@sideboard-ai/core 0.1.324 → 0.1.326

package/dist/{chunk-7D5QIU3N.js → chunk-QG4CYRA3.js}

@@ -1,17 +1,5 @@
 #!/usr/bin/env node
 
-import {
-  applyConnectedTeamToCli,
-  brightsyMcpServerName,
-  ensureCliTeamTracked,
-  ensureConnectedBrightsyTeamTokens
-} from "./chunk-6U6QRUHY.js";
-import {
-  loadBrightsyConfig
-} from "./chunk-E63AM3PW.js";
-import {
-  httpFetch
-} from "./chunk-2GPQZZLY.js";
 import {
   extractJsonErrorMessage,
   formatUnknownDetail,
@@ -21,16 +9,31 @@ import {
   looksLikeSkillBody,
   skillCommandFromBody,
   withEventParentId
-} from "./chunk-EQ52JR3Q.js";
+} from "./chunk-5MXLDDYF.js";
 import {
   isOrchestratorThread
-} from "./chunk-ZIRQZUZY.js";
+} from "./chunk-YGVGXQA7.js";
 import {
   codexUnattendedGitConfigArgs,
   mergeAgentGitAuthEnv,
   resolveAgentGitAuthEnv,
   resolveCodexGitWritableRoots
-} from "./chunk-ROOZDDFA.js";
+} from "./chunk-75RPUXJS.js";
+import {
+  applyConnectedTeamToCli,
+  brightsyMcpServerName,
+  ensureCliTeamTracked,
+  ensureConnectedBrightsyTeamTokens
+} from "./chunk-6U6QRUHY.js";
+import {
+  loadBrightsyConfig
+} from "./chunk-E63AM3PW.js";
+import {
+  httpFetch
+} from "./chunk-2GPQZZLY.js";
+import {
+  listAssignedLinearIssues
+} from "./chunk-WUCAVIIP.js";
 import {
   githubAgentAuthReady,
   npmGlobalNodeModules,
@@ -43,9 +46,10 @@ import {
   isLinearConnected,
   isPosthogConnected,
   loadAppSettings,
+  requestOccupancy,
   resolveAgentExecutable,
   resolveClaudeExecutable
-} from "./chunk-OIHRC2ZJ.js";
+} from "./chunk-D744HOI5.js";
 import {
   isElectronLikeCommand,
   unwrapStrippedElectronLaunch,
@@ -57,7 +61,7 @@ import {
   CLAUDE_POSTHOG_CONNECTOR_ALLOWED_TOOLS,
   CLAUDE_PRINT_BG_WAIT_CEILING_MS,
   mcpAllowToolsFromNames
-} from "./chunk-B4CDSSRN.js";
+} from "./chunk-Q3FHTGIW.js";
 import {
   appDataDir
 } from "./chunk-WOU343SI.js";
@@ -448,6 +452,7 @@ var brightsyAdapter = {
 
 // src/agents/claude.ts
 import { existsSync as existsSync11 } from "fs";
+import { dirname as dirname5 } from "path";
 
 // src/agents/claude-mcp-status.ts
 var SIDEBOARD_CONNECTOR_SERVICES = [
@@ -564,7 +569,7 @@ function isNotableMcpInitStatus(server, sideboardOk, coverage) {
 
 // src/mcp-ui/host.ts
 import { createHash } from "crypto";
-import { homedir as homedir5 } from "os";
+import { homedir as homedir6 } from "os";
 
 // src/agents/orch-mcp-isolation.ts
 import { existsSync as existsSync8, readFileSync as readFileSync4 } from "fs";
@@ -921,20 +926,20 @@ function readJson(path) {
 }
 
 // src/agents/orch-mcp-isolation.ts
-import { homedir as homedir4 } from "os";
-import { join as join7 } from "path";
+import { homedir as homedir5 } from "os";
+import { join as join8 } from "path";
 import { parse as parseToml } from "smol-toml";
 
 // src/agents/user-mcp-config.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname3, join as join6 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname3, join as join7 } from "path";
 
 // src/agents/injected-mcp.ts
-import { existsSync as existsSync6, mkdtempSync, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync6, mkdtempSync, writeFileSync as writeFileSync3 } from "fs";
 import { createRequire } from "module";
 import { tmpdir } from "os";
-import { dirname as dirname2, join as join5 } from "path";
+import { dirname as dirname2, join as join6 } from "path";
 import { fileURLToPath } from "url";
 
 // src/agent-rpc/protocol.ts
@@ -1401,6 +1406,44 @@ async function resolveNodeLaunch(scriptPath) {
   };
 }
 
+// src/agents/codex-mcp-profile.ts
+import { randomBytes } from "crypto";
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join5 } from "path";
+function isCodexSecretEnvKey(key) {
+  return /token|secret|password|credential|oauth|api_key|_key$/i.test(key);
+}
+function tomlBasicString(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r")}"`;
+}
+function secretEnv(env) {
+  if (!env) return void 0;
+  const out = { ...env };
+  delete out.ELECTRON_RUN_AS_NODE;
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+function writeCodexMcpSecretProfile(servers) {
+  const blocks = [];
+  for (const s of servers) {
+    const env = secretEnv(s.env);
+    if (!env) continue;
+    const secrets = Object.entries(env).filter(([key]) => isCodexSecretEnvKey(key));
+    if (secrets.length === 0) continue;
+    const lines = [`[mcp_servers.${s.name}.env]`];
+    for (const [key, value] of secrets) lines.push(`${key} = ${tomlBasicString(value)}`);
+    blocks.push(lines.join("\n"));
+  }
+  if (blocks.length === 0) return null;
+  const home = process.env.CODEX_HOME?.trim() || join5(homedir3(), ".codex");
+  mkdirSync2(home, { recursive: true, mode: 448 });
+  const profile = `sideboard-${randomBytes(8).toString("hex")}`;
+  const file = join5(home, `${profile}.config.toml`);
+  writeFileSync2(file, `${blocks.join("\n\n")}
+`, { mode: 384 });
+  return { profile, file };
+}
+
 // src/agents/injected-mcp.ts
 var SIDEBOARD_MCP_ALLOWED_TOOLS = [
   "mcp__sideboard",
@@ -1536,7 +1579,7 @@ function corePackageDir() {
   } catch {
   }
   try {
-    const req = createRequire(join5(process.cwd(), "package.json"));
+    const req = createRequire(join6(process.cwd(), "package.json"));
     return dirname2(req.resolve("@sideboard-ai/core"));
   } catch {
     return process.cwd();
@@ -1550,13 +1593,13 @@ function findSideboardMcpJsEntry() {
   let dir = corePackageDir();
   for (let i = 0; i < 10; i++) {
     const candidates = [
-      join5(dir, "mcp/run-stdio.js"),
-      join5(dir, "mcp/run-stdio.cjs"),
-      join5(dir, "dist/mcp/run-stdio.js"),
-      join5(dir, "dist/mcp/run-stdio.cjs"),
-      join5(dir, "packages/core/dist/mcp/run-stdio.js"),
-      join5(dir, "packages/cli/dist/index.js"),
-      join5(dir, "cli/dist/index.js")
+      join6(dir, "mcp/run-stdio.js"),
+      join6(dir, "mcp/run-stdio.cjs"),
+      join6(dir, "dist/mcp/run-stdio.js"),
+      join6(dir, "dist/mcp/run-stdio.cjs"),
+      join6(dir, "packages/core/dist/mcp/run-stdio.js"),
+      join6(dir, "packages/cli/dist/index.js"),
+      join6(dir, "cli/dist/index.js")
     ];
     for (const p of candidates) {
       if (existsSync6(p) && !isAsarPath(p)) return p;
@@ -1664,6 +1707,7 @@ function toCodexMcpConfigArgs(servers) {
     const env = mcpSpawnEnv(s.env);
     if (env) {
       for (const [key, value] of Object.entries(env)) {
+        if (isCodexSecretEnvKey(key)) continue;
         args.push("-c", `${prefix}.env.${key}=${JSON.stringify(value)}`);
       }
     }
@@ -1722,15 +1766,15 @@ function mcpServersRecord(servers, extraServers) {
 function writeMcpServersConfig(servers, extraServers) {
   const mcpServers = mcpServersRecord(servers, extraServers);
   if (Object.keys(mcpServers).length === 0) return null;
-  const dir = mkdtempSync(join5(tmpdir(), "sideboard-mcp-"));
-  const cfgPath = join5(dir, "mcp.json");
-  writeFileSync2(cfgPath, JSON.stringify({ mcpServers }, null, 2));
+  const dir = mkdtempSync(join6(tmpdir(), "sideboard-mcp-"));
+  const cfgPath = join6(dir, "mcp.json");
+  writeFileSync3(cfgPath, JSON.stringify({ mcpServers }, null, 2), { mode: 384 });
   return cfgPath;
 }
 
