@sideboard-ai/core 0.1.73 → 0.1.77

package/dist/index.js

@@ -4,7 +4,7 @@ import {
   listWorkspaces,
   removeWorkspace,
   syncWorkspacesFromThreads
-} from "./chunk-CYKPUTXN.js";
+} from "./chunk-75U65MBE.js";
 import {
   BRIGHTSY_MCP_ALLOWED_TOOLS,
   CLAUDE_MODEL_CATALOG,
@@ -58,7 +58,7 @@ import {
   sideboardMcpProfile,
   threadRequestsBrightsyMcp,
   writeInjectedMcpConfig
-} from "./chunk-WSFZPOPH.js";
+} from "./chunk-QD37IILI.js";
 import {
   CLOUD_COORDINATOR_BUSY_REPLY,
   CLOUD_COORDINATOR_STOPPED_REPLY,
@@ -85,7 +85,7 @@ import {
   parseForceStopMessage,
   slackCoordinatorSourceRef,
   takenTeamSlugsForOrchestration
-} from "./chunk-NF6Y4GTE.js";
+} from "./chunk-VERLUKN2.js";
 import {
   COORDINATOR_TOOL_PLAYBOOK,
   SLACK_REPLY_FORMATTING,
@@ -94,7 +94,7 @@ import {
   enrichWorkspacesWithGithub,
   ensureGlobalCoordinatorCwd,
   formatWorkspaceInventory
-} from "./chunk-V4ACEJX2.js";
+} from "./chunk-EEKSZTMU.js";
 import {
   brightsyConfigPath,
   brightsyMcpServerName,
@@ -128,7 +128,7 @@ import {
   parseCursorRunnerLine,
   pushTurnStderr,
   summarizeTurnStderr
-} from "./chunk-3WJAUKIL.js";
+} from "./chunk-SEOICVGB.js";
 import {
   HARNESS_ENV_KEYS,
   appSettingsPath,
@@ -192,8 +192,10 @@ import {
 import {
   caffeinateHoldPath,
   getCaffeinateHold,
+  isThreadCaffeinated,
+  releaseCaffeinateHoldForThread,
   setCaffeinateHold
-} from "./chunk-JAWEDVVA.js";
+} from "./chunk-MFF2RE3I.js";
 import {
   writePrivateFile
 } from "./chunk-JT7R45JB.js";
@@ -324,6 +326,31 @@ import {
   withExportedPath
 } from "./chunk-D4DPQ552.js";
 
+// src/git/agent-git-actions.ts
+var AGENT_GIT_ACTIONS = [
+  "commit-push",
+  "create-draft",
+  "create-web",
+  "resolve-conflicts",
+  "merge"
+];
+function agentGitPrompt(action, opts) {
+  switch (action) {
+    case "commit-push":
+      return "Commit and push.";
+    case "create-draft":
+      return "Commit, push, and open a draft PR.";
+    case "create-web":
+      return "Commit, push, and open a PR in the browser.";
+    case "resolve-conflicts": {
+      const base = opts?.prBase?.trim().replace(/^refs\/heads\//, "");
+      return base ? `Merge origin/${base} into this branch. Then push.` : "Fix merge conflicts.";
+    }
+    case "merge":
+      return "Merge PR.";
+  }
+}
+
 // src/integrations/github.ts
 async function getGitHubStatus() {
   const which = await run("which", ["gh"], { reject: false });
@@ -349,9 +376,9 @@ async function getGitHubStatus() {
     };
   }
   const status = await run("gh", ["auth", "status"], { reject: false });
-  const text2 = `${status.stdout}
+  const text3 = `${status.stdout}
 ${status.stderr}`;
-  const loginMatch = text2.match(/Logged in to ([^\s]+) account (\S+)/i) ?? text2.match(/Logged in to ([^\s]+) as (\S+)/i);
+  const loginMatch = text3.match(/Logged in to ([^\s]+) account (\S+)/i) ?? text3.match(/Logged in to ([^\s]+) as (\S+)/i);
   if (loginMatch) {
     return {
       connected: true,
@@ -371,13 +398,39 @@ async function refreshGitHubAuth() {
   return getGitHubStatus();
 }
 
+// src/http/fetch.ts
+var injected = null;
+function setHttpFetchImpl(fetchImpl) {
+  injected = fetchImpl;
+}
+function formatFetchError(err, url) {
+  if (!(err instanceof Error)) return `${String(err)} (${url})`;
+  const cause = err.cause;
+  let detail = "";
+  if (cause instanceof Error) {
+    const code = typeof cause.code === "string" ? cause.code : void 0;
+    detail = code ? ` [${code}: ${cause.message}]` : ` [${cause.message}]`;
+  } else if (cause != null) {
+    detail = ` [${String(cause)}]`;
+  }
+  return `${err.message}${detail} (${url})`;
+}
+async function httpFetch(input, init) {
+  const url = typeof input === "string" ? input : input.href;
+  const fn = injected ?? globalThis.fetch.bind(globalThis);
+  try {
+    return await fn(url, init);
+  } catch (err) {
+    throw new Error(formatFetchError(err, url));
+  }
+}
+
 // src/integrations/linear-oauth.ts
 import { createHash, randomBytes } from "crypto";
 import { createServer } from "http";
 
 // src/integrations/linear-app.ts
 var BAKED_LINEAR_CLIENT_ID = "39a15abc7ea5bea17c47f47f85ff5fd0";
-var BAKED_LINEAR_CLIENT_SECRET = "";
 function hasBakedLinearOAuth() {
   return Boolean(BAKED_LINEAR_CLIENT_ID.trim());
 }
@@ -389,12 +442,12 @@ var LINEAR_AUTHORIZE = "https://linear.app/oauth/authorize";
 var LINEAR_TOKEN = "https://api.linear.app/oauth/token";
 var LINEAR_REVOKE = "https://api.linear.app/oauth/revoke";
 var LINEAR_GRAPHQL = "https://api.linear.app/graphql";
-var LINEAR_OAUTH_SCOPES = "read";
+var LINEAR_OAUTH_SCOPES = "read,write";
 var REFRESH_SKEW_MS = 5 * 6e4;
 function linearOAuthCredentials() {
   const settings = loadAppSettings();
   const clientId = process.env.SIDEBOARD_LINEAR_CLIENT_ID?.trim() || settings.integrations.linearClientId?.trim() || BAKED_LINEAR_CLIENT_ID.trim();
-  const clientSecret = process.env.SIDEBOARD_LINEAR_CLIENT_SECRET?.trim() || settings.integrations.linearClientSecret?.trim() || BAKED_LINEAR_CLIENT_SECRET.trim();
+  const clientSecret = process.env.SIDEBOARD_LINEAR_CLIENT_SECRET?.trim() || settings.integrations.linearClientSecret?.trim() || "";
   if (!clientId) {
     throw new Error(
       `Linear browser sign-in needs a Linear OAuth app Client ID. Create one at linear.app/settings/api/applications/new with callback ${LINEAR_OAUTH_REDIRECT}, then set SIDEBOARD_LINEAR_CLIENT_ID (PKCE does not require a secret). You can still paste a personal API key.`
@@ -434,7 +487,7 @@ function htmlPage(title, body) {
 h1{font-size:1.25rem}p{line-height:1.5;color:#444}</style></head><body>${body}</body></html>`;
 }
 async function exchangeLinearToken(body) {
-  const res = await fetch(LINEAR_TOKEN, {
+  const res = await httpFetch(LINEAR_TOKEN, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body
@@ -456,7 +509,7 @@ async function persistLinearTokens(data, viewer) {
   });
 }
 async function fetchLinearViewer(accessToken) {
-  const res = await fetch(LINEAR_GRAPHQL, {
+  const res = await httpFetch(LINEAR_GRAPHQL, {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
@@ -627,7 +680,7 @@ async function revokeLinearToken(token, tokenTypeHint) {
     token,
     token_type_hint: tokenTypeHint
   });
-  await fetch(LINEAR_REVOKE, {
+  await httpFetch(LINEAR_REVOKE, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body
@@ -644,6 +697,18 @@ async function disconnectLinear() {
 
