@sideboard-ai/core 0.1.324 → 0.1.325

package/dist/{chunk-Y3WREIPQ.js → chunk-A76MKMSF.js}

@@ -3,223 +3,31 @@
 import {
   abletimeRestUrl,
   textFromAbleTimeDoc
-} from "./chunk-NXUN4U5P.js";
+} from "./chunk-VAFQS4D2.js";
 import {
   assertAbleTimeCredential,
   callAbleTimeTool,
   normalizeAbleTimeHost,
   rewriteAbleTimeError
-} from "./chunk-FR3SAYUL.js";
+} from "./chunk-AQEKPJWU.js";
+import {
+  downloadAuthenticatedFile,
+  extractHttpUrls,
+  hostMatches,
+  issueAttachmentWorktreePath,
+  looksLikeFileUrl,
+  looksLikeHttpUrl,
+  mergeIssueAttachments
+} from "./chunk-F6GE7V3Q.js";
 import {
   httpFetch
 } from "./chunk-2GPQZZLY.js";
-import {
-  ATTACHMENTS_DIR,
-  attachmentsGitignoreBody
-} from "./chunk-N2WW62LF.js";
 import {
   getAbleTimeAccessToken,
   getAbleTimeHost,
   isAbleTimeConnected,
   saveAbleTimeConnection
-} from "./chunk-OIHRC2ZJ.js";
-
-// src/integrations/issue-attachments.ts
-import { existsSync, mkdirSync, writeFileSync } from "fs";
-import { basename, extname, join } from "path";
-import { randomUUID } from "crypto";
-var ISSUE_ATTACHMENT_MAX_BYTES = 25 * 1024 * 1024;
-var MARKDOWN_IMAGE_RE = /!\[[^\]]*]\(\s*<?(https?:\/\/[^)\s>]+)>?/gi;
-var MARKDOWN_LINK_RE = /(?<!!)\[[^\]]*]\(\s*<?(https?:\/\/[^)\s>]+)>?/gi;
-var HTML_SRC_RE = /\b(?:src|href)\s*=\s*["'](https?:\/\/[^"']+)["']/gi;
-var BARE_URL_RE = /https?:\/\/[^\s<>"'`)]+/gi;
-var EXT_BY_MIME = {
-  "image/png": ".png",
-  "image/jpeg": ".jpg",
-  "image/jpg": ".jpg",
-  "image/gif": ".gif",
-  "image/webp": ".webp",
-  "image/svg+xml": ".svg",
-  "application/pdf": ".pdf",
-  "text/plain": ".txt",
-  "text/markdown": ".md",
-  "application/json": ".json",
-  "application/zip": ".zip"
-};
-function issueAttachmentWorktreePath(repoPath) {
-  const raw = (repoPath ?? "").trim();
-  return raw || process.cwd();
-}
-function ensureIssueAttachmentsDir(worktreePath) {
-  const dir = join(worktreePath, ATTACHMENTS_DIR);
-  mkdirSync(dir, { recursive: true });
-  const gi = join(dir, ".gitignore");
-  if (!existsSync(gi)) {
-    writeFileSync(gi, attachmentsGitignoreBody(), "utf8");
-  }
-  return dir;
-}
-function hostnameOf(url) {
-  try {
-    return new URL(url).hostname.toLowerCase();
-  } catch {
-    return "";
-  }
-}
-function hostMatches(url, suffixes) {
-  const host = hostnameOf(url);
-  if (!host) return false;
-  return suffixes.some((suffix) => host === suffix || host.endsWith(`.${suffix}`));
-}
-function looksLikeHttpUrl(value) {
-  return /^https?:\/\//i.test(value.trim());
-}
-function looksLikeFileUrl(url) {
-  try {
-    const path = new URL(url).pathname;
-    return /\.[a-z0-9]{2,8}$/i.test(path);
-  } catch {
-    return false;
-  }
-}
-function filenameFromUrl(url, fallback = "attachment") {
-  try {
-    const parsed = new URL(url);
-    const last = decodeURIComponent(basename(parsed.pathname)).replace(/[/\\]/g, "_");
-    if (last && last !== "/" && last !== ".") return last;
-  } catch {
-  }
-  return fallback;
-}
-function filenameFromContentDisposition(header) {
-  if (!header) return void 0;
-  const star = header.match(/filename\*\s*=\s*(?:UTF-8''|utf-8'')([^;]+)/i);
-  if (star?.[1]) {
-    try {
-      return decodeURIComponent(star[1].trim().replace(/^["']|["']$/g, ""));
-    } catch {
-      return star[1].trim().replace(/^["']|["']$/g, "");
-    }
-  }
-  const plain = header.match(/filename\s*=\s*("(?:\\.|[^"])*"|[^;]+)/i);
-  if (!plain?.[1]) return void 0;
-  return plain[1].trim().replace(/^["']|["']$/g, "").replace(/\\"/g, '"');
-}
-function uniqueAttachmentFileName(dir, originalName) {
-  const safe = originalName.replace(/[/\\]/g, "_").replace(/^\.+/, "") || "file";
-  if (!existsSync(join(dir, safe))) return safe;
-  const ext = extname(safe);
-  const stem = ext ? safe.slice(0, -ext.length) : safe;
