@sideboard-ai/core 0.1.174 → 0.1.176

package/dist/{chunk-TPPZXZTA.js → chunk-W44EKPIR.js}

@@ -5,13 +5,13 @@ import {
   brightsyMcpServerName,
   ensureCliTeamTracked,
   ensureConnectedBrightsyTeamTokens
-} from "./chunk-LZ6QMEQC.js";
+} from "./chunk-HVIEYTUK.js";
 import {
   loadBrightsyConfig
-} from "./chunk-S42XV45P.js";
+} from "./chunk-Y4MIXGPA.js";
 import {
   isOrchestratorThread
-} from "./chunk-VCVBICMZ.js";
+} from "./chunk-FJWQCZ74.js";
 import {
   codexUnattendedGitConfigArgs,
   mergeAgentGitAuthEnv,
@@ -782,7 +782,7 @@ var brightsyAdapter = {
 };
 
 // src/agents/claude.ts
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync6 } from "fs";
 
 // src/agents/claude-mcp.ts
 function parseMcpList(text) {
@@ -1270,10 +1270,10 @@ function normalizeParseResult(parsed) {
 }
 
 // src/agents/injected-mcp.ts
-import { existsSync as existsSync4, mkdtempSync, writeFileSync } from "fs";
+import { existsSync as existsSync5, mkdtempSync, writeFileSync as writeFileSync2 } from "fs";
 import { createRequire } from "module";
 import { tmpdir } from "os";
-import { dirname, join as join3 } from "path";
+import { dirname as dirname2, join as join4 } from "path";
 import { fileURLToPath } from "url";
 
 // src/mcp/profile.ts
@@ -1283,13 +1283,138 @@ function sideboardMcpProfile(env = process.env) {
 }
 
