@sideboard-ai/core 0.1.293 → 0.1.295

package/dist/index.js

@@ -186,7 +186,7 @@ import {
   worktreeBoardStatus,
   worktreeCleanupSettings,
   writeWorktreeFile
-} from "./chunk-LSHGJI4S.js";
+} from "./chunk-XXT3C2EF.js";
 import {
   LEGACY_PLAN_FILE_REL,
   PLAN_FILE_NAME,
@@ -207,6 +207,7 @@ import {
   BRIGHTSY_MCP_ALLOWED_TOOLS,
   CLAUDE_CHROME_ALLOWED_TOOLS,
   CLAUDE_MODEL_CATALOG,
+  CLAUDE_POSTHOG_CONNECTOR_ALLOWED_TOOLS,
   CLAUDE_PRINT_BG_WAIT_CEILING_MS,
   MAX_ANTHROPIC_CACHE_CONTROL_BLOCKS,
   PLAN_MODE_INSTRUCTION,
@@ -281,7 +282,7 @@ import {
   userMcpNamesToDisable,
   worktreeMcpToolNames,
   writeInjectedMcpConfig
-} from "./chunk-XZW3BXZW.js";
+} from "./chunk-RWIYYFID.js";
 import {
   brightsyMcpServerName,
   connectBrightsyTeam,
@@ -409,7 +410,7 @@ import {
   workspaceAgentChatSummaries,
   worktreeRunPortsPath,
   wrapReviewSkillMarkdown
-} from "./chunk-4YXXLWDI.js";
+} from "./chunk-KCP6IVRI.js";
 import {
   STDERR_EVENT_MAX_CHARS,
   STDOUT_EVENT_MAX_CHARS,
@@ -451,7 +452,7 @@ import {
   visibleToolRowDetail,
   withEventParentId,
   withEventsParentId
-} from "./chunk-YSLCWCMJ.js";
+} from "./chunk-Q3DPZ4DE.js";
 import "./chunk-7H655NEW.js";
 import {
   ABLETIME_OAUTH_CALLBACK_PATH,
@@ -475,7 +476,7 @@ import {
   parseAbleTimeOAuthCallbackUrl,
   resolveAbleTimeOAuthHost,
   startAbleTimeOAuth
-} from "./chunk-3E4NOIXN.js";
+} from "./chunk-3D3GGL6X.js";
 import {
   ableTimeDependencyTarget,
   commentAbleTimeTask,
@@ -500,8 +501,8 @@ import {
   toAbleTimeIssueInfo,
   updateAbleTimeTask,
   verifyAbleTimeConnection
-} from "./chunk-MYJYINTS.js";
-import "./chunk-B3BPLPKQ.js";
+} from "./chunk-LZVWKJXY.js";
+import "./chunk-R3R3ZDFC.js";
 import {
   ABLETIME_MCP_PATH,
   ABLETIME_MCP_PM_PATH,
@@ -522,13 +523,13 @@ import {
   normalizeAbleTimeCredential,
   normalizeAbleTimeHost,
   rewriteAbleTimeError
-} from "./chunk-NFPWLDCH.js";
+} from "./chunk-FAXOEKQR.js";
 import {
   clearOptionalCliPresenceCache,
   detectOptionalServiceClis,
   installOptionalServiceCli,
   optionalCliPresence
-} from "./chunk-OH4EN323.js";
+} from "./chunk-ISEYRGMP.js";
 import {
   OPTIONAL_SERVICES,
   OPTIONAL_SERVICE_IDS,
@@ -544,7 +545,7 @@ import {
   optionalServiceConnected,
   optionalServiceSpec,
   verifyOptionalService
-} from "./chunk-AF2DMY3K.js";
+} from "./chunk-QDDTVIWE.js";
 import {
   getAgentSetupInfo,
   installAgent,
@@ -556,7 +557,7 @@ import {
   prepareTerminalCommand,
   resolveLoginCommand,
   whichOnPath
-} from "./chunk-NXXQFLNQ.js";
+} from "./chunk-B42H6GJR.js";
 import {
   CLOUD_COORDINATOR_BUSY_REPLY,
   CLOUD_COORDINATOR_CANCELED_REPLY,
@@ -609,7 +610,7 @@ import {
   stageBuffersAsAttachments,
   syncWorkspacesFromThreads,
   takenTeamSlugsForOrchestration
-} from "./chunk-ZRQWV3MS.js";
+} from "./chunk-YEIPPZ5W.js";
 import {
   GITHUB_PR_BODY_MAX_CHARS,
   GITHUB_PR_BODY_SAFE_CHARS,
@@ -697,7 +698,7 @@ import {
   suggestSlug,
   switchWorktreeBranch,
   warmGithubAgentAuth
-} from "./chunk-2VGLZIU6.js";
+} from "./chunk-ZEP6JIRF.js";
 import {
   FAMOUS_SOCCER_TEAMS,
   allocateTeamName,
@@ -751,8 +752,9 @@ import {
   setHttpFetchImpl
 } from "./chunk-JAT3JFOS.js";
 import {
-  clipMcpToolResult
-} from "./chunk-K6IOJI3L.js";
+  clipMcpToolResult,
+  cursorToolErrorText
+} from "./chunk-ER6BGGME.js";
 import "./chunk-AXQ4ZWHK.js";
 import {
   AGENT_RUNNER_MAX_OLD_SPACE_MB,
@@ -768,8 +770,8 @@ import {
   trustSystemCertificates,
   turnCostUsdFromCursorUsage,
   withMaxOldSpaceSize
-} from "./chunk-7UUILVMV.js";
-import "./chunk-MIVX7QKI.js";
+} from "./chunk-IOY2LF3Y.js";
+import "./chunk-HO5R3ZRH.js";
 import {
   ATTACHMENTS_DIR,
   CLI_DIR,
@@ -903,6 +905,7 @@ import {
   isIssueSourceConnected,
   isLinearConnected,
   isOrchestratorCapableAgent,
+  isPosthogConnected,
   isSecureFileEncrypted,
   isUsageOnLimit,
   issueSourceLabel,
@@ -965,7 +968,7 @@ import {
