@sideboard-ai/core 0.1.287 → 0.1.288

package/dist/{chunk-5T4YWFLD.js → chunk-AHH5USEA.js}

@@ -6,14 +6,14 @@ import {
   normalizeAbleTimeCredential,
   normalizeAbleTimeHost,
   rewriteAbleTimeError
-} from "./chunk-VQEARG5H.js";
+} from "./chunk-GU6DT6NO.js";
 import {
   httpFetch
 } from "./chunk-2GPQZZLY.js";
 import {
   getAbleTimeAccessToken,
   getAbleTimeHost
-} from "./chunk-WRIMAEF2.js";
+} from "./chunk-MVZO7QZ2.js";
 
 // src/integrations/abletime-rest.ts
 var ABLETIME_REST_PREFIX = "/api/public/v2";

package/dist/{chunk-6CVVNAIU.js → chunk-B3BPLPKQ.js}

@@ -4,14 +4,14 @@ import {
   normalizeAbleTimeCredential,
   normalizeAbleTimeHost,
   rewriteAbleTimeError
-} from "./chunk-DEJALWKM.js";
+} from "./chunk-NFPWLDCH.js";
 import {
   httpFetch
 } from "./chunk-JAT3JFOS.js";
 import {
   getAbleTimeAccessToken,
   getAbleTimeHost
-} from "./chunk-YNTXWFXT.js";
+} from "./chunk-36J3IZBS.js";
 
 // src/integrations/abletime-rest.ts
 var ABLETIME_REST_PREFIX = "/api/public/v2";

package/dist/{chunk-ZGAMETNF.js → chunk-DBOFDEQ7.js}

@@ -3,7 +3,7 @@ import {
   ensureGhPreferOrigin,
   resolveGithubRepoSlug,
   resolveRepoRoot
-} from "./chunk-K5XSTHHP.js";
+} from "./chunk-HNB2HTCV.js";
 import {
   allocateTeamName,
   createEmptyThread,
@@ -29,7 +29,7 @@ import {
   resolveThreadDefaults,
   resolveViewerProfile,
   resolveViewerProfileForRepo
-} from "./chunk-YNTXWFXT.js";
+} from "./chunk-36J3IZBS.js";
 import {
   appDataDir,
   globalAgentCwd,
@@ -391,7 +391,7 @@ var COORDINATOR_TOOL_PLAYBOOK = [
   "- linear_* (when Linear is connected) \u2014 list_teams for team key/states; linear_list_projects for project names; get/search include the project a ticket is on; get/create/update/comment with ENG-123. Worktree agents have the same Account tools \u2014 prefer they comment, update status, and create spin-offs (parent=) on their own ticket when they were asked to do the work. When reviewing a PR or ticket, do not comment or update until the user types a next step \u2014 they should work through the feedback in chat first. Do not tell the child to ask_user after the review. Scope errors: reconnect Linear in Account settings. Prefer these over any Linear MCP the CLI may still list.",
   "- github_* \u2014 get/comment/update/create GitHub issues via Account `gh` (#123). github_list_projects and get/search include GitHub Projects. projectsError or a missing read:project scope \u2192 `gh auth refresh -s read:project`. Worktree agents have these too. Prefer over any vendor GitHub MCP. Pass parent= for spin-offs. When reviewing a PR or ticket, do not comment, submit `gh pr review`, or update the PR/ticket until the user types a next step.",
   "- abletime_* (when AbleTime is connected) \u2014 orientation first; abletime_list_projects lists projects; get/list include the project a task is on; get/comment/update/create (parent= for spin-offs); ensure_task when work has no ticket (or create_workspace from the default branch auto-creates one). Worktree agents have the same Account tools. Same review-write gate as Linear/GitHub.",
-  "- Optional connectors (Vercel, Supabase, PostHog, Sentry) in Settings \u2192 Connectors inject tokens into worktree agent env when connected. Prefer official CLIs (`vercel`, `supabase`, `sentry-cli`) with those env vars. PostHog has no first-class CLI \u2014 use the HTTP API (`POSTHOG_PERSONAL_API_KEY`). If a connector MCP is listed but needsAuth or unauthorized, do not sign in \u2014 check that native CLI or HTTP API. Tell any worktree agent (Claude / Cursor / Codex / OpenCode) to write CLI output to `.context/cli/` (not `.context/attachments/`) and read a slice \u2014 never stream raw `--json` / `--expand` into a tool result (that crashes the turn). They can `stop_job` if a detached fetch hangs. If a CLI is missing, the user can Install CLI on that row (not auto-installed on Connect). Do not add vendor MCPs or ask the user to paste tokens again. Git (`gh`) stays Settings \u2192 Git; issue tracking stays Settings \u2192 Issues. The phone remote is Settings \u2192 Remote \u2014 do not look up Slack users.",
+  "- Optional connectors (Vercel, Supabase, Sentry) in Settings \u2192 Connectors inject tokens into worktree agent env when connected. Prefer official CLIs (`vercel`, `supabase`, `sentry-cli`). PostHog is the Sideboard tool `posthog_api` (GET by default; POST `/api/projects/:id/query/` or `/api/environments/:id/query/` is a read and does not need write=true; other POST and PATCH need write=true only when the user asked to change data). The PostHog key stays in the vault \u2014 do not read it from the environment. If a connector MCP needsAuth or is unauthorized, do not sign in \u2014 use the native CLI or `posthog_api`. Tell any worktree agent (Claude / Cursor / Codex / OpenCode) to write CLI output to `.context/cli/` and read a slice. If a CLI is missing, the user presses Install CLI on that row. Do not add vendor MCPs. Git (`gh`) stays Settings \u2192 Git; issue tracking stays Settings \u2192 Issues. The phone remote is Settings \u2192 Remote \u2014 do not look up Slack users.",
   "- get_pr_stack / open_pr_stack_layers / add_stack_layer / create_pr_stack \u2014 GitHub stacked PRs (`gh stack`); one worktree per layer",
   "- list_models \u2014 only when you need a specific model (rare); otherwise omit model so Account defaults apply",
   "- list_chats / get_chat \u2014 live thread list (parent id + last message preview). get_chat on this orchestration chat lists child worktree agents (status + lastText). blockedReason is why that agent is waiting on a person. Also includes usage / lastTurnUsage.",