 // src/agents/node-launch.ts
-import { existsSync as existsSync3, readdirSync, realpathSync } from "fs";
+import { existsSync as existsSync4, readdirSync, realpathSync } from "fs";
 import { homedir } from "os";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
+
+// src/http/system-ca.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync2, mkdirSync, readFileSync, statSync, writeFileSync } from "fs";
+import { dirname, join } from "path";
+import tls from "tls";
+var NODE_USE_SYSTEM_CA = "NODE_USE_SYSTEM_CA";
+var NODE_EXTRA_CA_CERTS = "NODE_EXTRA_CA_CERTS";
+var BUNDLE_NAME = "system-ca.pem";
+var BUNDLE_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var LINUX_CA_FILES = [
+  "/etc/ssl/certs/ca-certificates.crt",
+  "/etc/pki/tls/certs/ca-bundle.crt",
+  "/etc/ssl/ca-bundle.pem",
+  "/etc/ssl/cert.pem"
+];
+var PEM_CERT_RE = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
+function splitPemCertificates(pem) {
+  return pem.match(PEM_CERT_RE) ?? [];
+}
+function readExistingFile(path) {
+  try {
+    return existsSync2(path) ? readFileSync(path, "utf8") : "";
+  } catch {
+    return "";
+  }
+}
+function darwinKeychainPem(spawn) {
+  const result = spawn("/usr/bin/security", ["find-certificate", "-a", "-p"], {
+    encoding: "utf8",
+    maxBuffer: 32 * 1024 * 1024,
+    timeout: 15e3
+  });
+  if (result.status !== 0) return "";
+  return typeof result.stdout === "string" ? result.stdout : "";
+}
+function linuxSystemCaPem() {
+  for (const path of LINUX_CA_FILES) {
+    const pem = readExistingFile(path);
+    if (splitPemCertificates(pem).length > 0) return pem;
+  }
+  return "";
+}
+function collectSystemCaPem(io = {}) {
+  const platform = io.platform ?? process.platform;
+  if (platform === "darwin") {
+    return darwinKeychainPem(io.spawn ?? spawnSync);
+  }
+  if (platform === "linux") {
+    return linuxSystemCaPem();
+  }
+  return "";
+}
+function systemCaBundlePath(io = {}) {
+  return join((io.appData ?? appDataDir)(), BUNDLE_NAME);
+}
+function bundleIsFresh(path, now) {
+  try {
+    if (!existsSync2(path)) return false;
+    if (splitPemCertificates(readFileSync(path, "utf8")).length === 0) return false;
+    return now - statSync(path).mtimeMs < BUNDLE_MAX_AGE_MS;
+  } catch {
+    return false;
+  }
+}
+function materializeSystemCaBundle(io = {}) {
+  const inherited = process.env.NODE_EXTRA_CA_CERTS?.trim();
+  if (inherited && splitPemCertificates(readExistingFile(inherited)).length > 0) {
+    return inherited;
+  }
+  const platform = io.platform ?? process.platform;
+  if (platform === "linux") {
+    for (const path of LINUX_CA_FILES) {
+      if (splitPemCertificates(readExistingFile(path)).length > 0) return path;
+    }
+  }
+  const dest = systemCaBundlePath(io);
+  const now = (io.now ?? Date.now)();
+  if (bundleIsFresh(dest, now)) return dest;
+  const pem = collectSystemCaPem(io);
+  if (splitPemCertificates(pem).length === 0) {
+    return existsSync2(dest) && splitPemCertificates(readExistingFile(dest)).length > 0 ? dest : void 0;
+  }
+  try {
+    mkdirSync(dirname(dest), { recursive: true });
+    writeFileSync(dest, pem.endsWith("\n") ? pem : `${pem}
+`, { mode: 384 });
+    return dest;
+  } catch {
+    return void 0;
+  }
+}
+function applySystemCaEnv(env) {
+  if (!String(env[NODE_USE_SYSTEM_CA] ?? "").trim()) {
+    env[NODE_USE_SYSTEM_CA] = "1";
