@sideboard-ai/core 0.1.309 → 0.1.310

package/dist/agents/cursor-runner.js

@@ -20,7 +20,7 @@ import {
   fetchCursorTurnCostUsd,
   importCursorSdk,
   resolveCursorSdkRoot
-} from "../chunk-UA3YKQ3D.js";
+} from "../chunk-Y3Y7SZBZ.js";
 import {
   TOOL_RESULT_STORE_MAX_CHARS,
   createCursorStreamToolProgress,

package/dist/{agents-LK6JGQRF.js → agents-QIIZYNOM.js}

@@ -46,7 +46,7 @@ import {
   resolveCursorSdkRoot,
   resolveQuotaFallbackAgent,
   turnCostUsdFromCursorUsage
-} from "./chunk-VXI7FFGO.js";
+} from "./chunk-GQJOLTZU.js";
 import {
   getAgentSetupInfo,
   installAgent,

package/dist/{agents-DG2UPJ6N.js → agents-XXXRQJJO.js}

@@ -37,7 +37,7 @@ import {
   planModeTurnInstruction,
   resolveCursorModelId,
   resolveQuotaFallbackAgent
-} from "./chunk-FMSLOWKR.js";
+} from "./chunk-4YBQBVYL.js";
 import "./chunk-VEVFHO6K.js";
 import "./chunk-7Q327QF2.js";
 import {
@@ -67,7 +67,7 @@ import {
   preferredCursorCostCents,
   resolveCursorSdkRoot,
   turnCostUsdFromCursorUsage
-} from "./chunk-UA3YKQ3D.js";
+} from "./chunk-Y3Y7SZBZ.js";
 import "./chunk-5XNT6BCG.js";
 import "./chunk-6K64FJDD.js";
 import "./chunk-LG6RJBIY.js";

package/dist/{chunk-FMSLOWKR.js → chunk-4YBQBVYL.js}

@@ -45,7 +45,7 @@ import {
   packagedMcpStdioPath,
   parseCursorRunnerLine,
   resolveNodeLaunch
-} from "./chunk-UA3YKQ3D.js";
+} from "./chunk-Y3Y7SZBZ.js";
 import {
   extractJsonErrorMessage,
   formatUnknownDetail,

package/dist/{chunk-VXI7FFGO.js → chunk-GQJOLTZU.js}

@@ -881,31 +881,55 @@ function applySystemCaEnv(env) {
   const inherited = process.env.NODE_EXTRA_CA_CERTS?.trim();
   if (inherited) env[NODE_EXTRA_CA_CERTS] = inherited;
 }
-function extraCertsFromBundle() {
+function extraCertsFromBundle(io = {}) {
   const path = process.env.NODE_EXTRA_CA_CERTS?.trim();
   if (path) return splitPemCertificates(readExistingFile(path));
-  const dest = systemCaBundlePath();
-  return splitPemCertificates(readExistingFile(dest));
+  return splitPemCertificates(readExistingFile(systemCaBundlePath(io)));
+}
+function extraSystemCaPems(io = {}) {
+  const fromBundle = extraCertsFromBundle(io);
+  if (fromBundle.length > 0) return fromBundle;
+  return splitPemCertificates(collectSystemCaPem(io));
+}
+function mergeSystemCaIntoTlsOptions(options, extra, roots = tls.rootCertificates) {
+  const existing = options?.ca;
+  const base = existing == null ? [...roots] : Array.isArray(existing) ? [...existing] : [existing];
+  return { ...options, ca: [...base, ...extra] };
+}
+function installCreateSecureContextCaPatch(api, extra) {
+  if (api.__sideboardSystemCaPatched) return true;
+  if (typeof api.createSecureContext !== "function") return false;
+  const orig = api.createSecureContext;
+  const roots = api.rootCertificates ?? tls.rootCertificates;
+  api.createSecureContext = ((options) => orig(mergeSystemCaIntoTlsOptions(options, extra, roots)));
+  api.__sideboardSystemCaPatched = true;
+  return true;
 }
 function trustSystemCertificates(io = {}) {
   try {
-    const api = tls;
-    if (typeof api.getCACertificates !== "function" || typeof api.setDefaultCACertificates !== "function") {
-      return false;
-    }
-    const current = api.getCACertificates("default");
-    const system = api.getCACertificates("system");
-    let extra = extraCertsFromBundle();
-    if (system.length === 0 && extra.length === 0) {
-      extra = splitPemCertificates(collectSystemCaPem(io));
+    const extra = extraSystemCaPems(io);
+    const api = io.tls ?? tls;
+    if (typeof api.getCACertificates === "function" && typeof api.setDefaultCACertificates === "function") {
+      const current = api.getCACertificates("default");
+      const system = api.getCACertificates("system");
+      if (system.length === 0 && extra.length === 0) return false;
+      api.setDefaultCACertificates([...current, ...system, ...extra]);
+      return true;
     }
-    if (system.length === 0 && extra.length === 0) return false;
-    api.setDefaultCACertificates([...current, ...system, ...extra]);
-    return true;
+    if (extra.length === 0) return false;
+    return installCreateSecureContextCaPatch(api, extra);
   } catch {
     return false;
   }
 }
+function bootstrapSystemCa(io = {}) {
+  const systemCaBundle = materializeSystemCaBundle(io);
+  if (systemCaBundle && !process.env.NODE_EXTRA_CA_CERTS?.trim()) {
+    process.env.NODE_EXTRA_CA_CERTS = systemCaBundle;
+  }
+  applySystemCaEnv(process.env);
+  trustSystemCertificates(io);
+}
 
 // src/agents/packaged-runtime.ts
 import { existsSync as existsSync4 } from "fs";
@@ -4521,9 +4545,7 @@ function allAdapters() {
 }
 
 export {
-  materializeSystemCaBundle,
-  applySystemCaEnv,
-  trustSystemCertificates,
+  bootstrapSystemCa,
   encodeBrightsyTarget,
   decodeBrightsyTarget,
   parseBrightsyCliLine,

package/dist/{chunk-M6PAT6HG.js → chunk-IT6A4FZF.js}

@@ -14,7 +14,7 @@ import {
   parseSessionQuotaResetAt,
   planModeTurnInstruction,
   resolveQuotaFallbackAgent
-} from "./chunk-FMSLOWKR.js";
+} from "./chunk-4YBQBVYL.js";
 import {
   REVIEW_TAB_TITLE,
   applyWorktreePkgCacheEnv,
@@ -181,7 +181,7 @@ import {
 import {
   applyAgentRunnerHeapEnv,
   packagedMcpDir
-} from "./chunk-UA3YKQ3D.js";
+} from "./chunk-Y3Y7SZBZ.js";
 import {
   fallbackTurnFailDetail,
   formatAgentErrorContinuePrompt,
@@ -3027,7 +3027,7 @@ async function createThread(input, _onSetupLine) {
   return readThread(thread.id) ?? thread;
 }
 async function listLinearIssues(agent, repoPath) {
-  const { getAdapter: getAdapter2 } = await import("./agents-DG2UPJ6N.js");
+  const { getAdapter: getAdapter2 } = await import("./agents-XXXRQJJO.js");
   await requireAgent(agent, { requireLinear: true });
   const adapter = getAdapter2(agent);
   if (!adapter.listLinearIssues) {
@@ -6741,7 +6741,7 @@ function formatScheduledPrompt(name, prompt) {
 ${prompt}`;
 }
 async function defaultDeps() {
-  const { getOrchestrator: getOrchestrator2, startOrchestration: startOrchestration2 } = await import("./orchestrator-T76JRIIN.js");
+  const { getOrchestrator: getOrchestrator2, startOrchestration: startOrchestration2 } = await import("./orchestrator-XFE3U3RP.js");
   const orch = getOrchestrator2();
   return {
     findThread: (id) => findThreadByRef(id),

package/dist/{chunk-OU5V56OI.js → chunk-JXOW5JAW.js}

@@ -27,7 +27,7 @@ import {
   parseSessionQuotaResetAt,
   planModeTurnInstruction,
   resolveQuotaFallbackAgent
-} from "./chunk-VXI7FFGO.js";
+} from "./chunk-GQJOLTZU.js";
 import {
   REVIEW_TAB_TITLE,
   applyWorktreePkgCacheEnv,
@@ -6389,7 +6389,7 @@ function formatScheduledPrompt(name, prompt) {
 ${prompt}`;
 }
 async function defaultDeps() {
-  const { getOrchestrator: getOrchestrator2, startOrchestration: startOrchestration2 } = await import("./orchestrator-4OIMDLIR.js");
+  const { getOrchestrator: getOrchestrator2, startOrchestration: startOrchestration2 } = await import("./orchestrator-7374OI7T.js");
   const orch = getOrchestrator2();
   return {
     findThread: (id) => findThreadByRef(id),

package/dist/{chunk-UA3YKQ3D.js → chunk-Y3Y7SZBZ.js}

@@ -113,31 +113,60 @@ function applySystemCaEnv(env) {
   const inherited = process.env.NODE_EXTRA_CA_CERTS?.trim();
   if (inherited) env[NODE_EXTRA_CA_CERTS] = inherited;
 }
-function extraCertsFromBundle() {
+function extraCertsFromBundle(io = {}) {
   const path = process.env.NODE_EXTRA_CA_CERTS?.trim();
   if (path) return splitPemCertificates(readExistingFile(path));
-  const dest = systemCaBundlePath();
-  return splitPemCertificates(readExistingFile(dest));
+  return splitPemCertificates(readExistingFile(systemCaBundlePath(io)));
+}
+function extraSystemCaPems(io = {}) {
+  const fromBundle = extraCertsFromBundle(io);
+  if (fromBundle.length > 0) return fromBundle;
+  return splitPemCertificates(collectSystemCaPem(io));
+}
+function mergeSystemCaIntoTlsOptions(options, extra, roots = tls.rootCertificates) {
+  const existing = options?.ca;
+  const base = existing == null ? [...roots] : Array.isArray(existing) ? [...existing] : [existing];
+  return { ...options, ca: [...base, ...extra] };
+}
+function systemCaTlsOptions(io = {}) {
+  const extra = extraSystemCaPems(io);
+  if (extra.length === 0) return {};
+  return { ca: [...tls.rootCertificates, ...extra] };
+}
+function installCreateSecureContextCaPatch(api, extra) {
+  if (api.__sideboardSystemCaPatched) return true;
+  if (typeof api.createSecureContext !== "function") return false;
+  const orig = api.createSecureContext;
+  const roots = api.rootCertificates ?? tls.rootCertificates;
+  api.createSecureContext = ((options) => orig(mergeSystemCaIntoTlsOptions(options, extra, roots)));
+  api.__sideboardSystemCaPatched = true;
+  return true;
 }
 function trustSystemCertificates(io = {}) {
   try {
-    const api = tls;
-    if (typeof api.getCACertificates !== "function" || typeof api.setDefaultCACertificates !== "function") {
-      return false;
+    const extra = extraSystemCaPems(io);
+    const api = io.tls ?? tls;
+    if (typeof api.getCACertificates === "function" && typeof api.setDefaultCACertificates === "function") {
+      const current = api.getCACertificates("default");
+      const system = api.getCACertificates("system");
+      if (system.length === 0 && extra.length === 0) return false;
+      api.setDefaultCACertificates([...current, ...system, ...extra]);
+      return true;
     }
-    const current = api.getCACertificates("default");
-    const system = api.getCACertificates("system");
-    let extra = extraCertsFromBundle();
-    if (system.length === 0 && extra.length === 0) {
-      extra = splitPemCertificates(collectSystemCaPem(io));
-    }
-    if (system.length === 0 && extra.length === 0) return false;
-    api.setDefaultCACertificates([...current, ...system, ...extra]);
-    return true;
+    if (extra.length === 0) return false;
+    return installCreateSecureContextCaPatch(api, extra);
   } catch {
     return false;
   }
 }
+function bootstrapSystemCa(io = {}) {
+  const systemCaBundle = materializeSystemCaBundle(io);
+  if (systemCaBundle && !process.env.NODE_EXTRA_CA_CERTS?.trim()) {
+    process.env.NODE_EXTRA_CA_CERTS = systemCaBundle;
+  }
+  applySystemCaEnv(process.env);
+  trustSystemCertificates(io);
+}
 
 // src/agents/node-launch.ts
 import { existsSync as existsSync3, readdirSync, realpathSync } from "fs";
@@ -878,7 +907,9 @@ function ensureCursorRipgrepPath(opts) {
 export {
   materializeSystemCaBundle,
   applySystemCaEnv,
+  systemCaTlsOptions,
   trustSystemCertificates,
+  bootstrapSystemCa,
   packagedCursorRuntimeDir,
   packagedCursorRunnerPath,
   packagedMcpDir,

package/dist/index.cjs

@@ -14366,31 +14366,60 @@ function applySystemCaEnv(env) {
   const inherited = process.env.NODE_EXTRA_CA_CERTS?.trim();
   if (inherited) env[NODE_EXTRA_CA_CERTS] = inherited;
 }
-function extraCertsFromBundle() {
+function extraCertsFromBundle(io = {}) {
   const path2 = process.env.NODE_EXTRA_CA_CERTS?.trim();
   if (path2) return splitPemCertificates(readExistingFile(path2));
-  const dest = systemCaBundlePath();
-  return splitPemCertificates(readExistingFile(dest));
+  return splitPemCertificates(readExistingFile(systemCaBundlePath(io)));
+}
+function extraSystemCaPems(io = {}) {
+  const fromBundle = extraCertsFromBundle(io);
+  if (fromBundle.length > 0) return fromBundle;
+  return splitPemCertificates(collectSystemCaPem(io));
+}
+function mergeSystemCaIntoTlsOptions(options, extra, roots = import_node_tls.default.rootCertificates) {
+  const existing = options?.ca;
+  const base = existing == null ? [...roots] : Array.isArray(existing) ? [...existing] : [existing];
+  return { ...options, ca: [...base, ...extra] };
+}
+function systemCaTlsOptions(io = {}) {
+  const extra = extraSystemCaPems(io);
+  if (extra.length === 0) return {};
+  return { ca: [...import_node_tls.default.rootCertificates, ...extra] };
+}
+function installCreateSecureContextCaPatch(api, extra) {
+  if (api.__sideboardSystemCaPatched) return true;
+  if (typeof api.createSecureContext !== "function") return false;
+  const orig = api.createSecureContext;
+  const roots = api.rootCertificates ?? import_node_tls.default.rootCertificates;
+  api.createSecureContext = ((options) => orig(mergeSystemCaIntoTlsOptions(options, extra, roots)));
+  api.__sideboardSystemCaPatched = true;
+  return true;
 }
 function trustSystemCertificates(io = {}) {
   try {
-    const api = import_node_tls.default;
-    if (typeof api.getCACertificates !== "function" || typeof api.setDefaultCACertificates !== "function") {
-      return false;
-    }
-    const current = api.getCACertificates("default");
-    const system = api.getCACertificates("system");
-    let extra = extraCertsFromBundle();
-    if (system.length === 0 && extra.length === 0) {
-      extra = splitPemCertificates(collectSystemCaPem(io));
+    const extra = extraSystemCaPems(io);
+    const api = io.tls ?? import_node_tls.default;
+    if (typeof api.getCACertificates === "function" && typeof api.setDefaultCACertificates === "function") {
+      const current = api.getCACertificates("default");
+      const system = api.getCACertificates("system");
+      if (system.length === 0 && extra.length === 0) return false;
+      api.setDefaultCACertificates([...current, ...system, ...extra]);
+      return true;
     }
-    if (system.length === 0 && extra.length === 0) return false;
-    api.setDefaultCACertificates([...current, ...system, ...extra]);
-    return true;
+    if (extra.length === 0) return false;
+    return installCreateSecureContextCaPatch(api, extra);
   } catch {
     return false;
   }
 }
+function bootstrapSystemCa(io = {}) {
+  const systemCaBundle = materializeSystemCaBundle(io);
+  if (systemCaBundle && !process.env.NODE_EXTRA_CA_CERTS?.trim()) {
+    process.env.NODE_EXTRA_CA_CERTS = systemCaBundle;
+  }
+  applySystemCaEnv(process.env);
+  trustSystemCertificates(io);
+}
 var import_node_child_process4, import_node_fs31, import_node_path34, import_node_tls, NODE_USE_SYSTEM_CA, NODE_EXTRA_CA_CERTS, BUNDLE_NAME, BUNDLE_MAX_AGE_MS, LINUX_CA_FILES, PEM_CERT_RE;
 var init_system_ca = __esm({
   "src/http/system-ca.ts"() {
@@ -32100,6 +32129,7 @@ __export(index_exports, {
   autoCleanupOrphansEnabled: () => autoCleanupOrphansEnabled,
   autoRenameBranchEnabled: () => autoRenameBranchEnabled,
   autoRunAfterSetupEnabled: () => autoRunAfterSetupEnabled,
+  bootstrapSystemCa: () => bootstrapSystemCa,
   branchDisplayLabel: () => branchDisplayLabel,
   brightsyAccessTokenNeedsRefresh: () => brightsyAccessTokenNeedsRefresh,
   brightsyAdapter: () => brightsyAdapter,
@@ -33440,6 +33470,7 @@ init_schedule_runner();
 // src/host/serve.ts
 var import_node_child_process7 = require("child_process");
 var import_node_os22 = require("os");
+init_system_ca();
 init_app_settings();
 init_desktop_host();
 init_schedules();
@@ -33447,6 +33478,7 @@ init_schedule_runner();
 
 // src/remote/client.ts
 var import_ws2 = require("ws");
+init_system_ca();
 
 // src/slack/public-dns.ts
 var import_node_dns = require("dns");
@@ -38363,6 +38395,14 @@ function startPhoneBoardSync(opts) {
 init_protocol();
 var BACKOFF_START_MS = 1e3;
 var BACKOFF_MAX_MS = 3e4;
+var RELAY_TLS_RE = /UNABLE_TO_GET_ISSUER|unable to get local issuer|SELF_SIGNED_CERT_IN_CHAIN/i;
+var RELAY_TLS_HINT = " \u2014 the TLS certificate was rejected. GitHub login can still work (browser Keychain trust); the relay socket uses Node TLS, which needs the corporate CA.";
+function formatRemoteHostError(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (message === "aborted") return message;
+  if (RELAY_TLS_RE.test(message)) return `${message}${RELAY_TLS_HINT}`;
+  return message;
+}
 function createRemoteKeepalive(opts) {
   let pongTimer = null;
   const arm = () => {
@@ -38459,7 +38499,7 @@ function runRemoteHost(opts) {
         backoff = BACKOFF_START_MS;
       } catch (err) {
         if (opts.signal?.aborted) return;
-        const message = err instanceof Error ? err.message : String(err);
+        const message = formatRemoteHostError(err);
         if (message !== "aborted") log(`remote error: ${message}`);
       }
       opts.onStatus?.({ connected: false, phoneConnected: false });
@@ -38477,7 +38517,10 @@ function runRemoteHost(opts) {
     const gen = ++connectionGen;
     stopBoardSync();
     setPhoneOpenChat(null);
-    const ws = new import_ws2.WebSocket(opts.url, { lookup: lookupPreferPublicDns });
+    const ws = new import_ws2.WebSocket(opts.url, {
+      lookup: lookupPreferPublicDns,
+      ...systemCaTlsOptions()
+    });
     socket = ws;
     let settled = false;
     const finish2 = (err) => {
@@ -40881,6 +40924,7 @@ async function startHeadlessHost(opts) {
   const blocked = headlessHostBlockedReason();
   if (blocked) return { ok: false, reason: blocked };
   claimDesktopHost();
+  bootstrapSystemCa();
   armSchedules();
   const ac = new AbortController();
   let stopped = false;
@@ -45465,6 +45509,7 @@ function getSlackReplyTarget(threadId) {
 }
 
 // src/slack/relay-client.ts
+init_system_ca();
 var import_ws6 = require("ws");
 var CLAIM_FALLBACK_MS = 400;
 var BACKOFF_START_MS3 = 1e3;
@@ -45493,7 +45538,10 @@ async function runSlackRelayClient(opts) {
   const log = opts.onLog ?? (() => void 0);
   const Ws = opts.WebSocketImpl ? resolveWebSocket(opts.WebSocketImpl) : class {
     constructor(url2) {
-      return new import_ws6.WebSocket(url2, { lookup: lookupPreferPublicDns });
+      return new import_ws6.WebSocket(url2, {
+        lookup: lookupPreferPublicDns,
+        ...systemCaTlsOptions()
+      });
     }
   };
   const url = opts.url.trim();
@@ -46316,12 +46364,12 @@ function sleep2(ms, signal) {
     signal?.addEventListener("abort", onAbort, { once: true });
   });
 }
-var RELAY_TLS_HINT = " \u2014 the TLS certificate was rejected. A work proxy often does this when Sideboard is not allowlisted, or when the app does not trust the corporate CA.";
+var RELAY_TLS_HINT2 = " \u2014 the TLS certificate was rejected. A work proxy often does this when Sideboard is not allowlisted, or when the app does not trust the corporate CA.";
 var RELAY_NETWORK_HINT = " Sideboard could not reach the relay. On a work computer this is often a VPN, a proxy, or an allowlist that does not include Sideboard.";
 var RELAY_NETWORK_RE = /fetch failed|Failed to fetch|ENOTFOUND|ECONNREFUSED|ECONNRESET|ETIMEDOUT|EHOSTUNREACH|ENETUNREACH|EAI_AGAIN|EPERM|UND_ERR_|ERR_CONNECTION|ERR_NETWORK|ERR_PROXY|ERR_TUNNEL|ERR_INTERNET|ERR_BLOCKED|ERR_NAME_NOT_RESOLVED|ERR_ADDRESS_UNREACHABLE|ERR_CERT|CERT_|UNABLE_TO_GET_ISSUER|SELF_SIGNED/i;
 function relayFetchError(err, url) {
-  const formatted = formatFetchError(err, url, { tlsHint: RELAY_TLS_HINT });
-  if (formatted.includes(RELAY_TLS_HINT) || !RELAY_NETWORK_RE.test(formatted)) {
+  const formatted = formatFetchError(err, url, { tlsHint: RELAY_TLS_HINT2 });
+  if (formatted.includes(RELAY_TLS_HINT2) || !RELAY_NETWORK_RE.test(formatted)) {
     return new Error(formatted);
   }
   return new Error(`${formatted}${RELAY_NETWORK_HINT}`);
@@ -46967,6 +47015,7 @@ async function pollSlackOutboundWatches(opts) {
   autoCleanupOrphansEnabled,
   autoRenameBranchEnabled,
   autoRunAfterSetupEnabled,
+  bootstrapSystemCa,
   branchDisplayLabel,
   brightsyAccessTokenNeedsRefresh,
   brightsyAdapter,

package/dist/index.d.cts

@@ -1,5 +1,6 @@
 import { NetworkInterfaceInfo } from 'node:os';
 import { SpawnSyncOptionsWithStringEncoding } from 'node:child_process';
+import tls from 'node:tls';
 import { ResultPromise } from 'execa';
 import { EventEmitter } from 'node:events';
 
@@ -3539,10 +3540,10 @@ declare function installOptionalServiceCli(id: OptionalServiceId): Promise<Agent
  *
  * Electron main should call {@link setHttpFetchImpl} with `net.fetch` so
  * requests use Chromium's network stack (create-worktree issue picker).
- * Agent Linear tools run in a Node MCP process — call
- * `trustSystemCertificates` / `applySystemCaEnv` so undici trusts Keychain
- * CAs. Node's undici `fetch` otherwise fails behind corporate VPN/proxy as
- * an opaque `TypeError: fetch failed` or `UNABLE_TO_GET_ISSUER_CERT_LOCALLY`.
+ * Agent Linear tools run in a Node MCP process — call `bootstrapSystemCa`
+ * so undici trusts Keychain CAs. Node's undici `fetch` otherwise fails
+ * behind corporate VPN/proxy as an opaque `TypeError: fetch failed` or
+ * `UNABLE_TO_GET_ISSUER_CERT_LOCALLY`.
  */
 declare function setHttpFetchImpl(fetchImpl: typeof fetch | null): void;
 /**
@@ -3556,19 +3557,29 @@ declare function formatFetchError(err: unknown, url: string, opts?: {
 declare function httpFetch(input: string | URL, init?: RequestInit): Promise<Response>;
 