package/dist/{chunk-VQEARG5H.js → chunk-GU6DT6NO.js}

@@ -6,7 +6,7 @@ import {
 import {
   getAbleTimeHost,
   isAbleTimeConnected
-} from "./chunk-WRIMAEF2.js";
+} from "./chunk-MVZO7QZ2.js";
 
 // src/integrations/abletime-mcp.ts
 var DEFAULT_ABLETIME_HOST = "https://track.abletime.com";
@@ -155,7 +155,7 @@ function textsFromUnknown(value) {
   return "";
 }
 async function abletimeMcpRequest(method, params, opts) {
-  const rawToken = opts?.token ?? await import("./abletime-oauth-7OZZ3ABX.js").then((m) => m.ensureAbleTimeAccessToken());
+  const rawToken = opts?.token ?? await import("./abletime-oauth-FW24YHYX.js").then((m) => m.ensureAbleTimeAccessToken());
   if (!rawToken?.trim()) {
     throw new Error("AbleTime is not connected \u2014 paste a personal access token in Account settings");
   }
@@ -226,9 +226,9 @@ async function callAbleTimeTool(name, args = {}, opts) {
   if (!opts?.token && !isAbleTimeConnected()) {
     throw new Error("AbleTime is not connected \u2014 paste a personal access token in Account settings");
   }
-  const rawToken = opts?.token ?? await import("./abletime-oauth-7OZZ3ABX.js").then((m) => m.ensureAbleTimeAccessToken());
+  const rawToken = opts?.token ?? await import("./abletime-oauth-FW24YHYX.js").then((m) => m.ensureAbleTimeAccessToken());
   if (rawToken && ableTimeUsesRest(rawToken)) {
-    const { callAbleTimeRestTool } = await import("./abletime-rest-WFI2HWBU.js");
+    const { callAbleTimeRestTool } = await import("./abletime-rest-OGWC7BC6.js");
     return callAbleTimeRestTool(name, args, { ...opts, token: rawToken });
   }
   const requestOpts = { ...opts, pm: opts?.pm ?? abletimeToolUsesPm(name) };
@@ -244,7 +244,7 @@ async function callAbleTimeTool(name, args = {}, opts) {
       return await call();
     }
     if (rawToken && ableTimeUsesRest(rawToken) && isAbleTimeRejectedCredential(message)) {
-      const { callAbleTimeRestTool } = await import("./abletime-rest-WFI2HWBU.js");
+      const { callAbleTimeRestTool } = await import("./abletime-rest-OGWC7BC6.js");
       return callAbleTimeRestTool(name, args, { ...opts, token: rawToken });
     }
     throw err instanceof Error ? new Error(rewriteAbleTimeError(err.message)) : err;