 // src/integrations/linear.ts
 var LINEAR_GRAPHQL2 = "https://api.linear.app/graphql";
+var ISSUE_FIELDS = `
+  id
+  identifier
+  title
+  description
+  url
+  priority
+  state { id name type }
+  assignee { id name }
+  team { id key name states { nodes { id name type } } }
+  labels { nodes { name } }
+`;
 var ASSIGNED_ISSUES_QUERY = `
 query SideboardAssignedIssues($first: Int!) {
   viewer {
@@ -652,53 +717,280 @@ query SideboardAssignedIssues($first: Int!) {
       orderBy: updatedAt
       filter: { state: { type: { nin: ["completed", "canceled"] } } }
     ) {
-      nodes {
-        id
-        identifier
-        title
-        url
-        labels { nodes { name } }
-      }
+      nodes { ${ISSUE_FIELDS} }
     }
   }
 }
 `;
-async function listLinearIssuesDirect(opts) {
-  const apiKey = (opts?.apiKey ?? await getLinearAuthToken())?.trim();
-  if (!apiKey) {
+var TEAMS_QUERY = `
+query SideboardTeams {
+  viewer { id name }
+  teams(first: 50) {
+    nodes {
+      id
+      key
+      name
+      states { nodes { id name type } }
+    }
+  }
+}
+`;
+var ISSUE_QUERY = `
+query SideboardIssue($id: String!) {
+  issue(id: $id) { ${ISSUE_FIELDS} }
+}
+`;
+var ISSUE_CREATE = `
+mutation SideboardIssueCreate($input: IssueCreateInput!) {
+  issueCreate(input: $input) {
+    success
+    issue { ${ISSUE_FIELDS} }
+  }
+}
+`;
+var ISSUE_UPDATE = `
+mutation SideboardIssueUpdate($id: String!, $input: IssueUpdateInput!) {
+  issueUpdate(id: $id, input: $input) {
+    success
+    issue { ${ISSUE_FIELDS} }
+  }
+}
+`;
+var COMMENT_CREATE = `
+mutation SideboardCommentCreate($input: CommentCreateInput!) {
+  commentCreate(input: $input) {
+    success
+    comment { id body url }
+  }
+}
+`;
+function rewriteLinearError(message) {
+  if (/scope|permission|not (authorized|allowed)|unauthorized|insufficient/i.test(message)) {
+    return `${message} \u2014 Disconnect and Connect Linear in Account settings to grant write access.`;
+  }
+  return message;
+}
+async function requireLinearToken(apiKey) {
+  const token = (apiKey ?? await getLinearAuthToken())?.trim();
+  if (!token) {
     throw new Error("Linear is not connected \u2014 sign in from Account settings");
   }
-  const first = Math.max(1, Math.min(100, opts?.limit ?? 50));
-  const res = await fetch(LINEAR_GRAPHQL2, {
+  return token;
+}
+async function linearGraphql(query, variables, opts) {
+  const apiKey = await requireLinearToken(opts?.apiKey);
+  const res = await httpFetch(LINEAR_GRAPHQL2, {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
       Authorization: linearAuthorizationHeader(apiKey)
     },
-    body: JSON.stringify({
-      query: ASSIGNED_ISSUES_QUERY,
-      variables: { first }
-    })
+    body: JSON.stringify({ query, variables })
   });
   if (!res.ok) {
     const body = await res.text().catch(() => "");
     throw new Error(
-      `Linear API error ${res.status}${body ? `: ${body.slice(0, 200)}` : ""}`
+      rewriteLinearError(
+        `Linear API error ${res.status}${body ? `: ${body.slice(0, 200)}` : ""}`
+      )
     );
   }
   const json = await res.json();
   if (json.errors?.length) {
-    throw new Error(json.errors.map((e) => e.message ?? "Linear error").join("; "));
+    throw new Error(
+      rewriteLinearError(json.errors.map((e) => e.message ?? "Linear error").join("; "))
+    );
   }
-  const nodes = json.data?.viewer?.assignedIssues?.nodes ?? [];
-  return nodes.map((node) => ({
+  if (json.data == null) {
+    throw new Error("Linear API returned no data");
+  }
+  return json.data;
+}
+function mapState(node) {
+  if (!node?.id) return void 0;
+  return {
+    id: String(node.id),
+    name: String(node.name ?? ""),
+    type: String(node.type ?? "")
+  };
+}
+function mapIssue(node) {
+  const team = node.team;
+  return {
     id: String(node.id ?? node.identifier ?? ""),
     identifier: String(node.identifier ?? node.id ?? ""),
     title: String(node.title ?? ""),
     url: String(node.url ?? ""),
-    labels: (node.labels?.nodes ?? []).map((l) => l.name).filter((n) => Boolean(n)),
+    description: node.description?.trim() || void 0,
+    priority: typeof node.priority === "number" ? node.priority : void 0,
+    state: mapState(node.state),
+    assignee: node.assignee?.id ? { id: String(node.assignee.id), name: String(node.assignee.name ?? "") } : void 0,
+    team: team?.id ? {
+      id: String(team.id),
+      key: String(team.key ?? ""),
+      name: String(team.name ?? ""),
+      states: (team.states?.nodes ?? []).map((s) => mapState(s)).filter((s) => Boolean(s))
+    } : void 0,
+    labels: (node.labels?.nodes ?? []).map((l) => l.name).filter((n) => Boolean(n))
+  };
+}
+function toIssueInfo(issue) {
+  return {
+    id: issue.id,
+    identifier: issue.identifier,
+    title: issue.title,
+    url: issue.url,
+    labels: issue.labels,
     provider: "linear"
-  }));
+  };
+}
+function mapTeam(node) {
+  return {
+    id: String(node.id ?? ""),
+    key: String(node.key ?? ""),
+    name: String(node.name ?? ""),
+    states: (node.states?.nodes ?? []).map((s) => mapState(s)).filter((s) => Boolean(s))
+  };
+}
+function resolveLinearTeam(teams, team) {
+  const t = team.trim();
+  if (!t) throw new Error("Linear team is required (id, key, or name from linear_list_teams)");
+  const lower = t.toLowerCase();
+  const found = teams.find(
+    (x) => x.id === t || x.key.toLowerCase() === lower || x.name.toLowerCase() === lower
+  );
+  if (!found) {
+    const keys = teams.map((x) => x.key).filter(Boolean).join(", ") || "(none)";
+    throw new Error(`Linear team not found: ${team}. Known keys: ${keys}`);
+  }
+  return found;
+}
+function resolveLinearState(team, state) {
+  const s = state.trim();
+  if (!s) throw new Error("Linear state is empty");
+  const lower = s.toLowerCase();
+  const found = team.states.find((x) => x.id === s) || team.states.find((x) => x.name.toLowerCase() === lower) || team.states.find((x) => x.type.toLowerCase() === lower);
+  if (!found) {
+    const available = team.states.map((x) => `${x.name} (${x.type})`).join(", ") || "(none)";
+    throw new Error(`Linear state not found on ${team.key}: ${state}. Available: ${available}`);
+  }
+  return found;
+}
+function normalizePriority(priority) {
+  if (priority == null) return void 0;
+  if (!Number.isInteger(priority) || priority < 0 || priority > 4) {
+    throw new Error("Linear priority must be 0 (none), 1 (urgent), 2 (high), 3 (medium), or 4 (low)");
+  }
+  return priority;
+}
+async function listLinearIssuesDirect(opts) {
+  const first = Math.max(1, Math.min(100, opts?.limit ?? 50));
+  const json = await linearGraphql(ASSIGNED_ISSUES_QUERY, { first }, opts);
+  return (json.viewer?.assignedIssues?.nodes ?? []).map((node) => toIssueInfo(mapIssue(node)));
+}
+async function listLinearTeams(opts) {
+  const json = await linearGraphql(TEAMS_QUERY, void 0, opts);
+  return {
+    viewer: {
+      id: String(json.viewer?.id ?? ""),
+      name: String(json.viewer?.name ?? "")
+    },
+    teams: (json.teams?.nodes ?? []).map(mapTeam)
+  };
+}
+async function getLinearIssue(id, opts) {
+  const issueId = id.trim();
+  if (!issueId) throw new Error("Linear issue id is required (uuid or ENG-123)");
+  const json = await linearGraphql(
+    ISSUE_QUERY,
+    { id: issueId },
+    opts
+  );
+  if (!json.issue) {
+    throw new Error(`Linear issue not found: ${issueId}`);
+  }
+  return mapIssue(json.issue);
+}
+async function createLinearIssue(input, opts) {
+  const title = input.title.trim();
+  if (!title) throw new Error("Linear issue title is required");
+  const { viewer, teams } = await listLinearTeams(opts);
+  const team = resolveLinearTeam(teams, input.team);
+  const mutationInput = {
+    teamId: team.id,
+    title
+  };
+  const description = input.description?.trim();
+  if (description) mutationInput.description = description;
+  if (input.state?.trim()) {
+    mutationInput.stateId = resolveLinearState(team, input.state).id;
+  }
+  const assignee = input.assignee === void 0 ? void 0 : input.assignee?.trim() || null;
+  if (assignee === "me") mutationInput.assigneeId = viewer.id;
+  else if (assignee) mutationInput.assigneeId = assignee;
+  const priority = normalizePriority(input.priority);
+  if (priority != null) mutationInput.priority = priority;
+  const json = await linearGraphql(ISSUE_CREATE, { input: mutationInput }, opts);
+  if (!json.issueCreate?.success || !json.issueCreate.issue) {
+    throw new Error("Linear issueCreate failed");
+  }
+  return mapIssue(json.issueCreate.issue);
+}
+async function updateLinearIssue(input, opts) {
+  const issueId = input.id.trim();
+  if (!issueId) throw new Error("Linear issue id is required (uuid or ENG-123)");
+  const mutationInput = {};
+  if (input.title !== void 0) {
+    const title = input.title.trim();
+    if (!title) throw new Error("Linear issue title cannot be empty");
+    mutationInput.title = title;
+  }
+  if (input.description !== void 0) {
+    mutationInput.description = input.description;
+  }
+  if (input.state?.trim()) {
+    const existing = await getLinearIssue(issueId, opts);
+    const team = existing.team;
+    if (!team?.states.length) {
+      throw new Error(`Linear issue ${existing.identifier} has no workflow states to resolve "${input.state}"`);
+    }
+    mutationInput.stateId = resolveLinearState(team, input.state).id;
+  }
+  if (input.assignee !== void 0) {
+    const assignee = input.assignee?.trim() || null;
+    if (assignee === "me") {
+      const { viewer } = await listLinearTeams(opts);
+      mutationInput.assigneeId = viewer.id;
+    } else {
+      mutationInput.assigneeId = assignee;
+    }
+  }
+  if (input.priority !== void 0) {
+    mutationInput.priority = normalizePriority(input.priority);
+  }
+  if (Object.keys(mutationInput).length === 0) {
+    throw new Error("linear_update_issue needs at least one of title, description, state, assignee, priority");
+  }
+  const json = await linearGraphql(ISSUE_UPDATE, { id: issueId, input: mutationInput }, opts);
+  if (!json.issueUpdate?.success || !json.issueUpdate.issue) {
+    throw new Error("Linear issueUpdate failed");
+  }
+  return mapIssue(json.issueUpdate.issue);
+}
+async function commentLinearIssue(input, opts) {
+  const issueId = input.id.trim();
+  const body = input.body.trim();
+  if (!issueId) throw new Error("Linear issue id is required (uuid or ENG-123)");
+  if (!body) throw new Error("Linear comment body is required");
+  const json = await linearGraphql(COMMENT_CREATE, { input: { issueId, body } }, opts);
+  if (!json.commentCreate?.success || !json.commentCreate.comment?.id) {
+    throw new Error("Linear commentCreate failed");
+  }
+  return {
+    id: String(json.commentCreate.comment.id),
+    body: String(json.commentCreate.comment.body ?? body),
+    url: json.commentCreate.comment.url?.trim() || void 0
+  };
 }
 async function validateLinearApiKey(apiKey) {
   const key = apiKey.trim();
@@ -843,9 +1135,9 @@ function toolFilePath(input) {
   if (!input) return void 0;
   return str(input.file_path) ?? str(input.path) ?? str(input.filePath) ?? str(input.filename);
 }
-function countLines(text2) {
-  if (!text2) return 0;
-  return text2.split("\n").length;
+function countLines(text3) {
+  if (!text3) return 0;
+  return text3.split("\n").length;
 }
 function diffFromInput(input) {
   if (!input) return {};
@@ -972,9 +1264,9 @@ function applyAgentEvent(parts, event) {
 function partsToAssistantText(parts) {
   return parts.filter((p) => p.type === "text").map((p) => p.text).join("").trim();
 }
-function stripBrightsyNdjsonNoise(text2) {
-  if (!text2 || !text2.includes('"type"')) return text2;
-  let out = text2;
+function stripBrightsyNdjsonNoise(text3) {
+  if (!text3 || !text3.includes('"type"')) return text3;
+  let out = text3;
   out = out.replace(
     /\{"type":"(?:tool_use|tool_result|tool|thinking|usage|done|error)"[\s\S]*?\}\s*(?=\{"type":"|$|(?=[A-Za-z*#]))/g,
     ""
@@ -1002,17 +1294,35 @@ function sumOptional(a, b) {
   if (a == null && b == null) return void 0;
   return (a ?? 0) + (b ?? 0);
 }
+function requestOccupancy(u) {
+  return u.inputTokens + (u.cacheReadTokens ?? 0) + (u.cacheWriteTokens ?? 0);
+}
 function mergeUsage(a, b) {
   return {
     inputTokens: (a?.inputTokens ?? 0) + b.inputTokens,
     outputTokens: (a?.outputTokens ?? 0) + b.outputTokens,
     cacheReadTokens: sumOptional(a?.cacheReadTokens, b.cacheReadTokens),
-    cacheWriteTokens: sumOptional(a?.cacheWriteTokens, b.cacheWriteTokens)
+    cacheWriteTokens: sumOptional(a?.cacheWriteTokens, b.cacheWriteTokens),
+    lastRequestTokens: b.lastRequestTokens ?? a?.lastRequestTokens
   };
 }
+function applyTurnUsage(current, incoming, scope = "request") {
+  if (scope === "turn") {
+    return {
+      ...incoming,
+      lastRequestTokens: current?.lastRequestTokens ?? requestOccupancy(incoming)
+    };
+  }
+  const merged = mergeUsage(current, incoming);
+  return { ...merged, lastRequestTokens: requestOccupancy(incoming) };
+}
 function totalTokens(u) {
   return u.inputTokens + u.outputTokens + (u.cacheReadTokens ?? 0) + (u.cacheWriteTokens ?? 0);
 }
+function contextTokens(u) {
+  if (u.lastRequestTokens != null && u.lastRequestTokens > 0) return u.lastRequestTokens;
+  return requestOccupancy(u);
+}
 
 // src/agents/spawn.ts
 async function spawnAgentTurn(thread, input, onEvent) {
@@ -1022,9 +1332,9 @@ async function spawnAgentTurn(thread, input, onEvent) {
       `Cannot spawn ${thread.agent}: thread ${thread.id} has no worktreePath`
     );
   }
-  const { isGlobalThread: isGlobalThread2 } = await import("./global-workspace-S3B6ESZS.js");
+  const { isGlobalThread: isGlobalThread2 } = await import("./global-workspace-YNMNO4CL.js");
   if (isGlobalThread2(thread)) {
-    const { ensureGlobalCoordinatorCwd: ensureGlobalCoordinatorCwd2 } = await import("./coordinator-prompt-4U2QNHGT.js");
+    const { ensureGlobalCoordinatorCwd: ensureGlobalCoordinatorCwd2 } = await import("./coordinator-prompt-LLFJUO2R.js");
     ensureGlobalCoordinatorCwd2(
       isOrchestratorThread(thread) ? { orchestratorThreadId: thread.id } : void 0
     );
@@ -1086,7 +1396,7 @@ async function spawnAgentTurn(thread, input, onEvent) {
           continue;
         }
         if (parsed.type === "usage") {
-          usage = mergeUsage(usage, parsed.data);
+          usage = applyTurnUsage(usage, parsed.data, parsed.scope ?? "request");
           onEvent(parsed);
           continue;
         }
@@ -1111,8 +1421,8 @@ async function spawnAgentTurn(thread, input, onEvent) {
     onEvent({ type: "exit", data: exitCode });
     const finalized = finalizeParts(parts);
     const rawText = assistantText.trim() || partsToAssistantText(finalized);
-    const text2 = thread.agent === "brightsy" ? stripBrightsyNdjsonNoise(rawText) : rawText;
-    return { exitCode, sessionId, assistantText: text2, parts: finalized, usage };
+    const text3 = thread.agent === "brightsy" ? stripBrightsyNdjsonNoise(rawText) : rawText;
+    return { exitCode, sessionId, assistantText: text3, parts: finalized, usage };
   });
   return {
     pid: child.pid,
@@ -1141,7 +1451,7 @@ function formatRenameBranchDirective(thread, opts) {
     "- Rename the git branch to a short kebab-case name that describes this task (what you are changing), e.g. `fix/panel-width` or `feat/dark-mode`:",
     "  `git branch -m <new-name>`",
     "- Prefer Conventional Commits style prefixes when they fit (`fix/`, `feat/`, `chore/`, `docs/`).",
-    "- Never push or merge to main/master from here."
+    "- Never push this placeholder to main/master."
   ];
   const custom = opts?.customPrompt?.trim();
   if (custom) {
@@ -1184,7 +1494,7 @@ function formatWorktreeDirective(thread, opts) {
     "- Prefer a concise imperative title (Conventional Commits style when it fits: feat:/fix:/chore:/docs:). Body should summarize intent, key changes, and test notes."
   );
   lines.push(
-    "- Commit with messages that state the purpose of the change (same standard as the PR). Stay on this thread branch; never push or merge to main/master from here."
+    "- Commit with messages that state the purpose of the change (same standard as the PR). Stay on this thread branch. Never push directly to main/master or merge locally into the main checkout. When asked to merge the PR, use GitHub from this worktree (`gh pr merge` / `gh stack merge`)."
   );
   if (thread.prUrl) {
     lines.push(
@@ -1216,13 +1526,13 @@ function formatWorktreeDirective(thread, opts) {
     '- "Fix CI: <name>." \u2192 investigate that failing check, fix it, commit, and push.'
   );
   lines.push(
-    '- "Update the branch." / "Fix merge conflicts." \u2192 sync with the PR base (merge or rebase), resolve conflicts carefully, commit, and push until the PR is mergeable.'
+    '- "Update the branch." / "Fix merge conflicts." / "Merge origin/<base> into this branch. Then push." \u2192 sync with the PR base (merge or rebase), resolve conflicts carefully, commit, and push until the PR is mergeable.'
   );
   lines.push(
     '- "Address review comments." \u2192 read PR review feedback, make the requested changes, commit, and push.'
   );
   lines.push(
-    '- "Merge PR." \u2192 merge this thread\'s open pull request with `gh pr merge` (respect repo defaults / squash vs merge); do not force-push main/master.'
+    '- "Merge PR." \u2192 merge this thread\'s open pull request on GitHub. If `gh stack view` shows a stack, use `gh stack merge`; otherwise `gh pr merge` (respect repo defaults / squash vs merge). Do not force-push main/master or merge locally into the main checkout.'
   );
   return lines.join("\n");
 }
@@ -1977,13 +2287,13 @@ function formatStat(files) {
   return `${n} file${n === 1 ? "" : "s"} changed, ${additions} insertions(+), ${deletions} deletions(-)`;
 }
 function emptyScopeStats() {
-  const z3 = emptyStat();
+  const z4 = emptyStat();
   return {
-    commits: z3,
-    uncommitted: z3,
-    staged: z3,
-    unstaged: z3,
-    last_turn: z3
+    commits: z4,
+    uncommitted: z4,
+    staged: z4,
+    unstaged: z4,
+    last_turn: z4
   };
 }
 function filesFromDiff(nameStatus, numstat, combinedDiff, maxHunk) {
@@ -2254,10 +2564,10 @@ async function getDiff(worktreePath, repoPath, opts) {
     listBranchCommits(worktreePath, repoPath, { base: baseLabel }),
     isDirty(worktreePath),
     countUnpushedCommits(worktreePath)
-  ]).then(([scopeStats, commits, dirty, unpushed]) => ({
+  ]).then(([scopeStats, commits, dirty2, unpushed]) => ({
     scopeStats,
     commits,
-    dirty,
+    dirty: dirty2,
     unpushed
   })) : Promise.resolve({
     scopeStats: emptyScopeStats(),
@@ -2334,13 +2644,14 @@ async function getDiff(worktreePath, repoPath, opts) {
     }
   }
   const files = [...filesMap.values()].sort((a, b) => a.path.localeCompare(b.path));
+  const dirty = includeMeta ? meta.dirty : scope === "commits" ? false : files.length > 0;
   return {
     scope,
     commitSha: scope === "commits" ? commitSha : null,
     base: labelBase,
     files,
     stat: formatStat(files),
-    dirty: fileOnly || !includeMeta ? files.length > 0 : meta.dirty,
+    dirty,
     unpushed: meta.unpushed,
     hasLastTurnBase,
     commits: meta.commits,
@@ -2972,16 +3283,16 @@ var PASTE_ATTACH_MIN_CHARS = 1200;
 var PASTE_ATTACH_MIN_LINES = 15;
 var PASTED_NAME_RE = /^Pasted text #(\d+)\.txt$/i;
 var PASTED_NAME_ALT_RE = /^pasted-(\d+)\.txt$/i;
-function pastedTextStats(text2) {
-  const chars = text2.length;
+function pastedTextStats(text3) {
+  const chars = text3.length;
   if (chars === 0) return { chars: 0, lines: 0 };
-  const lines = text2.split(/\r\n|\r|\n/).length;
+  const lines = text3.split(/\r\n|\r|\n/).length;
   return { chars, lines };
 }
-function shouldAttachPastedText(text2) {
-  const trimmed = text2.trim();
+function shouldAttachPastedText(text3) {
+  const trimmed = text3.trim();
   if (!trimmed) return false;
-  const { chars, lines } = pastedTextStats(text2);
+  const { chars, lines } = pastedTextStats(text3);
   return chars >= PASTE_ATTACH_MIN_CHARS || lines >= PASTE_ATTACH_MIN_LINES;
 }
 function nextPastedTextName(existing) {
@@ -2992,13 +3303,13 @@ function nextPastedTextName(existing) {
   }
   return `Pasted text #${max + 1}.txt`;
 }
-function buildPastedTextAttachment(text2, opts) {
+function buildPastedTextAttachment(text3, opts) {
   return {
     id: opts?.id ?? randomUUID2(),
     name: opts?.name ?? "Pasted text #1.txt",
     kind: "file",
     path: opts?.path,
-    content: text2
+    content: text3
   };
 }
 
