@sideboard-ai/core 0.1.323 → 0.1.325

package/dist/{chunk-D3VSKNVA.js → chunk-MFMDZAA6.js}

@@ -4,21 +4,24 @@ import {
   ensureCliTeamTracked,
   ensureConnectedBrightsyTeamTokens
 } from "./chunk-S5CJUIPY.js";
+import {
+  listAssignedLinearIssues
+} from "./chunk-PPTJMBUY.js";
 import {
   looksLikeConversationSummary,
   looksLikeSkillBody,
   skillCommandFromBody,
   withEventParentId
-} from "./chunk-QIC2JXHW.js";
+} from "./chunk-OOXRMTU6.js";
 import {
   isOrchestratorThread
-} from "./chunk-6W3XRKD5.js";
+} from "./chunk-APKUI4BP.js";
 import {
   codexUnattendedGitConfigArgs,
   mergeAgentGitAuthEnv,
   resolveAgentGitAuthEnv,
   resolveCodexGitWritableRoots
-} from "./chunk-FUFNMUNR.js";
+} from "./chunk-BTF3ATST.js";
 import {
   loadBrightsyConfig
 } from "./chunk-RSA47QYR.js";
@@ -45,13 +48,13 @@ import {
   packagedMcpStdioPath,
   parseCursorRunnerLine,
   resolveNodeLaunch
-} from "./chunk-ZHGMRBSC.js";
+} from "./chunk-U5WO6MEB.js";
 import {
   extractJsonErrorMessage,
   formatUnknownDetail,
   looksLikeAgentFailureMessage,
   looksLikeBrightsyEmptyCompletion
-} from "./chunk-5XNT6BCG.js";
+} from "./chunk-OPXEJJBM.js";
 import {
   githubAgentAuthReady,
   run
@@ -66,7 +69,7 @@ import {
   PILOT_TOOL_DESCRIPTIONS,
   PILOT_TOOL_NAMES,
   agentRpcConnectFromMetadata
-} from "./chunk-YDUHLWI5.js";
+} from "./chunk-SUZOPJZC.js";
 import {
   claudeChromeEnabled,
   fromInclusiveInputUsage,
@@ -76,7 +79,7 @@ import {
   loadAppSettings,
   resolveAgentExecutable,
   resolveClaudeExecutable
-} from "./chunk-EJ66LEKH.js";
+} from "./chunk-RZJTGBXY.js";
 import {
   isElectronLikeCommand,
   unwrapStrippedElectronLaunch
@@ -514,6 +517,7 @@ var brightsyAdapter = {
 
 // src/agents/claude.ts
 import { existsSync as existsSync7 } from "fs";
+import { dirname as dirname4 } from "path";
 
 // src/agents/claude-mcp-status.ts
 var SIDEBOARD_CONNECTOR_SERVICES = [
@@ -630,7 +634,7 @@ function isNotableMcpInitStatus(server, sideboardOk, coverage) {
 
 // src/mcp-ui/host.ts
 import { createHash } from "crypto";
-import { homedir as homedir4 } from "os";
+import { homedir as homedir5 } from "os";
 
 // src/agents/orch-mcp-isolation.ts
 import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
@@ -987,20 +991,20 @@ function readJson(path) {
 }
 
 // src/agents/orch-mcp-isolation.ts
-import { homedir as homedir3 } from "os";
-import { join as join4 } from "path";
+import { homedir as homedir4 } from "os";
+import { join as join5 } from "path";
 import { parse as parseToml } from "smol-toml";
 
 // src/agents/user-mcp-config.ts
-import { existsSync as existsSync4, mkdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join3 } from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname2, join as join4 } from "path";
 
 // src/agents/injected-mcp.ts
-import { existsSync as existsSync3, mkdtempSync, writeFileSync } from "fs";
+import { existsSync as existsSync3, mkdtempSync, writeFileSync as writeFileSync2 } from "fs";
 import { createRequire } from "module";
 import { tmpdir } from "os";
-import { dirname, join as join2 } from "path";
+import { dirname, join as join3 } from "path";
 import { fileURLToPath } from "url";
 
 // src/mcp/profile.ts
@@ -1095,6 +1099,44 @@ function sideboardMcpProfile(env = process.env) {
   return env[SIDEBOARD_MCP_PROFILE_ENV]?.trim().toLowerCase() === "worktree" ? "worktree" : "orchestration";
 }
 