package/dist/{chunk-K5XSTHHP.js → chunk-HNB2HTCV.js}

@@ -24,7 +24,7 @@ import {
 import {
   getGithubGitAuthMode,
   getGithubPat
-} from "./chunk-YNTXWFXT.js";
+} from "./chunk-36J3IZBS.js";
 import {
   worktreesRoot
 } from "./chunk-EHT2DRT4.js";

package/dist/{chunk-KLAQ4G34.js → chunk-IA4MPG7F.js}

@@ -5,7 +5,7 @@ import {
   ensureGhPreferOrigin,
   resolveGithubRepoSlug,
   resolveRepoRoot
-} from "./chunk-5MGLNVNK.js";
+} from "./chunk-3W5SL5EW.js";
 import {
   ATTACHMENTS_DIR,
   attachmentsGitignoreBody
@@ -22,7 +22,7 @@ import {
   resolveThreadDefaults,
   resolveViewerProfile,
   resolveViewerProfileForRepo
-} from "./chunk-WRIMAEF2.js";
+} from "./chunk-MVZO7QZ2.js";
 import {
   allocateTeamName,
   createEmptyThread,
@@ -346,7 +346,7 @@ var COORDINATOR_TOOL_PLAYBOOK = [
   "- linear_* (when Linear is connected) \u2014 list_teams for team key/states; linear_list_projects for project names; get/search include the project a ticket is on; get/create/update/comment with ENG-123. Worktree agents have the same Account tools \u2014 prefer they comment, update status, and create spin-offs (parent=) on their own ticket when they were asked to do the work. When reviewing a PR or ticket, do not comment or update until the user types a next step \u2014 they should work through the feedback in chat first. Do not tell the child to ask_user after the review. Scope errors: reconnect Linear in Account settings. Prefer these over any Linear MCP the CLI may still list.",
   "- github_* \u2014 get/comment/update/create GitHub issues via Account `gh` (#123). github_list_projects and get/search include GitHub Projects. projectsError or a missing read:project scope \u2192 `gh auth refresh -s read:project`. Worktree agents have these too. Prefer over any vendor GitHub MCP. Pass parent= for spin-offs. When reviewing a PR or ticket, do not comment, submit `gh pr review`, or update the PR/ticket until the user types a next step.",
   "- abletime_* (when AbleTime is connected) \u2014 orientation first; abletime_list_projects lists projects; get/list include the project a task is on; get/comment/update/create (parent= for spin-offs); ensure_task when work has no ticket (or create_workspace from the default branch auto-creates one). Worktree agents have the same Account tools. Same review-write gate as Linear/GitHub.",
-  "- Optional connectors (Vercel, Supabase, PostHog, Sentry) in Settings \u2192 Connectors inject tokens into worktree agent env when connected. Prefer official CLIs (`vercel`, `supabase`, `sentry-cli`) with those env vars. PostHog has no first-class CLI \u2014 use the HTTP API (`POSTHOG_PERSONAL_API_KEY`). If a connector MCP is listed but needsAuth or unauthorized, do not sign in \u2014 check that native CLI or HTTP API. Tell any worktree agent (Claude / Cursor / Codex / OpenCode) to write CLI output to `.context/cli/` (not `.context/attachments/`) and read a slice \u2014 never stream raw `--json` / `--expand` into a tool result (that crashes the turn). They can `stop_job` if a detached fetch hangs. If a CLI is missing, the user can Install CLI on that row (not auto-installed on Connect). Do not add vendor MCPs or ask the user to paste tokens again. Git (`gh`) stays Settings \u2192 Git; issue tracking stays Settings \u2192 Issues. The phone remote is Settings \u2192 Remote \u2014 do not look up Slack users.",
+  "- Optional connectors (Vercel, Supabase, Sentry) in Settings \u2192 Connectors inject tokens into worktree agent env when connected. Prefer official CLIs (`vercel`, `supabase`, `sentry-cli`). PostHog is the Sideboard tool `posthog_api` (GET by default; POST `/api/projects/:id/query/` or `/api/environments/:id/query/` is a read and does not need write=true; other POST and PATCH need write=true only when the user asked to change data). The PostHog key stays in the vault \u2014 do not read it from the environment. If a connector MCP needsAuth or is unauthorized, do not sign in \u2014 use the native CLI or `posthog_api`. Tell any worktree agent (Claude / Cursor / Codex / OpenCode) to write CLI output to `.context/cli/` and read a slice. If a CLI is missing, the user presses Install CLI on that row. Do not add vendor MCPs. Git (`gh`) stays Settings \u2192 Git; issue tracking stays Settings \u2192 Issues. The phone remote is Settings \u2192 Remote \u2014 do not look up Slack users.",
   "- get_pr_stack / open_pr_stack_layers / add_stack_layer / create_pr_stack \u2014 GitHub stacked PRs (`gh stack`); one worktree per layer",
   "- list_models \u2014 only when you need a specific model (rare); otherwise omit model so Account defaults apply",
   "- list_chats / get_chat \u2014 live thread list (parent id + last message preview). get_chat on this orchestration chat lists child worktree agents (status + lastText). blockedReason is why that agent is waiting on a person. Also includes usage / lastTurnUsage.",