   withTurnScopedCost,
   writeSecureJson,
   writeViewerContext
-} from "./chunk-36J3IZBS.js";
+} from "./chunk-RSATPXU4.js";
 import {
   THINKING_EFFORTS,
   isThinkingEffort,
@@ -3594,8 +3597,18 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 function wrapToolCallback(fn, cwd) {
   return async (...args) => {
-    const result = await fn(...args);
-    return clipMcpToolResult(result, cwd());
+    try {
+      const result = await fn(...args);
+      return clipMcpToolResult(
+        result,
+        cwd()
+      );
+    } catch (err) {
+      return {
+        isError: true,
+        content: [{ type: "text", text: cursorToolErrorText(err) }]
+      };
+    }
   };
 }
 function wrapRegistrar(orig, cwd) {
@@ -4810,6 +4823,7 @@ async function runPosthogApi(input) {
 }
 var POSTHOG_API_DESCRIPTION = "Call the connected PostHog project (Settings \u2192 Connectors). path must start with /api/ and is joined to the stored host. GET is the default. POST /api/projects/:id/query/ and POST /api/environments/:id/query/ are reads (HogQL and insights) and do not need write=true. Other POST and PATCH require write=true, and only when the user asked to change PostHog data. The API key is not in the environment. Do not sign in to a PostHog MCP.";
 function registerPosthogTools(server) {
+  if (!isPosthogConnected()) return;
   server.tool(
     "posthog_api",
     POSTHOG_API_DESCRIPTION,
@@ -5127,7 +5141,7 @@ async function handleJobStop(params, _ctx) {
   return stopDetachedJob(jobCwd(rec), id, reason ? { reason } : void 0);
 }
 async function defaultTurnWait(ref, timeoutMs) {
-  const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-BOGVTCWI.js");
+  const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-VDYZSZWY.js");
   const orch = getOrchestrator2();
   const thread = await orch.waitForTurn(ref, timeoutMs, {
     resolveIfStillRunning: true
@@ -5479,7 +5493,7 @@ async function startMcpServer() {
     );
   }
   try {
-    const { maxConcurrentAgents: maxConcurrentAgents2 } = await import("./app-settings-MR2U6AXN.js");
+    const { maxConcurrentAgents: maxConcurrentAgents2 } = await import("./app-settings-3OQWRKOK.js");
     orch.setMaxConcurrent(maxConcurrentAgents2());
   } catch {
   }
@@ -6002,7 +6016,7 @@ async function startMcpServer() {
   if (!worktreeProfile) {
     registerConnectedIssueVendorTools(server);
     const { getCaffeinateHold: getCaffeinateHold2, setCaffeinateHold: setCaffeinateHold2 } = await import("./caffeinate-hold-DYJGWK6Y.js");
-    const { resolveNewThreadOptions: resolveNewThreadOptions2, resolveThreadDefaults: resolveThreadDefaults2 } = await import("./app-settings-MR2U6AXN.js");
+    const { resolveNewThreadOptions: resolveNewThreadOptions2, resolveThreadDefaults: resolveThreadDefaults2 } = await import("./app-settings-3OQWRKOK.js");
     const accountDefaults = resolveThreadDefaults2();
     const accountDefaultsHint = `Account defaults: agent=${accountDefaults.agent}, model=${accountDefaults.model?.trim() || "Auto"}, effort=${accountDefaults.effort}`;
     server.tool(
@@ -13240,7 +13254,7 @@ async function continueSourceThread(threadId, prompt) {
       await continueOnReply(threadId, prompt);
       return;
     }
-    const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-BOGVTCWI.js");
+    const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-VDYZSZWY.js");
     await getOrchestrator2().send(threadId, prompt);
   } catch {
   }
@@ -13537,6 +13551,7 @@ export {
   CHAT_TEXT_SCALE_DEFAULT,
   CLAUDE_CHROME_ALLOWED_TOOLS,
   CLAUDE_MODEL_CATALOG,
+  CLAUDE_POSTHOG_CONNECTOR_ALLOWED_TOOLS,
   CLAUDE_PRINT_BG_WAIT_CEILING_MS,
   CLAUDE_SUMMARY_TIMEOUT_MS,
   CLI_DIR,
@@ -14093,6 +14108,7 @@ export {
   isPlaceholderBranch,
   isPlanQuestionAnswersMessage,
   isPollWrapperToolName,
+  isPosthogConnected,
   isPrNotMergeableError,
   isPresentPlanToolName,
   isPrimaryCheckoutThread,

