGhPreferOrigin(root);
   const current = readAll();
@@ -7517,7 +7649,7 @@ async function addWorkspace(repoPath) {
   if (existing) return existing;
   const next = {
     path: root,
-    name: (0, import_node_path20.basename)(root),
+    name: (0, import_node_path21.basename)(root),
     addedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   writeAll([...current, next]);
@@ -7539,10 +7671,10 @@ function syncWorkspacesFromThreads(repoPaths) {
     if (!path || path === "/" || isGlobalRepoPath(path) || byPath.has(path) || removed.has(path)) {
       continue;
     }
-    if (!(0, import_node_fs17.existsSync)(path)) continue;
+    if (!(0, import_node_fs18.existsSync)(path)) continue;
     const ws = {
       path,
-      name: (0, import_node_path20.basename)(path),
+      name: (0, import_node_path21.basename)(path),
       addedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     byPath.set(path, ws);
@@ -7552,12 +7684,12 @@ function syncWorkspacesFromThreads(repoPaths) {
   if (dirty) writeAll(next);
   return next.sort((a, b) => a.name.localeCompare(b.name));
 }
-var import_node_fs17, import_node_path20;
+var import_node_fs18, import_node_path21;
 var init_workspaces2 = __esm({
   "src/store/workspaces.ts"() {
     "use strict";
-    import_node_fs17 = require("fs");
-    import_node_path20 = require("path");
+    import_node_fs18 = require("fs");
+    import_node_path21 = require("path");
     init_paths();
     init_global_workspace();
     init_worktree();
@@ -7668,7 +7800,7 @@ function coordinatorTurnReminder(opts) {
 function ensureGlobalCoordinatorCwd(opts) {
   const dir = globalAgentCwd();
   try {
-    (0, import_node_fs18.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs19.mkdirSync)(dir, { recursive: true });
   } catch {
     return dir;
   }
@@ -7676,7 +7808,7 @@ function ensureGlobalCoordinatorCwd(opts) {
   let orchId = opts?.orchestratorThreadId?.trim() || "";
   if (!orchId) {
     try {
-      const existing = (0, import_node_fs18.readFileSync)((0, import_node_path21.join)(dir, "AGENTS.md"), "utf8");
+      const existing = (0, import_node_fs19.readFileSync)((0, import_node_path22.join)(dir, "AGENTS.md"), "utf8");
       const m = existing.match(
         /YOUR orchestration thread id is `([0-9a-f-]{36})`/i
       );
@@ -7711,8 +7843,8 @@ function ensureGlobalCoordinatorCwd(opts) {
     "",
     "When creating threads, pass `repoPath` from `list_workspaces` (or the path you just registered).",
     orchId ? `Pass parentThreadId="${orchId}" (or omit it). Never invent another parentThreadId.` : "Pass `parentThreadId` for children (this chat's id from the turn reminder).",
-    "Omit `agent` / `model` on `create_thread` unless you have a reason to override Account defaults.",
-    "Never pass `agent=codex` when you yourself are Codex \u2014 nested Codex deadlocks on shared ~/.codex locks. Omit agent (Account default) or use cursor/claude.",
+    "Omit `agent` / `model` on `create_thread`. Sideboard applies Settings \u2192 Default agent, model & effort. Do not pass your own agent or `agent=cursor` \u2014 those are ignored.",
+    "Never pass `agent=codex` when you yourself are Codex \u2014 nested Codex deadlocks on shared ~/.codex locks. Omit agent; Sideboard applies Account defaults (and coerces only that nested-Codex case).",
     "Typical flow (Home board): list_board \u2192 create_thread (sourceType=ticket|pr|branch) \u2192 send_to_thread \u2192 wait_for_turn (loop while stillRunning) \u2192 ask_git create-draft \u2192 wait_for_turn. Merge only if the user explicitly asked (`ask_git` merge).",
     "Typical flow (branch / explicit source): list_workspaces \u2192 list_branches|list_prs|list_issues \u2192 create_thread \u2192 send_to_thread \u2192 wait_for_turn (loop while stillRunning) \u2192 ask_git create-draft.",
     "Typical flow (find work): list_workspaces \u2192 pick repo(s) matching account / project context \u2192 Sideboard list_issues / linear_* (tickets) or list_prs(queue=review) (reviews) \u2192 show the options. Never wait on Claude Linear MCP. Only create_thread + send_to_thread when they asked to start (e.g. \u201Cfind me work and start it\u201D) \u2014 then wait_for_turn (loop while stillRunning) \u2192 ask_git create-draft.",
@@ -7721,9 +7853,9 @@ function ensureGlobalCoordinatorCwd(opts) {
     "Always ask worktree agents to commit, push, and open draft PRs (`ask_git` / `send_to_thread`). If the user gave a goal (Greptile 5/5, CI green), pass that goal through so they watch-fix-push until it lands \u2014 do not start that loop on a plain push, and do not tell the human to poll. Tell them to merge only when the user explicitly asked. The worktree agent runs git/gh; never merge from this orchestration cwd."
   ].join("\n");
   try {
-    (0, import_node_fs18.writeFileSync)((0, import_node_path21.join)(dir, "CLAUDE.md"), `${body}
+    (0, import_node_fs19.writeFileSync)((0, import_node_path22.join)(dir, "CLAUDE.md"), `${body}
 `, "utf8");
-    (0, import_node_fs18.writeFileSync)((0, import_node_path21.join)(dir, "AGENTS.md"), `${body}
+    (0, import_node_fs19.writeFileSync)((0, import_node_path22.join)(dir, "AGENTS.md"), `${body}
 `, "utf8");
   } catch {
   }
@@ -7755,12 +7887,12 @@ function coordinatorSystemPrompt(opts) {
     formatWorkspaceInventory(opts.workspaces)
   ].join("\n");
 }
-var import_node_fs18, import_node_path21, COORDINATOR_TOOL_PLAYBOOK, SLACK_REPLY_FORMATTING;
+var import_node_fs19, import_node_path22, COORDINATOR_TOOL_PLAYBOOK, SLACK_REPLY_FORMATTING;
 var init_coordinator_prompt = __esm({
   "src/orchestrator/coordinator-prompt.ts"() {
     "use strict";
-    import_node_fs18 = require("fs");
-    import_node_path21 = require("path");
+    import_node_fs19 = require("fs");
+    import_node_path22 = require("path");
     init_worktree();
     init_app_settings();
     init_paths();
@@ -7789,7 +7921,7 @@ var init_coordinator_prompt = __esm({
       "Workspaces:",
       "- add_workspace / remove_workspace \u2014 register or unregister a git repo",
       "Worktree threads (chats):",
-      "- create_thread \u2014 create a worktree + chat from branch | pr | ticket (appears on Home). Do not create a second worktree for a ticket, PR, or named branch that already has one \u2014 that call returns the live thread (alreadyStarted=true). Creating from the default branch still opens a new isolated worktree. Pass repoPath + parentThreadId; omit agent and model to use Sideboard Account defaults (Settings \u2192 Default agent, model & effort). If the repo has a setup script, Sideboard runs it in the background (does not block send_to_thread). If you are Codex, do not set agent=codex (nested Codex deadlocks)",
+      "- create_thread \u2014 create a worktree + chat from branch | pr | ticket (appears on Home). Do not create a second worktree for a ticket, PR, or named branch that already has one \u2014 that call returns the live thread (alreadyStarted=true). Creating from the default branch still opens a new isolated worktree. Pass repoPath + parentThreadId; omit agent and model so Sideboard applies Settings \u2192 Default agent, model & effort (never pass your own agent or agent=cursor). If the repo has a setup script, Sideboard runs it in the background (does not block send_to_thread). Nested Codex (you are Codex and the child is Codex) deadlocks \u2014 omit agent; Sideboard coerces that case",
       "- start_board_card \u2014 same as create_thread for a ticket/PR/named branch (attaches issue text when resolvable). Then send_to_thread.",
       "- fork_worktree \u2014 fork a worktree chat into a NEW git worktree + chat (transcript attached); optional agent; leave model unset (Auto) unless you have a reason. Not for orchestration chats.",
       "- fork_chat \u2014 fork a worktree chat (same worktree tab) OR a Global orchestration chat (new orchestration tab); optional agent; leave model unset (Auto) unless you have a reason. Remote coordinators: use this to continue another orchestration chat on a different agent after session limits.",
@@ -8075,32 +8207,32 @@ var init_global_workspace = __esm({
 function brightsyConfigPath() {
   const override = process.env.BRIGHTSY_CONFIG?.trim();
   if (override) return override;
-  return (0, import_node_path22.join)((0, import_node_os7.homedir)(), ".brightsy", "config.json");
+  return (0, import_node_path23.join)((0, import_node_os7.homedir)(), ".brightsy", "config.json");
 }
 function loadBrightsyConfig() {
   const path = brightsyConfigPath();
-  if (!(0, import_node_fs19.existsSync)(path)) {
+  if (!(0, import_node_fs20.existsSync)(path)) {
     throw new Error("Brightsy not logged in \u2014 run `brightsy login` first");
   }
-  const raw = JSON.parse((0, import_node_fs19.readFileSync)(path, "utf8"));
+  const raw = JSON.parse((0, import_node_fs20.readFileSync)(path, "utf8"));
   if (!raw.access_token || !raw.account_id) {
     throw new Error("Brightsy config incomplete \u2014 run `brightsy login`");
   }
   return raw;
 }
 function saveBrightsyConfig(cfg) {
-  (0, import_node_fs19.writeFileSync)(brightsyConfigPath(), `${JSON.stringify(cfg, null, 2)}
+  (0, import_node_fs20.writeFileSync)(brightsyConfigPath(), `${JSON.stringify(cfg, null, 2)}
 `, {
     mode: 384
   });
 }
-var import_node_fs19, import_node_os7, import_node_path22;
+var import_node_fs20, import_node_os7, import_node_path23;
 var init_config = __esm({
   "src/brightsy/config.ts"() {
     "use strict";
-    import_node_fs19 = require("fs");
+    import_node_fs20 = require("fs");
     import_node_os7 = require("os");
-    import_node_path22 = require("path");
+    import_node_path23 = require("path");
   }
 });
 
@@ -8114,17 +8246,24 @@ var init_accounts = __esm({
 });
 
 // src/http/fetch.ts
+function tlsIssuerHint(code, message) {
+  const text7 = `${code ?? ""} ${message}`;
+  return TLS_ISSUER_RE.test(text7) ? TLS_ISSUER_HINT : "";
+}
 function formatFetchError(err, url) {
   if (!(err instanceof Error)) return `${String(err)} (${url})`;
   const cause = err.cause;
   let detail = "";
+  let hint = tlsIssuerHint(void 0, err.message);
   if (cause instanceof Error) {
     const code = typeof cause.code === "string" ? cause.code : void 0;
     detail = code ? ` [${code}: ${cause.message}]` : ` [${cause.message}]`;
+    hint = tlsIssuerHint(code, `${err.message} ${cause.message}`) || hint;
   } else if (cause != null) {
     detail = ` [${String(cause)}]`;
+    hint = tlsIssuerHint(void 0, String(cause)) || hint;
   }
-  return `${err.message}${detail} (${url})`;
+  return `${err.message}${detail} (${url})${hint}`;
 }
 async function httpFetch(input, init) {
   const url = typeof input === "string" ? input : input.href;
@@ -8135,11 +8274,13 @@ async function httpFetch(input, init) {
     throw new Error(formatFetchError(err, url));
   }
 }
-var injected;
+var injected, TLS_ISSUER_RE, TLS_ISSUER_HINT;
 var init_fetch = __esm({
   "src/http/fetch.ts"() {
     "use strict";
     injected = null;
+    TLS_ISSUER_RE = /UNABLE_TO_GET_ISSUER_CERT|UNABLE_TO_VERIFY_LEAF_SIGNATURE|SELF_SIGNED_CERT_IN_CHAIN/i;
+    TLS_ISSUER_HINT = " \u2014 Node rejected the TLS certificate (corporate VPN/proxy CA). Desktop Linear can still work; reconnecting the API key will not fix this.";
   }
 });
 
@@ -8217,22 +8358,22 @@ var init_oauth = __esm({
 
 // src/brightsy/connected-teams.ts
 function storePath4() {
-  return (0, import_node_path23.join)(appDataDir(), "brightsy-teams.json");
+  return (0, import_node_path24.join)(appDataDir(), "brightsy-teams.json");
 }
 function readStore4() {
   const path = storePath4();
-  if (!(0, import_node_fs20.existsSync)(path)) return [];
+  if (!(0, import_node_fs21.existsSync)(path)) return [];
   try {
-    const parsed = JSON.parse((0, import_node_fs20.readFileSync)(path, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs21.readFileSync)(path, "utf8"));
     return Array.isArray(parsed.teams) ? parsed.teams : [];
   } catch {
     return [];
   }
 }
 function writeStore2(teams) {
-  (0, import_node_fs20.mkdirSync)(appDataDir(), { recursive: true });
+  (0, import_node_fs21.mkdirSync)(appDataDir(), { recursive: true });
   const path = storePath4();
-  (0, import_node_fs20.writeFileSync)(path, `${JSON.stringify({ teams }, null, 2)}
+  (0, import_node_fs21.writeFileSync)(path, `${JSON.stringify({ teams }, null, 2)}
 `, {
     mode: 384
   });
@@ -8338,12 +8479,12 @@ function brightsyMcpServerName(slug) {
   const cleaned = slug.replace(/[^A-Za-z0-9_-]/g, "_").replace(/^_+|_+$/g, "");
   return `brightsy_${cleaned || "team"}`;
 }
-var import_node_fs20, import_node_path23;
+var import_node_fs21, import_node_path24;
 var init_connected_teams = __esm({
   "src/brightsy/connected-teams.ts"() {
     "use strict";
-    import_node_fs20 = require("fs");
-    import_node_path23 = require("path");
+    import_node_fs21 = require("fs");
+    import_node_path24 = require("path");
     init_paths();
     init_accounts();
     init_config();
@@ -8731,11 +8872,11 @@ async function syncCliForTarget(accountId) {
   }
   applyConnectedTeamToCli(team);
 }
-var import_node_fs21, brightsyAdapter;
+var import_node_fs22, brightsyAdapter;
 var init_brightsy = __esm({
   "src/agents/brightsy.ts"() {
     "use strict";
-    import_node_fs21 = require("fs");
+    import_node_fs22 = require("fs");
     init_run();
     init_connected_teams();
     init_config();
@@ -8750,7 +8891,7 @@ var init_brightsy = __esm({
       async detect() {
         const brightsy = resolveAgentExecutable("brightsy");
         if (brightsy !== "brightsy") {
-          if (!(0, import_node_fs21.existsSync)(brightsy)) {
+          if (!(0, import_node_fs22.existsSync)(brightsy)) {
             return {
               agent: "brightsy",
               installed: false,
@@ -9342,43 +9483,43 @@ function electronResourcesPath() {
 function packagedCursorRuntimeDir() {
   const resources = electronResourcesPath();
   if (!resources) return null;
-  const dir = (0, import_node_path24.join)(resources, "cursor-runtime");
-  if (!(0, import_node_fs22.existsSync)((0, import_node_path24.join)(dir, "core-dist", "agents", "cursor-runner.js"))) return null;
+  const dir = (0, import_node_path25.join)(resources, "cursor-runtime");
+  if (!(0, import_node_fs23.existsSync)((0, import_node_path25.join)(dir, "core-dist", "agents", "cursor-runner.js"))) return null;
   return dir;
 }
 function packagedCursorRunnerPath() {
   const dir = packagedCursorRuntimeDir();
-  return dir ? (0, import_node_path24.join)(dir, "core-dist", "agents", "cursor-runner.js") : null;
+  return dir ? (0, import_node_path25.join)(dir, "core-dist", "agents", "cursor-runner.js") : null;
 }
 function packagedMcpDir() {
   const resources = electronResourcesPath();
   if (!resources) return null;
-  const dir = (0, import_node_path24.join)(resources, "sideboard-mcp");
-  if (!(0, import_node_fs22.existsSync)((0, import_node_path24.join)(dir, "core-dist", "mcp", "run-stdio.js"))) return null;
+  const dir = (0, import_node_path25.join)(resources, "sideboard-mcp");
+  if (!(0, import_node_fs23.existsSync)((0, import_node_path25.join)(dir, "core-dist", "mcp", "run-stdio.js"))) return null;
   return dir;
 }
 function packagedMcpStdioPath() {
   const dir = packagedMcpDir();
-  return dir ? (0, import_node_path24.join)(dir, "core-dist", "mcp", "run-stdio.js") : null;
+  return dir ? (0, import_node_path25.join)(dir, "core-dist", "mcp", "run-stdio.js") : null;
 }
 function packagedBundledNodePath() {
   const resources = electronResourcesPath();
   if (!resources) return null;
-  const bin = (0, import_node_path24.join)(resources, "node", "bin", "node");
-  if (!(0, import_node_fs22.existsSync)(bin)) return null;
+  const bin = (0, import_node_path25.join)(resources, "node", "bin", "node");
+  if (!(0, import_node_fs23.existsSync)(bin)) return null;
   return bin;
 }
 function packagedCursorRipgrepCandidate(platformPkg, binName) {
   const dir = packagedCursorRuntimeDir();
   if (!dir) return null;
-  return (0, import_node_path24.join)(dir, "node_modules", platformPkg, "bin", binName);
+  return (0, import_node_path25.join)(dir, "node_modules", platformPkg, "bin", binName);
 }
-var import_node_fs22, import_node_path24;
+var import_node_fs23, import_node_path25;
 var init_packaged_runtime = __esm({
   "src/agents/packaged-runtime.ts"() {
     "use strict";
-    import_node_fs22 = require("fs");
-    import_node_path24 = require("path");
+    import_node_fs23 = require("fs");
+    import_node_path25 = require("path");
   }
 });
 