package/dist/{chunk-S2OOM7AU.js → chunk-K6IOJI3L.js}

@@ -1,7 +1,7 @@
 import {
   clipToolResultForStore,
   looksLikeHugeToolResultDump
-} from "./chunk-U6QDXT4K.js";
+} from "./chunk-MIVX7QKI.js";
 import {
   CLI_DIR
 } from "./chunk-6K64FJDD.js";

package/dist/{chunk-U6QDXT4K.js → chunk-MIVX7QKI.js}

@@ -269,7 +269,7 @@ function humanizeAgentFailDetail(detail) {
     return "Cursor local file search failed (ripgrep / resource_exhausted). Wait a minute and retry; if it keeps happening, check Cursor usage.";
   }
   if (looksLikeCodexMcpError(raw)) {
-    return `${raw} \u2014 skip that vendor MCP and continue (PostHog: Settings \u2192 Connectors + HTTP API).`;
+    return `${raw} \u2014 skip that vendor MCP and continue (PostHog: Settings \u2192 Connectors and posthog_api).`;
   }
   if (/invalid user api key|invalid api key|not logged in|not authenticated|unauthorized|authentication|please run.*login|codex login|claude auth|cursor api/.test(
     lower

package/dist/{chunk-WRIMAEF2.js → chunk-MVZO7QZ2.js}

@@ -2211,22 +2211,21 @@ function applyAppEnvironment(target = process.env, settings = loadAppSettings())
   applyOptionalServiceTokens(target, settings.integrations);
   return target;
 }
-function fillEnvGap(target, key, value) {
+function assignEnv(target, key, value) {
   const v = value?.trim();
   if (!key || !v) return;
-  if (target[key] == null || target[key] === "") target[key] = v;
+  target[key] = v;
+}
+function scrubPosthogAgentEnv(target) {
+  delete target.POSTHOG_PERSONAL_API_KEY;
+  delete target.POSTHOG_HOST;
 }
 function applyOptionalServiceTokens(target, integrations) {
-  fillEnvGap(target, "VERCEL_TOKEN", integrations.vercelToken);
-  fillEnvGap(target, "SUPABASE_ACCESS_TOKEN", integrations.supabaseAccessToken);
-  fillEnvGap(target, "POSTHOG_PERSONAL_API_KEY", integrations.posthogPersonalApiKey);
-  fillEnvGap(
-    target,
-    "POSTHOG_HOST",
-    integrations.posthogPersonalApiKey ? integrations.posthogHost || "https://us.posthog.com" : void 0
-  );
-  fillEnvGap(target, "SENTRY_AUTH_TOKEN", integrations.sentryAuthToken);
-  fillEnvGap(
+  assignEnv(target, "VERCEL_TOKEN", integrations.vercelToken);
+  assignEnv(target, "SUPABASE_ACCESS_TOKEN", integrations.supabaseAccessToken);
+  scrubPosthogAgentEnv(target);
+  assignEnv(target, "SENTRY_AUTH_TOKEN", integrations.sentryAuthToken);
+  assignEnv(
     target,
     "SENTRY_URL",
     integrations.sentryAuthToken ? integrations.sentryHost || "https://sentry.io" : void 0
@@ -2241,6 +2240,7 @@ function childEnvWithAppSettings(extra) {
       if (v != null) env[k] = v;
     }
   }
+  scrubPosthogAgentEnv(env);
   return env;
 }
 function harnessEnvKey(harness) {

package/dist/{chunk-LS4FFCPL.js → chunk-MYJYINTS.js}

@@ -1,13 +1,13 @@
 import {
   abletimeRestUrl,
   textFromAbleTimeDoc
-} from "./chunk-6CVVNAIU.js";
+} from "./chunk-B3BPLPKQ.js";
 import {
   assertAbleTimeCredential,
   callAbleTimeTool,
   normalizeAbleTimeHost,
   rewriteAbleTimeError
-} from "./chunk-DEJALWKM.js";
+} from "./chunk-NFPWLDCH.js";
 import {
   httpFetch
 } from "./chunk-JAT3JFOS.js";
@@ -20,7 +20,7 @@ import {
   getAbleTimeHost,
   isAbleTimeConnected,
   saveAbleTimeConnection
-} from "./chunk-YNTXWFXT.js";
+} from "./chunk-36J3IZBS.js";
 
