@sideboard-ai/core 0.1.74 → 0.1.79

package/dist/index.js

@@ -4,7 +4,7 @@ import {
   listWorkspaces,
   removeWorkspace,
   syncWorkspacesFromThreads
-} from "./chunk-DG3S2UXP.js";
+} from "./chunk-PW5YHHP3.js";
 import {
   BRIGHTSY_MCP_ALLOWED_TOOLS,
   CLAUDE_MODEL_CATALOG,
@@ -58,7 +58,7 @@ import {
   sideboardMcpProfile,
   threadRequestsBrightsyMcp,
   writeInjectedMcpConfig
-} from "./chunk-5KJMNNCB.js";
+} from "./chunk-SHCR6RPU.js";
 import {
   CLOUD_COORDINATOR_BUSY_REPLY,
   CLOUD_COORDINATOR_STOPPED_REPLY,
@@ -85,7 +85,7 @@ import {
   parseForceStopMessage,
   slackCoordinatorSourceRef,
   takenTeamSlugsForOrchestration
-} from "./chunk-77W62MTX.js";
+} from "./chunk-5LXWTU3J.js";
 import {
   COORDINATOR_TOOL_PLAYBOOK,
   SLACK_REPLY_FORMATTING,
@@ -94,7 +94,7 @@ import {
   enrichWorkspacesWithGithub,
   ensureGlobalCoordinatorCwd,
   formatWorkspaceInventory
-} from "./chunk-HCWAIEBU.js";
+} from "./chunk-HCGEFU3J.js";
 import {
   brightsyConfigPath,
   brightsyMcpServerName,
@@ -129,79 +129,20 @@ import {
   pushTurnStderr,
   summarizeTurnStderr
 } from "./chunk-SEOICVGB.js";
-import {
-  HARNESS_ENV_KEYS,
-  appSettingsPath,
-  applyAppEnvironment,
-  autoArchiveOnMergeEnabled,
-  autoCleanupOrphansEnabled,
-  autoRenameBranchEnabled,
-  autoRunAfterSetupEnabled,
-  brightsyCloudConnectAgent,
-  brightsyCloudConnectEnabled,
-  brightsyInjectWorktreeMcpEnabled,
-  caffeinateWhileCloudConnectEnabled,
-  caffeinateWhileRunningEnabled,
-  caffeinateWhileSlackListenEnabled,
-  childEnvWithAppSettings,
-  claudeChromeEnabled,
-  claudeUserSettingsPath,
-  deleteBranchOnPurgeEnabled,
-  disconnectLinearConnection,
-  ensureSlackDeviceIdentity,
-  getDefaultAgent,
-  getDefaultEffort,
-  getDefaultFast,
-  getDefaultModel,
-  getIssueSource,
-  getLinearApiKey,
-  harnessEnvKey,
-  isLinearConnected,
-  isSecureFileEncrypted,
-  loadAppSettings,
-  maxConcurrentAgents,
-  orchestrationQuotaFallbackAgent,
-  orchestrationQuotaOnLimit,
-  persistVaultKeyInKeychain,
-  readKeychainVaultKey,
-  readSecureJson,
-  resolveAgentExecutable,
-  resolveClaudeExecutable,
-  resolveEffectiveIssueSource,
-  resolveNewThreadOptions,
-  resolveThreadDefaults,
-  resolveVaultKey,
-  saveAppSettings,
-  saveLinearOAuth,
-  secureFileUnlocksWith,
-  setVaultMasterKey,
-  slackAppLevelToken,
-  slackListenEnabled,
-  toPublicAppSettings,
-  updateAdvancedSettings,
-  updateAgentExecutable,
-  updateAppEnvironment,
-  updateBrightsySettings,
-  updateClaudeSettings,
-  updateCodexSettings,
-  updateDefaultsSettings,
-  updateIntegrationsSettings,
-  updateOpencodeSettings,
-  writeSecureJson
-} from "./chunk-W7YOTDVO.js";
 import {
   caffeinateHoldPath,
   getCaffeinateHold,
+  isThreadCaffeinated,
+  releaseCaffeinateHoldForThread,
   setCaffeinateHold
-} from "./chunk-JAWEDVVA.js";
-import {
-  writePrivateFile
-} from "./chunk-JT7R45JB.js";
+} from "./chunk-MFF2RE3I.js";
 import {
   FAMOUS_SOCCER_TEAMS,
   addPrStackLayer,
   allocateTeamName,
   allocateTeamSlug,
+  appendIndexedGitConfig,
+  applyGithubGitAuthEnv,
   branchDisplayLabel,
   checkoutPrStackLayer,
   collectTakenTeamSlugs,
@@ -216,6 +157,7 @@ import {
   extractGhErrorDetail,
   fetchPrHead,
   formatGhLandError,
+  formatGitAuthModeDirective,
   formatIpcInvokeError,
   formatRateLimitResetHint,
   getPr,
@@ -225,6 +167,7 @@ import {
   getPrStack,
   ghHeadRef,
   ghRepoSelectArgs,
+  githubAgentGitEnv,
   initPrStack,
   isDirty,
   isGhRateLimitError,
@@ -259,13 +202,79 @@ import {
   worktreeDisplayLabel,
   worktreeDisplayLabelForGroup,
   worktreeNameFromPath
-} from "./chunk-MF2YMEGD.js";
+} from "./chunk-YVVXWWCC.js";
 import {
   ATTACHMENTS_DIR,
   LEGACY_ATTACHMENTS_DIR,
   attachmentsGitignoreBody,
   isWorkspaceScratchPath
 } from "./chunk-FKOIHGKV.js";
+import {
+  GITHUB_GIT_AUTH_MODES,
+  HARNESS_ENV_KEYS,
+  appSettingsPath,
+  applyAppEnvironment,
+  autoArchiveOnMergeEnabled,
+  autoCleanupOrphansEnabled,
+  autoRenameBranchEnabled,
+  autoRunAfterSetupEnabled,
+  brightsyCloudConnectAgent,
+  brightsyCloudConnectEnabled,
+  brightsyInjectWorktreeMcpEnabled,
+  caffeinateWhileCloudConnectEnabled,
+  caffeinateWhileRunningEnabled,