package/dist/mcp/run-stdio.cjs

@@ -776,30 +776,6 @@ var init_system_ca = __esm({
   }
 });
 
-// src/paths/workspace-scratch.ts
-function attachmentsGitignoreBody() {
-  return ATTACHMENTS_GITIGNORE;
-}
-function isWorkspaceScratchPath(relativePath) {
-  const p = relativePath.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/$/, "");
-  return p === ATTACHMENTS_DIR || p.startsWith(`${ATTACHMENTS_DIR}/`) || p === CLI_DIR || p.startsWith(`${CLI_DIR}/`) || p === LEGACY_ATTACHMENTS_DIR || p.startsWith(`${LEGACY_ATTACHMENTS_DIR}/`) || p === ".sideboard" || p.startsWith(".sideboard/") || p === ".context" || p.startsWith(".context/");
-}
-var ATTACHMENTS_DIR, CLI_DIR, DETACHED_JOBS_DIR, LEGACY_ATTACHMENTS_DIR, LEGACY_DETACHED_JOBS_DIR, ATTACHMENTS_GITIGNORE;
-var init_workspace_scratch = __esm({
-  "src/paths/workspace-scratch.ts"() {
-    "use strict";
-    ATTACHMENTS_DIR = ".context/attachments";
-    CLI_DIR = ".context/cli";
-    DETACHED_JOBS_DIR = ".context/.sideboard/detached-jobs";
-    LEGACY_ATTACHMENTS_DIR = ".sideboard/attachments";
-    LEGACY_DETACHED_JOBS_DIR = ".sideboard/detached-jobs";
-    ATTACHMENTS_GITIGNORE = `# Sideboard / workspace attachments (local only)
-*
-!.gitignore
-`;
-  }
-});
-
 // src/agents/cursor-stream-cutoff.ts
 function looksLikeCursorStreamCutOff(text7) {
   return CURSOR_STREAM_CUTOFF.test(text7.trim());
@@ -1200,6 +1176,30 @@ var init_error_detail = __esm({
   }
 });
 