@@ -9398,6 +9539,7 @@ function applyAgentRunnerHeapEnv(env) {
     env.NODE_OPTIONS,
     AGENT_RUNNER_MAX_OLD_SPACE_MB
   );
+  applySystemCaEnv(env);
 }
 function envWithAgentHeap(env) {
   const next = { ...env };
@@ -9412,7 +9554,7 @@ function unpackedAsarPath(filePath) {
   if (!isAsarPath(filePath)) return null;
   const unpacked = filePath.replace(/\.asar(?=[/\\])/, ".asar.unpacked");
   if (unpacked === filePath) return null;
-  return (0, import_node_fs23.existsSync)(unpacked) ? unpacked : null;
+  return (0, import_node_fs24.existsSync)(unpacked) ? unpacked : null;
 }
 function nodeReadableScriptPath(scriptPath) {
   return unpackedAsarPath(scriptPath) ?? scriptPath;
@@ -9452,37 +9594,37 @@ function pickPreferredNode(candidates) {
   return best;
 }
 function versionDirNodeBins(root, toBin) {
-  if (!(0, import_node_fs23.existsSync)(root)) return [];
+  if (!(0, import_node_fs24.existsSync)(root)) return [];
   try {
-    return (0, import_node_fs23.readdirSync)(root).map(toBin);
+    return (0, import_node_fs24.readdirSync)(root).map(toBin);
   } catch {
     return [];
   }
 }
 function defaultNodeBinCandidates(home = (0, import_node_os8.homedir)()) {
   const kegs = ["/opt/homebrew", "/usr/local"].flatMap(
-    (prefix) => PREFERRED_LTS_MAJORS.map((major) => (0, import_node_path25.join)(prefix, "opt", `node@${major}`, "bin", "node"))
+    (prefix) => PREFERRED_LTS_MAJORS.map((major) => (0, import_node_path26.join)(prefix, "opt", `node@${major}`, "bin", "node"))
   );
   return [
     ...kegs,
     "/opt/homebrew/bin/node",
     "/usr/local/bin/node",
-    (0, import_node_path25.join)(home, ".local/share/fnm/aliases/default/bin/node"),
-    (0, import_node_path25.join)(home, ".nvm/current/bin/node"),
-    (0, import_node_path25.join)(home, ".volta/bin/node"),
-    (0, import_node_path25.join)(home, ".asdf/shims/node"),
-    (0, import_node_path25.join)(home, ".local/share/mise/shims/node"),
+    (0, import_node_path26.join)(home, ".local/share/fnm/aliases/default/bin/node"),
+    (0, import_node_path26.join)(home, ".nvm/current/bin/node"),
+    (0, import_node_path26.join)(home, ".volta/bin/node"),
+    (0, import_node_path26.join)(home, ".asdf/shims/node"),
+    (0, import_node_path26.join)(home, ".local/share/mise/shims/node"),
     ...versionDirNodeBins(
-      (0, import_node_path25.join)(home, ".nvm", "versions", "node"),
-      (name) => (0, import_node_path25.join)(home, ".nvm", "versions", "node", name, "bin", "node")
+      (0, import_node_path26.join)(home, ".nvm", "versions", "node"),
+      (name) => (0, import_node_path26.join)(home, ".nvm", "versions", "node", name, "bin", "node")
     ),
     ...versionDirNodeBins(
-      (0, import_node_path25.join)(home, ".local/share/fnm", "node-versions"),
-      (name) => (0, import_node_path25.join)(home, ".local/share/fnm", "node-versions", name, "installation", "bin", "node")
+      (0, import_node_path26.join)(home, ".local/share/fnm", "node-versions"),
+      (name) => (0, import_node_path26.join)(home, ".local/share/fnm", "node-versions", name, "installation", "bin", "node")
     ),
     ...versionDirNodeBins(
-      (0, import_node_path25.join)(home, ".volta", "tools", "image", "node"),
-      (name) => (0, import_node_path25.join)(home, ".volta", "tools", "image", "node", name, "bin", "node")
+      (0, import_node_path26.join)(home, ".volta", "tools", "image", "node"),
+      (name) => (0, import_node_path26.join)(home, ".volta", "tools", "image", "node", name, "bin", "node")
     )
   ];
 }
@@ -9491,10 +9633,10 @@ function uniqueExistingNodeBins(paths) {
   const out = [];
   for (const raw of paths) {
     const p = raw.trim();
-    if (!p || !(0, import_node_fs23.existsSync)(p) || isElectronLikeCommand(p)) continue;
+    if (!p || !(0, import_node_fs24.existsSync)(p) || isElectronLikeCommand(p)) continue;
     let key = p;
     try {
-      key = (0, import_node_fs23.realpathSync)(p);
+      key = (0, import_node_fs24.realpathSync)(p);
     } catch {
       continue;
     }
@@ -9574,14 +9716,15 @@ async function resolveNodeLaunch(scriptPath) {
     env: { ELECTRON_RUN_AS_NODE: "1" }
   };
 }
-var import_node_fs23, import_node_os8, import_node_path25, AGENT_RUNNER_MAX_OLD_SPACE_MB, MAX_OLD_SPACE_FLAG, PREFERRED_LTS_MAJORS;
+var import_node_fs24, import_node_os8, import_node_path26, AGENT_RUNNER_MAX_OLD_SPACE_MB, MAX_OLD_SPACE_FLAG, PREFERRED_LTS_MAJORS;
 var init_node_launch = __esm({
   "src/agents/node-launch.ts"() {
     "use strict";
-    import_node_fs23 = require("fs");
+    import_node_fs24 = require("fs");
     import_node_os8 = require("os");
-    import_node_path25 = require("path");
+    import_node_path26 = require("path");
     init_nested_electron_env();
+    init_system_ca();
     init_run();
     init_packaged_runtime();
     AGENT_RUNNER_MAX_OLD_SPACE_MB = 8192;
@@ -9681,37 +9824,37 @@ function corePackageDir() {
   try {
     const url = import_meta.url;
     if (typeof url === "string" && url.length > 0) {
-      return (0, import_node_path26.dirname)((0, import_node_url.fileURLToPath)(url));
+      return (0, import_node_path27.dirname)((0, import_node_url.fileURLToPath)(url));
     }
   } catch {
   }
   try {
-    const req = (0, import_node_module.createRequire)((0, import_node_path26.join)(process.cwd(), "package.json"));
-    return (0, import_node_path26.dirname)(req.resolve("@sideboard-ai/core"));
+    const req = (0, import_node_module.createRequire)((0, import_node_path27.join)(process.cwd(), "package.json"));
+    return (0, import_node_path27.dirname)(req.resolve("@sideboard-ai/core"));
   } catch {
     return process.cwd();
   }
 }
 function findSideboardMcpJsEntry() {
   const override = process.env.SIDEBOARD_MCP_ENTRY?.trim() || process.env.SIDEBOARD_CLI?.trim();
-  if (override && (0, import_node_fs24.existsSync)(override)) return override;
+  if (override && (0, import_node_fs25.existsSync)(override)) return override;
   const packaged = packagedMcpStdioPath();
   if (packaged) return packaged;
   let dir = corePackageDir();
   for (let i = 0; i < 10; i++) {
     const candidates = [
-      (0, import_node_path26.join)(dir, "mcp/run-stdio.js"),
-      (0, import_node_path26.join)(dir, "mcp/run-stdio.cjs"),
-      (0, import_node_path26.join)(dir, "dist/mcp/run-stdio.js"),
-      (0, import_node_path26.join)(dir, "dist/mcp/run-stdio.cjs"),
-      (0, import_node_path26.join)(dir, "packages/core/dist/mcp/run-stdio.js"),
-      (0, import_node_path26.join)(dir, "packages/cli/dist/index.js"),
-      (0, import_node_path26.join)(dir, "cli/dist/index.js")
+      (0, import_node_path27.join)(dir, "mcp/run-stdio.js"),
+      (0, import_node_path27.join)(dir, "mcp/run-stdio.cjs"),
+      (0, import_node_path27.join)(dir, "dist/mcp/run-stdio.js"),
+      (0, import_node_path27.join)(dir, "dist/mcp/run-stdio.cjs"),
+      (0, import_node_path27.join)(dir, "packages/core/dist/mcp/run-stdio.js"),
+      (0, import_node_path27.join)(dir, "packages/cli/dist/index.js"),
+      (0, import_node_path27.join)(dir, "cli/dist/index.js")
     ];
     for (const p of candidates) {
-      if ((0, import_node_fs24.existsSync)(p) && !isAsarPath(p)) return p;
+      if ((0, import_node_fs25.existsSync)(p) && !isAsarPath(p)) return p;
     }
-    const parent = (0, import_node_path26.dirname)(dir);
+    const parent = (0, import_node_path27.dirname)(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -9858,19 +10001,19 @@ function writeMcpServersConfig(servers) {
       ...env ? { env } : {}
     };
   }
-  const dir = (0, import_node_fs24.mkdtempSync)((0, import_node_path26.join)((0, import_node_os9.tmpdir)(), "sideboard-mcp-"));
-  const cfgPath = (0, import_node_path26.join)(dir, "mcp.json");
-  (0, import_node_fs24.writeFileSync)(cfgPath, JSON.stringify({ mcpServers }, null, 2));
+  const dir = (0, import_node_fs25.mkdtempSync)((0, import_node_path27.join)((0, import_node_os9.tmpdir)(), "sideboard-mcp-"));
+  const cfgPath = (0, import_node_path27.join)(dir, "mcp.json");
+  (0, import_node_fs25.writeFileSync)(cfgPath, JSON.stringify({ mcpServers }, null, 2));
   return cfgPath;
 }
-var import_node_fs24, import_node_module, import_node_os9, import_node_path26, import_node_url, import_meta, SIDEBOARD_MCP_ALLOWED_TOOLS, SIDEBOARD_ARTIFACT_MCP_ALLOWED_TOOLS, SIDEBOARD_GITHUB_MCP_ALLOWED_TOOLS, SIDEBOARD_LINEAR_MCP_ALLOWED_TOOLS, SIDEBOARD_ABLETIME_MCP_ALLOWED_TOOLS, brightsyMcpCommandCache, BRIGHTSY_WORD;
+var import_node_fs25, import_node_module, import_node_os9, import_node_path27, import_node_url, import_meta, SIDEBOARD_MCP_ALLOWED_TOOLS, SIDEBOARD_ARTIFACT_MCP_ALLOWED_TOOLS, SIDEBOARD_GITHUB_MCP_ALLOWED_TOOLS, SIDEBOARD_LINEAR_MCP_ALLOWED_TOOLS, SIDEBOARD_ABLETIME_MCP_ALLOWED_TOOLS, brightsyMcpCommandCache, BRIGHTSY_WORD;
 var init_injected_mcp = __esm({
   "src/agents/injected-mcp.ts"() {
     "use strict";
-    import_node_fs24 = require("fs");
+    import_node_fs25 = require("fs");
     import_node_module = require("module");
     import_node_os9 = require("os");
-    import_node_path26 = require("path");
+    import_node_path27 = require("path");
     import_node_url = require("url");
     init_run();
     init_config();
@@ -10253,11 +10396,11 @@ function parseIssuesJson(raw) {
   }
   return [];
 }
-var import_node_fs25, BASE_ALLOWED_TOOLS, CLAUDE_PRINT_BG_WAIT_CEILING_MS, CLAUDE_CHROME_ALLOWED_TOOLS, CLAUDE_PROMPT_ARG_MAX, mcpListCache, claudeAdapter;
+var import_node_fs26, BASE_ALLOWED_TOOLS, CLAUDE_PRINT_BG_WAIT_CEILING_MS, CLAUDE_CHROME_ALLOWED_TOOLS, CLAUDE_PROMPT_ARG_MAX, mcpListCache, claudeAdapter;
 var init_claude = __esm({
   "src/agents/claude.ts"() {
     "use strict";
-    import_node_fs25 = require("fs");
+    import_node_fs26 = require("fs");
     init_run();
     init_app_settings();
     init_claude_mcp();
@@ -10297,7 +10440,7 @@ var init_claude = __esm({
       async detect() {
         const claude = resolveClaudeExecutable();
         if (claude !== "claude") {
-          if (!(0, import_node_fs25.existsSync)(claude)) {
+          if (!(0, import_node_fs26.existsSync)(claude)) {
             return {
               agent: "claude",
               installed: false,
@@ -10556,13 +10699,13 @@ var init_claude = __esm({
 });
 