+  caffeinateWhileSlackListenEnabled,
+  childEnvWithAppSettings,
+  claudeChromeEnabled,
+  claudeUserSettingsPath,
+  deleteBranchOnPurgeEnabled,
+  disconnectLinearConnection,
+  ensureSlackDeviceIdentity,
+  getDefaultAgent,
+  getDefaultEffort,
+  getDefaultFast,
+  getDefaultModel,
+  getGithubGitAuthMode,
+  getGithubPat,
+  getIssueSource,
+  getLinearApiKey,
+  harnessEnvKey,
+  isLinearConnected,
+  isSecureFileEncrypted,
+  loadAppSettings,
+  maxConcurrentAgents,
+  orchestrationQuotaFallbackAgent,
+  orchestrationQuotaOnLimit,
+  persistVaultKeyInKeychain,
+  readKeychainVaultKey,
+  readSecureJson,
+  resolveAgentExecutable,
+  resolveClaudeExecutable,
+  resolveEffectiveIssueSource,
+  resolveNewThreadOptions,
+  resolveThreadDefaults,
+  resolveVaultKey,
+  saveAppSettings,
+  saveLinearOAuth,
+  secureFileUnlocksWith,
+  setVaultMasterKey,
+  slackAppLevelToken,
+  slackListenEnabled,
+  toPublicAppSettings,
+  updateAdvancedSettings,
+  updateAgentExecutable,
+  updateAppEnvironment,
+  updateBrightsySettings,
+  updateClaudeSettings,
+  updateCodexSettings,
+  updateDefaultsSettings,
+  updateIntegrationsSettings,
+  updateOpencodeSettings,
+  writeSecureJson
+} from "./chunk-IFPN6TER.js";
+import {
+  writePrivateFile
+} from "./chunk-JT7R45JB.js";
 import {
   appendMessage,
   createEmptyThread,
@@ -374,9 +383,9 @@ async function getGitHubStatus() {
     };
   }
   const status = await run("gh", ["auth", "status"], { reject: false });
-  const text2 = `${status.stdout}
+  const text3 = `${status.stdout}
 ${status.stderr}`;
-  const loginMatch = text2.match(/Logged in to ([^\s]+) account (\S+)/i) ?? text2.match(/Logged in to ([^\s]+) as (\S+)/i);
+  const loginMatch = text3.match(/Logged in to ([^\s]+) account (\S+)/i) ?? text3.match(/Logged in to ([^\s]+) as (\S+)/i);
   if (loginMatch) {
     return {
       connected: true,
@@ -396,13 +405,39 @@ async function refreshGitHubAuth() {
   return getGitHubStatus();
 }
 
+// src/http/fetch.ts
+var injected = null;
+function setHttpFetchImpl(fetchImpl) {
+  injected = fetchImpl;
+}
+function formatFetchError(err, url) {
+  if (!(err instanceof Error)) return `${String(err)} (${url})`;
+  const cause = err.cause;
+  let detail = "";
+  if (cause instanceof Error) {
+    const code = typeof cause.code === "string" ? cause.code : void 0;
+    detail = code ? ` [${code}: ${cause.message}]` : ` [${cause.message}]`;
+  } else if (cause != null) {
+    detail = ` [${String(cause)}]`;
+  }
+  return `${err.message}${detail} (${url})`;
+}
+async function httpFetch(input, init) {
+  const url = typeof input === "string" ? input : input.href;
+  const fn = injected ?? globalThis.fetch.bind(globalThis);
+  try {
+    return await fn(url, init);
+  } catch (err) {
+    throw new Error(formatFetchError(err, url));
+  }
+}
+
 // src/integrations/linear-oauth.ts
 import { createHash, randomBytes } from "crypto";
 import { createServer } from "http";
 
 // src/integrations/linear-app.ts
 var BAKED_LINEAR_CLIENT_ID = "39a15abc7ea5bea17c47f47f85ff5fd0";
-var BAKED_LINEAR_CLIENT_SECRET = "";
 function hasBakedLinearOAuth() {
   return Boolean(BAKED_LINEAR_CLIENT_ID.trim());
 }
@@ -414,12 +449,12 @@ var LINEAR_AUTHORIZE = "https://linear.app/oauth/authorize";
 var LINEAR_TOKEN = "https://api.linear.app/oauth/token";
 var LINEAR_REVOKE = "https://api.linear.app/oauth/revoke";
 var LINEAR_GRAPHQL = "https://api.linear.app/graphql";
-var LINEAR_OAUTH_SCOPES = "read";
+var LINEAR_OAUTH_SCOPES = "read,write";
 var REFRESH_SKEW_MS = 5 * 6e4;
 function linearOAuthCredentials() {
   const settings = loadAppSettings();
   const clientId = process.env.SIDEBOARD_LINEAR_CLIENT_ID?.trim() || settings.integrations.linearClientId?.trim() || BAKED_LINEAR_CLIENT_ID.trim();
-  const clientSecret = process.env.SIDEBOARD_LINEAR_CLIENT_SECRET?.trim() || settings.integrations.linearClientSecret?.trim() || BAKED_LINEAR_CLIENT_SECRET.trim();
+  const clientSecret = process.env.SIDEBOARD_LINEAR_CLIENT_SECRET?.trim() || settings.integrations.linearClientSecret?.trim() || "";
   if (!clientId) {
     throw new Error(