 // src/agents/user-mcp-config.ts
 function userClaudeMcpConfigPath() {
-  return join6(homedir3(), ".claude.json");
+  return join7(homedir4(), ".claude.json");
 }
 
 // src/agents/orch-mcp-isolation.ts
@@ -1767,13 +1811,19 @@ function readText(path) {
     return "";
   }
 }
-function userCodexConfigPaths(home = homedir4()) {
-  return [join7(home, ".codex", "config.toml"), join7(home, ".config", "codex", "config.toml")];
+function userCodexConfigPaths(home = homedir5()) {
+  const paths = [
+    join8(home, ".codex", "config.toml"),
+    join8(home, ".config", "codex", "config.toml")
+  ];
+  const codexHome = process.env.CODEX_HOME?.trim();
+  if (codexHome) paths.unshift(join8(codexHome, "config.toml"));
+  return paths;
 }
-function userOpencodeConfigPaths(home = homedir4()) {
+function userOpencodeConfigPaths(home = homedir5()) {
   return [
-    join7(home, ".config", "opencode", "opencode.json"),
-    join7(home, ".config", "opencode", "opencode.jsonc")
+    join8(home, ".config", "opencode", "opencode.json"),
+    join8(home, ".config", "opencode", "opencode.jsonc")
   ];
 }
 function userMcpNamesToDisable(opts) {
@@ -1792,7 +1842,7 @@ function userMcpNamesToDisable(opts) {
   }
   return out;
 }
-function listUserCodexMcpNames(home = homedir4()) {
+function listUserCodexMcpNames(home = homedir5()) {
   const names = [];
   for (const path of userCodexConfigPaths(home)) {
     if (!existsSync8(path)) continue;
@@ -1800,7 +1850,7 @@ function listUserCodexMcpNames(home = homedir4()) {
   }
   return names;
 }
-function listUserOpencodeMcpNames(home = homedir4()) {
+function listUserOpencodeMcpNames(home = homedir5()) {
   const names = [];
   for (const path of userOpencodeConfigPaths(home)) {
     if (!existsSync8(path)) continue;
@@ -1808,12 +1858,12 @@ function listUserOpencodeMcpNames(home = homedir4()) {
   }
   return names;
 }
-function userClaudeMcpConfigObject(home = homedir4()) {
-  const claudePath = home === homedir4() ? userClaudeMcpConfigPath() : join7(home, ".claude.json");
+function userClaudeMcpConfigObject(home = homedir5()) {
+  const claudePath = home === homedir5() ? userClaudeMcpConfigPath() : join8(home, ".claude.json");
   if (!existsSync8(claudePath)) return {};
   return asObject(asObject(readJsonObject(claudePath)).mcpServers);
 }
-function listUserClaudeMcpServerEntries(home = homedir4(), projectDirs) {
+function listUserClaudeMcpServerEntries(home = homedir5(), projectDirs) {
   const out = {};
   for (const [name, entry] of Object.entries(
     listEnabledClaudePluginMcpServers({ home, projectDirs })
@@ -1851,7 +1901,7 @@ function toCodexUnattendedAppsArgs() {
 }
 
 // src/mcp-ui/proxy-http.ts
-import { randomBytes, randomUUID } from "crypto";
+import { randomBytes as randomBytes2, randomUUID } from "crypto";
 import { createServer } from "http";
 import { Server as Server2 } from "@modelcontextprotocol/sdk/server/index.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
@@ -1948,7 +1998,7 @@ function listedTool(tool) {
 