+// src/paths/workspace-scratch.ts
+function attachmentsGitignoreBody() {
+  return ATTACHMENTS_GITIGNORE;
+}
+function isWorkspaceScratchPath(relativePath) {
+  const p = relativePath.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/$/, "");
+  return p === ATTACHMENTS_DIR || p.startsWith(`${ATTACHMENTS_DIR}/`) || p === CLI_DIR || p.startsWith(`${CLI_DIR}/`) || p === LEGACY_ATTACHMENTS_DIR || p.startsWith(`${LEGACY_ATTACHMENTS_DIR}/`) || p === ".sideboard" || p.startsWith(".sideboard/") || p === ".context" || p.startsWith(".context/");
+}
+var ATTACHMENTS_DIR, CLI_DIR, DETACHED_JOBS_DIR, LEGACY_ATTACHMENTS_DIR, LEGACY_DETACHED_JOBS_DIR, ATTACHMENTS_GITIGNORE;
+var init_workspace_scratch = __esm({
+  "src/paths/workspace-scratch.ts"() {
+    "use strict";
+    ATTACHMENTS_DIR = ".context/attachments";
+    CLI_DIR = ".context/cli";
+    DETACHED_JOBS_DIR = ".context/.sideboard/detached-jobs";
+    LEGACY_ATTACHMENTS_DIR = ".sideboard/attachments";
+    LEGACY_DETACHED_JOBS_DIR = ".sideboard/detached-jobs";
+    ATTACHMENTS_GITIGNORE = `# Sideboard / workspace attachments (local only)
+*
+!.gitignore
+`;
+  }
+});
+
 // src/agents/message-parts.ts
 function asRecord(input) {
   if (input && typeof input === "object" && !Array.isArray(input)) {
@@ -4637,6 +4637,7 @@ __export(app_settings_exports, {
   isChatTextScale: () => isChatTextScale,
   isIssueSourceConnected: () => isIssueSourceConnected,
   isLinearConnected: () => isLinearConnected,
+  isPosthogConnected: () => isPosthogConnected,
   isUsageOnLimit: () => isUsageOnLimit,
   issueSourceLabel: () => issueSourceLabel,
   loadAppSettings: () => loadAppSettings,
@@ -5841,6 +5842,9 @@ function disconnectLinearConnection() {
   delete integrations.linearOrganizationName;
   return saveAppSettings({ ...current, integrations });
 }
+function isPosthogConnected(settings = loadAppSettings()) {
+  return Boolean(settings.integrations.posthogPersonalApiKey?.trim());
+}
 function isAbleTimeConnected(settings = loadAppSettings()) {
   return Boolean(
     settings.integrations.abletimeAccessToken?.trim() || settings.integrations.abletimeRefreshToken?.trim()
@@ -9941,7 +9945,7 @@ var init_coordinator_prompt = __esm({
       "- linear_* (when Linear is connected) \u2014 list_teams for team key/states; linear_list_projects for project names; get/search include the project a ticket is on; get/create/update/comment with ENG-123. Worktree agents have the same Account tools \u2014 prefer they comment, update status, and create spin-offs (parent=) on their own ticket when they were asked to do the work. When reviewing a PR or ticket, do not comment or update until the user types a next step \u2014 they should work through the feedback in chat first. Do not tell the child to ask_user after the review. Scope errors: reconnect Linear in Account settings. Prefer these over any Linear MCP the CLI may still list.",
       "- github_* \u2014 get/comment/update/create GitHub issues via Account `gh` (#123). github_list_projects and get/search include GitHub Projects. projectsError or a missing read:project scope \u2192 `gh auth refresh -s read:project`. Worktree agents have these too. Prefer over any vendor GitHub MCP. Pass parent= for spin-offs. When reviewing a PR or ticket, do not comment, submit `gh pr review`, or update the PR/ticket until the user types a next step.",
       "- abletime_* (when AbleTime is connected) \u2014 orientation first; abletime_list_projects lists projects; get/list include the project a task is on; get/comment/update/create (parent= for spin-offs); ensure_task when work has no ticket (or create_workspace from the default branch auto-creates one). Worktree agents have the same Account tools. Same review-write gate as Linear/GitHub.",