+// src/agents/codex-mcp-profile.ts
+import { randomBytes } from "crypto";
+import { mkdirSync, writeFileSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+function isCodexSecretEnvKey(key) {
+  return /token|secret|password|credential|oauth|api_key|_key$/i.test(key);
+}
+function tomlBasicString(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r")}"`;
+}
+function secretEnv(env) {
+  if (!env) return void 0;
+  const out = { ...env };
+  delete out.ELECTRON_RUN_AS_NODE;
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+function writeCodexMcpSecretProfile(servers) {
+  const blocks = [];
+  for (const s of servers) {
+    const env = secretEnv(s.env);
+    if (!env) continue;
+    const secrets = Object.entries(env).filter(([key]) => isCodexSecretEnvKey(key));
+    if (secrets.length === 0) continue;
+    const lines = [`[mcp_servers.${s.name}.env]`];
+    for (const [key, value] of secrets) lines.push(`${key} = ${tomlBasicString(value)}`);
+    blocks.push(lines.join("\n"));
+  }
+  if (blocks.length === 0) return null;
+  const home = process.env.CODEX_HOME?.trim() || join2(homedir2(), ".codex");
+  mkdirSync(home, { recursive: true, mode: 448 });
+  const profile = `sideboard-${randomBytes(8).toString("hex")}`;
+  const file = join2(home, `${profile}.config.toml`);
+  writeFileSync(file, `${blocks.join("\n\n")}
+`, { mode: 384 });
+  return { profile, file };
+}
+
 // src/agents/injected-mcp.ts
 var SIDEBOARD_MCP_ALLOWED_TOOLS = [
   "mcp__sideboard",
@@ -1234,7 +1276,7 @@ function corePackageDir() {
   } catch {
   }
   try {
-    const req = createRequire(join2(process.cwd(), "package.json"));
+    const req = createRequire(join3(process.cwd(), "package.json"));
     return dirname(req.resolve("@sideboard-ai/core"));
   } catch {
     return process.cwd();
@@ -1248,13 +1290,13 @@ function findSideboardMcpJsEntry() {
   let dir = corePackageDir();
   for (let i = 0; i < 10; i++) {
     const candidates = [
-      join2(dir, "mcp/run-stdio.js"),
-      join2(dir, "mcp/run-stdio.cjs"),
-      join2(dir, "dist/mcp/run-stdio.js"),
-      join2(dir, "dist/mcp/run-stdio.cjs"),
-      join2(dir, "packages/core/dist/mcp/run-stdio.js"),
-      join2(dir, "packages/cli/dist/index.js"),
-      join2(dir, "cli/dist/index.js")
+      join3(dir, "mcp/run-stdio.js"),
+      join3(dir, "mcp/run-stdio.cjs"),
+      join3(dir, "dist/mcp/run-stdio.js"),
+      join3(dir, "dist/mcp/run-stdio.cjs"),
+      join3(dir, "packages/core/dist/mcp/run-stdio.js"),
+      join3(dir, "packages/cli/dist/index.js"),
+      join3(dir, "cli/dist/index.js")
     ];
     for (const p of candidates) {
       if (existsSync3(p) && !isAsarPath(p)) return p;
@@ -1362,6 +1404,7 @@ function toCodexMcpConfigArgs(servers) {
     const env = mcpSpawnEnv(s.env);
     if (env) {
       for (const [key, value] of Object.entries(env)) {
+        if (isCodexSecretEnvKey(key)) continue;
         args.push("-c", `${prefix}.env.${key}=${JSON.stringify(value)}`);
       }
     }
@@ -1420,9 +1463,9 @@ function mcpServersRecord(servers, extraServers) {
 function writeMcpServersConfig(servers, extraServers) {
   const mcpServers = mcpServersRecord(servers, extraServers);
   if (Object.keys(mcpServers).length === 0) return null;
-  const dir = mkdtempSync(join2(tmpdir(), "sideboard-mcp-"));
-  const cfgPath = join2(dir, "mcp.json");
-  writeFileSync(cfgPath, JSON.stringify({ mcpServers }, null, 2));
+  const dir = mkdtempSync(join3(tmpdir(), "sideboard-mcp-"));
+  const cfgPath = join3(dir, "mcp.json");
+  writeFileSync2(cfgPath, JSON.stringify({ mcpServers }, null, 2), { mode: 384 });
   return cfgPath;
 }
 async function writeInjectedMcpConfig(opts) {
@@ -1431,10 +1474,10 @@ async function writeInjectedMcpConfig(opts) {
 
 // src/agents/user-mcp-config.ts
 function userCursorMcpConfigPath() {
-  return join3(homedir2(), ".cursor", "mcp.json");
+  return join4(homedir3(), ".cursor", "mcp.json");
 }
 function userClaudeMcpConfigPath() {
-  return join3(homedir2(), ".claude.json");
+  return join4(homedir3(), ".claude.json");
 }
 function asObject(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return {};
@@ -1469,8 +1512,8 @@ function writeMergedMcpServersJson(configPath, sideboard) {
     }
   }
   const next = mergeSideboardIntoMcpServersJson(existing, sideboard);
-  mkdirSync(dirname2(configPath), { recursive: true });
-  writeFileSync2(configPath, `${JSON.stringify(next, null, 2)}
+  mkdirSync2(dirname2(configPath), { recursive: true });
+  writeFileSync3(configPath, `${JSON.stringify(next, null, 2)}
 `);
 }
 function launchFromResolved(server) {
@@ -1529,13 +1572,19 @@ function readText(path) {
     return "";
   }
 }
-function userCodexConfigPaths(home = homedir3()) {
-  return [join4(home, ".codex", "config.toml"), join4(home, ".config", "codex", "config.toml")];
+function userCodexConfigPaths(home = homedir4()) {
+  const paths = [
+    join5(home, ".codex", "config.toml"),
+    join5(home, ".config", "codex", "config.toml")
+  ];
+  const codexHome = process.env.CODEX_HOME?.trim();
+  if (codexHome) paths.unshift(join5(codexHome, "config.toml"));
+  return paths;
 }
-function userOpencodeConfigPaths(home = homedir3()) {
+function userOpencodeConfigPaths(home = homedir4()) {
   return [
-    join4(home, ".config", "opencode", "opencode.json"),
-    join4(home, ".config", "opencode", "opencode.jsonc")
+    join5(home, ".config", "opencode", "opencode.json"),
+    join5(home, ".config", "opencode", "opencode.jsonc")
   ];
 }
 function userMcpNamesToDisable(opts) {
@@ -1554,7 +1603,7 @@ function userMcpNamesToDisable(opts) {
   }
   return out;
 }
-function listUserCodexMcpNames(home = homedir3()) {
+function listUserCodexMcpNames(home = homedir4()) {
   const names = [];
   for (const path of userCodexConfigPaths(home)) {
     if (!existsSync5(path)) continue;
@@ -1562,7 +1611,7 @@ function listUserCodexMcpNames(home = homedir3()) {
   }
   return names;
 }
-function listUserOpencodeMcpNames(home = homedir3()) {
+function listUserOpencodeMcpNames(home = homedir4()) {
   const names = [];
   for (const path of userOpencodeConfigPaths(home)) {
     if (!existsSync5(path)) continue;
@@ -1570,12 +1619,12 @@ function listUserOpencodeMcpNames(home = homedir3()) {
   }
   return names;
 }
-function userClaudeMcpConfigObject(home = homedir3()) {
-  const claudePath = home === homedir3() ? userClaudeMcpConfigPath() : join4(home, ".claude.json");
+function userClaudeMcpConfigObject(home = homedir4()) {
+  const claudePath = home === homedir4() ? userClaudeMcpConfigPath() : join5(home, ".claude.json");
   if (!existsSync5(claudePath)) return {};
   return asObject2(asObject2(readJsonObject(claudePath)).mcpServers);
 }
-function listUserClaudeMcpServerEntries(home = homedir3(), projectDirs) {
+function listUserClaudeMcpServerEntries(home = homedir4(), projectDirs) {
   const out = {};
   for (const [name, entry] of Object.entries(
     listEnabledClaudePluginMcpServers({ home, projectDirs })
@@ -1613,7 +1662,7 @@ function toCodexUnattendedAppsArgs() {
 }
 