@@ -3046,9 +3357,9 @@ async function tryClaudeSummary(transcript, opts) {
       { cwd: opts?.cwd, reject: false }
     );
     if (exitCode !== 0) return null;
-    const text2 = stdout.trim();
-    if (text2.length < 40) return null;
-    return text2;
+    const text3 = stdout.trim();
+    if (text3.length < 40) return null;
+    return text3;
   } catch {
     return null;
   }
@@ -3097,9 +3408,9 @@ function extractiveSummary(transcript) {
   );
   return parts.join("\n");
 }
-function clipSummary(text2) {
-  if (text2.length <= MAX_SUMMARY_CHARS) return text2;
-  return `${text2.slice(0, MAX_SUMMARY_CHARS)}
+function clipSummary(text3) {
+  if (text3.length <= MAX_SUMMARY_CHARS) return text3;
+  return `${text3.slice(0, MAX_SUMMARY_CHARS)}
 
 [\u2026summary truncated\u2026]`;
 }
@@ -3501,7 +3812,7 @@ async function createThread(input, _onSetupLine) {
   return readThread(thread.id) ?? thread;
 }
 async function listLinearIssues(agent, repoPath) {
-  const { getAdapter: getAdapter2 } = await import("./agents-GUFUYXKP.js");
+  const { getAdapter: getAdapter2 } = await import("./agents-XJV6J3K2.js");
   await requireAgent(agent, { requireLinear: true });
   const adapter = getAdapter2(agent);
   if (!adapter.listLinearIssues) {
@@ -3999,13 +4310,13 @@ function resolveConductorCursorAgentId(workspacePath) {
   for (const hash of hashes) {
     const agentsFile = join7(CURSOR_SDK_STORE, hash, "agents.ndjson");
     if (!existsSync9(agentsFile)) continue;
-    let text2;
+    let text3;
     try {
-      text2 = readFileSync7(agentsFile, "utf8");
+      text3 = readFileSync7(agentsFile, "utf8");
     } catch {
       continue;
     }
-    for (const line of text2.split("\n")) {
+    for (const line of text3.split("\n")) {
       const trimmed = line.trim();
       if (!trimmed) continue;
       try {
@@ -4044,7 +4355,7 @@ async function adoptThread(input) {
     messages: input.messages ?? []
   });
   writeThread(thread);
-  const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-R66324S7.js");
+  const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-O3U5BENH.js");
   await ensureWorkspace2(repoPath);
   return thread;
 }
@@ -4495,8 +4806,8 @@ ${input.permalink}` : "";
 
 ${body}${link}`;
 }
-function isSlackExternalReplyPrompt(text2) {
-  return text2.startsWith("Slack reply from ") && text2.includes("not a command");
+function isSlackExternalReplyPrompt(text3) {
+  return text3.startsWith("Slack reply from ") && text3.includes("not a command");
 }
 function pendingSlackExternalReplies(messages) {
   let i = messages.length - 1;
@@ -4520,9 +4831,9 @@ function formatSlackRepliesForTurn(replies) {
 function listSlackOutboundWatches() {
   return pruneWatches(readStore3());
 }
-function formatOwnerSlackFyi(userName, text2) {
+function formatOwnerSlackFyi(userName, text3) {
   const who = userName.trim() || "Someone";
-  const body = text2.trim() || "(no text)";
+  const body = text3.trim() || "(no text)";
   return `${who} replied in Slack:
 ${body}`;
 }
@@ -4537,7 +4848,7 @@ async function relayExternalReply(opts) {
   const thread = readThread(threadId);
   if (!thread || thread.status === "archived") return true;
   try {
-    const text2 = formatSlackExternalReplyPrompt({
+    const text3 = formatSlackExternalReplyPrompt({
       userName: opts.reply.userName,
       kind: opts.watch.kind,
       toLabel: opts.watch.toLabel,
@@ -4546,7 +4857,7 @@ async function relayExternalReply(opts) {
     });
     appendMessage(threadId, {
       role: "agent",
-      text: text2,
+      text: text3,
       ts: (/* @__PURE__ */ new Date()).toISOString()
     });
   } catch {
@@ -4743,7 +5054,7 @@ async function refreshSlackReplyBadges(opts) {
     const messages = await fetchMessages(token, watch, opts?.fetchImpl);
     const replies = messages.filter((m) => isHumanReply(m, watch)).sort((a, b) => Number(a.ts) - Number(b.ts));
     if (replies.length === 0) continue;
-    const injected = new Set(watch.injectedReplyTs ?? []);
+    const injected2 = new Set(watch.injectedReplyTs ?? []);
     const collected = [...watch.replies ?? []];
     let lastSeenTs = watch.lastSeenTs;
     let latestUser;
@@ -4777,7 +5088,7 @@ async function refreshSlackReplyBadges(opts) {
       latestName = replyUserName;
       latestText = reply.text;
       latestPermalink = permalink;
-      if (injected.has(ts)) {
+      if (injected2.has(ts)) {
         lastSeenTs = ts;
         continue;
       }
@@ -4788,7 +5099,7 @@ async function refreshSlackReplyBadges(opts) {
         fetchImpl: opts?.fetchImpl
       });
       if (!delivered) break;
-      injected.add(ts);
+      injected2.add(ts);
       lastSeenTs = ts;
     }
     watches[i] = {
@@ -4800,7 +5111,7 @@ async function refreshSlackReplyBadges(opts) {
       replyTs: lastSeenTs,
       replyPreview: latestText.slice(0, 140),
       permalink: latestPermalink,
-      injectedReplyTs: [...injected],
+      injectedReplyTs: [...injected2],
       replies: collected.slice(-MAX_REPLIES_PER_WATCH)
     };
     changed = true;
@@ -5377,8 +5688,8 @@ function buildQuotaHandoffAttachment(from, limitText, fallbackAgent) {
   );
   const recent = from.messages.slice(-8).map((m) => {
     const role = m.role === "user" ? "User" : m.role === "agent" ? "Agent" : "Summary";
-    const text2 = m.text.trim().replace(/\s+/g, " ").slice(0, 280);
-    return text2 ? `- ${role}: ${text2}` : null;
+    const text3 = m.text.trim().replace(/\s+/g, " ").slice(0, 280);
+    return text3 ? `- ${role}: ${text3}` : null;
   }).filter(Boolean);
   const body = [
     `# Orchestration handoff`,
@@ -5798,11 +6109,11 @@ var Orchestrator = class {
     return results;
   }
   /** Edit the text of a not-yet-started queued message. */
-  async editQueuedMessage(threadRef, index, text2) {
+  async editQueuedMessage(threadRef, index, text3) {
     const thread = this.requireThread(threadRef);
     return withThreadLock(thread.id, async () => {
       const current = this.requireThread(thread.id);
-      const trimmed = text2.trim();
+      const trimmed = text3.trim();
       if (!trimmed || index < 0 || index >= current.queue.length) {
         return current;
       }
@@ -6562,6 +6873,14 @@ var Orchestrator = class {
       throw new Error(`${action} is not available on the global coordinator`);
     }
   }
+  /** MCP set_caffeinate is a detached hold — closing the chat must not leave the Mac awake. */
+  releaseOrchestratorCaffeinate(thread) {
+    if (!isOrchestratorThread(thread)) return;
+    try {
+      releaseCaffeinateHoldForThread(thread.id);
+    } catch {
+    }
+  }
   async diff(threadRef, opts) {
     const thread = this.requireThread(threadRef);
     this.assertNotGlobal(thread, "Diff");
@@ -6831,6 +7150,36 @@ var Orchestrator = class {
     this.emit({ type: "status_changed", threadId: tab.id, status: tab.status });
     return tab;
   }
+  /**
+   * Queue a desktop-git-button prompt on a worktree agent (commit/push/PR/merge).
+   * Orchestrators use this instead of running git/gh from the synthetic home.
+   */
+  async askGit(threadRef, action) {
+    if (!AGENT_GIT_ACTIONS.includes(action)) {
+      throw new Error(`Unknown git action: ${action}`);
+    }
+    const thread = this.requireThread(threadRef);
+    this.assertNotGlobal(thread, "ask_git");
+    if (isOrchestratorThread(thread)) {
+      throw new Error(
+        "ask_git targets a worktree agent thread (not the orchestrator). Pass a child/worktree thread ref."
+      );
+    }
+    if (action === "merge" && !thread.prUrl) {
+      throw new Error(
+        "No pull request linked. Ask the worktree agent to open a draft PR first (ask_git create-draft)."
+      );
+    }
+    let prBase;
+    if (action === "resolve-conflicts") {
+      try {
+        const details = await this.getPrDetails(threadRef);
+        prBase = details?.baseRefName?.trim() || void 0;
+      } catch {
+      }
+    }
+    return this.send(threadRef, agentGitPrompt(action, { prBase }));
+  }
   setThreadOptions(threadRef, patch) {
     const thread = this.requireThread(threadRef);
     const next = {};
@@ -6901,6 +7250,7 @@ var Orchestrator = class {
   async archive(threadRef) {
     const thread = this.requireThread(threadRef);
     this.stop(thread.id);
+    this.releaseOrchestratorCaffeinate(thread);
     if (isGlobalThread(thread)) {
       const archived2 = setStatus(thread.id, "archived");
       this.emit({ type: "status_changed", threadId: archived2.id, status: "archived" });
@@ -6925,7 +7275,7 @@ var Orchestrator = class {
     this.emit({ type: "status_changed", threadId: archived.id, status: "archived" });
     if (thread.repoPath && !isGlobalRepoPath(thread.repoPath)) {
       try {
-        const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-R66324S7.js");
+        const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-O3U5BENH.js");
         await ensureWorkspace2(thread.repoPath);
       } catch {
       }
@@ -6935,6 +7285,7 @@ var Orchestrator = class {
   async purge(threadRef, opts) {
     const thread = this.requireThread(threadRef);
     this.stop(thread.id);
+    this.releaseOrchestratorCaffeinate(thread);
     if (isGlobalThread(thread)) {
       deleteThreadRecord(thread.id);
       return;
@@ -7198,7 +7549,7 @@ function formatPlanQuestionsForChat(questions) {
 // src/mcp/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 import { basename as basename4 } from "path";
 