 /**
- * Trust OS / Keychain CAs in Node (undici `fetch`).
+ * Trust OS / Keychain CAs in Node (undici `fetch`, `ws`, `https`).
  *
  * Electron main Linear (create-worktree issue picker) uses `net.fetch` —
- * Chromium already reads the system store. Agent Linear tools run in a
- * real Node MCP process whose Mozilla bundle does not include corporate
- * VPN/proxy CAs, which surfaces as UNABLE_TO_GET_ISSUER_CERT_LOCALLY.
+ * Chromium already reads the system store. The phone relay WebSocket and
+ * agent Linear tools use Node TLS, whose Mozilla bundle does not include
+ * corporate VPN/proxy CAs (Zscaler), which surfaces as
+ * UNABLE_TO_GET_ISSUER_CERT_LOCALLY.
  *
  * Node 22.15+ can load the system store (`NODE_USE_SYSTEM_CA=1` /
- * `tls.getCACertificates('system')`). Older Node and some Keychain layouts
- * still need a PEM dump via `NODE_EXTRA_CA_CERTS`.
+ * `tls.getCACertificates('system')`). Electron 34 ships Node 20, where
+ * `NODE_EXTRA_CA_CERTS` is only read at process start and
+ * `setDefaultCACertificates` does not exist — so we dump Keychain PEMs
+ * and either pass them as `ca` or wrap `tls.createSecureContext`.
  */
 
 type EnvLike = NodeJS.ProcessEnv | Record<string, string | undefined>;
+type TlsSystemCa = {
+    getCACertificates?: (type?: 'default' | 'system' | 'bundled' | 'extra') => string[];
+    setDefaultCACertificates?: (certs: readonly (string | Buffer)[]) => void;
+    createSecureContext?: typeof tls.createSecureContext;
+    rootCertificates?: readonly string[];
+    __sideboardSystemCaPatched?: boolean;
+};
 type SystemCaSpawn = (file: string, args: readonly string[], options: SpawnSyncOptionsWithStringEncoding) => {
     status: number | null;
     stdout?: string;
@@ -3578,6 +3589,7 @@ type SystemCaIo = {
     spawn?: SystemCaSpawn;
     now?: () => number;
     appData?: () => string;
+    tls?: TlsSystemCa;
 };
 /**
  * Write (or reuse) a PEM bundle under app data. Returns the path when the
@@ -3588,9 +3600,15 @@ declare function materializeSystemCaBundle(io?: SystemCaIo): string | undefined;
 declare function applySystemCaEnv(env: EnvLike): void;
 /**
  * Expand this process's default TLS CAs with the OS store. Safe no-op on
- * Node builds that lack `tls.getCACertificates` / `setDefaultCACertificates`.
+ * Node builds that lack `tls.getCACertificates` / `setDefaultCACertificates`
+ * *and* have no extra PEMs to wrap into `createSecureContext`.
  */
 declare function trustSystemCertificates(io?: SystemCaIo): boolean;
+/**
+ * Dump OS CAs, export them for Node children, and trust them in this
+ * process. Safe to call more than once. Never throws.
+ */
+declare function bootstrapSystemCa(io?: SystemCaIo): void;
 
 /**
  * Turn payload for agent CLIs.
@@ -8681,4 +8699,4 @@ declare function pollSlackOutboundWatches(opts?: {
     now?: number;
 }): Promise<void>;
 