 // src/mcp-ui/proxy-http.ts
-import { randomBytes, randomUUID } from "crypto";
+import { randomBytes as randomBytes2, randomUUID } from "crypto";
 import { createServer } from "http";
 import { Server as Server2 } from "@modelcontextprotocol/sdk/server/index.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
@@ -1710,7 +1759,7 @@ function listedTool(tool) {
 
 // src/mcp-ui/proxy-http.ts
 async function listenMcpUiProxy(opts) {
-  const token = randomBytes(24).toString("hex");
+  const token = randomBytes2(24).toString("hex");
   const transports = /* @__PURE__ */ new Map();
   const httpServer = createServer((req, res) => {
     void handle(req, res);
@@ -2083,7 +2132,7 @@ var singleton;
 function getMcpUiHost() {
   if (!singleton) {
     singleton = new McpUiHost({
-      entries: (projectDirs) => listUserClaudeMcpServerEntries(homedir4(), projectDirs)
+      entries: (projectDirs) => listUserClaudeMcpServerEntries(homedir5(), projectDirs)
     });
   }
   return singleton;
@@ -2091,7 +2140,7 @@ function getMcpUiHost() {
 async function proxyClaudeUserMcp(orchestrator, projectDirs) {
   if (orchestrator) return {};
   const dirs = projectDirs.filter((d) => typeof d === "string" && d.length > 0);
-  return getMcpUiHost().proxyEntries(listUserClaudeMcpServerEntries(homedir4(), dirs), dirs);
+  return getMcpUiHost().proxyEntries(listUserClaudeMcpServerEntries(homedir5(), dirs), dirs);
 }
 function closeMcpUiHost() {
   const host = singleton;
@@ -2110,16 +2159,6 @@ function planModeTurnInstruction(planMode) {
   return planMode ? PLAN_MODE_INSTRUCTION : PLAN_MODE_OFF_INSTRUCTION;
 }
 function permissionMode(thread) {
-  if (thread.sourceType === "orchestration") {
-    return {
-      claude: "acceptEdits",
-      opencodePermission: JSON.stringify({
-        edit: "allow",
-        bash: { "*": "allow", "rm -rf *": "deny" }
-      }),
-      codexSandbox: "danger-full-access"
-    };
-  }
   if (thread.planMode) {
     return {
       claude: "plan",
@@ -2131,6 +2170,18 @@ function permissionMode(thread) {
       codexSandbox: "read-only"
     };
   }
+  if (thread.sourceType === "orchestration") {
+    return {
+      claude: "acceptEdits",
+      // Unattended coordinators cannot answer permission prompts. Explicit
+      // allows override the user's OpenCode denies for this process only.
+      opencodePermission: JSON.stringify({
+        edit: "allow",
+        bash: { "*": "allow" }
+      }),
+      codexSandbox: "danger-full-access"
+    };
+  }
   if (thread.autonomy === "full") {
     return {
       claude: "bypassPermissions",
@@ -2140,10 +2191,7 @@ function permissionMode(thread) {
   }
   return {
     claude: "acceptEdits",
-    opencodePermission: JSON.stringify({
-      edit: "allow",
-      bash: { "*": "allow", "rm -rf *": "deny" }
-    }),
+    opencodePermission: JSON.stringify({}),
     codexSandbox: "workspace-write"
   };
 }
@@ -2164,7 +2212,7 @@ function agentRpcChildEnv(rpc, cwd) {
 // src/agents/claude-host.ts
 import { existsSync as existsSync6 } from "fs";
 import { createRequire as createRequire2 } from "module";
-import { dirname as dirname3, join as join5 } from "path";
+import { dirname as dirname3, join as join6 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function claudePilotSdkAllowedTools() {
   return PILOT_TOOL_NAMES.map(
@@ -2192,17 +2240,17 @@ function entryDir() {
 function claudeRunnerPath() {
   const packagedDir = packagedCursorRuntimeDir();
   if (packagedDir) {
-    const packaged = join5(packagedDir, "core-dist", "agents", "claude-runner.js");
+    const packaged = join6(packagedDir, "core-dist", "agents", "claude-runner.js");
     if (existsSync6(packaged)) return packaged;
   }
   const root = entryDir();
   const candidates = [
-    join5(root, "agents", "claude-runner.js"),
-    join5(root, "agents", "claude-runner.cjs"),
-    join5(root, "dist", "agents", "claude-runner.js"),
-    join5(root, "dist", "agents", "claude-runner.cjs"),
-    join5(root, "claude-runner.ts"),
-    join5(root, "src", "agents", "claude-runner.ts")
+    join6(root, "agents", "claude-runner.js"),
+    join6(root, "agents", "claude-runner.cjs"),
+    join6(root, "dist", "agents", "claude-runner.js"),
+    join6(root, "dist", "agents", "claude-runner.cjs"),
+    join6(root, "claude-runner.ts"),
+    join6(root, "src", "agents", "claude-runner.ts")
   ];
   for (const candidate of candidates) {
     if (existsSync6(candidate)) return candidate;
@@ -2281,7 +2329,8 @@ function sessionCostUsdFromClaudeResult(obj) {
 function claudeResultErrorDetail(obj) {
   const isError = Boolean(obj.is_error) || typeof obj.subtype === "string" && /^error/i.test(obj.subtype);
   const fromResult = typeof obj.result === "string" ? obj.result.trim() : "";
-  if (fromResult && (isError || looksLikeAgentFailureMessage(fromResult))) {
+  const shortFailure = fromResult.length > 0 && fromResult.length <= 300 && !fromResult.includes("\n") && looksLikeAgentFailureMessage(fromResult);