 // src/mcp/archive-guard.ts
@@ -7426,8 +7777,8 @@ function labelGithubUrl(url) {
   }
   return { kind: "other", label: "GitHub", url: raw };
 }
-function appendGithubLink(text2, githubUrl) {
-  const body = text2.trimEnd();
+function appendGithubLink(text3, githubUrl) {
+  const body = text3.trimEnd();
   if (!githubUrl?.trim()) return body;
   const labeled = labelGithubUrl(githubUrl);
   if (!labeled) {
@@ -7710,6 +8061,101 @@ function registerSlackTools(server) {
   );
 }
 
+// src/mcp/linear-tools.ts
+import { z as z2 } from "zod";
+function text2(payload, isError = false) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(payload, null, 2) }],
+    ...isError ? { isError: true } : {}
+  };
+}
+function fail2(err) {
+  return text2(
+    { error: err instanceof Error ? err.message : String(err) },
+    true
+  );
+}
+var prioritySchema = z2.number().int().min(0).max(4).optional().describe("0 none, 1 urgent, 2 high, 3 medium, 4 low");
+function registerLinearTools(server) {
+  server.tool(
+    "linear_list_teams",
+    "List Linear teams (id, key, name) and workflow states for the connected Account. Use team key (e.g. ENG) on linear_create_issue; use state name or type (started, completed) on create/update. Viewer id is for assignee=me.",
+    {},
+    async () => {
+      try {
+        return text2(await listLinearTeams());
+      } catch (err) {
+        return fail2(err);
+      }
+    }
+  );
+  server.tool(
+    "linear_get_issue",
+    "Get a Linear issue by uuid or identifier (ENG-123).",
+    { id: z2.string() },
+    async ({ id }) => {
+      try {
+        return text2(await getLinearIssue(id));
+      } catch (err) {
+        return fail2(err);
+      }
+    }
+  );
+  server.tool(
+    "linear_create_issue",
+    'Create a Linear issue. Call linear_list_teams first. team is id, key, or name. state is name, type (unstarted/started/completed/canceled/backlog), or id. assignee is "me" or a user id.',
+    {
+      team: z2.string(),
+      title: z2.string(),
+      description: z2.string().optional(),
+      state: z2.string().optional(),
+      assignee: z2.string().nullable().optional(),
+      priority: prioritySchema
+    },
+    async (args) => {
+      try {
+        return text2(await createLinearIssue(args));
+      } catch (err) {
+        return fail2(err);
+      }
+    }
+  );
+  server.tool(
+    "linear_update_issue",
+    'Update a Linear issue (uuid or ENG-123). Pass at least one of title, description, state, assignee, priority. state is name, type, or id. assignee is "me", a user id, or null to unassign.',
+    {
+      id: z2.string(),
+      title: z2.string().optional(),
+      description: z2.string().optional(),
+      state: z2.string().optional(),
+      assignee: z2.string().nullable().optional(),
+      priority: prioritySchema
+    },
+    async (args) => {
+      try {
+        return text2(await updateLinearIssue(args));
+      } catch (err) {
+        return fail2(err);
+      }
+    }
+  );
+  server.tool(
+    "linear_comment",
+    "Add a markdown comment on a Linear issue (uuid or ENG-123).",
+    {
+      id: z2.string(),
+      body: z2.string()
+    },
+    async (args) => {
+      try {
+        return text2(await commentLinearIssue(args));
+      } catch (err) {
+        return fail2(err);
+      }
+    }
+  );
+}
+
 // src/mcp/server.ts
 var MAX_ORCH_THREADS = 5;
 var CREATE_THREAD_TIMEOUT_MS = 9e4;
@@ -7786,7 +8232,7 @@ async function startMcpServer() {
   server.tool(
     "get_thread",
     "Get a compact thread summary by id/ref",
-    { ref: z2.string() },
+    { ref: z3.string() },
     async ({ ref }) => {
       const t = orch.getThread(ref);
       if (!t) {
@@ -7815,14 +8261,14 @@ async function startMcpServer() {
     "present_artifact",
     "Show an HTML, SVG, markdown, or React document in Sideboard\u2019s Claude-style side column (desktop). Use instead of claude.ai\u2019s artifact tool \u2014 pass the full document content. Prefer type=html for interactive pages. For type=react, pass a single component module that `export default`s a component (JSX/TSX ok) \u2014 Sideboard bootstraps React/ReactDOM/Babel and renders it; only `react`/`react-dom` imports are available, no other npm packages.",
     {
-      title: z2.string().describe("Short title shown in the artifact pane header"),
-      type: z2.enum(["html", "svg", "markdown", "react"]).describe(
+      title: z3.string().describe("Short title shown in the artifact pane header"),
+      type: z3.enum(["html", "svg", "markdown", "react"]).describe(
         "Artifact kind \u2014 html opens an iframe preview; react transpiles and renders a default-exported component in a sandboxed iframe"
       ),
-      content: z2.string().describe(
+      content: z3.string().describe(
         "Full document body (complete HTML page, SVG markup, markdown, or a React component module with a default export)"
       ),
-      artifact_id: z2.string().optional().describe("Stable id when updating the same artifact across turns")
+      artifact_id: z3.string().optional().describe("Stable id when updating the same artifact across turns")
     },
     async ({ title, type, artifact_id }) => {
       const id = artifact_id?.trim() || `artifact_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
@@ -7840,15 +8286,15 @@ async function startMcpServer() {
     "ask_user",
     "Ask the user clarifying multiple-choice questions in Sideboard\u2019s composer (plan mode). Before calling, write a short chat message explaining the decision and what each option means. Include a description on every option. Use for approach forks and requirements \u2014 not for \u201Cis the plan ready?\u201D. After calling, stop and wait for their next message with answers.",
     {
-      questions: z2.array(
-        z2.object({
-          question: z2.string().describe("Full question text ending with ?"),
-          header: z2.string().max(24).optional().describe("Short label shown above the question"),
-          multiSelect: z2.boolean().optional().describe("Allow selecting multiple options"),
-          options: z2.array(
-            z2.object({
-              label: z2.string(),
-              description: z2.string().optional().describe("What this option means / when to choose it (strongly preferred)")
+      questions: z3.array(
+        z3.object({
+          question: z3.string().describe("Full question text ending with ?"),
+          header: z3.string().max(24).optional().describe("Short label shown above the question"),
+          multiSelect: z3.boolean().optional().describe("Allow selecting multiple options"),
+          options: z3.array(
+            z3.object({
+              label: z3.string(),
+              description: z3.string().optional().describe("What this option means / when to choose it (strongly preferred)")
             })
           ).min(2).max(6).describe("2\u20136 choices (Sideboard also offers Other)")
         })
@@ -7867,9 +8313,9 @@ async function startMcpServer() {
     "present_plan",
     "Save the implementation plan as markdown to .context/attachments/plan.md and show it in Sideboard chat for user approval (Copy / Hand off / Approve). Call this when the plan is ready \u2014 required in plan mode. Pass the full plan body in content. Then Claude should call ExitPlanMode.",
     {
-      title: z2.string().optional().describe("Short plan title (defaults to Plan)"),
-      content: z2.string().min(1).describe("Full plan markdown (headings, steps, risks, open questions)"),
-      thread_id: z2.string().optional().describe("Sideboard thread id when cwd is not the worktree")
+      title: z3.string().optional().describe("Short plan title (defaults to Plan)"),
+      content: z3.string().min(1).describe("Full plan markdown (headings, steps, risks, open questions)"),
+      thread_id: z3.string().optional().describe("Sideboard thread id when cwd is not the worktree")
     },
     async ({ title, content, thread_id }) => {
       const { writePlanFile: writePlanFile2 } = await import("./plan-file-6O7G4VPQ.js");
@@ -7892,15 +8338,15 @@ async function startMcpServer() {
     "present_schema",
     "Open Sideboard\u2019s schema-driven side column (filterable table and/or form). Pass JSON Schema + optional schemaUi. Prefer datasource=inline with embedded resource/records. Use datasource=brightsy with resource_id only when the user is logged into Brightsy.",
     {
-      title: z2.string().describe("Pane title"),
-      mode: z2.enum(["table", "form"]).optional().describe("table = list/filter records; form = edit one record"),
-      datasource: z2.enum(["brightsy", "inline"]).optional().describe("brightsy resolves via login; inline uses embedded resource/records"),
-      resource_id: z2.string().optional().describe("Brightsy record type UUID (or generic resource id)"),
-      record_id: z2.string().optional().describe("Record id when opening form mode"),
-      resource: z2.record(z2.unknown()).optional().describe("Inline { id, title, schema, schemaUi?, slug? }"),
-      record: z2.record(z2.unknown()).optional().describe("Inline record { id, data, published_at? }"),
-      records: z2.array(z2.record(z2.unknown())).optional().describe("Inline records for table mode"),
-      pane_id: z2.string().optional().describe("Stable pane id across updates")
+      title: z3.string().describe("Pane title"),
+      mode: z3.enum(["table", "form"]).optional().describe("table = list/filter records; form = edit one record"),
+      datasource: z3.enum(["brightsy", "inline"]).optional().describe("brightsy resolves via login; inline uses embedded resource/records"),
+      resource_id: z3.string().optional().describe("Brightsy record type UUID (or generic resource id)"),
+      record_id: z3.string().optional().describe("Record id when opening form mode"),
+      resource: z3.record(z3.unknown()).optional().describe("Inline { id, title, schema, schemaUi?, slug? }"),
+      record: z3.record(z3.unknown()).optional().describe("Inline record { id, data, published_at? }"),
+      records: z3.array(z3.record(z3.unknown())).optional().describe("Inline records for table mode"),
+      pane_id: z3.string().optional().describe("Stable pane id across updates")
     },
     async (args) => {
       const id = args.pane_id?.trim() || `schema_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
@@ -7921,10 +8367,10 @@ async function startMcpServer() {
     "present_files",
     "Open Sideboard\u2019s Files column (CMS-style file manager: browse, upload, pick). Use datasource=brightsy when the user is logged into Brightsy account storage; datasource=memory for a session-local demo store. Prefer this over claiming a file manager UI is unavailable. Pair with present_schema when editing records that need media.",
     {
-      title: z2.string().optional().describe("Pane title (default: Files)"),
-      datasource: z2.enum(["brightsy", "memory"]).optional().describe("brightsy = account storage via login; memory = session demo store"),
-      path: z2.string().optional().describe("Initial folder path (e.g. public)"),
-      pane_id: z2.string().optional().describe("Stable pane id across updates")
+      title: z3.string().optional().describe("Pane title (default: Files)"),
+      datasource: z3.enum(["brightsy", "memory"]).optional().describe("brightsy = account storage via login; memory = session demo store"),
+      path: z3.string().optional().describe("Initial folder path (e.g. public)"),
+      pane_id: z3.string().optional().describe("Stable pane id across updates")
     },
     async (args) => {
       const id = args.pane_id?.trim() || `files_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
@@ -7940,19 +8386,21 @@ async function startMcpServer() {
     }
   );
   registerSlackTools(server);
+  registerLinearTools(server);
   if (sideboardMcpProfile() !== "worktree") {
-    const { getCaffeinateHold: getCaffeinateHold2, setCaffeinateHold: setCaffeinateHold2 } = await import("./caffeinate-hold-KLC6SABD.js");
+    const { getCaffeinateHold: getCaffeinateHold2, setCaffeinateHold: setCaffeinateHold2 } = await import("./caffeinate-hold-EAZNWJBE.js");
     const { resolveNewThreadOptions: resolveNewThreadOptions2, resolveThreadDefaults: resolveThreadDefaults2 } = await import("./app-settings-3TLA2EJ7.js");
     const accountDefaults = resolveThreadDefaults2();
     const accountDefaultsHint = `Account defaults: agent=${accountDefaults.agent}, model=${accountDefaults.model?.trim() || "Auto"}, effort=${accountDefaults.effort}`;
     server.tool(
       "set_caffeinate",
-      "Keep this Mac awake with caffeinate (like Claude Code) across turns \u2014 independent of Settings toggles. Turn ON when the user will be away from the keyboard, is driving work from Slack, or asks you to keep the machine awake. Turn OFF when they say they are done, wrapping up, going to sleep, or no longer need the Mac awake. macOS only.",
+      "Keep this Mac awake with caffeinate (like Claude Code) across turns \u2014 independent of Settings toggles. Turn ON when the user will be away from the keyboard, is driving work from Slack, or asks you to keep the machine awake. Turn OFF when they say they are done, wrapping up, going to sleep, or no longer need the Mac awake. Closing or archiving this orchestration chat also releases the hold. macOS only.",
       {
-        enabled: z2.boolean().describe("true = hold caffeinate on; false = release and let the Mac sleep")
+        enabled: z3.boolean().describe("true = hold caffeinate on; false = release and let the Mac sleep")
       },
       async ({ enabled }) => {
-        const state = setCaffeinateHold2(enabled);
+        const threadId = process.env.SIDEBOARD_ORCHESTRATOR_THREAD_ID?.trim() || null;
+        const state = setCaffeinateHold2(enabled, { threadId });
         if (enabled && !state.held) {
           return {
             content: [
@@ -7975,7 +8423,7 @@ async function startMcpServer() {
               text: JSON.stringify({
                 ...getCaffeinateHold2(),
                 ok: true,
-                message: state.held ? "Mac will stay awake until you call set_caffeinate with enabled=false (or the user says they are done)." : "Caffeinate hold released. The Mac can sleep (unless Settings caffeinate toggles are on)."
+                message: state.held ? "Mac will stay awake until you call set_caffeinate with enabled=false, the user says they are done, or this orchestration chat is closed." : "Caffeinate hold released. The Mac can sleep (unless Settings caffeinate toggles are on)."
               })
             }
           ]
@@ -7986,15 +8434,15 @@ async function startMcpServer() {
       "create_thread",
       `Create a new worktree thread (chat) from branch, pr, or ticket. Pass repoPath from list_workspaces. From an orchestration chat, omit parentThreadId (Sideboard binds the child to this chat) or pass the exact id from the turn reminder \u2014 never invent a uuid. Prefer omitting agent/model so Sideboard applies ${accountDefaultsHint}. Then use send_to_thread to chat.`,
       {
-        sourceType: z2.enum(["branch", "pr", "ticket"]),
-        sourceRef: z2.string(),
-        agent: z2.enum(["claude", "codex", "opencode", "brightsy", "cursor"]).optional().describe(`Omit to use Account default agent (${accountDefaults.agent})`),
-        model: z2.string().nullable().optional().describe(
+        sourceType: z3.enum(["branch", "pr", "ticket"]),
+        sourceRef: z3.string(),
+        agent: z3.enum(["claude", "codex", "opencode", "brightsy", "cursor"]).optional().describe(`Omit to use Account default agent (${accountDefaults.agent})`),
+        model: z3.string().nullable().optional().describe(
           `Usually omit to use Account default model (${accountDefaults.model?.trim() || "Auto"}). Pass null only to force Auto / agent-default.`
         ),
-        repoPath: z2.string(),
-        title: z2.string().optional(),
-        parentThreadId: z2.string().optional().describe(
+        repoPath: z3.string(),
+        title: z3.string().optional(),
+        parentThreadId: z3.string().optional().describe(
           "Orchestration: omit (preferred) or pass YOUR chat id from the turn reminder / AGENTS.md. Do not invent uuids."
         )
       },
@@ -8099,11 +8547,11 @@ async function startMcpServer() {
     );
     server.tool(
       "send_to_thread",
-      "Queue a prompt on a worktree thread chat (runs under concurrency cap). Use after create_thread to start or continue a conversation. Set force_stop=true to interrupt an in-flight/queued turn (kill + clear queue) before queueing this prompt \u2014 use when the thread is mid-turn or has stale queued prompts you need to replace.",