-  for (let i = 1; i < 1e4; i++) {
-    const candidate = `${stem}-${i}${ext}`;
-    if (!existsSync(join(dir, candidate))) return candidate;
-  }
-  return `${stem}-${randomUUID()}${ext}`;
-}
-function extractHttpUrls(markdown) {
-  const text = markdown ?? "";
-  if (!text.trim()) return [];
-  const found = [];
-  const seen = /* @__PURE__ */ new Set();
-  const push = (raw) => {
-    const url = raw.replace(/[).,;]+$/, "");
-    if (!looksLikeHttpUrl(url) || seen.has(url)) return;
-    seen.add(url);
-    found.push(url);
-  };
-  for (const re of [MARKDOWN_IMAGE_RE, MARKDOWN_LINK_RE, HTML_SRC_RE, BARE_URL_RE]) {
-    re.lastIndex = 0;
-    let match;
-    while (match = re.exec(text)) {
-      if (match[1]) push(match[1]);
-      else if (re === BARE_URL_RE) push(match[0]);
-    }
-  }
-  return found;
-}
-function mergeIssueAttachments(items) {
-  const out = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const item of items) {
-    if (!item) continue;
-    const url = item.url.trim();
-    const id = item.id.trim() || url;
-    if (!id && !url) continue;
-    const key = url || id;
-    if (seen.has(key) || seen.has(id)) continue;
-    seen.add(key);
-    if (id !== key) seen.add(id);
-    out.push({
-      id: id || url,
-      name: item.name.trim() || filenameFromUrl(url),
-      url,
-      ...item.contentType ? { contentType: item.contentType } : {},
-      ...item.sourceType ? { sourceType: item.sourceType } : {}
-    });
-  }
-  return out;
-}
-function extensionForContentType(contentType, name) {
-  if (extname(name)) return name;
-  const mime = (contentType ?? "").split(";")[0]?.trim().toLowerCase() ?? "";
-  const ext = EXT_BY_MIME[mime];
-  return ext ? `${name}${ext}` : name;
-}
-function assertNotHtml(contentType, url) {
-  const mime = (contentType ?? "").split(";")[0]?.trim().toLowerCase() ?? "";
-  if (mime === "text/html" || mime === "application/xhtml+xml") {
-    throw new Error(
-      `Attachment at ${url} returned HTML, not a file. Use the listed file URL (uploads / user-attachments), not a ticket or PR page.`
-    );
-  }
-}
-async function downloadAuthenticatedFile(opts) {
-  const url = opts.url.trim();
-  if (!looksLikeHttpUrl(url)) {
-    throw new Error(`Attachment URL must be http(s) (got ${url || "empty"})`);
-  }
-  const res = await httpFetch(url, {
-    method: "GET",
-    redirect: "follow",
-    headers: {
-      Accept: "*/*",
-      ...opts.headers ?? {}
-    }
-  });
-  if (!res.ok) {
-    const detail = await res.text().catch(() => "");
-    throw new Error(
-      `Attachment download failed ${res.status}${detail ? `: ${detail.slice(0, 200)}` : ""} (${url})`
-    );
-  }
-  const contentType = res.headers.get("content-type") ?? void 0;
-  assertNotHtml(contentType, url);
-  const lengthHeader = res.headers.get("content-length");
-  if (lengthHeader) {
-    const length = Number(lengthHeader);
-    if (Number.isFinite(length) && length > ISSUE_ATTACHMENT_MAX_BYTES) {
-      throw new Error(
-        `Attachment is ${length} bytes; max is ${ISSUE_ATTACHMENT_MAX_BYTES} (${url})`
-      );
-    }
-  }
-  const buf = Buffer.from(await res.arrayBuffer());
-  if (buf.length > ISSUE_ATTACHMENT_MAX_BYTES) {
-    throw new Error(
-      `Attachment is ${buf.length} bytes; max is ${ISSUE_ATTACHMENT_MAX_BYTES} (${url})`
-    );
-  }
-  const dir = ensureIssueAttachmentsDir(opts.worktreePath);
-  const hinted = opts.name?.trim() || filenameFromContentDisposition(res.headers.get("content-disposition")) || filenameFromUrl(url);
-  const name = uniqueAttachmentFileName(dir, extensionForContentType(contentType, hinted));
-  writeFileSync(join(dir, name), buf);
-  return {
-    name,
-    path: `${ATTACHMENTS_DIR}/${name}`,
-    bytes: buf.length,
-    ...contentType ? { contentType } : {}
-  };
-}
+} from "./chunk-CI4M54LS.js";
 