-      "- Optional connectors (Vercel, Supabase, Sentry) in Settings \u2192 Connectors inject tokens into worktree agent env when connected. Prefer official CLIs (`vercel`, `supabase`, `sentry-cli`). PostHog is the Sideboard tool `posthog_api` (GET by default; POST `/api/projects/:id/query/` or `/api/environments/:id/query/` is a read and does not need write=true; other POST and PATCH need write=true only when the user asked to change data). The PostHog key stays in the vault \u2014 do not read it from the environment. If a connector MCP needsAuth or is unauthorized, do not sign in \u2014 use the native CLI or `posthog_api`. Tell any worktree agent (Claude / Cursor / Codex / OpenCode) to write CLI output to `.context/cli/` and read a slice. If a CLI is missing, the user presses Install CLI on that row. Do not add vendor MCPs. Git (`gh`) stays Settings \u2192 Git; issue tracking stays Settings \u2192 Issues. The phone remote is Settings \u2192 Remote \u2014 do not look up Slack users.",
+      "- Optional connectors (Vercel, Supabase, Sentry) in Settings \u2192 Connectors inject tokens into worktree agent env when connected. Prefer official CLIs (`vercel`, `supabase`, `sentry-cli`). When Settings \u2192 Connectors has a PostHog personal API key, PostHog is the Sideboard tool `posthog_api` (GET by default; POST `/api/projects/:id/query/` or `/api/environments/:id/query/` is a read and does not need write=true; other POST and PATCH need write=true only when the user asked to change data). The PostHog key stays in the vault \u2014 do not read it from the environment, and do not sign in to a PostHog MCP. When no PostHog API key is set, leave the Claude PostHog connector alone. If a Vercel, Supabase, or Sentry MCP needsAuth or is unauthorized, do not sign in \u2014 use the native CLI. Tell any worktree agent (Claude / Cursor / Codex / OpenCode) to write CLI output to `.context/cli/` and read a slice. If a CLI is missing, the user presses Install CLI on that row. Do not add vendor MCPs. Git (`gh`) stays Settings \u2192 Git; issue tracking stays Settings \u2192 Issues. The phone remote is Settings \u2192 Remote \u2014 do not look up Slack users.",
       "- get_pr_stack / open_pr_stack_layers / add_stack_layer / create_pr_stack \u2014 GitHub stacked PRs (`gh stack`); one worktree per layer",
       "- list_models \u2014 only when you need a specific model (rare); otherwise omit model so Account defaults apply",
       "- list_chats / get_chat \u2014 live thread list (parent id + last message preview). get_chat on this orchestration chat lists child worktree agents (status + lastText). blockedReason is why that agent is waiting on a person. Also includes usage / lastTurnUsage.",
@@ -11136,7 +11140,7 @@ function mcpAllowToolsFromNames(names) {
     [...names].map((name) => name.trim()).filter(Boolean).map((name) => ({ name, connected: true, needsAuth: false }))
   );
 }
-var BASE_ALLOWED_TOOLS, CLAUDE_PRINT_BG_WAIT_CEILING_MS, CLAUDE_CHROME_ALLOWED_TOOLS;
+var BASE_ALLOWED_TOOLS, CLAUDE_PRINT_BG_WAIT_CEILING_MS, CLAUDE_CHROME_ALLOWED_TOOLS, CLAUDE_POSTHOG_CONNECTOR_ALLOWED_TOOLS;
 var init_claude_mcp = __esm({
   "src/agents/claude-mcp.ts"() {
     "use strict";
@@ -11163,6 +11167,10 @@ var init_claude_mcp = __esm({
       "mcp__claude-in-chrome__*",
       "Skill(claude-in-chrome)"
     ];
+    CLAUDE_POSTHOG_CONNECTOR_ALLOWED_TOOLS = [
+      "mcp__claude_ai_PostHog",
+      "mcp__claude_ai_PostHog__*"
+    ];
   }
 });
 