+      "Queue a prompt on a worktree thread chat (runs under concurrency cap). Use after create_thread to start or continue a conversation. For commit/push/PR/merge, prefer ask_git (canonical desktop-button phrases). Set force_stop=true to interrupt an in-flight/queued turn (kill + clear queue) before queueing this prompt \u2014 use when the thread is mid-turn or has stale queued prompts you need to replace.",
       {
-        ref: z2.string(),
-        prompt: z2.string(),
-        force_stop: z2.boolean().optional()
+        ref: z3.string(),
+        prompt: z3.string(),
+        force_stop: z3.boolean().optional()
       },
       async ({ ref, prompt, force_stop }) => {
         if (force_stop) {
@@ -8130,10 +8578,10 @@ async function startMcpServer() {
     );
     server.tool(
       "wait_for_turn",
-      "Block until the thread finishes its current/queued turn (avoids polling). Use after send_to_thread to read the agent reply.",
+      "Block until the thread finishes its current/queued turn (avoids polling). Use after send_to_thread or ask_git to read the agent reply.",
       {
-        ref: z2.string(),
-        timeoutMs: z2.number().optional()
+        ref: z3.string(),
+        timeoutMs: z3.number().optional()
       },
       async ({ ref, timeoutMs }) => {
         const thread = await orch.waitForTurn(ref, timeoutMs ?? 6e5);
@@ -8155,7 +8603,7 @@ async function startMcpServer() {
     server.tool(
       "get_turn_result",
       "Final assistant message only (not full transcript)",
-      { ref: z2.string() },
+      { ref: z3.string() },
       async ({ ref }) => {
         const result = orch.getTurnResult(ref);
         return { content: [{ type: "text", text: JSON.stringify(result) }] };
@@ -8165,8 +8613,8 @@ async function startMcpServer() {
       "stop_thread",
       "Force-stop a thread: kill any in-flight agent turn AND clear queued prompts so drainQueue cannot continue. Does not archive the worktree. Optional force defaults to true.",
       {
-        ref: z2.string(),
-        force: z2.boolean().optional()
+        ref: z3.string(),
+        force: z3.boolean().optional()
       },
       async ({ ref, force }) => {
         const t = orch.getThread(ref);
@@ -8195,8 +8643,8 @@ async function startMcpServer() {
     );
     server.tool(
       "archive_thread",
-      "Archive a thread (stops agent/dev, runs archive script, removes worktree when last chat tab). Coordinators open PRs only by asking the worktree agent.",
-      { ref: z2.string() },
+      "Archive a thread (stops agent/dev, runs archive script, removes worktree when last chat tab). Coordinators commit, push, open PRs, and merge only by asking the worktree agent (ask_git).",
+      { ref: z3.string() },
       async ({ ref }) => {
         const t = orch.getThread(ref);
         if (!t) {
@@ -8229,7 +8677,7 @@ async function startMcpServer() {
     server.tool(
       "restore_thread",
       "Restore an archived thread (recreates worktree from branch when needed)",
-      { ref: z2.string() },
+      { ref: z3.string() },
       async ({ ref }) => {
         try {
           const restored = await orch.restore(ref);
@@ -8255,8 +8703,8 @@ async function startMcpServer() {
       "get_diff",
       "Compact diff summary (capped hunks, paginated)",
       {
-        ref: z2.string(),
-        maxFiles: z2.number().optional()
+        ref: z3.string(),
+        maxFiles: z3.number().optional()
       },
       async ({ ref, maxFiles }) => {
         const summary = await orch.diffSummary(ref);
@@ -8276,7 +8724,7 @@ async function startMcpServer() {
     server.tool(
       "request_review",
       'Start a merge-readiness Review on a worktree agent thread (same as the desktop Review button). Opens a new Review chat tab, attaches .sideboard/review.md when present (else local Review request.md / stock template), and sends "Review changes in this workspace." Expect Approve / Approve with nits / Request changes / Needs more information. Pass a worktree thread ref \u2014 not the orchestrator. Then wait_for_turn / get_turn_result on the returned review tab id.',
-      { ref: z2.string().describe("Worktree thread id/ref to review") },
+      { ref: z3.string().describe("Worktree thread id/ref to review") },
       async ({ ref }) => {
         try {
           const tab = await orch.requestReview(ref);
@@ -8301,7 +8749,39 @@ async function startMcpServer() {
         }
       }
     );
-    const agentEnum = z2.enum(["claude", "codex", "opencode", "brightsy", "cursor"]);
+    server.tool(
+      "ask_git",
+      "Tell a worktree agent to commit & push, open a draft PR, resolve conflicts, or merge the linked PR \u2014 same short prompts as the desktop git buttons. The worktree agent runs git/gh (`gh pr merge`); this only queues the prompt. Pass a worktree thread ref (not the orchestrator). Then wait_for_turn / get_turn_result. Do not run git or gh from the orchestration cwd.",
+      {
+        ref: z3.string().describe("Worktree thread id/ref"),
+        action: z3.enum(AGENT_GIT_ACTIONS).describe(
+          "commit-push | create-draft | create-web | resolve-conflicts | merge"
+        )
+      },
+      async ({ ref, action }) => {
+        try {
+          const thread = await orch.askGit(ref, action);
+          return {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify({
+                  id: thread.id,
+                  status: thread.status,
+                  queueLength: thread.queue.length,
+                  action,
+                  link: `sideboard://thread/${thread.id}`
+                })
+              }
+            ]
+          };
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          return { content: [{ type: "text", text: message }], isError: true };
+        }
+      }
+    );
+    const agentEnum = z3.enum(["claude", "codex", "opencode", "brightsy", "cursor"]);
     server.tool(
       "list_models",
       "List models for an agent. Prefer Auto: do not call this unless you have a reason to pin a specific model (user request, cost/latency, capability). Omit agent to list all.",
@@ -8324,11 +8804,11 @@ async function startMcpServer() {
       "fork_worktree",
       "Fork a worktree agent chat into a NEW git worktree + chat (desktop \u201CFork to new workspace\u201D). Seeds a transcript (through through_index, default all). Optional agent override. Leave model unset for Auto (default) \u2014 only pass model when you have a reason. Not for the orchestrator. Then send_to_thread / wait_for_turn on the returned id.",
       {
-        ref: z2.string().describe("Worktree thread id/ref to fork"),
-        through_index: z2.number().optional().describe("Inclusive message index to include in the transcript (default: all)"),
+        ref: z3.string().describe("Worktree thread id/ref to fork"),
+        through_index: z3.number().optional().describe("Inclusive message index to include in the transcript (default: all)"),
         agent: agentEnum.optional().describe("Agent for the forked chat (default: same as source)"),
-        model: z2.string().nullable().optional().describe("Usually omit (Auto). Only set from list_models when you need a specific model"),
-        title: z2.string().optional()
+        model: z3.string().nullable().optional().describe("Usually omit (Auto). Only set from list_models when you need a specific model"),
+        title: z3.string().optional()
       },
       async ({ ref, through_index, agent, model, title }) => {
         try {
@@ -8369,11 +8849,11 @@ async function startMcpServer() {
       "fork_chat",
       "Fork a chat into a NEW tab on the SAME workspace: worktree agent \u2192 same worktree tab; Global orchestration chat \u2192 new orchestration chat (same synthetic home). Seeds a transcript; optional agent override. Leave model unset for Auto unless you have a reason. Orchestration forks require an MCP-capable agent (claude, cursor, codex, opencode \u2014 not brightsy). Slack / Global orchestrators use this to continue an orchestration chat on another agent after session limits. Then send_to_thread / wait_for_turn on the returned id. Use fork_worktree only for worktree agents that need a new git worktree.",
       {
-        ref: z2.string().describe("Thread id/ref to fork (worktree agent or orchestration chat)"),
-        through_index: z2.number().optional().describe("Inclusive message index to include in the transcript (default: all)"),
+        ref: z3.string().describe("Thread id/ref to fork (worktree agent or orchestration chat)"),
+        through_index: z3.number().optional().describe("Inclusive message index to include in the transcript (default: all)"),
         agent: agentEnum.optional().describe("Agent for the forked chat (default: same as source)"),
-        model: z2.string().nullable().optional().describe("Usually omit (Auto). Only set from list_models when you need a specific model"),
-        title: z2.string().optional()
+        model: z3.string().nullable().optional().describe("Usually omit (Auto). Only set from list_models when you need a specific model"),
+        title: z3.string().optional()
       },
       async ({ ref, through_index, agent, model, title }) => {
         try {
@@ -8419,8 +8899,8 @@ async function startMcpServer() {
       "run_dev_script",
       "Start a .sideboard/.conductor run script for a thread (default script if name omitted); returns port",
       {
-        ref: z2.string(),
-        name: z2.string().optional()
+        ref: z3.string(),
+        name: z3.string().optional()
       },
       async ({ ref, name }) => {
         const result = await orch.startDev(ref, name);
@@ -8442,7 +8922,7 @@ async function startMcpServer() {
     server.tool(
       "list_run_scripts",
       "List named run scripts available for a thread",
-      { ref: z2.string() },
+      { ref: z3.string() },
       async ({ ref }) => {
         const scripts = orch.listThreadRunScripts(ref);
         const active = orch.getActiveRuns(ref);
@@ -8460,8 +8940,8 @@ async function startMcpServer() {
       "stop_dev_script",
       "Stop a running script for a thread (all scripts if name omitted)",
       {
-        ref: z2.string(),
-        name: z2.string().optional()
+        ref: z3.string(),
+        name: z3.string().optional()
       },
       async ({ ref, name }) => {
         orch.stopDev(ref, name);
@@ -8471,7 +8951,7 @@ async function startMcpServer() {
     server.tool(
       "run_setup",
       "Re-run workspace setup (Sideboard/Conductor settings or .cursor/worktrees.json)",
-      { ref: z2.string() },
+      { ref: z3.string() },
       async ({ ref }) => {
         const result = await orch.runSetup(ref);
         return {
@@ -8482,7 +8962,7 @@ async function startMcpServer() {
     server.tool(
       "add_workspace",
       "Register a git repo as a Sideboard workspace",
-      { repoPath: z2.string() },
+      { repoPath: z3.string() },
       async ({ repoPath }) => {
         const ws = await orch.addWorkspace(repoPath);
         return { content: [{ type: "text", text: JSON.stringify(ws) }] };
@@ -8491,7 +8971,7 @@ async function startMcpServer() {
     server.tool(
       "remove_workspace",
       "Unregister a Sideboard workspace (does not archive threads)",
-      { repoPath: z2.string() },
+      { repoPath: z3.string() },
       async ({ repoPath }) => {
         orch.removeWorkspace(repoPath);
         return { content: [{ type: "text", text: "ok" }] };
@@ -8501,12 +8981,12 @@ async function startMcpServer() {
       "fanout",
       "Best-of-n: create one thread per agent with the same prompt (parallel attempts)",
       {
-        prompt: z2.string(),
-        agents: z2.array(z2.enum(["claude", "codex", "opencode", "brightsy", "cursor"])),
-        repoPath: z2.string(),
-        sourceType: z2.enum(["branch", "pr", "ticket"]).optional(),
-        sourceRef: z2.string().optional(),
-        title: z2.string().optional()
+        prompt: z3.string(),
+        agents: z3.array(z3.enum(["claude", "codex", "opencode", "brightsy", "cursor"])),
+        repoPath: z3.string(),
+        sourceType: z3.enum(["branch", "pr", "ticket"]).optional(),
+        sourceRef: z3.string().optional(),
+        title: z3.string().optional()
       },
       async (args) => {
         const threads = await orch.bestOfN(args);
@@ -8533,8 +9013,8 @@ async function startMcpServer() {
       "list_branches",
       "List git branches in a registered workspace. Pass repoPath from list_workspaces (unmerged into the default branch by default \u2014 for create_thread sourceType=branch).",
       {
-        repoPath: z2.string(),
-        unmergedOnly: z2.boolean().optional()
+        repoPath: z3.string(),
+        unmergedOnly: z3.boolean().optional()
       },
       async ({ repoPath, unmergedOnly }) => {
         const root = await resolveRepoRoot(repoPath);
@@ -8554,7 +9034,7 @@ async function startMcpServer() {
     server.tool(
       "list_prs",
       "List open GitHub PRs for a registered workspace. Pass repoPath from list_workspaces (uses gh against that repo remote). Then create_thread with sourceType=pr.",
-      { repoPath: z2.string() },
+      { repoPath: z3.string() },
       async ({ repoPath }) => {
         const root = await resolveRepoRoot(repoPath);
         const prs = await listPrs(root);
@@ -8572,8 +9052,8 @@ async function startMcpServer() {
     );
     server.tool(
       "get_pr_stack",
-      "Load the GitHub PR stack for a thread worktree (`gh stack view --json`). Returns null JSON when the branch is not stacked. Prefer this before mergePr on stacked PRs.",
-      { ref: z2.string() },
+      "Load the GitHub PR stack for a thread worktree (`gh stack view --json`). Returns null JSON when the branch is not stacked. Prefer this before ask_git merge on stacked PRs.",
+      { ref: z3.string() },
       async ({ ref }) => {
         const stack = await orch.getPrStack(ref);
         return {
@@ -8585,8 +9065,8 @@ async function startMcpServer() {
       "open_pr_stack_layers",
       "Materialize one worktree+thread per stack layer (or a single 1-based layer). Pass a thread ref already on the stack.",
       {
-        ref: z2.string(),
-        layer: z2.number().int().positive().optional()
+        ref: z3.string(),
+        layer: z3.number().int().positive().optional()
       },
       async ({ ref, layer }) => {
         const result = await orch.openPrStackLayers(ref, { layer });
@@ -8620,9 +9100,9 @@ async function startMcpServer() {
       "add_stack_layer",
       "Add a branch on top of the current stack (`gh stack add`) and open a worktree+thread for it.",
       {
-        ref: z2.string(),
-        branchName: z2.string(),
-        title: z2.string().optional()
+        ref: z3.string(),
+        branchName: z3.string(),
+        title: z3.string().optional()
       },
       async ({ ref, branchName, title }) => {
         const result = await orch.addStackLayer(ref, branchName, { title });
@@ -8651,11 +9131,11 @@ async function startMcpServer() {
       "create_pr_stack",
       "Create a new GitHub PR stack with one Sideboard worktree per layer (bottom\u2192top branch names). Requires `gh extension install github/gh-stack`.",
       {
-        repoPath: z2.string(),
-        branches: z2.array(z2.string()).min(1),
-        agent: z2.enum(["claude", "codex", "opencode", "brightsy", "cursor"]),
-        base: z2.string().optional(),
-        title: z2.string().optional()
+        repoPath: z3.string(),
+        branches: z3.array(z3.string()).min(1),
+        agent: z3.enum(["claude", "codex", "opencode", "brightsy", "cursor"]),
+        base: z3.string().optional(),
+        title: z3.string().optional()
       },
       async (args) => {
         const result = await orch.createPrStack({
@@ -8693,7 +9173,7 @@ async function startMcpServer() {
     server.tool(
       "list_issues",
       "List issues from Sideboard Account connections (Linear API or GitHub Issues; Linear\u2192GitHub fallback when Linear is not connected). Pass repoPath from list_workspaces \u2014 GitHub Issues are scoped to that repo. Then create_thread with sourceType=ticket.",
-      { repoPath: z2.string() },
+      { repoPath: z3.string() },
       async ({ repoPath }) => {
         const root = await resolveRepoRoot(repoPath);
         const result = await listIssues(root);
@@ -8704,8 +9184,8 @@ async function startMcpServer() {
       "list_linear_issues",
       "Deprecated: prefer list_issues. Lists assigned Linear issues via the chosen agent MCP connector",
       {
-        agent: z2.enum(["claude", "codex", "opencode"]),
-        repoPath: z2.string()
+        agent: z3.enum(["claude", "codex", "opencode"]),
+        repoPath: z3.string()
       },
       async ({ agent, repoPath }) => {
         const issues = await listLinearIssues(agent, repoPath);
@@ -8718,18 +9198,7 @@ async function startMcpServer() {
 }
 