 // src/agents/user-mcp-config.ts
-var import_node_fs26, import_node_os10, import_node_path27;
+var import_node_fs27, import_node_os10, import_node_path28;
 var init_user_mcp_config = __esm({
   "src/agents/user-mcp-config.ts"() {
     "use strict";
-    import_node_fs26 = require("fs");
+    import_node_fs27 = require("fs");
     import_node_os10 = require("os");
-    import_node_path27 = require("path");
+    import_node_path28 = require("path");
     init_paths();
     init_injected_mcp();
   }
@@ -10590,25 +10733,25 @@ function listMcpNamesFromCodexToml(text7) {
 }
 function readJsonObject(path) {
   try {
-    return JSON.parse((0, import_node_fs27.readFileSync)(path, "utf8"));
+    return JSON.parse((0, import_node_fs28.readFileSync)(path, "utf8"));
   } catch {
     return {};
   }
 }
 function readText(path) {
   try {
-    return (0, import_node_fs27.readFileSync)(path, "utf8");
+    return (0, import_node_fs28.readFileSync)(path, "utf8");
   } catch {
     return "";
   }
 }
 function userCodexConfigPaths(home = (0, import_node_os11.homedir)()) {
-  return [(0, import_node_path28.join)(home, ".codex", "config.toml"), (0, import_node_path28.join)(home, ".config", "codex", "config.toml")];
+  return [(0, import_node_path29.join)(home, ".codex", "config.toml"), (0, import_node_path29.join)(home, ".config", "codex", "config.toml")];
 }
 function userOpencodeConfigPaths(home = (0, import_node_os11.homedir)()) {
   return [
-    (0, import_node_path28.join)(home, ".config", "opencode", "opencode.json"),
-    (0, import_node_path28.join)(home, ".config", "opencode", "opencode.jsonc")
+    (0, import_node_path29.join)(home, ".config", "opencode", "opencode.json"),
+    (0, import_node_path29.join)(home, ".config", "opencode", "opencode.jsonc")
   ];
 }
 function userMcpNamesToDisable(opts) {
@@ -10630,7 +10773,7 @@ function userMcpNamesToDisable(opts) {
 function listUserCodexMcpNames(home = (0, import_node_os11.homedir)()) {
   const names = [];
   for (const path of userCodexConfigPaths(home)) {
-    if (!(0, import_node_fs27.existsSync)(path)) continue;
+    if (!(0, import_node_fs28.existsSync)(path)) continue;
     names.push(...listMcpNamesFromCodexToml(readText(path)));
   }
   return names;
@@ -10638,7 +10781,7 @@ function listUserCodexMcpNames(home = (0, import_node_os11.homedir)()) {
 function listUserOpencodeMcpNames(home = (0, import_node_os11.homedir)()) {
   const names = [];
   for (const path of userOpencodeConfigPaths(home)) {
-    if (!(0, import_node_fs27.existsSync)(path)) continue;
+    if (!(0, import_node_fs28.existsSync)(path)) continue;
     names.push(...listMcpNamesFromJsonMap(readJsonObject(path), "mcp"));
   }
   return names;
@@ -10651,13 +10794,13 @@ function toCodexDisableUserMcpArgs(names) {
   }
   return args;
 }
-var import_node_fs27, import_node_os11, import_node_path28, import_smol_toml2;
+var import_node_fs28, import_node_os11, import_node_path29, import_smol_toml2;
 var init_orch_mcp_isolation = __esm({
   "src/agents/orch-mcp-isolation.ts"() {
     "use strict";
-    import_node_fs27 = require("fs");
+    import_node_fs28 = require("fs");
     import_node_os11 = require("os");
-    import_node_path28 = require("path");
+    import_node_path29 = require("path");
     import_smol_toml2 = require("smol-toml");
     init_user_mcp_config();
   }
@@ -10673,7 +10816,7 @@ async function listCodexModels() {
   if (codex === "codex") {
     const which = await run("which", ["codex"], { reject: false });
     if (which.exitCode !== 0) return FALLBACK_CODEX_MODELS;
-  } else if (!(0, import_node_fs28.existsSync)(codex)) {
+  } else if (!(0, import_node_fs29.existsSync)(codex)) {
     return FALLBACK_CODEX_MODELS;
   }
   const listed = await run(codex, ["debug", "models"], { reject: false });
@@ -10708,12 +10851,12 @@ function usageFromCodex(usage) {
 }
 function codexConfigHasNetworkAccess() {
   const candidates = [
-    (0, import_node_path29.join)((0, import_node_os12.homedir)(), ".codex", "config.toml"),
-    (0, import_node_path29.join)((0, import_node_os12.homedir)(), ".config", "codex", "config.toml")
+    (0, import_node_path30.join)((0, import_node_os12.homedir)(), ".codex", "config.toml"),
+    (0, import_node_path30.join)((0, import_node_os12.homedir)(), ".config", "codex", "config.toml")
   ];
   for (const path of candidates) {
-    if (!(0, import_node_fs28.existsSync)(path)) continue;
-    const text7 = (0, import_node_fs28.readFileSync)(path, "utf8");
+    if (!(0, import_node_fs29.existsSync)(path)) continue;
+    const text7 = (0, import_node_fs29.readFileSync)(path, "utf8");
     if (/network_access\s*=\s*true/.test(text7)) return true;
   }
   return false;
@@ -10745,21 +10888,21 @@ function asRecord2(value) {
   return void 0;
 }
 function codexLooksAuthenticated() {
-  const authPath = (0, import_node_path29.join)((0, import_node_os12.homedir)(), ".codex", "auth.json");
-  if (!(0, import_node_fs28.existsSync)(authPath)) return false;
+  const authPath = (0, import_node_path30.join)((0, import_node_os12.homedir)(), ".codex", "auth.json");
+  if (!(0, import_node_fs29.existsSync)(authPath)) return false;
   try {
-    return (0, import_node_fs28.statSync)(authPath).size > 2;
+    return (0, import_node_fs29.statSync)(authPath).size > 2;
   } catch {
     return false;
   }
 }
-var import_node_fs28, import_node_os12, import_node_path29, CODEX_PROMPT_ARG_MAX, FALLBACK_CODEX_MODELS, cachedCodexModels, CODEX_MODEL_CACHE_MS, codexAdapter;
+var import_node_fs29, import_node_os12, import_node_path30, CODEX_PROMPT_ARG_MAX, FALLBACK_CODEX_MODELS, cachedCodexModels, CODEX_MODEL_CACHE_MS, codexAdapter;
 var init_codex = __esm({
   "src/agents/codex.ts"() {
     "use strict";
-    import_node_fs28 = require("fs");
+    import_node_fs29 = require("fs");
     import_node_os12 = require("os");
-    import_node_path29 = require("path");
+    import_node_path30 = require("path");
     init_run();
     init_app_settings();
     init_global_workspace();
@@ -10785,7 +10928,7 @@ var init_codex = __esm({
       async detect() {
         const codex = resolveAgentExecutable("codex");
         if (codex !== "codex") {
-          if (!(0, import_node_fs28.existsSync)(codex)) {
+          if (!(0, import_node_fs29.existsSync)(codex)) {
             return {
               agent: "codex",
               installed: false,
@@ -11088,21 +11231,21 @@ function platformRipgrepPackage() {
 }
 function usableRipgrepPath(candidate) {
   const raw = candidate?.trim();
-  if (!raw || !(0, import_node_path30.isAbsolute)(raw)) return null;
+  if (!raw || !(0, import_node_path31.isAbsolute)(raw)) return null;
   const readable = nodeReadableScriptPath(raw);
-  if (!(0, import_node_fs29.existsSync)(readable) || isAsarPath(readable)) return null;
+  if (!(0, import_node_fs30.existsSync)(readable) || isAsarPath(readable)) return null;
   return readable;
 }
 function walkForBundledRipgrep(startFile) {
   if (!startFile) return null;
   const pkg = platformRipgrepPackage();
   const name = rgBinaryName();
-  let dir = (0, import_node_path30.dirname)((0, import_node_path30.resolve)(startFile));
-  const root = (0, import_node_path30.parse)(dir).root;
+  let dir = (0, import_node_path31.dirname)((0, import_node_path31.resolve)(startFile));
+  const root = (0, import_node_path31.parse)(dir).root;
   while (dir !== root) {
-    const hit = usableRipgrepPath((0, import_node_path30.join)(dir, "node_modules", pkg, "bin", name));
+    const hit = usableRipgrepPath((0, import_node_path31.join)(dir, "node_modules", pkg, "bin", name));
     if (hit) return hit;
-    const next = (0, import_node_path30.dirname)(dir);
+    const next = (0, import_node_path31.dirname)(dir);
     if (next === dir) break;
     dir = next;
   }
@@ -11112,7 +11255,7 @@ function requireResolveBundledRipgrep(fromFile) {
   try {
     const req = (0, import_node_module2.createRequire)(fromFile);
     const pkgJson = req.resolve(`${platformRipgrepPackage()}/package.json`);
-    return usableRipgrepPath((0, import_node_path30.join)((0, import_node_path30.dirname)(pkgJson), "bin", rgBinaryName()));
+    return usableRipgrepPath((0, import_node_path31.join)((0, import_node_path31.dirname)(pkgJson), "bin", rgBinaryName()));
   } catch {
     return null;
   }
@@ -11134,13 +11277,13 @@ function cursorRipgrepEnv(opts) {
   const path = resolveCursorRipgrepPath(opts);
   return path ? { [RIPGREP_ENV]: path } : {};
 }
-var import_node_fs29, import_node_module2, import_node_path30, RIPGREP_ENV;
+var import_node_fs30, import_node_module2, import_node_path31, RIPGREP_ENV;
 var init_cursor_ripgrep = __esm({
   "src/agents/cursor-ripgrep.ts"() {
     "use strict";
-    import_node_fs29 = require("fs");
+    import_node_fs30 = require("fs");
     import_node_module2 = require("module");
-    import_node_path30 = require("path");
+    import_node_path31 = require("path");
     init_node_launch();
     init_packaged_runtime();
     RIPGREP_ENV = "CURSOR_RIPGREP_PATH";
@@ -11178,11 +11321,11 @@ function entryDir() {
   const cjsDir = typeof __dirname !== "undefined" ? __dirname : "";
   if (cjsDir) return cjsDir;
   try {
-    return (0, import_node_path31.dirname)((0, import_node_url2.fileURLToPath)(import_meta2.url));
+    return (0, import_node_path32.dirname)((0, import_node_url2.fileURLToPath)(import_meta2.url));
   } catch {
     try {
       const req = (0, import_node_module3.createRequire)(process.cwd() + "/");
-      return (0, import_node_path31.dirname)(req.resolve("@sideboard-ai/core"));
+      return (0, import_node_path32.dirname)(req.resolve("@sideboard-ai/core"));
     } catch {
       return process.cwd();
     }
@@ -11193,27 +11336,27 @@ function cursorRunnerPath() {
   if (packaged) return packaged;
   const root = entryDir();
   const candidates = [
-    (0, import_node_path31.join)(root, "agents", "cursor-runner.js"),
-    (0, import_node_path31.join)(root, "agents", "cursor-runner.cjs"),
+    (0, import_node_path32.join)(root, "agents", "cursor-runner.js"),
+    (0, import_node_path32.join)(root, "agents", "cursor-runner.cjs"),
     // If somehow resolved from package root instead of dist/
-    (0, import_node_path31.join)(root, "dist", "agents", "cursor-runner.js"),
-    (0, import_node_path31.join)(root, "dist", "agents", "cursor-runner.cjs"),
+    (0, import_node_path32.join)(root, "dist", "agents", "cursor-runner.js"),
+    (0, import_node_path32.join)(root, "dist", "agents", "cursor-runner.cjs"),
     // Source tree (dev): packages/core/src/agents/cursor-runner.ts
-    (0, import_node_path31.join)(root, "cursor-runner.ts"),
-    (0, import_node_path31.join)(root, "src", "agents", "cursor-runner.ts")
+    (0, import_node_path32.join)(root, "cursor-runner.ts"),
+    (0, import_node_path32.join)(root, "src", "agents", "cursor-runner.ts")
   ];
   for (const candidate of candidates) {
-    if ((0, import_node_fs30.existsSync)(candidate)) return candidate;
+    if ((0, import_node_fs31.existsSync)(candidate)) return candidate;
   }
   return candidates[0];
 }
-var import_node_fs30, import_node_module3, import_node_path31, import_node_url2, import_sdk, import_meta2, FALLBACK_CURSOR_MODELS, cachedModels, MODEL_CACHE_MS, cursorAdapter;
+var import_node_fs31, import_node_module3, import_node_path32, import_node_url2, import_sdk, import_meta2, FALLBACK_CURSOR_MODELS, cachedModels, MODEL_CACHE_MS, cursorAdapter;
 var init_cursor = __esm({
   "src/agents/cursor.ts"() {
     "use strict";
-    import_node_fs30 = require("fs");
+    import_node_fs31 = require("fs");
     import_node_module3 = require("module");
-    import_node_path31 = require("path");
+    import_node_path32 = require("path");
     import_node_url2 = require("url");
     import_sdk = require("@cursor/sdk");
     init_run();
@@ -11365,7 +11508,7 @@ async function listOpencodeModels() {
   if (opencode === "opencode") {
     const which = await run("which", ["opencode"], { reject: false });
     if (which.exitCode !== 0) return FALLBACK_OPENCODE_MODELS;
-  } else if (!(0, import_node_fs31.existsSync)(opencode)) {
+  } else if (!(0, import_node_fs32.existsSync)(opencode)) {
     return FALLBACK_OPENCODE_MODELS;
   }
   const listed = await run(opencode, ["models"], { reject: false });
@@ -11395,11 +11538,11 @@ function usageFromOpencode(tokens) {
     cacheWriteTokens: tokens.cache?.write ? Number(tokens.cache.write) : void 0
   };
 }
-var import_node_fs31, FALLBACK_OPENCODE_MODELS, cachedOpencodeModels, OPENCODE_MODEL_CACHE_MS, opencodeAdapter;
+var import_node_fs32, FALLBACK_OPENCODE_MODELS, cachedOpencodeModels, OPENCODE_MODEL_CACHE_MS, opencodeAdapter;
 var init_opencode = __esm({
   "src/agents/opencode.ts"() {
     "use strict";
-    import_node_fs31 = require("fs");
+    import_node_fs32 = require("fs");
     init_run();
     init_app_settings();
     init_global_workspace();
@@ -11427,7 +11570,7 @@ var init_opencode = __esm({
       async detect() {
         const opencode = resolveAgentExecutable("opencode");
         if (opencode !== "opencode") {
-          if (!(0, import_node_fs31.existsSync)(opencode)) {
+          if (!(0, import_node_fs32.existsSync)(opencode)) {
             return {
               agent: "opencode",
               installed: false,
@@ -11955,15 +12098,15 @@ var init_agents = __esm({
 
