@sideboard-ai/core 0.1.293 → 0.1.294

package/dist/{chunk-PO3PDNMV.js → chunk-E7G7RY6T.js}

@@ -5,7 +5,7 @@ import {
   ensureGhPreferOrigin,
   resolveGithubRepoSlug,
   resolveRepoRoot
-} from "./chunk-UO5C2L2G.js";
+} from "./chunk-6SGYGYH7.js";
 import {
   ATTACHMENTS_DIR,
   attachmentsGitignoreBody
@@ -22,7 +22,7 @@ import {
   resolveThreadDefaults,
   resolveViewerProfile,
   resolveViewerProfileForRepo
-} from "./chunk-MVZO7QZ2.js";
+} from "./chunk-BU6HH5VA.js";
 import {
   allocateTeamName,
   createEmptyThread,
@@ -346,7 +346,7 @@ var COORDINATOR_TOOL_PLAYBOOK = [
   "- linear_* (when Linear is connected) \u2014 list_teams for team key/states; linear_list_projects for project names; get/search include the project a ticket is on; get/create/update/comment with ENG-123. Worktree agents have the same Account tools \u2014 prefer they comment, update status, and create spin-offs (parent=) on their own ticket when they were asked to do the work. When reviewing a PR or ticket, do not comment or update until the user types a next step \u2014 they should work through the feedback in chat first. Do not tell the child to ask_user after the review. Scope errors: reconnect Linear in Account settings. Prefer these over any Linear MCP the CLI may still list.",
   "- github_* \u2014 get/comment/update/create GitHub issues via Account `gh` (#123). github_list_projects and get/search include GitHub Projects. projectsError or a missing read:project scope \u2192 `gh auth refresh -s read:project`. Worktree agents have these too. Prefer over any vendor GitHub MCP. Pass parent= for spin-offs. When reviewing a PR or ticket, do not comment, submit `gh pr review`, or update the PR/ticket until the user types a next step.",
   "- abletime_* (when AbleTime is connected) \u2014 orientation first; abletime_list_projects lists projects; get/list include the project a task is on; get/comment/update/create (parent= for spin-offs); ensure_task when work has no ticket (or create_workspace from the default branch auto-creates one). Worktree agents have the same Account tools. Same review-write gate as Linear/GitHub.",
-  "- Optional connectors (Vercel, Supabase, Sentry) in Settings \u2192 Connectors inject tokens into worktree agent env when connected. Prefer official CLIs (`vercel`, `supabase`, `sentry-cli`). PostHog is the Sideboard tool `posthog_api` (GET by default; POST `/api/projects/:id/query/` or `/api/environments/:id/query/` is a read and does not need write=true; other POST and PATCH need write=true only when the user asked to change data). The PostHog key stays in the vault \u2014 do not read it from the environment. If a connector MCP needsAuth or is unauthorized, do not sign in \u2014 use the native CLI or `posthog_api`. Tell any worktree agent (Claude / Cursor / Codex / OpenCode) to write CLI output to `.context/cli/` and read a slice. If a CLI is missing, the user presses Install CLI on that row. Do not add vendor MCPs. Git (`gh`) stays Settings \u2192 Git; issue tracking stays Settings \u2192 Issues. The phone remote is Settings \u2192 Remote \u2014 do not look up Slack users.",
+  "- Optional connectors (Vercel, Supabase, Sentry) in Settings \u2192 Connectors inject tokens into worktree agent env when connected. Prefer official CLIs (`vercel`, `supabase`, `sentry-cli`). When Settings \u2192 Connectors has a PostHog personal API key, PostHog is the Sideboard tool `posthog_api` (GET by default; POST `/api/projects/:id/query/` or `/api/environments/:id/query/` is a read and does not need write=true; other POST and PATCH need write=true only when the user asked to change data). The PostHog key stays in the vault \u2014 do not read it from the environment, and do not sign in to a PostHog MCP. When no PostHog API key is set, leave the Claude PostHog connector alone. If a Vercel, Supabase, or Sentry MCP needsAuth or is unauthorized, do not sign in \u2014 use the native CLI. Tell any worktree agent (Claude / Cursor / Codex / OpenCode) to write CLI output to `.context/cli/` and read a slice. If a CLI is missing, the user presses Install CLI on that row. Do not add vendor MCPs. Git (`gh`) stays Settings \u2192 Git; issue tracking stays Settings \u2192 Issues. The phone remote is Settings \u2192 Remote \u2014 do not look up Slack users.",
   "- get_pr_stack / open_pr_stack_layers / add_stack_layer / create_pr_stack \u2014 GitHub stacked PRs (`gh stack`); one worktree per layer",
   "- list_models \u2014 only when you need a specific model (rare); otherwise omit model so Account defaults apply",
   "- list_chats / get_chat \u2014 live thread list (parent id + last message preview). get_chat on this orchestration chat lists child worktree agents (status + lastText). blockedReason is why that agent is waiting on a person. Also includes usage / lastTurnUsage.",

package/dist/{chunk-NFPWLDCH.js → chunk-FAXOEKQR.js}

@@ -4,7 +4,7 @@ import {
 import {
   getAbleTimeHost,
   isAbleTimeConnected
-} from "./chunk-36J3IZBS.js";
+} from "./chunk-RSATPXU4.js";
 
