@sideboard-ai/core 0.1.174 → 0.1.176

package/dist/{chunk-XD2BAANL.js → chunk-IEEAVWAP.js}

@@ -4,7 +4,7 @@ import {
   loadBrightsyConfig,
   refreshBrightsyAccessToken,
   saveBrightsyConfig
-} from "./chunk-M267JPEA.js";
+} from "./chunk-AN3THU7F.js";
 import {
   appDataDir
 } from "./chunk-EFVFB2AH.js";
@@ -18,7 +18,7 @@ import { join } from "path";
 
 // src/brightsy/accounts.ts
 async function loadConnectedTeams() {
-  const { listConnectedBrightsyTeams: listConnectedBrightsyTeams2 } = await import("./connected-teams-DBWAMP7G.js");
+  const { listConnectedBrightsyTeams: listConnectedBrightsyTeams2 } = await import("./connected-teams-ON2KIKQX.js");
   return listConnectedBrightsyTeams2();
 }
 async function runBrightsyTeamsJson(args) {
@@ -46,15 +46,15 @@ async function listBrightsyAccounts() {
 }
 async function getBrightsySession() {
   try {
-    const { ensureBrightsyLocalConfigFresh: ensureBrightsyLocalConfigFresh2 } = await import("./oauth-A7XXI2TM.js");
-    const { ensureConnectedBrightsyTeamTokens: ensureConnectedBrightsyTeamTokens2 } = await import("./connected-teams-DBWAMP7G.js");
+    const { ensureBrightsyLocalConfigFresh: ensureBrightsyLocalConfigFresh2 } = await import("./oauth-6ZQ4Q4XN.js");
+    const { ensureConnectedBrightsyTeamTokens: ensureConnectedBrightsyTeamTokens2 } = await import("./connected-teams-ON2KIKQX.js");
     await ensureBrightsyLocalConfigFresh2();
     await ensureConnectedBrightsyTeamTokens2();
     loadBrightsyConfig();
     const data = await runBrightsyTeamsJson([]);
     const accounts = Array.isArray(data.teams) ? data.teams : [];
     const active = data.active ?? accounts.find((a) => a.active) ?? null;
-    const { ensureCliTeamTracked: ensureCliTeamTracked2 } = await import("./connected-teams-DBWAMP7G.js");
+    const { ensureCliTeamTracked: ensureCliTeamTracked2 } = await import("./connected-teams-ON2KIKQX.js");
     const connectedTeams = ensureCliTeamTracked2(
       active ? { id: active.id, slug: active.slug, name: active.name } : void 0
     );
@@ -94,7 +94,7 @@ async function performBrightsyAccountSwitch(accountIdOrSlug) {
   return { cfg, target: data.active };
 }
 async function switchBrightsyAccount(accountIdOrSlug) {
-  const { connectBrightsyTeam: connectBrightsyTeam2 } = await import("./connected-teams-DBWAMP7G.js");
+  const { connectBrightsyTeam: connectBrightsyTeam2 } = await import("./connected-teams-ON2KIKQX.js");
   await connectBrightsyTeam2(accountIdOrSlug);
   return getBrightsySession();
 }