+  }
+  if (String(env[NODE_EXTRA_CA_CERTS] ?? "").trim()) return;
+  const inherited = process.env.NODE_EXTRA_CA_CERTS?.trim();
+  if (inherited) env[NODE_EXTRA_CA_CERTS] = inherited;
+}
+function extraCertsFromBundle() {
+  const path = process.env.NODE_EXTRA_CA_CERTS?.trim();
+  if (path) return splitPemCertificates(readExistingFile(path));
+  const dest = systemCaBundlePath();
+  return splitPemCertificates(readExistingFile(dest));
+}
+function trustSystemCertificates(io = {}) {
+  try {
+    const api = tls;
+    if (typeof api.getCACertificates !== "function" || typeof api.setDefaultCACertificates !== "function") {
+      return false;
+    }
+    const current = api.getCACertificates("default");
+    const system = api.getCACertificates("system");
+    let extra = extraCertsFromBundle();
+    if (system.length === 0 && extra.length === 0) {
+      extra = splitPemCertificates(collectSystemCaPem(io));
+    }
+    if (system.length === 0 && extra.length === 0) return false;
+    api.setDefaultCACertificates([...current, ...system, ...extra]);
+    return true;
+  } catch {
+    return false;
+  }
+}
 
 // src/agents/packaged-runtime.ts
-import { existsSync as existsSync2 } from "fs";
-import { join } from "path";
+import { existsSync as existsSync3 } from "fs";
+import { join as join2 } from "path";
 function electronResourcesPath() {
   const resources = process.resourcesPath;
   if (typeof resources !== "string" || !resources) return null;
@@ -1298,36 +1423,36 @@ function electronResourcesPath() {
 function packagedCursorRuntimeDir() {
   const resources = electronResourcesPath();
   if (!resources) return null;
-  const dir = join(resources, "cursor-runtime");
-  if (!existsSync2(join(dir, "core-dist", "agents", "cursor-runner.js"))) return null;
+  const dir = join2(resources, "cursor-runtime");
+  if (!existsSync3(join2(dir, "core-dist", "agents", "cursor-runner.js"))) return null;
   return dir;
 }
 function packagedCursorRunnerPath() {
   const dir = packagedCursorRuntimeDir();
-  return dir ? join(dir, "core-dist", "agents", "cursor-runner.js") : null;
+  return dir ? join2(dir, "core-dist", "agents", "cursor-runner.js") : null;
 }
 function packagedMcpDir() {
   const resources = electronResourcesPath();
   if (!resources) return null;
-  const dir = join(resources, "sideboard-mcp");
-  if (!existsSync2(join(dir, "core-dist", "mcp", "run-stdio.js"))) return null;
+  const dir = join2(resources, "sideboard-mcp");
+  if (!existsSync3(join2(dir, "core-dist", "mcp", "run-stdio.js"))) return null;
   return dir;
 }
 function packagedMcpStdioPath() {
   const dir = packagedMcpDir();
-  return dir ? join(dir, "core-dist", "mcp", "run-stdio.js") : null;
+  return dir ? join2(dir, "core-dist", "mcp", "run-stdio.js") : null;
 }
 function packagedBundledNodePath() {
   const resources = electronResourcesPath();
   if (!resources) return null;
-  const bin = join(resources, "node", "bin", "node");
-  if (!existsSync2(bin)) return null;
+  const bin = join2(resources, "node", "bin", "node");
+  if (!existsSync3(bin)) return null;
   return bin;
 }
 function packagedCursorRipgrepCandidate(platformPkg, binName) {
   const dir = packagedCursorRuntimeDir();
   if (!dir) return null;
-  return join(dir, "node_modules", platformPkg, "bin", binName);
+  return join2(dir, "node_modules", platformPkg, "bin", binName);
 }
 