-export { ABLETIME_MCP_PATH, ABLETIME_MCP_PM_PATH, ABLETIME_OAUTH_CALLBACK_PATH, ABLETIME_OAUTH_CANCELLED, ABLETIME_OAUTH_LOCAL_CALLBACK, ABLETIME_OAUTH_PORT, ABLETIME_OAUTH_REDIRECT, ABLETIME_OAUTH_RESOURCE, ABLETIME_OAUTH_TOKEN_PREFIX, ABLETIME_ORG_KEY_PREFIX, ABLETIME_PAT_PREFIX, ABLETIME_PM_TOOL_NAMES, AGENT_DONE_CUSTOM_SOUND_EXTENSIONS, AGENT_DONE_CUSTOM_SOUND_MAX_BYTES, AGENT_DONE_SOUNDS, AGENT_GIT_ACTIONS, AGENT_RPC_NATIVE_ENV, AGENT_RPC_PROTOCOL_VERSION, AGENT_RUNNER_MAX_OLD_SPACE_MB, ATTACHMENTS_DIR, type AbleTimeAssignedIssuesResult, type AbleTimeComment, type AbleTimeCredentialKind, type AbleTimeMcpToolName, AbleTimeOAuthCancelledError, type AbleTimeOrientation, type AbleTimePmToolName, type AbleTimeProject, type AbleTimeTask, type AbleTimeTaskRelationInput, type AbleTimeViewer, type AccountProfile, type ActiveRun, type AddBoardPinInput, type AddStackLayerInput, type AdoptInput, type AdvancedAppSettings, type AgentAdapter, type AgentBlock, type AgentBlockSource, type AgentDoneCustomSoundPayload, type AgentDoneSound, type AgentEvent, type AgentGitAction, type AgentKind, type AgentModelCatalog, type AgentModelInfo, type AgentPermissionPrompt, type AgentRpcConnect, type AgentRuntimeMetadata, type AgentSetupActionResult, type AgentSetupInfo, type AgentSetupKind, type AgentStatus, type AgentTurnInput, type AnthropicCacheControl, type AppSettings, type ApplyIntoMainResult, type AskBlockSnapshot, type AttachCommand, type Autonomy, BAKED_ABLETIME_OAUTH_CLIENT_ID, BAKED_REMOTE_RELAY_URL, BAKED_SLACK_RELAY_URL, BASE_ALLOWED_TOOLS, BRIGHTSY_MCP_ALLOWED_TOOLS, BRIGHTSY_OAUTH_CLIENT_ID, BRIGHTSY_OAUTH_REDIRECT, BRIGHTSY_SUMMARIZE_CONTEXT_TOOL, BUNDLED_LONG_RUNNING_PATH, BUNDLED_SKILL_PREFIX, type BoardPin, type BranchInfo, type BrightsyAccount, type BrightsyChatTarget, type BrightsyChatTargets, type BrightsyCloudConnectAgent, type BrightsyHarnessSettings, type BrightsySession, BrightsySideboardApi, type BrightsyTeamTargets, CHARS_PER_CONTEXT_TOKEN, CHAT_LINK_PREFIX, CHAT_TEXT_SCALES, CHAT_TEXT_SCALE_DEFAULT, CLAUDE_CHROME_ALLOWED_TOOLS, CLAUDE_MODEL_CATALOG, CLAUDE_POSTHOG_CONNECTOR_ALLOWED_TOOLS, CLAUDE_PRINT_BG_WAIT_CEILING_MS, CLAUDE_SUMMARY_TIMEOUT_MS, CLI_DIR, CLOUD_COORDINATOR_BUSY_REPLY, CLOUD_COORDINATOR_CANCELED_REPLY, CLOUD_COORDINATOR_INPUT_REQUIRED_REPLY, CLOUD_COORDINATOR_STOPPED_REPLY, CLOUD_COORDINATOR_TIMEOUT_REPLY, CLOUD_ORCHESTRATOR_GOAL, CONTEXT_COMPACT_CHARS, CONTEXT_KEEP_RECENT_CHARS, CONTEXT_KEEP_RECENT_MESSAGES, CONTEXT_MIN_MESSAGES, CONTEXT_REVIEW_PATH, CONVENTION_SETUP_RELPATHS, COORDINATOR_TOOL_PLAYBOOK, CURSOR_SDK_INSTALL_HINT, type CaffeinateHoldState, type ChatTextScale, type ClaudeExtraUsage, type ClaudeHarnessSettings, type ClaudePlanUsage, type ClaudeUsageWindow, type ClaudeUsageWindowId, type CleanupOrphansResult, type CliAgentKind, type CliExecutableSettings, type CloudConnectAgent, type CloudConnectOptions, type CloudConnectStatus, type CodeLineRange, type CodeRefInput, type CompactResult, type CompactThresholds, type ComposerFileBuffer, type ConductorSettings, type ConductorWorkspace, type ConnectedBrightsyTeamInfo, type ConventionSetupFile, type CowboyThreadFields, type CreateChatTabInput, type CreateGlobalChatOpts, type CreateScheduledTaskInput, type CreateStackInput, type CreateThreadInput, type CreateWorktreeResult, type CursorAgentUsageSnapshot, type CursorModelInfo, type CursorSdkStreamMessage, type CursorTurnRequest, type CursorUsageCost, type CursorWorktreesConfig, DEFAULT_ABLETIME_HOST, DEFAULT_RUN_LOG_TAIL_CHARS, DEFAULT_WORKTREE_SORT, DETACHED_JOBS_DIR, type DefaultsAppSettings, type DefaultsSettingsPatch, type DevAccessRun, type DevPreview, type DevServerHandle, type DiffCommentInput, type DiffCommentLine, type DiffCommit, type DiffFile, type DiffResult, type DiffScope, type DiffScopeStat, EMPTY_MANAGED_ACCOUNTS, type EnsuredReviewGuidelines, type ExpandResult, FAMOUS_SOCCER_TEAMS, FOLLOW_UP_BEHAVIORS, type FastForwardMainResult, type FollowUpBehavior, type ForkChatTabInput, type ForkThreadWorktreeInput, type FormatGhLandErrorOptions, GITHUB_GIT_AUTH_MODES, GITHUB_PR_BODY_MAX_CHARS, GITHUB_PR_BODY_SAFE_CHARS, GLOBAL_WORKSPACE_ID, type GetDiffOptions, type GhStackStatus, type GitHubIssue, type GitHubIssueComment, type GitHubIssueRelationInput, type GitHubProject, type GitHubProjectRef, type GitHubStatus, type GitWorktreeStatus, type GithubGitAuthMode, HARNESS_ENV_KEYS, HISTORY_DISCARDED_TEXT, HISTORY_MAX_COUNT_DEFAULT, HISTORY_MAX_COUNT_MAX, HISTORY_MAX_COUNT_MIN, HISTORY_MAX_DAYS_DEFAULT, HISTORY_MAX_DAYS_MAX, HOME_BOARD_CACHE_TTL_MS, type HarnessId, type HistoryCleanupResult, type HistoryRetentionPlan, type HomeBoardLoaded, type HomeBoardRemoteData, IMPLIED_TICKET_RESOLVE_PROMPT, ISSUE_SOURCE_LABELS, type ImportedAgentDoneSound, type InitStackFromThreadInput, type IntegrationsSettings, type IpcApi, type IssueActivityComment, type IssueAssigneeFilter, type IssueCycleInfo, type IssueInfo, type IssueSource, LEGACY_ATTACHMENTS_DIR, LEGACY_DETACHED_JOBS_DIR, LEGACY_PLAN_FILE_REL, LEGACY_REVIEW_REQUEST_PATH, LEGACY_THREAD_LINK_PREFIX, LIGHT_RECONCILE_THROTTLE_MS, LINEAR_OAUTH_CANCELLED, LINEAR_OAUTH_PORT, LINEAR_OAUTH_REDIRECT, LINEAR_OAUTH_SCOPES, LIVE_TURN_SPAWN_GRACE_MS, LONG_RUNNING_SKILL_COMMAND, type LandPreview, type LandResult, type LinearAssignedIssuesResult, type LinearAssigneeFilter, type LinearComment, type LinearCycle, type LinearIssue, type LinearIssueAttachment, type LinearIssueComment, type LinearIssueRef, type LinearIssueRelation, type LinearIssueRelationInput, type LinearNamedRef, LinearOAuthCancelledError, type LinearProjectRef, type LinearTeam, type LinearTeamsResult, type LinearWorkflowState, type ListIssuesOptions, type ListIssuesResult, type ListPrsOptions, MAX_ANTHROPIC_CACHE_CONTROL_BLOCKS, type ManagedAccount, type ManagedAccountKind, type ManagedAccountsState, type McpServerStatus, type McpUiView, type MessagePart, type NextManagedAccount, type NotifyOrchestratorReason, type NotifyOrchestratorResult, OPTIONAL_SERVICES, OPTIONAL_SERVICE_IDS, ORCHESTRATOR_AGENT_KINDS, type OpenPrStackLayersInput, type OpenStackLayerInput, type OpenStackLayerResult, type OptionalCliPresence, type OptionalServiceCliStatus, type OptionalServiceId, type OptionalServiceSpec, type OrchestrationQuotaOnLimit, Orchestrator, type OrchestratorAgentKind, type OrchestratorDefaultsSettings, type OrchestratorEvent, type OrchestratorRuntime, type OrphanWorktree, type OutboundTurnCopy, type OutboundTurnSnapshot, PASTE_ATTACH_MIN_CHARS, PASTE_ATTACH_MIN_LINES, PLAN_FILE_NAME, PLAN_FILE_REL, PLAN_MODE_INSTRUCTION, PLAN_MODE_OFF_INSTRUCTION, PLAN_QUESTION_ANSWERS_PREFIX, PORT_RANGE_SIZE, PRESENT_PLAN_REQUIRES_PLAN_MODE, PRESENT_PLAN_TOOL_DESCRIPTION, PROFILE_NOTES_MAX, PR_DETAILS_JSON_FIELDS, type PathRefInput, type PendingPlanQuestions, type PlanQuestion, type PlanQuestionAnswer, type PlanQuestionOption, type PlanToolPartLike, type PortReservation, type PrActor, type PrCheckRun, type PrCommentInfo, type PrCommitInfo, type PrDetails, type PrInfo, type PrMeta, type PrReviewInfo, type PrStack, type PrStackLayer, type PresentedPlan, type ProjectProfileSettings, type PublicAppSettings, type PublicIntegrationsSettings, READ_ALOUD_RATE_DEFAULT, READ_ALOUD_RATE_MAX, READ_ALOUD_RATE_MIN, REMOTE_RELAY_PATH, REPO_REVIEW_NAME, REPO_REVIEW_PATH, REVIEW_LABEL_MAX, REVIEW_REQUEST_NAME, REVIEW_REQUEST_PATH, REVIEW_REQUEST_PREFILL, REVIEW_REQUEST_TEMPLATE, REVIEW_SKILL_NAME, REVIEW_SKILL_PATH, RUN_PORTS_REL, RUN_SCRIPT_DESKTOP_ADOPT_MS, type ReadAloudSettingsFields, type RelayAccountProvider, type RelayServerHandle, type RelayServerOptions, type RemoteAccountSession, type RemoteAskQuestion, type RemoteHostClientOptions, type RemoteHostHandle, type RemoteHostStatus, RemoteHub, type RemoteServerMessage, type RepoSettings, type RepoSetupInfo, type RequestReviewResult, type ReservePortRangeOpts, type ResolvedAccountProfile, type ResolvedReviewGuidelines, type ResolvedThreadDefaults, type ResolvedViewerProfile, type ReviewGuidelinesSource, type RunLogSnapshot, type RunMode, type RunScript, type RunScriptPreviewInput, type RunScriptRequest, SEED_FULL_TOOL_MESSAGES, SEED_MAX_CHARS, SESSION_RESET_OCCUPANCY_TOKENS, SIDEBOARD_FORCE_STOP, SIDEBOARD_MCP_ALLOWED_TOOLS, SIDEBOARD_MCP_PROFILE_ENV, SLACK_LISTEN_INPUT_REQUIRED_REPLY, SLACK_LISTEN_STOPPED_REPLY, SLACK_LISTEN_TIMEOUT_REPLY, SLACK_OAUTH_CANCELLED, SLACK_OAUTH_REDIRECT, SLACK_PROGRESS_DELAY_MS, SLACK_PROGRESS_EDIT_MS, SLACK_REPLY_FORMATTING, SLACK_SEEN_REACTION, STDERR_EVENT_MAX_CHARS, STDOUT_EVENT_MAX_CHARS, type ScheduleCreatedBy, type ScheduleWhen, type ScheduledTask, type ScriptHandle, type SessionSeedOptions, type SetupLogSnapshot, type SetupRunResult, type SidebarGitAction, type SideboardMcpProfile, type SkillInfo, type SlackInboundMessage, type SlackListenOptions, type SlackListenStatus, SlackOAuthCancelledError, type SlackOutboundReply, type SlackOutboundWatch, type SlackRelayClientMessage, type SlackRelayClientOptions, SlackRelayHub, type SlackRelayServerMessage, type SlackWorkspaceInfo, type SourceType, type SpawnTurnHandle, type SteerRequest, type SummarizeResult, THINKING_EFFORTS, THINKING_PART_MAX_CHARS, type TaskState, type TeamName, type ThinkingEffort, type Thread, type ThreadAttachment, type ThreadMessage, type ThreadOptionsPatch, type ThreadStatus, type TokenUsage, type ToolPartLike, type TranscriptToolDetail, type TurnCommand, USAGE_ON_LIMIT_VALUES, type UpdateScheduledTaskPatch, type UsageOnLimit, type UsageScope, type ViewerContextWriteResult, type ViewerProfile, WORKTREE_ABLETIME_MCP_TOOLS, WORKTREE_GITHUB_MCP_TOOLS, WORKTREE_LINEAR_MCP_TOOLS, WORKTREE_MCP_TOOLS, type Workspace, type WorkspaceInventoryEntry, type WorkspaceScriptEnvOpts, type WorkspaceTagMode, type WorktreeDirtyStat, type WorktreeListBadge, type WorktreeOpener, type WorktreeOpenerId, type WorktreeSortMode, type WorktreeStatKind, ableTimeCredentialKind, ableTimeDependencyTarget, ableTimeOAuthAuthorizeUrl, ableTimeOAuthBouncePage, ableTimeOAuthClientId, ableTimeOAuthLocalBounceUrl, ableTimeOAuthRedirectUri, ableTimeOAuthResource, ableTimeUsesRest, abletimeMcpRequest, abletimeMcpUrl, abletimeToolUsesPm, accountIdToPin, ackSlackInboundSeen, activeAccountId, activeRunPreview, addBoardPin, addManagedAccount, addPrStackLayer, addStackLayerFromThread, addWorkspace, adoptThread, agentDoneCustomSoundMime, agentDoneSound, agentDoneSoundsDir, agentGitPrompt, agentRpcConnectFromMetadata, alignQueueAttachments, allAdapters, allocatePort, allocatePortRange, allocateTeamName, allocateTeamSlug, annotateDevAccessRuns, answerToolPermission, appDataDir, appSettingsPath, appendCompactedMessages, appendIndexedGitConfig, appendMessage, appendQueuedItem, applyAgentEvent, applyAgentRunnerHeapEnv, applyAppEnvironment, applyCompaction, applyForwardOccupancy, applyGithubGitAuthEnv, applyManagedAccountEnv, applyPromptCacheTtlEnv, applySystemCaEnv, applyThreadIntoMain, applyTurnUsage, applyWorkspaceTags, archiveRemovedWorkspaceChats, archivesWithRemovedWorkspace, armSchedules, assertAbleTimeCredential, assertAbleTimeMcpCredential, assertOrchestratorCapableAgent, attachmentFromAbsolutePath, attachmentsFromBuffers, attachmentsFromWorktreePaths, attachmentsGitignoreBody, autoArchiveOnMergeEnabled, autoCleanupHistoryEnabled, autoCleanupOrphansEnabled, autoRenameBranchEnabled, autoRunAfterSetupEnabled, branchDisplayLabel, brightsyAccessTokenNeedsRefresh, brightsyAdapter, brightsyCloudConnectAgent, brightsyCloudConnectEnabled, brightsyConfigPath, brightsyInjectWorktreeMcpEnabled, brightsyMcpAllowedTools, brightsyMcpServerName, buildBrightsySessionSeed, buildCachedUserContent, buildClaudeStreamJsonUserMessage, buildCodeRefAttachment, buildDiffCommentAttachment, buildForkTranscriptAttachment, buildLinearIssueFilter, buildPastedTextAttachment, buildPathRefAttachment, buildReviewRequestAttachment, buildSessionSeed, buildWorkspaceScriptEnv, caffeinateHoldPath, caffeinateWhileCloudConnectEnabled, caffeinateWhileRunningEnabled, caffeinateWhileSchedulesEnabled, caffeinateWhileSlackListenEnabled, callAbleTimeTool, canReuseIdleWorktreeAgentForReview, canonicalizeRepoPath, captureLoginEnv, captureTurnBaseline, chatLinkUrl, chatTextScale, checkoutPrStackLayer, childEnvWithAppSettings, claimDesktopHost, clampGithubPrBody, clampHistoryMaxCount, clampHistoryMaxDays, clampReadAloudRate, classifyRunScriptPreview, classifyWorktreeColumn, classifyWorktreeListBadges, claudeAdapter, claudeChromeEnabled, claudeSubagentTurnReminder, claudeUsageOverLimitWindows, claudeUserSettingsPath, cleanupArchivedHistory, cleanupOrphanWorktrees, clearAgentDoneCustomSoundFile, clearBoardPins, clearHomeBoardCache, clearOptionalCliPresenceCache, clipAgentEventForPaint, clipThinkingForStore, cloneRepoIntoSideboard, closeMcpUiHost, codeRefRangeLabel, codexAdapter, codexSandboxWritableRootsArgs, codexUnattendedGitConfigArgs, coerceOrchestratorAgent, collectTakenTeamSlugs, commandLooksLikeElectron, commentAbleTimeTask, commentGitHubIssue, commentLinearIssue, commitAll, compactArchiveProse, compactPartsForSummaryMessage, compactSummaryPart, computeNextRunAt, conductorBundledBinDir, conductorDbPath, confirmClaudeUsageOverLimitEnabled, confirmLand, connectBrightsyTeam, connectOptionalService, connectSlackToken, connectedOptionalServices, connectedOrchestratorTurnReminder, connectedPrSelectors, consumeComposerAttachments, contextTokens, coordinatorSystemPrompt, coordinatorTurnReminder, copyConfiguredFiles, copyReadAloudFromUnknown, countCacheControlBlocks, countUnpushedVsOrigin, cowboyModeEnabled, createAbleTimePkce, createAbleTimeTask, createChatTab, createEmptyThread, createExistingBranchWorktree, createGitHubIssue, createGlobalChat, createLinearIssue, createLinearPkce, createOrUpdatePr, createPrStack, createSchedule, createThread, createThreadWorktree, currentBranch, cursorAdapter, cursorSdkMessageToEvents, decodeBrightsyTarget, defaultScheduleName, deleteBranchOnPurgeEnabled, deleteSchedule, deleteThreadRecord, deriveTaskState, desktopHostPidPath, detectAgents, detectGhStack, detectLocalMergeConflicts, detectOptionalServiceClis, disconnectAbleTimeConnection, disconnectBrightsyTeam, disconnectLinear, disconnectLinearConnection, disconnectOptionalService, disconnectRemoteAccount, disconnectSlackWorkspace, discoverSkills, downloadAbleTimeAttachment, downloadGitHubIssueAttachment, downloadLinearAttachment, dropCachedPrefixOnResume, emptyPublicIntegrations, emptyRunLog, emptySetupLog, encodeBrightsyTarget, endedOnAskUser, enrichPathWithNpmGlobalBin, enrichWorkspacesWithGithub, ensureAbleTimeAccessToken, ensureAbleTimeTask, ensureAgentPath, ensureBrightsyLocalConfigFresh, ensureBrightsyOAuthClientId, ensureCloudCoordinator, ensureConnectedBrightsyTeamTokens, ensureGhPreferOrigin, ensureGlobalCoordinatorCwd, ensureManagedAccountDir, ensureRemoteCoordinator, ensureRemoteHostCredentials, ensureReviewGuidelinesFile, ensureReviewRequestFile, ensureReviewSkillFile, ensureSlackCoordinator, ensureSlackDeviceIdentity, ensureWorkspace, estimateMessageChars, estimateOccupancyTokens, estimateThreadChars, examplePrefixedBranch, expandComposerPrompt, extractBrightsyContextSummary, extractGhErrorDetail, extractPendingPlanQuestions, extractPresentedPlan, extractiveSummary, fastForwardMainCheckoutIfSafe, fetchOriginForWorktree, fetchPrHead, finalizeParts, findAgentDoneCustomSoundPath, findConventionSetup, findInvalidCacheControlTtlOrder, findLastBrightsyContextSummary, findLiveThreadForCreate, findLiveThreadForCreateSource, findManagedAccount, findOrphanWorktrees, findProjectProfileKey, findRemoteCoordinator, findSlackCoordinator, findThreadByRef, findThreadForStackLayer, fireSchedule, flattenTurnInput, flipLinearRelationType, foldLegacyRolesIntoNotes, followUpBehavior, forkChatTab, forkMessageSlice, forkThreadWorktree, formatAccountProfilePlaybookLine, formatArtifactDirective, formatAskUserNotifyMessage, formatBrightsyFetchError, formatClaudeExtraUsageDetail, formatClaudeSubagentReminder, formatClaudeUsageCompact, formatClaudeUsageFetchedAt, formatClaudeUsageOverLimitConfirm, formatClaudeUsageOverLimitWait, formatClaudeUsageReset, formatClaudeUsageResetClock, formatClaudeUsageTooltip, formatCloudTurnReply, formatConnectedOrchestratorReminder, formatDetachedJobInvoke, formatDevAccessHint, formatFetchError, formatGhLandError, formatGitAuthModeDirective, formatInjectedNoticesForTurn, formatIpcInvokeError, formatIssueToolsDirective, formatIssueToolsReminder, formatLinearDirective, formatLinearReminder, formatLongRunningDirective, formatLongRunningReminder, formatMergePrError, formatMessagesAsTranscript, formatNotifyOrchestratorPrompt, formatOptionalServicesDirective, formatOptionalServicesDirectiveForTurn, formatOptionalServicesReminder, formatOptionalServicesReminderForTurn, formatPlanQuestionAnswers, formatPlanQuestionsForChat, formatPrGateDirective, formatProcessGuideDirective, formatProjectProfilePlaybookLines, formatRateLimitResetHint, formatRemotePrompt, formatRenameBranchDirective, formatScheduleWhen, formatScheduledPrompt, formatSlackExternalReplyPrompt, formatSlackInboundPrompt, formatSlackRepliesForTurn, formatSlackReplyContinuePrompt, formatSlackSignedReply, formatSlackTurnReply, formatSlackWorkingText, formatTranscriptMarkdown, formatUiReminder, formatViewerContextDirective, formatViewerContextReminder, formatWorkspaceInventory, formatWorkspaceProfileSuffix, formatWorktreeDirective, formatWorktreeReminder, forwardContextUsage, forwardOccupancyTokens, fromInclusiveInputUsage, getAbleTimeAccessToken, getAbleTimeHost, getAbleTimeOrientation, getAbleTimeTask, getAdapter, getAgentRpcServer, getAgentSetupInfo, getBrightsySession, getCaffeinateHold, getClaudePlanUsage, getDefaultAgent, getDefaultEffort, getDefaultFast, getDefaultModel, getDefaultRunScript, getDiff, getDiffSummary, getGitHubIssue, getGitHubStatus, getGithubGitAuthMode, getGithubPat, getHomeBoardInputs, getIssueSource, getLinearApiKey, getLinearAuthToken, getLinearIssue, getMcpUiHost, getOrchestrator, getPr, getPrChecks, getPrDetails, getPrForHeadBranch, getPrMeta, getPrStack, getRepoSetupInfo, getRunMode, getRunScript, getSchedule, getSlackWorkspace, getWorktreeDirtyStat, gh, ghHeadRef, ghPrCreateAssigneeArgs, ghRepoSelectArgs, git, gitBranchPrefixSetting, githubAgentGitEnv, githubHttpsInsteadOfEntries, githubProjectsOnIssue, githubRelationEditFlag, globalAgentCwd, groupHomeBoardWorktrees, handleRemoteInbound, handleSlackInbound, harnessEnvKey, hasBakedAbleTimeOAuth, hasBakedLinearOAuth, hasBakedSlackOAuth, hasConductorHook, hasConventionSetup, hasCursorWorktreeSetup, hasEnabledSchedules, hasRepoHook, hasWorkspaceHook, hasWorkspaceSettingsToml, headlessHostBlockedReason, healOrchestrationSoccerTitles, historyMaxCount, historyMaxDays, hottestClaudeWindow, httpFetch, importAgentDoneCustomSound, importConductorWorkspace, importConductorWorkspaceAsync, initPrStack, initStackFromThread, initializeGitRepository, inspectGitWorktree, installAgent, installNpmGlobalPackage, installOptionalServiceCli, interruptSlackCoordinatorForInbound, invalidateThreadListCache, invalidateThreadRecord, isAbleTimeConnected, isAbleTimeOAuthCancelled, isAbleTimeRejectedCredential, isAdoptableRunScriptRequest, isAgentDoneSound, isAskUserToolName, isBrightsyConnected, isBrightsyNdjsonLine, isChatTextScale, isClaudeAiConnectorMcp, isCloudCoordinatorThread, isCompactToolName, isConductorBundledCli, isContextCompactDone, isContextCompactInProgress, isCowboyThread, isCursorApiKeyConfigured, isCursorAutoModel, isCursorSdkInstalled, isDefaultishSourceRef, isDesktopHostAlive, isDirty, isGhPrBodyTooLongError, isGhRateLimitError, isGlobalRepoPath, isGlobalThread, isHistoryRetentionStub, isHomeBoardThread, isImageFilePath, isInPrStack, isInboundForThisDesktop, isIncompleteTaskState, isInjectedNoticeText, isInjectedOrchMcpName, isInternalAgentStatusText, isIssueSourceConnected, isLinearConnected, isLinearNoneToken, isLinearOAuthCancelled, isManagedAccountKind, isOptionalServiceId, isOrchestratorCapableAgent, isOrchestratorThread, isOtherWorktreeListenerCwd, isPidAlive, isPlaceholderBranch, isPlanQuestionAnswersMessage, isPollWrapperToolName, isPosthogConnected, isPrNotMergeableError, isPresentPlanToolName, isPrimaryCheckoutThread, isRemoteAccountLoginCancelled, isRemoteStopCommand, isRemovedWorkspace, isSelfWrittenRecord, isSessionQuotaLimit, isSetupLastError, isShellToolName, isSideboardScratchPath, isSkillToolName, isSlackCoordinatorThread, isSlackExternalReplyPrompt, isSlackOAuthCancelled, isStaleLastErrorDuringTurn, isSubagentToolName, isSystemStatusThinking, isTerminalTaskState, isThinkingEffort, isThisProcessDesktopHost, isThisWorktreeListenerCwd, isThreadCaffeinated, isThreadRecordFile, isUnclaimedRunScriptRequest, isUsageOnLimit, isWorkspaceScratchPath, issueAttachmentForAbleTimeTask, issueMatchesAssignee, issueSourceLabel, issueTicketFromThread, killDetachedRunTree, killListenersOnPorts, killStaleWorktreeListeners, killableListenerPids, lanRelayUrls, lastAgentReply, lastAssistantMessageText, lastRequestOccupancy, latestPendingPlanQuestions, linearAuthorizationHeader, linearCycleIsActive, linearGraphql, linearOAuthAuthorizeUrl, linearOAuthCredentials, linearRelationCreateInput, linearTicketIdFromThread, linkSharedDirectories, linkifyChatUrls, listAbleTimeAssignedIssues, listAbleTimeProjects, listAbleTimeTasks, listAgentSetupInfo, listBoardPins, listBranchCommits, listBranches, listBrightsyAccounts, listBrightsyChatTargets, listCodexModels, listConductorWorkspaces, listConnectedBrightsyTeams, listCursorModels, listGitHubIssueCommentsSince, listGitHubIssues, listGitHubProjects, listGlobalThreads, listIssues, listLinearAssignedIssues, listLinearCommentsSince, listLinearIssues, listLinearIssuesDirect, listLinearIssuesFiltered, listLinearProjects, listLinearTeamCycles, listLinearTeams, listModelsForAgent, listOpencodeModels, listPrs, listRunScripts, listSchedules, listSlackOutboundWatches, listSlackWorkspaces, listThreads, listWorkspaces, listWorktreeFiles, listWorktrees, listenerCwd, liveActivitySummary, loadAppSettings, loadBrightsyConfig, loadConductorSettings, loadHomeBoardInputs, loadRepoSettings, loadWorkspaceSettings, loadWorktreeRunPorts, localhostPreviewUrl, locksDir, loginAgent, loginEnvPrefix, loginManagedAccount, looksLikeComposerSkillExpansion, looksLikeConversationSummary, looksLikeIncompleteSkillDump, looksLikeSkillBody, lookupSoccerTeam, managedAccountConfigDir, mapAbleTimeTask, markPrReady, materializeSystemCaBundle, maxConcurrentAgents, maybeCompactContext, mcpAllowTools, mcpAllowToolsFromNames, mcpAuthWarnings, mcpServerIdForPermission, mcpServerPermissionUpdate, mcpStatusThinkingFromClaudeInit, mcpUiContentSecurityPolicy, mentionsPrGoal, mergeAgentGitAuthEnv, mergePr, mergePrStack, mergeSetupOutput, mergeSideboardIntoMcpServersJson, mergeUsage, messagePartParentId, messagesForCompactArchive, messagesSinceLastBrightsyContextSummary, mirrorHostConfig, moveQueuedItemToFront, needsCoordinatorAction, nextManagedAccount, nextPastedTextName, nextThinkingEffort, nonInteractiveGitProcessEnv, normalizeAbleTimeCredential, normalizeAbleTimeHost, normalizeBrightsyEndpoint, normalizeCodeSelection, normalizeLinearRelationType, normalizeManagedAccounts, normalizeParseResult, normalizeRemoteRelayUrl, normalizeReviewLabel, normalizeServiceOrigin, normalizeThinkingEffort, normalizeThread, normalizeTurnInput, normalizeWorkspaceTags, normalizeWorktreePath, notifyOrchestrator, npmGlobalNodeModules, npmGlobalPrefix, openInSystemTerminal, openPrStackLayers, openStackLayer, opencodeAdapter, optionalCliPresence, optionalServiceConnected, optionalServiceSpec, orchestrationQuotaFallbackAgent, orchestrationQuotaOnLimit, orchestrationTitleNeedsSoccerNickname, orchestratorSessionPoisonedByBuiltins, originFetchBranch, originGhRepoEnv, outboundReplyFromTurn, packagedDetachedJobPath, parseAbleTimeOAuthCallbackUrl, parseChatLink, parseClaudeUsagePayload, parseCursorRunnerLine, parseDevPreview, parseDurationMs, parseForceStopMessage, parseGhStackViewJson, parseGitHubIssueNumber, parseGithubSlugFromRemoteUrl, parseMcpList, parsePlanQuestionsInput, parsePrDetailsView, parseSessionQuotaResetAt, parseSlackRelayClientMessage, parseSlackRelayServerMessage, partsToAssistantText, pastedTextStats, patchReadAloudSettings, pendingInjectedNotices, pendingSlackExternalReplies, permissionMode, persistPendingFileAttachments, persistVaultKeyInKeychain, planFileAbs, planHistoryAgePurge, planHistoryRetention, planModeTurnInstruction, planQuestionsSignature, pnpmFilterPackage, pollSlackOutboundWatches, posixShellSingleQuote, preferredCursorCostCents, prepareTerminalCommand, prependQueuedItem, previewLand, previousCostBaseline, primaryCheckoutFromLinkedWorktree, promptMentionsBrightsy, pushBranch, readAgentDoneCustomSound, readAgentRuntimeMetadata, readExistingReviewRequestFile, readKeychainVaultKey, readPlanFile, readRunLog, readSetupLog, readSkillBody, readThread, readViewerContext, readWorktreeFile, readWorktreeFileForUpload, readWorktreeInclude, recordScheduleRun, recordSlackOutboundWatch, refreshBrightsyAccessToken, refreshGitHubAuth, registerBrightsyOAuthClient, registerPackagedUserMcpClients, releaseCaffeinateHoldForThread, releaseDesktopHost, remoteAccountHttpOrigin, remoteCoordinatorSourceRef, remoteRelayUrl, removeBoardPin, removeManagedAccount, removeQueuedItem, removeWorkspace, removeWorktree, renameManagedAccount, repoSlug, requestOccupancy, requestReview, requireAgent, reservePort, reservePortRange, resetGhStackDetectCache, resetGithubAgentTokenMemo, resolveAbleTimeOAuthHost, resolveAccountForThread, resolveAccountProfile, resolveAccountProfileFromSettings, resolveAgentExecutable, resolveAgentGitAuthEnv, resolveClaudeExecutable, resolveCodexGitWritableRoots, resolveCommandBinarySync, resolveConductorCursorAgentId, resolveCreateFirstPrompt, resolveCursorModelId, resolveCursorSdkRoot, resolveDefaultBranch, resolveDetachedJobScript, resolveDiffBaseRef, resolveEffectiveIssueSource, resolveFilesToCopy, resolveGhAuthToken, resolveGitBranchPrefix, resolveGitDirsForLockRecovery, resolveGitHubIssueRepo, resolveGithubAgentToken, resolveGithubRepoSlug, resolveLinearCycle, resolveLinearLabel, resolveLinearProject, resolveLinearState, resolveLinearTeam, resolveLoginCommand, resolveNewOrchestratorOptions, resolveNewThreadOptions, resolveOrchChildFollowUp, resolveOrchestratorDefaults, resolvePlanMarkdown, resolvePrSelector, resolvePrSelectors, resolveProjectReviewLabel, resolveQuotaFallbackAgent, resolveRepoRoot, resolveReviewGuidelines, resolveScheduleThreadId, resolveSendFollowUp, resolveSidebarGitPrompt, resolveSlackListenMode, resolveThreadDefaults, resolveThreadEffort, resolveUsageOnLimit, resolveVaultKey, resolveViewerProfile, resolveViewerProfileForRepo, resolveWorktreeStartPoint, reviewLabelForRepo, rewriteAbleTimeError, rewriteLinearError, run, runArchiveScript, runCloudConnect, runConventionSetup, runCursorWorktreeSetup, runRemoteHost, runScriptPreview, runSetupScript, runSlackListen, runSlackRelayClient, runWorkspaceSetup, sameWorkspacePath, sameWorktreePath, sanitizeGitBranchPrefix, sanitizeMcpServerName, sanitizeReadAloudVoiceURI, saveAbleTimeConnection, saveAppSettings, saveLinearOAuth, saveRemotePhoneToken, saveWorktreeRunPorts, scheduleNeedsCaffeinate, schedulesPath, scrubGithubTokensFromChildEnv, searchAbleTimeTasks, secureFileUnlocksWith, selectManagedAccount, setCaffeinateHold, setHttpFetchImpl, setStatus, setVaultMasterKey, settingsSourceLabel, shiftQueuedItem, shouldAttachPastedText, shouldCompactContext, shouldInjectBrightsyMcp, shouldNotifyOrchestrator, shouldRefreshReviewRequestTemplate, shouldRegisterPresentPlan, shouldRemoveWorktreeOnTeardown, shouldResetSessionForOccupancy, shouldRunHistoryCleanup, shouldRunWorktreeCleanup, shouldStampSetupLastError, showCostEnabled, sidebarParentSelectId, sidebarQuestionThreadId, sidebarRowAgentBlock, sideboardHomeDir, sideboardMcpProfile, sideboardReposDir, sideboardWorkspacesDir, skillCommandFromBody, skillCommandFromInput, skillNameFromFrontmatter, slackAppLevelToken, slackArchiveUrl, slackCoordinatorSourceRef, slackListenEnabled, slackOAuthCredentials, slackOAuthResultUrl, slackRelayUrl, sliceRunLogOutput, slimMessagesForUiList, slimThreadForUiList, slugify, spawnAgentTurn, splitForCompaction, splitTurnInputForSystemPrompt, stackAgentDefaultsFrom, stackIdFrom, stackMergeReadiness, stageAbsolutePathsAsAttachments, stageBuffersAsAttachments, startAbleTimeOAuth, startAgentRpcServer, startDevServer, startHeadlessHost, startLinearOAuth, startMcpServer, startOrchestration, startRelayServer, startRemoteAccountLogin, startSlackOAuth, statWorktreePath, stopAgentRpcServer, stripBrightsyNdjsonNoise, stripNestedElectronEnv, submitPrStack, suggestSlug, sumUsageList, summarizeConversation, switchBrightsyAccount, switchWorktreeBranch, syncWorkspacesFromThreads, systemConfigDir, takePendingTurnAttachments, takenTeamSlugsForChatTab, takenTeamSlugsForOrchestration, taskMessageText, taskUrl, thinkingEffortBars, thinkingEffortLabel, thisProcessShouldDrainAgentQueues, threadDisplayLabel, threadFilePath, threadHasCompactedContext, threadLivePath, threadLockPath, threadMayPresentPlan, threadRequestsBrightsyMcp, threadsDir, threadsSharingWorktree, ticketSlugForBranch, toAbleTimeIssueInfo, toGitHubIssueInfo, toPublicAppSettings, toolActivityLine, toolDescription, toolDetail, toolFilePath, totalTokens, trustSystemCertificates, tryReservePort, tryReservePorts, turnCostUsdFromCursorUsage, turnCostUsdFromProviderSnapshot, updateAbleTimeTask, updateAdvancedSettings, updateAgentExecutable, updateAppEnvironment, updateBrightsySettings, updateClaudeSettings, updateCodexSettings, updateDefaultsSettings, updateGitHubIssue, updateIntegrationsSettings, updateLinearIssue, updateOpencodeSettings, updateProjectProfileSettings, updateSchedule, updateThread, usageOnLimit, userClaudeMcpConfigPath, userCursorMcpConfigPath, userMcpNamesToDisable, validateLinearApiKey, verifyAbleTimeConnection, verifyOptionalService, visibleAgentBlock, visibleAssistantText, visibleToolRowDetail, waitForPidExit, warmGithubAgentAuth, whichOnPath, withAddedAccount, withEventParentId, withEventsParentId, withExportedPath, withMaxOldSpaceSize, withRemovedAccount, withSelectedAccount, withThreadLock, withTurnScopedCost, workspaceAgentChatSummaries, workspaceSettingsSourceLabel, workspaceTagTargetRef, workspaceTagsFromGroup, worktreeAgentBlock, worktreeBoardStatus, worktreeCleanupSettings, worktreeDisplayLabel, worktreeDisplayLabelForGroup, worktreeNameFromPath, worktreeRunPortsPath, worktreeSlugForTicket, worktreesRoot, wrapReviewSkillMarkdown, writeInjectedMcpConfig, writePlanFile, writeThread, writeViewerContext, writeWorktreeFile };