package/dist/{chunk-YEPVWJ3R.js → chunk-JUA7XEXR.js}

@@ -33,7 +33,7 @@ import {
   summarizeTurnStderr,
   toolDescription,
   turnFailChatText
-} from "./chunk-TPPZXZTA.js";
+} from "./chunk-W44EKPIR.js";
 import {
   extractPresentedPlan,
   readPlanFile,
@@ -64,7 +64,7 @@ import {
   stageAbsolutePathsAsAttachments,
   stageBuffersAsAttachments,
   syncWorkspacesFromThreads
-} from "./chunk-VCVBICMZ.js";
+} from "./chunk-FJWQCZ74.js";
 import {
   addPrStackLayer,
   allocateTeamName,
@@ -401,7 +401,7 @@ async function continueSourceThread(threadId, prompt) {
       await continueOnReply(threadId, prompt);
       return;
     }
-    const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-DMSSC4SV.js");
+    const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-2KZD7N4X.js");
     await getOrchestrator2().send(threadId, prompt);
   } catch {
   }
@@ -794,9 +794,9 @@ async function spawnAgentTurn(thread, input, onEvent) {
       `Cannot spawn ${thread.agent}: thread ${thread.id} has no worktreePath`
     );
   }
-  const { isGlobalThread: isGlobalThread2 } = await import("./global-workspace-KA7T26F5.js");
+  const { isGlobalThread: isGlobalThread2 } = await import("./global-workspace-J737XNUX.js");
   if (isGlobalThread2(thread)) {
-    const { ensureGlobalCoordinatorCwd: ensureGlobalCoordinatorCwd2 } = await import("./coordinator-prompt-K3HXEPFD.js");
+    const { ensureGlobalCoordinatorCwd: ensureGlobalCoordinatorCwd2 } = await import("./coordinator-prompt-BE2FERYE.js");
     ensureGlobalCoordinatorCwd2(
       isOrchestratorThread(thread) ? { orchestratorThreadId: thread.id } : void 0
     );
@@ -991,6 +991,7 @@ var AGENT_GIT_ACTIONS = [
   "create-draft",
   "create-web",
   "resolve-conflicts",
+  "ready-for-review",
   "merge"
 ];
 function agentGitPrompt(action, opts) {
@@ -1006,6 +1007,8 @@ function agentGitPrompt(action, opts) {
       const named = base ? ` (${base})` : "";
       return `Merge the remote branch${named} into your branch and resolve conflicts. Then, commit and push your changes.`;
     }
+    case "ready-for-review":
+      return "Ready for review.";
     case "merge":
       return "Merge PR.";
   }
@@ -1021,6 +1024,8 @@ function gitActionExpansion(action, base) {
       return "Commit, push, then `gh pr create --web -R <origin-owner/name>`.";
     case "resolve-conflicts":
       return `Fetch the PR base${base ? ` (\`${base}\`)` : ""}, merge it into this branch, resolve conflicts carefully, then commit and push until the PR is mergeable.`;
+    case "ready-for-review":
+      return "This phrase is the explicit ask to mark this thread's draft pull request ready for review on GitHub (`gh pr ready -R <origin-owner/name>` or `gh pr ready`). Update title/body if the purpose drifted. Do not merge.";
     case "merge":
       return "This phrase is the explicit ask to merge this thread's open pull request on GitHub. If `gh stack view` shows a stack, use `gh stack merge`; otherwise `gh pr merge` (respect repo defaults / squash vs merge). Do not force-push main/master or merge locally into the main checkout.";
   }
@@ -3555,7 +3560,7 @@ async function createThread(input, _onSetupLine) {
   let sourceIsFork = false;
   if (!input.cowboy && sourceType === "branch" && (!sourceRef || sourceRef === "HEAD" || sourceRef === "default")) {
     if (isAbleTimeConnected() && getIssueSource() === "abletime") {
-      const { ensureAbleTimeTask, issueAttachmentForAbleTimeTask } = await import("./abletime-PCLL36HW.js");
+      const { ensureAbleTimeTask, issueAttachmentForAbleTimeTask } = await import("./abletime-BFIDZR3O.js");
       const task = await ensureAbleTimeTask({
         title: title?.trim() || "Untitled work",
         description: input.prompt?.trim() || void 0
@@ -4063,7 +4068,7 @@ async function adoptThread(input) {
     messages: input.messages ?? []
   });
   writeThread(thread);
-  const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-GOGBPATJ.js");
+  const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-DR4UNOQC.js");
   await ensureWorkspace2(repoPath);
   const { ensureWorktreeSideboardIgnored: ensureWorktreeSideboardIgnored2 } = await import("./worktree-exclude-N5X5I422.js");
   await ensureWorktreeSideboardIgnored2(input.worktreePath);
@@ -5844,7 +5849,7 @@ function formatWorktreeDirective(thread, opts) {
     );
   }
   lines.push(
-    '- Sideboard git buttons send short phrases ("Commit and push.", "Merge PR.", \u2026) with their meaning attached \u2014 act on them without asking for clarification. If the user gives a goal (Greptile 5/5, CI green, until checks pass), you get the watch-fix-push playbook with that request.'
+    '- Sideboard git buttons send short phrases ("Commit and push.", "Ready for review.", "Merge PR.", \u2026) with their meaning attached \u2014 act on them without asking for clarification. If the user gives a goal (Greptile 5/5, CI green, until checks pass), you get the watch-fix-push playbook with that request.'
   );
   lines.push("");
   lines.push(formatProcessGuideDirective({ worktreePath: thread.worktreePath }));
@@ -6339,7 +6344,7 @@ function formatScheduledPrompt(name, prompt) {
 ${prompt}`;
 }
 async function defaultDeps() {
-  const { getOrchestrator: getOrchestrator2, startOrchestration: startOrchestration2 } = await import("./orchestrator-DMSSC4SV.js");
+  const { getOrchestrator: getOrchestrator2, startOrchestration: startOrchestration2 } = await import("./orchestrator-2KZD7N4X.js");
   const orch = getOrchestrator2();
   return {
     findThread: (id) => findThreadByRef(id),
@@ -8257,7 +8262,7 @@ var Orchestrator = class {
         "ask_git targets a worktree agent thread (not the orchestrator). Pass a child/worktree thread ref."
       );
     }
-    if (action === "merge" && !thread.prUrl) {
+    if ((action === "merge" || action === "ready-for-review") && !thread.prUrl) {
       throw new Error(
         "No pull request linked. Ask the worktree agent to open a draft PR first (ask_git create-draft)."
       );
@@ -8425,7 +8430,7 @@ var Orchestrator = class {
     this.emit({ type: "status_changed", threadId: archived.id, status: "archived" });
     if (thread.repoPath && !isGlobalRepoPath(thread.repoPath)) {
       try {
-        const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-GOGBPATJ.js");
+        const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-DR4UNOQC.js");
         await ensureWorkspace2(thread.repoPath);
       } catch {
       }