 // src/agents/node-launch.ts
@@ -1348,6 +1473,7 @@ function applyAgentRunnerHeapEnv(env) {
     env.NODE_OPTIONS,
     AGENT_RUNNER_MAX_OLD_SPACE_MB
   );
+  applySystemCaEnv(env);
 }
 function envWithAgentHeap(env) {
   const next = { ...env };
@@ -1362,7 +1488,7 @@ function unpackedAsarPath(filePath) {
   if (!isAsarPath(filePath)) return null;
   const unpacked = filePath.replace(/\.asar(?=[/\\])/, ".asar.unpacked");
   if (unpacked === filePath) return null;
-  return existsSync3(unpacked) ? unpacked : null;
+  return existsSync4(unpacked) ? unpacked : null;
 }
 function nodeReadableScriptPath(scriptPath) {
   return unpackedAsarPath(scriptPath) ?? scriptPath;
@@ -1403,7 +1529,7 @@ function pickPreferredNode(candidates) {
   return best;
 }
 function versionDirNodeBins(root, toBin) {
-  if (!existsSync3(root)) return [];
+  if (!existsSync4(root)) return [];
   try {
     return readdirSync(root).map(toBin);
   } catch {
@@ -1412,28 +1538,28 @@ function versionDirNodeBins(root, toBin) {
 }
 function defaultNodeBinCandidates(home = homedir()) {
   const kegs = ["/opt/homebrew", "/usr/local"].flatMap(
-    (prefix) => PREFERRED_LTS_MAJORS.map((major) => join2(prefix, "opt", `node@${major}`, "bin", "node"))
+    (prefix) => PREFERRED_LTS_MAJORS.map((major) => join3(prefix, "opt", `node@${major}`, "bin", "node"))
   );
   return [
     ...kegs,
     "/opt/homebrew/bin/node",
     "/usr/local/bin/node",
-    join2(home, ".local/share/fnm/aliases/default/bin/node"),
-    join2(home, ".nvm/current/bin/node"),
-    join2(home, ".volta/bin/node"),
-    join2(home, ".asdf/shims/node"),
-    join2(home, ".local/share/mise/shims/node"),
+    join3(home, ".local/share/fnm/aliases/default/bin/node"),
+    join3(home, ".nvm/current/bin/node"),
+    join3(home, ".volta/bin/node"),
+    join3(home, ".asdf/shims/node"),
+    join3(home, ".local/share/mise/shims/node"),
     ...versionDirNodeBins(
-      join2(home, ".nvm", "versions", "node"),
-      (name) => join2(home, ".nvm", "versions", "node", name, "bin", "node")
+      join3(home, ".nvm", "versions", "node"),
+      (name) => join3(home, ".nvm", "versions", "node", name, "bin", "node")
     ),
     ...versionDirNodeBins(
-      join2(home, ".local/share/fnm", "node-versions"),
-      (name) => join2(home, ".local/share/fnm", "node-versions", name, "installation", "bin", "node")
+      join3(home, ".local/share/fnm", "node-versions"),
+      (name) => join3(home, ".local/share/fnm", "node-versions", name, "installation", "bin", "node")
     ),
     ...versionDirNodeBins(
-      join2(home, ".volta", "tools", "image", "node"),
-      (name) => join2(home, ".volta", "tools", "image", "node", name, "bin", "node")
+      join3(home, ".volta", "tools", "image", "node"),
+      (name) => join3(home, ".volta", "tools", "image", "node", name, "bin", "node")
     )
   ];
 }
@@ -1442,7 +1568,7 @@ function uniqueExistingNodeBins(paths) {
   const out = [];
   for (const raw of paths) {
     const p = raw.trim();
-    if (!p || !existsSync3(p) || isElectronLikeCommand(p)) continue;
+    if (!p || !existsSync4(p) || isElectronLikeCommand(p)) continue;
     let key = p;
     try {
       key = realpathSync(p);
@@ -1637,37 +1763,37 @@ function corePackageDir() {
   try {
     const url = import.meta.url;
     if (typeof url === "string" && url.length > 0) {
-      return dirname(fileURLToPath(url));
+      return dirname2(fileURLToPath(url));
     }
   } catch {
   }
   try {
-    const req = createRequire(join3(process.cwd(), "package.json"));
-    return dirname(req.resolve("@sideboard-ai/core"));
+    const req = createRequire(join4(process.cwd(), "package.json"));
+    return dirname2(req.resolve("@sideboard-ai/core"));
   } catch {
     return process.cwd();
   }
 }
 function findSideboardMcpJsEntry() {
   const override = process.env.SIDEBOARD_MCP_ENTRY?.trim() || process.env.SIDEBOARD_CLI?.trim();
-  if (override && existsSync4(override)) return override;
+  if (override && existsSync5(override)) return override;
   const packaged = packagedMcpStdioPath();
   if (packaged) return packaged;
   let dir = corePackageDir();
   for (let i = 0; i < 10; i++) {
     const candidates = [
-      join3(dir, "mcp/run-stdio.js"),
-      join3(dir, "mcp/run-stdio.cjs"),
-      join3(dir, "dist/mcp/run-stdio.js"),
-      join3(dir, "dist/mcp/run-stdio.cjs"),
-      join3(dir, "packages/core/dist/mcp/run-stdio.js"),
-      join3(dir, "packages/cli/dist/index.js"),
-      join3(dir, "cli/dist/index.js")
+      join4(dir, "mcp/run-stdio.js"),
+      join4(dir, "mcp/run-stdio.cjs"),
+      join4(dir, "dist/mcp/run-stdio.js"),
+      join4(dir, "dist/mcp/run-stdio.cjs"),
+      join4(dir, "packages/core/dist/mcp/run-stdio.js"),
+      join4(dir, "packages/cli/dist/index.js"),
+      join4(dir, "cli/dist/index.js")
     ];
     for (const p of candidates) {
-      if (existsSync4(p) && !isAsarPath(p)) return p;
+      if (existsSync5(p) && !isAsarPath(p)) return p;
     }
-    const parent = dirname(dir);
+    const parent = dirname2(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -1814,9 +1940,9 @@ function writeMcpServersConfig(servers) {
       ...env ? { env } : {}
     };
   }
-  const dir = mkdtempSync(join3(tmpdir(), "sideboard-mcp-"));
-  const cfgPath = join3(dir, "mcp.json");
-  writeFileSync(cfgPath, JSON.stringify({ mcpServers }, null, 2));
+  const dir = mkdtempSync(join4(tmpdir(), "sideboard-mcp-"));
+  const cfgPath = join4(dir, "mcp.json");
+  writeFileSync2(cfgPath, JSON.stringify({ mcpServers }, null, 2));
   return cfgPath;
 }
 