+export { ABLETIME_MCP_PATH, ABLETIME_MCP_PM_PATH, ABLETIME_OAUTH_CALLBACK_PATH, ABLETIME_OAUTH_CANCELLED, ABLETIME_OAUTH_LOCAL_CALLBACK, ABLETIME_OAUTH_PORT, ABLETIME_OAUTH_REDIRECT, ABLETIME_OAUTH_RESOURCE, ABLETIME_OAUTH_TOKEN_PREFIX, ABLETIME_ORG_KEY_PREFIX, ABLETIME_PAT_PREFIX, ABLETIME_PM_TOOL_NAMES, AGENT_DONE_CUSTOM_SOUND_EXTENSIONS, AGENT_DONE_CUSTOM_SOUND_MAX_BYTES, AGENT_DONE_SOUNDS, AGENT_GIT_ACTIONS, AGENT_RPC_NATIVE_ENV, AGENT_RPC_PROTOCOL_VERSION, AGENT_RUNNER_MAX_OLD_SPACE_MB, ATTACHMENTS_DIR, type AbleTimeAssignedIssuesResult, type AbleTimeComment, type AbleTimeCredentialKind, type AbleTimeMcpToolName, AbleTimeOAuthCancelledError, type AbleTimeOrientation, type AbleTimePmToolName, type AbleTimeProject, type AbleTimeTask, type AbleTimeTaskRelationInput, type AbleTimeViewer, type AccountProfile, type ActiveRun, type AddBoardPinInput, type AddStackLayerInput, type AdoptInput, type AdvancedAppSettings, type AgentAdapter, type AgentBlock, type AgentBlockSource, type AgentDoneCustomSoundPayload, type AgentDoneSound, type AgentEvent, type AgentGitAction, type AgentKind, type AgentModelCatalog, type AgentModelInfo, type AgentPermissionPrompt, type AgentRpcConnect, type AgentRuntimeMetadata, type AgentSetupActionResult, type AgentSetupInfo, type AgentSetupKind, type AgentStatus, type AgentTurnInput, type AnthropicCacheControl, type AppSettings, type ApplyIntoMainResult, type AskBlockSnapshot, type AttachCommand, type Autonomy, BAKED_ABLETIME_OAUTH_CLIENT_ID, BAKED_REMOTE_RELAY_URL, BAKED_SLACK_RELAY_URL, BASE_ALLOWED_TOOLS, BRIGHTSY_MCP_ALLOWED_TOOLS, BRIGHTSY_OAUTH_CLIENT_ID, BRIGHTSY_OAUTH_REDIRECT, BRIGHTSY_SUMMARIZE_CONTEXT_TOOL, BUNDLED_LONG_RUNNING_PATH, BUNDLED_SKILL_PREFIX, type BoardPin, type BranchInfo, type BrightsyAccount, type BrightsyChatTarget, type BrightsyChatTargets, type BrightsyCloudConnectAgent, type BrightsyHarnessSettings, type BrightsySession, BrightsySideboardApi, type BrightsyTeamTargets, CHARS_PER_CONTEXT_TOKEN, CHAT_LINK_PREFIX, CHAT_TEXT_SCALES, CHAT_TEXT_SCALE_DEFAULT, CLAUDE_CHROME_ALLOWED_TOOLS, CLAUDE_MODEL_CATALOG, CLAUDE_POSTHOG_CONNECTOR_ALLOWED_TOOLS, CLAUDE_PRINT_BG_WAIT_CEILING_MS, CLAUDE_SUMMARY_TIMEOUT_MS, CLI_DIR, CLOUD_COORDINATOR_BUSY_REPLY, CLOUD_COORDINATOR_CANCELED_REPLY, CLOUD_COORDINATOR_INPUT_REQUIRED_REPLY, CLOUD_COORDINATOR_STOPPED_REPLY, CLOUD_COORDINATOR_TIMEOUT_REPLY, CLOUD_ORCHESTRATOR_GOAL, CONTEXT_COMPACT_CHARS, CONTEXT_KEEP_RECENT_CHARS, CONTEXT_KEEP_RECENT_MESSAGES, CONTEXT_MIN_MESSAGES, CONTEXT_REVIEW_PATH, CONVENTION_SETUP_RELPATHS, COORDINATOR_TOOL_PLAYBOOK, CURSOR_SDK_INSTALL_HINT, type CaffeinateHoldState, type ChatTextScale, type ClaudeExtraUsage, type ClaudeHarnessSettings, type ClaudePlanUsage, type ClaudeUsageWindow, type ClaudeUsageWindowId, type CleanupOrphansResult, type CliAgentKind, type CliExecutableSettings, type CloudConnectAgent, type CloudConnectOptions, type CloudConnectStatus, type CodeLineRange, type CodeRefInput, type CompactResult, type CompactThresholds, type ComposerFileBuffer, type ConductorSettings, type ConductorWorkspace, type ConnectedBrightsyTeamInfo, type ConventionSetupFile, type CowboyThreadFields, type CreateChatTabInput, type CreateGlobalChatOpts, type CreateScheduledTaskInput, type CreateStackInput, type CreateThreadInput, type CreateWorktreeResult, type CursorAgentUsageSnapshot, type CursorModelInfo, type CursorSdkStreamMessage, type CursorTurnRequest, type CursorUsageCost, type CursorWorktreesConfig, DEFAULT_ABLETIME_HOST, DEFAULT_RUN_LOG_TAIL_CHARS, DEFAULT_WORKTREE_SORT, DETACHED_JOBS_DIR, type DefaultsAppSettings, type DefaultsSettingsPatch, type DevAccessRun, type DevPreview, type DevServerHandle, type DiffCommentInput, type DiffCommentLine, type DiffCommit, type DiffFile, type DiffResult, type DiffScope, type DiffScopeStat, EMPTY_MANAGED_ACCOUNTS, type EnsuredReviewGuidelines, type ExpandResult, FAMOUS_SOCCER_TEAMS, FOLLOW_UP_BEHAVIORS, type FastForwardMainResult, type FollowUpBehavior, type ForkChatTabInput, type ForkThreadWorktreeInput, type FormatGhLandErrorOptions, GITHUB_GIT_AUTH_MODES, GITHUB_PR_BODY_MAX_CHARS, GITHUB_PR_BODY_SAFE_CHARS, GLOBAL_WORKSPACE_ID, type GetDiffOptions, type GhStackStatus, type GitHubIssue, type GitHubIssueComment, type GitHubIssueRelationInput, type GitHubProject, type GitHubProjectRef, type GitHubStatus, type GitWorktreeStatus, type GithubGitAuthMode, HARNESS_ENV_KEYS, HISTORY_DISCARDED_TEXT, HISTORY_MAX_COUNT_DEFAULT, HISTORY_MAX_COUNT_MAX, HISTORY_MAX_COUNT_MIN, HISTORY_MAX_DAYS_DEFAULT, HISTORY_MAX_DAYS_MAX, HOME_BOARD_CACHE_TTL_MS, type HarnessId, type HistoryCleanupResult, type HistoryRetentionPlan, type HomeBoardLoaded, type HomeBoardRemoteData, IMPLIED_TICKET_RESOLVE_PROMPT, ISSUE_SOURCE_LABELS, type ImportedAgentDoneSound, type InitStackFromThreadInput, type IntegrationsSettings, type IpcApi, type IssueActivityComment, type IssueAssigneeFilter, type IssueCycleInfo, type IssueInfo, type IssueSource, LEGACY_ATTACHMENTS_DIR, LEGACY_DETACHED_JOBS_DIR, LEGACY_PLAN_FILE_REL, LEGACY_REVIEW_REQUEST_PATH, LEGACY_THREAD_LINK_PREFIX, LIGHT_RECONCILE_THROTTLE_MS, LINEAR_OAUTH_CANCELLED, LINEAR_OAUTH_PORT, LINEAR_OAUTH_REDIRECT, LINEAR_OAUTH_SCOPES, LIVE_TURN_SPAWN_GRACE_MS, LONG_RUNNING_SKILL_COMMAND, type LandPreview, type LandResult, type LinearAssignedIssuesResult, type LinearAssigneeFilter, type LinearComment, type LinearCycle, type LinearIssue, type LinearIssueAttachment, type LinearIssueComment, type LinearIssueRef, type LinearIssueRelation, type LinearIssueRelationInput, type LinearNamedRef, LinearOAuthCancelledError, type LinearProjectRef, type LinearTeam, type LinearTeamsResult, type LinearWorkflowState, type ListIssuesOptions, type ListIssuesResult, type ListPrsOptions, MAX_ANTHROPIC_CACHE_CONTROL_BLOCKS, type ManagedAccount, type ManagedAccountKind, type ManagedAccountsState, type McpServerStatus, type McpUiView, type MessagePart, type NextManagedAccount, type NotifyOrchestratorReason, type NotifyOrchestratorResult, OPTIONAL_SERVICES, OPTIONAL_SERVICE_IDS, ORCHESTRATOR_AGENT_KINDS, type OpenPrStackLayersInput, type OpenStackLayerInput, type OpenStackLayerResult, type OptionalCliPresence, type OptionalServiceCliStatus, type OptionalServiceId, type OptionalServiceSpec, type OrchestrationQuotaOnLimit, Orchestrator, type OrchestratorAgentKind, type OrchestratorDefaultsSettings, type OrchestratorEvent, type OrchestratorRuntime, type OrphanWorktree, type OutboundTurnCopy, type OutboundTurnSnapshot, PASTE_ATTACH_MIN_CHARS, PASTE_ATTACH_MIN_LINES, PLAN_FILE_NAME, PLAN_FILE_REL, PLAN_MODE_INSTRUCTION, PLAN_MODE_OFF_INSTRUCTION, PLAN_QUESTION_ANSWERS_PREFIX, PORT_RANGE_SIZE, PRESENT_PLAN_REQUIRES_PLAN_MODE, PRESENT_PLAN_TOOL_DESCRIPTION, PROFILE_NOTES_MAX, PR_DETAILS_JSON_FIELDS, type PathRefInput, type PendingPlanQuestions, type PlanQuestion, type PlanQuestionAnswer, type PlanQuestionOption, type PlanToolPartLike, type PortReservation, type PrActor, type PrCheckRun, type PrCommentInfo, type PrCommitInfo, type PrDetails, type PrInfo, type PrMeta, type PrReviewInfo, type PrStack, type PrStackLayer, type PresentedPlan, type ProjectProfileSettings, type PublicAppSettings, type PublicIntegrationsSettings, READ_ALOUD_RATE_DEFAULT, READ_ALOUD_RATE_MAX, READ_ALOUD_RATE_MIN, REMOTE_RELAY_PATH, REPO_REVIEW_NAME, REPO_REVIEW_PATH, REVIEW_LABEL_MAX, REVIEW_REQUEST_NAME, REVIEW_REQUEST_PATH, REVIEW_REQUEST_PREFILL, REVIEW_REQUEST_TEMPLATE, REVIEW_SKILL_NAME, REVIEW_SKILL_PATH, RUN_PORTS_REL, RUN_SCRIPT_DESKTOP_ADOPT_MS, type ReadAloudSettingsFields, type RelayAccountProvider, type RelayServerHandle, type RelayServerOptions, type RemoteAccountSession, type RemoteAskQuestion, type RemoteHostClientOptions, type RemoteHostHandle, type RemoteHostStatus, RemoteHub, type RemoteServerMessage, type RepoSettings, type RepoSetupInfo, type RequestReviewResult, type ReservePortRangeOpts, type ResolvedAccountProfile, type ResolvedReviewGuidelines, type ResolvedThreadDefaults, type ResolvedViewerProfile, type ReviewGuidelinesSource, type RunLogSnapshot, type RunMode, type RunScript, type RunScriptPreviewInput, type RunScriptRequest, SEED_FULL_TOOL_MESSAGES, SEED_MAX_CHARS, SESSION_RESET_OCCUPANCY_TOKENS, SIDEBOARD_FORCE_STOP, SIDEBOARD_MCP_ALLOWED_TOOLS, SIDEBOARD_MCP_PROFILE_ENV, SLACK_LISTEN_INPUT_REQUIRED_REPLY, SLACK_LISTEN_STOPPED_REPLY, SLACK_LISTEN_TIMEOUT_REPLY, SLACK_OAUTH_CANCELLED, SLACK_OAUTH_REDIRECT, SLACK_PROGRESS_DELAY_MS, SLACK_PROGRESS_EDIT_MS, SLACK_REPLY_FORMATTING, SLACK_SEEN_REACTION, STDERR_EVENT_MAX_CHARS, STDOUT_EVENT_MAX_CHARS, type ScheduleCreatedBy, type ScheduleWhen, type ScheduledTask, type ScriptHandle, type SessionSeedOptions, type SetupLogSnapshot, type SetupRunResult, type SidebarGitAction, type SideboardMcpProfile, type SkillInfo, type SlackInboundMessage, type SlackListenOptions, type SlackListenStatus, SlackOAuthCancelledError, type SlackOutboundReply, type SlackOutboundWatch, type SlackRelayClientMessage, type SlackRelayClientOptions, SlackRelayHub, type SlackRelayServerMessage, type SlackWorkspaceInfo, type SourceType, type SpawnTurnHandle, type SteerRequest, type SummarizeResult, THINKING_EFFORTS, THINKING_PART_MAX_CHARS, type TaskState, type TeamName, type ThinkingEffort, type Thread, type ThreadAttachment, type ThreadMessage, type ThreadOptionsPatch, type ThreadStatus, type TokenUsage, type ToolPartLike, type TranscriptToolDetail, type TurnCommand, USAGE_ON_LIMIT_VALUES, type UpdateScheduledTaskPatch, type UsageOnLimit, type UsageScope, type ViewerContextWriteResult, type ViewerProfile, WORKTREE_ABLETIME_MCP_TOOLS, WORKTREE_GITHUB_MCP_TOOLS, WORKTREE_LINEAR_MCP_TOOLS, WORKTREE_MCP_TOOLS, type Workspace, type WorkspaceInventoryEntry, type WorkspaceScriptEnvOpts, type WorkspaceTagMode, type WorktreeDirtyStat, type WorktreeListBadge, type WorktreeOpener, type WorktreeOpenerId, type WorktreeSortMode, type WorktreeStatKind, ableTimeCredentialKind, ableTimeDependencyTarget, ableTimeOAuthAuthorizeUrl, ableTimeOAuthBouncePage, ableTimeOAuthClientId, ableTimeOAuthLocalBounceUrl, ableTimeOAuthRedirectUri, ableTimeOAuthResource, ableTimeUsesRest, abletimeMcpRequest, abletimeMcpUrl, abletimeToolUsesPm, accountIdToPin, ackSlackInboundSeen, activeAccountId, activeRunPreview, addBoardPin, addManagedAccount, addPrStackLayer, addStackLayerFromThread, addWorkspace, adoptThread, agentDoneCustomSoundMime, agentDoneSound, agentDoneSoundsDir, agentGitPrompt, agentRpcConnectFromMetadata, alignQueueAttachments, allAdapters, allocatePort, allocatePortRange, allocateTeamName, allocateTeamSlug, annotateDevAccessRuns, answerToolPermission, appDataDir, appSettingsPath, appendCompactedMessages, appendIndexedGitConfig, appendMessage, appendQueuedItem, applyAgentEvent, applyAgentRunnerHeapEnv, applyAppEnvironment, applyCompaction, applyForwardOccupancy, applyGithubGitAuthEnv, applyManagedAccountEnv, applyPromptCacheTtlEnv, applySystemCaEnv, applyThreadIntoMain, applyTurnUsage, applyWorkspaceTags, archiveRemovedWorkspaceChats, archivesWithRemovedWorkspace, armSchedules, assertAbleTimeCredential, assertAbleTimeMcpCredential, assertOrchestratorCapableAgent, attachmentFromAbsolutePath, attachmentsFromBuffers, attachmentsFromWorktreePaths, attachmentsGitignoreBody, autoArchiveOnMergeEnabled, autoCleanupHistoryEnabled, autoCleanupOrphansEnabled, autoRenameBranchEnabled, autoRunAfterSetupEnabled, bootstrapSystemCa, branchDisplayLabel, brightsyAccessTokenNeedsRefresh, brightsyAdapter, brightsyCloudConnectAgent, brightsyCloudConnectEnabled, brightsyConfigPath, brightsyInjectWorktreeMcpEnabled, brightsyMcpAllowedTools, brightsyMcpServerName, buildBrightsySessionSeed, buildCachedUserContent, buildClaudeStreamJsonUserMessage, buildCodeRefAttachment, buildDiffCommentAttachment, buildForkTranscriptAttachment, buildLinearIssueFilter, buildPastedTextAttachment, buildPathRefAttachment, buildReviewRequestAttachment, buildSessionSeed, buildWorkspaceScriptEnv, caffeinateHoldPath, caffeinateWhileCloudConnectEnabled, caffeinateWhileRunningEnabled, caffeinateWhileSchedulesEnabled, caffeinateWhileSlackListenEnabled, callAbleTimeTool, canReuseIdleWorktreeAgentForReview, canonicalizeRepoPath, captureLoginEnv, captureTurnBaseline, chatLinkUrl, chatTextScale, checkoutPrStackLayer, childEnvWithAppSettings, claimDesktopHost, clampGithubPrBody, clampHistoryMaxCount, clampHistoryMaxDays, clampReadAloudRate, classifyRunScriptPreview, classifyWorktreeColumn, classifyWorktreeListBadges, claudeAdapter, claudeChromeEnabled, claudeSubagentTurnReminder, claudeUsageOverLimitWindows, claudeUserSettingsPath, cleanupArchivedHistory, cleanupOrphanWorktrees, clearAgentDoneCustomSoundFile, clearBoardPins, clearHomeBoardCache, clearOptionalCliPresenceCache, clipAgentEventForPaint, clipThinkingForStore, cloneRepoIntoSideboard, closeMcpUiHost, codeRefRangeLabel, codexAdapter, codexSandboxWritableRootsArgs, codexUnattendedGitConfigArgs, coerceOrchestratorAgent, collectTakenTeamSlugs, commandLooksLikeElectron, commentAbleTimeTask, commentGitHubIssue, commentLinearIssue, commitAll, compactArchiveProse, compactPartsForSummaryMessage, compactSummaryPart, computeNextRunAt, conductorBundledBinDir, conductorDbPath, confirmClaudeUsageOverLimitEnabled, confirmLand, connectBrightsyTeam, connectOptionalService, connectSlackToken, connectedOptionalServices, connectedOrchestratorTurnReminder, connectedPrSelectors, consumeComposerAttachments, contextTokens, coordinatorSystemPrompt, coordinatorTurnReminder, copyConfiguredFiles, copyReadAloudFromUnknown, countCacheControlBlocks, countUnpushedVsOrigin, cowboyModeEnabled, createAbleTimePkce, createAbleTimeTask, createChatTab, createEmptyThread, createExistingBranchWorktree, createGitHubIssue, createGlobalChat, createLinearIssue, createLinearPkce, createOrUpdatePr, createPrStack, createSchedule, createThread, createThreadWorktree, currentBranch, cursorAdapter, cursorSdkMessageToEvents, decodeBrightsyTarget, defaultScheduleName, deleteBranchOnPurgeEnabled, deleteSchedule, deleteThreadRecord, deriveTaskState, desktopHostPidPath, detectAgents, detectGhStack, detectLocalMergeConflicts, detectOptionalServiceClis, disconnectAbleTimeConnection, disconnectBrightsyTeam, disconnectLinear, disconnectLinearConnection, disconnectOptionalService, disconnectRemoteAccount, disconnectSlackWorkspace, discoverSkills, downloadAbleTimeAttachment, downloadGitHubIssueAttachment, downloadLinearAttachment, dropCachedPrefixOnResume, emptyPublicIntegrations, emptyRunLog, emptySetupLog, encodeBrightsyTarget, endedOnAskUser, enrichPathWithNpmGlobalBin, enrichWorkspacesWithGithub, ensureAbleTimeAccessToken, ensureAbleTimeTask, ensureAgentPath, ensureBrightsyLocalConfigFresh, ensureBrightsyOAuthClientId, ensureCloudCoordinator, ensureConnectedBrightsyTeamTokens, ensureGhPreferOrigin, ensureGlobalCoordinatorCwd, ensureManagedAccountDir, ensureRemoteCoordinator, ensureRemoteHostCredentials, ensureReviewGuidelinesFile, ensureReviewRequestFile, ensureReviewSkillFile, ensureSlackCoordinator, ensureSlackDeviceIdentity, ensureWorkspace, estimateMessageChars, estimateOccupancyTokens, estimateThreadChars, examplePrefixedBranch, expandComposerPrompt, extractBrightsyContextSummary, extractGhErrorDetail, extractPendingPlanQuestions, extractPresentedPlan, extractiveSummary, fastForwardMainCheckoutIfSafe, fetchOriginForWorktree, fetchPrHead, finalizeParts, findAgentDoneCustomSoundPath, findConventionSetup, findInvalidCacheControlTtlOrder, findLastBrightsyContextSummary, findLiveThreadForCreate, findLiveThreadForCreateSource, findManagedAccount, findOrphanWorktrees, findProjectProfileKey, findRemoteCoordinator, findSlackCoordinator, findThreadByRef, findThreadForStackLayer, fireSchedule, flattenTurnInput, flipLinearRelationType, foldLegacyRolesIntoNotes, followUpBehavior, forkChatTab, forkMessageSlice, forkThreadWorktree, formatAccountProfilePlaybookLine, formatArtifactDirective, formatAskUserNotifyMessage, formatBrightsyFetchError, formatClaudeExtraUsageDetail, formatClaudeSubagentReminder, formatClaudeUsageCompact, formatClaudeUsageFetchedAt, formatClaudeUsageOverLimitConfirm, formatClaudeUsageOverLimitWait, formatClaudeUsageReset, formatClaudeUsageResetClock, formatClaudeUsageTooltip, formatCloudTurnReply, formatConnectedOrchestratorReminder, formatDetachedJobInvoke, formatDevAccessHint, formatFetchError, formatGhLandError, formatGitAuthModeDirective, formatInjectedNoticesForTurn, formatIpcInvokeError, formatIssueToolsDirective, formatIssueToolsReminder, formatLinearDirective, formatLinearReminder, formatLongRunningDirective, formatLongRunningReminder, formatMergePrError, formatMessagesAsTranscript, formatNotifyOrchestratorPrompt, formatOptionalServicesDirective, formatOptionalServicesDirectiveForTurn, formatOptionalServicesReminder, formatOptionalServicesReminderForTurn, formatPlanQuestionAnswers, formatPlanQuestionsForChat, formatPrGateDirective, formatProcessGuideDirective, formatProjectProfilePlaybookLines, formatRateLimitResetHint, formatRemotePrompt, formatRenameBranchDirective, formatScheduleWhen, formatScheduledPrompt, formatSlackExternalReplyPrompt, formatSlackInboundPrompt, formatSlackRepliesForTurn, formatSlackReplyContinuePrompt, formatSlackSignedReply, formatSlackTurnReply, formatSlackWorkingText, formatTranscriptMarkdown, formatUiReminder, formatViewerContextDirective, formatViewerContextReminder, formatWorkspaceInventory, formatWorkspaceProfileSuffix, formatWorktreeDirective, formatWorktreeReminder, forwardContextUsage, forwardOccupancyTokens, fromInclusiveInputUsage, getAbleTimeAccessToken, getAbleTimeHost, getAbleTimeOrientation, getAbleTimeTask, getAdapter, getAgentRpcServer, getAgentSetupInfo, getBrightsySession, getCaffeinateHold, getClaudePlanUsage, getDefaultAgent, getDefaultEffort, getDefaultFast, getDefaultModel, getDefaultRunScript, getDiff, getDiffSummary, getGitHubIssue, getGitHubStatus, getGithubGitAuthMode, getGithubPat, getHomeBoardInputs, getIssueSource, getLinearApiKey, getLinearAuthToken, getLinearIssue, getMcpUiHost, getOrchestrator, getPr, getPrChecks, getPrDetails, getPrForHeadBranch, getPrMeta, getPrStack, getRepoSetupInfo, getRunMode, getRunScript, getSchedule, getSlackWorkspace, getWorktreeDirtyStat, gh, ghHeadRef, ghPrCreateAssigneeArgs, ghRepoSelectArgs, git, gitBranchPrefixSetting, githubAgentGitEnv, githubHttpsInsteadOfEntries, githubProjectsOnIssue, githubRelationEditFlag, globalAgentCwd, groupHomeBoardWorktrees, handleRemoteInbound, handleSlackInbound, harnessEnvKey, hasBakedAbleTimeOAuth, hasBakedLinearOAuth, hasBakedSlackOAuth, hasConductorHook, hasConventionSetup, hasCursorWorktreeSetup, hasEnabledSchedules, hasRepoHook, hasWorkspaceHook, hasWorkspaceSettingsToml, headlessHostBlockedReason, healOrchestrationSoccerTitles, historyMaxCount, historyMaxDays, hottestClaudeWindow, httpFetch, importAgentDoneCustomSound, importConductorWorkspace, importConductorWorkspaceAsync, initPrStack, initStackFromThread, initializeGitRepository, inspectGitWorktree, installAgent, installNpmGlobalPackage, installOptionalServiceCli, interruptSlackCoordinatorForInbound, invalidateThreadListCache, invalidateThreadRecord, isAbleTimeConnected, isAbleTimeOAuthCancelled, isAbleTimeRejectedCredential, isAdoptableRunScriptRequest, isAgentDoneSound, isAskUserToolName, isBrightsyConnected, isBrightsyNdjsonLine, isChatTextScale, isClaudeAiConnectorMcp, isCloudCoordinatorThread, isCompactToolName, isConductorBundledCli, isContextCompactDone, isContextCompactInProgress, isCowboyThread, isCursorApiKeyConfigured, isCursorAutoModel, isCursorSdkInstalled, isDefaultishSourceRef, isDesktopHostAlive, isDirty, isGhPrBodyTooLongError, isGhRateLimitError, isGlobalRepoPath, isGlobalThread, isHistoryRetentionStub, isHomeBoardThread, isImageFilePath, isInPrStack, isInboundForThisDesktop, isIncompleteTaskState, isInjectedNoticeText, isInjectedOrchMcpName, isInternalAgentStatusText, isIssueSourceConnected, isLinearConnected, isLinearNoneToken, isLinearOAuthCancelled, isManagedAccountKind, isOptionalServiceId, isOrchestratorCapableAgent, isOrchestratorThread, isOtherWorktreeListenerCwd, isPidAlive, isPlaceholderBranch, isPlanQuestionAnswersMessage, isPollWrapperToolName, isPosthogConnected, isPrNotMergeableError, isPresentPlanToolName, isPrimaryCheckoutThread, isRemoteAccountLoginCancelled, isRemoteStopCommand, isRemovedWorkspace, isSelfWrittenRecord, isSessionQuotaLimit, isSetupLastError, isShellToolName, isSideboardScratchPath, isSkillToolName, isSlackCoordinatorThread, isSlackExternalReplyPrompt, isSlackOAuthCancelled, isStaleLastErrorDuringTurn, isSubagentToolName, isSystemStatusThinking, isTerminalTaskState, isThinkingEffort, isThisProcessDesktopHost, isThisWorktreeListenerCwd, isThreadCaffeinated, isThreadRecordFile, isUnclaimedRunScriptRequest, isUsageOnLimit, isWorkspaceScratchPath, issueAttachmentForAbleTimeTask, issueMatchesAssignee, issueSourceLabel, issueTicketFromThread, killDetachedRunTree, killListenersOnPorts, killStaleWorktreeListeners, killableListenerPids, lanRelayUrls, lastAgentReply, lastAssistantMessageText, lastRequestOccupancy, latestPendingPlanQuestions, linearAuthorizationHeader, linearCycleIsActive, linearGraphql, linearOAuthAuthorizeUrl, linearOAuthCredentials, linearRelationCreateInput, linearTicketIdFromThread, linkSharedDirectories, linkifyChatUrls, listAbleTimeAssignedIssues, listAbleTimeProjects, listAbleTimeTasks, listAgentSetupInfo, listBoardPins, listBranchCommits, listBranches, listBrightsyAccounts, listBrightsyChatTargets, listCodexModels, listConductorWorkspaces, listConnectedBrightsyTeams, listCursorModels, listGitHubIssueCommentsSince, listGitHubIssues, listGitHubProjects, listGlobalThreads, listIssues, listLinearAssignedIssues, listLinearCommentsSince, listLinearIssues, listLinearIssuesDirect, listLinearIssuesFiltered, listLinearProjects, listLinearTeamCycles, listLinearTeams, listModelsForAgent, listOpencodeModels, listPrs, listRunScripts, listSchedules, listSlackOutboundWatches, listSlackWorkspaces, listThreads, listWorkspaces, listWorktreeFiles, listWorktrees, listenerCwd, liveActivitySummary, loadAppSettings, loadBrightsyConfig, loadConductorSettings, loadHomeBoardInputs, loadRepoSettings, loadWorkspaceSettings, loadWorktreeRunPorts, localhostPreviewUrl, locksDir, loginAgent, loginEnvPrefix, loginManagedAccount, looksLikeComposerSkillExpansion, looksLikeConversationSummary, looksLikeIncompleteSkillDump, looksLikeSkillBody, lookupSoccerTeam, managedAccountConfigDir, mapAbleTimeTask, markPrReady, materializeSystemCaBundle, maxConcurrentAgents, maybeCompactContext, mcpAllowTools, mcpAllowToolsFromNames, mcpAuthWarnings, mcpServerIdForPermission, mcpServerPermissionUpdate, mcpStatusThinkingFromClaudeInit, mcpUiContentSecurityPolicy, mentionsPrGoal, mergeAgentGitAuthEnv, mergePr, mergePrStack, mergeSetupOutput, mergeSideboardIntoMcpServersJson, mergeUsage, messagePartParentId, messagesForCompactArchive, messagesSinceLastBrightsyContextSummary, mirrorHostConfig, moveQueuedItemToFront, needsCoordinatorAction, nextManagedAccount, nextPastedTextName, nextThinkingEffort, nonInteractiveGitProcessEnv, normalizeAbleTimeCredential, normalizeAbleTimeHost, normalizeBrightsyEndpoint, normalizeCodeSelection, normalizeLinearRelationType, normalizeManagedAccounts, normalizeParseResult, normalizeRemoteRelayUrl, normalizeReviewLabel, normalizeServiceOrigin, normalizeThinkingEffort, normalizeThread, normalizeTurnInput, normalizeWorkspaceTags, normalizeWorktreePath, notifyOrchestrator, npmGlobalNodeModules, npmGlobalPrefix, openInSystemTerminal, openPrStackLayers, openStackLayer, opencodeAdapter, optionalCliPresence, optionalServiceConnected, optionalServiceSpec, orchestrationQuotaFallbackAgent, orchestrationQuotaOnLimit, orchestrationTitleNeedsSoccerNickname, orchestratorSessionPoisonedByBuiltins, originFetchBranch, originGhRepoEnv, outboundReplyFromTurn, packagedDetachedJobPath, parseAbleTimeOAuthCallbackUrl, parseChatLink, parseClaudeUsagePayload, parseCursorRunnerLine, parseDevPreview, parseDurationMs, parseForceStopMessage, parseGhStackViewJson, parseGitHubIssueNumber, parseGithubSlugFromRemoteUrl, parseMcpList, parsePlanQuestionsInput, parsePrDetailsView, parseSessionQuotaResetAt, parseSlackRelayClientMessage, parseSlackRelayServerMessage, partsToAssistantText, pastedTextStats, patchReadAloudSettings, pendingInjectedNotices, pendingSlackExternalReplies, permissionMode, persistPendingFileAttachments, persistVaultKeyInKeychain, planFileAbs, planHistoryAgePurge, planHistoryRetention, planModeTurnInstruction, planQuestionsSignature, pnpmFilterPackage, pollSlackOutboundWatches, posixShellSingleQuote, preferredCursorCostCents, prepareTerminalCommand, prependQueuedItem, previewLand, previousCostBaseline, primaryCheckoutFromLinkedWorktree, promptMentionsBrightsy, pushBranch, readAgentDoneCustomSound, readAgentRuntimeMetadata, readExistingReviewRequestFile, readKeychainVaultKey, readPlanFile, readRunLog, readSetupLog, readSkillBody, readThread, readViewerContext, readWorktreeFile, readWorktreeFileForUpload, readWorktreeInclude, recordScheduleRun, recordSlackOutboundWatch, refreshBrightsyAccessToken, refreshGitHubAuth, registerBrightsyOAuthClient, registerPackagedUserMcpClients, releaseCaffeinateHoldForThread, releaseDesktopHost, remoteAccountHttpOrigin, remoteCoordinatorSourceRef, remoteRelayUrl, removeBoardPin, removeManagedAccount, removeQueuedItem, removeWorkspace, removeWorktree, renameManagedAccount, repoSlug, requestOccupancy, requestReview, requireAgent, reservePort, reservePortRange, resetGhStackDetectCache, resetGithubAgentTokenMemo, resolveAbleTimeOAuthHost, resolveAccountForThread, resolveAccountProfile, resolveAccountProfileFromSettings, resolveAgentExecutable, resolveAgentGitAuthEnv, resolveClaudeExecutable, resolveCodexGitWritableRoots, resolveCommandBinarySync, resolveConductorCursorAgentId, resolveCreateFirstPrompt, resolveCursorModelId, resolveCursorSdkRoot, resolveDefaultBranch, resolveDetachedJobScript, resolveDiffBaseRef, resolveEffectiveIssueSource, resolveFilesToCopy, resolveGhAuthToken, resolveGitBranchPrefix, resolveGitDirsForLockRecovery, resolveGitHubIssueRepo, resolveGithubAgentToken, resolveGithubRepoSlug, resolveLinearCycle, resolveLinearLabel, resolveLinearProject, resolveLinearState, resolveLinearTeam, resolveLoginCommand, resolveNewOrchestratorOptions, resolveNewThreadOptions, resolveOrchChildFollowUp, resolveOrchestratorDefaults, resolvePlanMarkdown, resolvePrSelector, resolvePrSelectors, resolveProjectReviewLabel, resolveQuotaFallbackAgent, resolveRepoRoot, resolveReviewGuidelines, resolveScheduleThreadId, resolveSendFollowUp, resolveSidebarGitPrompt, resolveSlackListenMode, resolveThreadDefaults, resolveThreadEffort, resolveUsageOnLimit, resolveVaultKey, resolveViewerProfile, resolveViewerProfileForRepo, resolveWorktreeStartPoint, reviewLabelForRepo, rewriteAbleTimeError, rewriteLinearError, run, runArchiveScript, runCloudConnect, runConventionSetup, runCursorWorktreeSetup, runRemoteHost, runScriptPreview, runSetupScript, runSlackListen, runSlackRelayClient, runWorkspaceSetup, sameWorkspacePath, sameWorktreePath, sanitizeGitBranchPrefix, sanitizeMcpServerName, sanitizeReadAloudVoiceURI, saveAbleTimeConnection, saveAppSettings, saveLinearOAuth, saveRemotePhoneToken, saveWorktreeRunPorts, scheduleNeedsCaffeinate, schedulesPath, scrubGithubTokensFromChildEnv, searchAbleTimeTasks, secureFileUnlocksWith, selectManagedAccount, setCaffeinateHold, setHttpFetchImpl, setStatus, setVaultMasterKey, settingsSourceLabel, shiftQueuedItem, shouldAttachPastedText, shouldCompactContext, shouldInjectBrightsyMcp, shouldNotifyOrchestrator, shouldRefreshReviewRequestTemplate, shouldRegisterPresentPlan, shouldRemoveWorktreeOnTeardown, shouldResetSessionForOccupancy, shouldRunHistoryCleanup, shouldRunWorktreeCleanup, shouldStampSetupLastError, showCostEnabled, sidebarParentSelectId, sidebarQuestionThreadId, sidebarRowAgentBlock, sideboardHomeDir, sideboardMcpProfile, sideboardReposDir, sideboardWorkspacesDir, skillCommandFromBody, skillCommandFromInput, skillNameFromFrontmatter, slackAppLevelToken, slackArchiveUrl, slackCoordinatorSourceRef, slackListenEnabled, slackOAuthCredentials, slackOAuthResultUrl, slackRelayUrl, sliceRunLogOutput, slimMessagesForUiList, slimThreadForUiList, slugify, spawnAgentTurn, splitForCompaction, splitTurnInputForSystemPrompt, stackAgentDefaultsFrom, stackIdFrom, stackMergeReadiness, stageAbsolutePathsAsAttachments, stageBuffersAsAttachments, startAbleTimeOAuth, startAgentRpcServer, startDevServer, startHeadlessHost, startLinearOAuth, startMcpServer, startOrchestration, startRelayServer, startRemoteAccountLogin, startSlackOAuth, statWorktreePath, stopAgentRpcServer, stripBrightsyNdjsonNoise, stripNestedElectronEnv, submitPrStack, suggestSlug, sumUsageList, summarizeConversation, switchBrightsyAccount, switchWorktreeBranch, syncWorkspacesFromThreads, systemConfigDir, takePendingTurnAttachments, takenTeamSlugsForChatTab, takenTeamSlugsForOrchestration, taskMessageText, taskUrl, thinkingEffortBars, thinkingEffortLabel, thisProcessShouldDrainAgentQueues, threadDisplayLabel, threadFilePath, threadHasCompactedContext, threadLivePath, threadLockPath, threadMayPresentPlan, threadRequestsBrightsyMcp, threadsDir, threadsSharingWorktree, ticketSlugForBranch, toAbleTimeIssueInfo, toGitHubIssueInfo, toPublicAppSettings, toolActivityLine, toolDescription, toolDetail, toolFilePath, totalTokens, trustSystemCertificates, tryReservePort, tryReservePorts, turnCostUsdFromCursorUsage, turnCostUsdFromProviderSnapshot, updateAbleTimeTask, updateAdvancedSettings, updateAgentExecutable, updateAppEnvironment, updateBrightsySettings, updateClaudeSettings, updateCodexSettings, updateDefaultsSettings, updateGitHubIssue, updateIntegrationsSettings, updateLinearIssue, updateOpencodeSettings, updateProjectProfileSettings, updateSchedule, updateThread, usageOnLimit, userClaudeMcpConfigPath, userCursorMcpConfigPath, userMcpNamesToDisable, validateLinearApiKey, verifyAbleTimeConnection, verifyOptionalService, visibleAgentBlock, visibleAssistantText, visibleToolRowDetail, waitForPidExit, warmGithubAgentAuth, whichOnPath, withAddedAccount, withEventParentId, withEventsParentId, withExportedPath, withMaxOldSpaceSize, withRemovedAccount, withSelectedAccount, withThreadLock, withTurnScopedCost, workspaceAgentChatSummaries, workspaceSettingsSourceLabel, workspaceTagTargetRef, workspaceTagsFromGroup, worktreeAgentBlock, worktreeBoardStatus, worktreeCleanupSettings, worktreeDisplayLabel, worktreeDisplayLabelForGroup, worktreeNameFromPath, worktreeRunPortsPath, worktreeSlugForTicket, worktreesRoot, wrapReviewSkillMarkdown, writeInjectedMcpConfig, writePlanFile, writeThread, writeViewerContext, writeWorktreeFile };