package/dist/{chunk-ELBYOGVA.js → chunk-N7WZ6NIN.js}

@@ -3,17 +3,26 @@ var injected = null;
 function setHttpFetchImpl(fetchImpl) {
   injected = fetchImpl;
 }
+var TLS_ISSUER_RE = /UNABLE_TO_GET_ISSUER_CERT|UNABLE_TO_VERIFY_LEAF_SIGNATURE|SELF_SIGNED_CERT_IN_CHAIN/i;
+var TLS_ISSUER_HINT = " \u2014 Node rejected the TLS certificate (corporate VPN/proxy CA). Desktop Linear can still work; reconnecting the API key will not fix this.";
+function tlsIssuerHint(code, message) {
+  const text = `${code ?? ""} ${message}`;
+  return TLS_ISSUER_RE.test(text) ? TLS_ISSUER_HINT : "";
+}
 function formatFetchError(err, url) {
   if (!(err instanceof Error)) return `${String(err)} (${url})`;
   const cause = err.cause;
   let detail = "";
+  let hint = tlsIssuerHint(void 0, err.message);
   if (cause instanceof Error) {
     const code = typeof cause.code === "string" ? cause.code : void 0;
     detail = code ? ` [${code}: ${cause.message}]` : ` [${cause.message}]`;
+    hint = tlsIssuerHint(code, `${err.message} ${cause.message}`) || hint;
   } else if (cause != null) {
     detail = ` [${String(cause)}]`;
+    hint = tlsIssuerHint(void 0, String(cause)) || hint;
   }
-  return `${err.message}${detail} (${url})`;
+  return `${err.message}${detail} (${url})${hint}`;
 }
 async function httpFetch(input, init) {
   const url = typeof input === "string" ? input : input.href;

package/dist/{chunk-CUA4S537.js → chunk-NIB6BTC6.js}

@@ -1,6 +1,6 @@
 import {
   isOrchestratorThread
-} from "./chunk-ZY7K4T37.js";
+} from "./chunk-3ZFGZ7RT.js";
 import {
   codexUnattendedGitConfigArgs,
   mergeAgentGitAuthEnv,
@@ -12,10 +12,10 @@ import {
   brightsyMcpServerName,
   ensureCliTeamTracked,
   ensureConnectedBrightsyTeamTokens
-} from "./chunk-XD2BAANL.js";
+} from "./chunk-IEEAVWAP.js";
 import {
   loadBrightsyConfig
-} from "./chunk-M267JPEA.js";
+} from "./chunk-AN3THU7F.js";
 import {
   applyAgentRunnerHeapEnv,
   applyNodeLaunch,
@@ -29,7 +29,7 @@ import {
   packagedMcpStdioPath,
   parseCursorRunnerLine,
   resolveNodeLaunch
-} from "./chunk-XXIH6XYR.js";
+} from "./chunk-NQTKRAUF.js";
 import {
   claudeChromeEnabled,
   isAbleTimeConnected,
@@ -1898,7 +1898,7 @@ var claudeAdapter = {
       );
     }
     const mode = permissionMode(thread);
-    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-VDFSU3DD.js");
+    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-3HIWNQ3B.js");
     const isOrchestrator = isOrchestratorThread2(thread);
     const injectedServers = await buildInjectedMcpServers({
       includeSideboard: true,
@@ -2684,6 +2684,9 @@ function resolveCursorApiKey() {
   if (fromEnv) return fromEnv;
   return (loadAppSettings().environment.CURSOR_API_KEY || "").trim();
 }
+function isCursorApiKeyConfigured() {
+  return Boolean(resolveCursorApiKey());
+}
 function isCursorAutoModel(model) {
   const id = (model ?? "").trim().toLowerCase();
   return !id || id === "default" || id === "auto";
@@ -3700,6 +3703,7 @@ export {
   userMcpNamesToDisable,
   listCodexModels,
   codexAdapter,
+  isCursorApiKeyConfigured,
   isCursorAutoModel,
   resolveCursorModelId,
   listCursorModels,