@@ -2167,7 +2293,7 @@ var claudeAdapter = {
   async detect() {
     const claude = resolveClaudeExecutable();
     if (claude !== "claude") {
-      if (!existsSync5(claude)) {
+      if (!existsSync6(claude)) {
         return {
           agent: "claude",
           installed: false,
@@ -2216,7 +2342,7 @@ var claudeAdapter = {
       );
     }
     const mode = permissionMode(thread);
-    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-KA7T26F5.js");
+    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-J737XNUX.js");
     const isOrchestrator = isOrchestratorThread2(thread);
     const injectedServers = await buildInjectedMcpServers({
       includeSideboard: true,
@@ -2449,20 +2575,20 @@ function parseIssuesJson(raw) {
 }
 
 // src/agents/codex.ts
-import { existsSync as existsSync8, readFileSync as readFileSync3, statSync } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync4, statSync as statSync2 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 
 // src/agents/orch-mcp-isolation.ts
-import { existsSync as existsSync7, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync3 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 import { parse as parseToml } from "smol-toml";
 
 // src/agents/user-mcp-config.ts
-import { existsSync as existsSync6, mkdirSync, readFileSync, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join4 } from "path";
+import { dirname as dirname3, join as join5 } from "path";
 
 // src/agents/orch-mcp-isolation.ts
 function isInjectedOrchMcpName(name) {
@@ -2486,25 +2612,25 @@ function listMcpNamesFromCodexToml(text) {
 }
 function readJsonObject(path) {
   try {
-    return JSON.parse(readFileSync2(path, "utf8"));
+    return JSON.parse(readFileSync3(path, "utf8"));
   } catch {
     return {};
   }
 }
 function readText(path) {
   try {
-    return readFileSync2(path, "utf8");
+    return readFileSync3(path, "utf8");
   } catch {
     return "";
   }
 }
 function userCodexConfigPaths(home = homedir3()) {
-  return [join5(home, ".codex", "config.toml"), join5(home, ".config", "codex", "config.toml")];
+  return [join6(home, ".codex", "config.toml"), join6(home, ".config", "codex", "config.toml")];
 }
 function userOpencodeConfigPaths(home = homedir3()) {
   return [
-    join5(home, ".config", "opencode", "opencode.json"),
-    join5(home, ".config", "opencode", "opencode.jsonc")
+    join6(home, ".config", "opencode", "opencode.json"),
+    join6(home, ".config", "opencode", "opencode.jsonc")
   ];
 }
 function userMcpNamesToDisable(opts) {
@@ -2526,7 +2652,7 @@ function userMcpNamesToDisable(opts) {
 function listUserCodexMcpNames(home = homedir3()) {
   const names = [];
   for (const path of userCodexConfigPaths(home)) {
-    if (!existsSync7(path)) continue;
+    if (!existsSync8(path)) continue;
     names.push(...listMcpNamesFromCodexToml(readText(path)));
   }
   return names;
@@ -2534,7 +2660,7 @@ function listUserCodexMcpNames(home = homedir3()) {
 function listUserOpencodeMcpNames(home = homedir3()) {
   const names = [];
   for (const path of userOpencodeConfigPaths(home)) {
-    if (!existsSync7(path)) continue;
+    if (!existsSync8(path)) continue;
     names.push(...listMcpNamesFromJsonMap(readJsonObject(path), "mcp"));
   }
   return names;
@@ -2568,7 +2694,7 @@ async function listCodexModels() {
   if (codex === "codex") {
     const which = await run("which", ["codex"], { reject: false });
     if (which.exitCode !== 0) return FALLBACK_CODEX_MODELS;
-  } else if (!existsSync8(codex)) {
+  } else if (!existsSync9(codex)) {
     return FALLBACK_CODEX_MODELS;
   }
   const listed = await run(codex, ["debug", "models"], { reject: false });
@@ -2603,12 +2729,12 @@ function usageFromCodex(usage) {
 }
 function codexConfigHasNetworkAccess() {
   const candidates = [
-    join6(homedir4(), ".codex", "config.toml"),
-    join6(homedir4(), ".config", "codex", "config.toml")
+    join7(homedir4(), ".codex", "config.toml"),
+    join7(homedir4(), ".config", "codex", "config.toml")
   ];
   for (const path of candidates) {
-    if (!existsSync8(path)) continue;
-    const text = readFileSync3(path, "utf8");
+    if (!existsSync9(path)) continue;
+    const text = readFileSync4(path, "utf8");
     if (/network_access\s*=\s*true/.test(text)) return true;
   }
   return false;
@@ -2640,10 +2766,10 @@ function asRecord2(value) {
   return void 0;
 }
 function codexLooksAuthenticated() {
-  const authPath = join6(homedir4(), ".codex", "auth.json");
-  if (!existsSync8(authPath)) return false;
+  const authPath = join7(homedir4(), ".codex", "auth.json");
+  if (!existsSync9(authPath)) return false;
   try {
-    return statSync(authPath).size > 2;
+    return statSync2(authPath).size > 2;
   } catch {
     return false;
   }
@@ -2653,7 +2779,7 @@ var codexAdapter = {
   async detect() {
     const codex = resolveAgentExecutable("codex");
     if (codex !== "codex") {
-      if (!existsSync8(codex)) {
+      if (!existsSync9(codex)) {
         return {
           agent: "codex",
           installed: false,
@@ -2921,9 +3047,9 @@ var codexAdapter = {
 };
 