 // src/integrations/abletime-mcp.ts
 var DEFAULT_ABLETIME_HOST = "https://track.abletime.com";
@@ -153,7 +153,7 @@ function textsFromUnknown(value) {
   return "";
 }
 async function abletimeMcpRequest(method, params, opts) {
-  const rawToken = opts?.token ?? await import("./abletime-oauth-ICMB2XV2.js").then((m) => m.ensureAbleTimeAccessToken());
+  const rawToken = opts?.token ?? await import("./abletime-oauth-KTERKARA.js").then((m) => m.ensureAbleTimeAccessToken());
   if (!rawToken?.trim()) {
     throw new Error("AbleTime is not connected \u2014 paste a personal access token in Account settings");
   }
@@ -224,9 +224,9 @@ async function callAbleTimeTool(name, args = {}, opts) {
   if (!opts?.token && !isAbleTimeConnected()) {
     throw new Error("AbleTime is not connected \u2014 paste a personal access token in Account settings");
   }
-  const rawToken = opts?.token ?? await import("./abletime-oauth-ICMB2XV2.js").then((m) => m.ensureAbleTimeAccessToken());
+  const rawToken = opts?.token ?? await import("./abletime-oauth-KTERKARA.js").then((m) => m.ensureAbleTimeAccessToken());
   if (rawToken && ableTimeUsesRest(rawToken)) {
-    const { callAbleTimeRestTool } = await import("./abletime-rest-HFMRTUDT.js");
+    const { callAbleTimeRestTool } = await import("./abletime-rest-EUB6RW7K.js");
     return callAbleTimeRestTool(name, args, { ...opts, token: rawToken });
   }
   const requestOpts = { ...opts, pm: opts?.pm ?? abletimeToolUsesPm(name) };
@@ -242,7 +242,7 @@ async function callAbleTimeTool(name, args = {}, opts) {
       return await call();
     }
     if (rawToken && ableTimeUsesRest(rawToken) && isAbleTimeRejectedCredential(message)) {
-      const { callAbleTimeRestTool } = await import("./abletime-rest-HFMRTUDT.js");
+      const { callAbleTimeRestTool } = await import("./abletime-rest-EUB6RW7K.js");
       return callAbleTimeRestTool(name, args, { ...opts, token: rawToken });
     }
     throw err instanceof Error ? new Error(rewriteAbleTimeError(err.message)) : err;

package/dist/{chunk-GU6DT6NO.js → chunk-HSF2RQSQ.js}

@@ -6,7 +6,7 @@ import {
 import {
   getAbleTimeHost,
   isAbleTimeConnected
-} from "./chunk-MVZO7QZ2.js";
+} from "./chunk-BU6HH5VA.js";
 
 // src/integrations/abletime-mcp.ts
 var DEFAULT_ABLETIME_HOST = "https://track.abletime.com";
@@ -155,7 +155,7 @@ function textsFromUnknown(value) {
   return "";
 }
 async function abletimeMcpRequest(method, params, opts) {
-  const rawToken = opts?.token ?? await import("./abletime-oauth-FW24YHYX.js").then((m) => m.ensureAbleTimeAccessToken());
+  const rawToken = opts?.token ?? await import("./abletime-oauth-ZURGXSY6.js").then((m) => m.ensureAbleTimeAccessToken());
   if (!rawToken?.trim()) {
     throw new Error("AbleTime is not connected \u2014 paste a personal access token in Account settings");
   }
@@ -226,9 +226,9 @@ async function callAbleTimeTool(name, args = {}, opts) {
   if (!opts?.token && !isAbleTimeConnected()) {
     throw new Error("AbleTime is not connected \u2014 paste a personal access token in Account settings");
   }
-  const rawToken = opts?.token ?? await import("./abletime-oauth-FW24YHYX.js").then((m) => m.ensureAbleTimeAccessToken());
+  const rawToken = opts?.token ?? await import("./abletime-oauth-ZURGXSY6.js").then((m) => m.ensureAbleTimeAccessToken());
   if (rawToken && ableTimeUsesRest(rawToken)) {
-    const { callAbleTimeRestTool } = await import("./abletime-rest-OGWC7BC6.js");
+    const { callAbleTimeRestTool } = await import("./abletime-rest-4TVIWLZK.js");
     return callAbleTimeRestTool(name, args, { ...opts, token: rawToken });
   }
   const requestOpts = { ...opts, pm: opts?.pm ?? abletimeToolUsesPm(name) };
@@ -244,7 +244,7 @@ async function callAbleTimeTool(name, args = {}, opts) {
       return await call();
     }
     if (rawToken && ableTimeUsesRest(rawToken) && isAbleTimeRejectedCredential(message)) {
-      const { callAbleTimeRestTool } = await import("./abletime-rest-OGWC7BC6.js");
+      const { callAbleTimeRestTool } = await import("./abletime-rest-4TVIWLZK.js");
       return callAbleTimeRestTool(name, args, { ...opts, token: rawToken });
     }
     throw err instanceof Error ? new Error(rewriteAbleTimeError(err.message)) : err;