+  if (fromResult && (isError || shortFailure)) {
     return fromResult;
   }
   if (!isError) return null;
@@ -2528,7 +2577,7 @@ function eventsFromClaudeSystem(obj) {
       data: `Context compressed${trigger}`,
       replace: true
     };
-    if (meta.postTokens != null && meta.postTokens > 0) {
+    if (meta.postTokens != null && meta.postTokens > 0 && !parentId) {
       return [
         thinking,
         {
@@ -2609,7 +2658,7 @@ var claudeAdapter = {
       );
     }
     const mode = permissionMode(thread);
-    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-5BWUTSPJ.js");
+    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-Z2SURNHA.js");
     const isOrchestrator = isOrchestratorThread2(thread);
     const rpc = worktreeAgentRpc(isOrchestrator);
     const injectedServers = await buildInjectedMcpServers({
@@ -2709,6 +2758,7 @@ var claudeAdapter = {
       cwd: thread.worktreePath,
       stdin: useStdin ? `${promptText}
 ` : void 0,
+      ...mcpConfigPath ? { cleanupDirs: [dirname4(mcpConfigPath)] } : {},
       // Nested Task/Agent thinking+text in stream-json (Claude Code 2.1.211+).
       // Raise the -p background-agent wait so long TaskOutput polls are not
       // abandoned at Claude Code’s 10-minute default.
@@ -2738,9 +2788,17 @@ var claudeAdapter = {
           Array.isArray(message?.content) ? message.content : void 0,
           parentId
         );
-        if (obj.type === "assistant") {
+        if (obj.type === "assistant" && !parentId) {
           const usage = usageFromClaude(message?.usage);
-          if (usage) events.push({ type: "usage", data: usage, scope: "request" });
+          const messageId = message && typeof message.id === "string" ? message.id : void 0;
+          if (usage) {
+            events.push({
+              type: "usage",
+              data: usage,
+              scope: "request",
+              ...messageId ? { messageId } : {}
+            });
+          }
         }
         if (events.length === 0) return null;
         return events.length === 1 ? events[0] : events;
@@ -2827,56 +2885,47 @@ var claudeAdapter = {
     return { file: claude, args, cwd: thread.worktreePath };
   },
   async listLinearIssues(_repoPath) {
-    const claude = resolveClaudeExecutable();
-    const prompt = "List my assigned Linear issues as JSON array only, no markdown. Each item: id, identifier, title, url, labels (string[]).";
-    const { stdout, exitCode } = await run(
-      claude,
-      [
-        "-p",
-        prompt,
-        "--output-format",
-        "json",
-        "--permission-mode",
-        "bypassPermissions",
-        "--allowedTools",
-        "mcp__linear__*"
-      ],
-      { reject: false }
-    );
-    if (exitCode !== 0) return [];
-    return parseIssuesJson(stdout);
+    const { listAssignedLinearIssues: listAssignedLinearIssues2 } = await import("./linear-list-63I7QUC6.js");
+    return listAssignedLinearIssues2();
   }
 };
-function parseIssuesJson(raw) {
-  const text = raw.trim();
-  const candidates = [text];
-  const match = text.match(/\[[\s\S]*\]/);
-  if (match) candidates.push(match[0]);
-  for (const c of candidates) {
-    try {
-      const parsed = JSON.parse(c);
-      if (Array.isArray(parsed)) {
-        return parsed.map((item) => ({
-          id: String(item.id ?? item.identifier ?? ""),
-          identifier: String(item.identifier ?? item.id ?? ""),
-          title: String(item.title ?? ""),
-          url: String(item.url ?? ""),
-          labels: Array.isArray(item.labels) ? item.labels.map(String) : []
-        }));
-      }
-      if (parsed && typeof parsed === "object" && typeof parsed.result === "string") {
-        return parseIssuesJson(parsed.result);
-      }
-    } catch {
+
+// src/agents/codex.ts
+import { existsSync as existsSync8, statSync } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join7 } from "path";
+
+// src/agents/codex-items.ts
+function eventsFromCodexItem(eventType, item) {
+  const itemType = item.type ?? item.item_type;
+  if (itemType === "reasoning" && typeof item.text === "string" && item.text) {
+    return { type: "thinking", data: item.text };
+  }
+  if (itemType !== "file_change" || !item.id) return null;
+  const changes = Array.isArray(item.changes) ? item.changes : [];
+  const paths = changes.map((change) => typeof change?.path === "string" ? change.path : "").filter(Boolean);
+  const added = changes.some((change) => change?.kind === "add");
+  const events = [
+    {
+      type: "tool_use",
+      id: item.id,
+      name: added ? "Write" : "Edit",
+      input: paths.length ? { paths } : void 0
     }
+  ];
+  const finished = eventType === "item.completed" || item.status === "completed" || item.status === "failed";
+  if (finished) {
+    events.push({
+      type: "tool_result",
+      id: item.id,
+      content: paths.join("\n") || void 0,
+      isError: item.status === "failed"
+    });
   }
-  return [];
+  return events.length === 1 ? events[0] : events;
 }
 