 // src/integrations/abletime-attachments.ts
 function asRecord(value) {
@@ -841,12 +649,6 @@ async function verifyAbleTimeConnection(input) {
 }
 
 export {
-  issueAttachmentWorktreePath,
-  hostMatches,
-  looksLikeHttpUrl,
-  extractHttpUrls,
-  mergeIssueAttachments,
-  downloadAuthenticatedFile,
   downloadAbleTimeAttachment,
   taskUrl,
   mapAbleTimeTask,

package/dist/{chunk-JE3JLHMO.js → chunk-APKUI4BP.js}

@@ -5,7 +5,7 @@ import {
   resolveGithubRepoSlug,
   resolveOriginRemote,
   resolveRepoRoot
-} from "./chunk-FUFNMUNR.js";
+} from "./chunk-BTF3ATST.js";
 import {
   allocateTeamName,
   createEmptyThread,
@@ -14,7 +14,7 @@ import {
   teamSlugFromName,
   updateThread,
   writeThread
-} from "./chunk-IFWGG2M2.js";
+} from "./chunk-ZSHS46V5.js";
 import {
   ATTACHMENTS_DIR,
   attachmentsGitignoreBody
@@ -31,7 +31,7 @@ import {
   resolveThreadDefaults,
   resolveViewerProfile,
   resolveViewerProfileForRepo
-} from "./chunk-EJ66LEKH.js";
+} from "./chunk-RZJTGBXY.js";
 import {
   appDataDir,
   globalAgentCwd,

package/dist/{chunk-FR3SAYUL.js → chunk-AQEKPJWU.js}

@@ -6,7 +6,7 @@ import {
 import {
   getAbleTimeHost,
   isAbleTimeConnected
-} from "./chunk-OIHRC2ZJ.js";
+} from "./chunk-CI4M54LS.js";
 
 // src/integrations/abletime-mcp.ts
 var DEFAULT_ABLETIME_HOST = "https://track.abletime.com";
@@ -155,7 +155,7 @@ function textsFromUnknown(value) {
   return "";
 }
 async function abletimeMcpRequest(method, params, opts) {
-  const rawToken = opts?.token ?? await import("./abletime-oauth-4TTCR3CT.js").then((m) => m.ensureAbleTimeAccessToken());
+  const rawToken = opts?.token ?? await import("./abletime-oauth-P4ZFBEAL.js").then((m) => m.ensureAbleTimeAccessToken());
   if (!rawToken?.trim()) {
     throw new Error("AbleTime is not connected \u2014 paste a personal access token in Account settings");
   }
@@ -226,9 +226,9 @@ async function callAbleTimeTool(name, args = {}, opts) {
   if (!opts?.token && !isAbleTimeConnected()) {
     throw new Error("AbleTime is not connected \u2014 paste a personal access token in Account settings");
   }
-  const rawToken = opts?.token ?? await import("./abletime-oauth-4TTCR3CT.js").then((m) => m.ensureAbleTimeAccessToken());
+  const rawToken = opts?.token ?? await import("./abletime-oauth-P4ZFBEAL.js").then((m) => m.ensureAbleTimeAccessToken());
   if (rawToken && ableTimeUsesRest(rawToken)) {
-    const { callAbleTimeRestTool } = await import("./abletime-rest-3TG4G7LW.js");
+    const { callAbleTimeRestTool } = await import("./abletime-rest-DLV7EIWS.js");
     return callAbleTimeRestTool(name, args, { ...opts, token: rawToken });
   }
   const requestOpts = { ...opts, pm: opts?.pm ?? abletimeToolUsesPm(name) };
@@ -244,7 +244,7 @@ async function callAbleTimeTool(name, args = {}, opts) {
       return await call();
     }
     if (rawToken && ableTimeUsesRest(rawToken) && isAbleTimeRejectedCredential(message)) {
-      const { callAbleTimeRestTool } = await import("./abletime-rest-3TG4G7LW.js");
+      const { callAbleTimeRestTool } = await import("./abletime-rest-DLV7EIWS.js");
       return callAbleTimeRestTool(name, args, { ...opts, token: rawToken });
     }
     throw err instanceof Error ? new Error(rewriteAbleTimeError(err.message)) : err;