       `Linear browser sign-in needs a Linear OAuth app Client ID. Create one at linear.app/settings/api/applications/new with callback ${LINEAR_OAUTH_REDIRECT}, then set SIDEBOARD_LINEAR_CLIENT_ID (PKCE does not require a secret). You can still paste a personal API key.`
@@ -459,7 +494,7 @@ function htmlPage(title, body) {
 h1{font-size:1.25rem}p{line-height:1.5;color:#444}</style></head><body>${body}</body></html>`;
 }
 async function exchangeLinearToken(body) {
-  const res = await fetch(LINEAR_TOKEN, {
+  const res = await httpFetch(LINEAR_TOKEN, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body
@@ -481,7 +516,7 @@ async function persistLinearTokens(data, viewer) {
   });
 }
 async function fetchLinearViewer(accessToken) {
-  const res = await fetch(LINEAR_GRAPHQL, {
+  const res = await httpFetch(LINEAR_GRAPHQL, {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
@@ -652,7 +687,7 @@ async function revokeLinearToken(token, tokenTypeHint) {
     token,
     token_type_hint: tokenTypeHint
   });
-  await fetch(LINEAR_REVOKE, {
+  await httpFetch(LINEAR_REVOKE, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body
@@ -669,6 +704,18 @@ async function disconnectLinear() {
 
 // src/integrations/linear.ts
 var LINEAR_GRAPHQL2 = "https://api.linear.app/graphql";
+var ISSUE_FIELDS = `
+  id
+  identifier
+  title
+  description
+  url
+  priority
+  state { id name type }
+  assignee { id name }
+  team { id key name states { nodes { id name type } } }
+  labels { nodes { name } }
+`;
 var ASSIGNED_ISSUES_QUERY = `
 query SideboardAssignedIssues($first: Int!) {
   viewer {
@@ -677,53 +724,280 @@ query SideboardAssignedIssues($first: Int!) {
       orderBy: updatedAt
       filter: { state: { type: { nin: ["completed", "canceled"] } } }
     ) {
-      nodes {
-        id
-        identifier
-        title
-        url
-        labels { nodes { name } }
-      }
+      nodes { ${ISSUE_FIELDS} }
     }
   }
 }
 `;
-async function listLinearIssuesDirect(opts) {
-  const apiKey = (opts?.apiKey ?? await getLinearAuthToken())?.trim();
-  if (!apiKey) {
+var TEAMS_QUERY = `
+query SideboardTeams {
+  viewer { id name }
+  teams(first: 50) {
+    nodes {
+      id
+      key
+      name
+      states { nodes { id name type } }
+    }
+  }
+}
+`;
+var ISSUE_QUERY = `
+query SideboardIssue($id: String!) {
+  issue(id: $id) { ${ISSUE_FIELDS} }
+}
+`;
+var ISSUE_CREATE = `
+mutation SideboardIssueCreate($input: IssueCreateInput!) {
+  issueCreate(input: $input) {
+    success
+    issue { ${ISSUE_FIELDS} }
+  }
+}
+`;
+var ISSUE_UPDATE = `
+mutation SideboardIssueUpdate($id: String!, $input: IssueUpdateInput!) {
+  issueUpdate(id: $id, input: $input) {
+    success
+    issue { ${ISSUE_FIELDS} }
+  }
+}
+`;
+var COMMENT_CREATE = `
+mutation SideboardCommentCreate($input: CommentCreateInput!) {
+  commentCreate(input: $input) {
+    success
+    comment { id body url }
+  }
+}
+`;
+function rewriteLinearError(message) {
+  if (/scope|permission|not (authorized|allowed)|unauthorized|insufficient/i.test(message)) {
+    return `${message} \u2014 Disconnect and Connect Linear in Account settings to grant write access.`;
+  }
+  return message;
+}
+async function requireLinearToken(apiKey) {
+  const token = (apiKey ?? await getLinearAuthToken())?.trim();
+  if (!token) {
     throw new Error("Linear is not connected \u2014 sign in from Account settings");
   }
-  const first = Math.max(1, Math.min(100, opts?.limit ?? 50));
-  const res = await fetch(LINEAR_GRAPHQL2, {
+  return token;
+}
+async function linearGraphql(query, variables, opts) {
+  const apiKey = await requireLinearToken(opts?.apiKey);
+  const res = await httpFetch(LINEAR_GRAPHQL2, {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
       Authorization: linearAuthorizationHeader(apiKey)
     },
-    body: JSON.stringify({
-      query: ASSIGNED_ISSUES_QUERY,
-      variables: { first }
-    })
+    body: JSON.stringify({ query, variables })
   });
   if (!res.ok) {
     const body = await res.text().catch(() => "");
     throw new Error(
-      `Linear API error ${res.status}${body ? `: ${body.slice(0, 200)}` : ""}`
+      rewriteLinearError(
+        `Linear API error ${res.status}${body ? `: ${body.slice(0, 200)}` : ""}`
+      )
     );
   }