 // src/agents/codex.ts
-import { existsSync as existsSync8, readFileSync as readFileSync4, statSync } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join6 } from "path";
 var CODEX_PROMPT_ARG_MAX = 2e5;
 var FALLBACK_CODEX_MODELS = [
   { id: "gpt-5.6-sol", displayName: "GPT-5.6 Sol" },
@@ -2929,17 +2978,8 @@ function usageFromCodex(usage) {
     cachedInputTokens: Number(usage.cached_input_tokens ?? 0)
   });
 }
-function codexConfigHasNetworkAccess() {
-  const candidates = [
-    join6(homedir5(), ".codex", "config.toml"),
-    join6(homedir5(), ".config", "codex", "config.toml")
-  ];
-  for (const path of candidates) {
-    if (!existsSync8(path)) continue;
-    const text = readFileSync4(path, "utf8");
-    if (/network_access\s*=\s*true/.test(text)) return true;
-  }
-  return false;
+function codexHomeDir() {
+  return process.env.CODEX_HOME?.trim() || join7(homedir6(), ".codex");
 }
 function unwrapCodexMcpResult(result) {
   if (result == null) return void 0;
@@ -2968,7 +3008,7 @@ function asRecord3(value) {
   return void 0;
 }
 function codexLooksAuthenticated() {
-  const authPath = join6(homedir5(), ".codex", "auth.json");
+  const authPath = join7(codexHomeDir(), "auth.json");
   if (!existsSync8(authPath)) return false;
   try {
     return statSync(authPath).size > 2;
@@ -3007,18 +3047,13 @@ var codexAdapter = {
     const authenticated = codexLooksAuthenticated();
     const linearMcp = false;
     const warnings = [];
-    if (!codexConfigHasNetworkAccess()) {
-      warnings.push(
-        "Codex workspace-write blocks network by default \u2014 set [sandbox_workspace_write] network_access = true in ~/.codex/config.toml if agents need npm install etc."
-      );
-    }
     return {
       agent: "codex",
       installed: true,
       authenticated,
       linearMcp,
       warnings,
-      reason: authenticated ? void 0 : "Codex auth not found \u2014 run `codex login` (expected ~/.codex/auth.json)"
+      reason: authenticated ? void 0 : `Codex auth not found \u2014 run \`codex login\` (expected ${join7(codexHomeDir(), "auth.json")})`
     };
   },
   async buildTurn(thread, input) {
@@ -3043,6 +3078,12 @@ var codexAdapter = {
       threadId: thread.id
     });
     const isolatePlugins = isOrchestrator || Boolean(thread.isolateCodexPlugins) || Boolean(normalizeTurnInput(input).isolateCodexPlugins);
+    const gitEnv = await resolveAgentGitAuthEnv(process.env, {
+      cwd: thread.worktreePath
+    });
+    const writableRoots = mode.codexSandbox === "workspace-write" ? await resolveCodexGitWritableRoots(thread.worktreePath) : [];
+    const secretProfile = writeCodexMcpSecretProfile(injected);
+    const effort = thread.effort?.trim() ?? "";
     const mcpOverrides = [
       // Worktree first try keeps plugins (Claude connectors). Coordinators
       // isolate. After a fatal plugin MCP, the orchestrator retries with
@@ -3059,6 +3100,7 @@ var codexAdapter = {
     const execOpts = [
       // Global orchestration cwd is not a git repo; without this Codex ≥0.147
       // refuses to start ("Not inside a trusted directory").
+      ...secretProfile ? ["-p", secretProfile.profile] : [],
       "--skip-git-repo-check",
       "--cd",
       thread.worktreePath,
@@ -3068,14 +3110,16 @@ var codexAdapter = {
       // `codex exec` rejects `--ask-for-approval` (global-only on newer CLIs).
       "-c",
       'approval_policy="never"',
-      // Seatbelt cannot use the login Keychain; inherit GH_CONFIG_DIR / GIT_CONFIG_*.
-      // Default policy also strips *TOKEN*. Linked worktrees need the main
-      // repo `.git` (+ `.git/worktrees/<name>`) as writable_roots so git commit
-      // can create index.lock.
+      // Seatbelt cannot use the login Keychain. inherit=all keeps GH_CONFIG_DIR
+      // and GIT_CONFIG_*. Default excludes still strip *TOKEN*/*SECRET*/*KEY*;
+      // GIT_CONFIG_KEY_n is re-set because it matches *KEY*. Linked worktrees
+      // need the main repo `.git` as writable_roots so git commit can lock.
       ...codexUnattendedGitConfigArgs(mode.codexSandbox, {
-        writableRoots: mode.codexSandbox === "workspace-write" ? await resolveCodexGitWritableRoots(thread.worktreePath) : []
+        writableRoots,
+        preserveEnv: gitEnv
       }),
       ...model ? ["--model", model] : [],
+      ...effort ? ["-c", `model_reasoning_effort=${JSON.stringify(effort)}`] : [],
       ...mcpOverrides
     ];
     const args = sessionId ? ["exec", ...execOpts, "resume", sessionId, promptArg] : ["exec", ...execOpts, promptArg];
@@ -3084,7 +3128,8 @@ var codexAdapter = {
       args,
       cwd: thread.worktreePath,
       stdin: useStdin ? `${prompt}
-` : void 0
+` : void 0,
+      ...secretProfile ? { cleanupDirs: [secretProfile.file] } : {}
     };
   },
   parseEvent(line) {
@@ -3105,8 +3150,10 @@ var codexAdapter = {
       if (typeof obj.item === "object" && obj.item !== null) {
         const item = obj.item;
         const itemType = item.type ?? item.item_type;
+        const mapped = eventsFromCodexItem(type, item);
+        if (mapped) return mapped;
         if (itemType === "error") {
-          const detail = item.message?.trim() || extractJsonErrorMessage(obj) || "Codex item error";
+          const detail = (typeof item.message === "string" ? item.message.trim() : "") || extractJsonErrorMessage(obj) || "Codex item error";
           return { type: "stderr", data: detail };
         }
         if (itemType === "agent_message" && item.text) {
@@ -3135,14 +3182,14 @@ var codexAdapter = {
           const events = [
             { type: "tool_use", id: item.id, name: "Bash", input }
           ];
-          const finished = type === "item.completed" || item.status === "completed" || item.status === "failed";
+          const finished = type === "item.completed" || item.status === "completed" || item.status === "failed" || item.status === "declined";
           const output = typeof item.aggregated_output === "string" && item.aggregated_output ? item.aggregated_output : void 0;
           if (finished) {
             events.push({
               type: "tool_result",
               id: item.id,
               content: output,
-              isError: item.status === "failed"
+              isError: item.status === "failed" || item.status === "declined"
             });
           } else if (output) {
             events.push({
@@ -3185,7 +3232,7 @@ var codexAdapter = {
           return events.length === 1 ? events[0] : events;
         }
         if (item.status === "failed") {
-          const detail = item.message?.trim() || extractJsonErrorMessage(item) || `Codex ${itemType ?? "item"} failed`;
+          const detail = (typeof item.message === "string" ? item.message.trim() : "") || extractJsonErrorMessage(item) || `Codex ${itemType ?? "item"} failed`;
           return { type: "stderr", data: detail };
         }
       }
@@ -3194,7 +3241,8 @@ var codexAdapter = {
         return { type: "session_id", data: sid };
       }
       if (type === "turn.completed" || type === "turn_completed") {
-        const usage = usageFromCodex(obj.usage);
+        const payload = obj;
+        const usage = usageFromCodex(payload.last_token_usage ?? payload.usage);
         return usage ? { type: "usage", data: usage, scope: "turn" } : null;
       }
       if (typeof obj.content === "string" && obj.content.trim()) {
@@ -3217,7 +3265,7 @@ var codexAdapter = {
     if (sessionId) {
       return {
         file: codex,
-        args: ["exec", "--cd", thread.worktreePath, "resume", sessionId],
+        args: ["resume", sessionId],
         cwd: thread.worktreePath
       };
     }
@@ -3228,36 +3276,14 @@ var codexAdapter = {
     };
   },
   async listLinearIssues(_repoPath) {
-    const prompt = "List my assigned Linear issues as JSON array only: id, identifier, title, url, labels.";
-    const { stdout, exitCode } = await run(
-      resolveAgentExecutable("codex"),
-      [
-        "exec",
-        "--json",
-        "--sandbox",
-        "read-only",
-        "-c",
-        'approval_policy="never"',
-        prompt
-      ],
-      { reject: false }
-    );
-    if (exitCode !== 0) return [];
-    const match = stdout.match(/\[[\s\S]*\]/);
-    if (!match) return [];
-    try {
-      const parsed = JSON.parse(match[0]);
-      return Array.isArray(parsed) ? parsed : [];
-    } catch {
-      return [];
-    }
+    return listAssignedLinearIssues();
   }
 };
 
