@sideboard-ai/core 0.1.174 → 0.1.176

package/dist/mcp/run-stdio.cjs

@@ -491,24 +491,156 @@ var init_paths = __esm({
   }
 });
 
+// src/http/system-ca.ts
+function splitPemCertificates(pem) {
+  return pem.match(PEM_CERT_RE) ?? [];
+}
+function readExistingFile(path) {
+  try {
+    return (0, import_node_fs5.existsSync)(path) ? (0, import_node_fs5.readFileSync)(path, "utf8") : "";
+  } catch {
+    return "";
+  }
+}
+function darwinKeychainPem(spawn2) {
+  const result = spawn2("/usr/bin/security", ["find-certificate", "-a", "-p"], {
+    encoding: "utf8",
+    maxBuffer: 32 * 1024 * 1024,
+    timeout: 15e3
+  });
+  if (result.status !== 0) return "";
+  return typeof result.stdout === "string" ? result.stdout : "";
+}
+function linuxSystemCaPem() {
+  for (const path of LINUX_CA_FILES) {
+    const pem = readExistingFile(path);
+    if (splitPemCertificates(pem).length > 0) return pem;
+  }
+  return "";
+}
+function collectSystemCaPem(io = {}) {
+  const platform = io.platform ?? process.platform;
+  if (platform === "darwin") {
+    return darwinKeychainPem(io.spawn ?? import_node_child_process.spawnSync);
+  }
+  if (platform === "linux") {
+    return linuxSystemCaPem();
+  }
+  return "";
+}
+function systemCaBundlePath(io = {}) {
+  return (0, import_node_path6.join)((io.appData ?? appDataDir)(), BUNDLE_NAME);
+}
+function bundleIsFresh(path, now) {
+  try {
+    if (!(0, import_node_fs5.existsSync)(path)) return false;
+    if (splitPemCertificates((0, import_node_fs5.readFileSync)(path, "utf8")).length === 0) return false;
+    return now - (0, import_node_fs5.statSync)(path).mtimeMs < BUNDLE_MAX_AGE_MS;
+  } catch {
+    return false;
+  }
+}
+function materializeSystemCaBundle(io = {}) {
+  const inherited = process.env.NODE_EXTRA_CA_CERTS?.trim();
+  if (inherited && splitPemCertificates(readExistingFile(inherited)).length > 0) {
+    return inherited;
+  }
+  const platform = io.platform ?? process.platform;
+  if (platform === "linux") {
+    for (const path of LINUX_CA_FILES) {
+      if (splitPemCertificates(readExistingFile(path)).length > 0) return path;
+    }
+  }
+  const dest = systemCaBundlePath(io);
+  const now = (io.now ?? Date.now)();
+  if (bundleIsFresh(dest, now)) return dest;
+  const pem = collectSystemCaPem(io);
+  if (splitPemCertificates(pem).length === 0) {
+    return (0, import_node_fs5.existsSync)(dest) && splitPemCertificates(readExistingFile(dest)).length > 0 ? dest : void 0;
+  }
+  try {
+    (0, import_node_fs5.mkdirSync)((0, import_node_path6.dirname)(dest), { recursive: true });
+    (0, import_node_fs5.writeFileSync)(dest, pem.endsWith("\n") ? pem : `${pem}
+`, { mode: 384 });
+    return dest;
+  } catch {
+    return void 0;
+  }
+}
+function applySystemCaEnv(env) {
+  if (!String(env[NODE_USE_SYSTEM_CA] ?? "").trim()) {
+    env[NODE_USE_SYSTEM_CA] = "1";
+  }
+  if (String(env[NODE_EXTRA_CA_CERTS] ?? "").trim()) return;
+  const inherited = process.env.NODE_EXTRA_CA_CERTS?.trim();
+  if (inherited) env[NODE_EXTRA_CA_CERTS] = inherited;
+}
+function extraCertsFromBundle() {
+  const path = process.env.NODE_EXTRA_CA_CERTS?.trim();
+  if (path) return splitPemCertificates(readExistingFile(path));
+  const dest = systemCaBundlePath();
+  return splitPemCertificates(readExistingFile(dest));
+}
+function trustSystemCertificates(io = {}) {
+  try {
+    const api = import_node_tls.default;
+    if (typeof api.getCACertificates !== "function" || typeof api.setDefaultCACertificates !== "function") {
+      return false;
+    }
+    const current = api.getCACertificates("default");
+    const system = api.getCACertificates("system");
+    let extra = extraCertsFromBundle();
+    if (system.length === 0 && extra.length === 0) {
+      extra = splitPemCertificates(collectSystemCaPem(io));
+    }
+    if (system.length === 0 && extra.length === 0) return false;
+    api.setDefaultCACertificates([...current, ...system, ...extra]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var import_node_child_process, import_node_fs5, import_node_path6, import_node_tls, NODE_USE_SYSTEM_CA, NODE_EXTRA_CA_CERTS, BUNDLE_NAME, BUNDLE_MAX_AGE_MS, LINUX_CA_FILES, PEM_CERT_RE;
+var init_system_ca = __esm({
+  "src/http/system-ca.ts"() {
+    "use strict";
+    import_node_child_process = require("child_process");
+    import_node_fs5 = require("fs");
+    import_node_path6 = require("path");
+    import_node_tls = __toESM(require("tls"), 1);
+    init_paths();
+    NODE_USE_SYSTEM_CA = "NODE_USE_SYSTEM_CA";
+    NODE_EXTRA_CA_CERTS = "NODE_EXTRA_CA_CERTS";
+    BUNDLE_NAME = "system-ca.pem";
+    BUNDLE_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+    LINUX_CA_FILES = [
+      "/etc/ssl/certs/ca-certificates.crt",
+      "/etc/pki/tls/certs/ca-bundle.crt",
+      "/etc/ssl/ca-bundle.pem",
+      "/etc/ssl/cert.pem"
+    ];
+    PEM_CERT_RE = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
+  }
+});
+
 // src/store/private-file.ts
 function writePrivateFile(path, contents) {
-  (0, import_node_fs5.mkdirSync)((0, import_node_path6.dirname)(path), { recursive: true });
-  (0, import_node_fs5.writeFileSync)(path, contents, { encoding: "utf8", mode: PRIVATE_FILE_MODE });
+  (0, import_node_fs6.mkdirSync)((0, import_node_path7.dirname)(path), { recursive: true });
+  (0, import_node_fs6.writeFileSync)(path, contents, { encoding: "utf8", mode: PRIVATE_FILE_MODE });
   chmodOwnerOnly(path);
 }
 function chmodOwnerOnly(path) {
   try {
-    (0, import_node_fs5.chmodSync)(path, PRIVATE_FILE_MODE);
+    (0, import_node_fs6.chmodSync)(path, PRIVATE_FILE_MODE);
   } catch {
   }
 }
-var import_node_fs5, import_node_path6, PRIVATE_FILE_MODE;
+var import_node_fs6, import_node_path7, PRIVATE_FILE_MODE;
 var init_private_file = __esm({
   "src/store/private-file.ts"() {
     "use strict";
-    import_node_fs5 = require("fs");
-    import_node_path6 = require("path");
+    import_node_fs6 = require("fs");
+    import_node_path7 = require("path");
     PRIVATE_FILE_MODE = 384;
   }
 });
@@ -517,7 +649,7 @@ var init_private_file = __esm({
 function persistVaultKeyInKeychain(key) {
   if (process.platform !== "darwin" || key.length !== 32) return;
   try {
-    (0, import_node_child_process.execFileSync)(
+    (0, import_node_child_process2.execFileSync)(
       "security",
       [
         "add-generic-password",
@@ -542,7 +674,7 @@ function hexKey(value) {
 function keychainKey(create) {
   if (process.platform !== "darwin") return null;
   try {
-    const out = (0, import_node_child_process.execFileSync)(
+    const out = (0, import_node_child_process2.execFileSync)(
       "security",
       ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-a", KEYCHAIN_ACCOUNT, "-w"],
       { encoding: "utf8", timeout: 5e3, stdio: ["ignore", "pipe", "pipe"] }
@@ -594,11 +726,11 @@ function decryptEnvelope(envelope, key) {
   return JSON.parse(plaintext.toString("utf8"));
 }
 function readSecureJson(path) {
-  if (!(0, import_node_fs6.existsSync)(path)) return null;
+  if (!(0, import_node_fs7.existsSync)(path)) return null;
   chmodOwnerOnly(path);
   let parsed;
   try {
-    parsed = JSON.parse((0, import_node_fs6.readFileSync)(path, "utf8"));
+    parsed = JSON.parse((0, import_node_fs7.readFileSync)(path, "utf8"));
   } catch {
     return null;
   }
@@ -618,20 +750,20 @@ function writeSecureJson(path, value) {
 `);
 }
 function isSecureFileEncrypted(path) {
-  if (!(0, import_node_fs6.existsSync)(path)) return false;
+  if (!(0, import_node_fs7.existsSync)(path)) return false;
   try {
-    return isEnvelope(JSON.parse((0, import_node_fs6.readFileSync)(path, "utf8")));
+    return isEnvelope(JSON.parse((0, import_node_fs7.readFileSync)(path, "utf8")));
   } catch {
     return false;
   }
 }
-var import_node_child_process, import_node_crypto, import_node_fs6, KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, ALG, injectedKey;
+var import_node_child_process2, import_node_crypto, import_node_fs7, KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, ALG, injectedKey;
 var init_secure_file = __esm({
   "src/store/secure-file.ts"() {
     "use strict";
-    import_node_child_process = require("child_process");
+    import_node_child_process2 = require("child_process");
     import_node_crypto = require("crypto");
-    import_node_fs6 = require("fs");
+    import_node_fs7 = require("fs");
     init_private_file();
     KEYCHAIN_SERVICE = "ai.sideboard.app";
     KEYCHAIN_ACCOUNT = "secret-vault-v1";
@@ -756,7 +888,7 @@ function createEmptyThread(partial) {
 }
 async function withThreadLock(id, fn) {
   const lockPath = threadLockPath(id);
-  (0, import_node_fs7.writeFileSync)(lockPath, "", { flag: "a" });
+  (0, import_node_fs8.writeFileSync)(lockPath, "", { flag: "a" });
   let release;
   try {
     release = await import_proper_lockfile.default.lock(lockPath, {
@@ -777,7 +909,7 @@ function cacheForDir() {
 }
 function fileMtimeMs(path) {
   try {
-    return (0, import_node_fs7.statSync)(path).mtimeMs;
+    return (0, import_node_fs8.statSync)(path).mtimeMs;
   } catch {
     return null;
   }
@@ -805,7 +937,7 @@ function readThread(id) {
   const cache = cacheForDir();
   const cached = cache.byId.get(id);
   if (cached && cache.mtimeMs.get(id) === mtimeMs) return cached;
-  const raw = (0, import_node_fs7.readFileSync)(path, "utf8");
+  const raw = (0, import_node_fs8.readFileSync)(path, "utf8");
   const thread = normalizeThread(JSON.parse(raw));
   rememberThread(thread, mtimeMs);
   return thread;
@@ -814,20 +946,20 @@ function writeThread(thread) {
   const path = threadFilePath(idPath(thread.id));
   const tmp = `${path}.${process.pid}.tmp`;
   const next = { ...thread, updatedAt: nowIso() };
-  (0, import_node_fs7.writeFileSync)(tmp, JSON.stringify(next, null, 2), "utf8");
-  (0, import_node_fs7.renameSync)(tmp, path);
+  (0, import_node_fs8.writeFileSync)(tmp, JSON.stringify(next, null, 2), "utf8");
+  (0, import_node_fs8.renameSync)(tmp, path);
   rememberThread(next, fileMtimeMs(path) ?? Date.now());
 }
 function idPath(id) {
   return id;
 }
 function isThreadRecordFile(nameOrPath) {
-  const name = (0, import_node_path7.basename)(nameOrPath);
+  const name = (0, import_node_path8.basename)(nameOrPath);
   return name.endsWith(".json") && !name.endsWith(".live.json");
 }
 function listThreads(opts) {
   const cache = cacheForDir();
-  const files = (0, import_node_fs7.readdirSync)(threadsDir()).filter(isThreadRecordFile);
+  const files = (0, import_node_fs8.readdirSync)(threadsDir()).filter(isThreadRecordFile);
   const seen = /* @__PURE__ */ new Set();
   for (const f of files) {
     const id = f.replace(/\.json$/, "");
@@ -850,11 +982,11 @@ function listThreads(opts) {
 function deleteThreadRecord(id) {
   forgetThread(id);
   const path = threadFilePath(id);
-  if ((0, import_node_fs7.existsSync)(path)) (0, import_node_fs7.unlinkSync)(path);
+  if ((0, import_node_fs8.existsSync)(path)) (0, import_node_fs8.unlinkSync)(path);
   const lock = threadLockPath(id);
-  if ((0, import_node_fs7.existsSync)(lock)) {
+  if ((0, import_node_fs8.existsSync)(lock)) {
     try {
-      (0, import_node_fs7.unlinkSync)(lock);
+      (0, import_node_fs8.unlinkSync)(lock);
     } catch {
     }
   }
@@ -880,13 +1012,13 @@ function findThreadByRef(ref) {
     (t) => t.id === ref || t.id.startsWith(ref) || t.branchName === ref || t.title === ref
   ) ?? null;
 }
-var import_node_crypto2, import_node_fs7, import_node_path7, import_proper_lockfile, listCache;
+var import_node_crypto2, import_node_fs8, import_node_path8, import_proper_lockfile, listCache;
 var init_thread_store = __esm({
   "src/store/thread-store.ts"() {
     "use strict";
     import_node_crypto2 = require("crypto");
-    import_node_fs7 = require("fs");
-    import_node_path7 = require("path");
+    import_node_fs8 = require("fs");
+    import_node_path8 = require("path");
     import_proper_lockfile = __toESM(require("proper-lockfile"), 1);
     init_thinking_effort();
     init_paths();
@@ -938,13 +1070,13 @@ var init_api = __esm({
 
 // src/slack/reply-target.ts
 function storePath() {
-  return (0, import_node_path8.join)(appDataDir(), "slack-reply-to.json");
+  return (0, import_node_path9.join)(appDataDir(), "slack-reply-to.json");
 }
 function readStore() {
   const path = storePath();
-  if (!(0, import_node_fs8.existsSync)(path)) return {};
+  if (!(0, import_node_fs9.existsSync)(path)) return {};
   try {
-    const parsed = isSecureFileEncrypted(path) ? readSecureJson(path) : JSON.parse((0, import_node_fs8.readFileSync)(path, "utf8"));
+    const parsed = isSecureFileEncrypted(path) ? readSecureJson(path) : JSON.parse((0, import_node_fs9.readFileSync)(path, "utf8"));
     return parsed?.targets && typeof parsed.targets === "object" ? parsed.targets : {};
   } catch {
     return {};
@@ -953,12 +1085,12 @@ function readStore() {
 function getSlackReplyTarget(threadId) {
   return readStore()[threadId] ?? null;
 }
-var import_node_fs8, import_node_path8;
+var import_node_fs9, import_node_path9;
 var init_reply_target = __esm({
   "src/slack/reply-target.ts"() {
     "use strict";
-    import_node_fs8 = require("fs");
-    import_node_path8 = require("path");
+    import_node_fs9 = require("fs");
+    import_node_path9 = require("path");
     init_paths();
     init_private_file();
     init_secure_file();
@@ -967,7 +1099,7 @@ var init_reply_target = __esm({
 
 // src/slack/workspaces.ts
 function storePath2() {
-  return (0, import_node_path9.join)(appDataDir(), "slack-workspaces.json");
+  return (0, import_node_path10.join)(appDataDir(), "slack-workspaces.json");
 }
 function readStore2() {
   try {
@@ -1028,11 +1160,11 @@ function requireSlackWorkspace(teamId) {
   }
   return ws;
 }
-var import_node_path9;
+var import_node_path10;
 var init_workspaces = __esm({
   "src/slack/workspaces.ts"() {
     "use strict";
-    import_node_path9 = require("path");
+    import_node_path10 = require("path");
     init_paths();
     init_secure_file();
     init_api();
@@ -1041,7 +1173,7 @@ var init_workspaces = __esm({
 
 // src/slack/outbound-watch.ts
 function storePath3() {
-  return (0, import_node_path10.join)(appDataDir(), "slack-outbound-watch.json");
+  return (0, import_node_path11.join)(appDataDir(), "slack-outbound-watch.json");
 }
 function watchId(teamId, channelId, ts) {
   return `${teamId}:${channelId}:${ts}`;
@@ -1054,9 +1186,9 @@ function tsNewer(a, b) {
 }
 function readStore3() {
   const path = storePath3();
-  if (!(0, import_node_fs9.existsSync)(path)) return [];
+  if (!(0, import_node_fs10.existsSync)(path)) return [];
   try {
-    const parsed = isSecureFileEncrypted(path) ? readSecureJson(path) : JSON.parse((0, import_node_fs9.readFileSync)(path, "utf8"));
+    const parsed = isSecureFileEncrypted(path) ? readSecureJson(path) : JSON.parse((0, import_node_fs10.readFileSync)(path, "utf8"));
     return Array.isArray(parsed?.watches) ? parsed.watches : [];
   } catch {
     return [];
@@ -1378,12 +1510,12 @@ async function pollSlackOutboundWatches(opts) {
   }
   if (changed) writeStore(watches);
 }
-var import_node_fs9, import_node_path10, MAX_WATCHES, MAX_REPLIES_PER_WATCH, WATCH_TTL_MS, POLL_INTERVAL_MS, lastPollMs, nameCache, continueOnReply;
+var import_node_fs10, import_node_path11, MAX_WATCHES, MAX_REPLIES_PER_WATCH, WATCH_TTL_MS, POLL_INTERVAL_MS, lastPollMs, nameCache, continueOnReply;
 var init_outbound_watch = __esm({
   "src/slack/outbound-watch.ts"() {
     "use strict";
-    import_node_fs9 = require("fs");
-    import_node_path10 = require("path");
+    import_node_fs10 = require("fs");
+    import_node_path11 = require("path");
     init_paths();
     init_private_file();
     init_secure_file();
@@ -1703,64 +1835,64 @@ var init_error_detail = __esm({
 
 // src/agents/path.ts
 function prependPathDir(env, dir) {
-  if (!dir || !(0, import_node_fs10.existsSync)(dir)) return;
+  if (!dir || !(0, import_node_fs11.existsSync)(dir)) return;
   const current = env.PATH ?? "";
-  const parts = current.split(import_node_path11.delimiter).filter(Boolean);
+  const parts = current.split(import_node_path12.delimiter).filter(Boolean);
   if (parts.includes(dir)) {
     env.PATH = current;
     return;
   }
-  env.PATH = [dir, ...parts].join(import_node_path11.delimiter);
+  env.PATH = [dir, ...parts].join(import_node_path12.delimiter);
 }
 function conductorBundledBinDir(home = process.env.HOME || process.env.USERPROFILE || (0, import_node_os3.homedir)()) {
-  return (0, import_node_path11.join)(home, "Library", "Application Support", "com.conductor.app", "bin");
+  return (0, import_node_path12.join)(home, "Library", "Application Support", "com.conductor.app", "bin");
 }
 function ensureAgentPath(env = process.env) {
   const home = env.HOME || env.USERPROFILE || (0, import_node_os3.homedir)();
   const current = env.PATH ?? "";
-  const parts = current.split(import_node_path11.delimiter).filter(Boolean);
+  const parts = current.split(import_node_path12.delimiter).filter(Boolean);
   const seen = new Set(parts);
   const extras = [
-    ...EXTRA_BIN_DIRS.map((rel) => (0, import_node_path11.join)(home, rel)),
+    ...EXTRA_BIN_DIRS.map((rel) => (0, import_node_path12.join)(home, rel)),
     "/opt/homebrew/bin",
     "/usr/local/bin",
     // Keep after Homebrew/npm so a user-installed CLI still wins.
     conductorBundledBinDir(home)
   ];
   for (const dir of extras.reverse()) {
-    if (!dir || seen.has(dir) || !(0, import_node_fs10.existsSync)(dir)) continue;
+    if (!dir || seen.has(dir) || !(0, import_node_fs11.existsSync)(dir)) continue;
     parts.unshift(dir);
     seen.add(dir);
   }
-  const next = parts.join(import_node_path11.delimiter);
+  const next = parts.join(import_node_path12.delimiter);
   env.PATH = next;
   return next;
 }
 function enrichPathWithNpmGlobalBin(env = process.env) {
   ensureAgentPath(env);
   try {
-    const prefix = (0, import_node_child_process2.execFileSync)("npm", ["prefix", "-g"], {
+    const prefix = (0, import_node_child_process3.execFileSync)("npm", ["prefix", "-g"], {
       encoding: "utf8",
       env: { ...process.env, ...env },
       timeout: 8e3,
       stdio: ["ignore", "pipe", "ignore"]
     }).trim().split(/\r?\n/).find(Boolean);
     if (prefix) {
-      const binDir = process.platform === "win32" ? prefix : (0, import_node_path11.join)(prefix, "bin");
+      const binDir = process.platform === "win32" ? prefix : (0, import_node_path12.join)(prefix, "bin");
       prependPathDir(env, binDir);
     }
   } catch {
   }
   return env.PATH ?? "";
 }
-var import_node_fs10, import_node_child_process2, import_node_os3, import_node_path11, EXTRA_BIN_DIRS;
+var import_node_fs11, import_node_child_process3, import_node_os3, import_node_path12, EXTRA_BIN_DIRS;
 var init_path = __esm({
   "src/agents/path.ts"() {
     "use strict";
-    import_node_fs10 = require("fs");
-    import_node_child_process2 = require("child_process");
+    import_node_fs11 = require("fs");
+    import_node_child_process3 = require("child_process");
     import_node_os3 = require("os");
-    import_node_path11 = require("path");
+    import_node_path12 = require("path");
     EXTRA_BIN_DIRS = [
       ".local/bin",
       ".cargo/bin",
@@ -1781,23 +1913,23 @@ var init_path = __esm({
 function githubAgentAuthDir() {
   const override = process.env.SIDEBOARD_GIT_AUTH_DIR?.trim();
   if (override) return override;
-  return (0, import_node_path12.join)((0, import_node_os4.homedir)(), ".sideboard-git-auth");
+  return (0, import_node_path13.join)((0, import_node_os4.homedir)(), ".sideboard-git-auth");
 }
 function githubCredentialStorePath() {
-  return (0, import_node_path12.join)(githubAgentAuthDir(), "git-credentials");
+  return (0, import_node_path13.join)(githubAgentAuthDir(), "git-credentials");
 }
 function githubGhConfigDir() {
-  return (0, import_node_path12.join)(githubAgentAuthDir(), "gh");
+  return (0, import_node_path13.join)(githubAgentAuthDir(), "gh");
 }
 function writePrivateFile2(file, body) {
-  (0, import_node_fs11.mkdirSync)((0, import_node_path12.dirname)(file), { recursive: true, mode: 448 });
+  (0, import_node_fs12.mkdirSync)((0, import_node_path13.dirname)(file), { recursive: true, mode: 448 });
   try {
-    (0, import_node_fs11.chmodSync)((0, import_node_path12.dirname)(file), 448);
+    (0, import_node_fs12.chmodSync)((0, import_node_path13.dirname)(file), 448);
   } catch {
   }
-  (0, import_node_fs11.writeFileSync)(file, body, { encoding: "utf8", mode: 384 });
+  (0, import_node_fs12.writeFileSync)(file, body, { encoding: "utf8", mode: 384 });
   try {
-    (0, import_node_fs11.chmodSync)(file, 384);
+    (0, import_node_fs12.chmodSync)(file, 384);
   } catch {
   }
 }
@@ -1822,19 +1954,19 @@ function materializeGithubAgentAuth(token, user) {
   const trimmed = token.trim();
   if (!trimmed) return;
   const root = githubAgentAuthDir();
-  (0, import_node_fs11.mkdirSync)(root, { recursive: true, mode: 448 });
+  (0, import_node_fs12.mkdirSync)(root, { recursive: true, mode: 448 });
   try {
-    (0, import_node_fs11.chmodSync)(root, 448);
+    (0, import_node_fs12.chmodSync)(root, 448);
   } catch {
   }
   writePrivateFile2(githubCredentialStorePath(), gitCredentialStoreContents(trimmed));
   const ghDir = githubGhConfigDir();
-  (0, import_node_fs11.mkdirSync)(ghDir, { recursive: true, mode: 448 });
-  writePrivateFile2((0, import_node_path12.join)(ghDir, "hosts.yml"), ghHostsYml(trimmed, user));
-  writePrivateFile2((0, import_node_path12.join)(ghDir, "config.yml"), "git_protocol: https\nprompt: disabled\n");
+  (0, import_node_fs12.mkdirSync)(ghDir, { recursive: true, mode: 448 });
+  writePrivateFile2((0, import_node_path13.join)(ghDir, "hosts.yml"), ghHostsYml(trimmed, user));
+  writePrivateFile2((0, import_node_path13.join)(ghDir, "config.yml"), "git_protocol: https\nprompt: disabled\n");
 }
 function githubAgentAuthReady() {
-  return (0, import_node_fs11.existsSync)(githubCredentialStorePath()) && (0, import_node_fs11.existsSync)((0, import_node_path12.join)(githubGhConfigDir(), "hosts.yml"));
+  return (0, import_node_fs12.existsSync)(githubCredentialStorePath()) && (0, import_node_fs12.existsSync)((0, import_node_path13.join)(githubGhConfigDir(), "hosts.yml"));
 }
 function githubCredentialHelperGitConfig() {
   const file = githubCredentialStorePath();
@@ -1849,13 +1981,13 @@ function githubGhConfigEnv() {
     GH_PROMPT_DISABLED: "1"
   };
 }
-var import_node_fs11, import_node_os4, import_node_path12;
+var import_node_fs12, import_node_os4, import_node_path13;
 var init_github_agent_auth = __esm({
   "src/git/github-agent-auth.ts"() {
     "use strict";
-    import_node_fs11 = require("fs");
+    import_node_fs12 = require("fs");
     import_node_os4 = require("os");
-    import_node_path12 = require("path");
+    import_node_path13 = require("path");
   }
 });
 
