@sideboard-ai/core 0.1.308 → 0.1.310

package/dist/{chunk-MMVMQ34G.js → chunk-Y3Y7SZBZ.js}

@@ -1,7 +1,7 @@
 import {
   extractJsonErrorMessage,
   formatUnknownDetail
-} from "./chunk-HO5R3ZRH.js";
+} from "./chunk-5XNT6BCG.js";
 import {
   npmGlobalNodeModules,
   run
@@ -113,31 +113,60 @@ function applySystemCaEnv(env) {
   const inherited = process.env.NODE_EXTRA_CA_CERTS?.trim();
   if (inherited) env[NODE_EXTRA_CA_CERTS] = inherited;
 }
-function extraCertsFromBundle() {
+function extraCertsFromBundle(io = {}) {
   const path = process.env.NODE_EXTRA_CA_CERTS?.trim();
   if (path) return splitPemCertificates(readExistingFile(path));
-  const dest = systemCaBundlePath();
-  return splitPemCertificates(readExistingFile(dest));
+  return splitPemCertificates(readExistingFile(systemCaBundlePath(io)));
+}
+function extraSystemCaPems(io = {}) {
+  const fromBundle = extraCertsFromBundle(io);
+  if (fromBundle.length > 0) return fromBundle;
+  return splitPemCertificates(collectSystemCaPem(io));
+}
+function mergeSystemCaIntoTlsOptions(options, extra, roots = tls.rootCertificates) {
+  const existing = options?.ca;
+  const base = existing == null ? [...roots] : Array.isArray(existing) ? [...existing] : [existing];
+  return { ...options, ca: [...base, ...extra] };
+}
+function systemCaTlsOptions(io = {}) {
+  const extra = extraSystemCaPems(io);
+  if (extra.length === 0) return {};
+  return { ca: [...tls.rootCertificates, ...extra] };
+}
+function installCreateSecureContextCaPatch(api, extra) {
+  if (api.__sideboardSystemCaPatched) return true;
+  if (typeof api.createSecureContext !== "function") return false;
+  const orig = api.createSecureContext;
+  const roots = api.rootCertificates ?? tls.rootCertificates;
+  api.createSecureContext = ((options) => orig(mergeSystemCaIntoTlsOptions(options, extra, roots)));
+  api.__sideboardSystemCaPatched = true;
+  return true;
 }
 function trustSystemCertificates(io = {}) {
   try {
-    const api = tls;
-    if (typeof api.getCACertificates !== "function" || typeof api.setDefaultCACertificates !== "function") {
-      return false;
+    const extra = extraSystemCaPems(io);
+    const api = io.tls ?? tls;
+    if (typeof api.getCACertificates === "function" && typeof api.setDefaultCACertificates === "function") {
+      const current = api.getCACertificates("default");
+      const system = api.getCACertificates("system");
+      if (system.length === 0 && extra.length === 0) return false;
+      api.setDefaultCACertificates([...current, ...system, ...extra]);
+      return true;
     }
-    const current = api.getCACertificates("default");
-    const system = api.getCACertificates("system");
-    let extra = extraCertsFromBundle();
-    if (system.length === 0 && extra.length === 0) {
-      extra = splitPemCertificates(collectSystemCaPem(io));
-    }
-    if (system.length === 0 && extra.length === 0) return false;
-    api.setDefaultCACertificates([...current, ...system, ...extra]);
-    return true;
+    if (extra.length === 0) return false;
+    return installCreateSecureContextCaPatch(api, extra);
   } catch {
     return false;
   }
 }
+function bootstrapSystemCa(io = {}) {
+  const systemCaBundle = materializeSystemCaBundle(io);
+  if (systemCaBundle && !process.env.NODE_EXTRA_CA_CERTS?.trim()) {
+    process.env.NODE_EXTRA_CA_CERTS = systemCaBundle;
+  }
+  applySystemCaEnv(process.env);
+  trustSystemCertificates(io);
+}
 