 // src/hook/worktree-pkg-cache.ts
 function worktreePkgCacheRoot(worktreePath) {
-  return (0, import_node_path32.join)(worktreePath, WORKTREE_PKG_CACHE_REL);
+  return (0, import_node_path33.join)(worktreePath, WORKTREE_PKG_CACHE_REL);
 }
 function worktreePkgCacheEnv(worktreePath) {
   const root = worktreePkgCacheRoot(worktreePath);
-  const store = (0, import_node_path32.join)(root, "pnpm-store");
-  const pnpmCache = (0, import_node_path32.join)(root, "pnpm");
-  const npmCache = (0, import_node_path32.join)(root, "npm");
-  const nodeGyp = (0, import_node_path32.join)(root, "node-gyp");
-  const electron = (0, import_node_path32.join)(root, "electron");
+  const store = (0, import_node_path33.join)(root, "pnpm-store");
+  const pnpmCache = (0, import_node_path33.join)(root, "pnpm");
+  const npmCache = (0, import_node_path33.join)(root, "npm");
+  const nodeGyp = (0, import_node_path33.join)(root, "node-gyp");
+  const electron = (0, import_node_path33.join)(root, "electron");
   return {
     npm_config_store_dir: store,
     PNPM_STORE_DIR: store,
@@ -11985,8 +12128,8 @@ function fillGroup(env, keys, values) {
   }
 }
 function ensureWorktreePkgCacheDirs(worktreePath) {
-  if (!(0, import_node_fs32.existsSync)(worktreePath)) return;
-  (0, import_node_fs32.mkdirSync)(worktreePkgCacheRoot(worktreePath), { recursive: true });
+  if (!(0, import_node_fs33.existsSync)(worktreePath)) return;
+  (0, import_node_fs33.mkdirSync)(worktreePkgCacheRoot(worktreePath), { recursive: true });
 }
 function applyWorktreePkgCacheEnv(env, worktreePath) {
   const cwd = worktreePath.trim();
@@ -11999,12 +12142,12 @@ function applyWorktreePkgCacheEnv(env, worktreePath) {
   fillGroup(env, ["electron_config_cache"], next);
   ensureWorktreePkgCacheDirs(cwd);
 }
-var import_node_fs32, import_node_path32, WORKTREE_PKG_CACHE_REL;
+var import_node_fs33, import_node_path33, WORKTREE_PKG_CACHE_REL;
 var init_worktree_pkg_cache = __esm({
   "src/hook/worktree-pkg-cache.ts"() {
     "use strict";
-    import_node_fs32 = require("fs");
-    import_node_path32 = require("path");
+    import_node_fs33 = require("fs");
+    import_node_path33 = require("path");
     WORKTREE_PKG_CACHE_REL = ".context/.sideboard/pkg-cache";
   }
 });
@@ -13109,21 +13252,21 @@ function shouldRefreshReviewRequestTemplate(content) {
   return LEGACY_REVIEW_TEMPLATE_MARKERS.every((m) => trimmed.includes(m));
 }
 function readTextIfPresent(abs) {
-  if (!(0, import_node_fs33.existsSync)(abs)) return null;
+  if (!(0, import_node_fs34.existsSync)(abs)) return null;
   try {
-    const content = (0, import_node_fs33.readFileSync)(abs, "utf8");
+    const content = (0, import_node_fs34.readFileSync)(abs, "utf8");
     return content.trim() ? content : null;
   } catch {
     return null;
   }
 }
 function readLocalGuidelines(worktreePath) {
-  const localAbs = (0, import_node_path33.join)(worktreePath, REVIEW_REQUEST_PATH);
+  const localAbs = (0, import_node_path34.join)(worktreePath, REVIEW_REQUEST_PATH);
   const localContent = readTextIfPresent(localAbs);
   if (localContent && !shouldRefreshReviewRequestTemplate(localContent)) {
     return { path: REVIEW_REQUEST_PATH, content: localContent };
   }
-  const legacyAbs = (0, import_node_path33.join)(worktreePath, LEGACY_REVIEW_REQUEST_PATH);
+  const legacyAbs = (0, import_node_path34.join)(worktreePath, LEGACY_REVIEW_REQUEST_PATH);
   const legacyContent = readTextIfPresent(legacyAbs);
   if (legacyContent && !shouldRefreshReviewRequestTemplate(legacyContent)) {
     return { path: LEGACY_REVIEW_REQUEST_PATH, content: legacyContent };
@@ -13147,27 +13290,27 @@ function contextGuidelines(content, source) {
   };
 }
 function writeContextGuidelines(worktreePath, content) {
-  const abs = (0, import_node_path33.join)(worktreePath, CONTEXT_REVIEW_PATH);
-  (0, import_node_fs33.mkdirSync)((0, import_node_path33.dirname)(abs), { recursive: true });
+  const abs = (0, import_node_path34.join)(worktreePath, CONTEXT_REVIEW_PATH);
+  (0, import_node_fs34.mkdirSync)((0, import_node_path34.dirname)(abs), { recursive: true });
   const body = content.endsWith("\n") ? content : `${content}
 `;
-  (0, import_node_fs33.writeFileSync)(abs, body, "utf8");
+  (0, import_node_fs34.writeFileSync)(abs, body, "utf8");
   return body;
 }
 function readSideboardReview(worktreePath, repoPath) {
-  const fromWorktree = readTextIfPresent((0, import_node_path33.join)(worktreePath, REPO_REVIEW_PATH));
+  const fromWorktree = readTextIfPresent((0, import_node_path34.join)(worktreePath, REPO_REVIEW_PATH));
   if (fromWorktree) return fromWorktree;
   const repo = repoPath?.replace(/\/+$/, "");
   const wt = worktreePath.replace(/\/+$/, "");
   if (!repo || repo === wt) return null;
-  return readTextIfPresent((0, import_node_path33.join)(repo, REPO_REVIEW_PATH));
+  return readTextIfPresent((0, import_node_path34.join)(repo, REPO_REVIEW_PATH));
 }
 function ensureReviewGuidelinesFile(worktreePath, repoPath) {
-  const skillContent = readTextIfPresent((0, import_node_path33.join)(worktreePath, REVIEW_SKILL_PATH));
+  const skillContent = readTextIfPresent((0, import_node_path34.join)(worktreePath, REVIEW_SKILL_PATH));
   if (skillContent) {
     return { ...skillGuidelines(skillContent, "skill"), wrote: false };
   }
-  const contextContent = readTextIfPresent((0, import_node_path33.join)(worktreePath, CONTEXT_REVIEW_PATH));
+  const contextContent = readTextIfPresent((0, import_node_path34.join)(worktreePath, CONTEXT_REVIEW_PATH));
   if (contextContent && !shouldRefreshReviewRequestTemplate(contextContent)) {
     return { ...contextGuidelines(contextContent, "local"), wrote: false };
   }
@@ -13222,13 +13365,13 @@ async function requestReview(threadRef, send) {
   const started = await send(tab.id, REVIEW_REQUEST_PREFILL);
   return { tab: started, from };
 }
-var import_node_crypto7, import_node_fs33, import_node_path33, REPO_REVIEW_PATH, REPO_REVIEW_NAME, CONTEXT_REVIEW_PATH, REVIEW_REQUEST_PATH, LEGACY_REVIEW_REQUEST_PATH, REVIEW_REQUEST_NAME, REVIEW_REQUEST_PREFILL, LEGACY_REVIEW_TEMPLATE_MARKERS;
+var import_node_crypto7, import_node_fs34, import_node_path34, REPO_REVIEW_PATH, REPO_REVIEW_NAME, CONTEXT_REVIEW_PATH, REVIEW_REQUEST_PATH, LEGACY_REVIEW_REQUEST_PATH, REVIEW_REQUEST_NAME, REVIEW_REQUEST_PREFILL, LEGACY_REVIEW_TEMPLATE_MARKERS;
 var init_request_review = __esm({
   "src/review/request-review.ts"() {
     "use strict";
     import_node_crypto7 = require("crypto");
-    import_node_fs33 = require("fs");
-    import_node_path33 = require("path");
+    import_node_fs34 = require("fs");
+    import_node_path34 = require("path");
     init_global_workspace();
     init_chat_tabs();
     init_thread_store();
@@ -13254,9 +13397,9 @@ function matchSimpleGlob(pattern, name) {
   return new RegExp(`^${escaped}$`).test(name);
 }
 function readWorktreeInclude(repoPath) {
-  const path = (0, import_node_path34.join)(repoPath, ".worktreeinclude");
-  if (!(0, import_node_fs34.existsSync)(path)) return [];
-  return (0, import_node_fs34.readFileSync)(path, "utf8").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
+  const path = (0, import_node_path35.join)(repoPath, ".worktreeinclude");
+  if (!(0, import_node_fs35.existsSync)(path)) return [];
+  return (0, import_node_fs35.readFileSync)(path, "utf8").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
 }
 function resolveFilesToCopy(repoPath) {
   const fromInclude = readWorktreeInclude(repoPath);
@@ -13266,10 +13409,10 @@ function resolveFilesToCopy(repoPath) {
   if (settings?.fileIncludeGlobs?.length) {
     const matched = [];
     try {
-      for (const entry of (0, import_node_fs34.readdirSync)(repoPath, { withFileTypes: true })) {
+      for (const entry of (0, import_node_fs35.readdirSync)(repoPath, { withFileTypes: true })) {
         if (!entry.isFile()) continue;
         for (const glob of settings.fileIncludeGlobs) {
-          if (matchSimpleGlob(glob, entry.name) || matchSimpleGlob((0, import_node_path34.basename)(glob), entry.name)) {
+          if (matchSimpleGlob(glob, entry.name) || matchSimpleGlob((0, import_node_path35.basename)(glob), entry.name)) {
             matched.push(entry.name);
             break;
           }
@@ -13281,7 +13424,7 @@ function resolveFilesToCopy(repoPath) {
   }
   const defaults = [];
   try {
-    for (const entry of (0, import_node_fs34.readdirSync)(repoPath, { withFileTypes: true })) {
+    for (const entry of (0, import_node_fs35.readdirSync)(repoPath, { withFileTypes: true })) {
       if (entry.isFile() && entry.name.startsWith(".env")) {
         defaults.push(entry.name);
       }
@@ -13295,11 +13438,11 @@ function copyConfiguredFiles(repoPath, worktreePath) {
   const patterns = resolveFilesToCopy(repoPath);
   const copied = [];
   for (const rel of patterns) {
-    const src = (0, import_node_path34.join)(repoPath, rel);
-    if (!(0, import_node_fs34.existsSync)(src)) continue;
-    const dest = (0, import_node_path34.join)(worktreePath, rel);
-    (0, import_node_fs34.mkdirSync)((0, import_node_path34.dirname)(dest), { recursive: true });
-    (0, import_node_fs34.copyFileSync)(src, dest);
+    const src = (0, import_node_path35.join)(repoPath, rel);
+    if (!(0, import_node_fs35.existsSync)(src)) continue;
+    const dest = (0, import_node_path35.join)(worktreePath, rel);
+    (0, import_node_fs35.mkdirSync)((0, import_node_path35.dirname)(dest), { recursive: true });
+    (0, import_node_fs35.copyFileSync)(src, dest);
     copied.push(rel);
   }
   return copied;
@@ -13334,7 +13477,7 @@ function buildWorkspaceScriptEnv(opts, baseEnv) {
   const env = stripNestedElectronEnv({
     ...baseEnv ?? process.env
   });
-  const name = opts.workspaceName ?? (0, import_node_path34.basename)(opts.worktreePath);
+  const name = opts.workspaceName ?? (0, import_node_path35.basename)(opts.worktreePath);
   const ports = opts.ports ?? [];
   const primary = ports[0];
   env.SIDEBOARD_WORKSPACE_NAME = name;
@@ -13597,13 +13740,13 @@ async function startDevServer(repoPath, worktreePath, onLine, opts) {
     done: handle.done
   };
 }
-var import_node_fs34, import_node_net, import_node_path34, import_execa4, import_node_readline3, PORT_RANGE_SIZE, cachedLoginEnv;
+var import_node_fs35, import_node_net, import_node_path35, import_execa4, import_node_readline3, PORT_RANGE_SIZE, cachedLoginEnv;
 var init_conductor = __esm({
   "src/hook/conductor.ts"() {
     "use strict";
-    import_node_fs34 = require("fs");
+    import_node_fs35 = require("fs");
     import_node_net = require("net");
-    import_node_path34 = require("path");
+    import_node_path35 = require("path");
     import_execa4 = require("execa");
     import_node_readline3 = require("readline");
     init_settings();
@@ -13622,7 +13765,7 @@ var init_conductor = __esm({
 
 // src/store/setup-log.ts
 function setupLogPath(threadId) {
-  return (0, import_node_path35.join)(threadsDir(), `${threadId}.setup.log.json`);
+  return (0, import_node_path36.join)(threadsDir(), `${threadId}.setup.log.json`);
 }
 function emptySetupLog() {
   return { ...EMPTY };
@@ -13639,7 +13782,7 @@ function persistNow(threadId) {
   const snap = memory.get(threadId);
   if (!snap) return;
   try {
-    (0, import_node_fs35.writeFileSync)(setupLogPath(threadId), `${JSON.stringify(snap)}
+    (0, import_node_fs36.writeFileSync)(setupLogPath(threadId), `${JSON.stringify(snap)}
 `, "utf8");
   } catch {
   }
@@ -13656,9 +13799,9 @@ function schedulePersist(threadId) {
 }
 function loadFromDisk(threadId) {
   const path = setupLogPath(threadId);
-  if (!(0, import_node_fs35.existsSync)(path)) return null;
+  if (!(0, import_node_fs36.existsSync)(path)) return null;
   try {
-    const raw = JSON.parse((0, import_node_fs35.readFileSync)(path, "utf8"));
+    const raw = JSON.parse((0, import_node_fs36.readFileSync)(path, "utf8"));
     return {
       output: typeof raw.output === "string" ? raw.output : "",
       running: Boolean(raw.running),
@@ -13714,12 +13857,12 @@ function finishSetupLog(threadId, exitCode, source) {
   persistNow(threadId);
   return clone(snap);
 }
-var import_node_fs35, import_node_path35, EMPTY, memory, persistTimers;
+var import_node_fs36, import_node_path36, EMPTY, memory, persistTimers;
 var init_setup_log = __esm({
   "src/store/setup-log.ts"() {
     "use strict";
-    import_node_fs35 = require("fs");
-    import_node_path35 = require("path");
+    import_node_fs36 = require("fs");
+    import_node_path36 = require("path");
     init_paths();
     EMPTY = {
       output: "",
@@ -13743,9 +13886,9 @@ async function findOrphanWorktrees(repoPaths) {
     repoPaths?.length ? repoPaths : threads.map((t) => t.repoPath).filter(Boolean)
   );
   const homeRoot = sideboardWorkspacesDir();
-  if ((0, import_node_fs36.existsSync)(homeRoot)) {
+  if ((0, import_node_fs37.existsSync)(homeRoot)) {
     try {
-      for (const entry of (0, import_node_fs36.readdirSync)(homeRoot, { withFileTypes: true })) {
+      for (const entry of (0, import_node_fs37.readdirSync)(homeRoot, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
         void entry;
       }
@@ -13755,7 +13898,7 @@ async function findOrphanWorktrees(repoPaths) {
   const orphans = [];
   const seen = /* @__PURE__ */ new Set();
   for (const repoPath of repos) {
-    if (!repoPath || !(0, import_node_fs36.existsSync)(repoPath)) continue;
+    if (!repoPath || !(0, import_node_fs37.existsSync)(repoPath)) continue;
     try {
       const wts = await listWorktrees(repoPath);
       for (const wt of wts) {
@@ -13766,7 +13909,7 @@ async function findOrphanWorktrees(repoPaths) {
         seen.add(path);
         let mtimeMs = 0;
         try {
-          mtimeMs = (0, import_node_fs36.statSync)(path).mtimeMs;
+          mtimeMs = (0, import_node_fs37.statSync)(path).mtimeMs;
         } catch {
           mtimeMs = 0;
         }
@@ -13776,16 +13919,16 @@ async function findOrphanWorktrees(repoPaths) {
     }
     try {
       const root = worktreesRoot(repoPath);
-      if ((0, import_node_fs36.existsSync)(root)) {
-        for (const entry of (0, import_node_fs36.readdirSync)(root, { withFileTypes: true })) {
+      if ((0, import_node_fs37.existsSync)(root)) {
+        for (const entry of (0, import_node_fs37.readdirSync)(root, { withFileTypes: true })) {
           if (!entry.isDirectory()) continue;
-          const path = (0, import_node_path36.join)(root, entry.name).replace(/\/$/, "");
+          const path = (0, import_node_path37.join)(root, entry.name).replace(/\/$/, "");
           if (known.has(path) || seen.has(path)) continue;
-          if (!(0, import_node_fs36.existsSync)((0, import_node_path36.join)(path, ".git"))) continue;
+          if (!(0, import_node_fs37.existsSync)((0, import_node_path37.join)(path, ".git"))) continue;
           seen.add(path);
           let mtimeMs = 0;
           try {
-            mtimeMs = (0, import_node_fs36.statSync)(path).mtimeMs;
+            mtimeMs = (0, import_node_fs37.statSync)(path).mtimeMs;
           } catch {
             mtimeMs = Date.now();
           }
@@ -13837,12 +13980,12 @@ function shouldRunWorktreeCleanup(settings = loadAppSettings()) {
   const elapsed = Date.now() - Date.parse(last);
   return elapsed >= intervalHours * 36e5;
 }
-var import_node_fs36, import_node_path36;
+var import_node_fs37, import_node_path37;
 var init_orphan_cleanup = __esm({
   "src/git/orphan-cleanup.ts"() {
     "use strict";
-    import_node_fs36 = require("fs");
-    import_node_path36 = require("path");
+    import_node_fs37 = require("fs");
+    import_node_path37 = require("path");
     init_worktree();
     init_thread_store();
     init_paths();
@@ -13945,12 +14088,12 @@ async function cloneRepoIntoSideboard(opts) {
   if (!url) throw new Error("Clone URL is required");
   let name = opts.name?.trim();
   if (!name) {
-    const leaf = (0, import_node_path37.basename)(url.replace(/\/$/, "").replace(/\.git$/, ""));
+    const leaf = (0, import_node_path38.basename)(url.replace(/\/$/, "").replace(/\.git$/, ""));
     name = leaf || "repo";
   }
   name = name.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "repo";
-  const dest = (0, import_node_path37.join)(sideboardReposDir(), name);
-  if ((0, import_node_fs37.existsSync)(dest)) {
+  const dest = (0, import_node_path38.join)(sideboardReposDir(), name);
+  if ((0, import_node_fs38.existsSync)(dest)) {
     const repoPath2 = await resolveRepoRoot(dest);
     const workspace2 = await ensureWorkspace(repoPath2);
     return { repoPath: repoPath2, workspace: workspace2 };
@@ -13965,12 +14108,12 @@ async function cloneRepoIntoSideboard(opts) {
   const workspace = await ensureWorkspace(repoPath);
   return { repoPath, workspace };
 }
-var import_node_fs37, import_node_path37, import_execa6;
+var import_node_fs38, import_node_path38, import_execa6;
 var init_clone_repo = __esm({
   "src/git/clone-repo.ts"() {
     "use strict";
-    import_node_fs37 = require("fs");
-    import_node_path37 = require("path");
+    import_node_fs38 = require("fs");
+    import_node_path38 = require("path");
     import_execa6 = require("execa");
     init_paths();
     init_workspaces2();
@@ -13980,11 +14123,11 @@ var init_clone_repo = __esm({
 