@@ -1864,11 +1996,11 @@ function isIndexLockError(text7) {
   return /Unable to create ['"][^'"]*index\.lock['"]: File exists/i.test(text7);
 }
 function clearStaleIndexLock(gitDir, maxAgeMs = STALE_INDEX_LOCK_MS, now = Date.now()) {
-  const lockPath = (0, import_node_path13.join)(gitDir, "index.lock");
+  const lockPath = (0, import_node_path14.join)(gitDir, "index.lock");
   try {
-    if (!(0, import_node_fs12.existsSync)(lockPath)) return null;
-    if (now - (0, import_node_fs12.statSync)(lockPath).mtimeMs < maxAgeMs) return null;
-    (0, import_node_fs12.unlinkSync)(lockPath);
+    if (!(0, import_node_fs13.existsSync)(lockPath)) return null;
+    if (now - (0, import_node_fs13.statSync)(lockPath).mtimeMs < maxAgeMs) return null;
+    (0, import_node_fs13.unlinkSync)(lockPath);
     return lockPath;
   } catch {
     return null;
@@ -1883,12 +2015,12 @@ function clearStaleIndexLocks(gitDirs, maxAgeMs = STALE_INDEX_LOCK_MS) {
   }
   return removed;
 }
-var import_node_fs12, import_node_path13, STALE_INDEX_LOCK_MS;
+var import_node_fs13, import_node_path14, STALE_INDEX_LOCK_MS;
 var init_stale_lock = __esm({
   "src/git/stale-lock.ts"() {
     "use strict";
-    import_node_fs12 = require("fs");
-    import_node_path13 = require("path");
+    import_node_fs13 = require("fs");
+    import_node_path14 = require("path");
     STALE_INDEX_LOCK_MS = 2e4;
   }
 });
@@ -2998,11 +3130,11 @@ async function ensureWorktreeSideboardIgnored(worktreePath) {
   if (gitDir.exitCode !== 0) return;
   const dir = gitDir.stdout.trim();
   if (!dir) return;
-  const excludePath = (0, import_node_path14.join)(dir, "info", "exclude");
-  (0, import_node_fs13.mkdirSync)((0, import_node_path14.dirname)(excludePath), { recursive: true });
+  const excludePath = (0, import_node_path15.join)(dir, "info", "exclude");
+  (0, import_node_fs14.mkdirSync)((0, import_node_path15.dirname)(excludePath), { recursive: true });
   let body = "";
   try {
-    body = (0, import_node_fs13.readFileSync)(excludePath, "utf8");
+    body = (0, import_node_fs14.readFileSync)(excludePath, "utf8");
   } catch {
     body = "";
   }
@@ -3018,7 +3150,7 @@ async function ensureWorktreeSideboardIgnored(worktreePath) {
 ` : body;
     const header = body.includes(EXCLUDE_COMMENT) ? "" : `${EXCLUDE_COMMENT}
 `;
-    (0, import_node_fs13.writeFileSync)(excludePath, `${prefix}${header}${missing.join("\n")}
+    (0, import_node_fs14.writeFileSync)(excludePath, `${prefix}${header}${missing.join("\n")}
 `, "utf8");
   }
   const listed = await git(["ls-files", "-z", "--", ".sideboard"], worktreePath, {
@@ -3033,12 +3165,12 @@ async function ensureWorktreeSideboardIgnored(worktreePath) {
     timeoutMs: 8e3
   });
 }
-var import_node_fs13, import_node_path14, WORKTREE_SIDEBOARD_EXCLUDE, WORKTREE_CONTEXT_EXCLUDE, EXCLUDE_COMMENT;
+var import_node_fs14, import_node_path15, WORKTREE_SIDEBOARD_EXCLUDE, WORKTREE_CONTEXT_EXCLUDE, EXCLUDE_COMMENT;
 var init_worktree_exclude = __esm({
   "src/git/worktree-exclude.ts"() {
     "use strict";
-    import_node_fs13 = require("fs");
-    import_node_path14 = require("path");
+    import_node_fs14 = require("fs");
+    import_node_path15 = require("path");
     init_run();
     WORKTREE_SIDEBOARD_EXCLUDE = ".sideboard/";
     WORKTREE_CONTEXT_EXCLUDE = ".context/";
@@ -3189,7 +3321,7 @@ var init_account_profile = __esm({
 
 // src/store/secret-vault.ts
 function secretVaultPath() {
-  return (0, import_node_path15.join)(appDataDir(), "secrets.json");
+  return (0, import_node_path16.join)(appDataDir(), "secrets.json");
 }
 function loadSecretVault() {
   const parsed = readSecureJson(secretVaultPath());
@@ -3248,11 +3380,11 @@ function normalizeVault(raw) {
   }
   return out;
 }
-var import_node_path15;
+var import_node_path16;
 var init_secret_vault = __esm({
   "src/store/secret-vault.ts"() {
     "use strict";
-    import_node_path15 = require("path");
+    import_node_path16 = require("path");
     init_paths();
     init_secure_file();
   }
@@ -3433,10 +3565,10 @@ function toPublicAppSettings(settings) {
   };
 }
 function appSettingsPath() {
-  return (0, import_node_path16.join)(appDataDir(), "settings.json");
+  return (0, import_node_path17.join)(appDataDir(), "settings.json");
 }
 function claudeUserSettingsPath() {
-  return (0, import_node_path16.join)((0, import_node_os5.homedir)(), ".claude", "settings.json");
+  return (0, import_node_path17.join)((0, import_node_os5.homedir)(), ".claude", "settings.json");
 }
 function normalizeClaude(raw) {
   if (!raw || typeof raw !== "object") return {};
@@ -3444,7 +3576,7 @@ function normalizeClaude(raw) {
   const out = {};
   if (typeof source.executablePath === "string") {
     const path = source.executablePath.trim();
-    if (path && (0, import_node_path16.isAbsolute)(path)) out.executablePath = path;
+    if (path && (0, import_node_path17.isAbsolute)(path)) out.executablePath = path;
   }
   if (typeof source.chromeEnabled === "boolean") {
     out.chromeEnabled = source.chromeEnabled;
@@ -3457,13 +3589,13 @@ function normalizeCliExecutable(raw) {
   const out = {};
   if (typeof source.executablePath === "string") {
     const path = source.executablePath.trim();
-    if (path && (0, import_node_path16.isAbsolute)(path)) out.executablePath = path;
+    if (path && (0, import_node_path17.isAbsolute)(path)) out.executablePath = path;
   }
   return out;
 }
 function absoluteExecutablePath(value) {
   const path = value.trim();
-  if (!(0, import_node_path16.isAbsolute)(path)) {
+  if (!(0, import_node_path17.isAbsolute)(path)) {
     throw new Error("Executable path must be absolute. Leave it empty to use the system CLI.");
   }
   return path;
@@ -3474,7 +3606,7 @@ function normalizeBrightsy(raw) {
   const out = {};
   if (typeof source.executablePath === "string") {
     const path = source.executablePath.trim();
-    if (path && (0, import_node_path16.isAbsolute)(path)) out.executablePath = path;
+    if (path && (0, import_node_path17.isAbsolute)(path)) out.executablePath = path;
   }
   if (typeof source.cloudConnectEnabled === "boolean") {
     out.cloudConnectEnabled = source.cloudConnectEnabled;
@@ -3818,10 +3950,10 @@ function normalizeSettings(raw) {
 }
 function readSettingsFile() {
   const path = appSettingsPath();
-  if (!(0, import_node_fs14.existsSync)(path)) return { ...EMPTY_SETTINGS };
+  if (!(0, import_node_fs15.existsSync)(path)) return { ...EMPTY_SETTINGS };
   try {
     chmodOwnerOnly(path);
-    const parsed = JSON.parse((0, import_node_fs14.readFileSync)(path, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs15.readFileSync)(path, "utf8"));
     return normalizeSettings(parsed);
   } catch {
     return { ...EMPTY_SETTINGS };
@@ -4744,14 +4876,14 @@ function childEnvWithAppSettings(extra) {
 function harnessEnvKey(harness) {
   return HARNESS_ENV_KEYS[harness];
 }
-var import_node_crypto3, import_node_fs14, import_node_os5, import_node_path16, HARNESS_ENV_KEYS, DEFAULT_AGENTS, GITHUB_GIT_AUTH_MODES, FOLLOW_UP_BEHAVIORS, CLOUD_CONNECT_AGENTS, ISSUE_SOURCES, GIT_AUTH_MODES, EMPTY_SETTINGS, CONFIRM_ACCOUNT, CONFIRM_PROJECT, DEFAULT_CLI_BIN;
+var import_node_crypto3, import_node_fs15, import_node_os5, import_node_path17, HARNESS_ENV_KEYS, DEFAULT_AGENTS, GITHUB_GIT_AUTH_MODES, FOLLOW_UP_BEHAVIORS, CLOUD_CONNECT_AGENTS, ISSUE_SOURCES, GIT_AUTH_MODES, EMPTY_SETTINGS, CONFIRM_ACCOUNT, CONFIRM_PROJECT, DEFAULT_CLI_BIN;
 var init_app_settings = __esm({
   "src/store/app-settings.ts"() {
     "use strict";
     import_node_crypto3 = require("crypto");
-    import_node_fs14 = require("fs");
+    import_node_fs15 = require("fs");
     import_node_os5 = require("os");
-    import_node_path16 = require("path");
+    import_node_path17 = require("path");
     init_orchestrator_capable();
     init_thinking_effort();
     init_nested_electron_env();
@@ -4917,7 +5049,7 @@ async function warmGithubAgentAuth(opts) {
 }
 function normalizeWritableRoot(raw) {
   const trimmed = raw.trim().replace(/\/+$/, "");
-  return trimmed && (0, import_node_path17.isAbsolute)(trimmed) ? trimmed : null;
+  return trimmed && (0, import_node_path18.isAbsolute)(trimmed) ? trimmed : null;
 }
 async function resolveCodexGitWritableRoots(cwd) {
   const roots = /* @__PURE__ */ new Set();
@@ -4995,11 +5127,11 @@ function formatGitAuthModeDirective(mode) {
       ].join("\n");
   }
 }
-var import_node_path17, HTTPS_REWRITE, TOKEN_TTL_MS, tokenMemo, GITHUB_CHILD_TOKEN_KEYS;
+var import_node_path18, HTTPS_REWRITE, TOKEN_TTL_MS, tokenMemo, GITHUB_CHILD_TOKEN_KEYS;
 var init_git_auth_mode = __esm({
   "src/git/git-auth-mode.ts"() {
     "use strict";
-    import_node_path17 = require("path");
+    import_node_path18 = require("path");
     init_app_settings();
     init_github_agent_auth();
     init_run();
@@ -5823,7 +5955,7 @@ async function resolveRepoRoot(cwd) {
 }
 function canonicalizeRepoPath(path) {
   try {
-    return (0, import_node_fs15.realpathSync)(path);
+    return (0, import_node_fs16.realpathSync)(path);
   } catch {
     return path.replace(/\/+$/, "");
   }
@@ -6667,8 +6799,8 @@ async function refreshOriginAndMaybeFastForwardMain(repoPath, sourceRef) {
 }
 async function createThreadWorktree(opts) {
   let branchName = `thread/${opts.slug}`;
-  const worktreePath = (0, import_node_path18.join)(worktreesRoot(opts.repoPath), opts.slug);
-  if ((0, import_node_fs15.existsSync)(worktreePath)) {
+  const worktreePath = (0, import_node_path19.join)(worktreesRoot(opts.repoPath), opts.slug);
+  if ((0, import_node_fs16.existsSync)(worktreePath)) {
     throw new Error(`Worktree already exists at ${worktreePath}`);
   }
   await ensureGhPreferOrigin(opts.repoPath);
@@ -6709,8 +6841,8 @@ ${add.stdout}`;
 async function createExistingBranchWorktree(opts) {
   const branchName = opts.branchName.trim();
   if (!branchName) throw new Error("branch name required");
-  const worktreePath = (0, import_node_path18.join)(worktreesRoot(opts.repoPath), opts.slug);
-  if ((0, import_node_fs15.existsSync)(worktreePath)) {
+  const worktreePath = (0, import_node_path19.join)(worktreesRoot(opts.repoPath), opts.slug);
+  if ((0, import_node_fs16.existsSync)(worktreePath)) {
     throw new Error(`Worktree already exists at ${worktreePath}`);
   }
   await ensureGhPreferOrigin(opts.repoPath);
@@ -6991,11 +7123,11 @@ async function createOrUpdatePr(worktreePath, opts) {
   const headRef = ghHeadRef(slug, opts.head);
   const branchOnly = opts.head.trim().replace(/^refs\/heads\//, "");
   const bodyText = clampGithubPrBody(opts.body ?? opts.title);
-  const bodyFile = (0, import_node_path18.join)(
+  const bodyFile = (0, import_node_path19.join)(
     (0, import_node_os6.tmpdir)(),
     `sideboard-pr-body-${process.pid}-${(0, import_node_crypto4.randomBytes)(6).toString("hex")}.md`
   );
-  (0, import_node_fs15.writeFileSync)(bodyFile, bodyText.endsWith("\n") ? bodyText : `${bodyText}
+  (0, import_node_fs16.writeFileSync)(bodyFile, bodyText.endsWith("\n") ? bodyText : `${bodyText}
 `, "utf8");
   const bodyArgs = ["--body-file", bodyFile];
   try {
@@ -7009,7 +7141,7 @@ async function createOrUpdatePr(worktreePath, opts) {
     });
   } finally {
     try {
-      (0, import_node_fs15.unlinkSync)(bodyFile);
+      (0, import_node_fs16.unlinkSync)(bodyFile);
     } catch {
     }
   }
@@ -7091,10 +7223,10 @@ function sameRepoPath(a, b) {
   return normalizeWorktreePath(a) === normalizeWorktreePath(b);
 }
 function listLocalThreadBranchSlugs(repoPath) {
-  const refsDir = (0, import_node_path18.join)(repoPath, ".git", "refs", "heads", "thread");
-  if (!(0, import_node_fs15.existsSync)(refsDir)) return [];
+  const refsDir = (0, import_node_path19.join)(repoPath, ".git", "refs", "heads", "thread");
+  if (!(0, import_node_fs16.existsSync)(refsDir)) return [];
   try {
-    return (0, import_node_fs15.readdirSync)(refsDir).filter((name) => !name.startsWith(".")).map((name) => normalizeTakenSlug(name));
+    return (0, import_node_fs16.readdirSync)(refsDir).filter((name) => !name.startsWith(".")).map((name) => normalizeTakenSlug(name));
   } catch {
     return [];
   }
@@ -7102,8 +7234,8 @@ function listLocalThreadBranchSlugs(repoPath) {
 function collectTakenTeamSlugs(repoPath) {
   const taken = /* @__PURE__ */ new Set();
   const root = worktreesRoot(repoPath);
-  if ((0, import_node_fs15.existsSync)(root)) {
-    for (const entry of (0, import_node_fs15.readdirSync)(root, { withFileTypes: true })) {
+  if ((0, import_node_fs16.existsSync)(root)) {
+    for (const entry of (0, import_node_fs16.readdirSync)(root, { withFileTypes: true })) {
       if (entry.isDirectory() && entry.name !== ".DS_Store") {
         for (const slug of takenSlugsFromThread({ worktreePath: entry.name })) {
           taken.add(slug);
@@ -7128,20 +7260,20 @@ function allocateTeamSlug(repoPath) {
   const taken = collectTakenTeamSlugs(repoPath);
   for (let attempt = 0; attempt < 32; attempt++) {
     const team = allocateTeamName(taken);
-    const path = (0, import_node_path18.join)(worktreesRoot(repoPath), team.slug);
-    if (!(0, import_node_fs15.existsSync)(path)) return team;
+    const path = (0, import_node_path19.join)(worktreesRoot(repoPath), team.slug);
+    if (!(0, import_node_fs16.existsSync)(path)) return team;
     taken.add(team.slug);
   }
   throw new Error("No available soccer team worktree directories left");
 }
-var import_node_crypto4, import_node_fs15, import_node_os6, import_node_path18, PR_DETAILS_JSON_FIELDS;
+var import_node_crypto4, import_node_fs16, import_node_os6, import_node_path19, PR_DETAILS_JSON_FIELDS;
 var init_worktree = __esm({
   "src/git/worktree.ts"() {
     "use strict";
     import_node_crypto4 = require("crypto");
-    import_node_fs15 = require("fs");
+    import_node_fs16 = require("fs");
     import_node_os6 = require("os");
-    import_node_path18 = require("path");
+    import_node_path19 = require("path");
     init_paths();
     init_thread_store();
     init_teams();
@@ -7213,7 +7345,7 @@ var init_cloud_connect_constants = __esm({
 