@@ -11510,11 +11518,9 @@ var init_node_launch = __esm({
 
 // src/agents/injected-mcp.ts
 function sideboardWorktreeAllowedTools(opts) {
-  const out = [...SIDEBOARD_ARTIFACT_MCP_ALLOWED_TOOLS];
-  if (!opts?.planMode) {
-    const idx = out.indexOf("mcp__sideboard__present_plan");
-    if (idx >= 0) out.splice(idx, 1);
-  }
+  const out = SIDEBOARD_ARTIFACT_MCP_ALLOWED_TOOLS.filter(
+    (tool) => (opts?.planMode || tool !== "mcp__sideboard__present_plan") && (opts?.posthog || tool !== "mcp__sideboard__posthog_api")
+  );
   if (opts?.github !== false) out.push(...SIDEBOARD_GITHUB_MCP_ALLOWED_TOOLS);
   if (opts?.linear) out.push(...SIDEBOARD_LINEAR_MCP_ALLOWED_TOOLS);
   if (opts?.abletime) out.push(...SIDEBOARD_ABLETIME_MCP_ALLOWED_TOOLS);
@@ -12742,9 +12748,11 @@ var init_claude = __esm({
               github: true,
               linear: isLinearConnected(),
               abletime: isAbleTimeConnected(),
-              planMode: thread.planMode
+              planMode: thread.planMode,
+              posthog: isPosthogConnected()
             }),
-            ...brightsyMcpAllowedTools(injectedBrightsyNames)
+            ...brightsyMcpAllowedTools(injectedBrightsyNames),
+            ...isPosthogConnected() ? [] : CLAUDE_POSTHOG_CONNECTOR_ALLOWED_TOOLS
           ];
         }
         if (chromeOn) {
@@ -24267,6 +24275,12 @@ function connectorDirectiveLine(spec, cli) {
   }
   return `- ${spec.label}: call \`posthog_api\`. Path must start with \`/api/\`. GET is the default. POST \`/api/projects/:id/query/\` or \`/api/environments/:id/query/\` is a read and does not need \`write=true\`. Other POST and PATCH require \`write=true\` only when the user asked to change data. Do not read the API key from the environment. Do not add a ${spec.label} MCP.`;
 }
+function connectorAuthCaution(posthog, cliConnected) {
+  const signIn = posthog ? "If a connector MCP is listed but needsAuth or returns unauthorized, do not sign in to that MCP." : "If a Vercel, Supabase, or Sentry MCP is listed but needsAuth or returns unauthorized, do not sign in to that MCP.";
+  const token = cliConnected ? " CLI tokens are already in this process." : "";
+  const key = posthog ? " Do not read a PostHog key from the environment." : "";
+  return `${signIn}${token}${key}`;
+}
 function connectorReminderBit(spec, cli) {
   if (!spec.cli) return `${spec.label}: \`posthog_api\``;
   const presence = cliPresencePhrase(spec, cli);
@@ -24276,10 +24290,11 @@ function formatOptionalServicesDirective(integrations, cli) {
   const connected = connectedOptionalServices(integrations);
   if (connected.length === 0) return null;
   const cliConnected = connected.some((spec) => spec.cli);
+  const posthog = connected.some((spec) => spec.id === "posthog");
   const lines = [
     cliConnected ? "Optional connectors (connected \u2014 CLI tokens are already in this process env):" : "Optional connectors (connected):",
     ...connected.map((spec) => connectorDirectiveLine(spec, cli)),
-    cliConnected ? "If a connector MCP is listed but needsAuth or returns unauthorized, do not sign in to that MCP. CLI tokens are already in this process. Do not read a PostHog key from the environment." : "If a connector MCP is listed but needsAuth or returns unauthorized, do not sign in to that MCP. Do not read a PostHog key from the environment.",
+    connectorAuthCaution(posthog, cliConnected),
     "Do not add a vendor MCP. When a binary is missing, ask the user to press Install CLI in Settings \u2192 Connectors.",
     "When you shell a connector CLI, write bulky output to `.context/cli/` and read a slice."
   ];
@@ -24290,7 +24305,9 @@ function formatOptionalServicesReminder(integrations, cli) {
   if (connected.length === 0) return null;
   const bits = connected.map((spec) => connectorReminderBit(spec, cli)).join(". ");
   const tokenBit = connected.some((spec) => spec.cli) ? "CLI tokens are already in this process. " : "";
-  return `Settings \u2192 Connectors: ${tokenBit}${bits}. If a connector MCP needsAuth or is unauthorized, ignore it and use the CLI or \`posthog_api\`. Do not add vendor MCPs. Do not read a PostHog key from the environment. Shell dumps from those CLIs go in \`.context/cli/\` \u2014 read a slice.`;
+  const posthog = connected.some((spec) => spec.id === "posthog");
+  const auth = posthog ? "If a connector MCP needsAuth or is unauthorized, ignore it and use the CLI or `posthog_api`. Do not read a PostHog key from the environment." : "If a Vercel, Supabase, or Sentry MCP needsAuth or is unauthorized, ignore it and use the CLI.";
+  return `Settings \u2192 Connectors: ${tokenBit}${bits}. ${auth} Do not add vendor MCPs. Shell dumps from those CLIs go in \`.context/cli/\` \u2014 read a slice.`;
 }
 async function connectedCliPresence(integrations) {
   const ids = connectedOptionalServices(integrations).filter((spec) => spec.cli).map((spec) => spec.id);
@@ -28423,6 +28440,10 @@ var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
 // src/mcp/wrap-mcp-tools.ts
 var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
 
+// src/agents/cursor-tool-guard.ts
+init_error_detail();
+init_cursor_stream_cutoff();
+
 // src/agents/tool-result-clip.ts
 var import_node_fs7 = require("fs");
 var import_node_path8 = require("path");
@@ -28471,11 +28492,30 @@ function clipMcpToolResult(result, cwd) {
   };
 }
 
+// src/agents/cursor-tool-guard.ts
+var CURSOR_TOOL_RECOVERY_HINT = "Continue with a smaller request. If you were reading a large file or API payload, pass offset and limit or write the output to .context/cli/ and read a slice. Do not retry the same call.";
+function cursorToolErrorText(err) {
+  const raw = formatUnknownDetail(err).replace(/\s+/g, " ").trim();
+  const message = looksLikeHugeToolResultDump(raw) ? HUGE_TOOL_RESULT_SUMMARY : (raw || "unknown tool error").slice(0, 500);
+  return `Error: ${message}
+${CURSOR_TOOL_RECOVERY_HINT}`;
+}
+
 // src/mcp/wrap-mcp-tools.ts
 function wrapToolCallback(fn, cwd) {
   return async (...args) => {
-    const result = await fn(...args);
-    return clipMcpToolResult(result, cwd());
+    try {
+      const result = await fn(...args);
+      return clipMcpToolResult(
+        result,
+        cwd()
+      );
+    } catch (err) {
+      return {
+        isError: true,
+        content: [{ type: "text", text: cursorToolErrorText(err) }]
+      };
+    }
   };
 }
 function wrapRegistrar(orig, cwd) {
@@ -31645,6 +31685,7 @@ async function runPosthogApi(input) {
 }
 var POSTHOG_API_DESCRIPTION = "Call the connected PostHog project (Settings \u2192 Connectors). path must start with /api/ and is joined to the stored host. GET is the default. POST /api/projects/:id/query/ and POST /api/environments/:id/query/ are reads (HogQL and insights) and do not need write=true. Other POST and PATCH require write=true, and only when the user asked to change PostHog data. The API key is not in the environment. Do not sign in to a PostHog MCP.";
 function registerPosthogTools(server) {
+  if (!isPosthogConnected()) return;
   server.tool(
     "posthog_api",
     POSTHOG_API_DESCRIPTION,