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 import { NetworkInterfaceInfo } from 'node:os';
 import { SpawnSyncOptionsWithStringEncoding } from 'node:child_process';
+import tls from 'node:tls';
 import { ResultPromise } from 'execa';
 import { EventEmitter } from 'node:events';
 
@@ -3539,10 +3540,10 @@ declare function installOptionalServiceCli(id: OptionalServiceId): Promise<Agent
  *
  * Electron main should call {@link setHttpFetchImpl} with `net.fetch` so
  * requests use Chromium's network stack (create-worktree issue picker).
- * Agent Linear tools run in a Node MCP process — call
- * `trustSystemCertificates` / `applySystemCaEnv` so undici trusts Keychain
- * CAs. Node's undici `fetch` otherwise fails behind corporate VPN/proxy as
- * an opaque `TypeError: fetch failed` or `UNABLE_TO_GET_ISSUER_CERT_LOCALLY`.
+ * Agent Linear tools run in a Node MCP process — call `bootstrapSystemCa`
+ * so undici trusts Keychain CAs. Node's undici `fetch` otherwise fails
+ * behind corporate VPN/proxy as an opaque `TypeError: fetch failed` or
+ * `UNABLE_TO_GET_ISSUER_CERT_LOCALLY`.
  */
 declare function setHttpFetchImpl(fetchImpl: typeof fetch | null): void;
 /**
@@ -3556,19 +3557,29 @@ declare function formatFetchError(err: unknown, url: string, opts?: {
 declare function httpFetch(input: string | URL, init?: RequestInit): Promise<Response>;
 
 /**
- * Trust OS / Keychain CAs in Node (undici `fetch`).
+ * Trust OS / Keychain CAs in Node (undici `fetch`, `ws`, `https`).
  *
  * Electron main Linear (create-worktree issue picker) uses `net.fetch` —
- * Chromium already reads the system store. Agent Linear tools run in a
- * real Node MCP process whose Mozilla bundle does not include corporate
- * VPN/proxy CAs, which surfaces as UNABLE_TO_GET_ISSUER_CERT_LOCALLY.
+ * Chromium already reads the system store. The phone relay WebSocket and
+ * agent Linear tools use Node TLS, whose Mozilla bundle does not include
+ * corporate VPN/proxy CAs (Zscaler), which surfaces as
+ * UNABLE_TO_GET_ISSUER_CERT_LOCALLY.
  *
  * Node 22.15+ can load the system store (`NODE_USE_SYSTEM_CA=1` /
- * `tls.getCACertificates('system')`). Older Node and some Keychain layouts
- * still need a PEM dump via `NODE_EXTRA_CA_CERTS`.
+ * `tls.getCACertificates('system')`). Electron 34 ships Node 20, where
+ * `NODE_EXTRA_CA_CERTS` is only read at process start and
+ * `setDefaultCACertificates` does not exist — so we dump Keychain PEMs
+ * and either pass them as `ca` or wrap `tls.createSecureContext`.
  */
 
 type EnvLike = NodeJS.ProcessEnv | Record<string, string | undefined>;
+type TlsSystemCa = {
+    getCACertificates?: (type?: 'default' | 'system' | 'bundled' | 'extra') => string[];
+    setDefaultCACertificates?: (certs: readonly (string | Buffer)[]) => void;
+    createSecureContext?: typeof tls.createSecureContext;
+    rootCertificates?: readonly string[];
+    __sideboardSystemCaPatched?: boolean;
+};
 type SystemCaSpawn = (file: string, args: readonly string[], options: SpawnSyncOptionsWithStringEncoding) => {
     status: number | null;
     stdout?: string;
@@ -3578,6 +3589,7 @@ type SystemCaIo = {
     spawn?: SystemCaSpawn;
     now?: () => number;
     appData?: () => string;
+    tls?: TlsSystemCa;
 };
 /**
  * Write (or reuse) a PEM bundle under app data. Returns the path when the
@@ -3588,9 +3600,15 @@ declare function materializeSystemCaBundle(io?: SystemCaIo): string | undefined;
 declare function applySystemCaEnv(env: EnvLike): void;
 /**
  * Expand this process's default TLS CAs with the OS store. Safe no-op on
- * Node builds that lack `tls.getCACertificates` / `setDefaultCACertificates`.
+ * Node builds that lack `tls.getCACertificates` / `setDefaultCACertificates`
+ * *and* have no extra PEMs to wrap into `createSecureContext`.
  */
 declare function trustSystemCertificates(io?: SystemCaIo): boolean;
+/**
+ * Dump OS CAs, export them for Node children, and trust them in this
+ * process. Safe to call more than once. Never throws.
+ */
+declare function bootstrapSystemCa(io?: SystemCaIo): void;
 
 /**
  * Turn payload for agent CLIs.
@@ -8681,4 +8699,4 @@ declare function pollSlackOutboundWatches(opts?: {
     now?: number;
 }): Promise<void>;
 