 // src/brightsy/api.ts
-function formatBrightsyFetchError(err, url) {
-  if (!(err instanceof Error)) return `${String(err)} (${url})`;
-  const cause = err.cause;
-  let detail = "";
-  if (cause instanceof Error) {
-    const code = typeof cause.code === "string" ? cause.code : void 0;
-    detail = code ? ` [${code}: ${cause.message}]` : ` [${cause.message}]`;
-  } else if (cause != null) {
-    detail = ` [${String(cause)}]`;
-  }
-  return `${err.message}${detail} (${url})`;
-}
+var formatBrightsyFetchError = formatFetchError;
 var BrightsySideboardApi = class {
   cfg;
   fetchImpl;
@@ -8849,8 +9318,8 @@ var BrightsySideboardApi = class {
 };
 function taskMessageText(task) {
   const parts = task.message?.parts ?? [];
-  const text2 = parts.find((p) => p.kind === "text")?.text ?? "";
-  return text2.trim();
+  const text3 = parts.find((p) => p.kind === "text")?.text ?? "";
+  return text3.trim();
 }
 
 // src/brightsy/cloud-connect.ts
@@ -9046,63 +9515,128 @@ async function runCloudConnect(opts) {
 
 // src/slack/oauth.ts
 import { randomBytes as randomBytes2 } from "crypto";
-import { createServer as createServer3 } from "http";
 
 // src/slack/baked-app.ts
 var BAKED_SLACK_CLIENT_ID = "7592788819232.11813536272562";
-var BAKED_SLACK_CLIENT_SECRET = "10290abf6ad0dc11fe6fc321a6215299";
-var BAKED_SLACK_RELAY_URL = "wss://slack-relay.sideboard.cloud/desktop";
+var BAKED_SLACK_RELAY_URL = "wss://relay.sideboard.cloud/slack/desktop";
 function hasBakedSlackOAuth() {
-  return Boolean(BAKED_SLACK_CLIENT_ID.trim() && BAKED_SLACK_CLIENT_SECRET.trim());
+  return Boolean(BAKED_SLACK_CLIENT_ID.trim());
 }
 function slackRelayUrl() {
   return process.env.SIDEBOARD_SLACK_RELAY_URL?.trim() || BAKED_SLACK_RELAY_URL.trim();
 }
 
 // src/slack/oauth-redirect.ts
-var SLACK_OAUTH_PORT = 19847;
-var SLACK_OAUTH_LOCAL_CALLBACK = `http://127.0.0.1:${SLACK_OAUTH_PORT}/callback`;
-var SLACK_OAUTH_REDIRECT = "https://slack-relay.sideboard.cloud/callback";
-var SLACK_OAUTH_BOUNCE_PATH = "/callback";
-var BOUNCE_PARAMS = ["code", "state", "error", "error_description"];
+var SLACK_OAUTH_CALLBACK_PATH = "/slack/callback";
+var SLACK_OAUTH_RESULT_PATH = "/slack/oauth/result";
+var SLACK_RELAY_DESKTOP_PATH = "/slack/desktop";
+var SLACK_OAUTH_LOCAL_PORT = 19847;
+var SLACK_OAUTH_LOCAL_CALLBACK = `http://127.0.0.1:${SLACK_OAUTH_LOCAL_PORT}${SLACK_OAUTH_CALLBACK_PATH}`;
+var SLACK_OAUTH_REDIRECT = `https://relay.sideboard.cloud${SLACK_OAUTH_CALLBACK_PATH}`;
 function slackOAuthRedirectUri() {
   return process.env.SIDEBOARD_SLACK_OAUTH_REDIRECT?.trim() || SLACK_OAUTH_REDIRECT;
 }
-function slackOAuthLocalBounceTarget(params) {
-  const dest = new URL(SLACK_OAUTH_LOCAL_CALLBACK);
-  for (const key of BOUNCE_PARAMS) {
-    const value = params.get(key);
-    if (value) dest.searchParams.set(key, value);
-  }
-  return dest.toString();
-}
 function escapeHtml(value) {
   return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-function slackOAuthBounceHtml(target) {
-  const safe = escapeHtml(target);
-  return `<!doctype html><html><head><meta charset="utf-8"><meta http-equiv="refresh" content="0;url=${safe}"><title>Connecting Slack</title>
+function slackOAuthHtmlPage(title, body) {
+  return `<!doctype html><html><head><meta charset="utf-8"><title>${escapeHtml(title)}</title>
 <style>body{font-family:ui-sans-serif,system-ui,sans-serif;padding:48px 24px;max-width:36rem;margin:0 auto;color:#1a1a1a}
-h1{font-size:1.25rem}p{line-height:1.5;color:#444}a{color:#111}</style>
-<script>location.replace(${JSON.stringify(target)})</script>
-</head><body><h1>Connecting Slack</h1><p>Returning to Sideboard\u2026 <a href="${safe}">Continue</a></p></body></html>`;
+h1{font-size:1.25rem}p{line-height:1.5;color:#444}</style></head><body>${body}</body></html>`;
 }
-function slackOAuthBounceResponse(reqUrl) {
+function parseSlackOAuthCallbackUrl(reqUrl) {
   let url;
   try {
     url = new URL(reqUrl, SLACK_OAUTH_REDIRECT);
   } catch {
     return null;
   }
-  if (url.pathname !== SLACK_OAUTH_BOUNCE_PATH) return null;
-  const target = slackOAuthLocalBounceTarget(url.searchParams);
+  if (url.pathname !== SLACK_OAUTH_CALLBACK_PATH) return null;
+  return url;
+}
+function parseSlackOAuthResultUrl(reqUrl) {
+  let url;
+  try {
+    url = new URL(reqUrl, SLACK_OAUTH_REDIRECT);
+  } catch {
+    return null;
+  }
+  if (url.pathname !== SLACK_OAUTH_RESULT_PATH) return null;
+  return url;
+}
+
+// src/slack/oauth-exchange.ts
+var PENDING_TTL_MS = 5 * 6e4;
+var SlackOAuthPendingStore = class {
+  items = /* @__PURE__ */ new Map();
+  put(state, value) {
+    const id = state.trim();
+    if (!id) return;
+    this.sweep();
+    const existing = this.items.get(id);
+    if (existing && existing.value.ok && !value.ok) return;
+    this.items.set(id, { expiresAt: Date.now() + PENDING_TTL_MS, value });
+  }
+  /** Consume a pending result. Missing/expired → null (desktop should keep polling). */
+  take(state) {
+    const id = state.trim();
+    if (!id) return null;
+    this.sweep();
+    const row = this.items.get(id);
+    if (!row) return null;
+    this.items.delete(id);
+    return row.value;
+  }
+  sweep() {
+    const now = Date.now();
+    for (const [key, row] of this.items) {
+      if (row.expiresAt <= now) this.items.delete(key);
+    }
+  }
+};
+function slackRelayHttpOrigin(relayWsUrl) {
+  const raw = (relayWsUrl ?? slackRelayUrl()).trim();
+  const http = raw.replace(/^ws/i, "http");
+  const u = new URL(http);
+  return `${u.protocol}//${u.host}`;
+}
+function slackOAuthResultUrl(state, relayWsUrl) {
+  const u = new URL(SLACK_OAUTH_RESULT_PATH, slackRelayHttpOrigin(relayWsUrl));
+  u.searchParams.set("state", state);
+  return u.toString();
+}
+function slackOAuthRelayClientId() {
+  return process.env.SIDEBOARD_SLACK_CLIENT_ID?.trim() || BAKED_SLACK_CLIENT_ID.trim();
+}
+function slackOAuthRelayRedirectUri() {
+  return slackOAuthRedirectUri() || SLACK_OAUTH_REDIRECT;
+}
+async function exchangeSlackOAuthCode(opts) {
+  const body = new URLSearchParams({
+    client_id: opts.clientId,
+    client_secret: opts.clientSecret,
+    code: opts.code,
+    redirect_uri: opts.redirectUri
+  });
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const res = await fetchImpl("https://slack.com/api/oauth.v2.access", {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body
+  });
+  const data = await res.json();
+  if (!data.ok) {
+    throw new Error(`Slack OAuth exchange failed: ${data.error || res.status}`);
+  }
+  const teamId = data.team?.id?.trim();
+  if (!teamId) throw new Error("Slack OAuth did not return a team id");
   return {
-    status: 302,
-    headers: {
-      Location: target,
-      "Content-Type": "text/html; charset=utf-8"
-    },
-    body: slackOAuthBounceHtml(target)
+    team_id: teamId,
+    team_name: data.team?.name?.trim() || teamId,
+    user_id: data.authed_user?.id?.trim() || void 0,
+    bot_token: data.access_token?.trim() || void 0,
+    user_token: data.authed_user?.access_token?.trim() || void 0,
+    scopes: [data.scope, data.authed_user?.scope].filter(Boolean).join(",")
   };
 }
 