 // src/composer/stage-files.ts
 function fileExtension(filePath) {
-  const base = (0, import_node_path19.basename)(filePath).toLowerCase();
+  const base = (0, import_node_path20.basename)(filePath).toLowerCase();
   return base.includes(".") ? base.split(".").pop() || "" : "";
 }
 function isImageFilePath(filePath) {
@@ -7223,22 +7355,22 @@ function imageMimeType(filePath) {
   return IMAGE_MIME_BY_EXT[fileExtension(filePath)] || "image/png";
 }
 function ensureAttachmentsDir(worktreePath) {
-  const dir = (0, import_node_path19.join)(worktreePath, ATTACHMENTS_DIR);
-  (0, import_node_fs16.mkdirSync)(dir, { recursive: true });
-  const gi = (0, import_node_path19.join)(dir, ".gitignore");
-  if (!(0, import_node_fs16.existsSync)(gi)) {
-    (0, import_node_fs16.writeFileSync)(gi, attachmentsGitignoreBody(), "utf8");
+  const dir = (0, import_node_path20.join)(worktreePath, ATTACHMENTS_DIR);
+  (0, import_node_fs17.mkdirSync)(dir, { recursive: true });
+  const gi = (0, import_node_path20.join)(dir, ".gitignore");
+  if (!(0, import_node_fs17.existsSync)(gi)) {
+    (0, import_node_fs17.writeFileSync)(gi, attachmentsGitignoreBody(), "utf8");
   }
   return dir;
 }
 function uniqueAttachmentName(dir, originalName) {
   const safe = originalName.replace(/[/\\]/g, "_") || "file";
-  if (!(0, import_node_fs16.existsSync)((0, import_node_path19.join)(dir, safe))) return safe;
-  const ext = (0, import_node_path19.extname)(safe);
+  if (!(0, import_node_fs17.existsSync)((0, import_node_path20.join)(dir, safe))) return safe;
+  const ext = (0, import_node_path20.extname)(safe);
   const stem = ext ? safe.slice(0, -ext.length) : safe;
   for (let i = 1; i < 1e4; i++) {
     const candidate = `${stem}-${i}${ext}`;
-    if (!(0, import_node_fs16.existsSync)((0, import_node_path19.join)(dir, candidate))) return candidate;
+    if (!(0, import_node_fs17.existsSync)((0, import_node_path20.join)(dir, candidate))) return candidate;
   }
   return `${stem}-${(0, import_node_crypto5.randomUUID)()}${ext}`;
 }
@@ -7294,15 +7426,15 @@ function stageAbsolutePathsAsAttachments(worktreePath, absolutePaths) {
   const dir = ensureAttachmentsDir(worktreePath);
   const out = [];
   for (const abs of absolutePaths) {
-    const originalName = (0, import_node_path19.basename)(abs);
+    const originalName = (0, import_node_path20.basename)(abs);
     try {
-      const st = (0, import_node_fs16.statSync)(abs);
+      const st = (0, import_node_fs17.statSync)(abs);
       if (!st.isFile()) continue;
       const name = uniqueAttachmentName(dir, originalName);
-      const destAbs = (0, import_node_path19.join)(dir, name);
-      (0, import_node_fs16.copyFileSync)(abs, destAbs);
+      const destAbs = (0, import_node_path20.join)(dir, name);
+      (0, import_node_fs17.copyFileSync)(abs, destAbs);
       const rel = `${ATTACHMENTS_DIR}/${name}`;
-      const buf = (0, import_node_fs16.readFileSync)(destAbs);
+      const buf = (0, import_node_fs17.readFileSync)(destAbs);
       out.push(attachmentFromBuffer(name, buf, { path: rel, sourceLabel: abs }));
     } catch (err) {
       out.push({
@@ -7324,8 +7456,8 @@ function stageBuffersAsAttachments(worktreePath, buffers2) {
     try {
       const buf = Buffer.from(item.dataBase64, "base64");
       const name = uniqueAttachmentName(dir, originalName);
-      const destAbs = (0, import_node_path19.join)(dir, name);
-      (0, import_node_fs16.writeFileSync)(destAbs, buf);
+      const destAbs = (0, import_node_path20.join)(dir, name);
+      (0, import_node_fs17.writeFileSync)(destAbs, buf);
       const rel = `${ATTACHMENTS_DIR}/${name}`;
       out.push(attachmentFromBuffer(name, buf, { path: rel }));
     } catch (err) {
@@ -7386,18 +7518,18 @@ function attachmentsFromWorktreePaths(worktreePath, relativePaths) {
     if (!rel || rel.includes("..") || rel.startsWith("/")) {
       out.push({
         id: (0, import_node_crypto5.randomUUID)(),
-        name: (0, import_node_path19.basename)(rel) || "file",
+        name: (0, import_node_path20.basename)(rel) || "file",
         kind: "file",
         content: `(invalid path: ${rel})`
       });
       continue;
     }
-    const name = (0, import_node_path19.basename)(rel);
+    const name = (0, import_node_path20.basename)(rel);
     try {
-      const abs = (0, import_node_path19.join)(worktreePath, rel);
-      const st = (0, import_node_fs16.statSync)(abs);
+      const abs = (0, import_node_path20.join)(worktreePath, rel);
+      const st = (0, import_node_fs17.statSync)(abs);
       if (!st.isFile()) continue;
-      const buf = (0, import_node_fs16.readFileSync)(abs);
+      const buf = (0, import_node_fs17.readFileSync)(abs);
       out.push(attachmentFromBuffer(name, buf, { path: rel, sourceLabel: abs }));
     } catch (err) {
       out.push({
@@ -7410,12 +7542,12 @@ function attachmentsFromWorktreePaths(worktreePath, relativePaths) {
   }
   return out;
 }
-var import_node_fs16, import_node_path19, import_node_crypto5, IMAGE_EXTENSIONS, IMAGE_MIME_BY_EXT, MAX_INLINE_BYTES, MAX_PREVIEW_BYTES, IMAGE_HINT_RE, PLACEHOLDER_CONTENT_RE;
+var import_node_fs17, import_node_path20, import_node_crypto5, IMAGE_EXTENSIONS, IMAGE_MIME_BY_EXT, MAX_INLINE_BYTES, MAX_PREVIEW_BYTES, IMAGE_HINT_RE, PLACEHOLDER_CONTENT_RE;
 var init_stage_files = __esm({
   "src/composer/stage-files.ts"() {
     "use strict";
-    import_node_fs16 = require("fs");
-    import_node_path19 = require("path");
+    import_node_fs17 = require("fs");
+    import_node_path20 = require("path");
     import_node_crypto5 = require("crypto");
     init_workspace_scratch();
     IMAGE_EXTENSIONS = /* @__PURE__ */ new Set([
@@ -7455,38 +7587,38 @@ __export(workspaces_exports, {
   syncWorkspacesFromThreads: () => syncWorkspacesFromThreads
 });
 function workspacesFile() {
-  return (0, import_node_path20.join)(appDataDir(), "workspaces.json");
+  return (0, import_node_path21.join)(appDataDir(), "workspaces.json");
 }
 function removedWorkspacesFile() {
-  return (0, import_node_path20.join)(appDataDir(), "removed-workspaces.json");
+  return (0, import_node_path21.join)(appDataDir(), "removed-workspaces.json");
 }
 function readAll() {
   const path = workspacesFile();
-  if (!(0, import_node_fs17.existsSync)(path)) return [];
+  if (!(0, import_node_fs18.existsSync)(path)) return [];
   try {
-    const raw = JSON.parse((0, import_node_fs17.readFileSync)(path, "utf8"));
+    const raw = JSON.parse((0, import_node_fs18.readFileSync)(path, "utf8"));
     return Array.isArray(raw) ? raw : [];
   } catch {
     return [];
   }
 }
 function writeAll(list) {
-  (0, import_node_fs17.mkdirSync)(appDataDir(), { recursive: true });
-  (0, import_node_fs17.writeFileSync)(workspacesFile(), JSON.stringify(list, null, 2), "utf8");
+  (0, import_node_fs18.mkdirSync)(appDataDir(), { recursive: true });
+  (0, import_node_fs18.writeFileSync)(workspacesFile(), JSON.stringify(list, null, 2), "utf8");
 }
 function readRemoved() {
   const path = removedWorkspacesFile();
-  if (!(0, import_node_fs17.existsSync)(path)) return /* @__PURE__ */ new Set();
+  if (!(0, import_node_fs18.existsSync)(path)) return /* @__PURE__ */ new Set();
   try {
-    const raw = JSON.parse((0, import_node_fs17.readFileSync)(path, "utf8"));
+    const raw = JSON.parse((0, import_node_fs18.readFileSync)(path, "utf8"));
     return new Set(Array.isArray(raw) ? raw.filter((p) => typeof p === "string") : []);
   } catch {
     return /* @__PURE__ */ new Set();
   }
 }
 function writeRemoved(paths) {
-  (0, import_node_fs17.mkdirSync)(appDataDir(), { recursive: true });
-  (0, import_node_fs17.writeFileSync)(removedWorkspacesFile(), JSON.stringify([...paths].sort(), null, 2), "utf8");
+  (0, import_node_fs18.mkdirSync)(appDataDir(), { recursive: true });
+  (0, import_node_fs18.writeFileSync)(removedWorkspacesFile(), JSON.stringify([...paths].sort(), null, 2), "utf8");
 }
 function rememberRemoved(repoPath) {
   const next = readRemoved();
@@ -7509,7 +7641,7 @@ function listWorkspaces() {
 async function addWorkspace(repoPath) {
   const root = await resolveRepoRoot(repoPath);
   if (!root || root === "/") throw new Error(`Invalid repo path: ${repoPath}`);
-  if (!(0, import_node_fs17.existsSync)(root)) throw new Error(`Repo not found: ${root}`);
+  if (!(0, import_node_fs18.existsSync)(root)) throw new Error(`Repo not found: ${root}`);
   forgetRemoved(root);
   await ensureGhPreferOrigin(root);
   const current = readAll();
@@ -7517,7 +7649,7 @@ async function addWorkspace(repoPath) {
   if (existing) return existing;
   const next = {
     path: root,
-    name: (0, import_node_path20.basename)(root),
+    name: (0, import_node_path21.basename)(root),
     addedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   writeAll([...current, next]);
@@ -7539,10 +7671,10 @@ function syncWorkspacesFromThreads(repoPaths) {
     if (!path || path === "/" || isGlobalRepoPath(path) || byPath.has(path) || removed.has(path)) {
       continue;
     }
-    if (!(0, import_node_fs17.existsSync)(path)) continue;
+    if (!(0, import_node_fs18.existsSync)(path)) continue;
     const ws = {
       path,
-      name: (0, import_node_path20.basename)(path),
+      name: (0, import_node_path21.basename)(path),
       addedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     byPath.set(path, ws);
@@ -7552,12 +7684,12 @@ function syncWorkspacesFromThreads(repoPaths) {
   if (dirty) writeAll(next);
   return next.sort((a, b) => a.name.localeCompare(b.name));
 }
-var import_node_fs17, import_node_path20;
+var import_node_fs18, import_node_path21;
 var init_workspaces2 = __esm({
   "src/store/workspaces.ts"() {
     "use strict";
-    import_node_fs17 = require("fs");
-    import_node_path20 = require("path");
+    import_node_fs18 = require("fs");
+    import_node_path21 = require("path");
     init_paths();
     init_global_workspace();
     init_worktree();
@@ -7668,7 +7800,7 @@ function coordinatorTurnReminder(opts) {
 function ensureGlobalCoordinatorCwd(opts) {
   const dir = globalAgentCwd();
   try {
-    (0, import_node_fs18.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs19.mkdirSync)(dir, { recursive: true });
   } catch {
     return dir;
   }
@@ -7676,7 +7808,7 @@ function ensureGlobalCoordinatorCwd(opts) {
   let orchId = opts?.orchestratorThreadId?.trim() || "";
   if (!orchId) {
     try {
-      const existing = (0, import_node_fs18.readFileSync)((0, import_node_path21.join)(dir, "AGENTS.md"), "utf8");
+      const existing = (0, import_node_fs19.readFileSync)((0, import_node_path22.join)(dir, "AGENTS.md"), "utf8");
       const m = existing.match(
         /YOUR orchestration thread id is `([0-9a-f-]{36})`/i
       );
@@ -7711,8 +7843,8 @@ function ensureGlobalCoordinatorCwd(opts) {
     "",
     "When creating threads, pass `repoPath` from `list_workspaces` (or the path you just registered).",
     orchId ? `Pass parentThreadId="${orchId}" (or omit it). Never invent another parentThreadId.` : "Pass `parentThreadId` for children (this chat's id from the turn reminder).",
-    "Omit `agent` / `model` on `create_thread` unless you have a reason to override Account defaults.",
-    "Never pass `agent=codex` when you yourself are Codex \u2014 nested Codex deadlocks on shared ~/.codex locks. Omit agent (Account default) or use cursor/claude.",
+    "Omit `agent` / `model` on `create_thread`. Sideboard applies Settings \u2192 Default agent, model & effort. Do not pass your own agent or `agent=cursor` \u2014 those are ignored.",
+    "Never pass `agent=codex` when you yourself are Codex \u2014 nested Codex can deadlock on shared ~/.codex locks. Omit agent; Sideboard applies Account defaults, and switches that nested-Codex case to Cursor only when a CURSOR_API_KEY is configured.",
     "Typical flow (Home board): list_board \u2192 create_thread (sourceType=ticket|pr|branch) \u2192 send_to_thread \u2192 wait_for_turn (loop while stillRunning) \u2192 ask_git create-draft \u2192 wait_for_turn. Merge only if the user explicitly asked (`ask_git` merge).",
     "Typical flow (branch / explicit source): list_workspaces \u2192 list_branches|list_prs|list_issues \u2192 create_thread \u2192 send_to_thread \u2192 wait_for_turn (loop while stillRunning) \u2192 ask_git create-draft.",
     "Typical flow (find work): list_workspaces \u2192 pick repo(s) matching account / project context \u2192 Sideboard list_issues / linear_* (tickets) or list_prs(queue=review) (reviews) \u2192 show the options. Never wait on Claude Linear MCP. Only create_thread + send_to_thread when they asked to start (e.g. \u201Cfind me work and start it\u201D) \u2014 then wait_for_turn (loop while stillRunning) \u2192 ask_git create-draft.",
@@ -7721,9 +7853,9 @@ function ensureGlobalCoordinatorCwd(opts) {
     "Always ask worktree agents to commit, push, and open draft PRs (`ask_git` / `send_to_thread`). If the user gave a goal (Greptile 5/5, CI green), pass that goal through so they watch-fix-push until it lands \u2014 do not start that loop on a plain push, and do not tell the human to poll. Tell them to merge only when the user explicitly asked. The worktree agent runs git/gh; never merge from this orchestration cwd."
   ].join("\n");
   try {
-    (0, import_node_fs18.writeFileSync)((0, import_node_path21.join)(dir, "CLAUDE.md"), `${body}
+    (0, import_node_fs19.writeFileSync)((0, import_node_path22.join)(dir, "CLAUDE.md"), `${body}
 `, "utf8");
-    (0, import_node_fs18.writeFileSync)((0, import_node_path21.join)(dir, "AGENTS.md"), `${body}
+    (0, import_node_fs19.writeFileSync)((0, import_node_path22.join)(dir, "AGENTS.md"), `${body}
 `, "utf8");
   } catch {
   }
@@ -7755,12 +7887,12 @@ function coordinatorSystemPrompt(opts) {
     formatWorkspaceInventory(opts.workspaces)
   ].join("\n");
 }
-var import_node_fs18, import_node_path21, COORDINATOR_TOOL_PLAYBOOK, SLACK_REPLY_FORMATTING;
+var import_node_fs19, import_node_path22, COORDINATOR_TOOL_PLAYBOOK, SLACK_REPLY_FORMATTING;
 var init_coordinator_prompt = __esm({
   "src/orchestrator/coordinator-prompt.ts"() {
     "use strict";
-    import_node_fs18 = require("fs");
-    import_node_path21 = require("path");
+    import_node_fs19 = require("fs");
+    import_node_path22 = require("path");
     init_worktree();
     init_app_settings();
     init_paths();
@@ -7789,7 +7921,7 @@ var init_coordinator_prompt = __esm({
       "Workspaces:",
       "- add_workspace / remove_workspace \u2014 register or unregister a git repo",
       "Worktree threads (chats):",
-      "- create_thread \u2014 create a worktree + chat from branch | pr | ticket (appears on Home). Do not create a second worktree for a ticket, PR, or named branch that already has one \u2014 that call returns the live thread (alreadyStarted=true). Creating from the default branch still opens a new isolated worktree. Pass repoPath + parentThreadId; omit agent and model to use Sideboard Account defaults (Settings \u2192 Default agent, model & effort). If the repo has a setup script, Sideboard runs it in the background (does not block send_to_thread). If you are Codex, do not set agent=codex (nested Codex deadlocks)",
+      "- create_thread \u2014 create a worktree + chat from branch | pr | ticket (appears on Home). Do not create a second worktree for a ticket, PR, or named branch that already has one \u2014 that call returns the live thread (alreadyStarted=true). Creating from the default branch still opens a new isolated worktree. Pass repoPath + parentThreadId; omit agent and model so Sideboard applies Settings \u2192 Default agent, model & effort (never pass your own agent or agent=cursor). If the repo has a setup script, Sideboard runs it in the background (does not block send_to_thread). Nested Codex (you are Codex and the child would be Codex) can deadlock on ~/.codex locks \u2014 omit agent; Sideboard switches the child to Cursor when a CURSOR_API_KEY is set, otherwise keeps the Account default",
       "- start_board_card \u2014 same as create_thread for a ticket/PR/named branch (attaches issue text when resolvable). Then send_to_thread.",
       "- fork_worktree \u2014 fork a worktree chat into a NEW git worktree + chat (transcript attached); optional agent; leave model unset (Auto) unless you have a reason. Not for orchestration chats.",
       "- fork_chat \u2014 fork a worktree chat (same worktree tab) OR a Global orchestration chat (new orchestration tab); optional agent; leave model unset (Auto) unless you have a reason. Remote coordinators: use this to continue another orchestration chat on a different agent after session limits.",
@@ -7804,9 +7936,9 @@ var init_coordinator_prompt = __esm({
       "- get_diff \u2014 compact diff summary",
       "- get_pr_checks \u2014 snapshot of a worktree thread's PR checks (null = no PR). Use this to inspect status. If the user gave a goal, the worktree agent watches with `gh pr checks --watch` \u2014 do not poll for the human.",
       '- request_review \u2014 open a Review chat tab on a worktree thread (attaches .claude/skills/review/SKILL.md when present, else .context/review.md copied from .sideboard/review.md / stock; sends "Review changes in this workspace."); then wait_for_turn (loop while stillRunning) / get_turn_result on the returned id',
-      "- ask_git \u2014 commit & push, open a draft PR, resolve conflicts, or merge. When the worktree is clean, Sideboard pushes / opens the PR itself. When dirty, it queues the worktree agent \u2014 then wait_for_turn (loop while stillRunning). Prefer this over paraphrasing. If ask_git / get_thread lastError says the GraphQL/PR body is too long, the branch is already pushed \u2014 send_to_thread so the worktree agent runs `gh pr create --body-file` with a short description. Do not invent SSH or auth failures from that error. If the user gave a goal (Greptile 5/5, CI green), send_to_thread that goal so the worktree agent enters the watch-fix-push loop \u2014 do not tell the human to poll.",
+      "- ask_git \u2014 commit & push, open a draft PR, mark ready for review, resolve conflicts, or merge. When the worktree is clean, Sideboard pushes / opens the PR itself. When dirty, it queues the worktree agent \u2014 then wait_for_turn (loop while stillRunning). Prefer this over paraphrasing. If ask_git / get_thread lastError says the GraphQL/PR body is too long, the branch is already pushed \u2014 send_to_thread so the worktree agent runs `gh pr create --body-file` with a short description. Do not invent SSH or auth failures from that error. If the user gave a goal (Greptile 5/5, CI green), send_to_thread that goal so the worktree agent enters the watch-fix-push loop \u2014 do not tell the human to poll.",
       '- Merge (`ask_git` action=merge / send_to_thread "Merge PR.") only when the user explicitly asked to merge that PR. Do not merge because the work looks done, CI is green, or a typical flow includes it.',
-      '- Or send_to_thread with those exact phrases: "Commit and push.", "Commit, push, and open a draft PR.", "Merge the remote branch (main) into your branch and resolve conflicts. Then, commit and push your changes.", "Merge PR." (draft PRs: `gh pr create --draft -R <origin-owner/name>` using the workspace `github:` slug \u2014 never upstream). Never run git/gh from this orchestration cwd, and never merge the PR yourself.',
+      '- Or send_to_thread with those exact phrases: "Commit and push.", "Commit, push, and open a draft PR.", "Ready for review.", "Merge the remote branch (main) into your branch and resolve conflicts. Then, commit and push your changes.", "Merge PR." (draft PRs: `gh pr create --draft -R <origin-owner/name>` using the workspace `github:` slug \u2014 never upstream). Never run git/gh from this orchestration cwd, and never merge the PR yourself.',
       "Process guides:",
       "- Long child jobs (pack, test, deploy, anything that may run more than ~30s): workers always have `/long-running` (Sideboard product skill). Tell them to detach and wait; they may `stop_job` if it hangs or is doing the wrong thing; do not ask the human to poll.",
       "- Recurring multi-item / fan-out: if the child worktree has `.claude/skills/graph-engineering/SKILL.md`, tell the worker to follow it (`/graph-engineering`). Judge first; state on disk; grow the rulebook; do not patch three threads.",
@@ -8075,32 +8207,32 @@ var init_global_workspace = __esm({
 function brightsyConfigPath() {
   const override = process.env.BRIGHTSY_CONFIG?.trim();
   if (override) return override;
-  return (0, import_node_path22.join)((0, import_node_os7.homedir)(), ".brightsy", "config.json");
+  return (0, import_node_path23.join)((0, import_node_os7.homedir)(), ".brightsy", "config.json");
 }
 function loadBrightsyConfig() {
   const path = brightsyConfigPath();
-  if (!(0, import_node_fs19.existsSync)(path)) {
+  if (!(0, import_node_fs20.existsSync)(path)) {
     throw new Error("Brightsy not logged in \u2014 run `brightsy login` first");
   }
-  const raw = JSON.parse((0, import_node_fs19.readFileSync)(path, "utf8"));
+  const raw = JSON.parse((0, import_node_fs20.readFileSync)(path, "utf8"));
   if (!raw.access_token || !raw.account_id) {
     throw new Error("Brightsy config incomplete \u2014 run `brightsy login`");
   }
   return raw;
 }
 function saveBrightsyConfig(cfg) {
-  (0, import_node_fs19.writeFileSync)(brightsyConfigPath(), `${JSON.stringify(cfg, null, 2)}
+  (0, import_node_fs20.writeFileSync)(brightsyConfigPath(), `${JSON.stringify(cfg, null, 2)}
 `, {
     mode: 384
   });
 }
-var import_node_fs19, import_node_os7, import_node_path22;
+var import_node_fs20, import_node_os7, import_node_path23;
 var init_config = __esm({
   "src/brightsy/config.ts"() {
     "use strict";
-    import_node_fs19 = require("fs");
+    import_node_fs20 = require("fs");
     import_node_os7 = require("os");
-    import_node_path22 = require("path");
+    import_node_path23 = require("path");
   }
 });
 
@@ -8114,17 +8246,24 @@ var init_accounts = __esm({
 });
 
 // src/http/fetch.ts
+function tlsIssuerHint(code, message) {
+  const text7 = `${code ?? ""} ${message}`;
+  return TLS_ISSUER_RE.test(text7) ? TLS_ISSUER_HINT : "";
+}
 function formatFetchError(err, url) {
   if (!(err instanceof Error)) return `${String(err)} (${url})`;
   const cause = err.cause;
   let detail = "";
+  let hint = tlsIssuerHint(void 0, err.message);
   if (cause instanceof Error) {
     const code = typeof cause.code === "string" ? cause.code : void 0;
     detail = code ? ` [${code}: ${cause.message}]` : ` [${cause.message}]`;
+    hint = tlsIssuerHint(code, `${err.message} ${cause.message}`) || hint;
   } else if (cause != null) {
     detail = ` [${String(cause)}]`;
+    hint = tlsIssuerHint(void 0, String(cause)) || hint;
   }
-  return `${err.message}${detail} (${url})`;
+  return `${err.message}${detail} (${url})${hint}`;
 }
 async function httpFetch(input, init) {
   const url = typeof input === "string" ? input : input.href;
@@ -8135,11 +8274,13 @@ async function httpFetch(input, init) {
     throw new Error(formatFetchError(err, url));
   }
 }
-var injected;
+var injected, TLS_ISSUER_RE, TLS_ISSUER_HINT;
 var init_fetch = __esm({
   "src/http/fetch.ts"() {
     "use strict";
     injected = null;
+    TLS_ISSUER_RE = /UNABLE_TO_GET_ISSUER_CERT|UNABLE_TO_VERIFY_LEAF_SIGNATURE|SELF_SIGNED_CERT_IN_CHAIN/i;
+    TLS_ISSUER_HINT = " \u2014 Node rejected the TLS certificate (corporate VPN/proxy CA). Desktop Linear can still work; reconnecting the API key will not fix this.";
   }
 });
 