package/dist/{chunk-OH4EN323.js → chunk-ISEYRGMP.js}

@@ -2,11 +2,11 @@ import {
   OPTIONAL_SERVICES,
   isOptionalServiceId,
   optionalServiceSpec
-} from "./chunk-AF2DMY3K.js";
+} from "./chunk-QDDTVIWE.js";
 import {
   installNpmGlobalPackage,
   whichOnPath
-} from "./chunk-NXXQFLNQ.js";
+} from "./chunk-B42H6GJR.js";
 import {
   enrichPathWithNpmGlobalBin
 } from "./chunk-QVN2WOKJ.js";

package/dist/{chunk-XZW3BXZW.js → chunk-JEYJGQ33.js}

@@ -12,13 +12,13 @@ import {
 } from "./chunk-YSLCWCMJ.js";
 import {
   isOrchestratorThread
-} from "./chunk-ZRQWV3MS.js";
+} from "./chunk-YEIPPZ5W.js";
 import {
   codexUnattendedGitConfigArgs,
   mergeAgentGitAuthEnv,
   resolveAgentGitAuthEnv,
   resolveCodexGitWritableRoots
-} from "./chunk-2VGLZIU6.js";
+} from "./chunk-ZEP6JIRF.js";
 import {
   loadBrightsyConfig
 } from "./chunk-33KDPEK4.js";
@@ -64,10 +64,11 @@ import {
   fromInclusiveInputUsage,
   isAbleTimeConnected,
   isLinearConnected,
+  isPosthogConnected,
   loadAppSettings,
   resolveAgentExecutable,
   resolveClaudeExecutable
-} from "./chunk-36J3IZBS.js";
+} from "./chunk-RSATPXU4.js";
 import {
   isElectronLikeCommand,
   unwrapStrippedElectronLaunch
@@ -574,6 +575,10 @@ var CLAUDE_CHROME_ALLOWED_TOOLS = [
   "mcp__claude-in-chrome__*",
   "Skill(claude-in-chrome)"
 ];
+var CLAUDE_POSTHOG_CONNECTOR_ALLOWED_TOOLS = [
+  "mcp__claude_ai_PostHog",
+  "mcp__claude_ai_PostHog__*"
+];
 
 // src/agents/orch-mcp-isolation.ts
 import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
@@ -719,11 +724,9 @@ var SIDEBOARD_GITHUB_MCP_ALLOWED_TOOLS = ["mcp__sideboard__github_*"];
 var SIDEBOARD_LINEAR_MCP_ALLOWED_TOOLS = ["mcp__sideboard__linear_*"];
 var SIDEBOARD_ABLETIME_MCP_ALLOWED_TOOLS = ["mcp__sideboard__abletime_*"];
 function sideboardWorktreeAllowedTools(opts) {
-  const out = [...SIDEBOARD_ARTIFACT_MCP_ALLOWED_TOOLS];
-  if (!opts?.planMode) {
-    const idx = out.indexOf("mcp__sideboard__present_plan");
-    if (idx >= 0) out.splice(idx, 1);
-  }
+  const out = SIDEBOARD_ARTIFACT_MCP_ALLOWED_TOOLS.filter(
+    (tool) => (opts?.planMode || tool !== "mcp__sideboard__present_plan") && (opts?.posthog || tool !== "mcp__sideboard__posthog_api")
+  );
   if (opts?.github !== false) out.push(...SIDEBOARD_GITHUB_MCP_ALLOWED_TOOLS);
   if (opts?.linear) out.push(...SIDEBOARD_LINEAR_MCP_ALLOWED_TOOLS);
   if (opts?.abletime) out.push(...SIDEBOARD_ABLETIME_MCP_ALLOWED_TOOLS);
@@ -1752,7 +1755,7 @@ var claudeAdapter = {
       );
     }
     const mode = permissionMode(thread);
-    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-UGR6FQXI.js");
+    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-4WAU4PAL.js");
     const isOrchestrator = isOrchestratorThread2(thread);
     const rpc = worktreeAgentRpc(isOrchestrator);
     const injectedServers = await buildInjectedMcpServers({
@@ -1782,9 +1785,11 @@ var claudeAdapter = {
           github: true,
           linear: isLinearConnected(),
           abletime: isAbleTimeConnected(),
-          planMode: thread.planMode
+          planMode: thread.planMode,
+          posthog: isPosthogConnected()
         }),
-        ...brightsyMcpAllowedTools(injectedBrightsyNames)
+        ...brightsyMcpAllowedTools(injectedBrightsyNames),
+        ...isPosthogConnected() ? [] : CLAUDE_POSTHOG_CONNECTOR_ALLOWED_TOOLS
       ];
     }
     if (chromeOn) {
@@ -3683,6 +3688,7 @@ export {
   BASE_ALLOWED_TOOLS,
   CLAUDE_PRINT_BG_WAIT_CEILING_MS,
   CLAUDE_CHROME_ALLOWED_TOOLS,
+  CLAUDE_POSTHOG_CONNECTOR_ALLOWED_TOOLS,
   SIDEBOARD_MCP_PROFILE_ENV,
   SIDEBOARD_THREAD_ID_ENV,
   shouldRegisterMcpWaitForTurn,

package/dist/{chunk-MYJYINTS.js → chunk-LZVWKJXY.js}

@@ -1,13 +1,13 @@
 import {
   abletimeRestUrl,
   textFromAbleTimeDoc
-} from "./chunk-B3BPLPKQ.js";
+} from "./chunk-R3R3ZDFC.js";
 import {
   assertAbleTimeCredential,
   callAbleTimeTool,
   normalizeAbleTimeHost,
   rewriteAbleTimeError
-} from "./chunk-NFPWLDCH.js";
+} from "./chunk-FAXOEKQR.js";
 import {
   httpFetch
 } from "./chunk-JAT3JFOS.js";
@@ -20,7 +20,7 @@ import {
   getAbleTimeHost,
   isAbleTimeConnected,
   saveAbleTimeConnection
-} from "./chunk-36J3IZBS.js";
+} from "./chunk-RSATPXU4.js";
 