   const json = await res.json();
   if (json.errors?.length) {
-    throw new Error(json.errors.map((e) => e.message ?? "Linear error").join("; "));
+    throw new Error(
+      rewriteLinearError(json.errors.map((e) => e.message ?? "Linear error").join("; "))
+    );
   }
-  const nodes = json.data?.viewer?.assignedIssues?.nodes ?? [];
-  return nodes.map((node) => ({
+  if (json.data == null) {
+    throw new Error("Linear API returned no data");
+  }
+  return json.data;
+}
+function mapState(node) {
+  if (!node?.id) return void 0;
+  return {
+    id: String(node.id),
+    name: String(node.name ?? ""),
+    type: String(node.type ?? "")
+  };
+}
+function mapIssue(node) {
+  const team = node.team;
+  return {
     id: String(node.id ?? node.identifier ?? ""),
     identifier: String(node.identifier ?? node.id ?? ""),
     title: String(node.title ?? ""),
     url: String(node.url ?? ""),
-    labels: (node.labels?.nodes ?? []).map((l) => l.name).filter((n) => Boolean(n)),
+    description: node.description?.trim() || void 0,
+    priority: typeof node.priority === "number" ? node.priority : void 0,
+    state: mapState(node.state),
+    assignee: node.assignee?.id ? { id: String(node.assignee.id), name: String(node.assignee.name ?? "") } : void 0,
+    team: team?.id ? {
+      id: String(team.id),
+      key: String(team.key ?? ""),
+      name: String(team.name ?? ""),
+      states: (team.states?.nodes ?? []).map((s) => mapState(s)).filter((s) => Boolean(s))
+    } : void 0,
+    labels: (node.labels?.nodes ?? []).map((l) => l.name).filter((n) => Boolean(n))
+  };
+}
+function toIssueInfo(issue) {
+  return {
+    id: issue.id,
+    identifier: issue.identifier,
+    title: issue.title,
+    url: issue.url,
+    labels: issue.labels,
     provider: "linear"
-  }));
+  };
+}
+function mapTeam(node) {
+  return {
+    id: String(node.id ?? ""),
+    key: String(node.key ?? ""),
+    name: String(node.name ?? ""),
+    states: (node.states?.nodes ?? []).map((s) => mapState(s)).filter((s) => Boolean(s))
+  };
+}
+function resolveLinearTeam(teams, team) {
+  const t = team.trim();
+  if (!t) throw new Error("Linear team is required (id, key, or name from linear_list_teams)");
+  const lower = t.toLowerCase();
+  const found = teams.find(
+    (x) => x.id === t || x.key.toLowerCase() === lower || x.name.toLowerCase() === lower
+  );
+  if (!found) {
+    const keys = teams.map((x) => x.key).filter(Boolean).join(", ") || "(none)";
+    throw new Error(`Linear team not found: ${team}. Known keys: ${keys}`);
+  }
+  return found;
+}
+function resolveLinearState(team, state) {
+  const s = state.trim();
+  if (!s) throw new Error("Linear state is empty");
+  const lower = s.toLowerCase();
+  const found = team.states.find((x) => x.id === s) || team.states.find((x) => x.name.toLowerCase() === lower) || team.states.find((x) => x.type.toLowerCase() === lower);
+  if (!found) {
+    const available = team.states.map((x) => `${x.name} (${x.type})`).join(", ") || "(none)";
+    throw new Error(`Linear state not found on ${team.key}: ${state}. Available: ${available}`);
+  }
+  return found;
+}
+function normalizePriority(priority) {
+  if (priority == null) return void 0;
+  if (!Number.isInteger(priority) || priority < 0 || priority > 4) {
+    throw new Error("Linear priority must be 0 (none), 1 (urgent), 2 (high), 3 (medium), or 4 (low)");
+  }
+  return priority;
+}
+async function listLinearIssuesDirect(opts) {
+  const first = Math.max(1, Math.min(100, opts?.limit ?? 50));
+  const json = await linearGraphql(ASSIGNED_ISSUES_QUERY, { first }, opts);
+  return (json.viewer?.assignedIssues?.nodes ?? []).map((node) => toIssueInfo(mapIssue(node)));
+}
+async function listLinearTeams(opts) {
+  const json = await linearGraphql(TEAMS_QUERY, void 0, opts);
+  return {
+    viewer: {
+      id: String(json.viewer?.id ?? ""),
+      name: String(json.viewer?.name ?? "")
+    },
+    teams: (json.teams?.nodes ?? []).map(mapTeam)
+  };
+}
+async function getLinearIssue(id, opts) {
+  const issueId = id.trim();
+  if (!issueId) throw new Error("Linear issue id is required (uuid or ENG-123)");
+  const json = await linearGraphql(