@@ -8217,22 +8358,22 @@ var init_oauth = __esm({
 
 // src/brightsy/connected-teams.ts
 function storePath4() {
-  return (0, import_node_path23.join)(appDataDir(), "brightsy-teams.json");
+  return (0, import_node_path24.join)(appDataDir(), "brightsy-teams.json");
 }
 function readStore4() {
   const path = storePath4();
-  if (!(0, import_node_fs20.existsSync)(path)) return [];
+  if (!(0, import_node_fs21.existsSync)(path)) return [];
   try {
-    const parsed = JSON.parse((0, import_node_fs20.readFileSync)(path, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs21.readFileSync)(path, "utf8"));
     return Array.isArray(parsed.teams) ? parsed.teams : [];
   } catch {
     return [];
   }
 }
 function writeStore2(teams) {
-  (0, import_node_fs20.mkdirSync)(appDataDir(), { recursive: true });
+  (0, import_node_fs21.mkdirSync)(appDataDir(), { recursive: true });
   const path = storePath4();
-  (0, import_node_fs20.writeFileSync)(path, `${JSON.stringify({ teams }, null, 2)}
+  (0, import_node_fs21.writeFileSync)(path, `${JSON.stringify({ teams }, null, 2)}
 `, {
     mode: 384
   });
@@ -8338,12 +8479,12 @@ function brightsyMcpServerName(slug) {
   const cleaned = slug.replace(/[^A-Za-z0-9_-]/g, "_").replace(/^_+|_+$/g, "");
   return `brightsy_${cleaned || "team"}`;
 }
-var import_node_fs20, import_node_path23;
+var import_node_fs21, import_node_path24;
 var init_connected_teams = __esm({
   "src/brightsy/connected-teams.ts"() {
     "use strict";
-    import_node_fs20 = require("fs");
-    import_node_path23 = require("path");
+    import_node_fs21 = require("fs");
+    import_node_path24 = require("path");
     init_paths();
     init_accounts();
     init_config();
@@ -8731,11 +8872,11 @@ async function syncCliForTarget(accountId) {
   }
   applyConnectedTeamToCli(team);
 }
-var import_node_fs21, brightsyAdapter;
+var import_node_fs22, brightsyAdapter;
 var init_brightsy = __esm({
   "src/agents/brightsy.ts"() {
     "use strict";
-    import_node_fs21 = require("fs");
+    import_node_fs22 = require("fs");
     init_run();
     init_connected_teams();
     init_config();
@@ -8750,7 +8891,7 @@ var init_brightsy = __esm({
       async detect() {
         const brightsy = resolveAgentExecutable("brightsy");
         if (brightsy !== "brightsy") {
-          if (!(0, import_node_fs21.existsSync)(brightsy)) {
+          if (!(0, import_node_fs22.existsSync)(brightsy)) {
             return {
               agent: "brightsy",
               installed: false,
@@ -9342,43 +9483,43 @@ function electronResourcesPath() {
 function packagedCursorRuntimeDir() {
   const resources = electronResourcesPath();
   if (!resources) return null;
-  const dir = (0, import_node_path24.join)(resources, "cursor-runtime");
-  if (!(0, import_node_fs22.existsSync)((0, import_node_path24.join)(dir, "core-dist", "agents", "cursor-runner.js"))) return null;
+  const dir = (0, import_node_path25.join)(resources, "cursor-runtime");
+  if (!(0, import_node_fs23.existsSync)((0, import_node_path25.join)(dir, "core-dist", "agents", "cursor-runner.js"))) return null;
   return dir;
 }
 function packagedCursorRunnerPath() {
   const dir = packagedCursorRuntimeDir();
-  return dir ? (0, import_node_path24.join)(dir, "core-dist", "agents", "cursor-runner.js") : null;
+  return dir ? (0, import_node_path25.join)(dir, "core-dist", "agents", "cursor-runner.js") : null;
 }
 function packagedMcpDir() {
   const resources = electronResourcesPath();
   if (!resources) return null;
-  const dir = (0, import_node_path24.join)(resources, "sideboard-mcp");
-  if (!(0, import_node_fs22.existsSync)((0, import_node_path24.join)(dir, "core-dist", "mcp", "run-stdio.js"))) return null;
+  const dir = (0, import_node_path25.join)(resources, "sideboard-mcp");
+  if (!(0, import_node_fs23.existsSync)((0, import_node_path25.join)(dir, "core-dist", "mcp", "run-stdio.js"))) return null;
   return dir;
 }
 function packagedMcpStdioPath() {
   const dir = packagedMcpDir();
-  return dir ? (0, import_node_path24.join)(dir, "core-dist", "mcp", "run-stdio.js") : null;
+  return dir ? (0, import_node_path25.join)(dir, "core-dist", "mcp", "run-stdio.js") : null;
 }
 function packagedBundledNodePath() {
   const resources = electronResourcesPath();
   if (!resources) return null;
-  const bin = (0, import_node_path24.join)(resources, "node", "bin", "node");
-  if (!(0, import_node_fs22.existsSync)(bin)) return null;
+  const bin = (0, import_node_path25.join)(resources, "node", "bin", "node");
+  if (!(0, import_node_fs23.existsSync)(bin)) return null;
   return bin;
 }
 function packagedCursorRipgrepCandidate(platformPkg, binName) {
   const dir = packagedCursorRuntimeDir();
   if (!dir) return null;
-  return (0, import_node_path24.join)(dir, "node_modules", platformPkg, "bin", binName);
+  return (0, import_node_path25.join)(dir, "node_modules", platformPkg, "bin", binName);
 }
-var import_node_fs22, import_node_path24;
+var import_node_fs23, import_node_path25;
 var init_packaged_runtime = __esm({
   "src/agents/packaged-runtime.ts"() {
     "use strict";
-    import_node_fs22 = require("fs");
-    import_node_path24 = require("path");
+    import_node_fs23 = require("fs");
+    import_node_path25 = require("path");
   }
 });
 
@@ -9398,6 +9539,7 @@ function applyAgentRunnerHeapEnv(env) {
     env.NODE_OPTIONS,
     AGENT_RUNNER_MAX_OLD_SPACE_MB
   );
+  applySystemCaEnv(env);
 }
 function envWithAgentHeap(env) {
   const next = { ...env };
@@ -9412,7 +9554,7 @@ function unpackedAsarPath(filePath) {
   if (!isAsarPath(filePath)) return null;
   const unpacked = filePath.replace(/\.asar(?=[/\\])/, ".asar.unpacked");
   if (unpacked === filePath) return null;
-  return (0, import_node_fs23.existsSync)(unpacked) ? unpacked : null;
+  return (0, import_node_fs24.existsSync)(unpacked) ? unpacked : null;
 }
 function nodeReadableScriptPath(scriptPath) {
   return unpackedAsarPath(scriptPath) ?? scriptPath;
@@ -9452,37 +9594,37 @@ function pickPreferredNode(candidates) {
   return best;
 }
 function versionDirNodeBins(root, toBin) {
-  if (!(0, import_node_fs23.existsSync)(root)) return [];
+  if (!(0, import_node_fs24.existsSync)(root)) return [];
   try {
-    return (0, import_node_fs23.readdirSync)(root).map(toBin);
+    return (0, import_node_fs24.readdirSync)(root).map(toBin);
   } catch {
     return [];
   }
 }
 function defaultNodeBinCandidates(home = (0, import_node_os8.homedir)()) {
   const kegs = ["/opt/homebrew", "/usr/local"].flatMap(
-    (prefix) => PREFERRED_LTS_MAJORS.map((major) => (0, import_node_path25.join)(prefix, "opt", `node@${major}`, "bin", "node"))
+    (prefix) => PREFERRED_LTS_MAJORS.map((major) => (0, import_node_path26.join)(prefix, "opt", `node@${major}`, "bin", "node"))
   );
   return [
     ...kegs,
     "/opt/homebrew/bin/node",
     "/usr/local/bin/node",
-    (0, import_node_path25.join)(home, ".local/share/fnm/aliases/default/bin/node"),
-    (0, import_node_path25.join)(home, ".nvm/current/bin/node"),
-    (0, import_node_path25.join)(home, ".volta/bin/node"),
-    (0, import_node_path25.join)(home, ".asdf/shims/node"),
-    (0, import_node_path25.join)(home, ".local/share/mise/shims/node"),
+    (0, import_node_path26.join)(home, ".local/share/fnm/aliases/default/bin/node"),
+    (0, import_node_path26.join)(home, ".nvm/current/bin/node"),
+    (0, import_node_path26.join)(home, ".volta/bin/node"),
+    (0, import_node_path26.join)(home, ".asdf/shims/node"),
+    (0, import_node_path26.join)(home, ".local/share/mise/shims/node"),
     ...versionDirNodeBins(
-      (0, import_node_path25.join)(home, ".nvm", "versions", "node"),
-      (name) => (0, import_node_path25.join)(home, ".nvm", "versions", "node", name, "bin", "node")
+      (0, import_node_path26.join)(home, ".nvm", "versions", "node"),
+      (name) => (0, import_node_path26.join)(home, ".nvm", "versions", "node", name, "bin", "node")
     ),
     ...versionDirNodeBins(
-      (0, import_node_path25.join)(home, ".local/share/fnm", "node-versions"),
-      (name) => (0, import_node_path25.join)(home, ".local/share/fnm", "node-versions", name, "installation", "bin", "node")
+      (0, import_node_path26.join)(home, ".local/share/fnm", "node-versions"),
+      (name) => (0, import_node_path26.join)(home, ".local/share/fnm", "node-versions", name, "installation", "bin", "node")
     ),
     ...versionDirNodeBins(
-      (0, import_node_path25.join)(home, ".volta", "tools", "image", "node"),
-      (name) => (0, import_node_path25.join)(home, ".volta", "tools", "image", "node", name, "bin", "node")
+      (0, import_node_path26.join)(home, ".volta", "tools", "image", "node"),
+      (name) => (0, import_node_path26.join)(home, ".volta", "tools", "image", "node", name, "bin", "node")
     )
   ];
 }
@@ -9491,10 +9633,10 @@ function uniqueExistingNodeBins(paths) {
   const out = [];
   for (const raw of paths) {
     const p = raw.trim();
-    if (!p || !(0, import_node_fs23.existsSync)(p) || isElectronLikeCommand(p)) continue;
+    if (!p || !(0, import_node_fs24.existsSync)(p) || isElectronLikeCommand(p)) continue;
     let key = p;
     try {
-      key = (0, import_node_fs23.realpathSync)(p);
+      key = (0, import_node_fs24.realpathSync)(p);
     } catch {
       continue;
     }
@@ -9574,14 +9716,15 @@ async function resolveNodeLaunch(scriptPath) {
     env: { ELECTRON_RUN_AS_NODE: "1" }
   };
 }
-var import_node_fs23, import_node_os8, import_node_path25, AGENT_RUNNER_MAX_OLD_SPACE_MB, MAX_OLD_SPACE_FLAG, PREFERRED_LTS_MAJORS;
+var import_node_fs24, import_node_os8, import_node_path26, AGENT_RUNNER_MAX_OLD_SPACE_MB, MAX_OLD_SPACE_FLAG, PREFERRED_LTS_MAJORS;
 var init_node_launch = __esm({
   "src/agents/node-launch.ts"() {
     "use strict";
-    import_node_fs23 = require("fs");
+    import_node_fs24 = require("fs");
     import_node_os8 = require("os");
-    import_node_path25 = require("path");
+    import_node_path26 = require("path");
     init_nested_electron_env();
+    init_system_ca();
     init_run();
     init_packaged_runtime();
     AGENT_RUNNER_MAX_OLD_SPACE_MB = 8192;
@@ -9681,37 +9824,37 @@ function corePackageDir() {
   try {
     const url = import_meta.url;
     if (typeof url === "string" && url.length > 0) {
-      return (0, import_node_path26.dirname)((0, import_node_url.fileURLToPath)(url));
+      return (0, import_node_path27.dirname)((0, import_node_url.fileURLToPath)(url));
     }
   } catch {
   }
   try {
-    const req = (0, import_node_module.createRequire)((0, import_node_path26.join)(process.cwd(), "package.json"));
-    return (0, import_node_path26.dirname)(req.resolve("@sideboard-ai/core"));
+    const req = (0, import_node_module.createRequire)((0, import_node_path27.join)(process.cwd(), "package.json"));
+    return (0, import_node_path27.dirname)(req.resolve("@sideboard-ai/core"));
   } catch {
     return process.cwd();
   }
 }
 function findSideboardMcpJsEntry() {
   const override = process.env.SIDEBOARD_MCP_ENTRY?.trim() || process.env.SIDEBOARD_CLI?.trim();
-  if (override && (0, import_node_fs24.existsSync)(override)) return override;
+  if (override && (0, import_node_fs25.existsSync)(override)) return override;
   const packaged = packagedMcpStdioPath();
   if (packaged) return packaged;
   let dir = corePackageDir();
   for (let i = 0; i < 10; i++) {
     const candidates = [
-      (0, import_node_path26.join)(dir, "mcp/run-stdio.js"),
-      (0, import_node_path26.join)(dir, "mcp/run-stdio.cjs"),
-      (0, import_node_path26.join)(dir, "dist/mcp/run-stdio.js"),
-      (0, import_node_path26.join)(dir, "dist/mcp/run-stdio.cjs"),
-      (0, import_node_path26.join)(dir, "packages/core/dist/mcp/run-stdio.js"),
-      (0, import_node_path26.join)(dir, "packages/cli/dist/index.js"),
-      (0, import_node_path26.join)(dir, "cli/dist/index.js")
+      (0, import_node_path27.join)(dir, "mcp/run-stdio.js"),
+      (0, import_node_path27.join)(dir, "mcp/run-stdio.cjs"),
+      (0, import_node_path27.join)(dir, "dist/mcp/run-stdio.js"),
+      (0, import_node_path27.join)(dir, "dist/mcp/run-stdio.cjs"),
+      (0, import_node_path27.join)(dir, "packages/core/dist/mcp/run-stdio.js"),
+      (0, import_node_path27.join)(dir, "packages/cli/dist/index.js"),
+      (0, import_node_path27.join)(dir, "cli/dist/index.js")
     ];
     for (const p of candidates) {
-      if ((0, import_node_fs24.existsSync)(p) && !isAsarPath(p)) return p;
+      if ((0, import_node_fs25.existsSync)(p) && !isAsarPath(p)) return p;
     }
-    const parent = (0, import_node_path26.dirname)(dir);
+    const parent = (0, import_node_path27.dirname)(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -9858,19 +10001,19 @@ function writeMcpServersConfig(servers) {
       ...env ? { env } : {}
     };
   }
-  const dir = (0, import_node_fs24.mkdtempSync)((0, import_node_path26.join)((0, import_node_os9.tmpdir)(), "sideboard-mcp-"));
-  const cfgPath = (0, import_node_path26.join)(dir, "mcp.json");
-  (0, import_node_fs24.writeFileSync)(cfgPath, JSON.stringify({ mcpServers }, null, 2));
+  const dir = (0, import_node_fs25.mkdtempSync)((0, import_node_path27.join)((0, import_node_os9.tmpdir)(), "sideboard-mcp-"));
+  const cfgPath = (0, import_node_path27.join)(dir, "mcp.json");
+  (0, import_node_fs25.writeFileSync)(cfgPath, JSON.stringify({ mcpServers }, null, 2));
   return cfgPath;
 }
-var import_node_fs24, import_node_module, import_node_os9, import_node_path26, import_node_url, import_meta, SIDEBOARD_MCP_ALLOWED_TOOLS, SIDEBOARD_ARTIFACT_MCP_ALLOWED_TOOLS, SIDEBOARD_GITHUB_MCP_ALLOWED_TOOLS, SIDEBOARD_LINEAR_MCP_ALLOWED_TOOLS, SIDEBOARD_ABLETIME_MCP_ALLOWED_TOOLS, brightsyMcpCommandCache, BRIGHTSY_WORD;
+var import_node_fs25, import_node_module, import_node_os9, import_node_path27, import_node_url, import_meta, SIDEBOARD_MCP_ALLOWED_TOOLS, SIDEBOARD_ARTIFACT_MCP_ALLOWED_TOOLS, SIDEBOARD_GITHUB_MCP_ALLOWED_TOOLS, SIDEBOARD_LINEAR_MCP_ALLOWED_TOOLS, SIDEBOARD_ABLETIME_MCP_ALLOWED_TOOLS, brightsyMcpCommandCache, BRIGHTSY_WORD;
 var init_injected_mcp = __esm({
   "src/agents/injected-mcp.ts"() {
     "use strict";
-    import_node_fs24 = require("fs");
+    import_node_fs25 = require("fs");
     import_node_module = require("module");
     import_node_os9 = require("os");
-    import_node_path26 = require("path");
+    import_node_path27 = require("path");
     import_node_url = require("url");
     init_run();
     init_config();
@@ -10253,11 +10396,11 @@ function parseIssuesJson(raw) {
   }
   return [];
 }
-var import_node_fs25, BASE_ALLOWED_TOOLS, CLAUDE_PRINT_BG_WAIT_CEILING_MS, CLAUDE_CHROME_ALLOWED_TOOLS, CLAUDE_PROMPT_ARG_MAX, mcpListCache, claudeAdapter;
+var import_node_fs26, BASE_ALLOWED_TOOLS, CLAUDE_PRINT_BG_WAIT_CEILING_MS, CLAUDE_CHROME_ALLOWED_TOOLS, CLAUDE_PROMPT_ARG_MAX, mcpListCache, claudeAdapter;
 var init_claude = __esm({
   "src/agents/claude.ts"() {
     "use strict";
-    import_node_fs25 = require("fs");
+    import_node_fs26 = require("fs");
     init_run();
     init_app_settings();
     init_claude_mcp();
@@ -10297,7 +10440,7 @@ var init_claude = __esm({
       async detect() {
         const claude = resolveClaudeExecutable();
         if (claude !== "claude") {
-          if (!(0, import_node_fs25.existsSync)(claude)) {
+          if (!(0, import_node_fs26.existsSync)(claude)) {
             return {
               agent: "claude",
               installed: false,
@@ -10556,13 +10699,13 @@ var init_claude = __esm({
 });
 
 // src/agents/user-mcp-config.ts
-var import_node_fs26, import_node_os10, import_node_path27;
+var import_node_fs27, import_node_os10, import_node_path28;
 var init_user_mcp_config = __esm({
   "src/agents/user-mcp-config.ts"() {
     "use strict";
-    import_node_fs26 = require("fs");
+    import_node_fs27 = require("fs");
     import_node_os10 = require("os");
-    import_node_path27 = require("path");
+    import_node_path28 = require("path");
     init_paths();
     init_injected_mcp();
   }
@@ -10590,25 +10733,25 @@ function listMcpNamesFromCodexToml(text7) {
 }
 function readJsonObject(path) {
   try {
-    return JSON.parse((0, import_node_fs27.readFileSync)(path, "utf8"));
+    return JSON.parse((0, import_node_fs28.readFileSync)(path, "utf8"));
   } catch {
     return {};
   }
 }
 function readText(path) {
   try {
-    return (0, import_node_fs27.readFileSync)(path, "utf8");
+    return (0, import_node_fs28.readFileSync)(path, "utf8");
   } catch {
     return "";
   }
 }
 function userCodexConfigPaths(home = (0, import_node_os11.homedir)()) {
-  return [(0, import_node_path28.join)(home, ".codex", "config.toml"), (0, import_node_path28.join)(home, ".config", "codex", "config.toml")];
+  return [(0, import_node_path29.join)(home, ".codex", "config.toml"), (0, import_node_path29.join)(home, ".config", "codex", "config.toml")];
 }
 function userOpencodeConfigPaths(home = (0, import_node_os11.homedir)()) {
   return [
-    (0, import_node_path28.join)(home, ".config", "opencode", "opencode.json"),
-    (0, import_node_path28.join)(home, ".config", "opencode", "opencode.jsonc")
+    (0, import_node_path29.join)(home, ".config", "opencode", "opencode.json"),
+    (0, import_node_path29.join)(home, ".config", "opencode", "opencode.jsonc")
   ];
 }
 function userMcpNamesToDisable(opts) {
@@ -10630,7 +10773,7 @@ function userMcpNamesToDisable(opts) {
 function listUserCodexMcpNames(home = (0, import_node_os11.homedir)()) {
   const names = [];
   for (const path of userCodexConfigPaths(home)) {
-    if (!(0, import_node_fs27.existsSync)(path)) continue;
+    if (!(0, import_node_fs28.existsSync)(path)) continue;
     names.push(...listMcpNamesFromCodexToml(readText(path)));
   }
   return names;
@@ -10638,7 +10781,7 @@ function listUserCodexMcpNames(home = (0, import_node_os11.homedir)()) {
 function listUserOpencodeMcpNames(home = (0, import_node_os11.homedir)()) {
   const names = [];
   for (const path of userOpencodeConfigPaths(home)) {
-    if (!(0, import_node_fs27.existsSync)(path)) continue;
+    if (!(0, import_node_fs28.existsSync)(path)) continue;
     names.push(...listMcpNamesFromJsonMap(readJsonObject(path), "mcp"));
   }
   return names;
@@ -10651,13 +10794,13 @@ function toCodexDisableUserMcpArgs(names) {
   }
   return args;
 }
-var import_node_fs27, import_node_os11, import_node_path28, import_smol_toml2;
+var import_node_fs28, import_node_os11, import_node_path29, import_smol_toml2;
 var init_orch_mcp_isolation = __esm({
   "src/agents/orch-mcp-isolation.ts"() {
     "use strict";
-    import_node_fs27 = require("fs");
+    import_node_fs28 = require("fs");
     import_node_os11 = require("os");
-    import_node_path28 = require("path");
+    import_node_path29 = require("path");
     import_smol_toml2 = require("smol-toml");
     init_user_mcp_config();
   }
@@ -10673,7 +10816,7 @@ async function listCodexModels() {
   if (codex === "codex") {
     const which = await run("which", ["codex"], { reject: false });
     if (which.exitCode !== 0) return FALLBACK_CODEX_MODELS;
-  } else if (!(0, import_node_fs28.existsSync)(codex)) {
+  } else if (!(0, import_node_fs29.existsSync)(codex)) {
     return FALLBACK_CODEX_MODELS;
   }
   const listed = await run(codex, ["debug", "models"], { reject: false });
@@ -10708,12 +10851,12 @@ function usageFromCodex(usage) {
 }
 function codexConfigHasNetworkAccess() {
   const candidates = [
-    (0, import_node_path29.join)((0, import_node_os12.homedir)(), ".codex", "config.toml"),
-    (0, import_node_path29.join)((0, import_node_os12.homedir)(), ".config", "codex", "config.toml")
+    (0, import_node_path30.join)((0, import_node_os12.homedir)(), ".codex", "config.toml"),
+    (0, import_node_path30.join)((0, import_node_os12.homedir)(), ".config", "codex", "config.toml")
   ];
   for (const path of candidates) {
-    if (!(0, import_node_fs28.existsSync)(path)) continue;
-    const text7 = (0, import_node_fs28.readFileSync)(path, "utf8");
+    if (!(0, import_node_fs29.existsSync)(path)) continue;
+    const text7 = (0, import_node_fs29.readFileSync)(path, "utf8");
     if (/network_access\s*=\s*true/.test(text7)) return true;
   }
   return false;
@@ -10745,21 +10888,21 @@ function asRecord2(value) {
   return void 0;
 }
 function codexLooksAuthenticated() {
-  const authPath = (0, import_node_path29.join)((0, import_node_os12.homedir)(), ".codex", "auth.json");
-  if (!(0, import_node_fs28.existsSync)(authPath)) return false;
+  const authPath = (0, import_node_path30.join)((0, import_node_os12.homedir)(), ".codex", "auth.json");
+  if (!(0, import_node_fs29.existsSync)(authPath)) return false;
   try {
-    return (0, import_node_fs28.statSync)(authPath).size > 2;
+    return (0, import_node_fs29.statSync)(authPath).size > 2;
   } catch {
     return false;
   }
 }
-var import_node_fs28, import_node_os12, import_node_path29, CODEX_PROMPT_ARG_MAX, FALLBACK_CODEX_MODELS, cachedCodexModels, CODEX_MODEL_CACHE_MS, codexAdapter;
+var import_node_fs29, import_node_os12, import_node_path30, CODEX_PROMPT_ARG_MAX, FALLBACK_CODEX_MODELS, cachedCodexModels, CODEX_MODEL_CACHE_MS, codexAdapter;
 var init_codex = __esm({
   "src/agents/codex.ts"() {
     "use strict";
-    import_node_fs28 = require("fs");
+    import_node_fs29 = require("fs");
     import_node_os12 = require("os");
-    import_node_path29 = require("path");
+    import_node_path30 = require("path");
     init_run();
     init_app_settings();
     init_global_workspace();
@@ -10785,7 +10928,7 @@ var init_codex = __esm({
       async detect() {
         const codex = resolveAgentExecutable("codex");
         if (codex !== "codex") {
-          if (!(0, import_node_fs28.existsSync)(codex)) {
+          if (!(0, import_node_fs29.existsSync)(codex)) {
             return {
               agent: "codex",
               installed: false,
@@ -11088,21 +11231,21 @@ function platformRipgrepPackage() {
 }
 function usableRipgrepPath(candidate) {
   const raw = candidate?.trim();
-  if (!raw || !(0, import_node_path30.isAbsolute)(raw)) return null;
+  if (!raw || !(0, import_node_path31.isAbsolute)(raw)) return null;
   const readable = nodeReadableScriptPath(raw);
-  if (!(0, import_node_fs29.existsSync)(readable) || isAsarPath(readable)) return null;
+  if (!(0, import_node_fs30.existsSync)(readable) || isAsarPath(readable)) return null;
   return readable;
 }
 function walkForBundledRipgrep(startFile) {
   if (!startFile) return null;
   const pkg = platformRipgrepPackage();
   const name = rgBinaryName();
-  let dir = (0, import_node_path30.dirname)((0, import_node_path30.resolve)(startFile));
-  const root = (0, import_node_path30.parse)(dir).root;
+  let dir = (0, import_node_path31.dirname)((0, import_node_path31.resolve)(startFile));
+  const root = (0, import_node_path31.parse)(dir).root;
   while (dir !== root) {
-    const hit = usableRipgrepPath((0, import_node_path30.join)(dir, "node_modules", pkg, "bin", name));
+    const hit = usableRipgrepPath((0, import_node_path31.join)(dir, "node_modules", pkg, "bin", name));
     if (hit) return hit;
-    const next = (0, import_node_path30.dirname)(dir);
+    const next = (0, import_node_path31.dirname)(dir);
     if (next === dir) break;
     dir = next;
   }
@@ -11112,7 +11255,7 @@ function requireResolveBundledRipgrep(fromFile) {
   try {
     const req = (0, import_node_module2.createRequire)(fromFile);
     const pkgJson = req.resolve(`${platformRipgrepPackage()}/package.json`);
-    return usableRipgrepPath((0, import_node_path30.join)((0, import_node_path30.dirname)(pkgJson), "bin", rgBinaryName()));
+    return usableRipgrepPath((0, import_node_path31.join)((0, import_node_path31.dirname)(pkgJson), "bin", rgBinaryName()));
   } catch {
     return null;
   }
@@ -11134,13 +11277,13 @@ function cursorRipgrepEnv(opts) {
   const path = resolveCursorRipgrepPath(opts);
   return path ? { [RIPGREP_ENV]: path } : {};
 }
-var import_node_fs29, import_node_module2, import_node_path30, RIPGREP_ENV;
+var import_node_fs30, import_node_module2, import_node_path31, RIPGREP_ENV;
 var init_cursor_ripgrep = __esm({
   "src/agents/cursor-ripgrep.ts"() {
     "use strict";
-    import_node_fs29 = require("fs");
+    import_node_fs30 = require("fs");
     import_node_module2 = require("module");
-    import_node_path30 = require("path");
+    import_node_path31 = require("path");
     init_node_launch();
     init_packaged_runtime();
     RIPGREP_ENV = "CURSOR_RIPGREP_PATH";
@@ -11153,6 +11296,9 @@ function resolveCursorApiKey() {
   if (fromEnv) return fromEnv;
   return (loadAppSettings().environment.CURSOR_API_KEY || "").trim();
 }
+function isCursorApiKeyConfigured() {
+  return Boolean(resolveCursorApiKey());
+}
 async function listCursorModels() {
   const now = Date.now();
   if (cachedModels && now - cachedModels.at < MODEL_CACHE_MS) {
@@ -11178,11 +11324,11 @@ function entryDir() {
   const cjsDir = typeof __dirname !== "undefined" ? __dirname : "";
   if (cjsDir) return cjsDir;
   try {
-    return (0, import_node_path31.dirname)((0, import_node_url2.fileURLToPath)(import_meta2.url));
+    return (0, import_node_path32.dirname)((0, import_node_url2.fileURLToPath)(import_meta2.url));
   } catch {
     try {
       const req = (0, import_node_module3.createRequire)(process.cwd() + "/");
-      return (0, import_node_path31.dirname)(req.resolve("@sideboard-ai/core"));
+      return (0, import_node_path32.dirname)(req.resolve("@sideboard-ai/core"));
     } catch {
       return process.cwd();
     }
@@ -11193,27 +11339,27 @@ function cursorRunnerPath() {
   if (packaged) return packaged;
   const root = entryDir();
   const candidates = [
-    (0, import_node_path31.join)(root, "agents", "cursor-runner.js"),
-    (0, import_node_path31.join)(root, "agents", "cursor-runner.cjs"),
+    (0, import_node_path32.join)(root, "agents", "cursor-runner.js"),
+    (0, import_node_path32.join)(root, "agents", "cursor-runner.cjs"),
     // If somehow resolved from package root instead of dist/
-    (0, import_node_path31.join)(root, "dist", "agents", "cursor-runner.js"),
-    (0, import_node_path31.join)(root, "dist", "agents", "cursor-runner.cjs"),
+    (0, import_node_path32.join)(root, "dist", "agents", "cursor-runner.js"),
+    (0, import_node_path32.join)(root, "dist", "agents", "cursor-runner.cjs"),
     // Source tree (dev): packages/core/src/agents/cursor-runner.ts
-    (0, import_node_path31.join)(root, "cursor-runner.ts"),
-    (0, import_node_path31.join)(root, "src", "agents", "cursor-runner.ts")
+    (0, import_node_path32.join)(root, "cursor-runner.ts"),
+    (0, import_node_path32.join)(root, "src", "agents", "cursor-runner.ts")
   ];
   for (const candidate of candidates) {
-    if ((0, import_node_fs30.existsSync)(candidate)) return candidate;
+    if ((0, import_node_fs31.existsSync)(candidate)) return candidate;
   }
   return candidates[0];
 }
-var import_node_fs30, import_node_module3, import_node_path31, import_node_url2, import_sdk, import_meta2, FALLBACK_CURSOR_MODELS, cachedModels, MODEL_CACHE_MS, cursorAdapter;
+var import_node_fs31, import_node_module3, import_node_path32, import_node_url2, import_sdk, import_meta2, FALLBACK_CURSOR_MODELS, cachedModels, MODEL_CACHE_MS, cursorAdapter;
 var init_cursor = __esm({
   "src/agents/cursor.ts"() {
     "use strict";
-    import_node_fs30 = require("fs");
+    import_node_fs31 = require("fs");
     import_node_module3 = require("module");
-    import_node_path31 = require("path");
+    import_node_path32 = require("path");
     import_node_url2 = require("url");
     import_sdk = require("@cursor/sdk");
     init_run();
@@ -11365,7 +11511,7 @@ async function listOpencodeModels() {
   if (opencode === "opencode") {
     const which = await run("which", ["opencode"], { reject: false });
     if (which.exitCode !== 0) return FALLBACK_OPENCODE_MODELS;
-  } else if (!(0, import_node_fs31.existsSync)(opencode)) {
+  } else if (!(0, import_node_fs32.existsSync)(opencode)) {
     return FALLBACK_OPENCODE_MODELS;
   }
   const listed = await run(opencode, ["models"], { reject: false });
@@ -11395,11 +11541,11 @@ function usageFromOpencode(tokens) {
     cacheWriteTokens: tokens.cache?.write ? Number(tokens.cache.write) : void 0
   };
 }
-var import_node_fs31, FALLBACK_OPENCODE_MODELS, cachedOpencodeModels, OPENCODE_MODEL_CACHE_MS, opencodeAdapter;
+var import_node_fs32, FALLBACK_OPENCODE_MODELS, cachedOpencodeModels, OPENCODE_MODEL_CACHE_MS, opencodeAdapter;
 var init_opencode = __esm({
   "src/agents/opencode.ts"() {
     "use strict";
-    import_node_fs31 = require("fs");
+    import_node_fs32 = require("fs");
     init_run();
     init_app_settings();
     init_global_workspace();
@@ -11427,7 +11573,7 @@ var init_opencode = __esm({
       async detect() {
         const opencode = resolveAgentExecutable("opencode");
         if (opencode !== "opencode") {
-          if (!(0, import_node_fs31.existsSync)(opencode)) {
+          if (!(0, import_node_fs32.existsSync)(opencode)) {
             return {
               agent: "opencode",
               installed: false,
@@ -11955,15 +12101,15 @@ var init_agents = __esm({
 