 // src/mcp-ui/proxy-http.ts
 async function listenMcpUiProxy(opts) {
-  const token = randomBytes(24).toString("hex");
+  const token = randomBytes2(24).toString("hex");
   const transports = /* @__PURE__ */ new Map();
   const httpServer = createServer((req, res) => {
     void handle(req, res);
@@ -2321,7 +2371,7 @@ var singleton;
 function getMcpUiHost() {
   if (!singleton) {
     singleton = new McpUiHost({
-      entries: (projectDirs) => listUserClaudeMcpServerEntries(homedir5(), projectDirs)
+      entries: (projectDirs) => listUserClaudeMcpServerEntries(homedir6(), projectDirs)
     });
   }
   return singleton;
@@ -2329,7 +2379,7 @@ function getMcpUiHost() {
 async function proxyClaudeUserMcp(orchestrator, projectDirs) {
   if (orchestrator) return {};
   const dirs = projectDirs.filter((d) => typeof d === "string" && d.length > 0);
-  return getMcpUiHost().proxyEntries(listUserClaudeMcpServerEntries(homedir5(), dirs), dirs);
+  return getMcpUiHost().proxyEntries(listUserClaudeMcpServerEntries(homedir6(), dirs), dirs);
 }
 function dirsKeyFor(projectDirs) {
   if (!projectDirs?.length) return "";
@@ -2343,16 +2393,6 @@ function planModeTurnInstruction(planMode) {
   return planMode ? PLAN_MODE_INSTRUCTION : PLAN_MODE_OFF_INSTRUCTION;
 }
 function permissionMode(thread) {
-  if (thread.sourceType === "orchestration") {
-    return {
-      claude: "acceptEdits",
-      opencodePermission: JSON.stringify({
-        edit: "allow",
-        bash: { "*": "allow", "rm -rf *": "deny" }
-      }),
-      codexSandbox: "danger-full-access"
-    };
-  }
   if (thread.planMode) {
     return {
       claude: "plan",
@@ -2364,6 +2404,18 @@ function permissionMode(thread) {
       codexSandbox: "read-only"
     };
   }
+  if (thread.sourceType === "orchestration") {
+    return {
+      claude: "acceptEdits",
+      // Unattended coordinators cannot answer permission prompts. Explicit
+      // allows override the user's OpenCode denies for this process only.
+      opencodePermission: JSON.stringify({
+        edit: "allow",
+        bash: { "*": "allow" }
+      }),
+      codexSandbox: "danger-full-access"
+    };
+  }
   if (thread.autonomy === "full") {
     return {
       claude: "bypassPermissions",
@@ -2373,19 +2425,16 @@ function permissionMode(thread) {
   }
   return {
     claude: "acceptEdits",
-    opencodePermission: JSON.stringify({
-      edit: "allow",
-      bash: { "*": "allow", "rm -rf *": "deny" }
-    }),
+    opencodePermission: JSON.stringify({}),
     codexSandbox: "workspace-write"
   };
 }
 
 // src/agent-rpc/metadata.ts
-import { existsSync as existsSync9, readFileSync as readFileSync5, unlinkSync, writeFileSync as writeFileSync4 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync5, unlinkSync, writeFileSync as writeFileSync5 } from "fs";
+import { join as join9 } from "path";
 function agentRuntimeMetadataPath() {
-  return join8(appDataDir(), "agent-runtime.json");
+  return join9(appDataDir(), "agent-runtime.json");
 }
 function readAgentRuntimeMetadata() {
   try {
@@ -2454,7 +2503,7 @@ function agentRpcChildEnv(rpc, cwd) {
 // src/agents/claude-host.ts
 import { existsSync as existsSync10 } from "fs";
 import { createRequire as createRequire2 } from "module";
-import { dirname as dirname4, join as join9 } from "path";
+import { dirname as dirname4, join as join10 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/agent-rpc/client.ts
@@ -2499,17 +2548,17 @@ function entryDir() {
 function claudeRunnerPath() {
   const packagedDir = packagedCursorRuntimeDir();
   if (packagedDir) {
-    const packaged = join9(packagedDir, "core-dist", "agents", "claude-runner.js");
+    const packaged = join10(packagedDir, "core-dist", "agents", "claude-runner.js");
     if (existsSync10(packaged)) return packaged;
   }
   const root = entryDir();
   const candidates = [
-    join9(root, "agents", "claude-runner.js"),
-    join9(root, "agents", "claude-runner.cjs"),
-    join9(root, "dist", "agents", "claude-runner.js"),
-    join9(root, "dist", "agents", "claude-runner.cjs"),
-    join9(root, "claude-runner.ts"),
-    join9(root, "src", "agents", "claude-runner.ts")
+    join10(root, "agents", "claude-runner.js"),
+    join10(root, "agents", "claude-runner.cjs"),
+    join10(root, "dist", "agents", "claude-runner.js"),
+    join10(root, "dist", "agents", "claude-runner.cjs"),
+    join10(root, "claude-runner.ts"),
+    join10(root, "src", "agents", "claude-runner.ts")
   ];
   for (const candidate of candidates) {
     if (existsSync10(candidate)) return candidate;
@@ -2588,7 +2637,8 @@ function sessionCostUsdFromClaudeResult(obj) {
 function claudeResultErrorDetail(obj) {
   const isError = Boolean(obj.is_error) || typeof obj.subtype === "string" && /^error/i.test(obj.subtype);
   const fromResult = typeof obj.result === "string" ? obj.result.trim() : "";
-  if (fromResult && (isError || looksLikeAgentFailureMessage(fromResult))) {
+  const shortFailure = fromResult.length > 0 && fromResult.length <= 300 && !fromResult.includes("\n") && looksLikeAgentFailureMessage(fromResult);
+  if (fromResult && (isError || shortFailure)) {
     return fromResult;
   }
   if (!isError) return null;
@@ -2835,7 +2885,7 @@ function eventsFromClaudeSystem(obj) {
       data: `Context compressed${trigger}`,
       replace: true
     };
-    if (meta.postTokens != null && meta.postTokens > 0) {
+    if (meta.postTokens != null && meta.postTokens > 0 && !parentId) {
       return [
         thinking,
         {
@@ -2916,7 +2966,7 @@ var claudeAdapter = {
       );
     }
     const mode = permissionMode(thread);
-    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-A6UO6PJV.js");
+    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-FPDZKUPF.js");
     const isOrchestrator = isOrchestratorThread2(thread);
     const rpc = worktreeAgentRpc(isOrchestrator);
     const injectedServers = await buildInjectedMcpServers({
@@ -3016,6 +3066,7 @@ var claudeAdapter = {
       cwd: thread.worktreePath,
       stdin: useStdin ? `${promptText}
 ` : void 0,
+      ...mcpConfigPath ? { cleanupDirs: [dirname5(mcpConfigPath)] } : {},
       // Nested Task/Agent thinking+text in stream-json (Claude Code 2.1.211+).
       // Raise the -p background-agent wait so long TaskOutput polls are not
       // abandoned at Claude Code’s 10-minute default.
@@ -3045,9 +3096,17 @@ var claudeAdapter = {
           Array.isArray(message?.content) ? message.content : void 0,
           parentId
         );
-        if (obj.type === "assistant") {
+        if (obj.type === "assistant" && !parentId) {
           const usage = usageFromClaude(message?.usage);
-          if (usage) events.push({ type: "usage", data: usage, scope: "request" });
+          const messageId = message && typeof message.id === "string" ? message.id : void 0;
+          if (usage) {
+            events.push({
+              type: "usage",
+              data: usage,
+              scope: "request",
+              ...messageId ? { messageId } : {}
+            });
+          }
         }
         if (events.length === 0) return null;
         return events.length === 1 ? events[0] : events;
@@ -3134,56 +3193,47 @@ var claudeAdapter = {
     return { file: claude, args, cwd: thread.worktreePath };
   },
   async listLinearIssues(_repoPath) {
-    const claude = resolveClaudeExecutable();
-    const prompt = "List my assigned Linear issues as JSON array only, no markdown. Each item: id, identifier, title, url, labels (string[]).";
-    const { stdout, exitCode } = await run(
-      claude,
-      [
-        "-p",
-        prompt,
-        "--output-format",
-        "json",
-        "--permission-mode",
-        "bypassPermissions",
-        "--allowedTools",
-        "mcp__linear__*"
-      ],
-      { reject: false }
-    );
-    if (exitCode !== 0) return [];
-    return parseIssuesJson(stdout);
+    const { listAssignedLinearIssues: listAssignedLinearIssues2 } = await import("./linear-list-Q4M7AZO2.js");
+    return listAssignedLinearIssues2();
   }
 };
-function parseIssuesJson(raw) {
-  const text = raw.trim();
-  const candidates = [text];
-  const match = text.match(/\[[\s\S]*\]/);
-  if (match) candidates.push(match[0]);
-  for (const c of candidates) {
-    try {
-      const parsed = JSON.parse(c);
-      if (Array.isArray(parsed)) {
-        return parsed.map((item) => ({
-          id: String(item.id ?? item.identifier ?? ""),
-          identifier: String(item.identifier ?? item.id ?? ""),
-          title: String(item.title ?? ""),
-          url: String(item.url ?? ""),
-          labels: Array.isArray(item.labels) ? item.labels.map(String) : []
-        }));
-      }
-      if (parsed && typeof parsed === "object" && typeof parsed.result === "string") {
-        return parseIssuesJson(parsed.result);
-      }
-    } catch {
+
+// src/agents/codex.ts
+import { existsSync as existsSync12, statSync as statSync2 } from "fs";
+import { homedir as homedir7 } from "os";
+import { join as join11 } from "path";
+
+// src/agents/codex-items.ts
+function eventsFromCodexItem(eventType, item) {
+  const itemType = item.type ?? item.item_type;
+  if (itemType === "reasoning" && typeof item.text === "string" && item.text) {
+    return { type: "thinking", data: item.text };
+  }
+  if (itemType !== "file_change" || !item.id) return null;
+  const changes = Array.isArray(item.changes) ? item.changes : [];
+  const paths = changes.map((change) => typeof change?.path === "string" ? change.path : "").filter(Boolean);
+  const added = changes.some((change) => change?.kind === "add");
+  const events = [
+    {
+      type: "tool_use",
+      id: item.id,
+      name: added ? "Write" : "Edit",
+      input: paths.length ? { paths } : void 0
     }
+  ];
+  const finished = eventType === "item.completed" || item.status === "completed" || item.status === "failed";
+  if (finished) {
+    events.push({
+      type: "tool_result",
+      id: item.id,
+      content: paths.join("\n") || void 0,
+      isError: item.status === "failed"
+    });
   }
-  return [];
+  return events.length === 1 ? events[0] : events;
 }
 