 // src/agents/node-launch.ts
 import { existsSync as existsSync3, readdirSync, realpathSync } from "fs";
@@ -878,7 +907,9 @@ function ensureCursorRipgrepPath(opts) {
 export {
   materializeSystemCaBundle,
   applySystemCaEnv,
+  systemCaTlsOptions,
   trustSystemCertificates,
+  bootstrapSystemCa,
   packagedCursorRuntimeDir,
   packagedCursorRunnerPath,
   packagedMcpDir,

package/dist/{conductor-E6M3BATZ.js → conductor-AMZ5SKG2.js}

@@ -34,8 +34,8 @@ import {
   tryReservePort,
   tryReservePorts,
   worktreeRunPortsPath
-} from "./chunk-HRPSFU4Q.js";
-import "./chunk-5XQ43YZU.js";
+} from "./chunk-AILQRQ26.js";
+import "./chunk-I5TESHDN.js";
 import "./chunk-X3FSWWW2.js";
 import "./chunk-DLGGLV2M.js";
 import "./chunk-N2WW62LF.js";

package/dist/{conductor-IPIMGUR4.js → conductor-OFXA5BST.js}

@@ -32,14 +32,14 @@ import {
   tryReservePort,
   tryReservePorts,
   worktreeRunPortsPath
-} from "./chunk-CTFBZZGZ.js";
-import "./chunk-F36QRDM4.js";
+} from "./chunk-VBVSJUM2.js";
+import "./chunk-7Q327QF2.js";
 import "./chunk-5QX2NYXL.js";
 import "./chunk-BIPXOHZI.js";
 import "./chunk-HG25AYBV.js";
 import "./chunk-2P4XKWV2.js";
 import "./chunk-F2PVRF3B.js";
-import "./chunk-HO5R3ZRH.js";
+import "./chunk-5XNT6BCG.js";
 import "./chunk-6K64FJDD.js";
 import "./chunk-LG6RJBIY.js";
 import "./chunk-QVN2WOKJ.js";