 // src/hook/worktree-pkg-cache.ts
 function worktreePkgCacheRoot(worktreePath) {
-  return (0, import_node_path32.join)(worktreePath, WORKTREE_PKG_CACHE_REL);
+  return (0, import_node_path33.join)(worktreePath, WORKTREE_PKG_CACHE_REL);
 }
 function worktreePkgCacheEnv(worktreePath) {
   const root = worktreePkgCacheRoot(worktreePath);
-  const store = (0, import_node_path32.join)(root, "pnpm-store");
-  const pnpmCache = (0, import_node_path32.join)(root, "pnpm");
-  const npmCache = (0, import_node_path32.join)(root, "npm");
-  const nodeGyp = (0, import_node_path32.join)(root, "node-gyp");
-  const electron = (0, import_node_path32.join)(root, "electron");
+  const store = (0, import_node_path33.join)(root, "pnpm-store");
+  const pnpmCache = (0, import_node_path33.join)(root, "pnpm");
+  const npmCache = (0, import_node_path33.join)(root, "npm");
+  const nodeGyp = (0, import_node_path33.join)(root, "node-gyp");
+  const electron = (0, import_node_path33.join)(root, "electron");
   return {
     npm_config_store_dir: store,
     PNPM_STORE_DIR: store,
@@ -11985,8 +12131,8 @@ function fillGroup(env, keys, values) {
   }
 }
 function ensureWorktreePkgCacheDirs(worktreePath) {
-  if (!(0, import_node_fs32.existsSync)(worktreePath)) return;
-  (0, import_node_fs32.mkdirSync)(worktreePkgCacheRoot(worktreePath), { recursive: true });
+  if (!(0, import_node_fs33.existsSync)(worktreePath)) return;
+  (0, import_node_fs33.mkdirSync)(worktreePkgCacheRoot(worktreePath), { recursive: true });
 }
 function applyWorktreePkgCacheEnv(env, worktreePath) {
   const cwd = worktreePath.trim();
@@ -11999,12 +12145,12 @@ function applyWorktreePkgCacheEnv(env, worktreePath) {
   fillGroup(env, ["electron_config_cache"], next);
   ensureWorktreePkgCacheDirs(cwd);
 }
-var import_node_fs32, import_node_path32, WORKTREE_PKG_CACHE_REL;
+var import_node_fs33, import_node_path33, WORKTREE_PKG_CACHE_REL;
 var init_worktree_pkg_cache = __esm({
   "src/hook/worktree-pkg-cache.ts"() {
     "use strict";
-    import_node_fs32 = require("fs");
-    import_node_path32 = require("path");
+    import_node_fs33 = require("fs");
+    import_node_path33 = require("path");
     WORKTREE_PKG_CACHE_REL = ".context/.sideboard/pkg-cache";
   }
 });
@@ -12325,6 +12471,8 @@ function agentGitPrompt(action, opts) {
       const named = base ? ` (${base})` : "";
       return `Merge the remote branch${named} into your branch and resolve conflicts. Then, commit and push your changes.`;
     }
+    case "ready-for-review":
+      return "Ready for review.";
     case "merge":
       return "Merge PR.";
   }
@@ -12339,6 +12487,8 @@ function gitActionExpansion(action, base) {
       return "Commit, push, then `gh pr create --web -R <origin-owner/name>`.";
     case "resolve-conflicts":
       return `Fetch the PR base${base ? ` (\`${base}\`)` : ""}, merge it into this branch, resolve conflicts carefully, then commit and push until the PR is mergeable.`;
+    case "ready-for-review":
+      return "This phrase is the explicit ask to mark this thread's draft pull request ready for review on GitHub (`gh pr ready -R <origin-owner/name>` or `gh pr ready`). Update title/body if the purpose drifted. Do not merge.";
     case "merge":
       return "This phrase is the explicit ask to merge this thread's open pull request on GitHub. If `gh stack view` shows a stack, use `gh stack merge`; otherwise `gh pr merge` (respect repo defaults / squash vs merge). Do not force-push main/master or merge locally into the main checkout.";
   }
@@ -12381,6 +12531,7 @@ var init_agent_git_actions = __esm({
       "create-draft",
       "create-web",
       "resolve-conflicts",
+      "ready-for-review",
       "merge"
     ];
     RESOLVE_CONFLICTS_RE = /^Merge the remote branch(?: \(([^)]+)\))? into your branch and resolve conflicts\. Then, commit and push your changes\.$/;
@@ -13109,21 +13260,21 @@ function shouldRefreshReviewRequestTemplate(content) {
   return LEGACY_REVIEW_TEMPLATE_MARKERS.every((m) => trimmed.includes(m));
 }
 function readTextIfPresent(abs) {
-  if (!(0, import_node_fs33.existsSync)(abs)) return null;
+  if (!(0, import_node_fs34.existsSync)(abs)) return null;
   try {
-    const content = (0, import_node_fs33.readFileSync)(abs, "utf8");
+    const content = (0, import_node_fs34.readFileSync)(abs, "utf8");
     return content.trim() ? content : null;
   } catch {
     return null;
   }
 }
 function readLocalGuidelines(worktreePath) {
-  const localAbs = (0, import_node_path33.join)(worktreePath, REVIEW_REQUEST_PATH);
+  const localAbs = (0, import_node_path34.join)(worktreePath, REVIEW_REQUEST_PATH);
   const localContent = readTextIfPresent(localAbs);
   if (localContent && !shouldRefreshReviewRequestTemplate(localContent)) {
     return { path: REVIEW_REQUEST_PATH, content: localContent };
   }
-  const legacyAbs = (0, import_node_path33.join)(worktreePath, LEGACY_REVIEW_REQUEST_PATH);
+  const legacyAbs = (0, import_node_path34.join)(worktreePath, LEGACY_REVIEW_REQUEST_PATH);
   const legacyContent = readTextIfPresent(legacyAbs);
   if (legacyContent && !shouldRefreshReviewRequestTemplate(legacyContent)) {
     return { path: LEGACY_REVIEW_REQUEST_PATH, content: legacyContent };
@@ -13147,27 +13298,27 @@ function contextGuidelines(content, source) {
   };
 }
 function writeContextGuidelines(worktreePath, content) {
-  const abs = (0, import_node_path33.join)(worktreePath, CONTEXT_REVIEW_PATH);
-  (0, import_node_fs33.mkdirSync)((0, import_node_path33.dirname)(abs), { recursive: true });
+  const abs = (0, import_node_path34.join)(worktreePath, CONTEXT_REVIEW_PATH);
+  (0, import_node_fs34.mkdirSync)((0, import_node_path34.dirname)(abs), { recursive: true });
   const body = content.endsWith("\n") ? content : `${content}
 `;
-  (0, import_node_fs33.writeFileSync)(abs, body, "utf8");
+  (0, import_node_fs34.writeFileSync)(abs, body, "utf8");
   return body;
 }
 function readSideboardReview(worktreePath, repoPath) {
-  const fromWorktree = readTextIfPresent((0, import_node_path33.join)(worktreePath, REPO_REVIEW_PATH));
+  const fromWorktree = readTextIfPresent((0, import_node_path34.join)(worktreePath, REPO_REVIEW_PATH));
   if (fromWorktree) return fromWorktree;
   const repo = repoPath?.replace(/\/+$/, "");
   const wt = worktreePath.replace(/\/+$/, "");
   if (!repo || repo === wt) return null;
-  return readTextIfPresent((0, import_node_path33.join)(repo, REPO_REVIEW_PATH));
+  return readTextIfPresent((0, import_node_path34.join)(repo, REPO_REVIEW_PATH));
 }
 function ensureReviewGuidelinesFile(worktreePath, repoPath) {
-  const skillContent = readTextIfPresent((0, import_node_path33.join)(worktreePath, REVIEW_SKILL_PATH));
+  const skillContent = readTextIfPresent((0, import_node_path34.join)(worktreePath, REVIEW_SKILL_PATH));
   if (skillContent) {
     return { ...skillGuidelines(skillContent, "skill"), wrote: false };
   }
-  const contextContent = readTextIfPresent((0, import_node_path33.join)(worktreePath, CONTEXT_REVIEW_PATH));
+  const contextContent = readTextIfPresent((0, import_node_path34.join)(worktreePath, CONTEXT_REVIEW_PATH));
   if (contextContent && !shouldRefreshReviewRequestTemplate(contextContent)) {
     return { ...contextGuidelines(contextContent, "local"), wrote: false };
   }
@@ -13222,13 +13373,13 @@ async function requestReview(threadRef, send) {
   const started = await send(tab.id, REVIEW_REQUEST_PREFILL);
   return { tab: started, from };
 }
-var import_node_crypto7, import_node_fs33, import_node_path33, REPO_REVIEW_PATH, REPO_REVIEW_NAME, CONTEXT_REVIEW_PATH, REVIEW_REQUEST_PATH, LEGACY_REVIEW_REQUEST_PATH, REVIEW_REQUEST_NAME, REVIEW_REQUEST_PREFILL, LEGACY_REVIEW_TEMPLATE_MARKERS;
+var import_node_crypto7, import_node_fs34, import_node_path34, REPO_REVIEW_PATH, REPO_REVIEW_NAME, CONTEXT_REVIEW_PATH, REVIEW_REQUEST_PATH, LEGACY_REVIEW_REQUEST_PATH, REVIEW_REQUEST_NAME, REVIEW_REQUEST_PREFILL, LEGACY_REVIEW_TEMPLATE_MARKERS;
 var init_request_review = __esm({
   "src/review/request-review.ts"() {
     "use strict";
     import_node_crypto7 = require("crypto");
-    import_node_fs33 = require("fs");
-    import_node_path33 = require("path");
+    import_node_fs34 = require("fs");
+    import_node_path34 = require("path");
     init_global_workspace();
     init_chat_tabs();
     init_thread_store();
@@ -13254,9 +13405,9 @@ function matchSimpleGlob(pattern, name) {
   return new RegExp(`^${escaped}$`).test(name);
 }
 function readWorktreeInclude(repoPath) {
-  const path = (0, import_node_path34.join)(repoPath, ".worktreeinclude");
-  if (!(0, import_node_fs34.existsSync)(path)) return [];
-  return (0, import_node_fs34.readFileSync)(path, "utf8").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
+  const path = (0, import_node_path35.join)(repoPath, ".worktreeinclude");
+  if (!(0, import_node_fs35.existsSync)(path)) return [];
+  return (0, import_node_fs35.readFileSync)(path, "utf8").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
 }
 function resolveFilesToCopy(repoPath) {
   const fromInclude = readWorktreeInclude(repoPath);
@@ -13266,10 +13417,10 @@ function resolveFilesToCopy(repoPath) {
   if (settings?.fileIncludeGlobs?.length) {
     const matched = [];
     try {
-      for (const entry of (0, import_node_fs34.readdirSync)(repoPath, { withFileTypes: true })) {
+      for (const entry of (0, import_node_fs35.readdirSync)(repoPath, { withFileTypes: true })) {
         if (!entry.isFile()) continue;
         for (const glob of settings.fileIncludeGlobs) {
-          if (matchSimpleGlob(glob, entry.name) || matchSimpleGlob((0, import_node_path34.basename)(glob), entry.name)) {
+          if (matchSimpleGlob(glob, entry.name) || matchSimpleGlob((0, import_node_path35.basename)(glob), entry.name)) {
             matched.push(entry.name);
             break;
           }
@@ -13281,7 +13432,7 @@ function resolveFilesToCopy(repoPath) {
   }
   const defaults = [];
   try {
-    for (const entry of (0, import_node_fs34.readdirSync)(repoPath, { withFileTypes: true })) {
+    for (const entry of (0, import_node_fs35.readdirSync)(repoPath, { withFileTypes: true })) {
       if (entry.isFile() && entry.name.startsWith(".env")) {
         defaults.push(entry.name);
       }
@@ -13295,11 +13446,11 @@ function copyConfiguredFiles(repoPath, worktreePath) {
   const patterns = resolveFilesToCopy(repoPath);
   const copied = [];
   for (const rel of patterns) {
-    const src = (0, import_node_path34.join)(repoPath, rel);
-    if (!(0, import_node_fs34.existsSync)(src)) continue;
-    const dest = (0, import_node_path34.join)(worktreePath, rel);
-    (0, import_node_fs34.mkdirSync)((0, import_node_path34.dirname)(dest), { recursive: true });
-    (0, import_node_fs34.copyFileSync)(src, dest);
+    const src = (0, import_node_path35.join)(repoPath, rel);
+    if (!(0, import_node_fs35.existsSync)(src)) continue;
+    const dest = (0, import_node_path35.join)(worktreePath, rel);
+    (0, import_node_fs35.mkdirSync)((0, import_node_path35.dirname)(dest), { recursive: true });
+    (0, import_node_fs35.copyFileSync)(src, dest);
     copied.push(rel);
   }
   return copied;
@@ -13334,7 +13485,7 @@ function buildWorkspaceScriptEnv(opts, baseEnv) {
   const env = stripNestedElectronEnv({
     ...baseEnv ?? process.env
   });
-  const name = opts.workspaceName ?? (0, import_node_path34.basename)(opts.worktreePath);
+  const name = opts.workspaceName ?? (0, import_node_path35.basename)(opts.worktreePath);
   const ports = opts.ports ?? [];
   const primary = ports[0];
   env.SIDEBOARD_WORKSPACE_NAME = name;
@@ -13597,13 +13748,13 @@ async function startDevServer(repoPath, worktreePath, onLine, opts) {
     done: handle.done
   };
 }
-var import_node_fs34, import_node_net, import_node_path34, import_execa4, import_node_readline3, PORT_RANGE_SIZE, cachedLoginEnv;
+var import_node_fs35, import_node_net, import_node_path35, import_execa4, import_node_readline3, PORT_RANGE_SIZE, cachedLoginEnv;
 var init_conductor = __esm({
   "src/hook/conductor.ts"() {
     "use strict";
-    import_node_fs34 = require("fs");
+    import_node_fs35 = require("fs");
     import_node_net = require("net");
-    import_node_path34 = require("path");
+    import_node_path35 = require("path");
     import_execa4 = require("execa");
     import_node_readline3 = require("readline");
     init_settings();
@@ -13622,7 +13773,7 @@ var init_conductor = __esm({
 