 // src/agents/codex.ts
-import { existsSync as existsSync12, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
-import { homedir as homedir6 } from "os";
-import { join as join10 } from "path";
 var CODEX_PROMPT_ARG_MAX = 2e5;
 var FALLBACK_CODEX_MODELS = [
   { id: "gpt-5.6-sol", displayName: "GPT-5.6 Sol" },
@@ -3228,25 +3278,19 @@ async function listCodexModels() {
     return cachedCodexModels?.models ?? FALLBACK_CODEX_MODELS;
   }
 }
-function usageFromCodex(usage) {
+function usageFromCodex(usage, asContext = false) {
   if (!usage) return null;
-  return fromInclusiveInputUsage({
+  const mapped = fromInclusiveInputUsage({
     inputTokens: Number(usage.input_tokens ?? 0),
     outputTokens: Number(usage.output_tokens ?? 0),
     cachedInputTokens: Number(usage.cached_input_tokens ?? 0)
   });
+  if (!mapped || !asContext) return mapped;
+  const occ = requestOccupancy(mapped);
+  return occ > 0 ? { ...mapped, lastRequestTokens: occ } : mapped;
 }
-function codexConfigHasNetworkAccess() {
-  const candidates = [
-    join10(homedir6(), ".codex", "config.toml"),
-    join10(homedir6(), ".config", "codex", "config.toml")
-  ];
-  for (const path of candidates) {
-    if (!existsSync12(path)) continue;
-    const text = readFileSync6(path, "utf8");
-    if (/network_access\s*=\s*true/.test(text)) return true;
-  }
-  return false;
+function codexHomeDir() {
+  return process.env.CODEX_HOME?.trim() || join11(homedir7(), ".codex");
 }
 function unwrapCodexMcpResult(result) {
   if (result == null) return void 0;
@@ -3275,7 +3319,7 @@ function asRecord3(value) {
   return void 0;
 }
 function codexLooksAuthenticated() {
-  const authPath = join10(homedir6(), ".codex", "auth.json");
+  const authPath = join11(codexHomeDir(), "auth.json");
   if (!existsSync12(authPath)) return false;
   try {
     return statSync2(authPath).size > 2;
@@ -3314,18 +3358,13 @@ var codexAdapter = {
     const authenticated = codexLooksAuthenticated();
     const linearMcp = false;
     const warnings = [];
-    if (!codexConfigHasNetworkAccess()) {
-      warnings.push(
-        "Codex workspace-write blocks network by default \u2014 set [sandbox_workspace_write] network_access = true in ~/.codex/config.toml if agents need npm install etc."
-      );
-    }
     return {
       agent: "codex",
       installed: true,
       authenticated,
       linearMcp,
       warnings,
-      reason: authenticated ? void 0 : "Codex auth not found \u2014 run `codex login` (expected ~/.codex/auth.json)"
+      reason: authenticated ? void 0 : `Codex auth not found \u2014 run \`codex login\` (expected ${join11(codexHomeDir(), "auth.json")})`
     };
   },
   async buildTurn(thread, input) {
@@ -3350,6 +3389,12 @@ var codexAdapter = {
       threadId: thread.id
     });
     const isolatePlugins = isOrchestrator || Boolean(thread.isolateCodexPlugins) || Boolean(normalizeTurnInput(input).isolateCodexPlugins);
+    const gitEnv = await resolveAgentGitAuthEnv(process.env, {
+      cwd: thread.worktreePath
+    });
+    const writableRoots = mode.codexSandbox === "workspace-write" ? await resolveCodexGitWritableRoots(thread.worktreePath) : [];
+    const secretProfile = writeCodexMcpSecretProfile(injected);
+    const effort = thread.effort?.trim() ?? "";
     const mcpOverrides = [
       // Worktree first try keeps plugins (Claude connectors). Coordinators
       // isolate. After a fatal plugin MCP, the orchestrator retries with
@@ -3366,6 +3411,7 @@ var codexAdapter = {
     const execOpts = [
       // Global orchestration cwd is not a git repo; without this Codex ≥0.147
       // refuses to start ("Not inside a trusted directory").
+      ...secretProfile ? ["-p", secretProfile.profile] : [],
       "--skip-git-repo-check",
       "--cd",
       thread.worktreePath,
@@ -3375,14 +3421,16 @@ var codexAdapter = {
       // `codex exec` rejects `--ask-for-approval` (global-only on newer CLIs).
       "-c",
       'approval_policy="never"',
-      // Seatbelt cannot use the login Keychain; inherit GH_CONFIG_DIR / GIT_CONFIG_*.
-      // Default policy also strips *TOKEN*. Linked worktrees need the main
-      // repo `.git` (+ `.git/worktrees/<name>`) as writable_roots so git commit
-      // can create index.lock.
+      // Seatbelt cannot use the login Keychain. inherit=all keeps GH_CONFIG_DIR
+      // and GIT_CONFIG_*. Default excludes still strip *TOKEN*/*SECRET*/*KEY*;
+      // GIT_CONFIG_KEY_n is re-set because it matches *KEY*. Linked worktrees
+      // need the main repo `.git` as writable_roots so git commit can lock.
       ...codexUnattendedGitConfigArgs(mode.codexSandbox, {
-        writableRoots: mode.codexSandbox === "workspace-write" ? await resolveCodexGitWritableRoots(thread.worktreePath) : []
+        writableRoots,
+        preserveEnv: gitEnv
       }),
       ...model ? ["--model", model] : [],
+      ...effort ? ["-c", `model_reasoning_effort=${JSON.stringify(effort)}`] : [],
       ...mcpOverrides
     ];
     const args = sessionId ? ["exec", ...execOpts, "resume", sessionId, promptArg] : ["exec", ...execOpts, promptArg];
@@ -3391,7 +3439,8 @@ var codexAdapter = {
       args,
       cwd: thread.worktreePath,
       stdin: useStdin ? `${prompt}
-` : void 0
+` : void 0,
+      ...secretProfile ? { cleanupDirs: [secretProfile.file] } : {}
     };
   },
   parseEvent(line) {
@@ -3412,8 +3461,10 @@ var codexAdapter = {
       if (typeof obj.item === "object" && obj.item !== null) {
         const item = obj.item;
         const itemType = item.type ?? item.item_type;
+        const mapped = eventsFromCodexItem(type, item);
+        if (mapped) return mapped;
         if (itemType === "error") {
-          const detail = item.message?.trim() || extractJsonErrorMessage(obj) || "Codex item error";
+          const detail = (typeof item.message === "string" ? item.message.trim() : "") || extractJsonErrorMessage(obj) || "Codex item error";
           return { type: "stderr", data: detail };
         }
         if (itemType === "agent_message" && item.text) {
@@ -3442,14 +3493,14 @@ var codexAdapter = {
           const events = [
             { type: "tool_use", id: item.id, name: "Bash", input }
           ];
-          const finished = type === "item.completed" || item.status === "completed" || item.status === "failed";
+          const finished = type === "item.completed" || item.status === "completed" || item.status === "failed" || item.status === "declined";
           const output = typeof item.aggregated_output === "string" && item.aggregated_output ? item.aggregated_output : void 0;
           if (finished) {
             events.push({
               type: "tool_result",
               id: item.id,
               content: output,
-              isError: item.status === "failed"
+              isError: item.status === "failed" || item.status === "declined"
             });
           } else if (output) {
             events.push({
@@ -3492,7 +3543,7 @@ var codexAdapter = {
           return events.length === 1 ? events[0] : events;
         }
         if (item.status === "failed") {
-          const detail = item.message?.trim() || extractJsonErrorMessage(item) || `Codex ${itemType ?? "item"} failed`;
+          const detail = (typeof item.message === "string" ? item.message.trim() : "") || extractJsonErrorMessage(item) || `Codex ${itemType ?? "item"} failed`;
           return { type: "stderr", data: detail };
         }
       }
@@ -3501,7 +3552,8 @@ var codexAdapter = {
         return { type: "session_id", data: sid };
       }
       if (type === "turn.completed" || type === "turn_completed") {
-        const usage = usageFromCodex(obj.usage);
+        const payload = obj;
+        const usage = payload.last_token_usage ? usageFromCodex(payload.last_token_usage, true) : usageFromCodex(payload.usage);
         return usage ? { type: "usage", data: usage, scope: "turn" } : null;
       }
       if (typeof obj.content === "string" && obj.content.trim()) {
@@ -3524,7 +3576,7 @@ var codexAdapter = {
     if (sessionId) {
       return {
         file: codex,
-        args: ["exec", "--cd", thread.worktreePath, "resume", sessionId],
+        args: ["resume", sessionId],
         cwd: thread.worktreePath
       };
     }
@@ -3535,56 +3587,34 @@ var codexAdapter = {
     };
   },
   async listLinearIssues(_repoPath) {
-    const prompt = "List my assigned Linear issues as JSON array only: id, identifier, title, url, labels.";
-    const { stdout, exitCode } = await run(
-      resolveAgentExecutable("codex"),
-      [
-        "exec",
-        "--json",
-        "--sandbox",
-        "read-only",
-        "-c",
-        'approval_policy="never"',
-        prompt
-      ],
-      { reject: false }
-    );
-    if (exitCode !== 0) return [];
-    const match = stdout.match(/\[[\s\S]*\]/);
-    if (!match) return [];
-    try {
-      const parsed = JSON.parse(match[0]);
-      return Array.isArray(parsed) ? parsed : [];
-    } catch {
-      return [];
-    }
+    return listAssignedLinearIssues();
   }
 };
 