 // src/agents/cursor.ts
 import { existsSync as existsSync9 } from "fs";
 import { createRequire as createRequire3 } from "module";
-import { dirname as dirname4, join as join7 } from "path";
+import { dirname as dirname5, join as join8 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var FALLBACK_CURSOR_MODELS = [
   { id: "default", displayName: "Auto" },
@@ -3309,11 +3335,11 @@ function entryDir2() {
   const cjsDir = typeof __dirname !== "undefined" ? __dirname : "";
   if (cjsDir) return cjsDir;
   try {
-    return dirname4(fileURLToPath3(import.meta.url));
+    return dirname5(fileURLToPath3(import.meta.url));
   } catch {
     try {
       const req = createRequire3(process.cwd() + "/");
-      return dirname4(req.resolve("@sideboard-ai/core"));
+      return dirname5(req.resolve("@sideboard-ai/core"));
     } catch {
       return process.cwd();
     }
@@ -3324,14 +3350,14 @@ function cursorRunnerPath() {
   if (packaged) return packaged;
   const root = entryDir2();
   const candidates = [
-    join7(root, "agents", "cursor-runner.js"),
-    join7(root, "agents", "cursor-runner.cjs"),
+    join8(root, "agents", "cursor-runner.js"),
+    join8(root, "agents", "cursor-runner.cjs"),
     // If somehow resolved from package root instead of dist/
-    join7(root, "dist", "agents", "cursor-runner.js"),
-    join7(root, "dist", "agents", "cursor-runner.cjs"),
+    join8(root, "dist", "agents", "cursor-runner.js"),
+    join8(root, "dist", "agents", "cursor-runner.cjs"),
     // Source tree (dev): packages/core/src/agents/cursor-runner.ts
-    join7(root, "cursor-runner.ts"),
-    join7(root, "src", "agents", "cursor-runner.ts")
+    join8(root, "cursor-runner.ts"),
+    join8(root, "src", "agents", "cursor-runner.ts")
   ];
   for (const candidate of candidates) {
     if (existsSync9(candidate)) return candidate;
@@ -3372,6 +3398,7 @@ var cursorAdapter = {
   },
   async buildTurn(thread, input) {
     const agentId = await this.resolveSessionId(thread.worktreePath, thread.sessionId);
+    const fullPrompt = flattenTurnInput(input);
     const prompt = flattenTurnInput(dropCachedPrefixOnResume(input, agentId));
     const apiKey = resolveCursorApiKey() || void 0;
     const isOrchestrator = isOrchestratorThread(thread);
@@ -3388,6 +3415,7 @@ var cursorAdapter = {
     const mcpServers = toCursorMcpServers(injected);
     const req = {
       prompt,
+      ...fullPrompt !== prompt ? { freshPrompt: fullPrompt } : {},
       cwd: thread.worktreePath,
       threadId: thread.id,
       agentId,
@@ -3414,8 +3442,9 @@ var cursorAdapter = {
       stdin: JSON.stringify(req),
       env: {
         ...launch.env,
-        ...cursorRipgrepEnv({ startFile: runner }),
-        ...apiKey ? { CURSOR_API_KEY: apiKey } : {}
+        ...cursorRipgrepEnv({ startFile: runner })
+        // API key stays on the stdin request. Do not copy it into the child env,
+        // where `ps` and crash dumps can see it. The runner reads `req.apiKey`.
       }
     };
   },
@@ -3437,14 +3466,17 @@ var cursorAdapter = {
 };
 