-export { ABLETIME_MCP_PATH, ABLETIME_MCP_PM_PATH, ABLETIME_OAUTH_CALLBACK_PATH, ABLETIME_OAUTH_CANCELLED, ABLETIME_OAUTH_LOCAL_CALLBACK, ABLETIME_OAUTH_PORT, ABLETIME_OAUTH_REDIRECT, ABLETIME_OAUTH_RESOURCE, ABLETIME_OAUTH_TOKEN_PREFIX, ABLETIME_ORG_KEY_PREFIX, ABLETIME_PAT_PREFIX, ABLETIME_PM_TOOL_NAMES, AGENT_DONE_CUSTOM_SOUND_EXTENSIONS, AGENT_DONE_CUSTOM_SOUND_MAX_BYTES, AGENT_DONE_SOUNDS, AGENT_GIT_ACTIONS, AGENT_RPC_NATIVE_ENV, AGENT_RPC_PROTOCOL_VERSION, AGENT_RUNNER_MAX_OLD_SPACE_MB, ATTACHMENTS_DIR, type AbleTimeAssignedIssuesResult, type AbleTimeComment, type AbleTimeCredentialKind, type AbleTimeMcpToolName, AbleTimeOAuthCancelledError, type AbleTimeOrientation, type AbleTimePmToolName, type AbleTimeProject, type AbleTimeTask, type AbleTimeTaskRelationInput, type AbleTimeViewer, type AccountProfile, type ActiveRun, type AddBoardPinInput, type AddStackLayerInput, type AdoptInput, type AdvancedAppSettings, type AgentAdapter, type AgentBlock, type AgentBlockSource, type AgentDoneCustomSoundPayload, type AgentDoneSound, type AgentEvent, type AgentGitAction, type AgentKind, type AgentModelCatalog, type AgentModelInfo, type AgentPermissionPrompt, type AgentRpcConnect, type AgentRuntimeMetadata, type AgentSetupActionResult, type AgentSetupInfo, type AgentSetupKind, type AgentStatus, type AgentTurnInput, type AnthropicCacheControl, type AppSettings, type ApplyIntoMainResult, type AskBlockSnapshot, type AttachCommand, type Autonomy, BAKED_ABLETIME_OAUTH_CLIENT_ID, BAKED_REMOTE_RELAY_URL, BAKED_SLACK_RELAY_URL, BASE_ALLOWED_TOOLS, BRIGHTSY_MCP_ALLOWED_TOOLS, BRIGHTSY_OAUTH_CLIENT_ID, BRIGHTSY_OAUTH_REDIRECT, BRIGHTSY_SUMMARIZE_CONTEXT_TOOL, BUNDLED_LONG_RUNNING_PATH, BUNDLED_SKILL_PREFIX, type BoardPin, type BranchInfo, type BrightsyAccount, type BrightsyChatTarget, type BrightsyChatTargets, type BrightsyCloudConnectAgent, type BrightsyHarnessSettings, type BrightsySession, BrightsySideboardApi, type BrightsyTeamTargets, CHARS_PER_CONTEXT_TOKEN, CHAT_LINK_PREFIX, CHAT_TEXT_SCALES, CHAT_TEXT_SCALE_DEFAULT, CLAUDE_CHROME_ALLOWED_TOOLS, CLAUDE_MODEL_CATALOG, CLAUDE_POSTHOG_CONNECTOR_ALLOWED_TOOLS, CLAUDE_PRINT_BG_WAIT_CEILING_MS, CLAUDE_SUMMARY_TIMEOUT_MS, CLI_DIR, CLOUD_COORDINATOR_BUSY_REPLY, CLOUD_COORDINATOR_CANCELED_REPLY, CLOUD_COORDINATOR_INPUT_REQUIRED_REPLY, CLOUD_COORDINATOR_STOPPED_REPLY, CLOUD_COORDINATOR_TIMEOUT_REPLY, CLOUD_ORCHESTRATOR_GOAL, CONTEXT_COMPACT_CHARS, CONTEXT_KEEP_RECENT_CHARS, CONTEXT_KEEP_RECENT_MESSAGES, CONTEXT_MIN_MESSAGES, CONTEXT_REVIEW_PATH, CONVENTION_SETUP_RELPATHS, COORDINATOR_TOOL_PLAYBOOK, CURSOR_SDK_INSTALL_HINT, type CaffeinateHoldState, type ChatTextScale, type ClaudeExtraUsage, type ClaudeHarnessSettings, type ClaudePlanUsage, type ClaudeUsageWindow, type ClaudeUsageWindowId, type CleanupOrphansResult, type CliAgentKind, type CliExecutableSettings, type CloudConnectAgent, type CloudConnectOptions, type CloudConnectStatus, type CodeLineRange, type CodeRefInput, type CompactResult, type CompactThresholds, type ComposerFileBuffer, type ConductorSettings, type ConductorWorkspace, type ConnectedBrightsyTeamInfo, type ConventionSetupFile, type CowboyThreadFields, type CreateChatTabInput, type CreateGlobalChatOpts, type CreateScheduledTaskInput, type CreateStackInput, type CreateThreadInput, type CreateWorktreeResult, type CursorAgentUsageSnapshot, type CursorModelInfo, type CursorSdkStreamMessage, type CursorTurnRequest, type CursorUsageCost, type CursorWorktreesConfig, DEFAULT_ABLETIME_HOST, DEFAULT_RUN_LOG_TAIL_CHARS, DEFAULT_WORKTREE_SORT, DETACHED_JOBS_DIR, type DefaultsAppSettings, type DefaultsSettingsPatch, type DevAccessRun, type DevPreview, type DevServerHandle, type DiffCommentInput, type DiffCommentLine, type DiffCommit, type DiffFile, type DiffResult, type DiffScope, type DiffScopeStat, EMPTY_MANAGED_ACCOUNTS, type EnsuredReviewGuidelines, type ExpandResult, FAMOUS_SOCCER_TEAMS, FOLLOW_UP_BEHAVIORS, type FastForwardMainResult, type FollowUpBehavior, type ForkChatTabInput, type ForkThreadWorktreeInput, type FormatGhLandErrorOptions, GITHUB_GIT_AUTH_MODES, GITHUB_PR_BODY_MAX_CHARS, GITHUB_PR_BODY_SAFE_CHARS, GLOBAL_WORKSPACE_ID, type GetDiffOptions, type GhStackStatus, type GitHubIssue, type GitHubIssueComment, type GitHubIssueRelationInput, type GitHubProject, type GitHubProjectRef, type GitHubStatus, type GitWorktreeStatus, type GithubGitAuthMode, HARNESS_ENV_KEYS, HISTORY_DISCARDED_TEXT, HISTORY_MAX_COUNT_DEFAULT, HISTORY_MAX_COUNT_MAX, HISTORY_MAX_COUNT_MIN, HISTORY_MAX_DAYS_DEFAULT, HISTORY_MAX_DAYS_MAX, HOME_BOARD_CACHE_TTL_MS, type HarnessId, type HistoryCleanupResult, type HistoryRetentionPlan, type HomeBoardLoaded, type HomeBoardRemoteData, IMPLIED_TICKET_RESOLVE_PROMPT, ISSUE_SOURCE_LABELS, type ImportedAgentDoneSound, type InitStackFromThreadInput, type IntegrationsSettings, type IpcApi, type IssueActivityComment, type IssueAssigneeFilter, type IssueCycleInfo, type IssueInfo, type IssueSource, LEGACY_ATTACHMENTS_DIR, LEGACY_DETACHED_JOBS_DIR, LEGACY_PLAN_FILE_REL, LEGACY_REVIEW_REQUEST_PATH, LEGACY_THREAD_LINK_PREFIX, LIGHT_RECONCILE_THROTTLE_MS, LINEAR_OAUTH_CANCELLED, LINEAR_OAUTH_PORT, LINEAR_OAUTH_REDIRECT, LINEAR_OAUTH_SCOPES, LIVE_TURN_SPAWN_GRACE_MS, LONG_RUNNING_SKILL_COMMAND, type LandPreview, type LandResult, type LinearAssignedIssuesResult, type LinearAssigneeFilter, type LinearComment, type LinearCycle, type LinearIssue, type LinearIssueAttachment, type LinearIssueComment, type LinearIssueRef, type LinearIssueRelation, type LinearIssueRelationInput, type LinearNamedRef, LinearOAuthCancelledError, type LinearProjectRef, type LinearTeam, type LinearTeamsResult, type LinearWorkflowState, type ListIssuesOptions, type ListIssuesResult, type ListPrsOptions, MAX_ANTHROPIC_CACHE_CONTROL_BLOCKS, type ManagedAccount, type ManagedAccountKind, type ManagedAccountsState, type McpServerStatus, type McpUiView, type MessagePart, type NextManagedAccount, type NotifyOrchestratorReason, type NotifyOrchestratorResult, OPTIONAL_SERVICES, OPTIONAL_SERVICE_IDS, ORCHESTRATOR_AGENT_KINDS, type OpenPrStackLayersInput, type OpenStackLayerInput, type OpenStackLayerResult, type OptionalCliPresence, type OptionalServiceCliStatus, type OptionalServiceId, type OptionalServiceSpec, type OrchestrationQuotaOnLimit, Orchestrator, type OrchestratorAgentKind, type OrchestratorDefaultsSettings, type OrchestratorEvent, type OrchestratorRuntime, type OrphanWorktree, type OutboundTurnCopy, type OutboundTurnSnapshot, PASTE_ATTACH_MIN_CHARS, PASTE_ATTACH_MIN_LINES, PLAN_FILE_NAME, PLAN_FILE_REL, PLAN_MODE_INSTRUCTION, PLAN_MODE_OFF_INSTRUCTION, PLAN_QUESTION_ANSWERS_PREFIX, PORT_RANGE_SIZE, PRESENT_PLAN_REQUIRES_PLAN_MODE, PRESENT_PLAN_TOOL_DESCRIPTION, PROFILE_NOTES_MAX, PR_DETAILS_JSON_FIELDS, type PathRefInput, type PendingPlanQuestions, type PlanQuestion, type PlanQuestionAnswer, type PlanQuestionOption, type PlanToolPartLike, type PortReservation, type PrActor, type PrCheckRun, type PrCommentInfo, type PrCommitInfo, type PrDetails, type PrInfo, type PrMeta, type PrReviewInfo, type PrStack, type PrStackLayer, type PresentedPlan, type ProjectProfileSettings, type PublicAppSettings, type PublicIntegrationsSettings, READ_ALOUD_RATE_DEFAULT, READ_ALOUD_RATE_MAX, READ_ALOUD_RATE_MIN, REMOTE_RELAY_PATH, REPO_REVIEW_NAME, REPO_REVIEW_PATH, REVIEW_LABEL_MAX, REVIEW_REQUEST_NAME, REVIEW_REQUEST_PATH, REVIEW_REQUEST_PREFILL, REVIEW_REQUEST_TEMPLATE, REVIEW_SKILL_NAME, REVIEW_SKILL_PATH, RUN_PORTS_REL, RUN_SCRIPT_DESKTOP_ADOPT_MS, type ReadAloudSettingsFields, type RelayAccountProvider, type RelayServerHandle, type RelayServerOptions, type RemoteAccountSession, type RemoteAskQuestion, type RemoteHostClientOptions, type RemoteHostHandle, type RemoteHostStatus, RemoteHub, type RemoteServerMessage, type RepoSettings, type RepoSetupInfo, type RequestReviewResult, type ReservePortRangeOpts, type ResolvedAccountProfile, type ResolvedReviewGuidelines, type ResolvedThreadDefaults, type ResolvedViewerProfile, type ReviewGuidelinesSource, type RunLogSnapshot, type RunMode, type RunScript, type RunScriptPreviewInput, type RunScriptRequest, SEED_FULL_TOOL_MESSAGES, SEED_MAX_CHARS, SESSION_RESET_OCCUPANCY_TOKENS, SIDEBOARD_FORCE_STOP, SIDEBOARD_MCP_ALLOWED_TOOLS, SIDEBOARD_MCP_PROFILE_ENV, SLACK_LISTEN_INPUT_REQUIRED_REPLY, SLACK_LISTEN_STOPPED_REPLY, SLACK_LISTEN_TIMEOUT_REPLY, SLACK_OAUTH_CANCELLED, SLACK_OAUTH_REDIRECT, SLACK_PROGRESS_DELAY_MS, SLACK_PROGRESS_EDIT_MS, SLACK_REPLY_FORMATTING, SLACK_SEEN_REACTION, STDERR_EVENT_MAX_CHARS, STDOUT_EVENT_MAX_CHARS, type ScheduleCreatedBy, type ScheduleWhen, type ScheduledTask, type ScriptHandle, type SessionSeedOptions, type SetupLogSnapshot, type SetupRunResult, type SidebarGitAction, type SideboardMcpProfile, type SkillInfo, type SlackInboundMessage, type SlackListenOptions, type SlackListenStatus, SlackOAuthCancelledError, type SlackOutboundReply, type SlackOutboundWatch, type SlackRelayClientMessage, type SlackRelayClientOptions, SlackRelayHub, type SlackRelayServerMessage, type SlackWorkspaceInfo, type SourceType, type SpawnTurnHandle, type SteerRequest, type SummarizeResult, THINKING_EFFORTS, THINKING_PART_MAX_CHARS, type TaskState, type TeamName, type ThinkingEffort, type Thread, type ThreadAttachment, type ThreadMessage, type ThreadOptionsPatch, type ThreadStatus, type TokenUsage, type ToolPartLike, type TranscriptToolDetail, type TurnCommand, USAGE_ON_LIMIT_VALUES, type UpdateScheduledTaskPatch, type UsageOnLimit, type UsageScope, type ViewerContextWriteResult, type ViewerProfile, WORKTREE_ABLETIME_MCP_TOOLS, WORKTREE_GITHUB_MCP_TOOLS, WORKTREE_LINEAR_MCP_TOOLS, WORKTREE_MCP_TOOLS, type Workspace, type WorkspaceInventoryEntry, type WorkspaceScriptEnvOpts, type WorkspaceTagMode, type WorktreeDirtyStat, type WorktreeListBadge, type WorktreeOpener, type WorktreeOpenerId, type WorktreeSortMode, type WorktreeStatKind, ableTimeCredentialKind, ableTimeDependencyTarget, ableTimeOAuthAuthorizeUrl, ableTimeOAuthBouncePage, ableTimeOAuthClientId, ableTimeOAuthLocalBounceUrl, ableTimeOAuthRedirectUri, ableTimeOAuthResource, ableTimeUsesRest, abletimeMcpRequest, abletimeMcpUrl, abletimeToolUsesPm, accountIdToPin, ackSlackInboundSeen, activeAccountId, activeRunPreview, addBoardPin, addManagedAccount, addPrStackLayer, addStackLayerFromThread, addWorkspace, adoptThread, agentDoneCustomSoundMime, agentDoneSound, agentDoneSoundsDir, agentGitPrompt, agentRpcConnectFromMetadata, alignQueueAttachments, allAdapters, allocatePort, allocatePortRange, allocateTeamName, allocateTeamSlug, annotateDevAccessRuns, answerToolPermission, appDataDir, appSettingsPath, appendCompactedMessages, appendIndexedGitConfig, appendMessage, appendQueuedItem, applyAgentEvent, applyAgentRunnerHeapEnv, applyAppEnvironment, applyCompaction, applyForwardOccupancy, applyGithubGitAuthEnv, applyManagedAccountEnv, applyPromptCacheTtlEnv, applySystemCaEnv, applyThreadIntoMain, applyTurnUsage, applyWorkspaceTags, archiveRemovedWorkspaceChats, archivesWithRemovedWorkspace, armSchedules, assertAbleTimeCredential, assertAbleTimeMcpCredential, assertOrchestratorCapableAgent, attachmentFromAbsolutePath, attachmentsFromBuffers, attachmentsFromWorktreePaths, attachmentsGitignoreBody, autoArchiveOnMergeEnabled, autoCleanupHistoryEnabled, autoCleanupOrphansEnabled, autoRenameBranchEnabled, autoRunAfterSetupEnabled, branchDisplayLabel, brightsyAccessTokenNeedsRefresh, brightsyAdapter, brightsyCloudConnectAgent, brightsyCloudConnectEnabled, brightsyConfigPath, brightsyInjectWorktreeMcpEnabled, brightsyMcpAllowedTools, brightsyMcpServerName, buildBrightsySessionSeed, buildCachedUserContent, buildClaudeStreamJsonUserMessage, buildCodeRefAttachment, buildDiffCommentAttachment, buildForkTranscriptAttachment, buildLinearIssueFilter, buildPastedTextAttachment, buildPathRefAttachment, buildReviewRequestAttachment, buildSessionSeed, buildWorkspaceScriptEnv, caffeinateHoldPath, caffeinateWhileCloudConnectEnabled, caffeinateWhileRunningEnabled, caffeinateWhileSchedulesEnabled, caffeinateWhileSlackListenEnabled, callAbleTimeTool, canReuseIdleWorktreeAgentForReview, canonicalizeRepoPath, captureLoginEnv, captureTurnBaseline, chatLinkUrl, chatTextScale, checkoutPrStackLayer, childEnvWithAppSettings, claimDesktopHost, clampGithubPrBody, clampHistoryMaxCount, clampHistoryMaxDays, clampReadAloudRate, classifyRunScriptPreview, classifyWorktreeColumn, classifyWorktreeListBadges, claudeAdapter, claudeChromeEnabled, claudeSubagentTurnReminder, claudeUsageOverLimitWindows, claudeUserSettingsPath, cleanupArchivedHistory, cleanupOrphanWorktrees, clearAgentDoneCustomSoundFile, clearBoardPins, clearHomeBoardCache, clearOptionalCliPresenceCache, clipAgentEventForPaint, clipThinkingForStore, cloneRepoIntoSideboard, closeMcpUiHost, codeRefRangeLabel, codexAdapter, codexSandboxWritableRootsArgs, codexUnattendedGitConfigArgs, coerceOrchestratorAgent, collectTakenTeamSlugs, commandLooksLikeElectron, commentAbleTimeTask, commentGitHubIssue, commentLinearIssue, commitAll, compactArchiveProse, compactPartsForSummaryMessage, compactSummaryPart, computeNextRunAt, conductorBundledBinDir, conductorDbPath, confirmClaudeUsageOverLimitEnabled, confirmLand, connectBrightsyTeam, connectOptionalService, connectSlackToken, connectedOptionalServices, connectedOrchestratorTurnReminder, connectedPrSelectors, consumeComposerAttachments, contextTokens, coordinatorSystemPrompt, coordinatorTurnReminder, copyConfiguredFiles, copyReadAloudFromUnknown, countCacheControlBlocks, countUnpushedVsOrigin, cowboyModeEnabled, createAbleTimePkce, createAbleTimeTask, createChatTab, createEmptyThread, createExistingBranchWorktree, createGitHubIssue, createGlobalChat, createLinearIssue, createLinearPkce, createOrUpdatePr, createPrStack, createSchedule, createThread, createThreadWorktree, currentBranch, cursorAdapter, cursorSdkMessageToEvents, decodeBrightsyTarget, defaultScheduleName, deleteBranchOnPurgeEnabled, deleteSchedule, deleteThreadRecord, deriveTaskState, desktopHostPidPath, detectAgents, detectGhStack, detectLocalMergeConflicts, detectOptionalServiceClis, disconnectAbleTimeConnection, disconnectBrightsyTeam, disconnectLinear, disconnectLinearConnection, disconnectOptionalService, disconnectRemoteAccount, disconnectSlackWorkspace, discoverSkills, downloadAbleTimeAttachment, downloadGitHubIssueAttachment, downloadLinearAttachment, dropCachedPrefixOnResume, emptyPublicIntegrations, emptyRunLog, emptySetupLog, encodeBrightsyTarget, endedOnAskUser, enrichPathWithNpmGlobalBin, enrichWorkspacesWithGithub, ensureAbleTimeAccessToken, ensureAbleTimeTask, ensureAgentPath, ensureBrightsyLocalConfigFresh, ensureBrightsyOAuthClientId, ensureCloudCoordinator, ensureConnectedBrightsyTeamTokens, ensureGhPreferOrigin, ensureGlobalCoordinatorCwd, ensureManagedAccountDir, ensureRemoteCoordinator, ensureRemoteHostCredentials, ensureReviewGuidelinesFile, ensureReviewRequestFile, ensureReviewSkillFile, ensureSlackCoordinator, ensureSlackDeviceIdentity, ensureWorkspace, estimateMessageChars, estimateOccupancyTokens, estimateThreadChars, examplePrefixedBranch, expandComposerPrompt, extractBrightsyContextSummary, extractGhErrorDetail, extractPendingPlanQuestions, extractPresentedPlan, extractiveSummary, fastForwardMainCheckoutIfSafe, fetchOriginForWorktree, fetchPrHead, finalizeParts, findAgentDoneCustomSoundPath, findConventionSetup, findInvalidCacheControlTtlOrder, findLastBrightsyContextSummary, findLiveThreadForCreate, findLiveThreadForCreateSource, findManagedAccount, findOrphanWorktrees, findProjectProfileKey, findRemoteCoordinator, findSlackCoordinator, findThreadByRef, findThreadForStackLayer, fireSchedule, flattenTurnInput, flipLinearRelationType, foldLegacyRolesIntoNotes, followUpBehavior, forkChatTab, forkMessageSlice, forkThreadWorktree, formatAccountProfilePlaybookLine, formatArtifactDirective, formatAskUserNotifyMessage, formatBrightsyFetchError, formatClaudeExtraUsageDetail, formatClaudeSubagentReminder, formatClaudeUsageCompact, formatClaudeUsageFetchedAt, formatClaudeUsageOverLimitConfirm, formatClaudeUsageOverLimitWait, formatClaudeUsageReset, formatClaudeUsageResetClock, formatClaudeUsageTooltip, formatCloudTurnReply, formatConnectedOrchestratorReminder, formatDetachedJobInvoke, formatDevAccessHint, formatFetchError, formatGhLandError, formatGitAuthModeDirective, formatInjectedNoticesForTurn, formatIpcInvokeError, formatIssueToolsDirective, formatIssueToolsReminder, formatLinearDirective, formatLinearReminder, formatLongRunningDirective, formatLongRunningReminder, formatMergePrError, formatMessagesAsTranscript, formatNotifyOrchestratorPrompt, formatOptionalServicesDirective, formatOptionalServicesDirectiveForTurn, formatOptionalServicesReminder, formatOptionalServicesReminderForTurn, formatPlanQuestionAnswers, formatPlanQuestionsForChat, formatPrGateDirective, formatProcessGuideDirective, formatProjectProfilePlaybookLines, formatRateLimitResetHint, formatRemotePrompt, formatRenameBranchDirective, formatScheduleWhen, formatScheduledPrompt, formatSlackExternalReplyPrompt, formatSlackInboundPrompt, formatSlackRepliesForTurn, formatSlackReplyContinuePrompt, formatSlackSignedReply, formatSlackTurnReply, formatSlackWorkingText, formatTranscriptMarkdown, formatUiReminder, formatViewerContextDirective, formatViewerContextReminder, formatWorkspaceInventory, formatWorkspaceProfileSuffix, formatWorktreeDirective, formatWorktreeReminder, forwardContextUsage, forwardOccupancyTokens, fromInclusiveInputUsage, getAbleTimeAccessToken, getAbleTimeHost, getAbleTimeOrientation, getAbleTimeTask, getAdapter, getAgentRpcServer, getAgentSetupInfo, getBrightsySession, getCaffeinateHold, getClaudePlanUsage, getDefaultAgent, getDefaultEffort, getDefaultFast, getDefaultModel, getDefaultRunScript, getDiff, getDiffSummary, getGitHubIssue, getGitHubStatus, getGithubGitAuthMode, getGithubPat, getHomeBoardInputs, getIssueSource, getLinearApiKey, getLinearAuthToken, getLinearIssue, getMcpUiHost, getOrchestrator, getPr, getPrChecks, getPrDetails, getPrForHeadBranch, getPrMeta, getPrStack, getRepoSetupInfo, getRunMode, getRunScript, getSchedule, getSlackWorkspace, getWorktreeDirtyStat, gh, ghHeadRef, ghPrCreateAssigneeArgs, ghRepoSelectArgs, git, gitBranchPrefixSetting, githubAgentGitEnv, githubHttpsInsteadOfEntries, githubProjectsOnIssue, githubRelationEditFlag, globalAgentCwd, groupHomeBoardWorktrees, handleRemoteInbound, handleSlackInbound, harnessEnvKey, hasBakedAbleTimeOAuth, hasBakedLinearOAuth, hasBakedSlackOAuth, hasConductorHook, hasConventionSetup, hasCursorWorktreeSetup, hasEnabledSchedules, hasRepoHook, hasWorkspaceHook, hasWorkspaceSettingsToml, headlessHostBlockedReason, healOrchestrationSoccerTitles, historyMaxCount, historyMaxDays, hottestClaudeWindow, httpFetch, importAgentDoneCustomSound, importConductorWorkspace, importConductorWorkspaceAsync, initPrStack, initStackFromThread, initializeGitRepository, inspectGitWorktree, installAgent, installNpmGlobalPackage, installOptionalServiceCli, interruptSlackCoordinatorForInbound, invalidateThreadListCache, invalidateThreadRecord, isAbleTimeConnected, isAbleTimeOAuthCancelled, isAbleTimeRejectedCredential, isAdoptableRunScriptRequest, isAgentDoneSound, isAskUserToolName, isBrightsyConnected, isBrightsyNdjsonLine, isChatTextScale, isClaudeAiConnectorMcp, isCloudCoordinatorThread, isCompactToolName, isConductorBundledCli, isContextCompactDone, isContextCompactInProgress, isCowboyThread, isCursorApiKeyConfigured, isCursorAutoModel, isCursorSdkInstalled, isDefaultishSourceRef, isDesktopHostAlive, isDirty, isGhPrBodyTooLongError, isGhRateLimitError, isGlobalRepoPath, isGlobalThread, isHistoryRetentionStub, isHomeBoardThread, isImageFilePath, isInPrStack, isInboundForThisDesktop, isIncompleteTaskState, isInjectedNoticeText, isInjectedOrchMcpName, isInternalAgentStatusText, isIssueSourceConnected, isLinearConnected, isLinearNoneToken, isLinearOAuthCancelled, isManagedAccountKind, isOptionalServiceId, isOrchestratorCapableAgent, isOrchestratorThread, isOtherWorktreeListenerCwd, isPidAlive, isPlaceholderBranch, isPlanQuestionAnswersMessage, isPollWrapperToolName, isPosthogConnected, isPrNotMergeableError, isPresentPlanToolName, isPrimaryCheckoutThread, isRemoteAccountLoginCancelled, isRemoteStopCommand, isRemovedWorkspace, isSelfWrittenRecord, isSessionQuotaLimit, isSetupLastError, isShellToolName, isSideboardScratchPath, isSkillToolName, isSlackCoordinatorThread, isSlackExternalReplyPrompt, isSlackOAuthCancelled, isStaleLastErrorDuringTurn, isSubagentToolName, isSystemStatusThinking, isTerminalTaskState, isThinkingEffort, isThisProcessDesktopHost, isThisWorktreeListenerCwd, isThreadCaffeinated, isThreadRecordFile, isUnclaimedRunScriptRequest, isUsageOnLimit, isWorkspaceScratchPath, issueAttachmentForAbleTimeTask, issueMatchesAssignee, issueSourceLabel, issueTicketFromThread, killDetachedRunTree, killListenersOnPorts, killStaleWorktreeListeners, killableListenerPids, lanRelayUrls, lastAgentReply, lastAssistantMessageText, lastRequestOccupancy, latestPendingPlanQuestions, linearAuthorizationHeader, linearCycleIsActive, linearGraphql, linearOAuthAuthorizeUrl, linearOAuthCredentials, linearRelationCreateInput, linearTicketIdFromThread, linkSharedDirectories, linkifyChatUrls, listAbleTimeAssignedIssues, listAbleTimeProjects, listAbleTimeTasks, listAgentSetupInfo, listBoardPins, listBranchCommits, listBranches, listBrightsyAccounts, listBrightsyChatTargets, listCodexModels, listConductorWorkspaces, listConnectedBrightsyTeams, listCursorModels, listGitHubIssueCommentsSince, listGitHubIssues, listGitHubProjects, listGlobalThreads, listIssues, listLinearAssignedIssues, listLinearCommentsSince, listLinearIssues, listLinearIssuesDirect, listLinearIssuesFiltered, listLinearProjects, listLinearTeamCycles, listLinearTeams, listModelsForAgent, listOpencodeModels, listPrs, listRunScripts, listSchedules, listSlackOutboundWatches, listSlackWorkspaces, listThreads, listWorkspaces, listWorktreeFiles, listWorktrees, listenerCwd, liveActivitySummary, loadAppSettings, loadBrightsyConfig, loadConductorSettings, loadHomeBoardInputs, loadRepoSettings, loadWorkspaceSettings, loadWorktreeRunPorts, localhostPreviewUrl, locksDir, loginAgent, loginEnvPrefix, loginManagedAccount, looksLikeComposerSkillExpansion, looksLikeConversationSummary, looksLikeIncompleteSkillDump, looksLikeSkillBody, lookupSoccerTeam, managedAccountConfigDir, mapAbleTimeTask, markPrReady, materializeSystemCaBundle, maxConcurrentAgents, maybeCompactContext, mcpAllowTools, mcpAllowToolsFromNames, mcpAuthWarnings, mcpServerIdForPermission, mcpServerPermissionUpdate, mcpStatusThinkingFromClaudeInit, mcpUiContentSecurityPolicy, mentionsPrGoal, mergeAgentGitAuthEnv, mergePr, mergePrStack, mergeSetupOutput, mergeSideboardIntoMcpServersJson, mergeUsage, messagePartParentId, messagesForCompactArchive, messagesSinceLastBrightsyContextSummary, mirrorHostConfig, moveQueuedItemToFront, needsCoordinatorAction, nextManagedAccount, nextPastedTextName, nextThinkingEffort, nonInteractiveGitProcessEnv, normalizeAbleTimeCredential, normalizeAbleTimeHost, normalizeBrightsyEndpoint, normalizeCodeSelection, normalizeLinearRelationType, normalizeManagedAccounts, normalizeParseResult, normalizeRemoteRelayUrl, normalizeReviewLabel, normalizeServiceOrigin, normalizeThinkingEffort, normalizeThread, normalizeTurnInput, normalizeWorkspaceTags, normalizeWorktreePath, notifyOrchestrator, npmGlobalNodeModules, npmGlobalPrefix, openInSystemTerminal, openPrStackLayers, openStackLayer, opencodeAdapter, optionalCliPresence, optionalServiceConnected, optionalServiceSpec, orchestrationQuotaFallbackAgent, orchestrationQuotaOnLimit, orchestrationTitleNeedsSoccerNickname, orchestratorSessionPoisonedByBuiltins, originFetchBranch, originGhRepoEnv, outboundReplyFromTurn, packagedDetachedJobPath, parseAbleTimeOAuthCallbackUrl, parseChatLink, parseClaudeUsagePayload, parseCursorRunnerLine, parseDevPreview, parseDurationMs, parseForceStopMessage, parseGhStackViewJson, parseGitHubIssueNumber, parseGithubSlugFromRemoteUrl, parseMcpList, parsePlanQuestionsInput, parsePrDetailsView, parseSessionQuotaResetAt, parseSlackRelayClientMessage, parseSlackRelayServerMessage, partsToAssistantText, pastedTextStats, patchReadAloudSettings, pendingInjectedNotices, pendingSlackExternalReplies, permissionMode, persistPendingFileAttachments, persistVaultKeyInKeychain, planFileAbs, planHistoryAgePurge, planHistoryRetention, planModeTurnInstruction, planQuestionsSignature, pnpmFilterPackage, pollSlackOutboundWatches, posixShellSingleQuote, preferredCursorCostCents, prepareTerminalCommand, prependQueuedItem, previewLand, previousCostBaseline, primaryCheckoutFromLinkedWorktree, promptMentionsBrightsy, pushBranch, readAgentDoneCustomSound, readAgentRuntimeMetadata, readExistingReviewRequestFile, readKeychainVaultKey, readPlanFile, readRunLog, readSetupLog, readSkillBody, readThread, readViewerContext, readWorktreeFile, readWorktreeFileForUpload, readWorktreeInclude, recordScheduleRun, recordSlackOutboundWatch, refreshBrightsyAccessToken, refreshGitHubAuth, registerBrightsyOAuthClient, registerPackagedUserMcpClients, releaseCaffeinateHoldForThread, releaseDesktopHost, remoteAccountHttpOrigin, remoteCoordinatorSourceRef, remoteRelayUrl, removeBoardPin, removeManagedAccount, removeQueuedItem, removeWorkspace, removeWorktree, renameManagedAccount, repoSlug, requestOccupancy, requestReview, requireAgent, reservePort, reservePortRange, resetGhStackDetectCache, resetGithubAgentTokenMemo, resolveAbleTimeOAuthHost, resolveAccountForThread, resolveAccountProfile, resolveAccountProfileFromSettings, resolveAgentExecutable, resolveAgentGitAuthEnv, resolveClaudeExecutable, resolveCodexGitWritableRoots, resolveCommandBinarySync, resolveConductorCursorAgentId, resolveCreateFirstPrompt, resolveCursorModelId, resolveCursorSdkRoot, resolveDefaultBranch, resolveDetachedJobScript, resolveDiffBaseRef, resolveEffectiveIssueSource, resolveFilesToCopy, resolveGhAuthToken, resolveGitBranchPrefix, resolveGitDirsForLockRecovery, resolveGitHubIssueRepo, resolveGithubAgentToken, resolveGithubRepoSlug, resolveLinearCycle, resolveLinearLabel, resolveLinearProject, resolveLinearState, resolveLinearTeam, resolveLoginCommand, resolveNewOrchestratorOptions, resolveNewThreadOptions, resolveOrchChildFollowUp, resolveOrchestratorDefaults, resolvePlanMarkdown, resolvePrSelector, resolvePrSelectors, resolveProjectReviewLabel, resolveQuotaFallbackAgent, resolveRepoRoot, resolveReviewGuidelines, resolveScheduleThreadId, resolveSendFollowUp, resolveSidebarGitPrompt, resolveSlackListenMode, resolveThreadDefaults, resolveThreadEffort, resolveUsageOnLimit, resolveVaultKey, resolveViewerProfile, resolveViewerProfileForRepo, resolveWorktreeStartPoint, reviewLabelForRepo, rewriteAbleTimeError, rewriteLinearError, run, runArchiveScript, runCloudConnect, runConventionSetup, runCursorWorktreeSetup, runRemoteHost, runScriptPreview, runSetupScript, runSlackListen, runSlackRelayClient, runWorkspaceSetup, sameWorkspacePath, sameWorktreePath, sanitizeGitBranchPrefix, sanitizeMcpServerName, sanitizeReadAloudVoiceURI, saveAbleTimeConnection, saveAppSettings, saveLinearOAuth, saveRemotePhoneToken, saveWorktreeRunPorts, scheduleNeedsCaffeinate, schedulesPath, scrubGithubTokensFromChildEnv, searchAbleTimeTasks, secureFileUnlocksWith, selectManagedAccount, setCaffeinateHold, setHttpFetchImpl, setStatus, setVaultMasterKey, settingsSourceLabel, shiftQueuedItem, shouldAttachPastedText, shouldCompactContext, shouldInjectBrightsyMcp, shouldNotifyOrchestrator, shouldRefreshReviewRequestTemplate, shouldRegisterPresentPlan, shouldRemoveWorktreeOnTeardown, shouldResetSessionForOccupancy, shouldRunHistoryCleanup, shouldRunWorktreeCleanup, shouldStampSetupLastError, showCostEnabled, sidebarParentSelectId, sidebarQuestionThreadId, sidebarRowAgentBlock, sideboardHomeDir, sideboardMcpProfile, sideboardReposDir, sideboardWorkspacesDir, skillCommandFromBody, skillCommandFromInput, skillNameFromFrontmatter, slackAppLevelToken, slackArchiveUrl, slackCoordinatorSourceRef, slackListenEnabled, slackOAuthCredentials, slackOAuthResultUrl, slackRelayUrl, sliceRunLogOutput, slimMessagesForUiList, slimThreadForUiList, slugify, spawnAgentTurn, splitForCompaction, splitTurnInputForSystemPrompt, stackAgentDefaultsFrom, stackIdFrom, stackMergeReadiness, stageAbsolutePathsAsAttachments, stageBuffersAsAttachments, startAbleTimeOAuth, startAgentRpcServer, startDevServer, startHeadlessHost, startLinearOAuth, startMcpServer, startOrchestration, startRelayServer, startRemoteAccountLogin, startSlackOAuth, statWorktreePath, stopAgentRpcServer, stripBrightsyNdjsonNoise, stripNestedElectronEnv, submitPrStack, suggestSlug, sumUsageList, summarizeConversation, switchBrightsyAccount, switchWorktreeBranch, syncWorkspacesFromThreads, systemConfigDir, takePendingTurnAttachments, takenTeamSlugsForChatTab, takenTeamSlugsForOrchestration, taskMessageText, taskUrl, thinkingEffortBars, thinkingEffortLabel, thisProcessShouldDrainAgentQueues, threadDisplayLabel, threadFilePath, threadHasCompactedContext, threadLivePath, threadLockPath, threadMayPresentPlan, threadRequestsBrightsyMcp, threadsDir, threadsSharingWorktree, ticketSlugForBranch, toAbleTimeIssueInfo, toGitHubIssueInfo, toPublicAppSettings, toolActivityLine, toolDescription, toolDetail, toolFilePath, totalTokens, trustSystemCertificates, tryReservePort, tryReservePorts, turnCostUsdFromCursorUsage, turnCostUsdFromProviderSnapshot, updateAbleTimeTask, updateAdvancedSettings, updateAgentExecutable, updateAppEnvironment, updateBrightsySettings, updateClaudeSettings, updateCodexSettings, updateDefaultsSettings, updateGitHubIssue, updateIntegrationsSettings, updateLinearIssue, updateOpencodeSettings, updateProjectProfileSettings, updateSchedule, updateThread, usageOnLimit, userClaudeMcpConfigPath, userCursorMcpConfigPath, userMcpNamesToDisable, validateLinearApiKey, verifyAbleTimeConnection, verifyOptionalService, visibleAgentBlock, visibleAssistantText, visibleToolRowDetail, waitForPidExit, warmGithubAgentAuth, whichOnPath, withAddedAccount, withEventParentId, withEventsParentId, withExportedPath, withMaxOldSpaceSize, withRemovedAccount, withSelectedAccount, withThreadLock, withTurnScopedCost, workspaceAgentChatSummaries, workspaceSettingsSourceLabel, workspaceTagTargetRef, workspaceTagsFromGroup, worktreeAgentBlock, worktreeBoardStatus, worktreeCleanupSettings, worktreeDisplayLabel, worktreeDisplayLabelForGroup, worktreeNameFromPath, worktreeRunPortsPath, worktreeSlugForTicket, worktreesRoot, wrapReviewSkillMarkdown, writeInjectedMcpConfig, writePlanFile, writeThread, writeViewerContext, writeWorktreeFile };