 // src/agents/cursor.ts
-import { existsSync as existsSync10 } from "fs";
+import { existsSync as existsSync11 } from "fs";
 import { createRequire as createRequire3 } from "module";
-import { dirname as dirname4, join as join8 } from "path";
+import { dirname as dirname5, join as join9 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { Cursor } from "@cursor/sdk";
 
@@ -3139,9 +3265,9 @@ function parseCursorRunnerLine(line) {
 }
 
 // src/agents/cursor-ripgrep.ts
-import { existsSync as existsSync9 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import { createRequire as createRequire2 } from "module";
-import { dirname as dirname3, isAbsolute, join as join7, parse, resolve as resolvePath } from "path";
+import { dirname as dirname4, isAbsolute, join as join8, parse, resolve as resolvePath } from "path";
 var RIPGREP_ENV = "CURSOR_RIPGREP_PATH";
 function rgBinaryName() {
   return process.platform === "win32" ? "rg.exe" : "rg";
@@ -3153,19 +3279,19 @@ function usableRipgrepPath(candidate) {
   const raw = candidate?.trim();
   if (!raw || !isAbsolute(raw)) return null;
   const readable = nodeReadableScriptPath(raw);
-  if (!existsSync9(readable) || isAsarPath(readable)) return null;
+  if (!existsSync10(readable) || isAsarPath(readable)) return null;
   return readable;
 }
 function walkForBundledRipgrep(startFile) {
   if (!startFile) return null;
   const pkg = platformRipgrepPackage();
   const name = rgBinaryName();
-  let dir = dirname3(resolvePath(startFile));
+  let dir = dirname4(resolvePath(startFile));
   const root = parse(dir).root;
   while (dir !== root) {
-    const hit = usableRipgrepPath(join7(dir, "node_modules", pkg, "bin", name));
+    const hit = usableRipgrepPath(join8(dir, "node_modules", pkg, "bin", name));
     if (hit) return hit;
-    const next = dirname3(dir);
+    const next = dirname4(dir);
     if (next === dir) break;
     dir = next;
   }
@@ -3175,7 +3301,7 @@ function requireResolveBundledRipgrep(fromFile) {
   try {
     const req = createRequire2(fromFile);
     const pkgJson = req.resolve(`${platformRipgrepPackage()}/package.json`);
-    return usableRipgrepPath(join7(dirname3(pkgJson), "bin", rgBinaryName()));
+    return usableRipgrepPath(join8(dirname4(pkgJson), "bin", rgBinaryName()));
   } catch {
     return null;
   }
@@ -3211,6 +3337,9 @@ function resolveCursorApiKey() {
   if (fromEnv) return fromEnv;
   return (loadAppSettings().environment.CURSOR_API_KEY || "").trim();
 }
+function isCursorApiKeyConfigured() {
+  return Boolean(resolveCursorApiKey());
+}
 function isCursorAutoModel(model) {
   const id = (model ?? "").trim().toLowerCase();
   return !id || id === "default" || id === "auto";
@@ -3244,11 +3373,11 @@ function entryDir() {
   const cjsDir = typeof __dirname !== "undefined" ? __dirname : "";
   if (cjsDir) return cjsDir;
   try {
-    return dirname4(fileURLToPath2(import.meta.url));
+    return dirname5(fileURLToPath2(import.meta.url));
   } catch {
     try {
       const req = createRequire3(process.cwd() + "/");
-      return dirname4(req.resolve("@sideboard-ai/core"));
+      return dirname5(req.resolve("@sideboard-ai/core"));
     } catch {
       return process.cwd();
     }
@@ -3259,17 +3388,17 @@ function cursorRunnerPath() {
   if (packaged) return packaged;
   const root = entryDir();
   const candidates = [
-    join8(root, "agents", "cursor-runner.js"),
-    join8(root, "agents", "cursor-runner.cjs"),
+    join9(root, "agents", "cursor-runner.js"),
+    join9(root, "agents", "cursor-runner.cjs"),
     // If somehow resolved from package root instead of dist/
-    join8(root, "dist", "agents", "cursor-runner.js"),
-    join8(root, "dist", "agents", "cursor-runner.cjs"),
+    join9(root, "dist", "agents", "cursor-runner.js"),
+    join9(root, "dist", "agents", "cursor-runner.cjs"),
     // Source tree (dev): packages/core/src/agents/cursor-runner.ts
-    join8(root, "cursor-runner.ts"),
-    join8(root, "src", "agents", "cursor-runner.ts")
+    join9(root, "cursor-runner.ts"),
+    join9(root, "src", "agents", "cursor-runner.ts")
   ];
   for (const candidate of candidates) {
-    if (existsSync10(candidate)) return candidate;
+    if (existsSync11(candidate)) return candidate;
   }
   return candidates[0];
 }
@@ -3357,7 +3486,7 @@ var cursorAdapter = {
 };
 