+    ISSUE_QUERY,
+    { id: issueId },
+    opts
+  );
+  if (!json.issue) {
+    throw new Error(`Linear issue not found: ${issueId}`);
+  }
+  return mapIssue(json.issue);
+}
+async function createLinearIssue(input, opts) {
+  const title = input.title.trim();
+  if (!title) throw new Error("Linear issue title is required");
+  const { viewer, teams } = await listLinearTeams(opts);
+  const team = resolveLinearTeam(teams, input.team);
+  const mutationInput = {
+    teamId: team.id,
+    title
+  };
+  const description = input.description?.trim();
+  if (description) mutationInput.description = description;
+  if (input.state?.trim()) {
+    mutationInput.stateId = resolveLinearState(team, input.state).id;
+  }
+  const assignee = input.assignee === void 0 ? void 0 : input.assignee?.trim() || null;
+  if (assignee === "me") mutationInput.assigneeId = viewer.id;
+  else if (assignee) mutationInput.assigneeId = assignee;
+  const priority = normalizePriority(input.priority);
+  if (priority != null) mutationInput.priority = priority;
+  const json = await linearGraphql(ISSUE_CREATE, { input: mutationInput }, opts);
+  if (!json.issueCreate?.success || !json.issueCreate.issue) {
+    throw new Error("Linear issueCreate failed");
+  }
+  return mapIssue(json.issueCreate.issue);
+}
+async function updateLinearIssue(input, opts) {
+  const issueId = input.id.trim();
+  if (!issueId) throw new Error("Linear issue id is required (uuid or ENG-123)");
+  const mutationInput = {};
+  if (input.title !== void 0) {
+    const title = input.title.trim();
+    if (!title) throw new Error("Linear issue title cannot be empty");
+    mutationInput.title = title;
+  }
+  if (input.description !== void 0) {
+    mutationInput.description = input.description;
+  }
+  if (input.state?.trim()) {
+    const existing = await getLinearIssue(issueId, opts);
+    const team = existing.team;
+    if (!team?.states.length) {
+      throw new Error(`Linear issue ${existing.identifier} has no workflow states to resolve "${input.state}"`);
+    }
+    mutationInput.stateId = resolveLinearState(team, input.state).id;
+  }
+  if (input.assignee !== void 0) {
+    const assignee = input.assignee?.trim() || null;
+    if (assignee === "me") {
+      const { viewer } = await listLinearTeams(opts);
+      mutationInput.assigneeId = viewer.id;
+    } else {
+      mutationInput.assigneeId = assignee;
+    }
+  }
+  if (input.priority !== void 0) {
+    mutationInput.priority = normalizePriority(input.priority);
+  }
+  if (Object.keys(mutationInput).length === 0) {
+    throw new Error("linear_update_issue needs at least one of title, description, state, assignee, priority");
+  }
+  const json = await linearGraphql(ISSUE_UPDATE, { id: issueId, input: mutationInput }, opts);
+  if (!json.issueUpdate?.success || !json.issueUpdate.issue) {
+    throw new Error("Linear issueUpdate failed");
+  }
+  return mapIssue(json.issueUpdate.issue);
+}
+async function commentLinearIssue(input, opts) {
+  const issueId = input.id.trim();
+  const body = input.body.trim();
+  if (!issueId) throw new Error("Linear issue id is required (uuid or ENG-123)");
+  if (!body) throw new Error("Linear comment body is required");
+  const json = await linearGraphql(COMMENT_CREATE, { input: { issueId, body } }, opts);
+  if (!json.commentCreate?.success || !json.commentCreate.comment?.id) {
+    throw new Error("Linear commentCreate failed");
+  }
+  return {
+    id: String(json.commentCreate.comment.id),
+    body: String(json.commentCreate.comment.body ?? body),
+    url: json.commentCreate.comment.url?.trim() || void 0
+  };
 }
 async function validateLinearApiKey(apiKey) {
   const key = apiKey.trim();
@@ -808,8 +1082,8 @@ function toolDetail(name, input) {
   if (!input) return void 0;
   const command = str(input.command) ?? str(input.cmd);
   if (command) return command;
-  const path = str(input.file_path) ?? str(input.path) ?? str(input.filePath) ?? str(input.filename);
-  if (path) return path;
+  const path2 = str(input.file_path) ?? str(input.path) ?? str(input.filePath) ?? str(input.filename);
+  if (path2) return path2;
   const pattern = str(input.pattern) ?? str(input.glob) ?? str(input.glob_pattern);