 // src/agents/opencode.ts
-import { existsSync as existsSync10 } from "fs";
+import { existsSync as existsSync11 } from "fs";
+
+// src/agent-rpc/opencode-host.ts
+import { pathToFileURL } from "url";
 
 // src/agent-rpc/opencode-hook.ts
-import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync4, renameSync, writeFileSync as writeFileSync4 } from "fs";
+import { join as join9 } from "path";
 var OPENCODE_PLUGIN_SOURCE = `import { tool } from "@opencode-ai/plugin"
 
-const URL = process.env[${JSON.stringify(AGENT_RPC_URL_ENV)}] || ""
+const RPC_URL = process.env[${JSON.stringify(AGENT_RPC_URL_ENV)}] || ""
 const TOKEN = process.env[${JSON.stringify(AGENT_RPC_TOKEN_ENV)}] || ""
 const CWD = process.env[${JSON.stringify(AGENT_RPC_CWD_ENV)}] || ""
 
@@ -3457,24 +3489,29 @@ function jsonError(err) {
 }
 
 function socketUrl() {
-  const u = new URL(URL)
+  const u = new URL(RPC_URL)
   u.searchParams.set(${JSON.stringify(AGENT_RPC_TOKEN_QUERY)}, TOKEN)
   return u.toString()
 }
 
 function call(method, params) {
-  if (!URL || !TOKEN) {
+  if (!RPC_URL || !TOKEN) {
     return Promise.resolve(jsonError(new Error("Agent RPC runtime is not running")))
   }
+  const timeoutMs = method === "job.wait" ? 130000 : 30000
   return new Promise((resolve) => {
     let settled = false
+    let ws
+    let timer
     const done = (value) => {
       if (settled) return
       settled = true
+      clearTimeout(timer)
       try { ws.close() } catch {}
       resolve(value)
     }
-    const ws = new WebSocket(socketUrl())
+    timer = setTimeout(() => done(jsonError(new Error("Agent RPC timed out"))), timeoutMs)
+    ws = new WebSocket(socketUrl())
     const id = Date.now()
     ws.addEventListener("open", () => {
       ws.send(JSON.stringify({ jsonrpc: "2.0", id, method, params, authToken: TOKEN }))
@@ -3546,12 +3583,19 @@ export const SideboardRpc = async (ctx) => {
 }
 `;
 function writeOpencodeRpcPlugin() {
-  const configDir = join8(appDataDir(), "agent-rpc", "opencode");
-  const pluginDir = join8(configDir, "plugins");
-  mkdirSync2(pluginDir, { recursive: true });
-  const pluginFile = join8(pluginDir, "sideboard-rpc.js");
-  writeFileSync3(pluginFile, OPENCODE_PLUGIN_SOURCE);
-  return { configDir, pluginFile };
+  const pluginDir = join9(appDataDir(), "agent-rpc", "opencode");
+  mkdirSync3(pluginDir, { recursive: true });
+  const pluginFile = join9(pluginDir, "sideboard-rpc.js");
+  if (existsSync10(pluginFile)) {
+    try {
+      if (readFileSync4(pluginFile, "utf8") === OPENCODE_PLUGIN_SOURCE) return pluginFile;
+    } catch {
+    }
+  }
+  const tmp = `${pluginFile}.${process.pid}.tmp`;
+  writeFileSync4(tmp, OPENCODE_PLUGIN_SOURCE);
+  renameSync(tmp, pluginFile);
+  return pluginFile;
 }
 