package/dist/mcp/run-stdio.js

@@ -50,7 +50,7 @@ import {
   syncBoardPins,
   updateSchedule,
   workspaceTagTargetRef
-} from "../chunk-IP5WSADC.js";
+} from "../chunk-YFKAC4LB.js";
 import "../chunk-LX5R5JOR.js";
 import {
   commentAbleTimeTask,
@@ -70,12 +70,12 @@ import {
   searchAbleTimeTasks,
   toAbleTimeIssueInfo,
   updateAbleTimeTask
-} from "../chunk-Y67TBJD5.js";
-import "../chunk-AHH5USEA.js";
-import "../chunk-GU6DT6NO.js";
+} from "../chunk-MOP5L5QZ.js";
+import "../chunk-SSETL5EX.js";
+import "../chunk-HSF2RQSQ.js";
 import {
   normalizeServiceOrigin
-} from "../chunk-4BXRRHDC.js";
+} from "../chunk-XCXUVX7I.js";
 import {
   PRESENT_PLAN_REQUIRES_PLAN_MODE,
   PRESENT_PLAN_TOOL_DESCRIPTION,
@@ -93,8 +93,8 @@ import {
   sideboardMcpProfile,
   trustSystemCertificates,
   worktreeMcpToolNames
-} from "../chunk-RPCKGO3J.js";
-import "../chunk-W2KZTDET.js";
+} from "../chunk-ABLHTRRG.js";
+import "../chunk-WZCPZVUC.js";
 import "../chunk-7IAMHN2N.js";
 import "../chunk-PXMLMBMI.js";
 import {
@@ -110,16 +110,18 @@ import {
   waitForDetachedJob,
   waitForTurnToolResult,
   workspaceAgentChatSummaries
-} from "../chunk-WRDKJRWF.js";
+} from "../chunk-HWIIRVYE.js";
 import {
+  HUGE_TOOL_RESULT_SUMMARY,
   clipToolResultForStore,
+  formatUnknownDetail,
   isInternalAgentStatusText,
   looksLikeHugeToolResultDump
-} from "../chunk-AFLNFGGB.js";
+} from "../chunk-ED4ZXQVO.js";
 import {
   GLOBAL_WORKSPACE_ID,
   isCloudCoordinatorThread
-} from "../chunk-PO3PDNMV.js";
+} from "../chunk-E7G7RY6T.js";
 import {
   canonicalizeRepoPath,
   formatGhLandError,
@@ -130,7 +132,7 @@ import {
   resolveListPrsOptions,
   resolveRepoRoot,
   warmGithubAgentAuth
-} from "../chunk-UO5C2L2G.js";
+} from "../chunk-6SGYGYH7.js";
 import {
   CLI_DIR
 } from "../chunk-N2WW62LF.js";
@@ -145,13 +147,14 @@ import {
   formatWorkspaceProfileSuffix,
   isAbleTimeConnected,
   isLinearConnected,
+  isPosthogConnected,
   loadAppSettings,
   resolveEffectiveIssueSource,
   resolveProjectReviewLabel,
   resolveViewerProfile,
   resolveViewerProfileForRepo,
   saveLinearOAuth
-} from "../chunk-MVZO7QZ2.js";
+} from "../chunk-BU6HH5VA.js";
 import "../chunk-NSTQ6QKD.js";
 import {
   dropNestedElectronEnvFromProcess
@@ -221,11 +224,30 @@ function clipMcpToolResult(result, cwd) {
   };
 }
 