 // src/store/setup-log.ts
 function setupLogPath(threadId) {
-  return (0, import_node_path35.join)(threadsDir(), `${threadId}.setup.log.json`);
+  return (0, import_node_path36.join)(threadsDir(), `${threadId}.setup.log.json`);
 }
 function emptySetupLog() {
   return { ...EMPTY };
@@ -13639,7 +13790,7 @@ function persistNow(threadId) {
   const snap = memory.get(threadId);
   if (!snap) return;
   try {
-    (0, import_node_fs35.writeFileSync)(setupLogPath(threadId), `${JSON.stringify(snap)}
+    (0, import_node_fs36.writeFileSync)(setupLogPath(threadId), `${JSON.stringify(snap)}
 `, "utf8");
   } catch {
   }
@@ -13656,9 +13807,9 @@ function schedulePersist(threadId) {
 }
 function loadFromDisk(threadId) {
   const path = setupLogPath(threadId);
-  if (!(0, import_node_fs35.existsSync)(path)) return null;
+  if (!(0, import_node_fs36.existsSync)(path)) return null;
   try {
-    const raw = JSON.parse((0, import_node_fs35.readFileSync)(path, "utf8"));
+    const raw = JSON.parse((0, import_node_fs36.readFileSync)(path, "utf8"));
     return {
       output: typeof raw.output === "string" ? raw.output : "",
       running: Boolean(raw.running),
@@ -13714,12 +13865,12 @@ function finishSetupLog(threadId, exitCode, source) {
   persistNow(threadId);
   return clone(snap);
 }
-var import_node_fs35, import_node_path35, EMPTY, memory, persistTimers;
+var import_node_fs36, import_node_path36, EMPTY, memory, persistTimers;
 var init_setup_log = __esm({
   "src/store/setup-log.ts"() {
     "use strict";
-    import_node_fs35 = require("fs");
-    import_node_path35 = require("path");
+    import_node_fs36 = require("fs");
+    import_node_path36 = require("path");
     init_paths();
     EMPTY = {
       output: "",
@@ -13743,9 +13894,9 @@ async function findOrphanWorktrees(repoPaths) {
     repoPaths?.length ? repoPaths : threads.map((t) => t.repoPath).filter(Boolean)
   );
   const homeRoot = sideboardWorkspacesDir();
-  if ((0, import_node_fs36.existsSync)(homeRoot)) {
+  if ((0, import_node_fs37.existsSync)(homeRoot)) {
     try {
-      for (const entry of (0, import_node_fs36.readdirSync)(homeRoot, { withFileTypes: true })) {
+      for (const entry of (0, import_node_fs37.readdirSync)(homeRoot, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
         void entry;
       }
@@ -13755,7 +13906,7 @@ async function findOrphanWorktrees(repoPaths) {
   const orphans = [];
   const seen = /* @__PURE__ */ new Set();
   for (const repoPath of repos) {
-    if (!repoPath || !(0, import_node_fs36.existsSync)(repoPath)) continue;
+    if (!repoPath || !(0, import_node_fs37.existsSync)(repoPath)) continue;
     try {
       const wts = await listWorktrees(repoPath);
       for (const wt of wts) {
@@ -13766,7 +13917,7 @@ async function findOrphanWorktrees(repoPaths) {
         seen.add(path);
         let mtimeMs = 0;
         try {
-          mtimeMs = (0, import_node_fs36.statSync)(path).mtimeMs;
+          mtimeMs = (0, import_node_fs37.statSync)(path).mtimeMs;
         } catch {
           mtimeMs = 0;
         }
@@ -13776,16 +13927,16 @@ async function findOrphanWorktrees(repoPaths) {
     }
     try {
       const root = worktreesRoot(repoPath);
-      if ((0, import_node_fs36.existsSync)(root)) {
-        for (const entry of (0, import_node_fs36.readdirSync)(root, { withFileTypes: true })) {
+      if ((0, import_node_fs37.existsSync)(root)) {
+        for (const entry of (0, import_node_fs37.readdirSync)(root, { withFileTypes: true })) {
           if (!entry.isDirectory()) continue;
-          const path = (0, import_node_path36.join)(root, entry.name).replace(/\/$/, "");
+          const path = (0, import_node_path37.join)(root, entry.name).replace(/\/$/, "");
           if (known.has(path) || seen.has(path)) continue;
-          if (!(0, import_node_fs36.existsSync)((0, import_node_path36.join)(path, ".git"))) continue;
+          if (!(0, import_node_fs37.existsSync)((0, import_node_path37.join)(path, ".git"))) continue;
           seen.add(path);
           let mtimeMs = 0;
           try {
-            mtimeMs = (0, import_node_fs36.statSync)(path).mtimeMs;
+            mtimeMs = (0, import_node_fs37.statSync)(path).mtimeMs;
           } catch {
             mtimeMs = Date.now();
           }
@@ -13837,12 +13988,12 @@ function shouldRunWorktreeCleanup(settings = loadAppSettings()) {
   const elapsed = Date.now() - Date.parse(last);
   return elapsed >= intervalHours * 36e5;
 }
-var import_node_fs36, import_node_path36;
+var import_node_fs37, import_node_path37;
 var init_orphan_cleanup = __esm({
   "src/git/orphan-cleanup.ts"() {
     "use strict";
-    import_node_fs36 = require("fs");
-    import_node_path36 = require("path");
+    import_node_fs37 = require("fs");
+    import_node_path37 = require("path");
     init_worktree();
     init_thread_store();
     init_paths();
@@ -13945,12 +14096,12 @@ async function cloneRepoIntoSideboard(opts) {
   if (!url) throw new Error("Clone URL is required");
   let name = opts.name?.trim();
   if (!name) {
-    const leaf = (0, import_node_path37.basename)(url.replace(/\/$/, "").replace(/\.git$/, ""));
+    const leaf = (0, import_node_path38.basename)(url.replace(/\/$/, "").replace(/\.git$/, ""));
     name = leaf || "repo";
   }
   name = name.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "repo";
-  const dest = (0, import_node_path37.join)(sideboardReposDir(), name);
-  if ((0, import_node_fs37.existsSync)(dest)) {
+  const dest = (0, import_node_path38.join)(sideboardReposDir(), name);
+  if ((0, import_node_fs38.existsSync)(dest)) {
     const repoPath2 = await resolveRepoRoot(dest);
     const workspace2 = await ensureWorkspace(repoPath2);
     return { repoPath: repoPath2, workspace: workspace2 };
@@ -13965,12 +14116,12 @@ async function cloneRepoIntoSideboard(opts) {
   const workspace = await ensureWorkspace(repoPath);
   return { repoPath, workspace };
 }
-var import_node_fs37, import_node_path37, import_execa6;
+var import_node_fs38, import_node_path38, import_execa6;
 var init_clone_repo = __esm({
   "src/git/clone-repo.ts"() {
     "use strict";
-    import_node_fs37 = require("fs");
-    import_node_path37 = require("path");
+    import_node_fs38 = require("fs");
+    import_node_path38 = require("path");
     import_execa6 = require("execa");
     init_paths();
     init_workspaces2();
@@ -13980,11 +14131,11 @@ var init_clone_repo = __esm({
 
 // src/store/desktop-host.ts
 function desktopHostPidPath() {
-  return (0, import_node_path38.join)(appDataDir(), "desktop-host.pid");
+  return (0, import_node_path39.join)(appDataDir(), "desktop-host.pid");
 }
 function readDesktopHostPid() {
   try {
-    const pid = Number.parseInt((0, import_node_fs38.readFileSync)(desktopHostPidPath(), "utf8").trim(), 10);
+    const pid = Number.parseInt((0, import_node_fs39.readFileSync)(desktopHostPidPath(), "utf8").trim(), 10);
     if (!Number.isFinite(pid) || pid <= 0) return null;
     return pid;
   } catch {
@@ -14010,12 +14161,12 @@ function thisProcessShouldDrainAgentQueues() {
   if (isThisProcessDesktopHost()) return true;
   return !isDesktopHostAlive();
 }
-var import_node_fs38, import_node_path38;
+var import_node_fs39, import_node_path39;
 var init_desktop_host = __esm({
   "src/store/desktop-host.ts"() {
     "use strict";
-    import_node_fs38 = require("fs");
-    import_node_path38 = require("path");
+    import_node_fs39 = require("fs");
+    import_node_path39 = require("path");
     init_paths();
   }
 });
@@ -14130,24 +14281,24 @@ function jobTreeAlive(pid) {
   return jobAlive(pid) || processGroupAlive(pid);
 }
 function readIntFile(file) {
-  if (!(0, import_node_fs39.existsSync)(file)) return null;
-  const n = Number.parseInt((0, import_node_fs39.readFileSync)(file, "utf8").trim(), 10);
+  if (!(0, import_node_fs40.existsSync)(file)) return null;
+  const n = Number.parseInt((0, import_node_fs40.readFileSync)(file, "utf8").trim(), 10);
   return Number.isInteger(n) ? n : null;
 }
 function jobDir(root, id, legacy = false) {
-  return (0, import_node_path39.join)(root, legacy ? LEGACY_DETACHED_JOBS_DIR : DETACHED_JOBS_DIR, id);
+  return (0, import_node_path40.join)(root, legacy ? LEGACY_DETACHED_JOBS_DIR : DETACHED_JOBS_DIR, id);
 }
 function resolveJobDir(root, id) {
   const modern = jobDir(root, id, false);
-  if ((0, import_node_fs39.existsSync)(modern)) return modern;
+  if ((0, import_node_fs40.existsSync)(modern)) return modern;
   const legacy = jobDir(root, id, true);
-  if ((0, import_node_fs39.existsSync)(legacy)) return legacy;
+  if ((0, import_node_fs40.existsSync)(legacy)) return legacy;
   return modern;
 }
 function listJobIdsIn(root, rel) {
-  const dir = (0, import_node_path39.join)(root, rel);
-  if (!(0, import_node_fs39.existsSync)(dir)) return [];
-  return (0, import_node_fs39.readdirSync)(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && JOB_ID_RE.test(e.name)).map((e) => e.name);
+  const dir = (0, import_node_path40.join)(root, rel);
+  if (!(0, import_node_fs40.existsSync)(dir)) return [];
+  return (0, import_node_fs40.readdirSync)(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && JOB_ID_RE.test(e.name)).map((e) => e.name);
 }
 function listRunningDetachedJobs(worktreePath) {
   const root = worktreePath.trim();
@@ -14159,7 +14310,7 @@ function listRunningDetachedJobs(worktreePath) {
   const running = [];
   for (const id of ids) {
     const dir = resolveJobDir(root, id);
-    const pid = readIntFile((0, import_node_path39.join)(dir, "pid"));
+    const pid = readIntFile((0, import_node_path40.join)(dir, "pid"));
     if (jobTreeAlive(pid)) running.push(id);
   }
   return running.sort();
@@ -14212,13 +14363,13 @@ function planJobContinue(opts) {
   return { action: "none" };
 }
 function tailProgress(logFile, maxLines = 12) {
-  if (!(0, import_node_fs39.existsSync)(logFile)) return "(no log yet)";
-  const lines = (0, import_node_fs39.readFileSync)(logFile, "utf8").split("\n");
+  if (!(0, import_node_fs40.existsSync)(logFile)) return "(no log yet)";
+  const lines = (0, import_node_fs40.readFileSync)(logFile, "utf8").split("\n");
   return lines.slice(-maxLines).join("\n");
 }
 function readLogLines(file) {
-  if (!(0, import_node_fs39.existsSync)(file)) return [];
-  const lines = (0, import_node_fs39.readFileSync)(file, "utf8").split("\n");
+  if (!(0, import_node_fs40.existsSync)(file)) return [];
+  const lines = (0, import_node_fs40.readFileSync)(file, "utf8").split("\n");
   if (lines.length && lines[lines.length - 1] === "") lines.pop();
   return lines;
 }
@@ -14229,15 +14380,15 @@ function takeDelta(logFile, cursorFile) {
   return { delta: lines.slice(start).join("\n"), nextCursor: lines.length };
 }
 function snapshotJob(dir) {
-  const pid = readIntFile((0, import_node_path39.join)(dir, "pid"));
+  const pid = readIntFile((0, import_node_path40.join)(dir, "pid"));
   const running = jobTreeAlive(pid);
   return {
     pid,
     running,
-    exitCode: readIntFile((0, import_node_path39.join)(dir, "exit")),
-    log: (0, import_node_path39.join)(dir, "log"),
-    cursor: (0, import_node_path39.join)(dir, "present.cursor"),
-    progress: tailProgress((0, import_node_path39.join)(dir, "log"))
+    exitCode: readIntFile((0, import_node_path40.join)(dir, "exit")),
+    log: (0, import_node_path40.join)(dir, "log"),
+    cursor: (0, import_node_path40.join)(dir, "present.cursor"),
+    progress: tailProgress((0, import_node_path40.join)(dir, "log"))
   };
 }
 function toResult(id, snap, extra) {
@@ -14246,8 +14397,8 @@ function toResult(id, snap, extra) {
   const stillRunning = snap.running && !ok;
   const { delta, nextCursor } = takeDelta(snap.log, snap.cursor);
   try {
-    (0, import_node_fs39.mkdirSync)((0, import_node_path39.dirname)(snap.cursor), { recursive: true });
-    (0, import_node_fs39.writeFileSync)(snap.cursor, `${nextCursor}
+    (0, import_node_fs40.mkdirSync)((0, import_node_path40.dirname)(snap.cursor), { recursive: true });
+    (0, import_node_fs40.writeFileSync)(snap.cursor, `${nextCursor}
 `);
   } catch {
   }
@@ -14274,7 +14425,7 @@ async function waitForDetachedJob(cwd, id, opts) {
   const dir = resolveJobDir(root, jobId);
   const timeoutMs = mcpWaitForJobTimeoutMs(opts?.timeoutMs);
   const sleep = opts?.sleep ?? sleepMs;
-  if (!(0, import_node_fs39.existsSync)(dir)) {
+  if (!(0, import_node_fs40.existsSync)(dir)) {
     return {
       stillRunning: false,
       ok: false,
@@ -14320,10 +14471,10 @@ function killProcessTree(pid, signal) {
 }
 function appendJobLog(logFile, line) {
   try {
-    (0, import_node_fs39.mkdirSync)((0, import_node_path39.dirname)(logFile), { recursive: true });
+    (0, import_node_fs40.mkdirSync)((0, import_node_path40.dirname)(logFile), { recursive: true });
     const body = line.endsWith("\n") ? line : `${line}
 `;
-    (0, import_node_fs39.appendFileSync)(logFile, body);
+    (0, import_node_fs40.appendFileSync)(logFile, body);
   } catch {
   }
 }
@@ -14333,7 +14484,7 @@ async function stopDetachedJob(cwd, id, opts) {
   const dir = resolveJobDir(root, jobId);
   const sleep = opts?.sleep ?? sleepMs;
   const why = opts?.reason?.trim() ?? "";
-  if (!(0, import_node_fs39.existsSync)(dir)) {
+  if (!(0, import_node_fs40.existsSync)(dir)) {
     return {
       stillRunning: false,
       ok: false,
@@ -14369,10 +14520,10 @@ async function stopDetachedJob(cwd, id, opts) {
     killProcessTree(targetPid, "SIGKILL");
     await sleep(100);
   }
-  const exitFile = (0, import_node_path39.join)(dir, "exit");
-  if (!(0, import_node_fs39.existsSync)(exitFile)) {
+  const exitFile = (0, import_node_path40.join)(dir, "exit");
+  if (!(0, import_node_fs40.existsSync)(exitFile)) {
     try {
-      (0, import_node_fs39.writeFileSync)(exitFile, "1\n");
+      (0, import_node_fs40.writeFileSync)(exitFile, "1\n");
     } catch {
     }
   }
@@ -14392,12 +14543,12 @@ async function stopDetachedJob(cwd, id, opts) {
     hint: stopped ? MCP_STOP_JOB_HINT : MCP_WAIT_JOB_STILL_RUNNING_HINT
   };
 }
-var import_node_fs39, import_node_path39, MAX_JOB_CONTINUES, MCP_WAIT_JOB_STILL_RUNNING_HINT, MCP_STOP_JOB_HINT, JOB_ID_RE;
+var import_node_fs40, import_node_path40, MAX_JOB_CONTINUES, MCP_WAIT_JOB_STILL_RUNNING_HINT, MCP_STOP_JOB_HINT, JOB_ID_RE;
 var init_wait_for_job = __esm({
   "src/mcp/wait-for-job.ts"() {
     "use strict";
-    import_node_fs39 = require("fs");
-    import_node_path39 = require("path");
+    import_node_fs40 = require("fs");
+    import_node_path40 = require("path");
     init_workspace_scratch();
     init_wait_for_turn();
     MAX_JOB_CONTINUES = 8;
@@ -15492,7 +15643,7 @@ function reuseLiveThread(input, repoPath, match) {
 }
 async function createThread(input, _onSetupLine) {
   const repoPath = await resolveRepoRoot(input.repoPath);
-  if (!(0, import_node_fs40.existsSync)(repoPath)) {
+  if (!(0, import_node_fs41.existsSync)(repoPath)) {
     throw new Error(`Repo not found: ${repoPath}`);
   }
   const reused = reuseLiveThread(input, repoPath, {
@@ -15664,11 +15815,11 @@ async function createThread(input, _onSetupLine) {
   await ensureWorkspace(repoPath);
   return readThread(thread.id) ?? thread;
 }
-var import_node_fs40;
+var import_node_fs41;
 var init_create = __esm({
   "src/threads/create.ts"() {
     "use strict";
-    import_node_fs40 = require("fs");
+    import_node_fs41 = require("fs");
     init_detect();
     init_worktree();
     init_home_board();
@@ -15788,20 +15939,20 @@ function writeTurnLive(threadId, progress) {
   const path = threadLivePath(threadId);
   const tmp = `${path}.${process.pid}.tmp`;
   try {
-    (0, import_node_fs41.writeFileSync)(tmp, JSON.stringify(progress), "utf8");
-    (0, import_node_fs41.renameSync)(tmp, path);
+    (0, import_node_fs42.writeFileSync)(tmp, JSON.stringify(progress), "utf8");
+    (0, import_node_fs42.renameSync)(tmp, path);
   } catch {
     try {
-      (0, import_node_fs41.unlinkSync)(tmp);
+      (0, import_node_fs42.unlinkSync)(tmp);
     } catch {
     }
   }
 }
 function readTurnLive(threadId) {
   const path = threadLivePath(threadId);
-  if (!(0, import_node_fs41.existsSync)(path)) return null;
+  if (!(0, import_node_fs42.existsSync)(path)) return null;
   try {
-    const raw = JSON.parse((0, import_node_fs41.readFileSync)(path, "utf8"));
+    const raw = JSON.parse((0, import_node_fs42.readFileSync)(path, "utf8"));
     if (!raw || typeof raw.summary !== "string") return null;
     return raw;
   } catch {
@@ -15813,17 +15964,17 @@ function clearTurnLive(threadId) {
   if (buf?.timer) clearTimeout(buf.timer);
   buffers.delete(threadId);
   const path = threadLivePath(threadId);
-  if (!(0, import_node_fs41.existsSync)(path)) return;
+  if (!(0, import_node_fs42.existsSync)(path)) return;
   try {
-    (0, import_node_fs41.unlinkSync)(path);
+    (0, import_node_fs42.unlinkSync)(path);
   } catch {
   }
 }
-var import_node_fs41, buffers, FLUSH_MS, MAX_PARTS;
+var import_node_fs42, buffers, FLUSH_MS, MAX_PARTS;
 var init_turn_live = __esm({
   "src/store/turn-live.ts"() {
     "use strict";
-    import_node_fs41 = require("fs");
+    import_node_fs42 = require("fs");
     init_message_parts();
     init_paths();
     buffers = /* @__PURE__ */ new Map();
@@ -16040,7 +16191,7 @@ var init_quota_failover = __esm({
 // src/threads/adopt.ts
 function thisModuleFile() {
   const cjsFile = typeof __filename !== "undefined" ? __filename : "";
-  return cjsFile || process.argv[1] || (0, import_node_path40.join)(process.cwd(), "package.json");
+  return cjsFile || process.argv[1] || (0, import_node_path41.join)(process.cwd(), "package.json");
 }
 function openReadonlySqlite(file) {
   const req = (0, import_node_module4.createRequire)(thisModuleFile());
@@ -16058,21 +16209,21 @@ function mapAgentType(raw) {
   return null;
 }
 function resolveConductorCursorAgentId(workspacePath) {
-  if (!workspacePath || !(0, import_node_fs42.existsSync)(CURSOR_SDK_STORE)) return null;
+  if (!workspacePath || !(0, import_node_fs43.existsSync)(CURSOR_SDK_STORE)) return null;
   const normalized = workspacePath.replace(/\/$/, "");
   let best = null;
   let hashes;
   try {
-    hashes = (0, import_node_fs42.readdirSync)(CURSOR_SDK_STORE);
+    hashes = (0, import_node_fs43.readdirSync)(CURSOR_SDK_STORE);
   } catch {
     return null;
   }
   for (const hash of hashes) {
-    const agentsFile = (0, import_node_path40.join)(CURSOR_SDK_STORE, hash, "agents.ndjson");
-    if (!(0, import_node_fs42.existsSync)(agentsFile)) continue;
+    const agentsFile = (0, import_node_path41.join)(CURSOR_SDK_STORE, hash, "agents.ndjson");
+    if (!(0, import_node_fs43.existsSync)(agentsFile)) continue;
     let text7;
     try {
-      text7 = (0, import_node_fs42.readFileSync)(agentsFile, "utf8");
+      text7 = (0, import_node_fs43.readFileSync)(agentsFile, "utf8");
     } catch {
       continue;
     }
@@ -16096,7 +16247,7 @@ function resolveConductorCursorAgentId(workspacePath) {
   return best?.agentId ?? null;
 }
 async function adoptThread(input) {
-  if (!(0, import_node_fs42.existsSync)(input.worktreePath)) {
+  if (!(0, import_node_fs43.existsSync)(input.worktreePath)) {
     throw new Error(`Worktree not found: ${input.worktreePath}`);
   }
   const repoPath = await resolveRepoRoot(input.worktreePath);
@@ -16122,18 +16273,18 @@ async function adoptThread(input) {
   return thread;
 }
 function listConductorWorkspaces() {
-  if (!(0, import_node_fs42.existsSync)(CONDUCTOR_DB)) {
+  if (!(0, import_node_fs43.existsSync)(CONDUCTOR_DB)) {
     throw new Error(`Conductor DB not found at ${CONDUCTOR_DB}`);
   }
-  const tmp = (0, import_node_fs42.mkdtempSync)((0, import_node_path40.join)((0, import_node_os13.tmpdir)(), "sideboard-conductor-"));
-  const snapshot = (0, import_node_path40.join)(tmp, "conductor.db");
+  const tmp = (0, import_node_fs43.mkdtempSync)((0, import_node_path41.join)((0, import_node_os13.tmpdir)(), "sideboard-conductor-"));
+  const snapshot = (0, import_node_path41.join)(tmp, "conductor.db");
   try {
-    (0, import_node_fs42.copyFileSync)(CONDUCTOR_DB, snapshot);
+    (0, import_node_fs43.copyFileSync)(CONDUCTOR_DB, snapshot);
     for (const suffix of ["-wal", "-shm"]) {
       const src = `${CONDUCTOR_DB}${suffix}`;
-      if ((0, import_node_fs42.existsSync)(src)) {
+      if ((0, import_node_fs43.existsSync)(src)) {
         try {
-          (0, import_node_fs42.copyFileSync)(src, `${snapshot}${suffix}`);
+          (0, import_node_fs43.copyFileSync)(src, `${snapshot}${suffix}`);
         } catch {
         }
       }
@@ -16209,22 +16360,22 @@ function listConductorWorkspaces() {
       db.close();
     }
   } finally {
-    (0, import_node_fs42.rmSync)(tmp, { recursive: true, force: true });
+    (0, import_node_fs43.rmSync)(tmp, { recursive: true, force: true });
   }
 }
 function importConductorWorkspace(workspaceId) {
-  if (!(0, import_node_fs42.existsSync)(CONDUCTOR_DB)) {
+  if (!(0, import_node_fs43.existsSync)(CONDUCTOR_DB)) {
     throw new Error(`Conductor DB not found at ${CONDUCTOR_DB}`);
   }
-  const tmp = (0, import_node_fs42.mkdtempSync)((0, import_node_path40.join)((0, import_node_os13.tmpdir)(), "sideboard-conductor-"));
-  const snapshot = (0, import_node_path40.join)(tmp, "conductor.db");
+  const tmp = (0, import_node_fs43.mkdtempSync)((0, import_node_path41.join)((0, import_node_os13.tmpdir)(), "sideboard-conductor-"));
+  const snapshot = (0, import_node_path41.join)(tmp, "conductor.db");
   try {
-    (0, import_node_fs42.copyFileSync)(CONDUCTOR_DB, snapshot);
+    (0, import_node_fs43.copyFileSync)(CONDUCTOR_DB, snapshot);
     for (const suffix of ["-wal", "-shm"]) {
       const src = `${CONDUCTOR_DB}${suffix}`;
-      if ((0, import_node_fs42.existsSync)(src)) {
+      if ((0, import_node_fs43.existsSync)(src)) {
         try {
-          (0, import_node_fs42.copyFileSync)(src, `${snapshot}${suffix}`);
+          (0, import_node_fs43.copyFileSync)(src, `${snapshot}${suffix}`);
         } catch {
         }
       }
@@ -16242,7 +16393,7 @@ function importConductorWorkspace(workspaceId) {
       ).get(workspaceId);
       if (!row) throw new Error(`Conductor workspace not found: ${workspaceId}`);
       const worktreePath = String(row.workspacePath);
-      if (!(0, import_node_fs42.existsSync)(worktreePath)) {
+      if (!(0, import_node_fs43.existsSync)(worktreePath)) {
         throw new Error(`Conductor worktree missing on disk: ${worktreePath}`);
       }
       let sessionId = null;
@@ -16282,7 +16433,7 @@ function importConductorWorkspace(workspaceId) {
       }
       let repoPath = worktreePath;
       try {
-        repoPath = (0, import_node_child_process3.execFileSync)("git", ["rev-parse", "--show-toplevel"], {
+        repoPath = (0, import_node_child_process4.execFileSync)("git", ["rev-parse", "--show-toplevel"], {
           cwd: worktreePath,
           encoding: "utf8"
         }).trim();
@@ -16305,31 +16456,31 @@ function importConductorWorkspace(workspaceId) {
       db.close();
     }
   } finally {
-    (0, import_node_fs42.rmSync)(tmp, { recursive: true, force: true });
+    (0, import_node_fs43.rmSync)(tmp, { recursive: true, force: true });
   }
 }
 async function importConductorWorkspaceAsync(workspaceId) {
   return importConductorWorkspace(workspaceId);
 }
-var import_node_child_process3, import_node_fs42, import_node_os13, import_node_path40, import_node_module4, CONDUCTOR_APP_SUPPORT, CONDUCTOR_DB, CURSOR_SDK_STORE;
+var import_node_child_process4, import_node_fs43, import_node_os13, import_node_path41, import_node_module4, CONDUCTOR_APP_SUPPORT, CONDUCTOR_DB, CURSOR_SDK_STORE;
 var init_adopt = __esm({
   "src/threads/adopt.ts"() {
     "use strict";
-    import_node_child_process3 = require("child_process");
-    import_node_fs42 = require("fs");
+    import_node_child_process4 = require("child_process");
+    import_node_fs43 = require("fs");
     import_node_os13 = require("os");
-    import_node_path40 = require("path");
+    import_node_path41 = require("path");
     import_node_module4 = require("module");
     init_worktree();
     init_thread_store();
-    CONDUCTOR_APP_SUPPORT = (0, import_node_path40.join)(
+    CONDUCTOR_APP_SUPPORT = (0, import_node_path41.join)(
       process.env.HOME ?? "",
       "Library",
       "Application Support",
       "com.conductor.app"
     );
-    CONDUCTOR_DB = (0, import_node_path40.join)(CONDUCTOR_APP_SUPPORT, "conductor.db");
-    CURSOR_SDK_STORE = (0, import_node_path40.join)(CONDUCTOR_APP_SUPPORT, "cursor-sdk-store");
+    CONDUCTOR_DB = (0, import_node_path41.join)(CONDUCTOR_APP_SUPPORT, "conductor.db");
+    CURSOR_SDK_STORE = (0, import_node_path41.join)(CONDUCTOR_APP_SUPPORT, "cursor-sdk-store");
   }
 });
 