 // src/agent-rpc/opencode-host.ts
@@ -3574,10 +3618,9 @@ async function buildOpencodeHostEnv(thread) {
   const config = injected.length > 0 || disableNames.length > 0 ? JSON.parse(toOpencodeMcpConfigContent(injected, { disableNames })) : {};
   const env = {};
   if (rpc) {
-    const { configDir, pluginFile } = writeOpencodeRpcPlugin();
-    env.OPENCODE_CONFIG_DIR = configDir;
+    const pluginFile = writeOpencodeRpcPlugin();
     Object.assign(env, agentRpcChildEnv(rpc, thread.worktreePath));
-    config.plugin = [pluginFile];
+    config.plugin = [pathToFileURL(pluginFile).href];
   }
   if (Object.keys(config).length > 0) {
     env.OPENCODE_CONFIG_CONTENT = JSON.stringify(config);
@@ -3644,7 +3687,7 @@ async function listOpencodeModels() {
   if (opencode === "opencode") {
     const which = await run("which", ["opencode"], { reject: false });
     if (which.exitCode !== 0) return FALLBACK_OPENCODE_MODELS;
-  } else if (!existsSync10(opencode)) {
+  } else if (!existsSync11(opencode)) {
     return FALLBACK_OPENCODE_MODELS;
   }
   const listed = await run(opencode, ["models"], { reject: false });
@@ -3679,7 +3722,7 @@ var opencodeAdapter = {
   async detect() {
     const opencode = resolveAgentExecutable("opencode");
     if (opencode !== "opencode") {
-      if (!existsSync10(opencode)) {
+      if (!existsSync11(opencode)) {
         return {
           agent: "opencode",
           installed: false,
@@ -3733,6 +3776,11 @@ var opencodeAdapter = {
     if (model) {
       args.push("--model", model);
     }
+    args.push("--thinking");
+    const variant = thread.effort?.trim() ?? "";
+    if (variant && /^(minimal|low|medium|high|max|xhigh)$/i.test(variant)) {
+      args.push("--variant", variant);
+    }
     const hostEnv = await buildOpencodeHostEnv(thread);
     return {
       file: resolveAgentExecutable("opencode"),
@@ -3765,6 +3813,10 @@ var opencodeAdapter = {
         const text = obj.part?.text ?? obj.text;
         if (text) return { type: "stdout", data: text };
       }
+      if (obj.type === "reasoning" || obj.type === "thinking") {
+        const text = obj.part?.text ?? obj.text;
+        if (typeof text === "string" && text) return { type: "thinking", data: text };
+      }
       if (obj.type === "tool_use") {
         const part = obj.part;
         const name = part?.tool ?? part?.name ?? obj.tool ?? obj.name ?? "tool";
@@ -3880,11 +3932,14 @@ var opencodeAdapter = {
     const listed = await run(
       resolveAgentExecutable("opencode"),
       ["session", "list", "--format", "json"],
-      { cwd: worktreePath, reject: false }
+      { cwd: worktreePath, reject: false, timeoutMs: 8e3 }
     );
-    if (listed.exitCode === 0 && listed.stdout.trim()) {
+    if (listed.exitCode === 0) {
+      const raw = listed.stdout.trim();
+      if (!raw) return null;
       try {
-        const sessions = JSON.parse(listed.stdout);
+        const sessions = JSON.parse(raw);
+        if (Array.isArray(sessions) && sessions.length === 0) return null;
         if (Array.isArray(sessions) && sessions.length > 0) {
           const norm = (p) => p.replace(/\/+$/, "");
           const wt = norm(worktreePath);
@@ -3918,34 +3973,8 @@ var opencodeAdapter = {
     };
   },
   async listLinearIssues(_repoPath) {
-    const prompt = "List my assigned Linear issues as JSON array only: id, identifier, title, url, labels.";
-    const { stdout, exitCode } = await run(
-      resolveAgentExecutable("opencode"),
-      ["run", prompt, "--format", "json"],
-      {
-        reject: false,
-        env: { OPENCODE_PERMISSION: JSON.stringify({ "*": "allow" }) }
-      }
-    );
-    if (exitCode !== 0) return [];
-    const texts = [];
-    for (const line of stdout.split("\n")) {
-      try {
-        const obj = JSON.parse(line);
-        if (obj.type === "text") {
-          texts.push(obj.part?.text ?? obj.text ?? "");
-        }
-      } catch {
-      }
-    }
-    const joined = texts.join("");
-    const match = joined.match(/\[[\s\S]*\]/);
-    if (!match) return [];
-    try {
-      return JSON.parse(match[0]);
-    } catch {
-      return [];
-    }
+    const { listAssignedLinearIssues: listAssignedLinearIssues2 } = await import("./linear-list-63I7QUC6.js");
+    return listAssignedLinearIssues2();
   }
 };
 
@@ -4344,9 +4373,9 @@ function formatClaudeUsageOverLimitWait(windows, now = /* @__PURE__ */ new Date(
 }
 
 // src/agents/claude-usage-client.ts
-import { existsSync as existsSync11, readFileSync as readFileSync5 } from "fs";
-import { homedir as homedir6 } from "os";
-import { join as join9 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync5 } from "fs";
+import { homedir as homedir7 } from "os";
+import { join as join10 } from "path";
 var CLAUDE_OAUTH_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
 var CLAUDE_USAGE_TTL_MS = 9e4;
 var CLAUDE_USAGE_ERROR_TTL_MS = 5 * 6e4;
@@ -4386,12 +4415,12 @@ function accessTokenFromCredentialsJson(raw) {
   }
 }
 function claudeCredentialsPath(configDir) {
-  const root = configDir?.trim() || process.env.CLAUDE_CONFIG_DIR?.trim() || join9(homedir6(), ".claude");
-  return join9(root, ".credentials.json");
+  const root = configDir?.trim() || process.env.CLAUDE_CONFIG_DIR?.trim() || join10(homedir7(), ".claude");
+  return join10(root, ".credentials.json");
 }
 async function readFileAccessToken(configDir) {
   const path = claudeCredentialsPath(configDir);
-  if (!existsSync11(path)) return null;
+  if (!existsSync12(path)) return null;
   try {
     return accessTokenFromCredentialsJson(readFileSync5(path, "utf8"));
   } catch {