@@ -9138,13 +9672,13 @@ var SLACK_USER_SCOPES = [
 function slackOAuthCredentials() {
   const settings = loadAppSettings();
   const clientId = process.env.SIDEBOARD_SLACK_CLIENT_ID?.trim() || settings.integrations.slackClientId?.trim() || BAKED_SLACK_CLIENT_ID.trim();
-  const clientSecret = process.env.SIDEBOARD_SLACK_CLIENT_SECRET?.trim() || settings.integrations.slackClientSecret?.trim() || BAKED_SLACK_CLIENT_SECRET.trim();
-  if (!clientId || !clientSecret) {
+  const clientSecret = process.env.SIDEBOARD_SLACK_CLIENT_SECRET?.trim() || settings.integrations.slackClientSecret?.trim() || "";
+  if (!clientId) {
     throw new Error(
-      "Slack browser sign-in needs a Slack app Client ID and Secret (Account \u2192 Slack, or SIDEBOARD_SLACK_CLIENT_ID / SIDEBOARD_SLACK_CLIENT_SECRET). You can still paste an xoxb- or xoxp- token."
+      "Slack browser sign-in needs a Slack app Client ID (Account \u2192 Slack, or SIDEBOARD_SLACK_CLIENT_ID). You can still paste an xoxb- or xoxp- token."
     );
   }
-  return { clientId, clientSecret };
+  return { clientId, clientSecret: clientSecret || null };
 }
 var SLACK_OAUTH_CANCELLED = "Slack sign-in cancelled";
 var SlackOAuthCancelledError = class extends Error {
@@ -9169,127 +9703,100 @@ function slackOAuthAuthorizeUrl(clientId, state) {
   });
   return `https://slack.com/oauth/v2/authorize?${params.toString()}`;
 }
-function htmlPage2(title, body) {
-  return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title>
-<style>body{font-family:ui-sans-serif,system-ui,sans-serif;padding:48px 24px;max-width:36rem;margin:0 auto;color:#1a1a1a}
-h1{font-size:1.25rem}p{line-height:1.5;color:#444}</style></head><body>${body}</body></html>`;
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(new SlackOAuthCancelledError());
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(new SlackOAuthCancelledError());
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function upsertFromPayload(payload) {
+  return upsertSlackWorkspace({
+    team_id: payload.team_id,
+    team_name: payload.team_name,
+    user_id: payload.user_id,
+    bot_token: payload.bot_token,
+    user_token: payload.user_token,
+    scopes: payload.scopes,
+    connected_at: (/* @__PURE__ */ new Date()).toISOString()
+  });
 }
 async function startSlackOAuth(opts) {
   if (opts?.signal?.aborted) {
     throw new SlackOAuthCancelledError();
   }
-  const { clientId, clientSecret } = slackOAuthCredentials();
+  const { clientId } = slackOAuthCredentials();
   const state = randomBytes2(16).toString("hex");
   const authorizeUrl = slackOAuthAuthorizeUrl(clientId, state);
   const timeoutMs = opts?.timeoutMs ?? 5 * 6e4;
-  const code = await new Promise((resolve, reject) => {
-    let settled = false;
-    const finish = (err, value) => {
-      if (settled) return;
-      settled = true;
-      cleanup();
-      if (err) reject(err);
-      else resolve(value);
-    };
-    const server = createServer3((req, res2) => {
-      try {
-        const url = new URL(req.url || "/", `http://127.0.0.1:${SLACK_OAUTH_PORT}`);
-        if (url.pathname !== "/callback") {
-          res2.writeHead(404);
-          res2.end("Not found");
-          return;
-        }
-        const err = url.searchParams.get("error");
-        const gotState = url.searchParams.get("state");
-        const gotCode = url.searchParams.get("code");
-        if (err) {
-          res2.writeHead(400, { "Content-Type": "text/html" });
-          res2.end(htmlPage2("Slack", `<h1>Authorization cancelled</h1><p>${err}</p>`));
-          finish(new SlackOAuthCancelledError(`Slack OAuth: ${err}`));
-          return;
-        }
-        if (gotState !== state || !gotCode) {
-          res2.writeHead(400, { "Content-Type": "text/html" });
-          res2.end(htmlPage2("Slack", "<h1>Invalid callback</h1><p>State or code missing.</p>"));
-          finish(new Error("Slack OAuth callback was invalid"));
-          return;
-        }
-        res2.writeHead(200, { "Content-Type": "text/html" });
-        res2.end(
-          htmlPage2(
-            "Slack connected",
-            "<h1>Slack workspace connected</h1><p>You can close this tab and return to Sideboard.</p>"
-          )
-        );
-        finish(void 0, gotCode);
-      } catch (e) {
-        finish(e instanceof Error ? e : new Error(String(e)));
-      }
-    });
-    const timer = setTimeout(() => {
-      finish(new Error("Slack sign-in timed out \u2014 try again"));
-    }, timeoutMs);
-    const onAbort = () => finish(new SlackOAuthCancelledError());
-    const cleanup = () => {
-      clearTimeout(timer);
-      opts?.signal?.removeEventListener("abort", onAbort);
-      server.close();
-    };
-    opts?.signal?.addEventListener("abort", onAbort, { once: true });
+  const pollIntervalMs = opts?.pollIntervalMs ?? 400;
+  const fetchImpl = opts?.fetchImpl ?? fetch;
+  const resultUrl = opts?.resultUrlForState?.(state) ?? slackOAuthResultUrl(state);
+  await Promise.resolve(opts?.openUrl?.(authorizeUrl));
+  if (opts?.signal?.aborted) {
+    throw new SlackOAuthCancelledError();
+  }
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
     if (opts?.signal?.aborted) {
-      onAbort();
-      return;
+      throw new SlackOAuthCancelledError();
     }
-    server.on("error", (e) => {
-      finish(
-        e instanceof Error && e.code === "EADDRINUSE" ? new Error(
-          `Port ${SLACK_OAUTH_PORT} is in use. Close whatever is bound there, or paste a Slack token instead.`
-        ) : e instanceof Error ? e : new Error(String(e))
-      );
-    });
-    server.listen(SLACK_OAUTH_PORT, "127.0.0.1", () => {
-      void Promise.resolve(opts?.openUrl?.(authorizeUrl)).catch((e) => {
-        finish(e instanceof Error ? e : new Error(String(e)));
+    let res;
+    try {
+      res = await fetchImpl(resultUrl);
+    } catch {
+      if (opts?.signal?.aborted) throw new SlackOAuthCancelledError();
+      await sleep(pollIntervalMs, opts?.signal);
+      continue;
+    }
+    let data;
+    try {
+      data = await res.json();
+    } catch {
+      await sleep(pollIntervalMs, opts?.signal);
+      continue;
+    }
+    if (data.ok && data.team_id?.trim()) {
+      return upsertFromPayload({
+        team_id: data.team_id.trim(),
+        team_name: data.team_name?.trim() || data.team_id.trim(),
+        user_id: data.user_id?.trim() || void 0,
+        bot_token: data.bot_token?.trim() || void 0,
+        user_token: data.user_token?.trim() || void 0,
+        scopes: data.scopes?.trim() || ""
       });
-    });
-  });
-  const body = new URLSearchParams({
-    client_id: clientId,
-    client_secret: clientSecret,
-    code,
-    redirect_uri: slackOAuthRedirectUri()
-  });
-  const res = await fetch("https://slack.com/api/oauth.v2.access", {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body
-  });
-  const data = await res.json();
-  if (!data.ok) {
-    throw new Error(`Slack OAuth exchange failed: ${data.error || res.status}`);
+    }
+    const err = data.error?.trim();
+    if (err && err !== "pending") {
+      if (/cancel/i.test(err) || /access_denied/i.test(err)) {
+        throw new SlackOAuthCancelledError(`Slack OAuth: ${err}`);
+      }
+      throw new Error(err.startsWith("Slack") ? err : `Slack OAuth: ${err}`);
+    }
+    await sleep(pollIntervalMs, opts?.signal);
   }
-  const teamId = data.team?.id?.trim();
-  if (!teamId) throw new Error("Slack OAuth did not return a team id");
-  return upsertSlackWorkspace({
-    team_id: teamId,
-    team_name: data.team?.name?.trim() || teamId,
-    user_id: data.authed_user?.id,
-    bot_token: data.access_token,
-    user_token: data.authed_user?.access_token,
-    scopes: [data.scope, data.authed_user?.scope].filter(Boolean).join(","),
-    connected_at: (/* @__PURE__ */ new Date()).toISOString()
-  });
+  throw new Error("Slack sign-in timed out \u2014 try again");
 }
 
 // src/slack/socket-mode.ts
 import { WebSocket as WsWebSocket } from "ws";
 var BACKOFF_START_MS = 1e3;
 var BACKOFF_MAX_MS = 3e4;
-function stripSlackMentions(text2) {
-  return text2.replace(/<@[^>]+>/g, "").replace(/\s+/g, " ").trim();
+function stripSlackMentions(text3) {
+  return text3.replace(/<@[^>]+>/g, "").replace(/\s+/g, " ").trim();
 }
-function isSlackStopCommand(text2) {
-  const t = stripSlackMentions(text2).toLowerCase();
+function isSlackStopCommand(text3) {
+  const t = stripSlackMentions(text3).toLowerCase();
   return t === "stop" || t === "sideboard_force_stop";
 }
 function parseSlackSocketFrame(raw) {
@@ -9311,8 +9818,8 @@ function inboundFromSocketFrame(frame) {
   const ts = event.ts?.trim();
   if (!channelId || !ts) return null;
   const rawText = event.text?.trim() ?? "";
-  const text2 = stripSlackMentions(rawText);
-  if (!text2) return null;
+  const text3 = stripSlackMentions(rawText);
+  if (!text3) return null;
   const teamId = (frame.payload?.team_id || event.team || "").trim();
   if (!teamId) return null;
   const isDm = event.type === "message" && (event.channel_type === "im" || event.channel_type === "mpim" || !event.channel_type && channelId.startsWith("D"));
@@ -9324,7 +9831,7 @@ function inboundFromSocketFrame(frame) {
     ts,
     threadTs: event.thread_ts?.trim() || void 0,
     userId: event.user?.trim(),
-    text: text2,
+    text: text3,
     kind: isMention ? "mention" : "dm"
   };
 }
@@ -9575,7 +10082,40 @@ function parseSlackRelayServerMessage(raw) {
   }
 }
 
+// src/slack/public-dns.ts
+import { lookup as systemLookup, Resolver } from "dns";
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+var PUBLIC_DNS = ["1.1.1.1", "8.8.8.8"];
+function finishLookup(options, callback, address, family) {
+  if (options.all) {
+    callback(null, [{ address, family }]);
+    return;
+  }
+  callback(null, address, family);
+}
+var lookupPreferPublicDns = (hostname, options, callback) => {
+  if (options.family === 6) {
+    systemLookup(hostname, options, (err, address, family) => {
+      callback(err, address, family);
+    });
+    return;
+  }
+  const resolver = new Resolver();
+  resolver.setServers(PUBLIC_DNS);
+  resolver.resolve4(hostname, (err, addresses) => {
+    if (!err && addresses[0]) {
+      finishLookup(options, callback, addresses[0], 4);
+      return;
+    }
+    systemLookup(hostname, options, (sysErr, address, family) => {
+      callback(sysErr, address, family);
+    });
+  });
+};
+
 // src/slack/relay-client.ts
+import { WebSocket as WsWebSocket2 } from "ws";
 var BACKOFF_START_MS2 = 1e3;
 var BACKOFF_MAX_MS2 = 3e4;
 function wait2(ms, signal) {
@@ -9600,7 +10140,11 @@ function send(ws, msg) {
 }
 async function runSlackRelayClient(opts) {
   const log = opts.onLog ?? (() => void 0);
-  const Ws = resolveWebSocket(opts.WebSocketImpl);
+  const Ws = opts.WebSocketImpl ? resolveWebSocket(opts.WebSocketImpl) : class {
+    constructor(url2) {
+      return new WsWebSocket2(url2, { lookup: lookupPreferPublicDns });
+    }
+  };
   const url = opts.url.trim();
   const deviceId = opts.deviceId.trim();
   if (!url) throw new Error("Slack relay URL is empty");
@@ -9763,12 +10307,12 @@ function formatSlackInboundPrompt(msg) {
 
 ${msg.text}`;
 }
-function isSlackInboundUserPrompt(text2) {
-  return text2.startsWith("Slack DM\n") || text2.startsWith("Slack @mention\n");
+function isSlackInboundUserPrompt(text3) {
+  return text3.startsWith("Slack DM\n") || text3.startsWith("Slack @mention\n");
 }
-function formatSlackSignedReply(deviceLabel, text2) {
+function formatSlackSignedReply(deviceLabel, text3) {
   const label = deviceLabel.trim();
-  const body = text2.trim();
+  const body = text3.trim();
   if (!body) return body;
   if (!label) return body;
   const head = `${label}:`;
@@ -9777,8 +10321,8 @@ function formatSlackSignedReply(deviceLabel, text2) {
   }
   return `${label}: ${body}`;
 }
-function signForThisMac(text2) {
-  return formatSlackSignedReply(ensureSlackDeviceIdentity().deviceLabel, text2);
+function signForThisMac(text3) {
+  return formatSlackSignedReply(ensureSlackDeviceIdentity().deviceLabel, text3);
 }
 function slackReplyThreadTs(msg) {
   if (msg.threadTs && msg.threadTs !== msg.ts) return msg.threadTs;
@@ -9821,7 +10365,7 @@ async function ackSlackInboundSeen(msg, opts) {
     log(`react error: ${errMsg}${hint}`);
   }
 }
-async function postSlackText(target, text2, opts) {
+async function postSlackText(target, text3, opts) {
   const stub = {
     teamId: target.teamId,
     channelId: target.channelId,
@@ -9831,7 +10375,7 @@ async function postSlackText(target, text2, opts) {
     kind: "dm"
   };
   if (opts.postReply) {
-    await opts.postReply(stub, text2);
+    await opts.postReply(stub, text3);
     return;
   }
   const token = writeTokenForTeam(target.teamId);
@@ -9840,29 +10384,29 @@ async function postSlackText(target, text2, opts) {
     "chat.postMessage",
     {
       channel: target.channelId,
-      text: text2,
+      text: text3,
       thread_ts: target.threadTs
     },
     opts.fetchImpl
   );
 }
-async function postSlackReply(msg, text2, opts) {
+async function postSlackReply(msg, text3, opts) {
   await postSlackText(
     {
       teamId: msg.teamId,
       channelId: msg.channelId,
       threadTs: slackReplyThreadTs(msg)
     },
-    signForThisMac(text2),
+    signForThisMac(text3),
     opts
   );
 }
 var lastRelayed = /* @__PURE__ */ new Map();
-function markRelayed(threadId, text2) {
-  lastRelayed.set(threadId, `${threadId}:${text2}`);
+function markRelayed(threadId, text3) {
+  lastRelayed.set(threadId, `${threadId}:${text3}`);
 }
-function alreadyRelayed(threadId, text2) {
-  return lastRelayed.get(threadId) === `${threadId}:${text2}`;
+function alreadyRelayed(threadId, text3) {
+  return lastRelayed.get(threadId) === `${threadId}:${text3}`;
 }
 async function relayCoordinatorReplyToSlack(threadId, opts) {
   const target = getSlackReplyTarget(threadId);
@@ -9871,14 +10415,14 @@ async function relayCoordinatorReplyToSlack(threadId, opts) {
   const lastUser = thread ? [...thread.messages].reverse().find((m) => m.role === "user") : void 0;
   if (lastUser && isSlackInboundUserPrompt(lastUser.text)) return;
   const result = getOrchestrator().getTurnResult(threadId);
-  const text2 = result.text.trim();
-  if (!text2) return;
-  if (alreadyRelayed(threadId, text2)) return;
-  markRelayed(threadId, text2);
+  const text3 = result.text.trim();
+  if (!text3) return;
+  if (alreadyRelayed(threadId, text3)) return;
+  markRelayed(threadId, text3);
   const log = opts.onLog ?? (() => void 0);
   try {
-    await postSlackText(target, signForThisMac(text2), opts);
-    log(`replied ${target.threadTs ?? target.channelId} (${text2.length} chars)`);
+    await postSlackText(target, signForThisMac(text3), opts);
+    log(`replied ${target.threadTs ?? target.channelId} (${text3.length} chars)`);
   } catch (err) {
     lastRelayed.delete(threadId);
     const errMsg = err instanceof Error ? err.message : String(err);
@@ -10042,10 +10586,10 @@ function resolveSlackListenMode(opts) {
 }
 