+export { ABLETIME_MCP_PATH, ABLETIME_MCP_PM_PATH, ABLETIME_OAUTH_CALLBACK_PATH, ABLETIME_OAUTH_CANCELLED, ABLETIME_OAUTH_LOCAL_CALLBACK, ABLETIME_OAUTH_PORT, ABLETIME_OAUTH_REDIRECT, ABLETIME_OAUTH_RESOURCE, ABLETIME_OAUTH_TOKEN_PREFIX, ABLETIME_ORG_KEY_PREFIX, ABLETIME_PAT_PREFIX, ABLETIME_PM_TOOL_NAMES, AGENT_DONE_CUSTOM_SOUND_EXTENSIONS, AGENT_DONE_CUSTOM_SOUND_MAX_BYTES, AGENT_DONE_SOUNDS, AGENT_GIT_ACTIONS, AGENT_RPC_NATIVE_ENV, AGENT_RPC_PROTOCOL_VERSION, AGENT_RUNNER_MAX_OLD_SPACE_MB, ATTACHMENTS_DIR, type AbleTimeAssignedIssuesResult, type AbleTimeComment, type AbleTimeCredentialKind, type AbleTimeMcpToolName, AbleTimeOAuthCancelledError, type AbleTimeOrientation, type AbleTimePmToolName, type AbleTimeProject, type AbleTimeTask, type AbleTimeTaskRelationInput, type AbleTimeViewer, type AccountProfile, type ActiveRun, type AddBoardPinInput, type AddStackLayerInput, type AdoptInput, type AdvancedAppSettings, type AgentAdapter, type AgentBlock, type AgentBlockSource, type AgentDoneCustomSoundPayload, type AgentDoneSound, type AgentEvent, type AgentGitAction, type AgentKind, type AgentModelCatalog, type AgentModelInfo, type AgentPermissionPrompt, type AgentRpcConnect, type AgentRuntimeMetadata, type AgentSetupActionResult, type AgentSetupInfo, type AgentSetupKind, type AgentStatus, type AgentTurnInput, type AnthropicCacheControl, type AppSettings, type ApplyIntoMainResult, type AskBlockSnapshot, type AttachCommand, type Autonomy, BAKED_ABLETIME_OAUTH_CLIENT_ID, BAKED_REMOTE_RELAY_URL, BAKED_SLACK_RELAY_URL, BASE_ALLOWED_TOOLS, BRIGHTSY_MCP_ALLOWED_TOOLS, BRIGHTSY_OAUTH_CLIENT_ID, BRIGHTSY_OAUTH_REDIRECT, BRIGHTSY_SUMMARIZE_CONTEXT_TOOL, BUNDLED_LONG_RUNNING_PATH, BUNDLED_SKILL_PREFIX, type BoardPin, type BranchInfo, type BrightsyAccount, type BrightsyChatTarget, type BrightsyChatTargets, type BrightsyCloudConnectAgent, type BrightsyHarnessSettings, type BrightsySession, BrightsySideboardApi, type BrightsyTeamTargets, CHARS_PER_CONTEXT_TOKEN, CHAT_LINK_PREFIX, CHAT_TEXT_SCALES, CHAT_TEXT_SCALE_DEFAULT, CLAUDE_CHROME_ALLOWED_TOOLS, CLAUDE_MODEL_CATALOG, CLAUDE_POSTHOG_CONNECTOR_ALLOWED_TOOLS, CLAUDE_PRINT_BG_WAIT_CEILING_MS, CLAUDE_SUMMARY_TIMEOUT_MS, CLI_DIR, CLOUD_COORDINATOR_BUSY_REPLY, CLOUD_COORDINATOR_CANCELED_REPLY, CLOUD_COORDINATOR_INPUT_REQUIRED_REPLY, CLOUD_COORDINATOR_STOPPED_REPLY, CLOUD_COORDINATOR_TIMEOUT_REPLY, CLOUD_ORCHESTRATOR_GOAL, CONTEXT_COMPACT_CHARS, CONTEXT_KEEP_RECENT_CHARS, CONTEXT_KEEP_RECENT_MESSAGES, CONTEXT_MIN_MESSAGES, CONTEXT_REVIEW_PATH, CONVENTION_SETUP_RELPATHS, COORDINATOR_TOOL_PLAYBOOK, CURSOR_SDK_INSTALL_HINT, type CaffeinateHoldState, type ChatTextScale, type ClaudeExtraUsage, type ClaudeHarnessSettings, type ClaudePlanUsage, type ClaudeUsageWindow, type ClaudeUsageWindowId, type CleanupOrphansResult, type CliAgentKind, type CliExecutableSettings, type CloudConnectAgent, type CloudConnectOptions, type CloudConnectStatus, type CodeLineRange, type CodeRefInput, type CompactResult, type CompactThresholds, type ComposerFileBuffer, type ConductorSettings, type ConductorWorkspace, type ConnectedBrightsyTeamInfo, type ConventionSetupFile, type CowboyThreadFields, type CreateChatTabInput, type CreateGlobalChatOpts, type CreateScheduledTaskInput, type CreateStackInput, type CreateThreadInput, type CreateWorktreeResult, type CursorAgentUsageSnapshot, type CursorModelInfo, type CursorSdkStreamMessage, type CursorTurnRequest, type CursorUsageCost, type CursorWorktreesConfig, DEFAULT_ABLETIME_HOST, DEFAULT_RUN_LOG_TAIL_CHARS, DEFAULT_WORKTREE_SORT, DETACHED_JOBS_DIR, type DefaultsAppSettings, type DefaultsSettingsPatch, type DevAccessRun, type DevPreview, type DevServerHandle, type DiffCommentInput, type DiffCommentLine, type DiffCommit, type DiffFile, type DiffResult, type DiffScope, type DiffScopeStat, EMPTY_MANAGED_ACCOUNTS, type EnsuredReviewGuidelines, type ExpandResult, FAMOUS_SOCCER_TEAMS, FOLLOW_UP_BEHAVIORS, type FastForwardMainResult, type FollowUpBehavior, type ForkChatTabInput, type ForkThreadWorktreeInput, type FormatGhLandErrorOptions, GITHUB_GIT_AUTH_MODES, GITHUB_PR_BODY_MAX_CHARS, GITHUB_PR_BODY_SAFE_CHARS, GLOBAL_WORKSPACE_ID, type GetDiffOptions, type GhStackStatus, type GitHubIssue, type GitHubIssueComment, type GitHubIssueRelationInput, type GitHubProject, type GitHubProjectRef, type GitHubStatus, type GitWorktreeStatus, type GithubGitAuthMode, HARNESS_ENV_KEYS, HISTORY_DISCARDED_TEXT, HISTORY_MAX_COUNT_DEFAULT, HISTORY_MAX_COUNT_MAX, HISTORY_MAX_COUNT_MIN, HISTORY_MAX_DAYS_DEFAULT, HISTORY_MAX_DAYS_MAX, HOME_BOARD_CACHE_TTL_MS, type HarnessId, type HistoryCleanupResult, type HistoryRetentionPlan, type HomeBoardLoaded, type HomeBoardRemoteData, IMPLIED_TICKET_RESOLVE_PROMPT, ISSUE_SOURCE_LABELS, type ImportedAgentDoneSound, type InitStackFromThreadInput, type IntegrationsSettings, type IpcApi, type IssueActivityComment, type IssueAssigneeFilter, type IssueCycleInfo, type IssueInfo, type IssueSource, LEGACY_ATTACHMENTS_DIR, LEGACY_DETACHED_JOBS_DIR, LEGACY_PLAN_FILE_REL, LEGACY_REVIEW_REQUEST_PATH, LEGACY_THREAD_LINK_PREFIX, LIGHT_RECONCILE_THROTTLE_MS, LINEAR_OAUTH_CANCELLED, LINEAR_OAUTH_PORT, LINEAR_OAUTH_REDIRECT, LINEAR_OAUTH_SCOPES, LIVE_TURN_SPAWN_GRACE_MS, LONG_RUNNING_SKILL_COMMAND, type LandPreview, type LandResult, type LinearAssignedIssuesResult, type LinearAssigneeFilter, type LinearComment, type LinearCycle, type LinearIssue, type LinearIssueAttachment, type LinearIssueComment, type LinearIssueRef, type LinearIssueRelation, type LinearIssueRelationInput, type LinearNamedRef, LinearOAuthCancelledError, type LinearProjectRef, type LinearTeam, type LinearTeamsResult, type LinearWorkflowState, type ListIssuesOptions, type ListIssuesResult, type ListPrsOptions, MAX_ANTHROPIC_CACHE_CONTROL_BLOCKS, type ManagedAccount, type ManagedAccountKind, type ManagedAccountsState, type McpServerStatus, type McpUiView, type MessagePart, type NextManagedAccount, type NotifyOrchestratorReason, type NotifyOrchestratorResult, OPTIONAL_SERVICES, OPTIONAL_SERVICE_IDS, ORCHESTRATOR_AGENT_KINDS, type OpenPrStackLayersInput, type OpenStackLayerInput, type OpenStackLayerResult, type OptionalCliPresence, type OptionalServiceCliStatus, type OptionalServiceId, type OptionalServiceSpec, type OrchestrationQuotaOnLimit, Orchestrator, type OrchestratorAgentKind, type OrchestratorDefaultsSettings, type OrchestratorEvent, type OrchestratorRuntime, type OrphanWorktree, type OutboundTurnCopy, type OutboundTurnSnapshot, PASTE_ATTACH_MIN_CHARS, PASTE_ATTACH_MIN_LINES, PLAN_FILE_NAME, PLAN_FILE_REL, PLAN_MODE_INSTRUCTION, PLAN_MODE_OFF_INSTRUCTION, PLAN_QUESTION_ANSWERS_PREFIX, PORT_RANGE_SIZE, PRESENT_PLAN_REQUIRES_PLAN_MODE, PRESENT_PLAN_TOOL_DESCRIPTION, PROFILE_NOTES_MAX, PR_DETAILS_JSON_FIELDS, type PathRefInput, type PendingPlanQuestions, type PlanQuestion, type PlanQuestionAnswer, type PlanQuestionOption, type PlanToolPartLike, type PortReservation, type PrActor, type PrCheckRun, type PrCommentInfo, type PrCommitInfo, type PrDetails, type PrInfo, type PrMeta, type PrReviewInfo, type PrStack, type PrStackLayer, type PresentedPlan, type ProjectProfileSettings, type PublicAppSettings, type PublicIntegrationsSettings, READ_ALOUD_RATE_DEFAULT, READ_ALOUD_RATE_MAX, READ_ALOUD_RATE_MIN, REMOTE_RELAY_PATH, REPO_REVIEW_NAME, REPO_REVIEW_PATH, REVIEW_LABEL_MAX, REVIEW_REQUEST_NAME, REVIEW_REQUEST_PATH, REVIEW_REQUEST_PREFILL, REVIEW_REQUEST_TEMPLATE, REVIEW_SKILL_NAME, REVIEW_SKILL_PATH, RUN_PORTS_REL, RUN_SCRIPT_DESKTOP_ADOPT_MS, type ReadAloudSettingsFields, type RelayAccountProvider, type RelayServerHandle, type RelayServerOptions, type RemoteAccountSession, type RemoteAskQuestion, type RemoteHostClientOptions, type RemoteHostHandle, type RemoteHostStatus, RemoteHub, type RemoteServerMessage, type RepoSettings, type RepoSetupInfo, type RequestReviewResult, type ReservePortRangeOpts, type ResolvedAccountProfile, type ResolvedReviewGuidelines, type ResolvedThreadDefaults, type ResolvedViewerProfile, type ReviewGuidelinesSource, type RunLogSnapshot, type RunMode, type RunScript, type RunScriptPreviewInput, type RunScriptRequest, SEED_FULL_TOOL_MESSAGES, SEED_MAX_CHARS, SESSION_RESET_OCCUPANCY_TOKENS, SIDEBOARD_FORCE_STOP, SIDEBOARD_MCP_ALLOWED_TOOLS, SIDEBOARD_MCP_PROFILE_ENV, SLACK_LISTEN_INPUT_REQUIRED_REPLY, SLACK_LISTEN_STOPPED_REPLY, SLACK_LISTEN_TIMEOUT_REPLY, SLACK_OAUTH_CANCELLED, SLACK_OAUTH_REDIRECT, SLACK_PROGRESS_DELAY_MS, SLACK_PROGRESS_EDIT_MS, SLACK_REPLY_FORMATTING, SLACK_SEEN_REACTION, STDERR_EVENT_MAX_CHARS, STDOUT_EVENT_MAX_CHARS, type ScheduleCreatedBy, type ScheduleWhen, type ScheduledTask, type ScriptHandle, type SessionSeedOptions, type SetupLogSnapshot, type SetupRunResult, type SidebarGitAction, type SideboardMcpProfile, type SkillInfo, type SlackInboundMessage, type SlackListenOptions, type SlackListenStatus, SlackOAuthCancelledError, type SlackOutboundReply, type SlackOutboundWatch, type SlackRelayClientMessage, type SlackRelayClientOptions, SlackRelayHub, type SlackRelayServerMessage, type SlackWorkspaceInfo, type SourceType, type SpawnTurnHandle, type SteerRequest, type SummarizeResult, THINKING_EFFORTS, THINKING_PART_MAX_CHARS, type TaskState, type TeamName, type ThinkingEffort, type Thread, type ThreadAttachment, type ThreadMessage, type ThreadOptionsPatch, type ThreadStatus, type TokenUsage, type ToolPartLike, type TranscriptToolDetail, type TurnCommand, USAGE_ON_LIMIT_VALUES, type UpdateScheduledTaskPatch, type UsageOnLimit, type UsageScope, type ViewerContextWriteResult, type ViewerProfile, WORKTREE_ABLETIME_MCP_TOOLS, WORKTREE_GITHUB_MCP_TOOLS, WORKTREE_LINEAR_MCP_TOOLS, WORKTREE_MCP_TOOLS, type Workspace, type WorkspaceInventoryEntry, type WorkspaceScriptEnvOpts, type WorkspaceTagMode, type WorktreeDirtyStat, type WorktreeListBadge, type WorktreeOpener, type WorktreeOpenerId, type WorktreeSortMode, type WorktreeStatKind, ableTimeCredentialKind, ableTimeDependencyTarget, ableTimeOAuthAuthorizeUrl, ableTimeOAuthBouncePage, ableTimeOAuthClientId, ableTimeOAuthLocalBounceUrl, ableTimeOAuthRedirectUri, ableTimeOAuthResource, ableTimeUsesRest, abletimeMcpRequest, abletimeMcpUrl, abletimeToolUsesPm, accountIdToPin, ackSlackInboundSeen, activeAccountId, activeRunPreview, addBoardPin, addManagedAccount, addPrStackLayer, addStackLayerFromThread, addWorkspace, adoptThread, agentDoneCustomSoundMime, agentDoneSound, agentDoneSoundsDir, agentGitPrompt, agentRpcConnectFromMetadata, alignQueueAttachments, allAdapters, allocatePort, allocatePortRange, allocateTeamName, allocateTeamSlug, annotateDevAccessRuns, answerToolPermission, appDataDir, appSettingsPath, appendCompactedMessages, appendIndexedGitConfig, appendMessage, appendQueuedItem, applyAgentEvent, applyAgentRunnerHeapEnv, applyAppEnvironment, applyCompaction, applyForwardOccupancy, applyGithubGitAuthEnv, applyManagedAccountEnv, applyPromptCacheTtlEnv, applySystemCaEnv, applyThreadIntoMain, applyTurnUsage, applyWorkspaceTags, archiveRemovedWorkspaceChats, archivesWithRemovedWorkspace, armSchedules, assertAbleTimeCredential, assertAbleTimeMcpCredential, assertOrchestratorCapableAgent, attachmentFromAbsolutePath, attachmentsFromBuffers, attachmentsFromWorktreePaths, attachmentsGitignoreBody, autoArchiveOnMergeEnabled, autoCleanupHistoryEnabled, autoCleanupOrphansEnabled, autoRenameBranchEnabled, autoRunAfterSetupEnabled, bootstrapSystemCa, branchDisplayLabel, brightsyAccessTokenNeedsRefresh, brightsyAdapter, brightsyCloudConnectAgent, brightsyCloudConnectEnabled, brightsyConfigPath, brightsyInjectWorktreeMcpEnabled, brightsyMcpAllowedTools, brightsyMcpServerName, buildBrightsySessionSeed, buildCachedUserContent, buildClaudeStreamJsonUserMessage, buildCodeRefAttachment, buildDiffCommentAttachment, buildForkTranscriptAttachment, buildLinearIssueFilter, buildPastedTextAttachment, buildPathRefAttachment, buildReviewRequestAttachment, buildSessionSeed, buildWorkspaceScriptEnv, caffeinateHoldPath, caffeinateWhileCloudConnectEnabled, caffeinateWhileRunningEnabled, caffeinateWhileSchedulesEnabled, caffeinateWhileSlackListenEnabled, callAbleTimeTool, canReuseIdleWorktreeAgentForReview, canonicalizeRepoPath, captureLoginEnv, captureTurnBaseline, chatLinkUrl, chatTextScale, checkoutPrStackLayer, childEnvWithAppSettings, claimDesktopHost, clampGithubPrBody, clampHistoryMaxCount, clampHistoryMaxDays, clampReadAloudRate, classifyRunScriptPreview, classifyWorktreeColumn, classifyWorktreeListBadges, claudeAdapter, claudeChromeEnabled, claudeSubagentTurnReminder, claudeUsageOverLimitWindows, claudeUserSettingsPath, cleanupArchivedHistory, cleanupOrphanWorktrees, clearAgentDoneCustomSoundFile, clearBoardPins, clearHomeBoardCache, clearOptionalCliPresenceCache, clipAgentEventForPaint, clipThinkingForStore, cloneRepoIntoSideboard, closeMcpUiHost, codeRefRangeLabel, codexAdapter, codexSandboxWritableRootsArgs, codexUnattendedGitConfigArgs, coerceOrchestratorAgent, collectTakenTeamSlugs, commandLooksLikeElectron, commentAbleTimeTask, commentGitHubIssue, commentLinearIssue, commitAll, compactArchiveProse, compactPartsForSummaryMessage, compactSummaryPart, computeNextRunAt, conductorBundledBinDir, conductorDbPath, confirmClaudeUsageOverLimitEnabled, confirmLand, connectBrightsyTeam, connectOptionalService, connectSlackToken, connectedOptionalServices, connectedOrchestratorTurnReminder, connectedPrSelectors, consumeComposerAttachments, contextTokens, coordinatorSystemPrompt, coordinatorTurnReminder, copyConfiguredFiles, copyReadAloudFromUnknown, countCacheControlBlocks, countUnpushedVsOrigin, cowboyModeEnabled, createAbleTimePkce, createAbleTimeTask, createChatTab, createEmptyThread, createExistingBranchWorktree, createGitHubIssue, createGlobalChat, createLinearIssue, createLinearPkce, createOrUpdatePr, createPrStack, createSchedule, createThread, createThreadWorktree, currentBranch, cursorAdapter, cursorSdkMessageToEvents, decodeBrightsyTarget, defaultScheduleName, deleteBranchOnPurgeEnabled, deleteSchedule, deleteThreadRecord, deriveTaskState, desktopHostPidPath, detectAgents, detectGhStack, detectLocalMergeConflicts, detectOptionalServiceClis, disconnectAbleTimeConnection, disconnectBrightsyTeam, disconnectLinear, disconnectLinearConnection, disconnectOptionalService, disconnectRemoteAccount, disconnectSlackWorkspace, discoverSkills, downloadAbleTimeAttachment, downloadGitHubIssueAttachment, downloadLinearAttachment, dropCachedPrefixOnResume, emptyPublicIntegrations, emptyRunLog, emptySetupLog, encodeBrightsyTarget, endedOnAskUser, enrichPathWithNpmGlobalBin, enrichWorkspacesWithGithub, ensureAbleTimeAccessToken, ensureAbleTimeTask, ensureAgentPath, ensureBrightsyLocalConfigFresh, ensureBrightsyOAuthClientId, ensureCloudCoordinator, ensureConnectedBrightsyTeamTokens, ensureGhPreferOrigin, ensureGlobalCoordinatorCwd, ensureManagedAccountDir, ensureRemoteCoordinator, ensureRemoteHostCredentials, ensureReviewGuidelinesFile, ensureReviewRequestFile, ensureReviewSkillFile, ensureSlackCoordinator, ensureSlackDeviceIdentity, ensureWorkspace, estimateMessageChars, estimateOccupancyTokens, estimateThreadChars, examplePrefixedBranch, expandComposerPrompt, extractBrightsyContextSummary, extractGhErrorDetail, extractPendingPlanQuestions, extractPresentedPlan, extractiveSummary, fastForwardMainCheckoutIfSafe, fetchOriginForWorktree, fetchPrHead, finalizeParts, findAgentDoneCustomSoundPath, findConventionSetup, findInvalidCacheControlTtlOrder, findLastBrightsyContextSummary, findLiveThreadForCreate, findLiveThreadForCreateSource, findManagedAccount, findOrphanWorktrees, findProjectProfileKey, findRemoteCoordinator, findSlackCoordinator, findThreadByRef, findThreadForStackLayer, fireSchedule, flattenTurnInput, flipLinearRelationType, foldLegacyRolesIntoNotes, followUpBehavior, forkChatTab, forkMessageSlice, forkThreadWorktree, formatAccountProfilePlaybookLine, formatArtifactDirective, formatAskUserNotifyMessage, formatBrightsyFetchError, formatClaudeExtraUsageDetail, formatClaudeSubagentReminder, formatClaudeUsageCompact, formatClaudeUsageFetchedAt, formatClaudeUsageOverLimitConfirm, formatClaudeUsageOverLimitWait, formatClaudeUsageReset, formatClaudeUsageResetClock, formatClaudeUsageTooltip, formatCloudTurnReply, formatConnectedOrchestratorReminder, formatDetachedJobInvoke, formatDevAccessHint, formatFetchError, formatGhLandError, formatGitAuthModeDirective, formatInjectedNoticesForTurn, formatIpcInvokeError, formatIssueToolsDirective, formatIssueToolsReminder, formatLinearDirective, formatLinearReminder, formatLongRunningDirective, formatLongRunningReminder, formatMergePrError, formatMessagesAsTranscript, formatNotifyOrchestratorPrompt, formatOptionalServicesDirective, formatOptionalServicesDirectiveForTurn, formatOptionalServicesReminder, formatOptionalServicesReminderForTurn, formatPlanQuestionAnswers, formatPlanQuestionsForChat, formatPrGateDirective, formatProcessGuideDirective, formatProjectProfilePlaybookLines, formatRateLimitResetHint, formatRemotePrompt, formatRenameBranchDirective, formatScheduleWhen, formatScheduledPrompt, formatSlackExternalReplyPrompt, formatSlackInboundPrompt, formatSlackRepliesForTurn, formatSlackReplyContinuePrompt, formatSlackSignedReply, formatSlackTurnReply, formatSlackWorkingText, formatTranscriptMarkdown, formatUiReminder, formatViewerContextDirective, formatViewerContextReminder, formatWorkspaceInventory, formatWorkspaceProfileSuffix, formatWorktreeDirective, formatWorktreeReminder, forwardContextUsage, forwardOccupancyTokens, fromInclusiveInputUsage, getAbleTimeAccessToken, getAbleTimeHost, getAbleTimeOrientation, getAbleTimeTask, getAdapter, getAgentRpcServer, getAgentSetupInfo, getBrightsySession, getCaffeinateHold, getClaudePlanUsage, getDefaultAgent, getDefaultEffort, getDefaultFast, getDefaultModel, getDefaultRunScript, getDiff, getDiffSummary, getGitHubIssue, getGitHubStatus, getGithubGitAuthMode, getGithubPat, getHomeBoardInputs, getIssueSource, getLinearApiKey, getLinearAuthToken, getLinearIssue, getMcpUiHost, getOrchestrator, getPr, getPrChecks, getPrDetails, getPrForHeadBranch, getPrMeta, getPrStack, getRepoSetupInfo, getRunMode, getRunScript, getSchedule, getSlackWorkspace, getWorktreeDirtyStat, gh, ghHeadRef, ghPrCreateAssigneeArgs, ghRepoSelectArgs, git, gitBranchPrefixSetting, githubAgentGitEnv, githubHttpsInsteadOfEntries, githubProjectsOnIssue, githubRelationEditFlag, globalAgentCwd, groupHomeBoardWorktrees, handleRemoteInbound, handleSlackInbound, harnessEnvKey, hasBakedAbleTimeOAuth, hasBakedLinearOAuth, hasBakedSlackOAuth, hasConductorHook, hasConventionSetup, hasCursorWorktreeSetup, hasEnabledSchedules, hasRepoHook, hasWorkspaceHook, hasWorkspaceSettingsToml, headlessHostBlockedReason, healOrchestrationSoccerTitles, historyMaxCount, historyMaxDays, hottestClaudeWindow, httpFetch, importAgentDoneCustomSound, importConductorWorkspace, importConductorWorkspaceAsync, initPrStack, initStackFromThread, initializeGitRepository, inspectGitWorktree, installAgent, installNpmGlobalPackage, installOptionalServiceCli, interruptSlackCoordinatorForInbound, invalidateThreadListCache, invalidateThreadRecord, isAbleTimeConnected, isAbleTimeOAuthCancelled, isAbleTimeRejectedCredential, isAdoptableRunScriptRequest, isAgentDoneSound, isAskUserToolName, isBrightsyConnected, isBrightsyNdjsonLine, isChatTextScale, isClaudeAiConnectorMcp, isCloudCoordinatorThread, isCompactToolName, isConductorBundledCli, isContextCompactDone, isContextCompactInProgress, isCowboyThread, isCursorApiKeyConfigured, isCursorAutoModel, isCursorSdkInstalled, isDefaultishSourceRef, isDesktopHostAlive, isDirty, isGhPrBodyTooLongError, isGhRateLimitError, isGlobalRepoPath, isGlobalThread, isHistoryRetentionStub, isHomeBoardThread, isImageFilePath, isInPrStack, isInboundForThisDesktop, isIncompleteTaskState, isInjectedNoticeText, isInjectedOrchMcpName, isInternalAgentStatusText, isIssueSourceConnected, isLinearConnected, isLinearNoneToken, isLinearOAuthCancelled, isManagedAccountKind, isOptionalServiceId, isOrchestratorCapableAgent, isOrchestratorThread, isOtherWorktreeListenerCwd, isPidAlive, isPlaceholderBranch, isPlanQuestionAnswersMessage, isPollWrapperToolName, isPosthogConnected, isPrNotMergeableError, isPresentPlanToolName, isPrimaryCheckoutThread, isRemoteAccountLoginCancelled, isRemoteStopCommand, isRemovedWorkspace, isSelfWrittenRecord, isSessionQuotaLimit, isSetupLastError, isShellToolName, isSideboardScratchPath, isSkillToolName, isSlackCoordinatorThread, isSlackExternalReplyPrompt, isSlackOAuthCancelled, isStaleLastErrorDuringTurn, isSubagentToolName, isSystemStatusThinking, isTerminalTaskState, isThinkingEffort, isThisProcessDesktopHost, isThisWorktreeListenerCwd, isThreadCaffeinated, isThreadRecordFile, isUnclaimedRunScriptRequest, isUsageOnLimit, isWorkspaceScratchPath, issueAttachmentForAbleTimeTask, issueMatchesAssignee, issueSourceLabel, issueTicketFromThread, killDetachedRunTree, killListenersOnPorts, killStaleWorktreeListeners, killableListenerPids, lanRelayUrls, lastAgentReply, lastAssistantMessageText, lastRequestOccupancy, latestPendingPlanQuestions, linearAuthorizationHeader, linearCycleIsActive, linearGraphql, linearOAuthAuthorizeUrl, linearOAuthCredentials, linearRelationCreateInput, linearTicketIdFromThread, linkSharedDirectories, linkifyChatUrls, listAbleTimeAssignedIssues, listAbleTimeProjects, listAbleTimeTasks, listAgentSetupInfo, listBoardPins, listBranchCommits, listBranches, listBrightsyAccounts, listBrightsyChatTargets, listCodexModels, listConductorWorkspaces, listConnectedBrightsyTeams, listCursorModels, listGitHubIssueCommentsSince, listGitHubIssues, listGitHubProjects, listGlobalThreads, listIssues, listLinearAssignedIssues, listLinearCommentsSince, listLinearIssues, listLinearIssuesDirect, listLinearIssuesFiltered, listLinearProjects, listLinearTeamCycles, listLinearTeams, listModelsForAgent, listOpencodeModels, listPrs, listRunScripts, listSchedules, listSlackOutboundWatches, listSlackWorkspaces, listThreads, listWorkspaces, listWorktreeFiles, listWorktrees, listenerCwd, liveActivitySummary, loadAppSettings, loadBrightsyConfig, loadConductorSettings, loadHomeBoardInputs, loadRepoSettings, loadWorkspaceSettings, loadWorktreeRunPorts, localhostPreviewUrl, locksDir, loginAgent, loginEnvPrefix, loginManagedAccount, looksLikeComposerSkillExpansion, looksLikeConversationSummary, looksLikeIncompleteSkillDump, looksLikeSkillBody, lookupSoccerTeam, managedAccountConfigDir, mapAbleTimeTask, markPrReady, materializeSystemCaBundle, maxConcurrentAgents, maybeCompactContext, mcpAllowTools, mcpAllowToolsFromNames, mcpAuthWarnings, mcpServerIdForPermission, mcpServerPermissionUpdate, mcpStatusThinkingFromClaudeInit, mcpUiContentSecurityPolicy, mentionsPrGoal, mergeAgentGitAuthEnv, mergePr, mergePrStack, mergeSetupOutput, mergeSideboardIntoMcpServersJson, mergeUsage, messagePartParentId, messagesForCompactArchive, messagesSinceLastBrightsyContextSummary, mirrorHostConfig, moveQueuedItemToFront, needsCoordinatorAction, nextManagedAccount, nextPastedTextName, nextThinkingEffort, nonInteractiveGitProcessEnv, normalizeAbleTimeCredential, normalizeAbleTimeHost, normalizeBrightsyEndpoint, normalizeCodeSelection, normalizeLinearRelationType, normalizeManagedAccounts, normalizeParseResult, normalizeRemoteRelayUrl, normalizeReviewLabel, normalizeServiceOrigin, normalizeThinkingEffort, normalizeThread, normalizeTurnInput, normalizeWorkspaceTags, normalizeWorktreePath, notifyOrchestrator, npmGlobalNodeModules, npmGlobalPrefix, openInSystemTerminal, openPrStackLayers, openStackLayer, opencodeAdapter, optionalCliPresence, optionalServiceConnected, optionalServiceSpec, orchestrationQuotaFallbackAgent, orchestrationQuotaOnLimit, orchestrationTitleNeedsSoccerNickname, orchestratorSessionPoisonedByBuiltins, originFetchBranch, originGhRepoEnv, outboundReplyFromTurn, packagedDetachedJobPath, parseAbleTimeOAuthCallbackUrl, parseChatLink, parseClaudeUsagePayload, parseCursorRunnerLine, parseDevPreview, parseDurationMs, parseForceStopMessage, parseGhStackViewJson, parseGitHubIssueNumber, parseGithubSlugFromRemoteUrl, parseMcpList, parsePlanQuestionsInput, parsePrDetailsView, parseSessionQuotaResetAt, parseSlackRelayClientMessage, parseSlackRelayServerMessage, partsToAssistantText, pastedTextStats, patchReadAloudSettings, pendingInjectedNotices, pendingSlackExternalReplies, permissionMode, persistPendingFileAttachments, persistVaultKeyInKeychain, planFileAbs, planHistoryAgePurge, planHistoryRetention, planModeTurnInstruction, planQuestionsSignature, pnpmFilterPackage, pollSlackOutboundWatches, posixShellSingleQuote, preferredCursorCostCents, prepareTerminalCommand, prependQueuedItem, previewLand, previousCostBaseline, primaryCheckoutFromLinkedWorktree, promptMentionsBrightsy, pushBranch, readAgentDoneCustomSound, readAgentRuntimeMetadata, readExistingReviewRequestFile, readKeychainVaultKey, readPlanFile, readRunLog, readSetupLog, readSkillBody, readThread, readViewerContext, readWorktreeFile, readWorktreeFileForUpload, readWorktreeInclude, recordScheduleRun, recordSlackOutboundWatch, refreshBrightsyAccessToken, refreshGitHubAuth, registerBrightsyOAuthClient, registerPackagedUserMcpClients, releaseCaffeinateHoldForThread, releaseDesktopHost, remoteAccountHttpOrigin, remoteCoordinatorSourceRef, remoteRelayUrl, removeBoardPin, removeManagedAccount, removeQueuedItem, removeWorkspace, removeWorktree, renameManagedAccount, repoSlug, requestOccupancy, requestReview, requireAgent, reservePort, reservePortRange, resetGhStackDetectCache, resetGithubAgentTokenMemo, resolveAbleTimeOAuthHost, resolveAccountForThread, resolveAccountProfile, resolveAccountProfileFromSettings, resolveAgentExecutable, resolveAgentGitAuthEnv, resolveClaudeExecutable, resolveCodexGitWritableRoots, resolveCommandBinarySync, resolveConductorCursorAgentId, resolveCreateFirstPrompt, resolveCursorModelId, resolveCursorSdkRoot, resolveDefaultBranch, resolveDetachedJobScript, resolveDiffBaseRef, resolveEffectiveIssueSource, resolveFilesToCopy, resolveGhAuthToken, resolveGitBranchPrefix, resolveGitDirsForLockRecovery, resolveGitHubIssueRepo, resolveGithubAgentToken, resolveGithubRepoSlug, resolveLinearCycle, resolveLinearLabel, resolveLinearProject, resolveLinearState, resolveLinearTeam, resolveLoginCommand, resolveNewOrchestratorOptions, resolveNewThreadOptions, resolveOrchChildFollowUp, resolveOrchestratorDefaults, resolvePlanMarkdown, resolvePrSelector, resolvePrSelectors, resolveProjectReviewLabel, resolveQuotaFallbackAgent, resolveRepoRoot, resolveReviewGuidelines, resolveScheduleThreadId, resolveSendFollowUp, resolveSidebarGitPrompt, resolveSlackListenMode, resolveThreadDefaults, resolveThreadEffort, resolveUsageOnLimit, resolveVaultKey, resolveViewerProfile, resolveViewerProfileForRepo, resolveWorktreeStartPoint, reviewLabelForRepo, rewriteAbleTimeError, rewriteLinearError, run, runArchiveScript, runCloudConnect, runConventionSetup, runCursorWorktreeSetup, runRemoteHost, runScriptPreview, runSetupScript, runSlackListen, runSlackRelayClient, runWorkspaceSetup, sameWorkspacePath, sameWorktreePath, sanitizeGitBranchPrefix, sanitizeMcpServerName, sanitizeReadAloudVoiceURI, saveAbleTimeConnection, saveAppSettings, saveLinearOAuth, saveRemotePhoneToken, saveWorktreeRunPorts, scheduleNeedsCaffeinate, schedulesPath, scrubGithubTokensFromChildEnv, searchAbleTimeTasks, secureFileUnlocksWith, selectManagedAccount, setCaffeinateHold, setHttpFetchImpl, setStatus, setVaultMasterKey, settingsSourceLabel, shiftQueuedItem, shouldAttachPastedText, shouldCompactContext, shouldInjectBrightsyMcp, shouldNotifyOrchestrator, shouldRefreshReviewRequestTemplate, shouldRegisterPresentPlan, shouldRemoveWorktreeOnTeardown, shouldResetSessionForOccupancy, shouldRunHistoryCleanup, shouldRunWorktreeCleanup, shouldStampSetupLastError, showCostEnabled, sidebarParentSelectId, sidebarQuestionThreadId, sidebarRowAgentBlock, sideboardHomeDir, sideboardMcpProfile, sideboardReposDir, sideboardWorkspacesDir, skillCommandFromBody, skillCommandFromInput, skillNameFromFrontmatter, slackAppLevelToken, slackArchiveUrl, slackCoordinatorSourceRef, slackListenEnabled, slackOAuthCredentials, slackOAuthResultUrl, slackRelayUrl, sliceRunLogOutput, slimMessagesForUiList, slimThreadForUiList, slugify, spawnAgentTurn, splitForCompaction, splitTurnInputForSystemPrompt, stackAgentDefaultsFrom, stackIdFrom, stackMergeReadiness, stageAbsolutePathsAsAttachments, stageBuffersAsAttachments, startAbleTimeOAuth, startAgentRpcServer, startDevServer, startHeadlessHost, startLinearOAuth, startMcpServer, startOrchestration, startRelayServer, startRemoteAccountLogin, startSlackOAuth, statWorktreePath, stopAgentRpcServer, stripBrightsyNdjsonNoise, stripNestedElectronEnv, submitPrStack, suggestSlug, sumUsageList, summarizeConversation, switchBrightsyAccount, switchWorktreeBranch, syncWorkspacesFromThreads, systemConfigDir, takePendingTurnAttachments, takenTeamSlugsForChatTab, takenTeamSlugsForOrchestration, taskMessageText, taskUrl, thinkingEffortBars, thinkingEffortLabel, thisProcessShouldDrainAgentQueues, threadDisplayLabel, threadFilePath, threadHasCompactedContext, threadLivePath, threadLockPath, threadMayPresentPlan, threadRequestsBrightsyMcp, threadsDir, threadsSharingWorktree, ticketSlugForBranch, toAbleTimeIssueInfo, toGitHubIssueInfo, toPublicAppSettings, toolActivityLine, toolDescription, toolDetail, toolFilePath, totalTokens, trustSystemCertificates, tryReservePort, tryReservePorts, turnCostUsdFromCursorUsage, turnCostUsdFromProviderSnapshot, updateAbleTimeTask, updateAdvancedSettings, updateAgentExecutable, updateAppEnvironment, updateBrightsySettings, updateClaudeSettings, updateCodexSettings, updateDefaultsSettings, updateGitHubIssue, updateIntegrationsSettings, updateLinearIssue, updateOpencodeSettings, updateProjectProfileSettings, updateSchedule, updateThread, usageOnLimit, userClaudeMcpConfigPath, userCursorMcpConfigPath, userMcpNamesToDisable, validateLinearApiKey, verifyAbleTimeConnection, verifyOptionalService, visibleAgentBlock, visibleAssistantText, visibleToolRowDetail, waitForPidExit, warmGithubAgentAuth, whichOnPath, withAddedAccount, withEventParentId, withEventsParentId, withExportedPath, withMaxOldSpaceSize, withRemovedAccount, withSelectedAccount, withThreadLock, withTurnScopedCost, workspaceAgentChatSummaries, workspaceSettingsSourceLabel, workspaceTagTargetRef, workspaceTagsFromGroup, worktreeAgentBlock, worktreeBoardStatus, worktreeCleanupSettings, worktreeDisplayLabel, worktreeDisplayLabelForGroup, worktreeNameFromPath, worktreeRunPortsPath, worktreeSlugForTicket, worktreesRoot, wrapReviewSkillMarkdown, writeInjectedMcpConfig, writePlanFile, writeThread, writeViewerContext, writeWorktreeFile };