 // src/integrations/issue-attachments.ts
 import { existsSync, mkdirSync, writeFileSync } from "fs";

package/dist/{chunk-DEJALWKM.js → chunk-NFPWLDCH.js}

@@ -4,7 +4,7 @@ import {
 import {
   getAbleTimeHost,
   isAbleTimeConnected
-} from "./chunk-YNTXWFXT.js";
+} from "./chunk-36J3IZBS.js";
 
 // src/integrations/abletime-mcp.ts
 var DEFAULT_ABLETIME_HOST = "https://track.abletime.com";
@@ -153,7 +153,7 @@ function textsFromUnknown(value) {
   return "";
 }
 async function abletimeMcpRequest(method, params, opts) {
-  const rawToken = opts?.token ?? await import("./abletime-oauth-C2HN2Q6F.js").then((m) => m.ensureAbleTimeAccessToken());
+  const rawToken = opts?.token ?? await import("./abletime-oauth-ICMB2XV2.js").then((m) => m.ensureAbleTimeAccessToken());
   if (!rawToken?.trim()) {
     throw new Error("AbleTime is not connected \u2014 paste a personal access token in Account settings");
   }
@@ -224,9 +224,9 @@ async function callAbleTimeTool(name, args = {}, opts) {
   if (!opts?.token && !isAbleTimeConnected()) {
     throw new Error("AbleTime is not connected \u2014 paste a personal access token in Account settings");
   }
-  const rawToken = opts?.token ?? await import("./abletime-oauth-C2HN2Q6F.js").then((m) => m.ensureAbleTimeAccessToken());
+  const rawToken = opts?.token ?? await import("./abletime-oauth-ICMB2XV2.js").then((m) => m.ensureAbleTimeAccessToken());
   if (rawToken && ableTimeUsesRest(rawToken)) {
-    const { callAbleTimeRestTool } = await import("./abletime-rest-E4LBRFLM.js");
+    const { callAbleTimeRestTool } = await import("./abletime-rest-HFMRTUDT.js");
     return callAbleTimeRestTool(name, args, { ...opts, token: rawToken });
   }
   const requestOpts = { ...opts, pm: opts?.pm ?? abletimeToolUsesPm(name) };
@@ -242,7 +242,7 @@ async function callAbleTimeTool(name, args = {}, opts) {
       return await call();
     }
     if (rawToken && ableTimeUsesRest(rawToken) && isAbleTimeRejectedCredential(message)) {
-      const { callAbleTimeRestTool } = await import("./abletime-rest-E4LBRFLM.js");
+      const { callAbleTimeRestTool } = await import("./abletime-rest-HFMRTUDT.js");
       return callAbleTimeRestTool(name, args, { ...opts, token: rawToken });
     }
     throw err instanceof Error ? new Error(rewriteAbleTimeError(err.message)) : err;