package/dist/index.cjs

@@ -5362,6 +5362,12 @@ var init_thread_store = __esm({
 function looksLikeCursorStreamCutOff(text7) {
   return CURSOR_STREAM_CUTOFF.test(text7.trim());
 }
+function looksLikeCursorStreamIdleAfterTools(text7) {
+  return CURSOR_STREAM_IDLE_AFTER_TOOLS.test(text7.trim());
+}
+function looksLikeCursorStreamFailure(text7) {
+  return looksLikeCursorStreamCutOff(text7) || looksLikeCursorStreamIdleAfterTools(text7);
+}
 function cursorStreamCutOffContinueLimit(detail) {
   if (looksLikeCursorStreamCutOff(detail) || /connection stalled/i.test(detail)) {
     return CURSOR_STREAM_CUTOFF_CONTINUE_LIMIT;
@@ -5373,11 +5379,12 @@ function nextCrashContinueCount(detail, used) {
   if (used >= limit) return null;
   return used + 1;
 }
-var CURSOR_STREAM_CUTOFF, CURSOR_STREAM_CUTOFF_CONTINUE_LIMIT;
+var CURSOR_STREAM_CUTOFF, CURSOR_STREAM_IDLE_AFTER_TOOLS, CURSOR_STREAM_CUTOFF_CONTINUE_LIMIT;
 var init_cursor_stream_cutoff = __esm({
   "src/agents/cursor-stream-cutoff.ts"() {
     "use strict";
     CURSOR_STREAM_CUTOFF = /nghttp2|premature close|\[unavailable\]\s+error\b|http\/2 stream closed|\bcancel \(0x8\)|error code cancel\b/i;
+    CURSOR_STREAM_IDLE_AFTER_TOOLS = /stopped responding after a tool call/i;
     CURSOR_STREAM_CUTOFF_CONTINUE_LIMIT = 3;
   }
 });
@@ -5581,7 +5588,7 @@ function looksLikeRetryableRunnerCrash(text7) {
   if (looksLikeInvalidAgentSession(text7)) return false;
   if (looksLikeV8Oom(text7)) return false;
   if (looksLikeHugeToolResultDump(text7)) return true;
-  if (looksLikeCursorStreamCutOff(text7)) return true;
+  if (looksLikeCursorStreamFailure(text7)) return true;
   if (looksLikeBrightsyEmptyCompletion(text7)) return true;
   const lower = text7.trim().toLowerCase();
   if (/cannot find (?:package|module)|err_module_not_found/.test(lower)) return false;
@@ -5658,7 +5665,7 @@ function humanizeAgentFailDetail(detail) {
   if (/corrupt local agent checkpoint|missing root blob|truncated crash dump/.test(lower)) {
     return `${raw} \u2014 retry the turn (Sideboard will start a fresh Cursor session).`;
   }
-  if (/connection stalled/.test(lower) || looksLikeCursorStreamCutOff(raw)) {
+  if (/connection stalled/.test(lower) || looksLikeCursorStreamFailure(raw)) {
     return /retry the turn/i.test(raw) ? raw : `${raw} \u2014 retry the turn (Sideboard will start a fresh Cursor session).`;
   }
   if (looksLikeBrightsyEmptyCompletion(raw)) {
@@ -14359,31 +14366,60 @@ function applySystemCaEnv(env) {
   const inherited = process.env.NODE_EXTRA_CA_CERTS?.trim();
   if (inherited) env[NODE_EXTRA_CA_CERTS] = inherited;
 }
-function extraCertsFromBundle() {
+function extraCertsFromBundle(io = {}) {
   const path2 = process.env.NODE_EXTRA_CA_CERTS?.trim();
   if (path2) return splitPemCertificates(readExistingFile(path2));
-  const dest = systemCaBundlePath();
-  return splitPemCertificates(readExistingFile(dest));
+  return splitPemCertificates(readExistingFile(systemCaBundlePath(io)));
+}
+function extraSystemCaPems(io = {}) {
+  const fromBundle = extraCertsFromBundle(io);
+  if (fromBundle.length > 0) return fromBundle;
+  return splitPemCertificates(collectSystemCaPem(io));
+}
+function mergeSystemCaIntoTlsOptions(options, extra, roots = import_node_tls.default.rootCertificates) {
+  const existing = options?.ca;
+  const base = existing == null ? [...roots] : Array.isArray(existing) ? [...existing] : [existing];
+  return { ...options, ca: [...base, ...extra] };
+}
+function systemCaTlsOptions(io = {}) {
+  const extra = extraSystemCaPems(io);
+  if (extra.length === 0) return {};
+  return { ca: [...import_node_tls.default.rootCertificates, ...extra] };
+}
+function installCreateSecureContextCaPatch(api, extra) {
+  if (api.__sideboardSystemCaPatched) return true;
+  if (typeof api.createSecureContext !== "function") return false;
+  const orig = api.createSecureContext;
+  const roots = api.rootCertificates ?? import_node_tls.default.rootCertificates;
+  api.createSecureContext = ((options) => orig(mergeSystemCaIntoTlsOptions(options, extra, roots)));
+  api.__sideboardSystemCaPatched = true;
+  return true;
 }
 function trustSystemCertificates(io = {}) {
   try {
-    const api = import_node_tls.default;
-    if (typeof api.getCACertificates !== "function" || typeof api.setDefaultCACertificates !== "function") {
-      return false;
-    }
-    const current = api.getCACertificates("default");
-    const system = api.getCACertificates("system");