 // src/store/desktop-host.ts
 function desktopHostPidPath() {
-  return (0, import_node_path38.join)(appDataDir(), "desktop-host.pid");
+  return (0, import_node_path39.join)(appDataDir(), "desktop-host.pid");
 }
 function readDesktopHostPid() {
   try {
-    const pid = Number.parseInt((0, import_node_fs38.readFileSync)(desktopHostPidPath(), "utf8").trim(), 10);
+    const pid = Number.parseInt((0, import_node_fs39.readFileSync)(desktopHostPidPath(), "utf8").trim(), 10);
     if (!Number.isFinite(pid) || pid <= 0) return null;
     return pid;
   } catch {
@@ -14010,12 +14153,12 @@ function thisProcessShouldDrainAgentQueues() {
   if (isThisProcessDesktopHost()) return true;
   return !isDesktopHostAlive();
 }
-var import_node_fs38, import_node_path38;
+var import_node_fs39, import_node_path39;
 var init_desktop_host = __esm({
   "src/store/desktop-host.ts"() {
     "use strict";
-    import_node_fs38 = require("fs");
-    import_node_path38 = require("path");
+    import_node_fs39 = require("fs");
+    import_node_path39 = require("path");
     init_paths();
   }
 });
@@ -14130,24 +14273,24 @@ function jobTreeAlive(pid) {
   return jobAlive(pid) || processGroupAlive(pid);
 }
 function readIntFile(file) {
-  if (!(0, import_node_fs39.existsSync)(file)) return null;
-  const n = Number.parseInt((0, import_node_fs39.readFileSync)(file, "utf8").trim(), 10);
+  if (!(0, import_node_fs40.existsSync)(file)) return null;
+  const n = Number.parseInt((0, import_node_fs40.readFileSync)(file, "utf8").trim(), 10);
   return Number.isInteger(n) ? n : null;
 }
 function jobDir(root, id, legacy = false) {
-  return (0, import_node_path39.join)(root, legacy ? LEGACY_DETACHED_JOBS_DIR : DETACHED_JOBS_DIR, id);
+  return (0, import_node_path40.join)(root, legacy ? LEGACY_DETACHED_JOBS_DIR : DETACHED_JOBS_DIR, id);
 }
 function resolveJobDir(root, id) {
   const modern = jobDir(root, id, false);
-  if ((0, import_node_fs39.existsSync)(modern)) return modern;
+  if ((0, import_node_fs40.existsSync)(modern)) return modern;
   const legacy = jobDir(root, id, true);
-  if ((0, import_node_fs39.existsSync)(legacy)) return legacy;
+  if ((0, import_node_fs40.existsSync)(legacy)) return legacy;
   return modern;
 }
 function listJobIdsIn(root, rel) {
-  const dir = (0, import_node_path39.join)(root, rel);
-  if (!(0, import_node_fs39.existsSync)(dir)) return [];
-  return (0, import_node_fs39.readdirSync)(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && JOB_ID_RE.test(e.name)).map((e) => e.name);
+  const dir = (0, import_node_path40.join)(root, rel);
+  if (!(0, import_node_fs40.existsSync)(dir)) return [];
+  return (0, import_node_fs40.readdirSync)(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && JOB_ID_RE.test(e.name)).map((e) => e.name);
 }
 function listRunningDetachedJobs(worktreePath) {
   const root = worktreePath.trim();
@@ -14159,7 +14302,7 @@ function listRunningDetachedJobs(worktreePath) {
   const running = [];
   for (const id of ids) {
     const dir = resolveJobDir(root, id);
-    const pid = readIntFile((0, import_node_path39.join)(dir, "pid"));
+    const pid = readIntFile((0, import_node_path40.join)(dir, "pid"));
     if (jobTreeAlive(pid)) running.push(id);
   }
   return running.sort();
@@ -14212,13 +14355,13 @@ function planJobContinue(opts) {
   return { action: "none" };
 }
 function tailProgress(logFile, maxLines = 12) {
-  if (!(0, import_node_fs39.existsSync)(logFile)) return "(no log yet)";
-  const lines = (0, import_node_fs39.readFileSync)(logFile, "utf8").split("\n");
+  if (!(0, import_node_fs40.existsSync)(logFile)) return "(no log yet)";
+  const lines = (0, import_node_fs40.readFileSync)(logFile, "utf8").split("\n");
   return lines.slice(-maxLines).join("\n");
 }
 function readLogLines(file) {
-  if (!(0, import_node_fs39.existsSync)(file)) return [];
-  const lines = (0, import_node_fs39.readFileSync)(file, "utf8").split("\n");
+  if (!(0, import_node_fs40.existsSync)(file)) return [];
+  const lines = (0, import_node_fs40.readFileSync)(file, "utf8").split("\n");
   if (lines.length && lines[lines.length - 1] === "") lines.pop();
   return lines;
 }
@@ -14229,15 +14372,15 @@ function takeDelta(logFile, cursorFile) {
   return { delta: lines.slice(start).join("\n"), nextCursor: lines.length };
 }
 function snapshotJob(dir) {
-  const pid = readIntFile((0, import_node_path39.join)(dir, "pid"));
+  const pid = readIntFile((0, import_node_path40.join)(dir, "pid"));
   const running = jobTreeAlive(pid);
   return {
     pid,
     running,
-    exitCode: readIntFile((0, import_node_path39.join)(dir, "exit")),
-    log: (0, import_node_path39.join)(dir, "log"),
-    cursor: (0, import_node_path39.join)(dir, "present.cursor"),
-    progress: tailProgress((0, import_node_path39.join)(dir, "log"))
+    exitCode: readIntFile((0, import_node_path40.join)(dir, "exit")),
+    log: (0, import_node_path40.join)(dir, "log"),
+    cursor: (0, import_node_path40.join)(dir, "present.cursor"),
+    progress: tailProgress((0, import_node_path40.join)(dir, "log"))
   };
 }
 function toResult(id, snap, extra) {
@@ -14246,8 +14389,8 @@ function toResult(id, snap, extra) {
   const stillRunning = snap.running && !ok;
   const { delta, nextCursor } = takeDelta(snap.log, snap.cursor);
   try {
-    (0, import_node_fs39.mkdirSync)((0, import_node_path39.dirname)(snap.cursor), { recursive: true });
-    (0, import_node_fs39.writeFileSync)(snap.cursor, `${nextCursor}
+    (0, import_node_fs40.mkdirSync)((0, import_node_path40.dirname)(snap.cursor), { recursive: true });
+    (0, import_node_fs40.writeFileSync)(snap.cursor, `${nextCursor}
 `);
   } catch {
   }
@@ -14274,7 +14417,7 @@ async function waitForDetachedJob(cwd, id, opts) {
   const dir = resolveJobDir(root, jobId);
   const timeoutMs = mcpWaitForJobTimeoutMs(opts?.timeoutMs);
   const sleep = opts?.sleep ?? sleepMs;
-  if (!(0, import_node_fs39.existsSync)(dir)) {
+  if (!(0, import_node_fs40.existsSync)(dir)) {
     return {
       stillRunning: false,
       ok: false,
@@ -14320,10 +14463,10 @@ function killProcessTree(pid, signal) {
 }
 function appendJobLog(logFile, line) {
   try {
-    (0, import_node_fs39.mkdirSync)((0, import_node_path39.dirname)(logFile), { recursive: true });
+    (0, import_node_fs40.mkdirSync)((0, import_node_path40.dirname)(logFile), { recursive: true });
     const body = line.endsWith("\n") ? line : `${line}
 `;
-    (0, import_node_fs39.appendFileSync)(logFile, body);
+    (0, import_node_fs40.appendFileSync)(logFile, body);
   } catch {
   }
 }
@@ -14333,7 +14476,7 @@ async function stopDetachedJob(cwd, id, opts) {
   const dir = resolveJobDir(root, jobId);
   const sleep = opts?.sleep ?? sleepMs;
   const why = opts?.reason?.trim() ?? "";
-  if (!(0, import_node_fs39.existsSync)(dir)) {
+  if (!(0, import_node_fs40.existsSync)(dir)) {
     return {
       stillRunning: false,
       ok: false,
@@ -14369,10 +14512,10 @@ async function stopDetachedJob(cwd, id, opts) {
     killProcessTree(targetPid, "SIGKILL");
     await sleep(100);
   }
-  const exitFile = (0, import_node_path39.join)(dir, "exit");
-  if (!(0, import_node_fs39.existsSync)(exitFile)) {
+  const exitFile = (0, import_node_path40.join)(dir, "exit");
+  if (!(0, import_node_fs40.existsSync)(exitFile)) {
     try {
-      (0, import_node_fs39.writeFileSync)(exitFile, "1\n");
+      (0, import_node_fs40.writeFileSync)(exitFile, "1\n");
     } catch {
     }
   }
@@ -14392,12 +14535,12 @@ async function stopDetachedJob(cwd, id, opts) {
     hint: stopped ? MCP_STOP_JOB_HINT : MCP_WAIT_JOB_STILL_RUNNING_HINT
   };
 }
-var import_node_fs39, import_node_path39, MAX_JOB_CONTINUES, MCP_WAIT_JOB_STILL_RUNNING_HINT, MCP_STOP_JOB_HINT, JOB_ID_RE;
+var import_node_fs40, import_node_path40, MAX_JOB_CONTINUES, MCP_WAIT_JOB_STILL_RUNNING_HINT, MCP_STOP_JOB_HINT, JOB_ID_RE;
 var init_wait_for_job = __esm({
   "src/mcp/wait-for-job.ts"() {
     "use strict";
-    import_node_fs39 = require("fs");
-    import_node_path39 = require("path");
+    import_node_fs40 = require("fs");
+    import_node_path40 = require("path");
     init_workspace_scratch();
     init_wait_for_turn();
     MAX_JOB_CONTINUES = 8;
@@ -15492,7 +15635,7 @@ function reuseLiveThread(input, repoPath, match) {
 }
 async function createThread(input, _onSetupLine) {
   const repoPath = await resolveRepoRoot(input.repoPath);
-  if (!(0, import_node_fs40.existsSync)(repoPath)) {
+  if (!(0, import_node_fs41.existsSync)(repoPath)) {
     throw new Error(`Repo not found: ${repoPath}`);
   }
   const reused = reuseLiveThread(input, repoPath, {
@@ -15664,11 +15807,11 @@ async function createThread(input, _onSetupLine) {
   await ensureWorkspace(repoPath);
   return readThread(thread.id) ?? thread;
 }
-var import_node_fs40;
+var import_node_fs41;
 var init_create = __esm({
   "src/threads/create.ts"() {
     "use strict";
-    import_node_fs40 = require("fs");
+    import_node_fs41 = require("fs");
     init_detect();
     init_worktree();
     init_home_board();
@@ -15788,20 +15931,20 @@ function writeTurnLive(threadId, progress) {
   const path = threadLivePath(threadId);
   const tmp = `${path}.${process.pid}.tmp`;
   try {
-    (0, import_node_fs41.writeFileSync)(tmp, JSON.stringify(progress), "utf8");
-    (0, import_node_fs41.renameSync)(tmp, path);
+    (0, import_node_fs42.writeFileSync)(tmp, JSON.stringify(progress), "utf8");
+    (0, import_node_fs42.renameSync)(tmp, path);
   } catch {
     try {
-      (0, import_node_fs41.unlinkSync)(tmp);
+      (0, import_node_fs42.unlinkSync)(tmp);
     } catch {
     }
   }
 }
 function readTurnLive(threadId) {
   const path = threadLivePath(threadId);
-  if (!(0, import_node_fs41.existsSync)(path)) return null;
+  if (!(0, import_node_fs42.existsSync)(path)) return null;
   try {
-    const raw = JSON.parse((0, import_node_fs41.readFileSync)(path, "utf8"));
+    const raw = JSON.parse((0, import_node_fs42.readFileSync)(path, "utf8"));
     if (!raw || typeof raw.summary !== "string") return null;
     return raw;
   } catch {
@@ -15813,17 +15956,17 @@ function clearTurnLive(threadId) {
   if (buf?.timer) clearTimeout(buf.timer);
   buffers.delete(threadId);
   const path = threadLivePath(threadId);
-  if (!(0, import_node_fs41.existsSync)(path)) return;
+  if (!(0, import_node_fs42.existsSync)(path)) return;
   try {
-    (0, import_node_fs41.unlinkSync)(path);
+    (0, import_node_fs42.unlinkSync)(path);
   } catch {
   }
 }
-var import_node_fs41, buffers, FLUSH_MS, MAX_PARTS;
+var import_node_fs42, buffers, FLUSH_MS, MAX_PARTS;
 var init_turn_live = __esm({
   "src/store/turn-live.ts"() {
     "use strict";
-    import_node_fs41 = require("fs");
+    import_node_fs42 = require("fs");
     init_message_parts();
     init_paths();
     buffers = /* @__PURE__ */ new Map();
@@ -16040,7 +16183,7 @@ var init_quota_failover = __esm({
 // src/threads/adopt.ts
 function thisModuleFile() {
   const cjsFile = typeof __filename !== "undefined" ? __filename : "";
-  return cjsFile || process.argv[1] || (0, import_node_path40.join)(process.cwd(), "package.json");
+  return cjsFile || process.argv[1] || (0, import_node_path41.join)(process.cwd(), "package.json");
 }
 function openReadonlySqlite(file) {
   const req = (0, import_node_module4.createRequire)(thisModuleFile());
@@ -16058,21 +16201,21 @@ function mapAgentType(raw) {
   return null;
 }
 function resolveConductorCursorAgentId(workspacePath) {
-  if (!workspacePath || !(0, import_node_fs42.existsSync)(CURSOR_SDK_STORE)) return null;
+  if (!workspacePath || !(0, import_node_fs43.existsSync)(CURSOR_SDK_STORE)) return null;
   const normalized = workspacePath.replace(/\/$/, "");
   let best = null;
   let hashes;
   try {
-    hashes = (0, import_node_fs42.readdirSync)(CURSOR_SDK_STORE);
+    hashes = (0, import_node_fs43.readdirSync)(CURSOR_SDK_STORE);
   } catch {
     return null;
   }
   for (const hash of hashes) {
-    const agentsFile = (0, import_node_path40.join)(CURSOR_SDK_STORE, hash, "agents.ndjson");
-    if (!(0, import_node_fs42.existsSync)(agentsFile)) continue;
+    const agentsFile = (0, import_node_path41.join)(CURSOR_SDK_STORE, hash, "agents.ndjson");
+    if (!(0, import_node_fs43.existsSync)(agentsFile)) continue;
     let text7;
     try {
-      text7 = (0, import_node_fs42.readFileSync)(agentsFile, "utf8");
+      text7 = (0, import_node_fs43.readFileSync)(agentsFile, "utf8");
     } catch {
       continue;
     }
@@ -16096,7 +16239,7 @@ function resolveConductorCursorAgentId(workspacePath) {
   return best?.agentId ?? null;
 }
 async function adoptThread(input) {
-  if (!(0, import_node_fs42.existsSync)(input.worktreePath)) {
+  if (!(0, import_node_fs43.existsSync)(input.worktreePath)) {
     throw new Error(`Worktree not found: ${input.worktreePath}`);
   }
   const repoPath = await resolveRepoRoot(input.worktreePath);
@@ -16122,18 +16265,18 @@ async function adoptThread(input) {
   return thread;
 }
 function listConductorWorkspaces() {
-  if (!(0, import_node_fs42.existsSync)(CONDUCTOR_DB)) {
+  if (!(0, import_node_fs43.existsSync)(CONDUCTOR_DB)) {
     throw new Error(`Conductor DB not found at ${CONDUCTOR_DB}`);
   }
-  const tmp = (0, import_node_fs42.mkdtempSync)((0, import_node_path40.join)((0, import_node_os13.tmpdir)(), "sideboard-conductor-"));
-  const snapshot = (0, import_node_path40.join)(tmp, "conductor.db");
+  const tmp = (0, import_node_fs43.mkdtempSync)((0, import_node_path41.join)((0, import_node_os13.tmpdir)(), "sideboard-conductor-"));
+  const snapshot = (0, import_node_path41.join)(tmp, "conductor.db");
   try {
-    (0, import_node_fs42.copyFileSync)(CONDUCTOR_DB, snapshot);
+    (0, import_node_fs43.copyFileSync)(CONDUCTOR_DB, snapshot);
     for (const suffix of ["-wal", "-shm"]) {
       const src = `${CONDUCTOR_DB}${suffix}`;
-      if ((0, import_node_fs42.existsSync)(src)) {
+      if ((0, import_node_fs43.existsSync)(src)) {
         try {
-          (0, import_node_fs42.copyFileSync)(src, `${snapshot}${suffix}`);
+          (0, import_node_fs43.copyFileSync)(src, `${snapshot}${suffix}`);
         } catch {
         }
       }
@@ -16209,22 +16352,22 @@ function listConductorWorkspaces() {
       db.close();
     }
   } finally {
-    (0, import_node_fs42.rmSync)(tmp, { recursive: true, force: true });
+    (0, import_node_fs43.rmSync)(tmp, { recursive: true, force: true });
   }
 }
 function importConductorWorkspace(workspaceId) {
-  if (!(0, import_node_fs42.existsSync)(CONDUCTOR_DB)) {
+  if (!(0, import_node_fs43.existsSync)(CONDUCTOR_DB)) {
     throw new Error(`Conductor DB not found at ${CONDUCTOR_DB}`);
   }
-  const tmp = (0, import_node_fs42.mkdtempSync)((0, import_node_path40.join)((0, import_node_os13.tmpdir)(), "sideboard-conductor-"));
-  const snapshot = (0, import_node_path40.join)(tmp, "conductor.db");
+  const tmp = (0, import_node_fs43.mkdtempSync)((0, import_node_path41.join)((0, import_node_os13.tmpdir)(), "sideboard-conductor-"));
+  const snapshot = (0, import_node_path41.join)(tmp, "conductor.db");
   try {
-    (0, import_node_fs42.copyFileSync)(CONDUCTOR_DB, snapshot);
+    (0, import_node_fs43.copyFileSync)(CONDUCTOR_DB, snapshot);
     for (const suffix of ["-wal", "-shm"]) {
       const src = `${CONDUCTOR_DB}${suffix}`;
-      if ((0, import_node_fs42.existsSync)(src)) {
+      if ((0, import_node_fs43.existsSync)(src)) {
         try {
-          (0, import_node_fs42.copyFileSync)(src, `${snapshot}${suffix}`);
+          (0, import_node_fs43.copyFileSync)(src, `${snapshot}${suffix}`);
         } catch {
         }
       }
@@ -16242,7 +16385,7 @@ function importConductorWorkspace(workspaceId) {
       ).get(workspaceId);
       if (!row) throw new Error(`Conductor workspace not found: ${workspaceId}`);
       const worktreePath = String(row.workspacePath);
-      if (!(0, import_node_fs42.existsSync)(worktreePath)) {
+      if (!(0, import_node_fs43.existsSync)(worktreePath)) {
         throw new Error(`Conductor worktree missing on disk: ${worktreePath}`);
       }
       let sessionId = null;
@@ -16282,7 +16425,7 @@ function importConductorWorkspace(workspaceId) {
       }
       let repoPath = worktreePath;
       try {
-        repoPath = (0, import_node_child_process3.execFileSync)("git", ["rev-parse", "--show-toplevel"], {
+        repoPath = (0, import_node_child_process4.execFileSync)("git", ["rev-parse", "--show-toplevel"], {
           cwd: worktreePath,
           encoding: "utf8"
         }).trim();
@@ -16305,31 +16448,31 @@ function importConductorWorkspace(workspaceId) {
       db.close();
     }
   } finally {
-    (0, import_node_fs42.rmSync)(tmp, { recursive: true, force: true });
+    (0, import_node_fs43.rmSync)(tmp, { recursive: true, force: true });
   }
 }
 async function importConductorWorkspaceAsync(workspaceId) {
   return importConductorWorkspace(workspaceId);
 }
-var import_node_child_process3, import_node_fs42, import_node_os13, import_node_path40, import_node_module4, CONDUCTOR_APP_SUPPORT, CONDUCTOR_DB, CURSOR_SDK_STORE;
+var import_node_child_process4, import_node_fs43, import_node_os13, import_node_path41, import_node_module4, CONDUCTOR_APP_SUPPORT, CONDUCTOR_DB, CURSOR_SDK_STORE;
 var init_adopt = __esm({
   "src/threads/adopt.ts"() {
     "use strict";
-    import_node_child_process3 = require("child_process");
-    import_node_fs42 = require("fs");
+    import_node_child_process4 = require("child_process");
+    import_node_fs43 = require("fs");
     import_node_os13 = require("os");
-    import_node_path40 = require("path");
+    import_node_path41 = require("path");
     import_node_module4 = require("module");
     init_worktree();
     init_thread_store();
-    CONDUCTOR_APP_SUPPORT = (0, import_node_path40.join)(
+    CONDUCTOR_APP_SUPPORT = (0, import_node_path41.join)(
       process.env.HOME ?? "",
       "Library",
       "Application Support",
       "com.conductor.app"
     );
-    CONDUCTOR_DB = (0, import_node_path40.join)(CONDUCTOR_APP_SUPPORT, "conductor.db");
-    CURSOR_SDK_STORE = (0, import_node_path40.join)(CONDUCTOR_APP_SUPPORT, "cursor-sdk-store");
+    CONDUCTOR_DB = (0, import_node_path41.join)(CONDUCTOR_APP_SUPPORT, "conductor.db");
+    CURSOR_SDK_STORE = (0, import_node_path41.join)(CONDUCTOR_APP_SUPPORT, "cursor-sdk-store");
   }
 });
 