 // src/agents/cursor.ts
 import { existsSync as existsSync15 } from "fs";
 import { createRequire as createRequire5 } from "module";
-import { dirname as dirname7, join as join13 } from "path";
+import { dirname as dirname8, join as join14 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 
 // src/agents/cursor-sdk-resolve.ts
-import { existsSync as existsSync13, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync6 } from "fs";
 import { createRequire as createRequire3 } from "module";
-import { basename, dirname as dirname5, join as join11 } from "path";
+import { basename, dirname as dirname6, join as join12 } from "path";
 import { fileURLToPath as fileURLToPath3, pathToFileURL } from "url";
 var CURSOR_SDK_INSTALL_HINT = "Cursor SDK is not installed. Settings \u2192 Agents \u2192 Cursor \u2192 Install (`npm i -g @cursor/sdk`). Sideboard does not ship the SDK \u2014 update it anytime without a new Sideboard build.";
 function thisModuleFile() {
   const cjsDir = typeof __dirname !== "undefined" ? __dirname : "";
-  if (cjsDir) return join11(cjsDir, "cursor-sdk-resolve.js");
+  if (cjsDir) return join12(cjsDir, "cursor-sdk-resolve.js");
   try {
     return fileURLToPath3(import.meta.url);
   } catch {
-    return join11(process.cwd(), "package.json");
+    return join12(process.cwd(), "package.json");
   }
 }
 function packageRootLooksLikeSdk(dir) {
   try {
-    const raw = readFileSync7(join11(dir, "package.json"), "utf8");
+    const raw = readFileSync6(join12(dir, "package.json"), "utf8");
     const pkg = JSON.parse(raw);
     return pkg.name === "@cursor/sdk" && existsSync13(dir);
   } catch {
@@ -3595,7 +3625,7 @@ function resolvedPackageRoot(fromFile) {
   try {
     const req = createRequire3(fromFile);
     const pkgJson = req.resolve("@cursor/sdk/package.json");
-    const root = dirname5(pkgJson);
+    const root = dirname6(pkgJson);
     return packageRootLooksLikeSdk(root) ? root : null;
   } catch {
     return null;
@@ -3609,10 +3639,10 @@ function resolveCursorSdkRoot(opts) {
   }
   const globalNm = npmGlobalNodeModules(env);
   if (globalNm) {
-    const globalRoot = join11(globalNm, "@cursor/sdk");
+    const globalRoot = join12(globalNm, "@cursor/sdk");
     if (packageRootLooksLikeSdk(globalRoot)) return globalRoot;
   }
-  const cwdPkg = join11(process.cwd(), "package.json");
+  const cwdPkg = join12(process.cwd(), "package.json");
   return resolvedPackageRoot(thisModuleFile()) ?? resolvedPackageRoot(cwdPkg);
 }
 function isCursorSdkInstalled(opts) {
@@ -3628,12 +3658,12 @@ function exportTarget(value) {
 }
 function cursorSdkEsmEntry(root) {
   try {
-    const pkg = JSON.parse(readFileSync7(join11(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync6(join12(root, "package.json"), "utf8"));
     const exp = pkg.exports;
     const dot = exp && typeof exp === "object" && !Array.isArray(exp) && "." in exp ? exp["."] : exp;
     const rel = exportTarget(dot) ?? (typeof pkg.module === "string" ? pkg.module : null);
     if (!rel) return null;
-    const entry = join11(root, rel);
+    const entry = join12(root, rel);
     return existsSync13(entry) ? entry : null;
   } catch {
     return null;
@@ -3650,7 +3680,7 @@ async function importCursorSdk(opts) {
   try {
     let entry = cursorSdkEsmEntry(root);
     if (!entry) {
-      const req = createRequire3(join11(root, "package.json"));
+      const req = createRequire3(join12(root, "package.json"));
       entry = req.resolve("@cursor/sdk");
     }
     return unwrapCursorSdkModule(await import(pathToFileURL(entry).href));
@@ -3662,8 +3692,8 @@ function cursorSdkPlatformRipgrepPackage() {
   return `@cursor/sdk-${process.platform}-${process.arch}`;
 }
 function nodeModulesDirForPackageRoot(packageRoot) {
-  const parent = dirname5(packageRoot);
-  return basename(parent).startsWith("@") ? dirname5(parent) : parent;
+  const parent = dirname6(packageRoot);
+  return basename(parent).startsWith("@") ? dirname6(parent) : parent;
 }
 function cursorSdkRipgrepCandidate(opts) {
   const root = resolveCursorSdkRoot(opts);
@@ -3671,9 +3701,9 @@ function cursorSdkRipgrepCandidate(opts) {
   const nm = nodeModulesDirForPackageRoot(root);
   const pkg = cursorSdkPlatformRipgrepPackage();
   const bin = process.platform === "win32" ? "rg.exe" : "rg";
-  const sibling = join11(nm, pkg, "bin", bin);
+  const sibling = join12(nm, pkg, "bin", bin);
   if (existsSync13(sibling)) return sibling;
-  const nested = join11(root, "node_modules", pkg, "bin", bin);
+  const nested = join12(root, "node_modules", pkg, "bin", bin);
   return existsSync13(nested) ? nested : null;
 }
 