package/dist/{chunk-XXIH6XYR.js → chunk-NQTKRAUF.js}

@@ -2,6 +2,9 @@ import {
   isElectronLikeCommand,
   wrapElectronAsNodeLaunch
 } from "./chunk-4TR3HZFT.js";
+import {
+  appDataDir
+} from "./chunk-EFVFB2AH.js";
 import {
   run
 } from "./chunk-UFHNSFAS.js";
@@ -301,14 +304,139 @@ function formatTurnExitError(exitCode, stderrSummary) {
   return `exit ${code}: ${detail}`;
 }
 
+// src/http/system-ca.ts
+import { spawnSync } from "child_process";
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "fs";
+import { dirname, join } from "path";
+import tls from "tls";
+var NODE_USE_SYSTEM_CA = "NODE_USE_SYSTEM_CA";
+var NODE_EXTRA_CA_CERTS = "NODE_EXTRA_CA_CERTS";
+var BUNDLE_NAME = "system-ca.pem";
+var BUNDLE_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var LINUX_CA_FILES = [
+  "/etc/ssl/certs/ca-certificates.crt",
+  "/etc/pki/tls/certs/ca-bundle.crt",
+  "/etc/ssl/ca-bundle.pem",
+  "/etc/ssl/cert.pem"
+];
+var PEM_CERT_RE = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
+function splitPemCertificates(pem) {
+  return pem.match(PEM_CERT_RE) ?? [];
+}
+function readExistingFile(path) {
+  try {
+    return existsSync(path) ? readFileSync(path, "utf8") : "";
+  } catch {
+    return "";
+  }
+}
+function darwinKeychainPem(spawn) {
+  const result = spawn("/usr/bin/security", ["find-certificate", "-a", "-p"], {
+    encoding: "utf8",
+    maxBuffer: 32 * 1024 * 1024,
+    timeout: 15e3
+  });
+  if (result.status !== 0) return "";
+  return typeof result.stdout === "string" ? result.stdout : "";
+}
+function linuxSystemCaPem() {
+  for (const path of LINUX_CA_FILES) {
+    const pem = readExistingFile(path);
+    if (splitPemCertificates(pem).length > 0) return pem;
+  }
+  return "";
+}
+function collectSystemCaPem(io = {}) {
+  const platform = io.platform ?? process.platform;
+  if (platform === "darwin") {
+    return darwinKeychainPem(io.spawn ?? spawnSync);
+  }
+  if (platform === "linux") {
+    return linuxSystemCaPem();
+  }
+  return "";
+}
+function systemCaBundlePath(io = {}) {
+  return join((io.appData ?? appDataDir)(), BUNDLE_NAME);
+}
+function bundleIsFresh(path, now) {
+  try {
+    if (!existsSync(path)) return false;
+    if (splitPemCertificates(readFileSync(path, "utf8")).length === 0) return false;
+    return now - statSync(path).mtimeMs < BUNDLE_MAX_AGE_MS;
+  } catch {
+    return false;
+  }
+}
+function materializeSystemCaBundle(io = {}) {
+  const inherited = process.env.NODE_EXTRA_CA_CERTS?.trim();
+  if (inherited && splitPemCertificates(readExistingFile(inherited)).length > 0) {
+    return inherited;
+  }
+  const platform = io.platform ?? process.platform;
+  if (platform === "linux") {
+    for (const path of LINUX_CA_FILES) {
+      if (splitPemCertificates(readExistingFile(path)).length > 0) return path;
+    }
+  }
+  const dest = systemCaBundlePath(io);
+  const now = (io.now ?? Date.now)();
+  if (bundleIsFresh(dest, now)) return dest;
+  const pem = collectSystemCaPem(io);
+  if (splitPemCertificates(pem).length === 0) {
+    return existsSync(dest) && splitPemCertificates(readExistingFile(dest)).length > 0 ? dest : void 0;
+  }
+  try {
+    mkdirSync(dirname(dest), { recursive: true });
+    writeFileSync(dest, pem.endsWith("\n") ? pem : `${pem}
+`, { mode: 384 });
+    return dest;
+  } catch {
+    return void 0;
+  }
+}
+function applySystemCaEnv(env) {
+  if (!String(env[NODE_USE_SYSTEM_CA] ?? "").trim()) {
+    env[NODE_USE_SYSTEM_CA] = "1";
+  }
+  if (String(env[NODE_EXTRA_CA_CERTS] ?? "").trim()) return;