 // src/slack/relay-hub.ts
-function parseSlackDeviceDestination(text2) {
-  const m = text2.match(/^\s*(?:to\s+)?(?:@|#)?([A-Za-z][\w-]{0,63})\s*[:：]\s*/);
-  if (!m) return { label: null, rest: text2 };
-  return { label: m[1], rest: text2.slice(m[0].length) };
+function parseSlackDeviceDestination(text3) {
+  const m = text3.match(/^\s*(?:to\s+)?(?:@|#)?([A-Za-z][\w-]{0,63})\s*[:：]\s*/);
+  if (!m) return { label: null, rest: text3 };
+  return { label: m[1], rest: text3.slice(m[0].length) };
 }
 var SlackRelayHub = class {
   sessions = /* @__PURE__ */ new Map();
@@ -10263,40 +10807,126 @@ var SlackRelayHub = class {
 };
 
 // src/slack/relay-server.ts
-import { createServer as createServer4 } from "http";
+import { createServer as createServer3 } from "http";
 import { WebSocketServer } from "ws";
+function sendHtml(res, status, title, body) {
+  res.writeHead(status, { "Content-Type": "text/html; charset=utf-8" });
+  res.end(slackOAuthHtmlPage(title, body));
+}
+function sendJson(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
 async function startSlackRelayServer(opts) {
   const log = opts.onLog ?? console.log;
   const appToken = opts.appToken.trim();
   if (!appToken.startsWith("xapp-")) {
     throw new Error("SIDEBOARD_SLACK_APP_TOKEN must be an xapp-\u2026 app-level token");
   }
+  const clientId = (opts.clientId ?? slackOAuthRelayClientId()).trim();
+  const clientSecret = (opts.clientSecret ?? process.env.SIDEBOARD_SLACK_CLIENT_SECRET ?? "").trim();
+  const redirectUri = (opts.oauthRedirectUri ?? slackOAuthRelayRedirectUri()).trim();
+  const pending = new SlackOAuthPendingStore();
   const hub = opts.hub ?? new SlackRelayHub({
     fetchImpl: opts.fetchImpl,
     onLog: log
   });
-  const httpServer = createServer4((req, res) => {
-    const bounce = slackOAuthBounceResponse(req.url || "/");
-    if (bounce) {
-      res.writeHead(bounce.status, bounce.headers);
-      res.end(bounce.body);
-      return;
+  const handleCallback = async (reqUrl, res) => {
+    const url2 = parseSlackOAuthCallbackUrl(reqUrl);
+    if (!url2) return false;
+    const error = url2.searchParams.get("error")?.trim();
+    const state = url2.searchParams.get("state")?.trim() ?? "";
+    const code = url2.searchParams.get("code")?.trim() ?? "";
+    if (error) {
+      if (state) pending.put(state, { ok: false, error: `Slack OAuth: ${error}` });
+      sendHtml(
+        res,
+        400,
+        "Slack",
+        `<h1>Authorization cancelled</h1><p>${escapeHtml(error)}</p>`
+      );
+      return true;
     }
-    if (req.url === "/health" || req.url === "/") {
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(
-        JSON.stringify({
-          ok: true,
-          service: "sideboard-slack-relay",
-          sessions: hub.listSessions().length
-        })
+    if (!state || !code) {
+      sendHtml(res, 400, "Slack", "<h1>Invalid callback</h1><p>State or code missing.</p>");
+      return true;
+    }
+    if (!clientSecret) {
+      pending.put(state, {
+        ok: false,
+        error: "Relay is missing SIDEBOARD_SLACK_CLIENT_SECRET"
+      });
+      sendHtml(
+        res,
+        500,
+        "Slack",
+        "<h1>Relay misconfigured</h1><p>OAuth client secret is not set on the relay.</p>"
       );
-      return;
+      return true;
+    }
+    try {
+      const payload = await exchangeSlackOAuthCode({
+        clientId,
+        clientSecret,
+        code,
+        redirectUri,
+        fetchImpl: opts.fetchImpl
+      });
+      pending.put(state, { ok: true, payload });
+      sendHtml(
+        res,
+        200,
+        "Slack connected",
+        "<h1>Slack workspace connected</h1><p>You can close this tab and return to Sideboard.</p>"
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      pending.put(state, { ok: false, error: message });
+      sendHtml(res, 400, "Slack", `<h1>Could not connect Slack</h1><p>${escapeHtml(message)}</p>`);
+    }
+    return true;
+  };
+  const handleResult = (reqUrl, res) => {
+    const url2 = parseSlackOAuthResultUrl(reqUrl);
+    if (!url2) return false;
+    const state = url2.searchParams.get("state")?.trim() ?? "";
+    const value = pending.take(state);
+    if (!value) {
+      sendJson(res, 404, { ok: false, error: "pending" });
+      return true;
+    }
+    if (!value.ok) {
+      sendJson(res, 400, { ok: false, error: value.error });
+      return true;
     }
-    res.writeHead(404);
-    res.end("Not found");
+    sendJson(res, 200, { ok: true, ...value.payload });
+    return true;
+  };
+  const httpServer = createServer3((req, res) => {
+    void (async () => {
+      const reqUrl = req.url || "/";
+      if (await handleCallback(reqUrl, res)) return;
+      if (handleResult(reqUrl, res)) return;
+      if (req.url === "/health" || req.url === "/") {
+        sendJson(res, 200, {
+          ok: true,
+          service: "sideboard-slack-relay",
+          sessions: hub.listSessions().length,
+          oauth: Boolean(clientSecret)
+        });
+        return;
+      }
+      res.writeHead(404);
+      res.end("Not found");
+    })().catch((err) => {
+      log(`http error: ${err instanceof Error ? err.message : String(err)}`);
+      if (!res.headersSent) {
+        res.writeHead(500);
+        res.end("Internal error");
+      }
+    });
   });
-  const wss = new WebSocketServer({ server: httpServer, path: "/desktop" });
+  const wss = new WebSocketServer({ server: httpServer, path: SLACK_RELAY_DESKTOP_PATH });
   wss.on("connection", (ws, _req) => {
     const socket = {
       send: (data) => {
@@ -10334,12 +10964,12 @@ async function startSlackRelayServer(opts) {
   });
   const address = httpServer.address();
   const boundPort = typeof address === "object" && address ? address.port : typeof port === "number" ? port : 0;
-  const url = `ws://${host === "0.0.0.0" ? "127.0.0.1" : host}:${boundPort}/desktop`;
+  const url = `ws://${host === "0.0.0.0" ? "127.0.0.1" : host}:${boundPort}${SLACK_RELAY_DESKTOP_PATH}`;
   log(`relay listening on ${url}`);
   const ac = new AbortController();
   const onAbort = () => ac.abort();
   opts.signal?.addEventListener("abort", onAbort, { once: true });
-  const socketModeDone = runSlackSocketMode({
+  const socketModeDone = opts.skipSocketMode ? Promise.resolve() : runSlackSocketMode({
     appToken,
     signal: ac.signal,
     fetchImpl: opts.fetchImpl,
@@ -10370,6 +11000,7 @@ async function startSlackRelayServer(opts) {
   };
 }
 export {
+  AGENT_GIT_ACTIONS,
   ATTACHMENTS_DIR,
   BAKED_SLACK_RELAY_URL,
   BRIGHTSY_MCP_ALLOWED_TOOLS,
@@ -10415,8 +11046,6 @@ export {
   SLACK_LISTEN_STOPPED_REPLY,
   SLACK_LISTEN_TIMEOUT_REPLY,
   SLACK_OAUTH_CANCELLED,
-  SLACK_OAUTH_LOCAL_CALLBACK,
-  SLACK_OAUTH_PORT,
   SLACK_OAUTH_REDIRECT,
   SLACK_REPLY_FORMATTING,
   SLACK_SEEN_REACTION,
@@ -10428,6 +11057,7 @@ export {
   addStackLayerFromThread,
   addWorkspace,
   adoptThread,
+  agentGitPrompt,
   allAdapters,
   allocatePort,
   allocatePortRange,
@@ -10440,6 +11070,7 @@ export {
   applyAppEnvironment,
   applyCompaction,
   applyThreadIntoMain,
+  applyTurnUsage,
   assertOrchestratorCapableAgent,
   attachmentFromAbsolutePath,
   attachmentsFromBuffers,
@@ -10481,12 +11112,14 @@ export {
   codexAdapter,
   coerceOrchestratorAgent,
   collectTakenTeamSlugs,
+  commentLinearIssue,
   commitAll,
   conductorBundledBinDir,
   conductorDbPath,
   confirmLand,
   connectBrightsyTeam,
   connectSlackToken,
+  contextTokens,
   coordinatorSystemPrompt,
   coordinatorTurnReminder,
   copyConfiguredFiles,
@@ -10495,6 +11128,7 @@ export {
   createEmptyThread,
   createExistingBranchWorktree,
   createGlobalChat,
+  createLinearIssue,
   createLinearPkce,
   createOrUpdatePr,
   createPrStack,
@@ -10547,6 +11181,7 @@ export {
   formatAgentInstructions,
   formatArtifactDirective,
   formatBrightsyFetchError,
+  formatFetchError,
   formatGhLandError,
   formatIpcInvokeError,
   formatMessagesAsTranscript,
@@ -10577,6 +11212,7 @@ export {
   getIssueSource,
   getLinearApiKey,
   getLinearAuthToken,
+  getLinearIssue,
   getOrchestrator,
   getPr,
   getPrChecks,
@@ -10601,6 +11237,7 @@ export {
   hasRepoHook,
   hasWorkspaceHook,
   healOrchestrationSoccerTitles,
+  httpFetch,
   importConductorWorkspace,
   importConductorWorkspaceAsync,
   initPrStack,
@@ -10634,8 +11271,10 @@ export {
   isSlackExternalReplyPrompt,
   isSlackOAuthCancelled,
   isThinkingEffort,
+  isThreadCaffeinated,
   isWorkspaceScratchPath,
   linearAuthorizationHeader,
+  linearGraphql,
   linearOAuthAuthorizeUrl,
   linearOAuthCredentials,
   listAgentSetupInfo,
@@ -10652,6 +11291,7 @@ export {
   listIssues,
   listLinearIssues,
   listLinearIssuesDirect,
+  listLinearTeams,
   listModelsForAgent,
   listOpencodeModels,
   listPrs,
@@ -10727,9 +11367,11 @@ export {
   recordSlackOutboundWatch,
   refreshGitHubAuth,
   refreshSlackReplyBadges,
+  releaseCaffeinateHoldForThread,
   removeWorkspace,
   removeWorktree,
   repoSlug,
+  requestOccupancy,
   requestReview,
   requireAgent,
   resetGhStackDetectCache,
@@ -10744,6 +11386,8 @@ export {
   resolveFilesToCopy,
   resolveGhAuthToken,
   resolveGithubRepoSlug,
+  resolveLinearState,
+  resolveLinearTeam,
   resolveLoginCommand,
   resolveNewThreadOptions,
   resolvePlanMarkdown,
@@ -10756,6 +11400,7 @@ export {
   resolveThreadEffort,
   resolveVaultKey,
   resolveWorktreeStartPoint,
+  rewriteLinearError,
   run,
   runArchiveScript,
   runCloudConnect,
@@ -10769,6 +11414,7 @@ export {
   saveLinearOAuth,
   secureFileUnlocksWith,
   setCaffeinateHold,
+  setHttpFetchImpl,
   setStatus,
   setVaultMasterKey,
   settingsSourceLabel,
@@ -10786,6 +11432,7 @@ export {
   slackCoordinatorSourceRef,
   slackListenEnabled,
   slackOAuthCredentials,
+  slackOAuthResultUrl,
   slackRelayUrl,
   slugify,
   spawnAgentTurn,
@@ -10831,6 +11478,7 @@ export {
   updateCodexSettings,
   updateDefaultsSettings,
   updateIntegrationsSettings,
+  updateLinearIssue,
   updateOpencodeSettings,
   updateThread,
   validateLinearApiKey,