package/dist/index.js

@@ -201,7 +201,7 @@ import {
   worktreeCleanupSettings,
   writeAgentBlock,
   writeWorktreeFile
-} from "./chunk-M6PAT6HG.js";
+} from "./chunk-IT6A4FZF.js";
 import {
   LEGACY_PLAN_FILE_REL,
   PLAN_FILE_NAME,
@@ -295,7 +295,7 @@ import {
   userMcpNamesToDisable,
   worktreeMcpToolNames,
   writeInjectedMcpConfig
-} from "./chunk-FMSLOWKR.js";
+} from "./chunk-4YBQBVYL.js";
 import {
   brightsyMcpServerName,
   connectBrightsyTeam,
@@ -790,16 +790,18 @@ import {
   CURSOR_SDK_INSTALL_HINT,
   applyAgentRunnerHeapEnv,
   applySystemCaEnv,
+  bootstrapSystemCa,
   cursorSdkMessageToEvents,
   isCursorSdkInstalled,
   materializeSystemCaBundle,
   parseCursorRunnerLine,
   preferredCursorCostCents,
   resolveCursorSdkRoot,
+  systemCaTlsOptions,
   trustSystemCertificates,
   turnCostUsdFromCursorUsage,
   withMaxOldSpaceSize
-} from "./chunk-UA3YKQ3D.js";
+} from "./chunk-Y3Y7SZBZ.js";
 import "./chunk-5XNT6BCG.js";
 import {
   ATTACHMENTS_DIR,
@@ -6354,6 +6356,14 @@ function startPhoneBoardSync(opts) {
 // src/remote/client.ts
 var BACKOFF_START_MS = 1e3;
 var BACKOFF_MAX_MS = 3e4;
+var RELAY_TLS_RE = /UNABLE_TO_GET_ISSUER|unable to get local issuer|SELF_SIGNED_CERT_IN_CHAIN/i;
+var RELAY_TLS_HINT = " \u2014 the TLS certificate was rejected. GitHub login can still work (browser Keychain trust); the relay socket uses Node TLS, which needs the corporate CA.";
+function formatRemoteHostError(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (message === "aborted") return message;
+  if (RELAY_TLS_RE.test(message)) return `${message}${RELAY_TLS_HINT}`;
+  return message;
+}
 function createRemoteKeepalive(opts) {
   let pongTimer = null;
   const arm = () => {
@@ -6450,7 +6460,7 @@ function runRemoteHost(opts) {
         backoff = BACKOFF_START_MS;
       } catch (err) {
         if (opts.signal?.aborted) return;
-        const message = err instanceof Error ? err.message : String(err);
+        const message = formatRemoteHostError(err);
         if (message !== "aborted") log(`remote error: ${message}`);
       }
       opts.onStatus?.({ connected: false, phoneConnected: false });
@@ -6468,7 +6478,10 @@ function runRemoteHost(opts) {
     const gen = ++connectionGen;
     stopBoardSync();
     setPhoneOpenChat(null);
-    const ws = new WsWebSocket(opts.url, { lookup: lookupPreferPublicDns });
+    const ws = new WsWebSocket(opts.url, {
+      lookup: lookupPreferPublicDns,
+      ...systemCaTlsOptions()
+    });
     socket = ws;
     let settled = false;
     const finish = (err) => {
@@ -8864,6 +8877,7 @@ async function startHeadlessHost(opts) {
   const blocked = headlessHostBlockedReason();
   if (blocked) return { ok: false, reason: blocked };
   claimDesktopHost();
+  bootstrapSystemCa();
   armSchedules();
   const ac = new AbortController();
   let stopped = false;
@@ -8891,7 +8905,7 @@ async function startHeadlessHost(opts) {
   };
   const refreshRunning = async () => {
     try {
-      const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-T76JRIIN.js");
+      const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-XFE3U3RP.js");
       agentsRunning = getOrchestrator2().getRuntime().running;
     } catch {
       agentsRunning = 0;
@@ -10823,7 +10837,7 @@ async function handleJobStop(params, _ctx) {
   return stopDetachedJob(jobCwd(rec), id, reason ? { reason } : void 0);
 }
 async function defaultTurnWait(ref, timeoutMs) {
-  const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-T76JRIIN.js");
+  const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-XFE3U3RP.js");
   const orch = getOrchestrator2();
   const thread = await orch.waitForTurn(ref, timeoutMs, {
     resolveIfStillRunning: true
@@ -13209,7 +13223,10 @@ async function runSlackRelayClient(opts) {
   const log = opts.onLog ?? (() => void 0);
   const Ws = opts.WebSocketImpl ? resolveWebSocket(opts.WebSocketImpl) : class {
     constructor(url2) {
-      return new WsWebSocket3(url2, { lookup: lookupPreferPublicDns });
+      return new WsWebSocket3(url2, {
+        lookup: lookupPreferPublicDns,
+        ...systemCaTlsOptions()
+      });
     }
   };
   const url = opts.url.trim();
@@ -14027,12 +14044,12 @@ function sleep2(ms, signal) {
     signal?.addEventListener("abort", onAbort, { once: true });
   });
 }
-var RELAY_TLS_HINT = " \u2014 the TLS certificate was rejected. A work proxy often does this when Sideboard is not allowlisted, or when the app does not trust the corporate CA.";
+var RELAY_TLS_HINT2 = " \u2014 the TLS certificate was rejected. A work proxy often does this when Sideboard is not allowlisted, or when the app does not trust the corporate CA.";
 var RELAY_NETWORK_HINT = " Sideboard could not reach the relay. On a work computer this is often a VPN, a proxy, or an allowlist that does not include Sideboard.";
 var RELAY_NETWORK_RE = /fetch failed|Failed to fetch|ENOTFOUND|ECONNREFUSED|ECONNRESET|ETIMEDOUT|EHOSTUNREACH|ENETUNREACH|EAI_AGAIN|EPERM|UND_ERR_|ERR_CONNECTION|ERR_NETWORK|ERR_PROXY|ERR_TUNNEL|ERR_INTERNET|ERR_BLOCKED|ERR_NAME_NOT_RESOLVED|ERR_ADDRESS_UNREACHABLE|ERR_CERT|CERT_|UNABLE_TO_GET_ISSUER|SELF_SIGNED/i;
 function relayFetchError(err, url) {
-  const formatted = formatFetchError(err, url, { tlsHint: RELAY_TLS_HINT });
-  if (formatted.includes(RELAY_TLS_HINT) || !RELAY_NETWORK_RE.test(formatted)) {
+  const formatted = formatFetchError(err, url, { tlsHint: RELAY_TLS_HINT2 });
+  if (formatted.includes(RELAY_TLS_HINT2) || !RELAY_NETWORK_RE.test(formatted)) {
     return new Error(formatted);
   }
   return new Error(`${formatted}${RELAY_NETWORK_HINT}`);
@@ -14196,7 +14213,7 @@ async function continueSourceThread(threadId, prompt) {
       await continueOnReply(threadId, prompt);
       return;
     }
-    const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-T76JRIIN.js");
+    const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-XFE3U3RP.js");
     await getOrchestrator2().send(threadId, prompt);
   } catch {
   }
@@ -14672,6 +14689,7 @@ export {
   autoCleanupOrphansEnabled,
   autoRenameBranchEnabled,
   autoRunAfterSetupEnabled,
+  bootstrapSystemCa,
   branchDisplayLabel,
   brightsyAccessTokenNeedsRefresh,
   brightsyAdapter,

package/dist/mcp/run-stdio.cjs

@@ -732,31 +732,55 @@ function applySystemCaEnv(env) {
   const inherited = process.env.NODE_EXTRA_CA_CERTS?.trim();
   if (inherited) env[NODE_EXTRA_CA_CERTS] = inherited;
 }
-function extraCertsFromBundle() {
+function extraCertsFromBundle(io = {}) {
   const path = process.env.NODE_EXTRA_CA_CERTS?.trim();
   if (path) return splitPemCertificates(readExistingFile(path));
-  const dest = systemCaBundlePath();
-  return splitPemCertificates(readExistingFile(dest));
+  return splitPemCertificates(readExistingFile(systemCaBundlePath(io)));
+}
+function extraSystemCaPems(io = {}) {
+  const fromBundle = extraCertsFromBundle(io);
+  if (fromBundle.length > 0) return fromBundle;
+  return splitPemCertificates(collectSystemCaPem(io));
+}
+function mergeSystemCaIntoTlsOptions(options, extra, roots = import_node_tls.default.rootCertificates) {
+  const existing = options?.ca;
+  const base = existing == null ? [...roots] : Array.isArray(existing) ? [...existing] : [existing];
+  return { ...options, ca: [...base, ...extra] };
+}
+function installCreateSecureContextCaPatch(api, extra) {
+  if (api.__sideboardSystemCaPatched) return true;
+  if (typeof api.createSecureContext !== "function") return false;
+  const orig = api.createSecureContext;
+  const roots = api.rootCertificates ?? import_node_tls.default.rootCertificates;
+  api.createSecureContext = ((options) => orig(mergeSystemCaIntoTlsOptions(options, extra, roots)));
+  api.__sideboardSystemCaPatched = true;
+  return true;
 }
 function trustSystemCertificates(io = {}) {
   try {
-    const api = import_node_tls.default;
-    if (typeof api.getCACertificates !== "function" || typeof api.setDefaultCACertificates !== "function") {
-      return false;
-    }
-    const current = api.getCACertificates("default");
-    const system = api.getCACertificates("system");
-    let extra = extraCertsFromBundle();
-    if (system.length === 0 && extra.length === 0) {
-      extra = splitPemCertificates(collectSystemCaPem(io));
+    const extra = extraSystemCaPems(io);
+    const api = io.tls ?? import_node_tls.default;
+    if (typeof api.getCACertificates === "function" && typeof api.setDefaultCACertificates === "function") {
+      const current = api.getCACertificates("default");
+      const system = api.getCACertificates("system");
+      if (system.length === 0 && extra.length === 0) return false;
+      api.setDefaultCACertificates([...current, ...system, ...extra]);
+      return true;
     }
-    if (system.length === 0 && extra.length === 0) return false;
-    api.setDefaultCACertificates([...current, ...system, ...extra]);
-    return true;
+    if (extra.length === 0) return false;
+    return installCreateSecureContextCaPatch(api, extra);
   } catch {
     return false;
   }
 }
+function bootstrapSystemCa(io = {}) {
+  const systemCaBundle = materializeSystemCaBundle(io);
+  if (systemCaBundle && !process.env.NODE_EXTRA_CA_CERTS?.trim()) {
+    process.env.NODE_EXTRA_CA_CERTS = systemCaBundle;
+  }
+  applySystemCaEnv(process.env);
+  trustSystemCertificates(io);
+}
 var import_node_child_process, import_node_fs6, import_node_path7, import_node_tls, NODE_USE_SYSTEM_CA, NODE_EXTRA_CA_CERTS, BUNDLE_NAME, BUNDLE_MAX_AGE_MS, LINUX_CA_FILES, PEM_CERT_RE;
 var init_system_ca = __esm({
   "src/http/system-ca.ts"() {
@@ -34515,12 +34539,7 @@ async function startMcpServer() {
 
 // src/mcp/run-stdio.ts
 dropNestedElectronEnvFromProcess();
-var systemCaBundle = materializeSystemCaBundle();
-if (systemCaBundle && !process.env.NODE_EXTRA_CA_CERTS?.trim()) {
-  process.env.NODE_EXTRA_CA_CERTS = systemCaBundle;
-}
-applySystemCaEnv(process.env);
-trustSystemCertificates();
+bootstrapSystemCa();
 startMcpServer().catch((err) => {
   console.error(err);
   process.exitCode = 1;

package/dist/mcp/run-stdio.js

@@ -56,7 +56,7 @@ import {
   updateSchedule,
   workspaceTagTargetRef,
   writeAgentBlock
-} from "../chunk-OU5V56OI.js";
+} from "../chunk-JXOW5JAW.js";
 import "../chunk-LX5R5JOR.js";
 import {
   commentAbleTimeTask,
@@ -91,15 +91,13 @@ import {
 import "../chunk-DC3VZXMA.js";
 import {
   SIDEBOARD_THREAD_ID_ENV,
-  applySystemCaEnv,
+  bootstrapSystemCa,
   isCursorApiKeyConfigured,
   listModelsForAgent,
-  materializeSystemCaBundle,
   shouldRegisterMcpWaitForTurn,
   sideboardMcpProfile,
-  trustSystemCertificates,
   worktreeMcpToolNames
-} from "../chunk-VXI7FFGO.js";
+} from "../chunk-GQJOLTZU.js";
 import "../chunk-EGTCXNQM.js";
 import "../chunk-42JGPPVS.js";
 import "../chunk-PXMLMBMI.js";
@@ -5246,12 +5244,7 @@ async function startMcpServer() {
 
 // src/mcp/run-stdio.ts
 dropNestedElectronEnvFromProcess();
-var systemCaBundle = materializeSystemCaBundle();
-if (systemCaBundle && !process.env.NODE_EXTRA_CA_CERTS?.trim()) {
-  process.env.NODE_EXTRA_CA_CERTS = systemCaBundle;
-}
-applySystemCaEnv(process.env);
-trustSystemCertificates();
+bootstrapSystemCa();
 startMcpServer().catch((err) => {
   console.error(err);
   process.exitCode = 1;

package/dist/{orchestrator-4OIMDLIR.js → orchestrator-7374OI7T.js}

@@ -11,12 +11,12 @@ import {
   resolveSendFollowUp,
   startOrchestration,
   waitForPidExit
-} from "./chunk-OU5V56OI.js";
+} from "./chunk-JXOW5JAW.js";
 import "./chunk-LX5R5JOR.js";
 import "./chunk-62ESCTJ4.js";
 import "./chunk-4GK32AYX.js";
 import "./chunk-DC3VZXMA.js";
-import "./chunk-VXI7FFGO.js";
+import "./chunk-GQJOLTZU.js";
 import "./chunk-EGTCXNQM.js";
 import "./chunk-42JGPPVS.js";
 import "./chunk-PXMLMBMI.js";

package/dist/{orchestrator-T76JRIIN.js → orchestrator-XFE3U3RP.js}

@@ -9,9 +9,9 @@ import {
   resolveSendFollowUp,
   startOrchestration,
   waitForPidExit
-} from "./chunk-M6PAT6HG.js";
+} from "./chunk-IT6A4FZF.js";
 import "./chunk-PGPSIEMW.js";
-import "./chunk-FMSLOWKR.js";
+import "./chunk-4YBQBVYL.js";
 import "./chunk-VEVFHO6K.js";
 import "./chunk-VBVSJUM2.js";
 import "./chunk-7Q327QF2.js";
@@ -26,7 +26,7 @@ import "./chunk-33KDPEK4.js";
 import "./chunk-JAT3JFOS.js";
 import "./chunk-F2PVRF3B.js";
 import "./chunk-AXQ4ZWHK.js";
-import "./chunk-UA3YKQ3D.js";
+import "./chunk-Y3Y7SZBZ.js";
 import "./chunk-5XNT6BCG.js";
 import "./chunk-6K64FJDD.js";
 import "./chunk-LG6RJBIY.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sideboard-ai/core",
-  "version": "0.1.309",
+  "version": "0.1.310",
   "description": "Sideboard core — orchestration, agents, git worktrees, MCP server",
   "license": "Apache-2.0",
   "type": "module",