 // src/integrations/issue-attachments.ts
 import { existsSync, mkdirSync, writeFileSync } from "fs";

package/dist/{chunk-Y67TBJD5.js → chunk-MOP5L5QZ.js}

@@ -3,13 +3,13 @@
 import {
   abletimeRestUrl,
   textFromAbleTimeDoc
-} from "./chunk-AHH5USEA.js";
+} from "./chunk-SSETL5EX.js";
 import {
   assertAbleTimeCredential,
   callAbleTimeTool,
   normalizeAbleTimeHost,
   rewriteAbleTimeError
-} from "./chunk-GU6DT6NO.js";
+} from "./chunk-HSF2RQSQ.js";
 import {
   httpFetch
 } from "./chunk-2GPQZZLY.js";
@@ -22,7 +22,7 @@ import {
   getAbleTimeHost,
   isAbleTimeConnected,
   saveAbleTimeConnection
-} from "./chunk-MVZO7QZ2.js";
+} from "./chunk-BU6HH5VA.js";
 
 // src/integrations/issue-attachments.ts
 import { existsSync, mkdirSync, writeFileSync } from "fs";

package/dist/{chunk-AF2DMY3K.js → chunk-QDDTVIWE.js}

@@ -4,7 +4,7 @@ import {
 import {
   loadAppSettings,
   saveAppSettings
-} from "./chunk-36J3IZBS.js";
+} from "./chunk-RSATPXU4.js";
 
 // src/integrations/optional-services.ts
 var OPTIONAL_SERVICE_IDS = ["vercel", "supabase", "posthog", "sentry"];
@@ -235,6 +235,12 @@ function connectorDirectiveLine(spec, cli) {
   }
   return `- ${spec.label}: call \`posthog_api\`. Path must start with \`/api/\`. GET is the default. POST \`/api/projects/:id/query/\` or \`/api/environments/:id/query/\` is a read and does not need \`write=true\`. Other POST and PATCH require \`write=true\` only when the user asked to change data. Do not read the API key from the environment. Do not add a ${spec.label} MCP.`;
 }
+function connectorAuthCaution(posthog, cliConnected) {
+  const signIn = posthog ? "If a connector MCP is listed but needsAuth or returns unauthorized, do not sign in to that MCP." : "If a Vercel, Supabase, or Sentry MCP is listed but needsAuth or returns unauthorized, do not sign in to that MCP.";
+  const token = cliConnected ? " CLI tokens are already in this process." : "";
+  const key = posthog ? " Do not read a PostHog key from the environment." : "";
+  return `${signIn}${token}${key}`;
+}
 function connectorReminderBit(spec, cli) {
   if (!spec.cli) return `${spec.label}: \`posthog_api\``;
   const presence = cliPresencePhrase(spec, cli);
@@ -244,10 +250,11 @@ function formatOptionalServicesDirective(integrations, cli) {
   const connected = connectedOptionalServices(integrations);
   if (connected.length === 0) return null;
   const cliConnected = connected.some((spec) => spec.cli);
+  const posthog = connected.some((spec) => spec.id === "posthog");
   const lines = [
     cliConnected ? "Optional connectors (connected \u2014 CLI tokens are already in this process env):" : "Optional connectors (connected):",
     ...connected.map((spec) => connectorDirectiveLine(spec, cli)),
-    cliConnected ? "If a connector MCP is listed but needsAuth or returns unauthorized, do not sign in to that MCP. CLI tokens are already in this process. Do not read a PostHog key from the environment." : "If a connector MCP is listed but needsAuth or returns unauthorized, do not sign in to that MCP. Do not read a PostHog key from the environment.",
+    connectorAuthCaution(posthog, cliConnected),
     "Do not add a vendor MCP. When a binary is missing, ask the user to press Install CLI in Settings \u2192 Connectors.",
     "When you shell a connector CLI, write bulky output to `.context/cli/` and read a slice."
   ];
@@ -258,13 +265,15 @@ function formatOptionalServicesReminder(integrations, cli) {
   if (connected.length === 0) return null;
   const bits = connected.map((spec) => connectorReminderBit(spec, cli)).join(". ");
   const tokenBit = connected.some((spec) => spec.cli) ? "CLI tokens are already in this process. " : "";
-  return `Settings \u2192 Connectors: ${tokenBit}${bits}. If a connector MCP needsAuth or is unauthorized, ignore it and use the CLI or \`posthog_api\`. Do not add vendor MCPs. Do not read a PostHog key from the environment. Shell dumps from those CLIs go in \`.context/cli/\` \u2014 read a slice.`;
+  const posthog = connected.some((spec) => spec.id === "posthog");
+  const auth = posthog ? "If a connector MCP needsAuth or is unauthorized, ignore it and use the CLI or `posthog_api`. Do not read a PostHog key from the environment." : "If a Vercel, Supabase, or Sentry MCP needsAuth or is unauthorized, ignore it and use the CLI.";
+  return `Settings \u2192 Connectors: ${tokenBit}${bits}. ${auth} Do not add vendor MCPs. Shell dumps from those CLIs go in \`.context/cli/\` \u2014 read a slice.`;
 }
 async function connectedCliPresence(integrations) {
   const ids = connectedOptionalServices(integrations).filter((spec) => spec.cli).map((spec) => spec.id);
   if (ids.length === 0) return void 0;
   try {
-    const { optionalCliPresence } = await import("./optional-cli-6SW4OOX3.js");
+    const { optionalCliPresence } = await import("./optional-cli-PZXDOVJJ.js");
     return await optionalCliPresence(ids);
   } catch {
     return void 0;