+  const inherited = process.env.NODE_EXTRA_CA_CERTS?.trim();
+  if (inherited) env[NODE_EXTRA_CA_CERTS] = inherited;
+}
+function extraCertsFromBundle() {
+  const path = process.env.NODE_EXTRA_CA_CERTS?.trim();
+  if (path) return splitPemCertificates(readExistingFile(path));
+  const dest = systemCaBundlePath();
+  return splitPemCertificates(readExistingFile(dest));
+}
+function trustSystemCertificates(io = {}) {
+  try {
+    const api = tls;
+    if (typeof api.getCACertificates !== "function" || typeof api.setDefaultCACertificates !== "function") {
+      return false;
+    }
+    const current = api.getCACertificates("default");
+    const system = api.getCACertificates("system");
+    let extra = extraCertsFromBundle();
+    if (system.length === 0 && extra.length === 0) {
+      extra = splitPemCertificates(collectSystemCaPem(io));
+    }
+    if (system.length === 0 && extra.length === 0) return false;
+    api.setDefaultCACertificates([...current, ...system, ...extra]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // src/agents/node-launch.ts
-import { existsSync as existsSync2, readdirSync, realpathSync } from "fs";
+import { existsSync as existsSync3, readdirSync, realpathSync } from "fs";
 import { homedir } from "os";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 
 // src/agents/packaged-runtime.ts
-import { existsSync } from "fs";
-import { join } from "path";
+import { existsSync as existsSync2 } from "fs";
+import { join as join2 } from "path";
 function electronResourcesPath() {
   const resources = process.resourcesPath;
   if (typeof resources !== "string" || !resources) return null;
@@ -317,36 +445,36 @@ function electronResourcesPath() {
 function packagedCursorRuntimeDir() {
   const resources = electronResourcesPath();
   if (!resources) return null;
-  const dir = join(resources, "cursor-runtime");
-  if (!existsSync(join(dir, "core-dist", "agents", "cursor-runner.js"))) return null;
+  const dir = join2(resources, "cursor-runtime");
+  if (!existsSync2(join2(dir, "core-dist", "agents", "cursor-runner.js"))) return null;
   return dir;
 }
 function packagedCursorRunnerPath() {
   const dir = packagedCursorRuntimeDir();
-  return dir ? join(dir, "core-dist", "agents", "cursor-runner.js") : null;
+  return dir ? join2(dir, "core-dist", "agents", "cursor-runner.js") : null;
 }
 function packagedMcpDir() {
   const resources = electronResourcesPath();
   if (!resources) return null;
-  const dir = join(resources, "sideboard-mcp");
-  if (!existsSync(join(dir, "core-dist", "mcp", "run-stdio.js"))) return null;
+  const dir = join2(resources, "sideboard-mcp");
+  if (!existsSync2(join2(dir, "core-dist", "mcp", "run-stdio.js"))) return null;
   return dir;
 }
 function packagedMcpStdioPath() {
   const dir = packagedMcpDir();
-  return dir ? join(dir, "core-dist", "mcp", "run-stdio.js") : null;
+  return dir ? join2(dir, "core-dist", "mcp", "run-stdio.js") : null;
 }
 function packagedBundledNodePath() {
   const resources = electronResourcesPath();
   if (!resources) return null;
-  const bin = join(resources, "node", "bin", "node");
-  if (!existsSync(bin)) return null;
+  const bin = join2(resources, "node", "bin", "node");
+  if (!existsSync2(bin)) return null;
   return bin;
 }
 function packagedCursorRipgrepCandidate(platformPkg, binName) {
   const dir = packagedCursorRuntimeDir();
   if (!dir) return null;
-  return join(dir, "node_modules", platformPkg, "bin", binName);
+  return join2(dir, "node_modules", platformPkg, "bin", binName);
 }
 