package/dist/chunk-NXXQFLNQ.js

@@ -0,0 +1,300 @@
+import {
+  enrichPathWithNpmGlobalBin,
+  isConductorBundledCli,
+  resolveCommandBinarySync,
+  run,
+  withExportedPath
+} from "./chunk-QVN2WOKJ.js";
+import {
+  resolveAgentExecutable
+} from "./chunk-36J3IZBS.js";
+
+// src/agents/install.ts
+import { existsSync } from "fs";
+var SETUP = {
+  claude: {
+    agent: "claude",
+    kind: "cli",
+    summary: "Install the Claude Code CLI, then complete login in a terminal.",
+    docsUrl: "https://code.claude.com/docs/en/install",
+    installCommand: "npm install -g @anthropic-ai/claude-code",
+    loginCommand: "claude auth login",
+    npmPackage: "@anthropic-ai/claude-code",
+    updateArgs: ["update"]
+  },
+  codex: {
+    agent: "codex",
+    kind: "cli",
+    summary: "Install the Codex CLI, then run login in a terminal.",
+    docsUrl: "https://github.com/openai/codex",
+    installCommand: "npm install -g @openai/codex",
+    loginCommand: "codex login",
+    npmPackage: "@openai/codex",
+    updateArgs: ["update"]
+  },
+  opencode: {
+    agent: "opencode",
+    kind: "cli",
+    summary: "Install OpenCode (curl installer or npm), then authenticate providers.",
+    docsUrl: "https://opencode.ai/docs",
+    // Prefer the official installer; npm package name is opencode-ai.
+    installCommand: "curl -fsSL https://opencode.ai/install | bash",
+    loginCommand: "opencode auth login",
+    npmPackage: "opencode-ai@latest",
+    updateArgs: ["upgrade"]
+  },
+  cursor: {
+    agent: "cursor",
+    kind: "cli",
+    summary: "Install (or update) @cursor/sdk with npm \u2014 Sideboard does not pin it in the app. Then add a CURSOR_API_KEY.",
+    docsUrl: "https://www.npmjs.com/package/@cursor/sdk",
+    installCommand: "npm install -g @cursor/sdk",
+    loginCommand: null,
+    npmPackage: "@cursor/sdk"
+  },
+  brightsy: {
+    agent: "brightsy",
+    kind: "cli",
+    summary: "Install (or update) the Brightsy CLI with npm, then run `brightsy login`.",
+    docsUrl: "https://www.npmjs.com/package/@brightsy/cli",
+    installCommand: "npm install -g @brightsy/cli",
+    loginCommand: "brightsy login",
+    npmPackage: "@brightsy/cli"
+  }
+};
+var CLI_BIN = {
+  claude: "claude",
+  codex: "codex",
+  opencode: "opencode",
+  brightsy: "brightsy"
+};
+function getAgentSetupInfo(agent) {
+  return SETUP[agent];
+}
+function listAgentSetupInfo() {
+  return Object.values(SETUP);
+}
+var CLI_LOGIN_AGENTS = /* @__PURE__ */ new Set([
+  "claude",
+  "codex",
+  "opencode",
+  "brightsy"
+]);
+function resolveLoginCommand(agent) {
+  const info = getAgentSetupInfo(agent);
+  if (!info.loginCommand) return null;
+  if (!CLI_LOGIN_AGENTS.has(agent)) return info.loginCommand;
+  const exe = resolveAgentExecutable(agent);
+  return info.loginCommand.replace(/^\S+/, exe);
+}
+async function prepareTerminalCommand(command) {
+  enrichPathWithNpmGlobalBin();
+  const trimmed = command.trim();
+  if (!trimmed) return trimmed;
+  if (/^(export\s+PATH=|PATH=)/.test(trimmed)) return trimmed;
+  const match = /^(\S+)(\s[\s\S]*)?$/.exec(trimmed);
+  const bin = match?.[1];
+  let whichPath = null;
+  if (bin && !bin.includes("/") && !bin.includes("\\")) {
+    const which = await run("which", [bin], { reject: false, timeoutMs: 3e3 });
+    whichPath = which.exitCode === 0 ? which.stdout.trim() : null;
+  }
+  const resolved = resolveCommandBinarySync(trimmed, whichPath);
+  return withExportedPath(resolved, process.env.PATH ?? "");
+}
+async function openInSystemTerminal(command) {
+  const trimmed = (await prepareTerminalCommand(command)).trim();
+  if (!trimmed) throw new Error("Command is empty");
+  if (process.platform === "darwin") {
+    const escaped = trimmed.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+    const script = `tell application "Terminal" to do script "${escaped}"`;
+    const result = await run("osascript", ["-e", script], { reject: false });
+    if (result.exitCode !== 0) {
+      throw new Error(result.stderr.trim() || result.stdout.trim() || "Failed to open Terminal");
+    }
+    await run("osascript", ["-e", 'tell application "Terminal" to activate'], {
+      reject: false
+    });
+    return;
+  }
+  if (process.platform === "win32") {
+    const result = await run(
+      "cmd.exe",
+      ["/c", "start", "cmd.exe", "/k", trimmed],
+      { reject: false }
+    );
+    if (result.exitCode !== 0) {
+      throw new Error(result.stderr.trim() || result.stdout.trim() || "Failed to open cmd");
+    }
+    return;
+  }
+  const candidates = [
+    { file: "gnome-terminal", args: ["--", "bash", "-lc", `${trimmed}; exec bash`] },
+    { file: "x-terminal-emulator", args: ["-e", "bash", "-lc", `${trimmed}; exec bash`] },
+    { file: "konsole", args: ["-e", "bash", "-lc", `${trimmed}; exec bash`] },
+    { file: "xterm", args: ["-e", "bash", "-lc", `${trimmed}; exec bash`] }
+  ];
+  for (const c of candidates) {
+    const which = await run("which", [c.file], { reject: false });
+    if (which.exitCode !== 0 || !which.stdout.trim()) continue;
+    const result = await run(c.file, c.args, { reject: false });
+    if (result.exitCode === 0) return;
+  }
+  throw new Error(
+    `No terminal found to run: ${trimmed}. Install gnome-terminal (or similar), or run the command manually.`
+  );
+}