-    let extra = extraCertsFromBundle();
-    if (system.length === 0 && extra.length === 0) {
-      extra = splitPemCertificates(collectSystemCaPem(io));
+    const extra = extraSystemCaPems(io);
+    const api = io.tls ?? import_node_tls.default;
+    if (typeof api.getCACertificates === "function" && typeof api.setDefaultCACertificates === "function") {
+      const current = api.getCACertificates("default");
+      const system = api.getCACertificates("system");
+      if (system.length === 0 && extra.length === 0) return false;
+      api.setDefaultCACertificates([...current, ...system, ...extra]);
+      return true;
     }
-    if (system.length === 0 && extra.length === 0) return false;
-    api.setDefaultCACertificates([...current, ...system, ...extra]);
-    return true;
+    if (extra.length === 0) return false;
+    return installCreateSecureContextCaPatch(api, extra);
   } catch {
     return false;
   }
 }
+function bootstrapSystemCa(io = {}) {
+  const systemCaBundle = materializeSystemCaBundle(io);
+  if (systemCaBundle && !process.env.NODE_EXTRA_CA_CERTS?.trim()) {
+    process.env.NODE_EXTRA_CA_CERTS = systemCaBundle;
+  }
+  applySystemCaEnv(process.env);
+  trustSystemCertificates(io);
+}
 var import_node_child_process4, import_node_fs31, import_node_path34, import_node_tls, NODE_USE_SYSTEM_CA, NODE_EXTRA_CA_CERTS, BUNDLE_NAME, BUNDLE_MAX_AGE_MS, LINUX_CA_FILES, PEM_CERT_RE;
 var init_system_ca = __esm({
   "src/http/system-ca.ts"() {
@@ -27699,7 +27735,7 @@ function formatWorktreeReminder() {
   return "Sideboard workspace: stay in this cwd for all file and git work. Push and open PRs against origin, never upstream. Do not edit the main repo checkout. If a goal is given (Greptile 5/5, CI green), watch-fix-push until it lands \u2014 do not watch after every push. Schedules: create_schedule (at / every / cron; chatId=self for this chat). set_workspace_tags updates labels on this workspace (omit ref).";
 }
 function formatClaudeSubagentReminder() {
-  return 'Claude subagents: if Task/Agent workers will edit files, write a short plan in this chat and continue in the same turn. Do not ask the user whether to isolate, and do not set worktree.bgIsolation to none. One writer may edit this workspace. Every other writer is an Agent with isolation "worktree" and a disjoint file list (read-only explore agents may overlap). While those agents run, leave their files alone. Merge each returned branch into this workspace, then remove the temporary worktree. You stay in this cwd. If Claude says another write-capable agent is in this directory, or that writes to the shared checkout are blocked, re-spawn that agent with isolation "worktree" or make the edit yourself.';
+  return 'Claude subagents: if Task/Agent workers will edit files, write a short plan in this chat and continue in the same turn. Do not ask the user whether to isolate, and do not set worktree.bgIsolation to none. One writer may edit this workspace. Every other writer is an Agent with isolation "worktree" and a disjoint file list (read-only explore agents may overlap). While those agents run, leave their files alone. Merge each returned branch into this workspace, then remove the temporary worktree. You stay in this cwd. If Claude says another write-capable agent is in this directory, or that writes to the shared checkout are blocked, re-spawn that agent with isolation "worktree" or make the edit yourself. That note is another worker in this chat, or a worker Claude still has marked running. Do not mention it to the user.';
 }
 function claudeSubagentTurnReminder(thread) {
   if (thread.agent !== "claude" || thread.planMode || isOrchestratorThread(thread)) {
@@ -32093,6 +32129,7 @@ __export(index_exports, {
   autoCleanupOrphansEnabled: () => autoCleanupOrphansEnabled,
   autoRenameBranchEnabled: () => autoRenameBranchEnabled,
   autoRunAfterSetupEnabled: () => autoRunAfterSetupEnabled,
+  bootstrapSystemCa: () => bootstrapSystemCa,
   branchDisplayLabel: () => branchDisplayLabel,
   brightsyAccessTokenNeedsRefresh: () => brightsyAccessTokenNeedsRefresh,
   brightsyAdapter: () => brightsyAdapter,
@@ -33433,6 +33470,7 @@ init_schedule_runner();
 // src/host/serve.ts
 var import_node_child_process7 = require("child_process");
 var import_node_os22 = require("os");
+init_system_ca();
 init_app_settings();
 init_desktop_host();
 init_schedules();
@@ -33440,6 +33478,7 @@ init_schedule_runner();
 