@@ -16396,7 +16539,7 @@ async function openStackLayer(input, _onSetupLine) {
   let createdWorktree = false;
   const trees = await listWorktrees(repoPath);
   const checkedOut = trees.find((w) => w.branch === branchName);
-  if (checkedOut?.path && (0, import_node_fs43.existsSync)(checkedOut.path)) {
+  if (checkedOut?.path && (0, import_node_fs44.existsSync)(checkedOut.path)) {
     if (input.reuseExistingWorktree !== false) {
       worktreePath = checkedOut.path;
     } else {
@@ -16538,7 +16681,7 @@ async function initStackFromThread(input, onSetupLine) {
 async function createPrStack(input, onSetupLine) {
   await requireAgent(input.agent);
   const repoPath = await resolveRepoRoot(input.repoPath);
-  if (!(0, import_node_fs43.existsSync)(repoPath)) throw new Error(`Repo not found: ${repoPath}`);
+  if (!(0, import_node_fs44.existsSync)(repoPath)) throw new Error(`Repo not found: ${repoPath}`);
   if (!input.branches.length) throw new Error("At least one branch name required");
   const status = await detectGhStack(repoPath);
   if (!status.available) throw new Error(status.reason);
@@ -16605,7 +16748,7 @@ async function createPrStack(input, onSetupLine) {
     }
   }
   const claimed = new Set(threads.map((t) => t.worktreePath));
-  if (!claimed.has(bootstrap.worktreePath) && (0, import_node_fs43.existsSync)(bootstrap.worktreePath)) {
+  if (!claimed.has(bootstrap.worktreePath) && (0, import_node_fs44.existsSync)(bootstrap.worktreePath)) {
     try {
       await removeWorktree(repoPath, bootstrap.worktreePath, {
         deleteBranch: bootstrap.branchName
@@ -16615,11 +16758,11 @@ async function createPrStack(input, onSetupLine) {
   }
   return { stack, threads, createdThreadIds };
 }
-var import_node_fs43;
+var import_node_fs44;
 var init_stack_layers = __esm({
   "src/threads/stack-layers.ts"() {
     "use strict";
-    import_node_fs43 = require("fs");
+    import_node_fs44 = require("fs");
     init_detect();
     init_run();
     init_stack();
@@ -16632,7 +16775,7 @@ var init_stack_layers = __esm({
 
 // src/diff/diff.ts
 async function inspectGitWorktree(worktreePath) {
-  if (!worktreePath || !(0, import_node_fs44.existsSync)(worktreePath)) return "missing_worktree";
+  if (!worktreePath || !(0, import_node_fs45.existsSync)(worktreePath)) return "missing_worktree";
   const check = await git(["rev-parse", "--is-inside-work-tree"], worktreePath, {
     reject: false
   });
@@ -16640,7 +16783,7 @@ async function inspectGitWorktree(worktreePath) {
   return "ok";
 }
 async function initializeGitRepository(worktreePath) {
-  if (!worktreePath || !(0, import_node_fs44.existsSync)(worktreePath)) {
+  if (!worktreePath || !(0, import_node_fs45.existsSync)(worktreePath)) {
     throw new Error("Worktree not found");
   }
   const status = await inspectGitWorktree(worktreePath);
@@ -16774,11 +16917,11 @@ new file mode 100644
   };
 }
 async function untrackedPatch(worktreePath, path, maxHunk) {
-  const abs = (0, import_node_path41.join)(worktreePath, path);
+  const abs = (0, import_node_path42.join)(worktreePath, path);
   try {
-    const st = (0, import_node_fs44.statSync)(abs);
+    const st = (0, import_node_fs45.statSync)(abs);
     if (st.isFile() && st.size > maxHunk) {
-      const buf = (0, import_node_fs44.readFileSync)(abs).subarray(0, maxHunk);
+      const buf = (0, import_node_fs45.readFileSync)(abs).subarray(0, maxHunk);
       return syntheticAddPatch(path, buf.toString("utf8"), maxHunk);
     }
   } catch {
@@ -17267,8 +17410,8 @@ function isImageRelativePath(relativePath) {
 function readWorktreeFileForUpload(worktreePath, relativePath, opts) {
   assertSafeRelativePath(relativePath);
   const maxBytes = opts?.maxBytes ?? DEFAULT_UPLOAD_MAX_BYTES;
-  const abs = (0, import_node_path41.join)(worktreePath, relativePath);
-  const st = (0, import_node_fs44.statSync)(abs);
+  const abs = (0, import_node_path42.join)(worktreePath, relativePath);
+  const st = (0, import_node_fs45.statSync)(abs);
   if (!st.isFile()) {
     throw new Error(`Not a file: ${relativePath}`);
   }
@@ -17277,7 +17420,7 @@ function readWorktreeFileForUpload(worktreePath, relativePath, opts) {
       `File too large to upload (${st.size} bytes; max ${maxBytes})`
     );
   }
-  const buf = (0, import_node_fs44.readFileSync)(abs);
+  const buf = (0, import_node_fs45.readFileSync)(abs);
   return {
     path: relativePath,
     contentBase64: buf.toString("base64"),
@@ -17287,12 +17430,12 @@ function readWorktreeFileForUpload(worktreePath, relativePath, opts) {
 function readWorktreeFile(worktreePath, relativePath, opts) {
   assertSafeRelativePath(relativePath);
   const maxBytes = opts?.maxBytes ?? 2e5;
-  const abs = (0, import_node_path41.join)(worktreePath, relativePath);
-  const st = (0, import_node_fs44.statSync)(abs);
+  const abs = (0, import_node_path42.join)(worktreePath, relativePath);
+  const st = (0, import_node_fs45.statSync)(abs);
   if (!st.isFile()) {
     throw new Error(`Not a file: ${relativePath}`);
   }
-  const buf = (0, import_node_fs44.readFileSync)(abs);
+  const buf = (0, import_node_fs45.readFileSync)(abs);
   if (isImageRelativePath(relativePath)) {
     const maxImageBytes = Math.max(maxBytes, 15e6);
     const truncated2 = buf.length > maxImageBytes;
@@ -17335,9 +17478,9 @@ function assertSafeRelativePath(relativePath) {
 }
 function writeWorktreeFile(worktreePath, relativePath, content) {
   assertSafeRelativePath(relativePath);
-  const abs = (0, import_node_path41.join)(worktreePath, relativePath);
-  (0, import_node_fs44.mkdirSync)((0, import_node_path41.dirname)(abs), { recursive: true });
-  (0, import_node_fs44.writeFileSync)(abs, content, "utf8");
+  const abs = (0, import_node_path42.join)(worktreePath, relativePath);
+  (0, import_node_fs45.mkdirSync)((0, import_node_path42.dirname)(abs), { recursive: true });
+  (0, import_node_fs45.writeFileSync)(abs, content, "utf8");
   return { path: relativePath };
 }
 async function getDiffSummary(worktreePath, repoPath, opts) {
@@ -17354,12 +17497,12 @@ async function getDiffSummary(worktreePath, repoPath, opts) {
     truncated: full.files.length > maxFiles
   };
 }
-var import_node_fs44, import_node_path41, mergeBaseCache, MERGE_BASE_TTL_MS, SHA_RE, IMAGE_EXTENSIONS2, DEFAULT_UPLOAD_MAX_BYTES;
+var import_node_fs45, import_node_path42, mergeBaseCache, MERGE_BASE_TTL_MS, SHA_RE, IMAGE_EXTENSIONS2, DEFAULT_UPLOAD_MAX_BYTES;
 var init_diff = __esm({
   "src/diff/diff.ts"() {
     "use strict";
-    import_node_fs44 = require("fs");
-    import_node_path41 = require("path");
+    import_node_fs45 = require("fs");
+    import_node_path42 = require("path");
     init_run();
     init_worktree();
     mergeBaseCache = /* @__PURE__ */ new Map();
@@ -17635,7 +17778,7 @@ function parseFrontmatter(content) {
 }
 function readSkill(skillMd, source) {
   try {
-    const content = (0, import_node_fs45.readFileSync)(skillMd, "utf8");
+    const content = (0, import_node_fs46.readFileSync)(skillMd, "utf8");
     const { name: fmName, description } = parseFrontmatter(content);
     const dirName = skillMd.split("/").slice(-2, -1)[0] || "skill";
     const name = fmName || dirName;
@@ -17654,19 +17797,19 @@ function readSkill(skillMd, source) {
   }
 }
 function scanSkillsDir(dir, source, out) {
-  if (!(0, import_node_fs45.existsSync)(dir)) return;
+  if (!(0, import_node_fs46.existsSync)(dir)) return;
   let entries;
   try {
-    entries = (0, import_node_fs45.readdirSync)(dir);
+    entries = (0, import_node_fs46.readdirSync)(dir);
   } catch {
     return;
   }
   for (const entry of entries) {
     if (entry.startsWith(".")) continue;
-    const skillMd = (0, import_node_path42.join)(dir, entry, "SKILL.md");
-    if (!(0, import_node_fs45.existsSync)(skillMd)) continue;
+    const skillMd = (0, import_node_path43.join)(dir, entry, "SKILL.md");
+    if (!(0, import_node_fs46.existsSync)(skillMd)) continue;
     try {
-      if (!(0, import_node_fs45.statSync)(skillMd).isFile()) continue;
+      if (!(0, import_node_fs46.statSync)(skillMd).isFile()) continue;
     } catch {
       continue;
     }
@@ -17675,24 +17818,24 @@ function scanSkillsDir(dir, source, out) {
   }
 }
 function scanClaudePluginSkills(pluginsRoot, out) {
-  if (!(0, import_node_fs45.existsSync)(pluginsRoot)) return;
+  if (!(0, import_node_fs46.existsSync)(pluginsRoot)) return;
   const walk = (dir, depth, lookingForSkillsDir) => {
     if (depth > 7) return;
     let entries;
     try {
-      entries = (0, import_node_fs45.readdirSync)(dir);
+      entries = (0, import_node_fs46.readdirSync)(dir);
     } catch {
       return;
     }
     if (lookingForSkillsDir && entries.includes("SKILL.md")) {
-      const skill = readSkill((0, import_node_path42.join)(dir, "SKILL.md"), "cli");
+      const skill = readSkill((0, import_node_path43.join)(dir, "SKILL.md"), "cli");
       if (skill) out.push(skill);
     }
     for (const entry of entries) {
       if (entry === "node_modules" || entry === ".git") continue;
-      const full = (0, import_node_path42.join)(dir, entry);
+      const full = (0, import_node_path43.join)(dir, entry);
       try {
-        if (!(0, import_node_fs45.statSync)(full).isDirectory()) continue;
+        if (!(0, import_node_fs46.statSync)(full).isDirectory()) continue;
       } catch {
         continue;
       }
@@ -17710,17 +17853,17 @@ function discoverSkills(worktreePath) {
   const home = (0, import_node_os14.homedir)();
   const collected = [];
   for (const rel of [".claude/skills", ".cursor/skills", ".sideboard/skills", ".brightsy/skills", "skills"]) {
-    scanSkillsDir((0, import_node_path42.join)(worktreePath, rel), "workspace", collected);
+    scanSkillsDir((0, import_node_path43.join)(worktreePath, rel), "workspace", collected);
   }
   for (const abs of [
-    (0, import_node_path42.join)(home, ".claude/skills"),
-    (0, import_node_path42.join)(home, ".cursor/skills"),
-    (0, import_node_path42.join)(home, ".sideboard/skills"),
-    (0, import_node_path42.join)(home, ".brightsy/skills")
+    (0, import_node_path43.join)(home, ".claude/skills"),
+    (0, import_node_path43.join)(home, ".cursor/skills"),
+    (0, import_node_path43.join)(home, ".sideboard/skills"),
+    (0, import_node_path43.join)(home, ".brightsy/skills")
   ]) {
     scanSkillsDir(abs, "user", collected);
   }
-  scanClaudePluginSkills((0, import_node_path42.join)(home, ".claude/plugins"), collected);
+  scanClaudePluginSkills((0, import_node_path43.join)(home, ".claude/plugins"), collected);
   collected.push(...bundledSkills());
   const rank = {
     workspace: 0,
@@ -17746,7 +17889,7 @@ function readSkillBody(skillPath, maxChars = 12e3) {
 \u2026(truncated)` : body;
     }
   }
-  const raw = (0, import_node_fs45.readFileSync)(skillPath, "utf8");
+  const raw = (0, import_node_fs46.readFileSync)(skillPath, "utf8");
   if (raw.startsWith("---")) {
     const end = raw.indexOf("\n---", 3);
     if (end >= 0) {
@@ -17760,13 +17903,13 @@ function readSkillBody(skillPath, maxChars = 12e3) {
 