package/dist/{chunk-QOS4465Y.js → chunk-BOFYI6LC.js}

@@ -125,7 +125,7 @@ async function connectedCliPresence(integrations) {
   const ids = connectedOptionalServices(integrations).filter((spec) => spec.cli).map((spec) => spec.id);
   if (ids.length === 0) return void 0;
   try {
-    const { optionalCliPresence } = await import("./optional-cli-RMMS5L6F.js");
+    const { optionalCliPresence } = await import("./optional-cli-U2GUA2X6.js");
     return await optionalCliPresence(ids);
   } catch {
     return void 0;

package/dist/{chunk-FUFNMUNR.js → chunk-BTF3ATST.js}

@@ -4,7 +4,7 @@ import {
   normalizeTakenSlug,
   normalizeWorktreePath,
   takenSlugsFromThread
-} from "./chunk-IFWGG2M2.js";
+} from "./chunk-ZSHS46V5.js";
 import {
   ensureWorktreeSideboardIgnored
 } from "./chunk-QKHEVSB5.js";
@@ -25,7 +25,7 @@ import {
 import {
   getGithubGitAuthMode,
   getGithubPat
-} from "./chunk-EJ66LEKH.js";
+} from "./chunk-RZJTGBXY.js";
 import {
   worktreesRoot
 } from "./chunk-H4UEFJRI.js";
@@ -291,12 +291,11 @@ function codexSandboxWritableRootsArgs(roots) {
   return ["-c", `sandbox_workspace_write.writable_roots=${JSON.stringify(abs)}`];
 }
 function codexUnattendedGitConfigArgs(sandbox, opts) {
-  const args = [
-    "-c",
-    'shell_environment_policy.inherit="all"',
-    "-c",
-    "shell_environment_policy.ignore_default_excludes=true"
-  ];
+  const args = ["-c", 'shell_environment_policy.inherit="all"'];
+  for (const [key, value] of Object.entries(opts?.preserveEnv ?? {})) {
+    if (!/^GIT_CONFIG_KEY_\d+$/.test(key) || !value) continue;
+    args.push("-c", `shell_environment_policy.set.${key}=${JSON.stringify(value)}`);
+  }
   if (sandbox === "workspace-write") {
     args.push("-c", "sandbox_workspace_write.network_access=true");
     args.push(...codexSandboxWritableRootsArgs(opts?.writableRoots ?? []));