@@ -3702,7 +3732,8 @@ function preferredCursorCostCents(cost) {
 }
 function turnCostUsdFromCursorUsage(before, after) {
   if (!after) return void 0;
-  const beforeIds = new Set((before?.runs ?? []).map((r) => r.runId));
+  if (before == null) return void 0;
+  const beforeIds = new Set((before.runs ?? []).map((r) => r.runId));
   const newRuns = (after.runs ?? []).filter((r) => !beforeIds.has(r.runId));
   let sum = 0;
   let any = false;
@@ -3714,7 +3745,6 @@ function turnCostUsdFromCursorUsage(before, after) {
     }
   }
   if (any) return sum / 100;
-  if (before == null) return void 0;
   const afterCents = preferredCursorCostCents(after.cost);
   if (afterCents == null) return void 0;
   const beforeCents = preferredCursorCostCents(before.cost) ?? 0;
@@ -3857,7 +3887,7 @@ function cursorSdkMessageToEvents(msg) {
   }
   if (msg.type === "usage") {
     const usage = usageFromCursor(msg.usage);
-    if (usage) return [{ type: "usage", data: usage, scope: "request" }];
+    if (usage) return [{ type: "usage", data: usage, scope: "turn" }];
   }
   if (msg.type === "status" && msg.status === "ERROR") {
     const rawMessage = msg.message;
@@ -3891,7 +3921,7 @@ function parseCursorRunnerLine(line) {
 // src/agents/cursor-ripgrep.ts
 import { existsSync as existsSync14 } from "fs";
 import { createRequire as createRequire4 } from "module";
-import { dirname as dirname6, isAbsolute as isAbsolute2, join as join12, parse, resolve as resolvePath } from "path";
+import { dirname as dirname7, isAbsolute as isAbsolute2, join as join13, parse, resolve as resolvePath } from "path";
 var RIPGREP_ENV = "CURSOR_RIPGREP_PATH";
 function rgBinaryName() {
   return process.platform === "win32" ? "rg.exe" : "rg";
@@ -3910,12 +3940,12 @@ function walkForBundledRipgrep(startFile) {
   if (!startFile) return null;
   const pkg = platformRipgrepPackage();
   const name = rgBinaryName();
-  let dir = dirname6(resolvePath(startFile));
+  let dir = dirname7(resolvePath(startFile));
   const root = parse(dir).root;
   while (dir !== root) {
-    const hit = usableRipgrepPath(join12(dir, "node_modules", pkg, "bin", name));
+    const hit = usableRipgrepPath(join13(dir, "node_modules", pkg, "bin", name));
     if (hit) return hit;
-    const next = dirname6(dir);
+    const next = dirname7(dir);
     if (next === dir) break;
     dir = next;
   }
@@ -3925,7 +3955,7 @@ function requireResolveBundledRipgrep(fromFile) {
   try {
     const req = createRequire4(fromFile);
     const pkgJson = req.resolve(`${platformRipgrepPackage()}/package.json`);
-    return usableRipgrepPath(join12(dirname6(pkgJson), "bin", rgBinaryName()));
+    return usableRipgrepPath(join13(dirname7(pkgJson), "bin", rgBinaryName()));
   } catch {
     return null;
   }
@@ -3999,11 +4029,11 @@ function entryDir2() {
   const cjsDir = typeof __dirname !== "undefined" ? __dirname : "";
   if (cjsDir) return cjsDir;
   try {
-    return dirname7(fileURLToPath4(import.meta.url));
+    return dirname8(fileURLToPath4(import.meta.url));
   } catch {
     try {
       const req = createRequire5(process.cwd() + "/");
-      return dirname7(req.resolve("@sideboard-ai/core"));
+      return dirname8(req.resolve("@sideboard-ai/core"));
     } catch {
       return process.cwd();
     }
@@ -4014,14 +4044,14 @@ function cursorRunnerPath() {
   if (packaged) return packaged;
   const root = entryDir2();
   const candidates = [
-    join13(root, "agents", "cursor-runner.js"),
-    join13(root, "agents", "cursor-runner.cjs"),
+    join14(root, "agents", "cursor-runner.js"),
+    join14(root, "agents", "cursor-runner.cjs"),
     // If somehow resolved from package root instead of dist/
-    join13(root, "dist", "agents", "cursor-runner.js"),
-    join13(root, "dist", "agents", "cursor-runner.cjs"),
+    join14(root, "dist", "agents", "cursor-runner.js"),
+    join14(root, "dist", "agents", "cursor-runner.cjs"),
     // Source tree (dev): packages/core/src/agents/cursor-runner.ts
-    join13(root, "cursor-runner.ts"),
-    join13(root, "src", "agents", "cursor-runner.ts")
+    join14(root, "cursor-runner.ts"),
+    join14(root, "src", "agents", "cursor-runner.ts")
   ];
   for (const candidate of candidates) {
     if (existsSync15(candidate)) return candidate;
@@ -4062,6 +4092,7 @@ var cursorAdapter = {
   },
   async buildTurn(thread, input) {
     const agentId = await this.resolveSessionId(thread.worktreePath, thread.sessionId);
+    const fullPrompt = flattenTurnInput(input);
     const prompt = flattenTurnInput(dropCachedPrefixOnResume(input, agentId));
     const apiKey = resolveCursorApiKey() || void 0;
     const isOrchestrator = isOrchestratorThread(thread);
@@ -4078,6 +4109,7 @@ var cursorAdapter = {
     const mcpServers = toCursorMcpServers(injected);
     const req = {
       prompt,
+      ...fullPrompt !== prompt ? { freshPrompt: fullPrompt } : {},
       cwd: thread.worktreePath,
       threadId: thread.id,
       agentId,
@@ -4104,8 +4136,9 @@ var cursorAdapter = {
       stdin: JSON.stringify(req),
       env: {
         ...launch.env,
-        ...cursorRipgrepEnv({ startFile: runner }),
-        ...apiKey ? { CURSOR_API_KEY: apiKey } : {}
+        ...cursorRipgrepEnv({ startFile: runner })
+        // API key stays on the stdin request. Do not copy it into the child env,
+        // where `ps` and crash dumps can see it. The runner reads `req.apiKey`.
       }
     };
   },
@@ -4127,14 +4160,17 @@ var cursorAdapter = {
 };
 