 \u2026(truncated)` : raw;
 }
-var import_node_fs45, import_node_os14, import_node_path42, BUNDLED_SKILL_PREFIX;
+var import_node_fs46, import_node_os14, import_node_path43, BUNDLED_SKILL_PREFIX;
 var init_discover = __esm({
   "src/skills/discover.ts"() {
     "use strict";
-    import_node_fs45 = require("fs");
+    import_node_fs46 = require("fs");
     import_node_os14 = require("os");
-    import_node_path42 = require("path");
+    import_node_path43 = require("path");
     init_long_running();
     BUNDLED_SKILL_PREFIX = "bundled:";
   }
@@ -17860,8 +18003,8 @@ var init_expand = __esm({
 // src/skills/detached-job-path.ts
 function detachedJobScriptIn(dir) {
   for (const name of DETACHED_JOB_FILENAMES) {
-    const script = (0, import_node_path43.join)(dir, "scripts", name);
-    if ((0, import_node_fs46.existsSync)(script)) return script;
+    const script = (0, import_node_path44.join)(dir, "scripts", name);
+    if ((0, import_node_fs47.existsSync)(script)) return script;
   }
   return null;
 }
@@ -17873,11 +18016,11 @@ function packagedDetachedJobPath() {
 function resolveDetachedJobScript() {
   const packaged = packagedDetachedJobPath();
   if (packaged) return packaged;
-  let dir = (0, import_node_path43.dirname)((0, import_node_url3.fileURLToPath)(import_meta3.url));
+  let dir = (0, import_node_path44.dirname)((0, import_node_url3.fileURLToPath)(import_meta3.url));
   for (let i = 0; i < 8; i++) {
     const candidate = detachedJobScriptIn(dir);
     if (candidate) return candidate;
-    const parent = (0, import_node_path43.dirname)(dir);
+    const parent = (0, import_node_path44.dirname)(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -17888,12 +18031,12 @@ function formatDetachedJobInvoke(scriptPath) {
   if (resolved) return `node ${JSON.stringify(resolved)}`;
   return "node scripts/detached-job.cjs";
 }
-var import_node_fs46, import_node_path43, import_node_url3, import_meta3, DETACHED_JOB_FILENAMES;
+var import_node_fs47, import_node_path44, import_node_url3, import_meta3, DETACHED_JOB_FILENAMES;
 var init_detached_job_path = __esm({
   "src/skills/detached-job-path.ts"() {
     "use strict";
-    import_node_fs46 = require("fs");
-    import_node_path43 = require("path");
+    import_node_fs47 = require("fs");
+    import_node_path44 = require("path");
     import_node_url3 = require("url");
     init_packaged_runtime();
     import_meta3 = {};
@@ -18051,9 +18194,9 @@ function formatPrGateDirective() {
 }
 function formatProcessGuideDirective(opts) {
   const worktree = opts?.worktreePath?.trim();
-  const hasGraphSkill = !!worktree && (0, import_node_fs47.existsSync)((0, import_node_path44.join)(worktree, ".claude/skills/graph-engineering/SKILL.md"));
-  const hasReviewSkill = !!worktree && (0, import_node_fs47.existsSync)((0, import_node_path44.join)(worktree, ".claude/skills/review/SKILL.md"));
-  const hasInstallSkill = !!worktree && (0, import_node_fs47.existsSync)((0, import_node_path44.join)(worktree, ".claude/skills/worktree-install/SKILL.md"));
+  const hasGraphSkill = !!worktree && (0, import_node_fs48.existsSync)((0, import_node_path45.join)(worktree, ".claude/skills/graph-engineering/SKILL.md"));
+  const hasReviewSkill = !!worktree && (0, import_node_fs48.existsSync)((0, import_node_path45.join)(worktree, ".claude/skills/review/SKILL.md"));
+  const hasInstallSkill = !!worktree && (0, import_node_fs48.existsSync)((0, import_node_path45.join)(worktree, ".claude/skills/worktree-install/SKILL.md"));
   return [
     "Process guides (recurring work only):",
     hasGraphSkill ? "- Migrations, ports, batch fixes, and other fan-out: follow `.claude/skills/graph-engineering/SKILL.md` (`/graph-engineering`). Judge first; state on disk; grow the rulebook; do not patch around it." : null,
@@ -18091,12 +18234,12 @@ function formatArtifactDirective() {
 function formatUiReminder() {
   return "Sideboard UI: markdown table is enough to read data; present_schema if they ask to edit/filter (even after markdown); present_files for the file manager. html fence or present_artifact, not both for the same document. type=log appends (same artifact_id, new lines only). ask_user only for a real multiple-choice (not hellos or \u201Cwhat next?\u201D) \u2014 reply in chat. Do not say artifacts/CMS UI are unavailable.";
 }
-var import_node_fs47, import_node_path44, PR_GOAL_RE, GITHUB_TICKET_REF, KEYED_TICKET_REF;
+var import_node_fs48, import_node_path45, PR_GOAL_RE, GITHUB_TICKET_REF, KEYED_TICKET_REF;
 var init_instructions = __esm({
   "src/agents/instructions.ts"() {
     "use strict";
-    import_node_fs47 = require("fs");
-    import_node_path44 = require("path");
+    import_node_fs48 = require("fs");
+    import_node_path45 = require("path");
     init_git_auth_mode();
     init_worktree_labels();
     init_detached_job_path();
@@ -18287,40 +18430,40 @@ __export(plan_file_exports, {
   writePlanFile: () => writePlanFile
 });
 function ensureAttachmentsGitignore(worktreePath) {
-  const gitignoreAbs = (0, import_node_path45.join)(worktreePath, ATTACHMENTS_DIR, ".gitignore");
-  if ((0, import_node_fs48.existsSync)(gitignoreAbs)) return;
-  (0, import_node_fs48.mkdirSync)((0, import_node_path45.dirname)(gitignoreAbs), { recursive: true });
-  (0, import_node_fs48.writeFileSync)(gitignoreAbs, attachmentsGitignoreBody(), "utf8");
+  const gitignoreAbs = (0, import_node_path46.join)(worktreePath, ATTACHMENTS_DIR, ".gitignore");
+  if ((0, import_node_fs49.existsSync)(gitignoreAbs)) return;
+  (0, import_node_fs49.mkdirSync)((0, import_node_path46.dirname)(gitignoreAbs), { recursive: true });
+  (0, import_node_fs49.writeFileSync)(gitignoreAbs, attachmentsGitignoreBody(), "utf8");
 }
 function planFileAbs(worktreePath) {
-  return (0, import_node_path45.join)(worktreePath, PLAN_FILE_REL);
+  return (0, import_node_path46.join)(worktreePath, PLAN_FILE_REL);
 }
 function readTextIfPresent2(abs) {
-  if (!(0, import_node_fs48.existsSync)(abs)) return null;
+  if (!(0, import_node_fs49.existsSync)(abs)) return null;
   try {
-    const content = (0, import_node_fs48.readFileSync)(abs, "utf8");
+    const content = (0, import_node_fs49.readFileSync)(abs, "utf8");
     return content.trim() ? content : null;
   } catch {
     return null;
   }
 }
 function readPlanFile(worktreePath) {
-  return readTextIfPresent2(planFileAbs(worktreePath)) ?? readTextIfPresent2((0, import_node_path45.join)(worktreePath, `${LEGACY_ATTACHMENTS_DIR}/plan.md`)) ?? readTextIfPresent2((0, import_node_path45.join)(worktreePath, LEGACY_PLAN_FILE_REL));
+  return readTextIfPresent2(planFileAbs(worktreePath)) ?? readTextIfPresent2((0, import_node_path46.join)(worktreePath, `${LEGACY_ATTACHMENTS_DIR}/plan.md`)) ?? readTextIfPresent2((0, import_node_path46.join)(worktreePath, LEGACY_PLAN_FILE_REL));
 }
 function writePlanFile(worktreePath, content) {
   ensureAttachmentsGitignore(worktreePath);
   const abs = planFileAbs(worktreePath);
-  (0, import_node_fs48.mkdirSync)((0, import_node_path45.dirname)(abs), { recursive: true });
+  (0, import_node_fs49.mkdirSync)((0, import_node_path46.dirname)(abs), { recursive: true });
   const body = content.trimEnd() + (content.endsWith("\n") ? "" : "\n");
-  (0, import_node_fs48.writeFileSync)(abs, body, "utf8");
+  (0, import_node_fs49.writeFileSync)(abs, body, "utf8");
   return PLAN_FILE_REL;
 }
-var import_node_fs48, import_node_path45;
+var import_node_fs49, import_node_path46;
 var init_plan_file = __esm({
   "src/plan/plan-file.ts"() {
     "use strict";
-    import_node_fs48 = require("fs");
-    import_node_path45 = require("path");
+    import_node_fs49 = require("fs");
+    import_node_path46 = require("path");
     init_workspace_scratch();
     init_plan_present();
     init_plan_present();
@@ -18380,7 +18523,7 @@ function setCaffeinateHoldHooks(next) {
   hooks = next;
 }
 function caffeinateHoldPath() {
-  return (0, import_node_path46.join)(appDataDir(), "caffeinate-hold.json");
+  return (0, import_node_path47.join)(appDataDir(), "caffeinate-hold.json");
 }
 function processAlive(pid) {
   if (hooks.processAlive) return hooks.processAlive(pid);
@@ -18414,9 +18557,9 @@ function uniqueIds(ids) {
 }
 function readHold() {
   const path = caffeinateHoldPath();
-  if (!(0, import_node_fs49.existsSync)(path)) return null;
+  if (!(0, import_node_fs50.existsSync)(path)) return null;
   try {
-    const parsed = JSON.parse((0, import_node_fs49.readFileSync)(path, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs50.readFileSync)(path, "utf8"));
     if (typeof parsed?.pid === "number" && parsed.pid > 0) {
       return {
         pid: parsed.pid,
@@ -18438,7 +18581,7 @@ function writeHold(pid, threadIds) {
 }
 function clearHold() {
   try {
-    (0, import_node_fs49.unlinkSync)(caffeinateHoldPath());
+    (0, import_node_fs50.unlinkSync)(caffeinateHoldPath());
   } catch {
   }
 }
@@ -18496,7 +18639,7 @@ function setCaffeinateHold(enabled, opts) {
   if (platform !== "darwin") {
     return idleState(platform);
   }
-  const spawnImpl = hooks.spawn ?? import_node_child_process4.spawn;
+  const spawnImpl = hooks.spawn ?? import_node_child_process5.spawn;
   const child = spawnImpl("caffeinate", ["-dimsu"], {
     detached: true,
     stdio: "ignore"
@@ -18523,13 +18666,13 @@ function releaseCaffeinateHoldForThread(threadId) {
   }
   return setCaffeinateHold(false, { threadId: id });
 }
-var import_node_child_process4, import_node_fs49, import_node_path46, hooks;
+var import_node_child_process5, import_node_fs50, import_node_path47, hooks;
 var init_caffeinate_hold = __esm({
   "src/store/caffeinate-hold.ts"() {
     "use strict";
-    import_node_child_process4 = require("child_process");
-    import_node_fs49 = require("fs");
-    import_node_path46 = require("path");
+    import_node_child_process5 = require("child_process");
+    import_node_fs50 = require("fs");
+    import_node_path47 = require("path");
     init_paths();
     init_private_file();
     hooks = {};
@@ -18538,7 +18681,7 @@ var init_caffeinate_hold = __esm({
 
 // src/store/schedules.ts
 function schedulesPath() {
-  return (0, import_node_path47.join)(appDataDir(), "schedules.json");
+  return (0, import_node_path48.join)(appDataDir(), "schedules.json");
 }
 function parseDurationMs(every) {
   const m = every.trim().match(DURATION_RE);
@@ -18638,9 +18781,9 @@ function normalizeTask(raw) {
 }
 function readAll2() {
   const path = schedulesPath();
-  if (!(0, import_node_fs50.existsSync)(path)) return [];
+  if (!(0, import_node_fs51.existsSync)(path)) return [];
   try {
-    const parsed = JSON.parse((0, import_node_fs50.readFileSync)(path, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs51.readFileSync)(path, "utf8"));
     if (!Array.isArray(parsed)) return [];
     return parsed.map((row) => {
       try {
@@ -18752,13 +18895,13 @@ function recordScheduleRun(id, result) {
   writeAll2(rows);
   return next;
 }
-var import_node_crypto9, import_node_fs50, import_node_path47, import_croner, DURATION_RE, UNIT_MS;
+var import_node_crypto9, import_node_fs51, import_node_path48, import_croner, DURATION_RE, UNIT_MS;
 var init_schedules = __esm({
   "src/store/schedules.ts"() {
     "use strict";
     import_node_crypto9 = require("crypto");
-    import_node_fs50 = require("fs");
-    import_node_path47 = require("path");
+    import_node_fs51 = require("fs");
+    import_node_path48 = require("path");
     import_croner = require("croner");
     init_orchestrator_capable();
     init_paths();
@@ -18900,13 +19043,13 @@ var init_schedule_runner = __esm({
 