@@ -16396,7 +16547,7 @@ async function openStackLayer(input, _onSetupLine) {
   let createdWorktree = false;
   const trees = await listWorktrees(repoPath);
   const checkedOut = trees.find((w) => w.branch === branchName);
-  if (checkedOut?.path && (0, import_node_fs43.existsSync)(checkedOut.path)) {
+  if (checkedOut?.path && (0, import_node_fs44.existsSync)(checkedOut.path)) {
     if (input.reuseExistingWorktree !== false) {
       worktreePath = checkedOut.path;
     } else {
@@ -16538,7 +16689,7 @@ async function initStackFromThread(input, onSetupLine) {
 async function createPrStack(input, onSetupLine) {
   await requireAgent(input.agent);
   const repoPath = await resolveRepoRoot(input.repoPath);
-  if (!(0, import_node_fs43.existsSync)(repoPath)) throw new Error(`Repo not found: ${repoPath}`);
+  if (!(0, import_node_fs44.existsSync)(repoPath)) throw new Error(`Repo not found: ${repoPath}`);
   if (!input.branches.length) throw new Error("At least one branch name required");
   const status = await detectGhStack(repoPath);
   if (!status.available) throw new Error(status.reason);
@@ -16605,7 +16756,7 @@ async function createPrStack(input, onSetupLine) {
     }
   }
   const claimed = new Set(threads.map((t) => t.worktreePath));
-  if (!claimed.has(bootstrap.worktreePath) && (0, import_node_fs43.existsSync)(bootstrap.worktreePath)) {
+  if (!claimed.has(bootstrap.worktreePath) && (0, import_node_fs44.existsSync)(bootstrap.worktreePath)) {
     try {
       await removeWorktree(repoPath, bootstrap.worktreePath, {
         deleteBranch: bootstrap.branchName
@@ -16615,11 +16766,11 @@ async function createPrStack(input, onSetupLine) {
   }
   return { stack, threads, createdThreadIds };
 }
-var import_node_fs43;
+var import_node_fs44;
 var init_stack_layers = __esm({
   "src/threads/stack-layers.ts"() {
     "use strict";
-    import_node_fs43 = require("fs");
+    import_node_fs44 = require("fs");
     init_detect();
     init_run();
     init_stack();
@@ -16632,7 +16783,7 @@ var init_stack_layers = __esm({
 
 // src/diff/diff.ts
 async function inspectGitWorktree(worktreePath) {
-  if (!worktreePath || !(0, import_node_fs44.existsSync)(worktreePath)) return "missing_worktree";
+  if (!worktreePath || !(0, import_node_fs45.existsSync)(worktreePath)) return "missing_worktree";
   const check = await git(["rev-parse", "--is-inside-work-tree"], worktreePath, {
     reject: false
   });
@@ -16640,7 +16791,7 @@ async function inspectGitWorktree(worktreePath) {
   return "ok";
 }
 async function initializeGitRepository(worktreePath) {
-  if (!worktreePath || !(0, import_node_fs44.existsSync)(worktreePath)) {
+  if (!worktreePath || !(0, import_node_fs45.existsSync)(worktreePath)) {
     throw new Error("Worktree not found");
   }
   const status = await inspectGitWorktree(worktreePath);
@@ -16774,11 +16925,11 @@ new file mode 100644
   };
 }
 async function untrackedPatch(worktreePath, path, maxHunk) {
-  const abs = (0, import_node_path41.join)(worktreePath, path);
+  const abs = (0, import_node_path42.join)(worktreePath, path);
   try {
-    const st = (0, import_node_fs44.statSync)(abs);
+    const st = (0, import_node_fs45.statSync)(abs);
     if (st.isFile() && st.size > maxHunk) {
-      const buf = (0, import_node_fs44.readFileSync)(abs).subarray(0, maxHunk);
+      const buf = (0, import_node_fs45.readFileSync)(abs).subarray(0, maxHunk);
       return syntheticAddPatch(path, buf.toString("utf8"), maxHunk);
     }
   } catch {
@@ -17267,8 +17418,8 @@ function isImageRelativePath(relativePath) {
 function readWorktreeFileForUpload(worktreePath, relativePath, opts) {
   assertSafeRelativePath(relativePath);
   const maxBytes = opts?.maxBytes ?? DEFAULT_UPLOAD_MAX_BYTES;
-  const abs = (0, import_node_path41.join)(worktreePath, relativePath);
-  const st = (0, import_node_fs44.statSync)(abs);
+  const abs = (0, import_node_path42.join)(worktreePath, relativePath);
+  const st = (0, import_node_fs45.statSync)(abs);
   if (!st.isFile()) {
     throw new Error(`Not a file: ${relativePath}`);
   }
@@ -17277,7 +17428,7 @@ function readWorktreeFileForUpload(worktreePath, relativePath, opts) {
       `File too large to upload (${st.size} bytes; max ${maxBytes})`
     );
   }
-  const buf = (0, import_node_fs44.readFileSync)(abs);
+  const buf = (0, import_node_fs45.readFileSync)(abs);
   return {
     path: relativePath,
     contentBase64: buf.toString("base64"),
@@ -17287,12 +17438,12 @@ function readWorktreeFileForUpload(worktreePath, relativePath, opts) {
 function readWorktreeFile(worktreePath, relativePath, opts) {
   assertSafeRelativePath(relativePath);
   const maxBytes = opts?.maxBytes ?? 2e5;
-  const abs = (0, import_node_path41.join)(worktreePath, relativePath);
-  const st = (0, import_node_fs44.statSync)(abs);
+  const abs = (0, import_node_path42.join)(worktreePath, relativePath);
+  const st = (0, import_node_fs45.statSync)(abs);
   if (!st.isFile()) {
     throw new Error(`Not a file: ${relativePath}`);
   }
-  const buf = (0, import_node_fs44.readFileSync)(abs);
+  const buf = (0, import_node_fs45.readFileSync)(abs);
   if (isImageRelativePath(relativePath)) {
     const maxImageBytes = Math.max(maxBytes, 15e6);
     const truncated2 = buf.length > maxImageBytes;
@@ -17335,9 +17486,9 @@ function assertSafeRelativePath(relativePath) {
 }
 function writeWorktreeFile(worktreePath, relativePath, content) {
   assertSafeRelativePath(relativePath);
-  const abs = (0, import_node_path41.join)(worktreePath, relativePath);
-  (0, import_node_fs44.mkdirSync)((0, import_node_path41.dirname)(abs), { recursive: true });
-  (0, import_node_fs44.writeFileSync)(abs, content, "utf8");
+  const abs = (0, import_node_path42.join)(worktreePath, relativePath);
+  (0, import_node_fs45.mkdirSync)((0, import_node_path42.dirname)(abs), { recursive: true });
+  (0, import_node_fs45.writeFileSync)(abs, content, "utf8");
   return { path: relativePath };
 }
 async function getDiffSummary(worktreePath, repoPath, opts) {
@@ -17354,12 +17505,12 @@ async function getDiffSummary(worktreePath, repoPath, opts) {
     truncated: full.files.length > maxFiles
   };
 }
-var import_node_fs44, import_node_path41, mergeBaseCache, MERGE_BASE_TTL_MS, SHA_RE, IMAGE_EXTENSIONS2, DEFAULT_UPLOAD_MAX_BYTES;
+var import_node_fs45, import_node_path42, mergeBaseCache, MERGE_BASE_TTL_MS, SHA_RE, IMAGE_EXTENSIONS2, DEFAULT_UPLOAD_MAX_BYTES;
 var init_diff = __esm({
   "src/diff/diff.ts"() {
     "use strict";
-    import_node_fs44 = require("fs");
-    import_node_path41 = require("path");
+    import_node_fs45 = require("fs");
+    import_node_path42 = require("path");
     init_run();
     init_worktree();
     mergeBaseCache = /* @__PURE__ */ new Map();
@@ -17635,7 +17786,7 @@ function parseFrontmatter(content) {
 }
 function readSkill(skillMd, source) {
   try {
-    const content = (0, import_node_fs45.readFileSync)(skillMd, "utf8");
+    const content = (0, import_node_fs46.readFileSync)(skillMd, "utf8");
     const { name: fmName, description } = parseFrontmatter(content);
     const dirName = skillMd.split("/").slice(-2, -1)[0] || "skill";
     const name = fmName || dirName;
@@ -17654,19 +17805,19 @@ function readSkill(skillMd, source) {
   }
 }
 function scanSkillsDir(dir, source, out) {
-  if (!(0, import_node_fs45.existsSync)(dir)) return;
+  if (!(0, import_node_fs46.existsSync)(dir)) return;
   let entries;
   try {
-    entries = (0, import_node_fs45.readdirSync)(dir);
+    entries = (0, import_node_fs46.readdirSync)(dir);
   } catch {
     return;
   }
   for (const entry of entries) {
     if (entry.startsWith(".")) continue;
-    const skillMd = (0, import_node_path42.join)(dir, entry, "SKILL.md");
-    if (!(0, import_node_fs45.existsSync)(skillMd)) continue;
+    const skillMd = (0, import_node_path43.join)(dir, entry, "SKILL.md");
+    if (!(0, import_node_fs46.existsSync)(skillMd)) continue;
     try {
-      if (!(0, import_node_fs45.statSync)(skillMd).isFile()) continue;
+      if (!(0, import_node_fs46.statSync)(skillMd).isFile()) continue;
     } catch {
       continue;
     }
@@ -17675,24 +17826,24 @@ function scanSkillsDir(dir, source, out) {
   }
 }
 function scanClaudePluginSkills(pluginsRoot, out) {
-  if (!(0, import_node_fs45.existsSync)(pluginsRoot)) return;
+  if (!(0, import_node_fs46.existsSync)(pluginsRoot)) return;
   const walk = (dir, depth, lookingForSkillsDir) => {
     if (depth > 7) return;
     let entries;
     try {
-      entries = (0, import_node_fs45.readdirSync)(dir);
+      entries = (0, import_node_fs46.readdirSync)(dir);
     } catch {
       return;
     }
     if (lookingForSkillsDir && entries.includes("SKILL.md")) {
-      const skill = readSkill((0, import_node_path42.join)(dir, "SKILL.md"), "cli");
+      const skill = readSkill((0, import_node_path43.join)(dir, "SKILL.md"), "cli");
       if (skill) out.push(skill);
     }
     for (const entry of entries) {
       if (entry === "node_modules" || entry === ".git") continue;
-      const full = (0, import_node_path42.join)(dir, entry);
+      const full = (0, import_node_path43.join)(dir, entry);
       try {
-        if (!(0, import_node_fs45.statSync)(full).isDirectory()) continue;
+        if (!(0, import_node_fs46.statSync)(full).isDirectory()) continue;
       } catch {
         continue;
       }
@@ -17710,17 +17861,17 @@ function discoverSkills(worktreePath) {
   const home = (0, import_node_os14.homedir)();
   const collected = [];
   for (const rel of [".claude/skills", ".cursor/skills", ".sideboard/skills", ".brightsy/skills", "skills"]) {
-    scanSkillsDir((0, import_node_path42.join)(worktreePath, rel), "workspace", collected);
+    scanSkillsDir((0, import_node_path43.join)(worktreePath, rel), "workspace", collected);
   }
   for (const abs of [
-    (0, import_node_path42.join)(home, ".claude/skills"),
-    (0, import_node_path42.join)(home, ".cursor/skills"),
-    (0, import_node_path42.join)(home, ".sideboard/skills"),
-    (0, import_node_path42.join)(home, ".brightsy/skills")
+    (0, import_node_path43.join)(home, ".claude/skills"),
+    (0, import_node_path43.join)(home, ".cursor/skills"),
+    (0, import_node_path43.join)(home, ".sideboard/skills"),
+    (0, import_node_path43.join)(home, ".brightsy/skills")
   ]) {
     scanSkillsDir(abs, "user", collected);
   }
-  scanClaudePluginSkills((0, import_node_path42.join)(home, ".claude/plugins"), collected);
+  scanClaudePluginSkills((0, import_node_path43.join)(home, ".claude/plugins"), collected);
   collected.push(...bundledSkills());
   const rank = {
     workspace: 0,
@@ -17746,7 +17897,7 @@ function readSkillBody(skillPath, maxChars = 12e3) {
 \u2026(truncated)` : body;
     }
   }
-  const raw = (0, import_node_fs45.readFileSync)(skillPath, "utf8");
+  const raw = (0, import_node_fs46.readFileSync)(skillPath, "utf8");
   if (raw.startsWith("---")) {
     const end = raw.indexOf("\n---", 3);
     if (end >= 0) {
@@ -17760,13 +17911,13 @@ function readSkillBody(skillPath, maxChars = 12e3) {
 
 \u2026(truncated)` : raw;
 }
-var import_node_fs45, import_node_os14, import_node_path42, BUNDLED_SKILL_PREFIX;
+var import_node_fs46, import_node_os14, import_node_path43, BUNDLED_SKILL_PREFIX;
 var init_discover = __esm({
   "src/skills/discover.ts"() {
     "use strict";
-    import_node_fs45 = require("fs");
+    import_node_fs46 = require("fs");
     import_node_os14 = require("os");
-    import_node_path42 = require("path");
+    import_node_path43 = require("path");
     init_long_running();
     BUNDLED_SKILL_PREFIX = "bundled:";
   }
@@ -17860,8 +18011,8 @@ var init_expand = __esm({
 // src/skills/detached-job-path.ts
 function detachedJobScriptIn(dir) {
   for (const name of DETACHED_JOB_FILENAMES) {
-    const script = (0, import_node_path43.join)(dir, "scripts", name);
-    if ((0, import_node_fs46.existsSync)(script)) return script;
+    const script = (0, import_node_path44.join)(dir, "scripts", name);
+    if ((0, import_node_fs47.existsSync)(script)) return script;
   }
   return null;
 }
@@ -17873,11 +18024,11 @@ function packagedDetachedJobPath() {
 function resolveDetachedJobScript() {
   const packaged = packagedDetachedJobPath();
   if (packaged) return packaged;
-  let dir = (0, import_node_path43.dirname)((0, import_node_url3.fileURLToPath)(import_meta3.url));
+  let dir = (0, import_node_path44.dirname)((0, import_node_url3.fileURLToPath)(import_meta3.url));
   for (let i = 0; i < 8; i++) {
     const candidate = detachedJobScriptIn(dir);
     if (candidate) return candidate;
-    const parent = (0, import_node_path43.dirname)(dir);
+    const parent = (0, import_node_path44.dirname)(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -17888,12 +18039,12 @@ function formatDetachedJobInvoke(scriptPath) {
   if (resolved) return `node ${JSON.stringify(resolved)}`;
   return "node scripts/detached-job.cjs";
 }
-var import_node_fs46, import_node_path43, import_node_url3, import_meta3, DETACHED_JOB_FILENAMES;
+var import_node_fs47, import_node_path44, import_node_url3, import_meta3, DETACHED_JOB_FILENAMES;
 var init_detached_job_path = __esm({
   "src/skills/detached-job-path.ts"() {
     "use strict";
-    import_node_fs46 = require("fs");
-    import_node_path43 = require("path");
+    import_node_fs47 = require("fs");
+    import_node_path44 = require("path");
     import_node_url3 = require("url");
     init_packaged_runtime();
     import_meta3 = {};
@@ -17971,7 +18122,7 @@ function formatWorktreeDirective(thread, opts) {
     );
   }
   lines.push(
-    '- Sideboard git buttons send short phrases ("Commit and push.", "Merge PR.", \u2026) with their meaning attached \u2014 act on them without asking for clarification. If the user gives a goal (Greptile 5/5, CI green, until checks pass), you get the watch-fix-push playbook with that request.'
+    '- Sideboard git buttons send short phrases ("Commit and push.", "Ready for review.", "Merge PR.", \u2026) with their meaning attached \u2014 act on them without asking for clarification. If the user gives a goal (Greptile 5/5, CI green, until checks pass), you get the watch-fix-push playbook with that request.'
   );
   lines.push("");
   lines.push(formatProcessGuideDirective({ worktreePath: thread.worktreePath }));
@@ -18051,9 +18202,9 @@ function formatPrGateDirective() {
 }
 function formatProcessGuideDirective(opts) {
   const worktree = opts?.worktreePath?.trim();
-  const hasGraphSkill = !!worktree && (0, import_node_fs47.existsSync)((0, import_node_path44.join)(worktree, ".claude/skills/graph-engineering/SKILL.md"));
-  const hasReviewSkill = !!worktree && (0, import_node_fs47.existsSync)((0, import_node_path44.join)(worktree, ".claude/skills/review/SKILL.md"));
-  const hasInstallSkill = !!worktree && (0, import_node_fs47.existsSync)((0, import_node_path44.join)(worktree, ".claude/skills/worktree-install/SKILL.md"));
+  const hasGraphSkill = !!worktree && (0, import_node_fs48.existsSync)((0, import_node_path45.join)(worktree, ".claude/skills/graph-engineering/SKILL.md"));
+  const hasReviewSkill = !!worktree && (0, import_node_fs48.existsSync)((0, import_node_path45.join)(worktree, ".claude/skills/review/SKILL.md"));
+  const hasInstallSkill = !!worktree && (0, import_node_fs48.existsSync)((0, import_node_path45.join)(worktree, ".claude/skills/worktree-install/SKILL.md"));
   return [
     "Process guides (recurring work only):",
     hasGraphSkill ? "- Migrations, ports, batch fixes, and other fan-out: follow `.claude/skills/graph-engineering/SKILL.md` (`/graph-engineering`). Judge first; state on disk; grow the rulebook; do not patch around it." : null,
@@ -18091,12 +18242,12 @@ function formatArtifactDirective() {
 function formatUiReminder() {
   return "Sideboard UI: markdown table is enough to read data; present_schema if they ask to edit/filter (even after markdown); present_files for the file manager. html fence or present_artifact, not both for the same document. type=log appends (same artifact_id, new lines only). ask_user only for a real multiple-choice (not hellos or \u201Cwhat next?\u201D) \u2014 reply in chat. Do not say artifacts/CMS UI are unavailable.";
 }
-var import_node_fs47, import_node_path44, PR_GOAL_RE, GITHUB_TICKET_REF, KEYED_TICKET_REF;
+var import_node_fs48, import_node_path45, PR_GOAL_RE, GITHUB_TICKET_REF, KEYED_TICKET_REF;
 var init_instructions = __esm({
   "src/agents/instructions.ts"() {
     "use strict";
-    import_node_fs47 = require("fs");
-    import_node_path44 = require("path");
+    import_node_fs48 = require("fs");
+    import_node_path45 = require("path");
     init_git_auth_mode();
     init_worktree_labels();
     init_detached_job_path();
@@ -18287,40 +18438,40 @@ __export(plan_file_exports, {
   writePlanFile: () => writePlanFile
 });
 function ensureAttachmentsGitignore(worktreePath) {
-  const gitignoreAbs = (0, import_node_path45.join)(worktreePath, ATTACHMENTS_DIR, ".gitignore");
-  if ((0, import_node_fs48.existsSync)(gitignoreAbs)) return;
-  (0, import_node_fs48.mkdirSync)((0, import_node_path45.dirname)(gitignoreAbs), { recursive: true });
-  (0, import_node_fs48.writeFileSync)(gitignoreAbs, attachmentsGitignoreBody(), "utf8");
+  const gitignoreAbs = (0, import_node_path46.join)(worktreePath, ATTACHMENTS_DIR, ".gitignore");
+  if ((0, import_node_fs49.existsSync)(gitignoreAbs)) return;
+  (0, import_node_fs49.mkdirSync)((0, import_node_path46.dirname)(gitignoreAbs), { recursive: true });
+  (0, import_node_fs49.writeFileSync)(gitignoreAbs, attachmentsGitignoreBody(), "utf8");
 }
 function planFileAbs(worktreePath) {
-  return (0, import_node_path45.join)(worktreePath, PLAN_FILE_REL);
+  return (0, import_node_path46.join)(worktreePath, PLAN_FILE_REL);
 }
 function readTextIfPresent2(abs) {
-  if (!(0, import_node_fs48.existsSync)(abs)) return null;
+  if (!(0, import_node_fs49.existsSync)(abs)) return null;
   try {
-    const content = (0, import_node_fs48.readFileSync)(abs, "utf8");
+    const content = (0, import_node_fs49.readFileSync)(abs, "utf8");
     return content.trim() ? content : null;
   } catch {
     return null;
   }
 }
 function readPlanFile(worktreePath) {
-  return readTextIfPresent2(planFileAbs(worktreePath)) ?? readTextIfPresent2((0, import_node_path45.join)(worktreePath, `${LEGACY_ATTACHMENTS_DIR}/plan.md`)) ?? readTextIfPresent2((0, import_node_path45.join)(worktreePath, LEGACY_PLAN_FILE_REL));
+  return readTextIfPresent2(planFileAbs(worktreePath)) ?? readTextIfPresent2((0, import_node_path46.join)(worktreePath, `${LEGACY_ATTACHMENTS_DIR}/plan.md`)) ?? readTextIfPresent2((0, import_node_path46.join)(worktreePath, LEGACY_PLAN_FILE_REL));
 }
 function writePlanFile(worktreePath, content) {
   ensureAttachmentsGitignore(worktreePath);
   const abs = planFileAbs(worktreePath);
-  (0, import_node_fs48.mkdirSync)((0, import_node_path45.dirname)(abs), { recursive: true });
+  (0, import_node_fs49.mkdirSync)((0, import_node_path46.dirname)(abs), { recursive: true });
   const body = content.trimEnd() + (content.endsWith("\n") ? "" : "\n");
-  (0, import_node_fs48.writeFileSync)(abs, body, "utf8");
+  (0, import_node_fs49.writeFileSync)(abs, body, "utf8");
   return PLAN_FILE_REL;
 }
-var import_node_fs48, import_node_path45;
+var import_node_fs49, import_node_path46;
 var init_plan_file = __esm({
   "src/plan/plan-file.ts"() {
     "use strict";
-    import_node_fs48 = require("fs");
-    import_node_path45 = require("path");
+    import_node_fs49 = require("fs");
+    import_node_path46 = require("path");
     init_workspace_scratch();
     init_plan_present();
     init_plan_present();
@@ -18380,7 +18531,7 @@ function setCaffeinateHoldHooks(next) {
   hooks = next;
 }
 function caffeinateHoldPath() {
-  return (0, import_node_path46.join)(appDataDir(), "caffeinate-hold.json");
+  return (0, import_node_path47.join)(appDataDir(), "caffeinate-hold.json");
 }
 function processAlive(pid) {
   if (hooks.processAlive) return hooks.processAlive(pid);
@@ -18414,9 +18565,9 @@ function uniqueIds(ids) {
 }
 function readHold() {
   const path = caffeinateHoldPath();
-  if (!(0, import_node_fs49.existsSync)(path)) return null;
+  if (!(0, import_node_fs50.existsSync)(path)) return null;
   try {
-    const parsed = JSON.parse((0, import_node_fs49.readFileSync)(path, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs50.readFileSync)(path, "utf8"));
     if (typeof parsed?.pid === "number" && parsed.pid > 0) {
       return {
         pid: parsed.pid,
@@ -18438,7 +18589,7 @@ function writeHold(pid, threadIds) {
 }
 function clearHold() {
   try {
-    (0, import_node_fs49.unlinkSync)(caffeinateHoldPath());
+    (0, import_node_fs50.unlinkSync)(caffeinateHoldPath());
   } catch {
   }
 }
@@ -18496,7 +18647,7 @@ function setCaffeinateHold(enabled, opts) {
   if (platform !== "darwin") {
     return idleState(platform);
   }
-  const spawnImpl = hooks.spawn ?? import_node_child_process4.spawn;
+  const spawnImpl = hooks.spawn ?? import_node_child_process5.spawn;
   const child = spawnImpl("caffeinate", ["-dimsu"], {
     detached: true,
     stdio: "ignore"
@@ -18523,13 +18674,13 @@ function releaseCaffeinateHoldForThread(threadId) {
   }
   return setCaffeinateHold(false, { threadId: id });
 }
-var import_node_child_process4, import_node_fs49, import_node_path46, hooks;
+var import_node_child_process5, import_node_fs50, import_node_path47, hooks;
 var init_caffeinate_hold = __esm({
   "src/store/caffeinate-hold.ts"() {
     "use strict";
-    import_node_child_process4 = require("child_process");
-    import_node_fs49 = require("fs");
-    import_node_path46 = require("path");
+    import_node_child_process5 = require("child_process");
+    import_node_fs50 = require("fs");
+    import_node_path47 = require("path");
     init_paths();
     init_private_file();
     hooks = {};
@@ -18538,7 +18689,7 @@ var init_caffeinate_hold = __esm({
 