 // src/agents/node-launch.ts
@@ -367,6 +495,7 @@ function applyAgentRunnerHeapEnv(env) {
     env.NODE_OPTIONS,
     AGENT_RUNNER_MAX_OLD_SPACE_MB
   );
+  applySystemCaEnv(env);
 }
 function envWithAgentHeap(env) {
   const next = { ...env };
@@ -381,7 +510,7 @@ function unpackedAsarPath(filePath) {
   if (!isAsarPath(filePath)) return null;
   const unpacked = filePath.replace(/\.asar(?=[/\\])/, ".asar.unpacked");
   if (unpacked === filePath) return null;
-  return existsSync2(unpacked) ? unpacked : null;
+  return existsSync3(unpacked) ? unpacked : null;
 }
 function nodeReadableScriptPath(scriptPath) {
   return unpackedAsarPath(scriptPath) ?? scriptPath;
@@ -422,7 +551,7 @@ function pickPreferredNode(candidates) {
   return best;
 }
 function versionDirNodeBins(root, toBin) {
-  if (!existsSync2(root)) return [];
+  if (!existsSync3(root)) return [];
   try {
     return readdirSync(root).map(toBin);
   } catch {
@@ -431,28 +560,28 @@ function versionDirNodeBins(root, toBin) {
 }
 function defaultNodeBinCandidates(home = homedir()) {
   const kegs = ["/opt/homebrew", "/usr/local"].flatMap(
-    (prefix) => PREFERRED_LTS_MAJORS.map((major) => join2(prefix, "opt", `node@${major}`, "bin", "node"))
+    (prefix) => PREFERRED_LTS_MAJORS.map((major) => join3(prefix, "opt", `node@${major}`, "bin", "node"))
   );
   return [
     ...kegs,
     "/opt/homebrew/bin/node",
     "/usr/local/bin/node",
-    join2(home, ".local/share/fnm/aliases/default/bin/node"),
-    join2(home, ".nvm/current/bin/node"),
-    join2(home, ".volta/bin/node"),
-    join2(home, ".asdf/shims/node"),
-    join2(home, ".local/share/mise/shims/node"),
+    join3(home, ".local/share/fnm/aliases/default/bin/node"),
+    join3(home, ".nvm/current/bin/node"),
+    join3(home, ".volta/bin/node"),
+    join3(home, ".asdf/shims/node"),
+    join3(home, ".local/share/mise/shims/node"),
     ...versionDirNodeBins(
-      join2(home, ".nvm", "versions", "node"),
-      (name) => join2(home, ".nvm", "versions", "node", name, "bin", "node")
+      join3(home, ".nvm", "versions", "node"),
+      (name) => join3(home, ".nvm", "versions", "node", name, "bin", "node")
     ),
     ...versionDirNodeBins(
-      join2(home, ".local/share/fnm", "node-versions"),
-      (name) => join2(home, ".local/share/fnm", "node-versions", name, "installation", "bin", "node")
+      join3(home, ".local/share/fnm", "node-versions"),
+      (name) => join3(home, ".local/share/fnm", "node-versions", name, "installation", "bin", "node")
     ),
     ...versionDirNodeBins(
-      join2(home, ".volta", "tools", "image", "node"),
-      (name) => join2(home, ".volta", "tools", "image", "node", name, "bin", "node")
+      join3(home, ".volta", "tools", "image", "node"),
+      (name) => join3(home, ".volta", "tools", "image", "node", name, "bin", "node")
     )
   ];
 }
@@ -461,7 +590,7 @@ function uniqueExistingNodeBins(paths) {
   const out = [];
   for (const raw of paths) {
     const p = raw.trim();
-    if (!p || !existsSync2(p) || isElectronLikeCommand(p)) continue;
+    if (!p || !existsSync3(p) || isElectronLikeCommand(p)) continue;
     let key = p;
     try {
       key = realpathSync(p);
@@ -854,9 +983,9 @@ function parseCursorRunnerLine(line) {
 }
 