+// src/agents/cursor-tool-guard.ts
+var CURSOR_TOOL_RECOVERY_HINT = "Continue with a smaller request. If you were reading a large file or API payload, pass offset and limit or write the output to .context/cli/ and read a slice. Do not retry the same call.";
+function cursorToolErrorText(err) {
+  const raw = formatUnknownDetail(err).replace(/\s+/g, " ").trim();
+  const message = looksLikeHugeToolResultDump(raw) ? HUGE_TOOL_RESULT_SUMMARY : (raw || "unknown tool error").slice(0, 500);
+  return `Error: ${message}
+${CURSOR_TOOL_RECOVERY_HINT}`;
+}
+
 // src/mcp/wrap-mcp-tools.ts
 function wrapToolCallback(fn, cwd) {
   return async (...args) => {
-    const result = await fn(...args);
-    return clipMcpToolResult(result, cwd());
+    try {
+      const result = await fn(...args);
+      return clipMcpToolResult(
+        result,
+        cwd()
+      );
+    } catch (err) {
+      return {
+        isError: true,
+        content: [{ type: "text", text: cursorToolErrorText(err) }]
+      };
+    }
   };
 }
 function wrapRegistrar(orig, cwd) {
@@ -3315,6 +3337,7 @@ async function runPosthogApi(input) {
 }
 var POSTHOG_API_DESCRIPTION = "Call the connected PostHog project (Settings \u2192 Connectors). path must start with /api/ and is joined to the stored host. GET is the default. POST /api/projects/:id/query/ and POST /api/environments/:id/query/ are reads (HogQL and insights) and do not need write=true. Other POST and PATCH require write=true, and only when the user asked to change PostHog data. The API key is not in the environment. Do not sign in to a PostHog MCP.";
 function registerPosthogTools(server) {
+  if (!isPosthogConnected()) return;
   server.tool(
     "posthog_api",
     POSTHOG_API_DESCRIPTION,
@@ -3828,7 +3851,7 @@ async function startMcpServer() {
     );
   }
   try {
-    const { maxConcurrentAgents } = await import("../app-settings-EHMXHNG5.js");
+    const { maxConcurrentAgents } = await import("../app-settings-2IH42VA5.js");
     orch.setMaxConcurrent(maxConcurrentAgents());
   } catch {
   }
@@ -4351,7 +4374,7 @@ async function startMcpServer() {
   if (!worktreeProfile) {
     registerConnectedIssueVendorTools(server);
     const { getCaffeinateHold, setCaffeinateHold } = await import("../caffeinate-hold-7JM5H5P3.js");
-    const { resolveNewThreadOptions, resolveThreadDefaults } = await import("../app-settings-EHMXHNG5.js");
+    const { resolveNewThreadOptions, resolveThreadDefaults } = await import("../app-settings-2IH42VA5.js");
     const accountDefaults = resolveThreadDefaults();
     const accountDefaultsHint = `Account defaults: agent=${accountDefaults.agent}, model=${accountDefaults.model?.trim() || "Auto"}, effort=${accountDefaults.effort}`;
     server.tool(

package/dist/{optional-cli-FRUZSZ3U.js → optional-cli-JQVNSMSU.js}

@@ -4,16 +4,16 @@ import {
   OPTIONAL_SERVICES,
   isOptionalServiceId,
   optionalServiceSpec
-} from "./chunk-4BXRRHDC.js";
+} from "./chunk-XCXUVX7I.js";
 import {
   installNpmGlobalPackage,
   whichOnPath
-} from "./chunk-W2KZTDET.js";
+} from "./chunk-WZCPZVUC.js";
 import "./chunk-2GPQZZLY.js";
 import {
   enrichPathWithNpmGlobalBin
 } from "./chunk-2UG25RMK.js";
-import "./chunk-MVZO7QZ2.js";
+import "./chunk-BU6HH5VA.js";
 import "./chunk-NSTQ6QKD.js";
 import "./chunk-WWUABK6B.js";
 import "./chunk-FJZWM2ON.js";

package/dist/{optional-cli-6SW4OOX3.js → optional-cli-PZXDOVJJ.js}

@@ -3,12 +3,12 @@ import {
   detectOptionalServiceClis,
   installOptionalServiceCli,
   optionalCliPresence
-} from "./chunk-OH4EN323.js";
-import "./chunk-AF2DMY3K.js";
-import "./chunk-NXXQFLNQ.js";
+} from "./chunk-ISEYRGMP.js";
+import "./chunk-QDDTVIWE.js";
+import "./chunk-B42H6GJR.js";
 import "./chunk-JAT3JFOS.js";
 import "./chunk-QVN2WOKJ.js";
-import "./chunk-36J3IZBS.js";
+import "./chunk-RSATPXU4.js";
 import "./chunk-77WWLBCI.js";
 import "./chunk-4TR3HZFT.js";
 import "./chunk-WDRMZKVB.js";