 // src/agents/cursor-store.ts
 function cursorSdkStoreDir(threadId) {
-  const root = (0, import_node_path48.join)(appDataDir(), CURSOR_SDK_STORE_DIR);
+  const root = (0, import_node_path49.join)(appDataDir(), CURSOR_SDK_STORE_DIR);
   const id = sanitizeCursorStoreSegment(threadId);
   if (!id) return root;
-  return (0, import_node_path48.join)(root, "threads", id);
+  return (0, import_node_path49.join)(root, "threads", id);
 }
 function cursorSdkRunsNdjsonPath(threadId) {
-  return (0, import_node_path48.join)(cursorSdkStoreDir(threadId), "runs.ndjson");
+  return (0, import_node_path49.join)(cursorSdkStoreDir(threadId), "runs.ndjson");
 }
 function cursorSdkRunsNdjsonSearchPaths(threadId) {
   const scoped = cursorSdkRunsNdjsonPath(threadId);
@@ -18919,11 +19062,11 @@ function cursorSdkRunsNdjsonSearchPaths(threadId) {
 function sanitizeCursorStoreSegment(threadId) {
   return (threadId ?? "").trim().replace(/[^a-zA-Z0-9._-]/g, "_");
 }
-var import_node_path48, CURSOR_SDK_STORE_DIR;
+var import_node_path49, CURSOR_SDK_STORE_DIR;
 var init_cursor_store = __esm({
   "src/agents/cursor-store.ts"() {
     "use strict";
-    import_node_path48 = require("path");
+    import_node_path49 = require("path");
     init_paths();
     CURSOR_SDK_STORE_DIR = "cursor-sdk-store";
   }
@@ -18945,9 +19088,9 @@ function recoverFinishedCursorRun(opts) {
   return best;
 }
 function scanFinishedCursorRuns(runsPath, agentId, startedAfterMs) {
-  if (!(0, import_node_fs51.existsSync)(runsPath)) return null;
+  if (!(0, import_node_fs52.existsSync)(runsPath)) return null;
   try {
-    const lines = (0, import_node_fs51.readFileSync)(runsPath, "utf8").split("\n");
+    const lines = (0, import_node_fs52.readFileSync)(runsPath, "utf8").split("\n");
     let best = null;
     for (const line of lines) {
       const trimmed = line.trim();
@@ -18973,11 +19116,11 @@ function scanFinishedCursorRuns(runsPath, agentId, startedAfterMs) {
     return null;
   }
 }
-var import_node_fs51;
+var import_node_fs52;
 var init_cursor_recover = __esm({
   "src/agents/cursor-recover.ts"() {
     "use strict";
-    import_node_fs51 = require("fs");
+    import_node_fs52 = require("fs");
     init_cursor_store();
   }
 });
@@ -19109,13 +19252,13 @@ async function startOrchestration(opts) {
   }
   return updated;
 }
-var import_node_events, import_node_fs52, LIVE_TURN_SPAWN_GRACE_MS, STALE_AGENT_PID_WAIT_MS, Orchestrator, singleton;
+var import_node_events, import_node_fs53, LIVE_TURN_SPAWN_GRACE_MS, STALE_AGENT_PID_WAIT_MS, Orchestrator, singleton;
 var init_orchestrator = __esm({
   "src/orchestrator/orchestrator.ts"() {
     "use strict";
     import_node_events = require("events");
     init_outbound_watch();
-    import_node_fs52 = require("fs");
+    import_node_fs53 = require("fs");
     init_error_detail();
     init_run();
     init_stale_lock();
@@ -19288,7 +19431,7 @@ var init_orchestrator = __esm({
             }
             continue;
           }
-          if (!(0, import_node_fs52.existsSync)(thread.worktreePath)) {
+          if (!(0, import_node_fs53.existsSync)(thread.worktreePath)) {
             setStatus(thread.id, "broken", "Worktree missing on disk");
             this.emit({ type: "status_changed", threadId: thread.id, status: "broken" });
             continue;
@@ -21179,7 +21322,7 @@ var init_orchestrator = __esm({
           this.emit({ type: "status_changed", threadId: restored2.id, status: restored2.status });
           return restored2;
         }
-        if (!(0, import_node_fs52.existsSync)(thread.worktreePath)) {
+        if (!(0, import_node_fs53.existsSync)(thread.worktreePath)) {
           if (isCowboyThread(thread) || isPrimaryCheckoutThread(thread)) {
             throw new Error(
               `Cowboy checkout missing: ${thread.worktreePath}. Re-add the project folder, then restore.`
@@ -21256,13 +21399,14 @@ var init_orchestrator = __esm({
 
 // src/mcp/run-stdio.ts
 init_nested_electron_env();
+init_system_ca();
 
 // src/mcp/server.ts
 var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
 var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
 var import_zod8 = require("zod");
 var import_node_crypto12 = require("crypto");
-var import_node_path51 = require("path");
+var import_node_path52 = require("path");
 init_orchestrator();
 init_worktree();
 
@@ -23854,27 +23998,27 @@ init_gh_errors();
 init_git_auth_mode();
 
 // src/board/load-home-board.ts
-var import_node_fs54 = require("fs");
-var import_node_path50 = require("path");
+var import_node_fs55 = require("fs");
+var import_node_path51 = require("path");
 init_worktree();
 init_paths();
 
 // src/board/board-pins.ts
 var import_node_crypto11 = require("crypto");
-var import_node_fs53 = require("fs");
-var import_node_path49 = require("path");
+var import_node_fs54 = require("fs");
+var import_node_path50 = require("path");
 init_paths();
 init_home_board();
 var FILE = "home-board-pins.json";
 var VERSION = 1;
 function pinsFile() {
-  return (0, import_node_path49.join)(appDataDir(), FILE);
+  return (0, import_node_path50.join)(appDataDir(), FILE);
 }
 function readDisk() {
   const path = pinsFile();
-  if (!(0, import_node_fs53.existsSync)(path)) return [];
+  if (!(0, import_node_fs54.existsSync)(path)) return [];
   try {
-    const raw = JSON.parse((0, import_node_fs53.readFileSync)(path, "utf8"));
+    const raw = JSON.parse((0, import_node_fs54.readFileSync)(path, "utf8"));
     if (raw?.version !== VERSION || !Array.isArray(raw.items)) return [];
     return raw.items.filter((item) => item?.id && item.kind && item.ref);
   } catch {
@@ -23882,8 +24026,8 @@ function readDisk() {
   }
 }
 function writeDisk(items) {
-  (0, import_node_fs53.mkdirSync)(appDataDir(), { recursive: true });
-  (0, import_node_fs53.writeFileSync)(pinsFile(), JSON.stringify({ version: VERSION, items }, null, 2), "utf8");
+  (0, import_node_fs54.mkdirSync)(appDataDir(), { recursive: true });
+  (0, import_node_fs54.writeFileSync)(pinsFile(), JSON.stringify({ version: VERSION, items }, null, 2), "utf8");
 }
 function listBoardPins() {
   return readDisk();
@@ -23904,7 +24048,7 @@ function homeBoardWorkspaceKey(workspaces) {
   return workspaces.map((w) => w.path).filter(Boolean).sort().join("\n");
 }
 function cacheFile() {
-  return (0, import_node_path50.join)(appDataDir(), "home-board-cache.json");
+  return (0, import_node_path51.join)(appDataDir(), "home-board-cache.json");
 }
 function emptyInputs() {
   return {
@@ -23930,9 +24074,9 @@ function shouldCacheHomeBoardInputs(inputs) {
 }
 function readDiskCache() {
   const path = cacheFile();
-  if (!(0, import_node_fs54.existsSync)(path)) return null;
+  if (!(0, import_node_fs55.existsSync)(path)) return null;
   try {
-    const raw = JSON.parse((0, import_node_fs54.readFileSync)(path, "utf8"));
+    const raw = JSON.parse((0, import_node_fs55.readFileSync)(path, "utf8"));
     if (raw?.version !== CACHE_VERSION || typeof raw.fetchedAt !== "number") {
       return null;
     }
@@ -23946,8 +24090,8 @@ function readDiskCache() {
 }
 function writeDiskCache(entry) {
   try {
-    (0, import_node_fs54.mkdirSync)(appDataDir(), { recursive: true });
-    (0, import_node_fs54.writeFileSync)(cacheFile(), JSON.stringify(entry), "utf8");
+    (0, import_node_fs55.mkdirSync)(appDataDir(), { recursive: true });
+    (0, import_node_fs55.writeFileSync)(cacheFile(), JSON.stringify(entry), "utf8");
   } catch {
   }
 }
@@ -24075,6 +24219,52 @@ async function getHomeBoardInputs(workspaces, opts) {
 
 // src/mcp/server.ts
 init_home_board();
+
+// src/mcp/create-thread-agent.ts
+function resolveOrchCreateThreadOptions(input) {
+  const { resolveNewThreadOptions: resolveNewThreadOptions2 } = input;
+  const account = resolveNewThreadOptions2({});
+  const requested = input.requestedAgent;
+  const parent = input.parentAgent ?? void 0;
+  let agent = account.agent;
+  let ignoredAgent;
+  let honorRequestedModel = false;
+  if (requested) {
+    const parentEcho = Boolean(parent) && requested === parent && requested !== account.agent;
+    const cursorAutofill = requested === "cursor" && account.agent !== "cursor";
+    if (parentEcho || cursorAutofill) {
+      ignoredAgent = requested;
+    } else {
+      agent = requested;
+      honorRequestedModel = input.requestedModel !== void 0;
+    }
+  }
+  let coercedFrom;
+  if (agent === "codex" && parent === "codex") {
+    coercedFrom = requested ?? "codex";
+    agent = "cursor";
+  }
+  const opts = resolveNewThreadOptions2({
+    agent,
+    model: honorRequestedModel ? input.requestedModel : void 0
+  });
+  return {
+    ...opts,
+    ...ignoredAgent ? { ignoredAgent } : {},
+    ...coercedFrom ? { coercedFrom } : {}
+  };
+}
+function orchCreateThreadAgentNote(input) {
+  if (input.coercedFrom) {
+    return `Avoid nested Codex under a Codex orchestrator \u2014 used Account default agent=${input.agent}`;
+  }
+  if (input.ignoredAgent) {
+    return `Ignored agent=${input.ignoredAgent} \u2014 used Account default agent=${input.agent}`;
+  }
+  return void 0;
+}
+
+// src/mcp/server.ts
 var MAX_ORCH_THREADS = 5;
 var CREATE_THREAD_TIMEOUT_MS = 9e4;
 function withTimeout(promise, ms, label) {
@@ -24122,18 +24312,13 @@ async function createOrchChildThread(orch, args, resolveNewThreadOptions2) {
       };
     }
   }
-  let agentArg = args.agent;
-  let agentCoercedFrom;
-  const resolvedProbe = resolveNewThreadOptions2({ agent: agentArg }).agent;
-  if (resolvedProbe === "codex") {
-    agentCoercedFrom = agentArg ?? "codex";
-    const accountAgent = resolveNewThreadOptions2({}).agent;
-    agentArg = accountAgent !== "codex" ? accountAgent : "cursor";
-  }
-  const opts = resolveNewThreadOptions2({
-    agent: agentArg,
-    model: args.model
+  const opts = resolveOrchCreateThreadOptions({
+    requestedAgent: args.agent,
+    requestedModel: args.model,
+    parentAgent: parent?.agent,
+    resolveNewThreadOptions: resolveNewThreadOptions2
   });
+  const agentNote = orchCreateThreadAgentNote(opts);
   try {
     const priorIds = new Set(orch.getThreads(false).map((t) => t.id));
     const thread = await withTimeout(
@@ -24169,10 +24354,9 @@ async function createOrchChildThread(orch, args, resolveNewThreadOptions2) {
         link: `sideboard://thread/${thread.id}`,
         parentThreadId: thread.parentThreadId,
         ...alreadyStarted ? { alreadyStarted: true } : {},
-        ...agentCoercedFrom ? {
-          agentCoercedFrom,
-          note: `Avoid nested Codex under a Codex orchestrator \u2014 used Account default agent=${thread.agent}`
-        } : {},
+        ...opts.coercedFrom ? { agentCoercedFrom: opts.coercedFrom } : {},
+        ...opts.ignoredAgent ? { agentIgnored: opts.ignoredAgent } : {},
+        ...agentNote ? { note: agentNote } : {},
         ...parentCorrectedFrom ? { parentCorrectedFrom, parentNote } : {}
       })
     };
@@ -24247,7 +24431,7 @@ async function startMcpServer() {
       async () => {
         const threads = orch.getThreads(true);
         const lines = threads.map((t) => {
-          const repo = t.repoPath === GLOBAL_WORKSPACE_ID ? "Orchestration" : (0, import_node_path51.basename)(t.repoPath) || t.repoPath;
+          const repo = t.repoPath === GLOBAL_WORKSPACE_ID ? "Orchestration" : (0, import_node_path52.basename)(t.repoPath) || t.repoPath;
           const live = orch.threadLooksLive(t) ? readTurnLive(t.id) : null;
           const parent = t.parentThreadId ? `  parent:${t.parentThreadId.slice(0, 8)}` : "";
           const preview = lastMessagePreview(t.messages, 80);
@@ -24532,11 +24716,13 @@ async function startMcpServer() {
     );
     server.tool(
       "create_thread",
-      `Create a worktree thread (chat) from branch, pr, or ticket. A ticket, PR, or named branch may have only one live worktree \u2014 if one already matches, returns it (alreadyStarted=true) instead of a second checkout. Creating from the default branch still opens a new isolated worktree. Pass repoPath from list_workspaces. cowboy=true uses the project folder on the default branch (no isolated worktree; land is commit+push). From an orchestration chat, omit parentThreadId (Sideboard binds the child to this chat) or pass the exact id from the turn reminder \u2014 never invent a uuid. Prefer omitting agent/model so Sideboard applies ${accountDefaultsHint}. Setup (settings.toml, .cursor/worktrees.json, or script/setup) runs in the background in parallel with the first turn (skipped for cowboy). Then use send_to_thread to chat.`,
+      `Create a worktree thread (chat) from branch, pr, or ticket. A ticket, PR, or named branch may have only one live worktree \u2014 if one already matches, returns it (alreadyStarted=true) instead of a second checkout. Creating from the default branch still opens a new isolated worktree. Pass repoPath from list_workspaces. cowboy=true uses the project folder on the default branch (no isolated worktree; land is commit+push). From an orchestration chat, omit parentThreadId (Sideboard binds the child to this chat) or pass the exact id from the turn reminder \u2014 never invent a uuid. Omit agent/model \u2014 Sideboard applies ${accountDefaultsHint}. Do not pass your own agent or agent=cursor; those are ignored. Setup (settings.toml, .cursor/worktrees.json, or script/setup) runs in the background in parallel with the first turn (skipped for cowboy). Then use send_to_thread to chat.`,
       {
         sourceType: import_zod8.z.enum(["branch", "pr", "ticket"]),
         sourceRef: import_zod8.z.string(),
-        agent: import_zod8.z.enum(["claude", "codex", "opencode", "brightsy", "cursor"]).optional().describe(`Omit to use Account default agent (${accountDefaults.agent})`),
+        agent: import_zod8.z.enum(["claude", "codex", "opencode", "brightsy", "cursor"]).optional().describe(
+          `Usually omit. Sideboard uses Account default agent (${accountDefaults.agent}). Passing your own agent or cursor is ignored.`
+        ),
         model: import_zod8.z.string().nullable().optional().describe(
           `Usually omit to use Account default model (${accountDefaults.model?.trim() || "Auto"}). Pass null only to force Auto / agent-default.`
         ),
@@ -25243,6 +25429,12 @@ async function startMcpServer() {
 
 // src/mcp/run-stdio.ts
 dropNestedElectronEnvFromProcess();
+var systemCaBundle = materializeSystemCaBundle();
+if (systemCaBundle && !process.env.NODE_EXTRA_CA_CERTS?.trim()) {
+  process.env.NODE_EXTRA_CA_CERTS = systemCaBundle;
+}
+applySystemCaEnv(process.env);
+trustSystemCertificates();
 startMcpServer().catch((err) => {
   console.error(err);
   process.exitCode = 1;