package/dist/{chunk-B3BPLPKQ.js → chunk-R3R3ZDFC.js}

@@ -4,14 +4,14 @@ import {
   normalizeAbleTimeCredential,
   normalizeAbleTimeHost,
   rewriteAbleTimeError
-} from "./chunk-NFPWLDCH.js";
+} from "./chunk-FAXOEKQR.js";
 import {
   httpFetch
 } from "./chunk-JAT3JFOS.js";
 import {
   getAbleTimeAccessToken,
   getAbleTimeHost
-} from "./chunk-36J3IZBS.js";
+} from "./chunk-RSATPXU4.js";
 
 // src/integrations/abletime-rest.ts
 var ABLETIME_REST_PREFIX = "/api/public/v2";

package/dist/{chunk-36J3IZBS.js → chunk-RSATPXU4.js}

@@ -1906,6 +1906,9 @@ function disconnectLinearConnection() {
   delete integrations.linearOrganizationName;
   return saveAppSettings({ ...current, integrations });
 }
+function isPosthogConnected(settings = loadAppSettings()) {
+  return Boolean(settings.integrations.posthogPersonalApiKey?.trim());
+}
 function isAbleTimeConnected(settings = loadAppSettings()) {
   return Boolean(
     settings.integrations.abletimeAccessToken?.trim() || settings.integrations.abletimeRefreshToken?.trim()
@@ -2375,6 +2378,7 @@ export {
   isLinearConnected,
   saveLinearOAuth,
   disconnectLinearConnection,
+  isPosthogConnected,
   isAbleTimeConnected,
   getAbleTimeAccessToken,
   getAbleTimeHost,

package/dist/{chunk-AHH5USEA.js → chunk-SSETL5EX.js}

@@ -6,14 +6,14 @@ import {
   normalizeAbleTimeCredential,
   normalizeAbleTimeHost,
   rewriteAbleTimeError
-} from "./chunk-GU6DT6NO.js";
+} from "./chunk-HSF2RQSQ.js";
 import {
   httpFetch
 } from "./chunk-2GPQZZLY.js";
 import {
   getAbleTimeAccessToken,
   getAbleTimeHost
-} from "./chunk-MVZO7QZ2.js";
+} from "./chunk-BU6HH5VA.js";
 
 // src/integrations/abletime-rest.ts
 var ABLETIME_REST_PREFIX = "/api/public/v2";

package/dist/{chunk-RPCKGO3J.js → chunk-SVQTKVXH.js}

@@ -24,13 +24,13 @@ import {
 } from "./chunk-AFLNFGGB.js";
 import {
   isOrchestratorThread
-} from "./chunk-PO3PDNMV.js";
+} from "./chunk-E7G7RY6T.js";
 import {
   codexUnattendedGitConfigArgs,
   mergeAgentGitAuthEnv,
   resolveAgentGitAuthEnv,
   resolveCodexGitWritableRoots
-} from "./chunk-UO5C2L2G.js";
+} from "./chunk-6SGYGYH7.js";
 import {
   npmGlobalNodeModules,
   run
@@ -40,10 +40,11 @@ import {
   fromInclusiveInputUsage,
   isAbleTimeConnected,
   isLinearConnected,
+  isPosthogConnected,
   loadAppSettings,
   resolveAgentExecutable,
   resolveClaudeExecutable
-} from "./chunk-MVZO7QZ2.js";
+} from "./chunk-BU6HH5VA.js";
 import {
   isElectronLikeCommand,
   unwrapStrippedElectronLaunch,
@@ -483,6 +484,10 @@ var CLAUDE_CHROME_ALLOWED_TOOLS = [
   "mcp__claude-in-chrome__*",
   "Skill(claude-in-chrome)"
 ];
+var CLAUDE_POSTHOG_CONNECTOR_ALLOWED_TOOLS = [
+  "mcp__claude_ai_PostHog",
+  "mcp__claude_ai_PostHog__*"
+];
 