 // src/agents/cursor-ripgrep.ts
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { createRequire } from "module";
-import { dirname, isAbsolute, join as join3, parse, resolve as resolvePath } from "path";
+import { dirname as dirname2, isAbsolute, join as join4, parse, resolve as resolvePath } from "path";
 var RIPGREP_ENV = "CURSOR_RIPGREP_PATH";
 function rgBinaryName() {
   return process.platform === "win32" ? "rg.exe" : "rg";
@@ -868,19 +997,19 @@ function usableRipgrepPath(candidate) {
   const raw = candidate?.trim();
   if (!raw || !isAbsolute(raw)) return null;
   const readable = nodeReadableScriptPath(raw);
-  if (!existsSync3(readable) || isAsarPath(readable)) return null;
+  if (!existsSync4(readable) || isAsarPath(readable)) return null;
   return readable;
 }
 function walkForBundledRipgrep(startFile) {
   if (!startFile) return null;
   const pkg = platformRipgrepPackage();
   const name = rgBinaryName();
-  let dir = dirname(resolvePath(startFile));
+  let dir = dirname2(resolvePath(startFile));
   const root = parse(dir).root;
   while (dir !== root) {
-    const hit = usableRipgrepPath(join3(dir, "node_modules", pkg, "bin", name));
+    const hit = usableRipgrepPath(join4(dir, "node_modules", pkg, "bin", name));
     if (hit) return hit;
-    const next = dirname(dir);
+    const next = dirname2(dir);
     if (next === dir) break;
     dir = next;
   }
@@ -890,7 +1019,7 @@ function requireResolveBundledRipgrep(fromFile) {
   try {
     const req = createRequire(fromFile);
     const pkgJson = req.resolve(`${platformRipgrepPackage()}/package.json`);
-    return usableRipgrepPath(join3(dirname(pkgJson), "bin", rgBinaryName()));
+    return usableRipgrepPath(join4(dirname2(pkgJson), "bin", rgBinaryName()));
   } catch {
     return null;
   }
@@ -934,6 +1063,9 @@ export {
   shouldFeedErrorBackToAgent,
   formatAgentErrorContinuePrompt,
   formatTurnExitError,
+  materializeSystemCaBundle,
+  applySystemCaEnv,
+  trustSystemCertificates,
   packagedCursorRunnerPath,
   packagedMcpDir,
   packagedMcpStdioPath,

package/dist/{chunk-CMJ2FBBV.js → chunk-RE2YWFUQ.js}

@@ -1,6 +1,6 @@
 import {
   httpFetch
-} from "./chunk-ELBYOGVA.js";
+} from "./chunk-N7WZ6NIN.js";
 import {
   getAbleTimeAccessToken,
   getAbleTimeHost,

package/dist/{chunk-6GN5WPYZ.js → chunk-VKQGAWHY.js}

@@ -3,17 +3,26 @@
 
 // src/http/fetch.ts
 var injected = null;
+var TLS_ISSUER_RE = /UNABLE_TO_GET_ISSUER_CERT|UNABLE_TO_VERIFY_LEAF_SIGNATURE|SELF_SIGNED_CERT_IN_CHAIN/i;
+var TLS_ISSUER_HINT = " \u2014 Node rejected the TLS certificate (corporate VPN/proxy CA). Desktop Linear can still work; reconnecting the API key will not fix this.";
+function tlsIssuerHint(code, message) {
+  const text = `${code ?? ""} ${message}`;
+  return TLS_ISSUER_RE.test(text) ? TLS_ISSUER_HINT : "";
+}
 function formatFetchError(err, url) {
   if (!(err instanceof Error)) return `${String(err)} (${url})`;
   const cause = err.cause;
   let detail = "";
+  let hint = tlsIssuerHint(void 0, err.message);
   if (cause instanceof Error) {
     const code = typeof cause.code === "string" ? cause.code : void 0;
     detail = code ? ` [${code}: ${cause.message}]` : ` [${cause.message}]`;
+    hint = tlsIssuerHint(code, `${err.message} ${cause.message}`) || hint;
   } else if (cause != null) {
     detail = ` [${String(cause)}]`;
+    hint = tlsIssuerHint(void 0, String(cause)) || hint;
   }
-  return `${err.message}${detail} (${url})`;
+  return `${err.message}${detail} (${url})${hint}`;
 }
 async function httpFetch(input, init) {
   const url = typeof input === "string" ? input : input.href;