 // src/remote/client.ts
 var import_ws2 = require("ws");
+init_system_ca();
 
 // src/slack/public-dns.ts
 var import_node_dns = require("dns");
@@ -34407,10 +34446,9 @@ function parsePhoneMcpUi(value, op, chatId) {
 }
 function phoneMcpToolPayload(parts, tool, callId) {
   if (!parts) return null;
-  const matches = parts.filter(
-    (part2) => part2.type === "tool" && part2.name === tool && !part2.parentId
+  const part = parts.find(
+    (row2) => row2.type === "tool" && row2.id === callId && row2.name === tool && !row2.parentId
   );
-  const part = matches.find((row2) => row2.id === callId) ?? matches[matches.length - 1];
   if (!part) return null;
   return {
     input: part.input ?? {},
@@ -34418,6 +34456,15 @@ function phoneMcpToolPayload(parts, tool, callId) {
     isError: part.status === "error"
   };
 }
+function phoneMcpToolPayloadFromMessages(messages, tool, callId) {
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const message = messages[i];
+    if (message?.role !== "agent") continue;
+    const payload = phoneMcpToolPayload(message.parts, tool, callId);
+    if (payload) return payload;
+  }
+  return null;
+}
 
 // src/remote/phone-stream.ts
 init_message_parts();
@@ -34477,8 +34524,8 @@ function listPhoneMessages(thread) {
     const names = (message.attachments ?? []).map((item) => item.name.trim()).filter(Boolean);
     const visible = [phoneVisibleText(message.role, message.text), names.length ? names.join(", ") : ""].filter(Boolean).join("\n");
     const text7 = message.role === "agent" ? phoneArtifactText(visible, message.parts, MESSAGE_LIMIT) : clip(visible, MESSAGE_LIMIT);
-    if (!text7) continue;
     const apps = message.role === "agent" ? phoneMcpApps(thread.agent, message.parts) : [];
+    if (!text7 && apps.length === 0) continue;
     out.push({ role: message.role, text: text7, ...apps.length ? { apps } : {} });
   }
   const live = withLiveTail(thread, out);
@@ -35240,8 +35287,7 @@ function dispatchPhoneMcpUi(cmd, opts) {
     );
     return true;
   }
-  const agentMessage = [...thread.messages].reverse().find((message) => message.role === "agent");
-  const payload = phoneMcpToolPayload(agentMessage?.parts, cmd.tool, cmd.callId);
+  const payload = phoneMcpToolPayloadFromMessages(thread.messages, cmd.tool, cmd.callId);
   void getMcpUiHost().viewForClaudeTool(cmd.tool, projectDirs).then((view) => {
     if (!view || view.html.length > PHONE_HTML_CAP) {
       emitControl(opts, { op: "mcp-ui", chatId, reqId, view: null });
@@ -38349,6 +38395,14 @@ function startPhoneBoardSync(opts) {
 init_protocol();
 var BACKOFF_START_MS = 1e3;
 var BACKOFF_MAX_MS = 3e4;
+var RELAY_TLS_RE = /UNABLE_TO_GET_ISSUER|unable to get local issuer|SELF_SIGNED_CERT_IN_CHAIN/i;
+var RELAY_TLS_HINT = " \u2014 the TLS certificate was rejected. GitHub login can still work (browser Keychain trust); the relay socket uses Node TLS, which needs the corporate CA.";
+function formatRemoteHostError(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (message === "aborted") return message;
+  if (RELAY_TLS_RE.test(message)) return `${message}${RELAY_TLS_HINT}`;
+  return message;
+}
 function createRemoteKeepalive(opts) {
   let pongTimer = null;
   const arm = () => {
@@ -38445,7 +38499,7 @@ function runRemoteHost(opts) {
         backoff = BACKOFF_START_MS;
       } catch (err) {
         if (opts.signal?.aborted) return;
-        const message = err instanceof Error ? err.message : String(err);
+        const message = formatRemoteHostError(err);
         if (message !== "aborted") log(`remote error: ${message}`);
       }
       opts.onStatus?.({ connected: false, phoneConnected: false });
@@ -38463,7 +38517,10 @@ function runRemoteHost(opts) {
     const gen = ++connectionGen;
     stopBoardSync();
     setPhoneOpenChat(null);
-    const ws = new import_ws2.WebSocket(opts.url, { lookup: lookupPreferPublicDns });
+    const ws = new import_ws2.WebSocket(opts.url, {
+      lookup: lookupPreferPublicDns,
+      ...systemCaTlsOptions()
+    });
     socket = ws;
     let settled = false;
     const finish2 = (err) => {
@@ -40867,6 +40924,7 @@ async function startHeadlessHost(opts) {
   const blocked = headlessHostBlockedReason();
   if (blocked) return { ok: false, reason: blocked };
   claimDesktopHost();
+  bootstrapSystemCa();
   armSchedules();
   const ac = new AbortController();
   let stopped = false;
@@ -45451,6 +45509,7 @@ function getSlackReplyTarget(threadId) {
 }
 