 // src/agents/orch-mcp-isolation.ts
 import { existsSync as existsSync7, readFileSync as readFileSync3 } from "fs";
@@ -976,11 +981,9 @@ var SIDEBOARD_GITHUB_MCP_ALLOWED_TOOLS = ["mcp__sideboard__github_*"];
 var SIDEBOARD_LINEAR_MCP_ALLOWED_TOOLS = ["mcp__sideboard__linear_*"];
 var SIDEBOARD_ABLETIME_MCP_ALLOWED_TOOLS = ["mcp__sideboard__abletime_*"];
 function sideboardWorktreeAllowedTools(opts) {
-  const out = [...SIDEBOARD_ARTIFACT_MCP_ALLOWED_TOOLS];
-  if (!opts?.planMode) {
-    const idx = out.indexOf("mcp__sideboard__present_plan");
-    if (idx >= 0) out.splice(idx, 1);
-  }
+  const out = SIDEBOARD_ARTIFACT_MCP_ALLOWED_TOOLS.filter(
+    (tool) => (opts?.planMode || tool !== "mcp__sideboard__present_plan") && (opts?.posthog || tool !== "mcp__sideboard__posthog_api")
+  );
   if (opts?.github !== false) out.push(...SIDEBOARD_GITHUB_MCP_ALLOWED_TOOLS);
   if (opts?.linear) out.push(...SIDEBOARD_LINEAR_MCP_ALLOWED_TOOLS);
   if (opts?.abletime) out.push(...SIDEBOARD_ABLETIME_MCP_ALLOWED_TOOLS);
@@ -2015,7 +2018,7 @@ var claudeAdapter = {
       );
     }
     const mode = permissionMode(thread);
-    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-CTFQDG7G.js");
+    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-PX4GUVLW.js");
     const isOrchestrator = isOrchestratorThread2(thread);
     const rpc = worktreeAgentRpc(isOrchestrator);
     const injectedServers = await buildInjectedMcpServers({
@@ -2045,9 +2048,11 @@ var claudeAdapter = {
           github: true,
           linear: isLinearConnected(),
           abletime: isAbleTimeConnected(),
-          planMode: thread.planMode
+          planMode: thread.planMode,
+          posthog: isPosthogConnected()
         }),
-        ...brightsyMcpAllowedTools(injectedBrightsyNames)
+        ...brightsyMcpAllowedTools(injectedBrightsyNames),
+        ...isPosthogConnected() ? [] : CLAUDE_POSTHOG_CONNECTOR_ALLOWED_TOOLS
       ];
     }
     if (chromeOn) {

package/dist/{chunk-W2KZTDET.js → chunk-WZCPZVUC.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-2UG25RMK.js";
 import {
   resolveAgentExecutable
-} from "./chunk-MVZO7QZ2.js";
+} from "./chunk-BU6HH5VA.js";
 
 // src/agents/install.ts
 import { existsSync } from "fs";
@@ -267,7 +267,7 @@ async function loginAgent(agent) {
   };
 }
 async function loginManagedAccount(accountId) {
-  const { loadAppSettings } = await import("./app-settings-EHMXHNG5.js");
+  const { loadAppSettings } = await import("./app-settings-2IH42VA5.js");
   const { loginEnvPrefix } = await import("./managed-accounts-46A4KRUE.js");
   const account = loadAppSettings().accounts.accounts.find((a) => a.id === accountId);
   if (!account) {

package/dist/{chunk-4BXRRHDC.js → chunk-XCXUVX7I.js}

@@ -87,6 +87,12 @@ function connectorDirectiveLine(spec, cli) {
   }
   return `- ${spec.label}: call \`posthog_api\`. Path must start with \`/api/\`. GET is the default. POST \`/api/projects/:id/query/\` or \`/api/environments/:id/query/\` is a read and does not need \`write=true\`. Other POST and PATCH require \`write=true\` only when the user asked to change data. Do not read the API key from the environment. Do not add a ${spec.label} MCP.`;
 }
+function connectorAuthCaution(posthog, cliConnected) {
+  const signIn = posthog ? "If a connector MCP is listed but needsAuth or returns unauthorized, do not sign in to that MCP." : "If a Vercel, Supabase, or Sentry MCP is listed but needsAuth or returns unauthorized, do not sign in to that MCP.";
+  const token = cliConnected ? " CLI tokens are already in this process." : "";
+  const key = posthog ? " Do not read a PostHog key from the environment." : "";
+  return `${signIn}${token}${key}`;
+}
 function connectorReminderBit(spec, cli) {
   if (!spec.cli) return `${spec.label}: \`posthog_api\``;
   const presence = cliPresencePhrase(spec, cli);
@@ -96,10 +102,11 @@ function formatOptionalServicesDirective(integrations, cli) {
   const connected = connectedOptionalServices(integrations);
   if (connected.length === 0) return null;
   const cliConnected = connected.some((spec) => spec.cli);
+  const posthog = connected.some((spec) => spec.id === "posthog");
   const lines = [
     cliConnected ? "Optional connectors (connected \u2014 CLI tokens are already in this process env):" : "Optional connectors (connected):",
     ...connected.map((spec) => connectorDirectiveLine(spec, cli)),
-    cliConnected ? "If a connector MCP is listed but needsAuth or returns unauthorized, do not sign in to that MCP. CLI tokens are already in this process. Do not read a PostHog key from the environment." : "If a connector MCP is listed but needsAuth or returns unauthorized, do not sign in to that MCP. Do not read a PostHog key from the environment.",
+    connectorAuthCaution(posthog, cliConnected),
     "Do not add a vendor MCP. When a binary is missing, ask the user to press Install CLI in Settings \u2192 Connectors.",
     "When you shell a connector CLI, write bulky output to `.context/cli/` and read a slice."
   ];
@@ -110,13 +117,15 @@ function formatOptionalServicesReminder(integrations, cli) {
   if (connected.length === 0) return null;
   const bits = connected.map((spec) => connectorReminderBit(spec, cli)).join(". ");
   const tokenBit = connected.some((spec) => spec.cli) ? "CLI tokens are already in this process. " : "";
-  return `Settings \u2192 Connectors: ${tokenBit}${bits}. If a connector MCP needsAuth or is unauthorized, ignore it and use the CLI or \`posthog_api\`. Do not add vendor MCPs. Do not read a PostHog key from the environment. Shell dumps from those CLIs go in \`.context/cli/\` \u2014 read a slice.`;
+  const posthog = connected.some((spec) => spec.id === "posthog");
+  const auth = posthog ? "If a connector MCP needsAuth or is unauthorized, ignore it and use the CLI or `posthog_api`. Do not read a PostHog key from the environment." : "If a Vercel, Supabase, or Sentry MCP needsAuth or is unauthorized, ignore it and use the CLI.";
+  return `Settings \u2192 Connectors: ${tokenBit}${bits}. ${auth} Do not add vendor MCPs. Shell dumps from those CLIs go in \`.context/cli/\` \u2014 read a slice.`;
 }
 async function connectedCliPresence(integrations) {
   const ids = connectedOptionalServices(integrations).filter((spec) => spec.cli).map((spec) => spec.id);
   if (ids.length === 0) return void 0;
   try {
-    const { optionalCliPresence } = await import("./optional-cli-FRUZSZ3U.js");
+    const { optionalCliPresence } = await import("./optional-cli-JQVNSMSU.js");
     return await optionalCliPresence(ids);
   } catch {
     return void 0;