package/dist/{chunk-OIHRC2ZJ.js → chunk-CI4M54LS.js}

@@ -471,6 +471,20 @@ function fromInclusiveInputUsage(opts) {
 function requestOccupancy(u) {
   return u.inputTokens + (u.cacheReadTokens ?? 0) + (u.cacheWriteTokens ?? 0);
 }
+function subtractUsage(total, part) {
+  if (!total) return null;
+  const cacheRead = Math.max(0, (total.cacheReadTokens ?? 0) - (part.cacheReadTokens ?? 0));
+  const cacheWrite = Math.max(0, (total.cacheWriteTokens ?? 0) - (part.cacheWriteTokens ?? 0));
+  return {
+    inputTokens: Math.max(0, total.inputTokens - part.inputTokens),
+    outputTokens: Math.max(0, total.outputTokens - part.outputTokens),
+    cacheReadTokens: cacheRead || void 0,
+    cacheWriteTokens: cacheWrite || void 0,
+    costUsd: total.costUsd != null && part.costUsd != null ? Math.max(0, total.costUsd - part.costUsd) : total.costUsd,
+    sessionCostUsd: total.sessionCostUsd,
+    lastRequestTokens: total.lastRequestTokens
+  };
+}
 function mergeUsage(a, b) {
   return {
     inputTokens: (a?.inputTokens ?? 0) + b.inputTokens,
@@ -562,7 +576,8 @@ function previousCostBaseline(messages) {
   }
   return {
     sessionCostUsd: lastSession ?? summed,
-    lastCostUsd: lastCost
+    lastCostUsd: lastCost,
+    hasSessionSnapshot: lastSession != null
   };
 }
 function turnCostUsdFromProviderSnapshot(opts) {
@@ -576,6 +591,9 @@ function turnCostUsdFromProviderSnapshot(opts) {
       if (session + USD_EPS >= previous) {
         return roundUsd(Math.max(0, session - previous));
       }
+      if (opts.previousHasSessionSnapshot) {
+        return roundUsd(session);
+      }
       if (last != null && session + USD_EPS >= last) {
         return roundUsd(Math.max(0, session - last));
       }
@@ -590,7 +608,8 @@ function withTurnScopedCost(usage, previousMessages) {
     reportedTurnCostUsd: usage.costUsd,
     sessionCostUsd: usage.sessionCostUsd,
     previousSessionCostUsd: baseline.sessionCostUsd,
-    previousLastCostUsd: baseline.lastCostUsd
+    previousLastCostUsd: baseline.lastCostUsd,
+    previousHasSessionSnapshot: baseline.hasSessionSnapshot
   });
   if (costUsd == null) {
     if (usage.costUsd == null) return usage;
@@ -2371,6 +2390,7 @@ export {
   formatViewerContextDirective,
   formatViewerContextReminder,
   fromInclusiveInputUsage,
+  subtractUsage,
   sumUsageList,
   applyTurnUsage,
   contextTokens,