 // src/agents/opencode.ts
-import { existsSync as existsSync16 } from "fs";
+import { existsSync as existsSync17 } from "fs";
+
+// src/agent-rpc/opencode-host.ts
+import { pathToFileURL as pathToFileURL2 } from "url";
 
 // src/agent-rpc/opencode-hook.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync5 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync4, readFileSync as readFileSync7, renameSync, writeFileSync as writeFileSync6 } from "fs";
+import { join as join15 } from "path";
 var OPENCODE_PLUGIN_SOURCE = `import { tool } from "@opencode-ai/plugin"
 
-const URL = process.env[${JSON.stringify(AGENT_RPC_URL_ENV)}] || ""
+const RPC_URL = process.env[${JSON.stringify(AGENT_RPC_URL_ENV)}] || ""
 const TOKEN = process.env[${JSON.stringify(AGENT_RPC_TOKEN_ENV)}] || ""
 const CWD = process.env[${JSON.stringify(AGENT_RPC_CWD_ENV)}] || ""
 
@@ -4147,24 +4183,29 @@ function jsonError(err) {
 }
 
 function socketUrl() {
-  const u = new URL(URL)
+  const u = new URL(RPC_URL)
   u.searchParams.set(${JSON.stringify(AGENT_RPC_TOKEN_QUERY)}, TOKEN)
   return u.toString()
 }
 
 function call(method, params) {
-  if (!URL || !TOKEN) {
+  if (!RPC_URL || !TOKEN) {
     return Promise.resolve(jsonError(new Error("Agent RPC runtime is not running")))
   }
+  const timeoutMs = method === "job.wait" ? 130000 : 30000
   return new Promise((resolve) => {
     let settled = false
+    let ws
+    let timer
     const done = (value) => {
       if (settled) return
       settled = true
+      clearTimeout(timer)
       try { ws.close() } catch {}
       resolve(value)
     }
-    const ws = new WebSocket(socketUrl())
+    timer = setTimeout(() => done(jsonError(new Error("Agent RPC timed out"))), timeoutMs)
+    ws = new WebSocket(socketUrl())
     const id = Date.now()
     ws.addEventListener("open", () => {
       ws.send(JSON.stringify({ jsonrpc: "2.0", id, method, params, authToken: TOKEN }))
@@ -4236,12 +4277,19 @@ export const SideboardRpc = async (ctx) => {
 }
 `;
 function writeOpencodeRpcPlugin() {
-  const configDir = join14(appDataDir(), "agent-rpc", "opencode");
-  const pluginDir = join14(configDir, "plugins");
-  mkdirSync3(pluginDir, { recursive: true });
-  const pluginFile = join14(pluginDir, "sideboard-rpc.js");
-  writeFileSync5(pluginFile, OPENCODE_PLUGIN_SOURCE);
-  return { configDir, pluginFile };
+  const pluginDir = join15(appDataDir(), "agent-rpc", "opencode");
+  mkdirSync4(pluginDir, { recursive: true });
+  const pluginFile = join15(pluginDir, "sideboard-rpc.js");
+  if (existsSync16(pluginFile)) {
+    try {
+      if (readFileSync7(pluginFile, "utf8") === OPENCODE_PLUGIN_SOURCE) return pluginFile;
+    } catch {
+    }
+  }
+  const tmp = `${pluginFile}.${process.pid}.tmp`;
+  writeFileSync6(tmp, OPENCODE_PLUGIN_SOURCE);
+  renameSync(tmp, pluginFile);
+  return pluginFile;
 }
 