   if (pattern) return pattern;
   const query = str(input.query) ?? str(input.prompt);
@@ -853,12 +1127,12 @@ function toolDescription(name, input) {
     return "Run shell command";
   }
   if (/edit|write|apply/i.test(name)) {
-    const path = str(input.file_path) ?? str(input.path);
-    return path ? `Edit ${path.split("/").pop()}` : "Edit file";
+    const path2 = str(input.file_path) ?? str(input.path);
+    return path2 ? `Edit ${path2.split("/").pop()}` : "Edit file";
   }
   if (/read/i.test(name)) {
-    const path = str(input.file_path) ?? str(input.path);
-    return path ? `Read ${path.split("/").pop()}` : "Read file";
+    const path2 = str(input.file_path) ?? str(input.path);
+    return path2 ? `Read ${path2.split("/").pop()}` : "Read file";
   }
   if (/grep/i.test(name)) return "Search files";
   if (/glob/i.test(name)) return "Find files";
@@ -868,9 +1142,9 @@ function toolFilePath(input) {
   if (!input) return void 0;
   return str(input.file_path) ?? str(input.path) ?? str(input.filePath) ?? str(input.filename);
 }
-function countLines(text2) {
-  if (!text2) return 0;
-  return text2.split("\n").length;
+function countLines(text3) {
+  if (!text3) return 0;
+  return text3.split("\n").length;
 }
 function diffFromInput(input) {
   if (!input) return {};
@@ -997,9 +1271,9 @@ function applyAgentEvent(parts, event) {
 function partsToAssistantText(parts) {
   return parts.filter((p) => p.type === "text").map((p) => p.text).join("").trim();
 }
-function stripBrightsyNdjsonNoise(text2) {
-  if (!text2 || !text2.includes('"type"')) return text2;
-  let out = text2;
+function stripBrightsyNdjsonNoise(text3) {
+  if (!text3 || !text3.includes('"type"')) return text3;
+  let out = text3;
   out = out.replace(
     /\{"type":"(?:tool_use|tool_result|tool|thinking|usage|done|error)"[\s\S]*?\}\s*(?=\{"type":"|$|(?=[A-Za-z*#]))/g,
     ""
@@ -1065,9 +1339,9 @@ async function spawnAgentTurn(thread, input, onEvent) {
       `Cannot spawn ${thread.agent}: thread ${thread.id} has no worktreePath`
     );
   }
-  const { isGlobalThread: isGlobalThread2 } = await import("./global-workspace-CSIS62Z4.js");
+  const { isGlobalThread: isGlobalThread2 } = await import("./global-workspace-VG44RZUH.js");
   if (isGlobalThread2(thread)) {
-    const { ensureGlobalCoordinatorCwd: ensureGlobalCoordinatorCwd2 } = await import("./coordinator-prompt-3XXSG7M2.js");
+    const { ensureGlobalCoordinatorCwd: ensureGlobalCoordinatorCwd2 } = await import("./coordinator-prompt-2OVON2LQ.js");
     ensureGlobalCoordinatorCwd2(
       isOrchestratorThread(thread) ? { orchestratorThreadId: thread.id } : void 0
     );
@@ -1084,8 +1358,13 @@ async function spawnAgentTurn(thread, input, onEvent) {
   }
   const env = childEnvWithAppSettings(cmd.env);
   if (!isOrchestratorThread(thread)) {
-    const originEnv = await originGhRepoEnv(thread.worktreePath).catch(() => ({}));
-    Object.assign(env, originEnv);
+    try {
+      const originEnv = await originGhRepoEnv(thread.worktreePath, { env });
+      Object.assign(env, originEnv);
+    } catch (err) {
+      const detail = err instanceof Error ? err.message : String(err);
+      console.warn(`[sideboard] originGhRepoEnv failed (${thread.worktreePath}): ${detail}`);
+    }
   }
   const child = execa(cmd.file, cmd.args, {
     cwd: cmd.cwd,
@@ -1154,8 +1433,8 @@ async function spawnAgentTurn(thread, input, onEvent) {
     onEvent({ type: "exit", data: exitCode });
     const finalized = finalizeParts(parts);
     const rawText = assistantText.trim() || partsToAssistantText(finalized);
-    const text2 = thread.agent === "brightsy" ? stripBrightsyNdjsonNoise(rawText) : rawText;
-    return { exitCode, sessionId, assistantText: text2, parts: finalized, usage };
+    const text3 = thread.agent === "brightsy" ? stripBrightsyNdjsonNoise(rawText) : rawText;
+    return { exitCode, sessionId, assistantText: text3, parts: finalized, usage };
   });
   return {
     pid: child.pid,
@@ -1220,6 +1499,8 @@ function formatWorktreeDirective(thread, opts) {
   lines.push(
     "- Push with `git push -u origin HEAD` (or the current branch name). Do not `git push upstream`."