package/dist/{chunk-ZRQWV3MS.js → chunk-YEIPPZ5W.js}

@@ -3,7 +3,7 @@ import {
   ensureGhPreferOrigin,
   resolveGithubRepoSlug,
   resolveRepoRoot
-} from "./chunk-2VGLZIU6.js";
+} from "./chunk-ZEP6JIRF.js";
 import {
   allocateTeamName,
   createEmptyThread,
@@ -29,7 +29,7 @@ import {
   resolveThreadDefaults,
   resolveViewerProfile,
   resolveViewerProfileForRepo
-} from "./chunk-36J3IZBS.js";
+} from "./chunk-RSATPXU4.js";
 import {
   appDataDir,
   globalAgentCwd,
@@ -391,7 +391,7 @@ var COORDINATOR_TOOL_PLAYBOOK = [
   "- linear_* (when Linear is connected) \u2014 list_teams for team key/states; linear_list_projects for project names; get/search include the project a ticket is on; get/create/update/comment with ENG-123. Worktree agents have the same Account tools \u2014 prefer they comment, update status, and create spin-offs (parent=) on their own ticket when they were asked to do the work. When reviewing a PR or ticket, do not comment or update until the user types a next step \u2014 they should work through the feedback in chat first. Do not tell the child to ask_user after the review. Scope errors: reconnect Linear in Account settings. Prefer these over any Linear MCP the CLI may still list.",
   "- github_* \u2014 get/comment/update/create GitHub issues via Account `gh` (#123). github_list_projects and get/search include GitHub Projects. projectsError or a missing read:project scope \u2192 `gh auth refresh -s read:project`. Worktree agents have these too. Prefer over any vendor GitHub MCP. Pass parent= for spin-offs. When reviewing a PR or ticket, do not comment, submit `gh pr review`, or update the PR/ticket until the user types a next step.",
   "- abletime_* (when AbleTime is connected) \u2014 orientation first; abletime_list_projects lists projects; get/list include the project a task is on; get/comment/update/create (parent= for spin-offs); ensure_task when work has no ticket (or create_workspace from the default branch auto-creates one). Worktree agents have the same Account tools. Same review-write gate as Linear/GitHub.",
-  "- Optional connectors (Vercel, Supabase, Sentry) in Settings \u2192 Connectors inject tokens into worktree agent env when connected. Prefer official CLIs (`vercel`, `supabase`, `sentry-cli`). PostHog is the Sideboard tool `posthog_api` (GET by default; POST `/api/projects/:id/query/` or `/api/environments/:id/query/` is a read and does not need write=true; other POST and PATCH need write=true only when the user asked to change data). The PostHog key stays in the vault \u2014 do not read it from the environment. If a connector MCP needsAuth or is unauthorized, do not sign in \u2014 use the native CLI or `posthog_api`. Tell any worktree agent (Claude / Cursor / Codex / OpenCode) to write CLI output to `.context/cli/` and read a slice. If a CLI is missing, the user presses Install CLI on that row. Do not add vendor MCPs. Git (`gh`) stays Settings \u2192 Git; issue tracking stays Settings \u2192 Issues. The phone remote is Settings \u2192 Remote \u2014 do not look up Slack users.",
+  "- Optional connectors (Vercel, Supabase, Sentry) in Settings \u2192 Connectors inject tokens into worktree agent env when connected. Prefer official CLIs (`vercel`, `supabase`, `sentry-cli`). When Settings \u2192 Connectors has a PostHog personal API key, PostHog is the Sideboard tool `posthog_api` (GET by default; POST `/api/projects/:id/query/` or `/api/environments/:id/query/` is a read and does not need write=true; other POST and PATCH need write=true only when the user asked to change data). The PostHog key stays in the vault \u2014 do not read it from the environment, and do not sign in to a PostHog MCP. When no PostHog API key is set, leave the Claude PostHog connector alone. If a Vercel, Supabase, or Sentry MCP needsAuth or is unauthorized, do not sign in \u2014 use the native CLI. Tell any worktree agent (Claude / Cursor / Codex / OpenCode) to write CLI output to `.context/cli/` and read a slice. If a CLI is missing, the user presses Install CLI on that row. Do not add vendor MCPs. Git (`gh`) stays Settings \u2192 Git; issue tracking stays Settings \u2192 Issues. The phone remote is Settings \u2192 Remote \u2014 do not look up Slack users.",
   "- get_pr_stack / open_pr_stack_layers / add_stack_layer / create_pr_stack \u2014 GitHub stacked PRs (`gh stack`); one worktree per layer",
   "- list_models \u2014 only when you need a specific model (rare); otherwise omit model so Account defaults apply",
   "- list_chats / get_chat \u2014 live thread list (parent id + last message preview). get_chat on this orchestration chat lists child worktree agents (status + lastText). blockedReason is why that agent is waiting on a person. Also includes usage / lastTurnUsage.",