 // src/agents/opencode.ts
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync12 } from "fs";
 var FALLBACK_OPENCODE_MODELS = [
   { id: "opencode/big-pickle", displayName: "opencode \xB7 big-pickle" },
   {
@@ -3416,7 +3545,7 @@ async function listOpencodeModels() {
   if (opencode === "opencode") {
     const which = await run("which", ["opencode"], { reject: false });
     if (which.exitCode !== 0) return FALLBACK_OPENCODE_MODELS;
-  } else if (!existsSync11(opencode)) {
+  } else if (!existsSync12(opencode)) {
     return FALLBACK_OPENCODE_MODELS;
   }
   const listed = await run(opencode, ["models"], { reject: false });
@@ -3451,7 +3580,7 @@ var opencodeAdapter = {
   async detect() {
     const opencode = resolveAgentExecutable("opencode");
     if (opencode !== "opencode") {
-      if (!existsSync11(opencode)) {
+      if (!existsSync12(opencode)) {
         return {
           agent: "opencode",
           installed: false,
@@ -4156,6 +4285,9 @@ function allAdapters() {
 }
 
 export {
+  materializeSystemCaBundle,
+  applySystemCaEnv,
+  trustSystemCertificates,
   pushTurnStderr,
   looksLikeV8Oom,
   summarizeTurnStderr,
@@ -4198,6 +4330,7 @@ export {
   turnCostUsdFromCursorUsage,
   cursorSdkMessageToEvents,
   parseCursorRunnerLine,
+  isCursorApiKeyConfigured,
   isCursorAutoModel,
   resolveCursorModelId,
   listCursorModels,

package/dist/{chunk-S42XV45P.js → chunk-Y4MIXGPA.js}

@@ -2,7 +2,7 @@
 
 import {
   formatFetchError
-} from "./chunk-6GN5WPYZ.js";
+} from "./chunk-VKQGAWHY.js";
 
 // src/brightsy/config.ts
 import { existsSync, readFileSync, writeFileSync } from "fs";

package/dist/{connected-teams-DBWAMP7G.js → connected-teams-ON2KIKQX.js}

@@ -7,9 +7,9 @@ import {
   ensureConnectedBrightsyTeamTokens,
   getConnectedBrightsyTeamsRaw,
   listConnectedBrightsyTeams
-} from "./chunk-XD2BAANL.js";
-import "./chunk-M267JPEA.js";
-import "./chunk-ELBYOGVA.js";
+} from "./chunk-IEEAVWAP.js";
+import "./chunk-AN3THU7F.js";
+import "./chunk-N7WZ6NIN.js";
 import "./chunk-EFVFB2AH.js";
 import "./chunk-UFHNSFAS.js";
 export {