   );
+  lines.push("");
+  lines.push(formatGitAuthModeDirective(opts?.gitAuthMode ?? "auto"));
   lines.push(
     "- Derive the PR title and body from what the changes actually do and why \u2014 inspect the diff/commits and the user request. Do not use the soccer-team worktree nickname or placeholder branch as the PR title."
   );
@@ -1405,9 +1686,9 @@ function matchSimpleGlob(pattern, name) {
   return new RegExp(`^${escaped}$`).test(name);
 }
 function readWorktreeInclude(repoPath) {
-  const path = join2(repoPath, ".worktreeinclude");
-  if (!existsSync2(path)) return [];
-  return readFileSync2(path, "utf8").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
+  const path2 = join2(repoPath, ".worktreeinclude");
+  if (!existsSync2(path2)) return [];
+  return readFileSync2(path2, "utf8").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
 }
 function resolveFilesToCopy(repoPath) {
   const fromInclude = readWorktreeInclude(repoPath);
@@ -1482,8 +1763,20 @@ async function captureLoginEnv() {
   cachedLoginEnv = { ...process.env };
   return { ...cachedLoginEnv };
 }
+var NESTED_ELECTRON_ENV_PREFIXES = ["ELECTRON_", "CHROME_"];
+function stripNestedElectronEnv(env) {
+  const out = { ...env };
+  for (const key of Object.keys(out)) {
+    if (NESTED_ELECTRON_ENV_PREFIXES.some((prefix) => key.startsWith(prefix))) {
+      delete out[key];
+    }
+  }
+  return out;
+}
 function buildWorkspaceScriptEnv(opts, baseEnv) {
-  const env = { ...baseEnv ?? process.env };
+  const env = stripNestedElectronEnv({
+    ...baseEnv ?? process.env
+  });
   const name = opts.workspaceName ?? basename(opts.worktreePath);
   const ports = opts.ports ?? [];
   const primary = ports[0];
@@ -1708,10 +2001,10 @@ import { join as join3 } from "path";
 import { execa as execa3 } from "execa";
 import { createInterface as createInterface3 } from "readline";
 function loadCursorWorktreesJson(rootPath) {
-  const path = join3(rootPath, ".cursor", "worktrees.json");
-  if (!existsSync3(path)) return null;
+  const path2 = join3(rootPath, ".cursor", "worktrees.json");
+  if (!existsSync3(path2)) return null;
   try {
-    return JSON.parse(readFileSync3(path, "utf8"));
+    return JSON.parse(readFileSync3(path2, "utf8"));
   } catch {
     return null;
   }
@@ -1812,9 +2105,9 @@ function parseNameStatus(stdout) {
   const out = [];
   for (const line of stdout.split("\n").filter(Boolean)) {
     const [status, ...pathParts] = line.split("	");
-    const path = pathParts[pathParts.length - 1];
-    if (!status || !path) continue;
-    out.push({ status: status[0] ?? status, path });
+    const path2 = pathParts[pathParts.length - 1];
+    if (!status || !path2) continue;
+    out.push({ status: status[0] ?? status, path: path2 });
   }
   return out;
 }
@@ -1822,12 +2115,12 @@ function parseNumstat(stdout) {
   const map = /* @__PURE__ */ new Map();
   for (const line of stdout.split("\n").filter(Boolean)) {
     const [addRaw, delRaw, ...pathParts] = line.split("	");
-    const path = pathParts[pathParts.length - 1];
-    if (!path) continue;
+    const path2 = pathParts[pathParts.length - 1];
+    if (!path2) continue;
     const additions = addRaw === "-" ? 0 : Number(addRaw);
     const deletions = delRaw === "-" ? 0 : Number(delRaw);
     if (!Number.isFinite(additions) && !Number.isFinite(deletions)) continue;
-    map.set(path, {
+    map.set(path2, {
       additions: Number.isFinite(additions) ? additions : 0,
       deletions: Number.isFinite(deletions) ? deletions : 0
     });
@@ -1904,70 +2197,70 @@ function splitCombinedDiff(stdout) {
   }
   return map;
 }
-function syntheticAddPatch(path, content, maxHunk) {
+function syntheticAddPatch(path2, content, maxHunk) {
   const lines = content.split("\n");
   const body = lines.map((l) => `+${l}`).join("\n");
-  const header = `diff --git a/${path} b/${path}
+  const header = `diff --git a/${path2} b/${path2}
 new file mode 100644
 --- /dev/null
-+++ b/${path}
++++ b/${path2}
 @@ -0,0 +1,${lines.length} @@
 `;
   return {
-    path,