 // src/store/schedules.ts
 function schedulesPath() {
-  return (0, import_node_path47.join)(appDataDir(), "schedules.json");
+  return (0, import_node_path48.join)(appDataDir(), "schedules.json");
 }
 function parseDurationMs(every) {
   const m = every.trim().match(DURATION_RE);
@@ -18638,9 +18789,9 @@ function normalizeTask(raw) {
 }
 function readAll2() {
   const path = schedulesPath();
-  if (!(0, import_node_fs50.existsSync)(path)) return [];
+  if (!(0, import_node_fs51.existsSync)(path)) return [];
   try {
-    const parsed = JSON.parse((0, import_node_fs50.readFileSync)(path, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs51.readFileSync)(path, "utf8"));
     if (!Array.isArray(parsed)) return [];
     return parsed.map((row) => {
       try {
@@ -18752,13 +18903,13 @@ function recordScheduleRun(id, result) {
   writeAll2(rows);
   return next;
 }
-var import_node_crypto9, import_node_fs50, import_node_path47, import_croner, DURATION_RE, UNIT_MS;
+var import_node_crypto9, import_node_fs51, import_node_path48, import_croner, DURATION_RE, UNIT_MS;
 var init_schedules = __esm({
   "src/store/schedules.ts"() {
     "use strict";
     import_node_crypto9 = require("crypto");
-    import_node_fs50 = require("fs");
-    import_node_path47 = require("path");
+    import_node_fs51 = require("fs");
+    import_node_path48 = require("path");
     import_croner = require("croner");
     init_orchestrator_capable();
     init_paths();
@@ -18900,13 +19051,13 @@ var init_schedule_runner = __esm({
 
 // src/agents/cursor-store.ts
 function cursorSdkStoreDir(threadId) {
-  const root = (0, import_node_path48.join)(appDataDir(), CURSOR_SDK_STORE_DIR);
+  const root = (0, import_node_path49.join)(appDataDir(), CURSOR_SDK_STORE_DIR);
   const id = sanitizeCursorStoreSegment(threadId);
   if (!id) return root;
-  return (0, import_node_path48.join)(root, "threads", id);
+  return (0, import_node_path49.join)(root, "threads", id);
 }
 function cursorSdkRunsNdjsonPath(threadId) {
-  return (0, import_node_path48.join)(cursorSdkStoreDir(threadId), "runs.ndjson");
+  return (0, import_node_path49.join)(cursorSdkStoreDir(threadId), "runs.ndjson");
 }
 function cursorSdkRunsNdjsonSearchPaths(threadId) {
   const scoped = cursorSdkRunsNdjsonPath(threadId);
@@ -18919,11 +19070,11 @@ function cursorSdkRunsNdjsonSearchPaths(threadId) {
 function sanitizeCursorStoreSegment(threadId) {
   return (threadId ?? "").trim().replace(/[^a-zA-Z0-9._-]/g, "_");
 }
-var import_node_path48, CURSOR_SDK_STORE_DIR;
+var import_node_path49, CURSOR_SDK_STORE_DIR;
 var init_cursor_store = __esm({
   "src/agents/cursor-store.ts"() {
     "use strict";
-    import_node_path48 = require("path");
+    import_node_path49 = require("path");
     init_paths();
     CURSOR_SDK_STORE_DIR = "cursor-sdk-store";
   }
@@ -18945,9 +19096,9 @@ function recoverFinishedCursorRun(opts) {
   return best;
 }
 function scanFinishedCursorRuns(runsPath, agentId, startedAfterMs) {
-  if (!(0, import_node_fs51.existsSync)(runsPath)) return null;
+  if (!(0, import_node_fs52.existsSync)(runsPath)) return null;
   try {
-    const lines = (0, import_node_fs51.readFileSync)(runsPath, "utf8").split("\n");
+    const lines = (0, import_node_fs52.readFileSync)(runsPath, "utf8").split("\n");
     let best = null;
     for (const line of lines) {
       const trimmed = line.trim();
@@ -18973,11 +19124,11 @@ function scanFinishedCursorRuns(runsPath, agentId, startedAfterMs) {
     return null;
   }
 }
-var import_node_fs51;
+var import_node_fs52;
 var init_cursor_recover = __esm({
   "src/agents/cursor-recover.ts"() {
     "use strict";
-    import_node_fs51 = require("fs");
+    import_node_fs52 = require("fs");
     init_cursor_store();
   }
 });
@@ -19109,13 +19260,13 @@ async function startOrchestration(opts) {
   }
   return updated;
 }
-var import_node_events, import_node_fs52, LIVE_TURN_SPAWN_GRACE_MS, STALE_AGENT_PID_WAIT_MS, Orchestrator, singleton;
+var import_node_events, import_node_fs53, LIVE_TURN_SPAWN_GRACE_MS, STALE_AGENT_PID_WAIT_MS, Orchestrator, singleton;
 var init_orchestrator = __esm({
   "src/orchestrator/orchestrator.ts"() {
     "use strict";
     import_node_events = require("events");
     init_outbound_watch();
-    import_node_fs52 = require("fs");
+    import_node_fs53 = require("fs");
     init_error_detail();
     init_run();
     init_stale_lock();
@@ -19288,7 +19439,7 @@ var init_orchestrator = __esm({
             }
             continue;
           }
-          if (!(0, import_node_fs52.existsSync)(thread.worktreePath)) {
+          if (!(0, import_node_fs53.existsSync)(thread.worktreePath)) {
             setStatus(thread.id, "broken", "Worktree missing on disk");
             this.emit({ type: "status_changed", threadId: thread.id, status: "broken" });
             continue;
@@ -20963,7 +21114,7 @@ var init_orchestrator = __esm({
             "ask_git targets a worktree agent thread (not the orchestrator). Pass a child/worktree thread ref."
           );
         }
-        if (action === "merge" && !thread.prUrl) {
+        if ((action === "merge" || action === "ready-for-review") && !thread.prUrl) {
           throw new Error(
             "No pull request linked. Ask the worktree agent to open a draft PR first (ask_git create-draft)."
           );
@@ -21179,7 +21330,7 @@ var init_orchestrator = __esm({
           this.emit({ type: "status_changed", threadId: restored2.id, status: restored2.status });
           return restored2;
         }
-        if (!(0, import_node_fs52.existsSync)(thread.worktreePath)) {
+        if (!(0, import_node_fs53.existsSync)(thread.worktreePath)) {
           if (isCowboyThread(thread) || isPrimaryCheckoutThread(thread)) {
             throw new Error(
               `Cowboy checkout missing: ${thread.worktreePath}. Re-add the project folder, then restore.`
@@ -21256,13 +21407,14 @@ var init_orchestrator = __esm({
 
 // src/mcp/run-stdio.ts
 init_nested_electron_env();
+init_system_ca();
 
 // src/mcp/server.ts
 var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
 var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
 var import_zod8 = require("zod");
 var import_node_crypto12 = require("crypto");
-var import_node_path51 = require("path");
+var import_node_path52 = require("path");
 init_orchestrator();
 init_worktree();
 
@@ -23854,27 +24006,27 @@ init_gh_errors();
 init_git_auth_mode();
 
 // src/board/load-home-board.ts
-var import_node_fs54 = require("fs");
-var import_node_path50 = require("path");
+var import_node_fs55 = require("fs");
+var import_node_path51 = require("path");
 init_worktree();
 init_paths();
 
 // src/board/board-pins.ts
 var import_node_crypto11 = require("crypto");
-var import_node_fs53 = require("fs");
-var import_node_path49 = require("path");
+var import_node_fs54 = require("fs");
+var import_node_path50 = require("path");
 init_paths();
 init_home_board();
 var FILE = "home-board-pins.json";
 var VERSION = 1;
 function pinsFile() {
-  return (0, import_node_path49.join)(appDataDir(), FILE);
+  return (0, import_node_path50.join)(appDataDir(), FILE);
 }
 function readDisk() {
   const path = pinsFile();
-  if (!(0, import_node_fs53.existsSync)(path)) return [];
+  if (!(0, import_node_fs54.existsSync)(path)) return [];
   try {
-    const raw = JSON.parse((0, import_node_fs53.readFileSync)(path, "utf8"));
+    const raw = JSON.parse((0, import_node_fs54.readFileSync)(path, "utf8"));
     if (raw?.version !== VERSION || !Array.isArray(raw.items)) return [];
     return raw.items.filter((item) => item?.id && item.kind && item.ref);
   } catch {
@@ -23882,8 +24034,8 @@ function readDisk() {
   }
 }
 function writeDisk(items) {
-  (0, import_node_fs53.mkdirSync)(appDataDir(), { recursive: true });
-  (0, import_node_fs53.writeFileSync)(pinsFile(), JSON.stringify({ version: VERSION, items }, null, 2), "utf8");
+  (0, import_node_fs54.mkdirSync)(appDataDir(), { recursive: true });
+  (0, import_node_fs54.writeFileSync)(pinsFile(), JSON.stringify({ version: VERSION, items }, null, 2), "utf8");
 }
 function listBoardPins() {
   return readDisk();
@@ -23904,7 +24056,7 @@ function homeBoardWorkspaceKey(workspaces) {
   return workspaces.map((w) => w.path).filter(Boolean).sort().join("\n");
 }
 function cacheFile() {
-  return (0, import_node_path50.join)(appDataDir(), "home-board-cache.json");
+  return (0, import_node_path51.join)(appDataDir(), "home-board-cache.json");
 }
 function emptyInputs() {
   return {
@@ -23930,9 +24082,9 @@ function shouldCacheHomeBoardInputs(inputs) {
 }
 function readDiskCache() {
   const path = cacheFile();
-  if (!(0, import_node_fs54.existsSync)(path)) return null;
+  if (!(0, import_node_fs55.existsSync)(path)) return null;
   try {
-    const raw = JSON.parse((0, import_node_fs54.readFileSync)(path, "utf8"));
+    const raw = JSON.parse((0, import_node_fs55.readFileSync)(path, "utf8"));
     if (raw?.version !== CACHE_VERSION || typeof raw.fetchedAt !== "number") {
       return null;
     }
@@ -23946,8 +24098,8 @@ function readDiskCache() {
 }
 function writeDiskCache(entry) {
   try {
-    (0, import_node_fs54.mkdirSync)(appDataDir(), { recursive: true });
-    (0, import_node_fs54.writeFileSync)(cacheFile(), JSON.stringify(entry), "utf8");
+    (0, import_node_fs55.mkdirSync)(appDataDir(), { recursive: true });
+    (0, import_node_fs55.writeFileSync)(cacheFile(), JSON.stringify(entry), "utf8");
   } catch {
   }
 }
@@ -24075,6 +24227,54 @@ async function getHomeBoardInputs(workspaces, opts) {
 
 // src/mcp/server.ts
 init_home_board();
+
+// src/mcp/create-thread-agent.ts
+init_cursor();
+function resolveOrchCreateThreadOptions(input) {
+  const { resolveNewThreadOptions: resolveNewThreadOptions2 } = input;
+  const account = resolveNewThreadOptions2({});
+  const requested = input.requestedAgent;
+  const parent = input.parentAgent ?? void 0;
+  const cursorReady = input.cursorReady ?? isCursorApiKeyConfigured();
+  let agent = account.agent;
+  let ignoredAgent;
+  let honorRequestedModel = false;
+  if (requested) {
+    const parentEcho = Boolean(parent) && requested === parent && requested !== account.agent;
+    const cursorAutofill = requested === "cursor" && account.agent !== "cursor";
+    if (parentEcho || cursorAutofill) {
+      ignoredAgent = requested;
+    } else {
+      agent = requested;
+      honorRequestedModel = input.requestedModel !== void 0;
+    }
+  }
+  let coercedFrom;
+  if (agent === "codex" && parent === "codex" && cursorReady) {
+    coercedFrom = requested ?? "codex";
+    agent = "cursor";
+  }
+  const opts = resolveNewThreadOptions2({
+    agent,
+    model: honorRequestedModel ? input.requestedModel : void 0
+  });
+  return {
+    ...opts,
+    ...ignoredAgent ? { ignoredAgent } : {},
+    ...coercedFrom ? { coercedFrom } : {}
+  };
+}
+function orchCreateThreadAgentNote(input) {
+  if (input.coercedFrom) {
+    return `Avoid nested Codex under a Codex orchestrator \u2014 used agent=${input.agent}`;
+  }
+  if (input.ignoredAgent) {
+    return `Ignored agent=${input.ignoredAgent} \u2014 used Account default agent=${input.agent}`;
+  }
+  return void 0;
+}
+
+// src/mcp/server.ts
 var MAX_ORCH_THREADS = 5;
 var CREATE_THREAD_TIMEOUT_MS = 9e4;
 function withTimeout(promise, ms, label) {
@@ -24122,18 +24322,13 @@ async function createOrchChildThread(orch, args, resolveNewThreadOptions2) {
       };
     }
   }
-  let agentArg = args.agent;
-  let agentCoercedFrom;
-  const resolvedProbe = resolveNewThreadOptions2({ agent: agentArg }).agent;
-  if (resolvedProbe === "codex") {
-    agentCoercedFrom = agentArg ?? "codex";
-    const accountAgent = resolveNewThreadOptions2({}).agent;
-    agentArg = accountAgent !== "codex" ? accountAgent : "cursor";
-  }
-  const opts = resolveNewThreadOptions2({
-    agent: agentArg,
-    model: args.model
+  const opts = resolveOrchCreateThreadOptions({
+    requestedAgent: args.agent,
+    requestedModel: args.model,
+    parentAgent: parent?.agent,
+    resolveNewThreadOptions: resolveNewThreadOptions2
   });
+  const agentNote = orchCreateThreadAgentNote(opts);
   try {
     const priorIds = new Set(orch.getThreads(false).map((t) => t.id));
     const thread = await withTimeout(
@@ -24169,10 +24364,9 @@ async function createOrchChildThread(orch, args, resolveNewThreadOptions2) {
         link: `sideboard://thread/${thread.id}`,
         parentThreadId: thread.parentThreadId,
         ...alreadyStarted ? { alreadyStarted: true } : {},
-        ...agentCoercedFrom ? {
-          agentCoercedFrom,
-          note: `Avoid nested Codex under a Codex orchestrator \u2014 used Account default agent=${thread.agent}`
-        } : {},
+        ...opts.coercedFrom ? { agentCoercedFrom: opts.coercedFrom } : {},
+        ...opts.ignoredAgent ? { agentIgnored: opts.ignoredAgent } : {},
+        ...agentNote ? { note: agentNote } : {},
         ...parentCorrectedFrom ? { parentCorrectedFrom, parentNote } : {}
       })
     };
@@ -24247,7 +24441,7 @@ async function startMcpServer() {
       async () => {
         const threads = orch.getThreads(true);
         const lines = threads.map((t) => {
-          const repo = t.repoPath === GLOBAL_WORKSPACE_ID ? "Orchestration" : (0, import_node_path51.basename)(t.repoPath) || t.repoPath;
+          const repo = t.repoPath === GLOBAL_WORKSPACE_ID ? "Orchestration" : (0, import_node_path52.basename)(t.repoPath) || t.repoPath;
           const live = orch.threadLooksLive(t) ? readTurnLive(t.id) : null;
           const parent = t.parentThreadId ? `  parent:${t.parentThreadId.slice(0, 8)}` : "";
           const preview = lastMessagePreview(t.messages, 80);
@@ -24532,11 +24726,13 @@ async function startMcpServer() {
     );
     server.tool(
       "create_thread",
-      `Create a worktree thread (chat) from branch, pr, or ticket. A ticket, PR, or named branch may have only one live worktree \u2014 if one already matches, returns it (alreadyStarted=true) instead of a second checkout. Creating from the default branch still opens a new isolated worktree. Pass repoPath from list_workspaces. cowboy=true uses the project folder on the default branch (no isolated worktree; land is commit+push). From an orchestration chat, omit parentThreadId (Sideboard binds the child to this chat) or pass the exact id from the turn reminder \u2014 never invent a uuid. Prefer omitting agent/model so Sideboard applies ${accountDefaultsHint}. Setup (settings.toml, .cursor/worktrees.json, or script/setup) runs in the background in parallel with the first turn (skipped for cowboy). Then use send_to_thread to chat.`,
+      `Create a worktree thread (chat) from branch, pr, or ticket. A ticket, PR, or named branch may have only one live worktree \u2014 if one already matches, returns it (alreadyStarted=true) instead of a second checkout. Creating from the default branch still opens a new isolated worktree. Pass repoPath from list_workspaces. cowboy=true uses the project folder on the default branch (no isolated worktree; land is commit+push). From an orchestration chat, omit parentThreadId (Sideboard binds the child to this chat) or pass the exact id from the turn reminder \u2014 never invent a uuid. Omit agent/model \u2014 Sideboard applies ${accountDefaultsHint}. Do not pass your own agent or agent=cursor; those are ignored. Setup (settings.toml, .cursor/worktrees.json, or script/setup) runs in the background in parallel with the first turn (skipped for cowboy). Then use send_to_thread to chat.`,
       {
         sourceType: import_zod8.z.enum(["branch", "pr", "ticket"]),
         sourceRef: import_zod8.z.string(),
-        agent: import_zod8.z.enum(["claude", "codex", "opencode", "brightsy", "cursor"]).optional().describe(`Omit to use Account default agent (${accountDefaults.agent})`),
+        agent: import_zod8.z.enum(["claude", "codex", "opencode", "brightsy", "cursor"]).optional().describe(
+          `Usually omit. Sideboard uses Account default agent (${accountDefaults.agent}). Passing your own agent or cursor is ignored.`
+        ),
         model: import_zod8.z.string().nullable().optional().describe(
           `Usually omit to use Account default model (${accountDefaults.model?.trim() || "Auto"}). Pass null only to force Auto / agent-default.`
         ),
@@ -24840,11 +25036,11 @@ async function startMcpServer() {
     );
     server.tool(
       "ask_git",
-      "Commit & push, open a draft PR, resolve conflicts, or merge \u2014 same actions as the desktop git buttons. When the worktree is clean, Sideboard pushes / opens the PR itself (HTTPS via `gh` even when origin is SSH / Settings \u2192 Git is SSH). When dirty, queues the worktree agent to commit; then wait_for_turn (loop while stillRunning). Do not start a checks loop on a plain push \u2014 only if the user gave a goal (Greptile 5/5, CI green). Pass a worktree thread ref (not the orchestrator). action=merge only when the user explicitly asked to merge that PR. Do not run git or gh from the orchestration cwd. If this tool errors that the GraphQL/PR body is too long, the branch is already pushed \u2014 have the worktree agent retry `gh pr create --body-file` with a short description (GitHub limit 65,536 characters). Do not invent SSH/auth failures from that error.",
+      "Commit & push, open a draft PR, mark ready for review, resolve conflicts, or merge \u2014 same actions as the desktop git buttons. When the worktree is clean, Sideboard pushes / opens the PR itself (HTTPS via `gh` even when origin is SSH / Settings \u2192 Git is SSH). When dirty, queues the worktree agent to commit; then wait_for_turn (loop while stillRunning). Do not start a checks loop on a plain push \u2014 only if the user gave a goal (Greptile 5/5, CI green). Pass a worktree thread ref (not the orchestrator). action=ready-for-review and action=merge only when the user explicitly asked (or clicked the desktop button). Do not run git or gh from the orchestration cwd. If this tool errors that the GraphQL/PR body is too long, the branch is already pushed \u2014 have the worktree agent retry `gh pr create --body-file` with a short description (GitHub limit 65,536 characters). Do not invent SSH/auth failures from that error.",
       {
         ref: import_zod8.z.string().describe("Worktree thread id/ref"),
         action: import_zod8.z.enum(AGENT_GIT_ACTIONS).describe(
-          "commit-push | create-draft | create-web | resolve-conflicts | merge"
+          "commit-push | create-draft | create-web | resolve-conflicts | ready-for-review | merge"
         )
       },
       async ({ ref, action }) => {
@@ -25243,6 +25439,12 @@ async function startMcpServer() {
 
 // src/mcp/run-stdio.ts
 dropNestedElectronEnvFromProcess();
+var systemCaBundle = materializeSystemCaBundle();
+if (systemCaBundle && !process.env.NODE_EXTRA_CA_CERTS?.trim()) {
+  process.env.NODE_EXTRA_CA_CERTS = systemCaBundle;
+}
+applySystemCaEnv(process.env);
+trustSystemCertificates();
 startMcpServer().catch((err) => {
   console.error(err);
   process.exitCode = 1;