 // src/slack/relay-client.ts
+init_system_ca();
 var import_ws6 = require("ws");
 var CLAIM_FALLBACK_MS = 400;
 var BACKOFF_START_MS3 = 1e3;
@@ -45479,7 +45538,10 @@ async function runSlackRelayClient(opts) {
   const log = opts.onLog ?? (() => void 0);
   const Ws = opts.WebSocketImpl ? resolveWebSocket(opts.WebSocketImpl) : class {
     constructor(url2) {
-      return new import_ws6.WebSocket(url2, { lookup: lookupPreferPublicDns });
+      return new import_ws6.WebSocket(url2, {
+        lookup: lookupPreferPublicDns,
+        ...systemCaTlsOptions()
+      });
     }
   };
   const url = opts.url.trim();
@@ -46302,12 +46364,12 @@ function sleep2(ms, signal) {
     signal?.addEventListener("abort", onAbort, { once: true });
   });
 }
-var RELAY_TLS_HINT = " \u2014 the TLS certificate was rejected. A work proxy often does this when Sideboard is not allowlisted, or when the app does not trust the corporate CA.";
+var RELAY_TLS_HINT2 = " \u2014 the TLS certificate was rejected. A work proxy often does this when Sideboard is not allowlisted, or when the app does not trust the corporate CA.";
 var RELAY_NETWORK_HINT = " Sideboard could not reach the relay. On a work computer this is often a VPN, a proxy, or an allowlist that does not include Sideboard.";
 var RELAY_NETWORK_RE = /fetch failed|Failed to fetch|ENOTFOUND|ECONNREFUSED|ECONNRESET|ETIMEDOUT|EHOSTUNREACH|ENETUNREACH|EAI_AGAIN|EPERM|UND_ERR_|ERR_CONNECTION|ERR_NETWORK|ERR_PROXY|ERR_TUNNEL|ERR_INTERNET|ERR_BLOCKED|ERR_NAME_NOT_RESOLVED|ERR_ADDRESS_UNREACHABLE|ERR_CERT|CERT_|UNABLE_TO_GET_ISSUER|SELF_SIGNED/i;
 function relayFetchError(err, url) {
-  const formatted = formatFetchError(err, url, { tlsHint: RELAY_TLS_HINT });
-  if (formatted.includes(RELAY_TLS_HINT) || !RELAY_NETWORK_RE.test(formatted)) {
+  const formatted = formatFetchError(err, url, { tlsHint: RELAY_TLS_HINT2 });
+  if (formatted.includes(RELAY_TLS_HINT2) || !RELAY_NETWORK_RE.test(formatted)) {
     return new Error(formatted);
   }
   return new Error(`${formatted}${RELAY_NETWORK_HINT}`);
@@ -46953,6 +47015,7 @@ async function pollSlackOutboundWatches(opts) {
   autoCleanupOrphansEnabled,
   autoRenameBranchEnabled,
   autoRunAfterSetupEnabled,
+  bootstrapSystemCa,
   branchDisplayLabel,
   brightsyAccessTokenNeedsRefresh,
   brightsyAdapter,