+async function whichOnPath(bin) {
+  const which = await run("which", [bin], { reject: false, timeoutMs: 3e3 });
+  if (which.exitCode !== 0) return null;
+  return which.stdout.trim().split(/\r?\n/).find(Boolean) ?? null;
+}
+async function installNpmGlobalPackage(opts) {
+  enrichPathWithNpmGlobalBin();
+  const result = await run("npm", ["install", "-g", opts.npmPackage], { reject: false });
+  const ok = result.exitCode === 0;
+  if (!ok) {
+    try {
+      await openInSystemTerminal(opts.installCommand);
+      return {
+        ok: false,
+        openedTerminal: true,
+        command: opts.installCommand,
+        exitCode: result.exitCode,
+        stdout: result.stdout,
+        stderr: result.stderr,
+        message: `npm install failed (exit ${result.exitCode}). Opened Terminal with: ${opts.installCommand}`
+      };
+    } catch {
+      return {
+        ok: false,
+        command: opts.installCommand,
+        exitCode: result.exitCode,
+        stdout: result.stdout,
+        stderr: result.stderr,
+        message: result.stderr.trim() || result.stdout.trim() || `npm install failed (exit ${result.exitCode})`
+      };
+    }
+  }
+  enrichPathWithNpmGlobalBin();
+  const binPath = opts.cliBin ? await whichOnPath(opts.cliBin) : null;
+  return {
+    ok: true,
+    command: opts.installCommand,
+    exitCode: 0,
+    stdout: result.stdout,
+    stderr: result.stderr,
+    // Library-only packages (`@cursor/sdk`) have no CLI to look for.
+    message: !opts.cliBin ? `Installed ${opts.npmPackage}` : binPath ? `Installed ${opts.npmPackage} \u2192 ${binPath}` : `Installed ${opts.npmPackage} (CLI not yet on PATH)`
+  };
+}
+async function resolveExistingCli(agent) {
+  if (agent === "cursor") return null;
+  const exe = resolveAgentExecutable(agent);
+  if ((exe.includes("/") || exe.includes("\\")) && existsSync(exe)) return exe;
+  enrichPathWithNpmGlobalBin();
+  return whichOnPath(CLI_BIN[agent]);
+}
+async function runVendorUpdate(existing, updateArgs) {
+  const result = await run(existing, updateArgs, {
+    reject: false,
+    timeoutMs: 12e4
+  });
+  const command = `${existing} ${updateArgs.join(" ")}`;
+  const ok = result.exitCode === 0;
+  const detail = result.stdout.trim() || result.stderr.trim() || `exit ${result.exitCode}`;
+  return {
+    ok,
+    command,
+    exitCode: result.exitCode,
+    stdout: result.stdout,
+    stderr: result.stderr,
+    message: ok ? isConductorBundledCli(existing) ? `Updated Conductor\u2019s CLI at ${existing}. ${detail}` : `Updated ${command}. ${detail}` : `Update failed (${command}): ${detail}`
+  };
+}
+function isCurlInstaller(command) {
+  return /curl\s| \|\s*bash/.test(command);
+}
+async function installAgent(agent) {
+  const info = getAgentSetupInfo(agent);
+  if (info.kind === "bundled-sdk" || info.kind === "api-key") {
+    return {
+      ok: true,
+      message: info.summary
+    };
+  }
+  if (!info.installCommand) {
+    return { ok: false, message: `No install command for ${agent}` };
+  }
+  const existing = await resolveExistingCli(agent);
+  if (existing && info.updateArgs?.length) {
+    return runVendorUpdate(existing, info.updateArgs);
+  }
+  if (info.npmPackage && !isCurlInstaller(info.installCommand)) {
+    const cliBin = agent === "cursor" ? null : CLI_BIN[agent];
+    return installNpmGlobalPackage({
+      npmPackage: info.npmPackage,
+      installCommand: info.installCommand,
+      cliBin
+    });
+  }
+  await openInSystemTerminal(info.installCommand);
+  return {
+    ok: true,
+    openedTerminal: true,
+    command: info.installCommand,
+    message: `Opened Terminal to run: ${info.installCommand}`
+  };
+}
+async function loginAgent(agent) {
+  const info = getAgentSetupInfo(agent);
+  const loginCommand = resolveLoginCommand(agent);
+  if (!loginCommand) {
+    return {
+      ok: true,
+      message: info.kind === "bundled-sdk" || info.kind === "api-key" ? info.summary : `No login command for ${agent}`
+    };
+  }
+  const prepared = await prepareTerminalCommand(loginCommand);
+  await openInSystemTerminal(prepared);
+  return {
+    ok: true,
+    openedTerminal: true,
+    command: prepared,
+    message: `Opened Terminal to run: ${prepared}`
+  };
+}
+async function loginManagedAccount(accountId) {
+  const { loadAppSettings } = await import("./app-settings-MR2U6AXN.js");
+  const { loginEnvPrefix } = await import("./managed-accounts-2AK5RIAF.js");
+  const account = loadAppSettings().accounts.accounts.find((a) => a.id === accountId);
+  if (!account) {
+    return { ok: false, message: `Account not found: ${accountId}` };
+  }
+  const loginCommand = resolveLoginCommand(account.kind);
+  if (!loginCommand) {
+    return { ok: false, message: `No login command for ${account.kind}` };
+  }
+  const prepared = await prepareTerminalCommand(loginCommand);
+  const prefixed = `${loginEnvPrefix(account)} && ${prepared}`;
+  await openInSystemTerminal(prefixed);
+  return {
+    ok: true,
+    openedTerminal: true,
+    command: prefixed,
+    message: `Opened Terminal to run: ${prefixed}`
+  };
+}
+
+export {
+  getAgentSetupInfo,
+  listAgentSetupInfo,
+  resolveLoginCommand,
+  prepareTerminalCommand,
+  openInSystemTerminal,
+  whichOnPath,
+  installNpmGlobalPackage,
+  installAgent,
+  loginAgent,
+  loginManagedAccount
+};