package/dist/{chunk-4YXXLWDI.js → chunk-YKO6HG74.js}

@@ -8,11 +8,11 @@ import {
   isGlobalThread,
   isOrchestratorThread,
   isSlackCoordinatorThread
-} from "./chunk-ZRQWV3MS.js";
+} from "./chunk-YEIPPZ5W.js";
 import {
   mergeAgentGitAuthEnv,
   resolveAgentGitAuthEnv
-} from "./chunk-2VGLZIU6.js";
+} from "./chunk-ZEP6JIRF.js";
 import {
   allocateTeamName,
   createEmptyThread,
@@ -43,7 +43,7 @@ import {
 import {
   assertOrchestratorCapableAgent,
   contextTokens
-} from "./chunk-36J3IZBS.js";
+} from "./chunk-RSATPXU4.js";
 import {
   stripNestedElectronEnv
 } from "./chunk-4TR3HZFT.js";
@@ -1776,7 +1776,7 @@ var PORT_RANGE_SIZE = 10;
 var RECLAIM_RETRY_DELAY_MS = 40;
 var RECLAIM_TRIES = 8;
 async function killReclaimable(ports, worktreePath, signal) {
-  const { killListenersOnPorts: killListenersOnPorts2, killStaleWorktreeListeners: killStaleWorktreeListeners2 } = await import("./conductor-MAYZSFL6.js");
+  const { killListenersOnPorts: killListenersOnPorts2, killStaleWorktreeListeners: killStaleWorktreeListeners2 } = await import("./conductor-ZQZTYXSX.js");
   if (worktreePath) killStaleWorktreeListeners2(ports, worktreePath, signal);
   else killListenersOnPorts2(ports);
 }

package/dist/{chunk-2VGLZIU6.js → chunk-ZEP6JIRF.js}

@@ -24,7 +24,7 @@ import {
 import {
   getGithubGitAuthMode,
   getGithubPat
-} from "./chunk-36J3IZBS.js";
+} from "./chunk-RSATPXU4.js";
 import {
   worktreesRoot
 } from "./chunk-EHT2DRT4.js";

package/dist/{conductor-P7XPGYF4.js → conductor-7DEMFEIO.js}

@@ -33,14 +33,14 @@ import {
   tryReservePort,
   tryReservePorts,
   worktreeRunPortsPath
-} from "./chunk-WRDKJRWF.js";
+} from "./chunk-BJUHZSZQ.js";
 import "./chunk-AFLNFGGB.js";
-import "./chunk-PO3PDNMV.js";
-import "./chunk-UO5C2L2G.js";
+import "./chunk-E7G7RY6T.js";
+import "./chunk-6SGYGYH7.js";
 import "./chunk-N2WW62LF.js";
 import "./chunk-DD67JWTN.js";
 import "./chunk-2UG25RMK.js";
-import "./chunk-MVZO7QZ2.js";
+import "./chunk-BU6HH5VA.js";
 import "./chunk-NSTQ6QKD.js";
 import {
   stripNestedElectronEnv

package/dist/{conductor-MAYZSFL6.js → conductor-ZQZTYXSX.js}

@@ -31,17 +31,17 @@ import {
   tryReservePort,
   tryReservePorts,
   worktreeRunPortsPath
-} from "./chunk-4YXXLWDI.js";
+} from "./chunk-YKO6HG74.js";
 import "./chunk-YSLCWCMJ.js";
-import "./chunk-ZRQWV3MS.js";
-import "./chunk-2VGLZIU6.js";
+import "./chunk-YEIPPZ5W.js";
+import "./chunk-ZEP6JIRF.js";
 import "./chunk-QB5MDOHL.js";
 import "./chunk-2P4XKWV2.js";
 import "./chunk-MIVX7QKI.js";
 import "./chunk-6K64FJDD.js";
 import "./chunk-UWQ6UCIB.js";
 import "./chunk-QVN2WOKJ.js";
-import "./chunk-36J3IZBS.js";
+import "./chunk-RSATPXU4.js";
 import "./chunk-77WWLBCI.js";
 import {
   stripNestedElectronEnv