package/dist/chunk-DBKHL7NC.js

@@ -0,0 +1,214 @@
+import {
+  httpFetch
+} from "./chunk-JAT3JFOS.js";
+import {
+  ATTACHMENTS_DIR,
+  attachmentsGitignoreBody
+} from "./chunk-6K64FJDD.js";
+
+// src/integrations/issue-attachments.ts
+import { existsSync, mkdirSync, writeFileSync } from "fs";
+import { basename, extname, join } from "path";
+import { randomUUID } from "crypto";
+var ISSUE_ATTACHMENT_MAX_BYTES = 25 * 1024 * 1024;
+var MARKDOWN_IMAGE_RE = /!\[[^\]]*]\(\s*<?(https?:\/\/[^)\s>]+)>?/gi;
+var MARKDOWN_LINK_RE = /(?<!!)\[[^\]]*]\(\s*<?(https?:\/\/[^)\s>]+)>?/gi;
+var HTML_SRC_RE = /\b(?:src|href)\s*=\s*["'](https?:\/\/[^"']+)["']/gi;
+var BARE_URL_RE = /https?:\/\/[^\s<>"'`)]+/gi;
+var EXT_BY_MIME = {
+  "image/png": ".png",
+  "image/jpeg": ".jpg",
+  "image/jpg": ".jpg",
+  "image/gif": ".gif",
+  "image/webp": ".webp",
+  "image/svg+xml": ".svg",
+  "application/pdf": ".pdf",
+  "text/plain": ".txt",
+  "text/markdown": ".md",
+  "application/json": ".json",
+  "application/zip": ".zip"
+};
+function issueAttachmentWorktreePath(repoPath) {
+  const raw = (repoPath ?? "").trim();
+  return raw || process.cwd();
+}
+function ensureIssueAttachmentsDir(worktreePath) {
+  const dir = join(worktreePath, ATTACHMENTS_DIR);
+  mkdirSync(dir, { recursive: true });
+  const gi = join(dir, ".gitignore");
+  if (!existsSync(gi)) {
+    writeFileSync(gi, attachmentsGitignoreBody(), "utf8");
+  }
+  return dir;
+}
+function hostnameOf(url) {
+  try {
+    return new URL(url).hostname.toLowerCase();
+  } catch {
+    return "";
+  }
+}
+function hostMatches(url, suffixes) {
+  const host = hostnameOf(url);
+  if (!host) return false;
+  return suffixes.some((suffix) => host === suffix || host.endsWith(`.${suffix}`));
+}
+function looksLikeHttpUrl(value) {
+  return /^https?:\/\//i.test(value.trim());
+}
+function looksLikeFileUrl(url) {
+  try {
+    const path = new URL(url).pathname;
+    return /\.[a-z0-9]{2,8}$/i.test(path);
+  } catch {
+    return false;
+  }
+}
+function filenameFromUrl(url, fallback = "attachment") {
+  try {
+    const parsed = new URL(url);
+    const last = decodeURIComponent(basename(parsed.pathname)).replace(/[/\\]/g, "_");
+    if (last && last !== "/" && last !== ".") return last;
+  } catch {
+  }
+  return fallback;
+}
+function filenameFromContentDisposition(header) {
+  if (!header) return void 0;
+  const star = header.match(/filename\*\s*=\s*(?:UTF-8''|utf-8'')([^;]+)/i);
+  if (star?.[1]) {
+    try {
+      return decodeURIComponent(star[1].trim().replace(/^["']|["']$/g, ""));
+    } catch {
+      return star[1].trim().replace(/^["']|["']$/g, "");
+    }
+  }
+  const plain = header.match(/filename\s*=\s*("(?:\\.|[^"])*"|[^;]+)/i);
+  if (!plain?.[1]) return void 0;
+  return plain[1].trim().replace(/^["']|["']$/g, "").replace(/\\"/g, '"');
+}
+function uniqueAttachmentFileName(dir, originalName) {
+  const safe = originalName.replace(/[/\\]/g, "_").replace(/^\.+/, "") || "file";
+  if (!existsSync(join(dir, safe))) return safe;
+  const ext = extname(safe);
+  const stem = ext ? safe.slice(0, -ext.length) : safe;
+  for (let i = 1; i < 1e4; i++) {
+    const candidate = `${stem}-${i}${ext}`;
+    if (!existsSync(join(dir, candidate))) return candidate;
+  }
+  return `${stem}-${randomUUID()}${ext}`;
+}
+function extractHttpUrls(markdown) {
+  const text = markdown ?? "";
+  if (!text.trim()) return [];
+  const found = [];
+  const seen = /* @__PURE__ */ new Set();
+  const push = (raw) => {
+    const url = raw.replace(/[).,;]+$/, "");
+    if (!looksLikeHttpUrl(url) || seen.has(url)) return;
+    seen.add(url);
+    found.push(url);
+  };
+  for (const re of [MARKDOWN_IMAGE_RE, MARKDOWN_LINK_RE, HTML_SRC_RE, BARE_URL_RE]) {
+    re.lastIndex = 0;
+    let match;
+    while (match = re.exec(text)) {
+      if (match[1]) push(match[1]);
+      else if (re === BARE_URL_RE) push(match[0]);
+    }
+  }
+  return found;
+}
+function mergeIssueAttachments(items) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of items) {
+    if (!item) continue;
+    const url = item.url.trim();
+    const id = item.id.trim() || url;
+    if (!id && !url) continue;
+    const key = url || id;
+    if (seen.has(key) || seen.has(id)) continue;
+    seen.add(key);
+    if (id !== key) seen.add(id);
+    out.push({
+      id: id || url,
+      name: item.name.trim() || filenameFromUrl(url),
+      url,
+      ...item.contentType ? { contentType: item.contentType } : {},
+      ...item.sourceType ? { sourceType: item.sourceType } : {}
+    });
+  }
+  return out;
+}
+function extensionForContentType(contentType, name) {
+  if (extname(name)) return name;
+  const mime = (contentType ?? "").split(";")[0]?.trim().toLowerCase() ?? "";
+  const ext = EXT_BY_MIME[mime];
+  return ext ? `${name}${ext}` : name;
+}
+function assertNotHtml(contentType, url) {
+  const mime = (contentType ?? "").split(";")[0]?.trim().toLowerCase() ?? "";
+  if (mime === "text/html" || mime === "application/xhtml+xml") {
+    throw new Error(
+      `Attachment at ${url} returned HTML, not a file. Use the listed file URL (uploads / user-attachments), not a ticket or PR page.`
+    );
+  }
+}
+async function downloadAuthenticatedFile(opts) {
+  const url = opts.url.trim();
+  if (!looksLikeHttpUrl(url)) {
+    throw new Error(`Attachment URL must be http(s) (got ${url || "empty"})`);
+  }
+  const res = await httpFetch(url, {
+    method: "GET",
+    redirect: "follow",
+    headers: {
+      Accept: "*/*",
+      ...opts.headers ?? {}
+    }
+  });
+  if (!res.ok) {
+    const detail = await res.text().catch(() => "");
+    throw new Error(
+      `Attachment download failed ${res.status}${detail ? `: ${detail.slice(0, 200)}` : ""} (${url})`
+    );
+  }
+  const contentType = res.headers.get("content-type") ?? void 0;
+  assertNotHtml(contentType, url);
+  const lengthHeader = res.headers.get("content-length");
+  if (lengthHeader) {
+    const length = Number(lengthHeader);
+    if (Number.isFinite(length) && length > ISSUE_ATTACHMENT_MAX_BYTES) {
+      throw new Error(
+        `Attachment is ${length} bytes; max is ${ISSUE_ATTACHMENT_MAX_BYTES} (${url})`
+      );
+    }
+  }
+  const buf = Buffer.from(await res.arrayBuffer());
+  if (buf.length > ISSUE_ATTACHMENT_MAX_BYTES) {
+    throw new Error(
+      `Attachment is ${buf.length} bytes; max is ${ISSUE_ATTACHMENT_MAX_BYTES} (${url})`
+    );
+  }
+  const dir = ensureIssueAttachmentsDir(opts.worktreePath);
+  const hinted = opts.name?.trim() || filenameFromContentDisposition(res.headers.get("content-disposition")) || filenameFromUrl(url);
+  const name = uniqueAttachmentFileName(dir, extensionForContentType(contentType, hinted));
+  writeFileSync(join(dir, name), buf);
+  return {
+    name,
+    path: `${ATTACHMENTS_DIR}/${name}`,
+    bytes: buf.length,
+    ...contentType ? { contentType } : {}
+  };
+}
+
+export {
+  issueAttachmentWorktreePath,
+  hostMatches,
+  looksLikeHttpUrl,
+  looksLikeFileUrl,
+  extractHttpUrls,
+  mergeIssueAttachments,
+  downloadAuthenticatedFile
+};