package/dist/chunk-OH4EN323.js

@@ -0,0 +1,89 @@
+import {
+  OPTIONAL_SERVICES,
+  isOptionalServiceId,
+  optionalServiceSpec
+} from "./chunk-AF2DMY3K.js";
+import {
+  installNpmGlobalPackage,
+  whichOnPath
+} from "./chunk-NXXQFLNQ.js";
+import {
+  enrichPathWithNpmGlobalBin
+} from "./chunk-QVN2WOKJ.js";
+
+// src/integrations/optional-cli.ts
+async function detectOptionalServiceClis() {
+  enrichPathWithNpmGlobalBin();
+  return Promise.all(
+    OPTIONAL_SERVICES.map(async (spec) => {
+      if (!spec.cli) {
+        return { id: spec.id, cli: null, installed: false, path: null };
+      }
+      const path = await whichOnPath(spec.cli);
+      return {
+        id: spec.id,
+        cli: spec.cli,
+        installed: Boolean(path),
+        path
+      };
+    })
+  );
+}
+var CLI_PRESENCE_TTL_MS = 6e4;
+var cliPresenceCache = /* @__PURE__ */ new Map();
+function clearOptionalCliPresenceCache() {
+  cliPresenceCache.clear();
+}
+async function optionalCliPresence(ids) {
+  const presence = {};
+  const now = Date.now();
+  await Promise.all(
+    ids.map(async (id) => {
+      const spec = optionalServiceSpec(id);
+      if (!spec.cli) return;
+      const hit = cliPresenceCache.get(id);
+      if (hit && now - hit.at < CLI_PRESENCE_TTL_MS) {
+        presence[id] = hit.installed;
+        return;
+      }
+      const path = await whichOnPath(spec.cli);
+      const installed = Boolean(path);
+      cliPresenceCache.set(id, { at: now, installed });
+      presence[id] = installed;
+    })
+  );
+  return presence;
+}
+async function installOptionalServiceCli(id) {
+  if (!isOptionalServiceId(id)) {
+    return { ok: false, message: "Unknown optional service" };
+  }
+  const spec = optionalServiceSpec(id);
+  if (!spec.cli || !spec.npmPackage) {
+    return {
+      ok: false,
+      message: `${spec.label} has no CLI to install. Agents call posthog_api.`
+    };
+  }
+  enrichPathWithNpmGlobalBin();
+  const existing = await whichOnPath(spec.cli);
+  if (existing) {
+    return {
+      ok: true,
+      command: existing,
+      message: `Already on PATH: ${existing}`
+    };
+  }
+  return installNpmGlobalPackage({
+    npmPackage: spec.npmPackage,
+    installCommand: `npm install -g ${spec.npmPackage}`,
+    cliBin: spec.cli
+  });
+}
+
+export {
+  detectOptionalServiceClis,
+  clearOptionalCliPresenceCache,
+  optionalCliPresence,
+  installOptionalServiceCli
+};