 // src/agent-rpc/opencode-host.ts
@@ -4264,10 +4312,9 @@ async function buildOpencodeHostEnv(thread) {
   const config = injected.length > 0 || disableNames.length > 0 ? JSON.parse(toOpencodeMcpConfigContent(injected, { disableNames })) : {};
   const env = {};
   if (rpc) {
-    const { configDir, pluginFile } = writeOpencodeRpcPlugin();
-    env.OPENCODE_CONFIG_DIR = configDir;
+    const pluginFile = writeOpencodeRpcPlugin();
     Object.assign(env, agentRpcChildEnv(rpc, thread.worktreePath));
-    config.plugin = [pluginFile];
+    config.plugin = [pathToFileURL2(pluginFile).href];
   }
   if (Object.keys(config).length > 0) {
     env.OPENCODE_CONFIG_CONTENT = JSON.stringify(config);
@@ -4334,7 +4381,7 @@ async function listOpencodeModels() {
   if (opencode === "opencode") {
     const which = await run("which", ["opencode"], { reject: false });
     if (which.exitCode !== 0) return FALLBACK_OPENCODE_MODELS;
-  } else if (!existsSync16(opencode)) {
+  } else if (!existsSync17(opencode)) {
     return FALLBACK_OPENCODE_MODELS;
   }
   const listed = await run(opencode, ["models"], { reject: false });
@@ -4369,7 +4416,7 @@ var opencodeAdapter = {
   async detect() {
     const opencode = resolveAgentExecutable("opencode");
     if (opencode !== "opencode") {
-      if (!existsSync16(opencode)) {
+      if (!existsSync17(opencode)) {
         return {
           agent: "opencode",
           installed: false,
@@ -4423,6 +4470,11 @@ var opencodeAdapter = {
     if (model) {
       args.push("--model", model);
     }
+    args.push("--thinking");
+    const variant = thread.effort?.trim() ?? "";
+    if (variant && /^(minimal|low|medium|high|max|xhigh)$/i.test(variant)) {
+      args.push("--variant", variant);
+    }
     const hostEnv = await buildOpencodeHostEnv(thread);
     return {
       file: resolveAgentExecutable("opencode"),
@@ -4455,6 +4507,10 @@ var opencodeAdapter = {
         const text = obj.part?.text ?? obj.text;
         if (text) return { type: "stdout", data: text };
       }
+      if (obj.type === "reasoning" || obj.type === "thinking") {
+        const text = obj.part?.text ?? obj.text;
+        if (typeof text === "string" && text) return { type: "thinking", data: text };
+      }
       if (obj.type === "tool_use") {
         const part = obj.part;
         const name = part?.tool ?? part?.name ?? obj.tool ?? obj.name ?? "tool";
@@ -4570,11 +4626,14 @@ var opencodeAdapter = {
     const listed = await run(
       resolveAgentExecutable("opencode"),
       ["session", "list", "--format", "json"],
-      { cwd: worktreePath, reject: false }
+      { cwd: worktreePath, reject: false, timeoutMs: 8e3 }
     );
-    if (listed.exitCode === 0 && listed.stdout.trim()) {
+    if (listed.exitCode === 0) {
+      const raw = listed.stdout.trim();
+      if (!raw) return null;
       try {
-        const sessions = JSON.parse(listed.stdout);
+        const sessions = JSON.parse(raw);
+        if (Array.isArray(sessions) && sessions.length === 0) return null;
         if (Array.isArray(sessions) && sessions.length > 0) {
           const norm = (p) => p.replace(/\/+$/, "");
           const wt = norm(worktreePath);
@@ -4608,34 +4667,8 @@ var opencodeAdapter = {
     };
   },
   async listLinearIssues(_repoPath) {
-    const prompt = "List my assigned Linear issues as JSON array only: id, identifier, title, url, labels.";
-    const { stdout, exitCode } = await run(
-      resolveAgentExecutable("opencode"),
-      ["run", prompt, "--format", "json"],
-      {
-        reject: false,
-        env: { OPENCODE_PERMISSION: JSON.stringify({ "*": "allow" }) }
-      }
-    );
-    if (exitCode !== 0) return [];
-    const texts = [];
-    for (const line of stdout.split("\n")) {
-      try {
-        const obj = JSON.parse(line);
-        if (obj.type === "text") {
-          texts.push(obj.part?.text ?? obj.text ?? "");
-        }
-      } catch {
-      }
-    }
-    const joined = texts.join("");
-    const match = joined.match(/\[[\s\S]*\]/);
-    if (!match) return [];
-    try {
-      return JSON.parse(match[0]);
-    } catch {
-      return [];
-    }
+    const { listAssignedLinearIssues: listAssignedLinearIssues2 } = await import("./linear-list-Q4M7AZO2.js");
+    return listAssignedLinearIssues2();
   }
 };
 
@@ -5034,9 +5067,9 @@ function formatClaudeUsageOverLimitWait(windows, now = /* @__PURE__ */ new Date(
 }
 
 // src/agents/claude-usage-client.ts
-import { existsSync as existsSync17, readFileSync as readFileSync8 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join15 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync8 } from "fs";
+import { homedir as homedir8 } from "os";
+import { join as join16 } from "path";
 var CLAUDE_OAUTH_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
 var CLAUDE_USAGE_TTL_MS = 9e4;
 var CLAUDE_USAGE_ERROR_TTL_MS = 5 * 6e4;
@@ -5076,12 +5109,12 @@ function accessTokenFromCredentialsJson(raw) {
   }
 }
 function claudeCredentialsPath(configDir) {
-  const root = configDir?.trim() || process.env.CLAUDE_CONFIG_DIR?.trim() || join15(homedir7(), ".claude");
-  return join15(root, ".credentials.json");
+  const root = configDir?.trim() || process.env.CLAUDE_CONFIG_DIR?.trim() || join16(homedir8(), ".claude");
+  return join16(root, ".credentials.json");
 }
 async function readFileAccessToken(configDir) {
   const path = claudeCredentialsPath(configDir);
-  if (!existsSync17(path)) return null;
+  if (!existsSync18(path)) return null;
   try {
     return accessTokenFromCredentialsJson(readFileSync8(path, "utf8"));
   } catch {