package/dist/{chunk-ROOZDDFA.js → chunk-EO6ZFLG6.js}

@@ -20,14 +20,14 @@ import {
 import {
   getGithubGitAuthMode,
   getGithubPat
-} from "./chunk-OIHRC2ZJ.js";
+} from "./chunk-CI4M54LS.js";
 import {
   allocateTeamName,
   listThreads,
   normalizeTakenSlug,
   normalizeWorktreePath,
   takenSlugsFromThread
-} from "./chunk-B4CDSSRN.js";
+} from "./chunk-Q3FHTGIW.js";
 import {
   worktreesRoot
 } from "./chunk-WOU343SI.js";
@@ -282,12 +282,11 @@ function codexSandboxWritableRootsArgs(roots) {
   return ["-c", `sandbox_workspace_write.writable_roots=${JSON.stringify(abs)}`];
 }
 function codexUnattendedGitConfigArgs(sandbox, opts) {
-  const args = [
-    "-c",
-    'shell_environment_policy.inherit="all"',
-    "-c",
-    "shell_environment_policy.ignore_default_excludes=true"
-  ];
+  const args = ["-c", 'shell_environment_policy.inherit="all"'];
+  for (const [key, value] of Object.entries(opts?.preserveEnv ?? {})) {
+    if (!/^GIT_CONFIG_KEY_\d+$/.test(key) || !value) continue;
+    args.push("-c", `shell_environment_policy.set.${key}=${JSON.stringify(value)}`);
+  }
   if (sandbox === "workspace-write") {
     args.push("-c", "sandbox_workspace_write.network_access=true");
     args.push(...codexSandboxWritableRootsArgs(opts?.writableRoots ?? []));