+    path: path2,
     status: "A",
     patch: capPatch(`${header}${body}`, maxHunk),
     additions: lines.length,
     deletions: 0
   };
 }
-async function untrackedPatch(worktreePath, path, maxHunk) {
-  const abs = join4(worktreePath, path);
+async function untrackedPatch(worktreePath, path2, maxHunk) {
+  const abs = join4(worktreePath, path2);
   try {
     const st = statSync2(abs);
     if (st.isFile() && st.size > maxHunk) {
       const buf = readFileSync4(abs).subarray(0, maxHunk);
-      return syntheticAddPatch(path, buf.toString("utf8"), maxHunk);
+      return syntheticAddPatch(path2, buf.toString("utf8"), maxHunk);
     }
   } catch {
   }
   const { stdout: patch } = await git(
-    ["diff", "--no-ext-diff", "--no-color", "--no-index", "--", "/dev/null", path],
+    ["diff", "--no-ext-diff", "--no-color", "--no-index", "--", "/dev/null", path2],
     worktreePath,
     { reject: false, timeoutMs: 4e3 }
   );
-  const normalized = patch.replace(/^diff --git a\/.+? b\/.+?$/m, `diff --git a/${path} b/${path}`).replace(/^--- .*$/m, "--- /dev/null").replace(/^\+\+\+ .*$/m, `+++ b/${path}`);
+  const normalized = patch.replace(/^diff --git a\/.+? b\/.+?$/m, `diff --git a/${path2} b/${path2}`).replace(/^--- .*$/m, "--- /dev/null").replace(/^\+\+\+ .*$/m, `+++ b/${path2}`);
   const addLines = normalized.split("\n").filter((l) => l.startsWith("+") && !l.startsWith("+++")).length;
   return {
-    path,
+    path: path2,
     status: "A",
     patch: capPatch(normalized, maxHunk),
     additions: addLines,
     deletions: 0
   };
 }
-async function listUntrackedPaths(worktreePath, path) {
+async function listUntrackedPaths(worktreePath, path2) {
   const args = ["ls-files", "-z", "--others", "--exclude-standard"];
-  if (path) args.push("--", path);
+  if (path2) args.push("--", path2);
   const { stdout } = await git(args, worktreePath, { reject: false });
   return stdout.split("\0").filter(Boolean).filter((p) => !isSideboardScratchPath(p));
 }
 async function listUntrackedFiles(worktreePath, maxHunk, paths) {
   const list = paths ?? await listUntrackedPaths(worktreePath);
   if (list.length === 0) return [];
-  return Promise.all(list.map((path) => untrackedPatch(worktreePath, path, maxHunk)));
+  return Promise.all(list.map((path2) => untrackedPatch(worktreePath, path2, maxHunk)));
 }
 function untrackedStubs(paths) {
-  return paths.map((path) => ({
-    path,
+  return paths.map((path2) => ({
+    path: path2,
     status: "A",
     patch: "",
     additions: 0,
     deletions: 0
   }));
 }
-function pathspec(path) {
-  return path ? ["--", path] : [];
+function pathspec(path2) {
+  return path2 ? ["--", path2] : [];
 }
 function gitDiff(args, cwd, opts) {
   return git(["diff", "--no-ext-diff", "--no-color", ...args], cwd, {
@@ -1975,7 +2268,7 @@ function gitDiff(args, cwd, opts) {
     timeoutMs: opts?.timeoutMs
   });
 }
-function fileFromPatch(path, patch, maxHunk) {
+function fileFromPatch(path2, patch, maxHunk) {
   let status = "M";
   if (/^new file mode /m.test(patch) || /^--- \/dev\/null/m.test(patch)) {
     status = "A";
@@ -1987,15 +2280,15 @@ function fileFromPatch(path, patch, maxHunk) {
   const additions = patch.split("\n").filter((l) => l.startsWith("+") && !l.startsWith("+++")).length;
   const deletions = patch.split("\n").filter((l) => l.startsWith("-") && !l.startsWith("---")).length;
   return {
-    path,
+    path: path2,
     status,
     patch: capPatch(patch, maxHunk),
     additions,
     deletions
   };
 }
-async function gitDiffParts(worktreePath, diffArgs, includePatches, path) {
-  const extra = pathspec(path);
+async function gitDiffParts(worktreePath, diffArgs, includePatches, path2) {
+  const extra = pathspec(path2);
   if (includePatches) {
     const diff = await gitDiff([...diffArgs, ...extra], worktreePath, {
       timeoutMs: 4e3
@@ -2020,30 +2313,30 @@ function formatStat(files) {
   return `${n} file${n === 1 ? "" : "s"} changed, ${additions} insertions(+), ${deletions} deletions(-)`;
 }
 function emptyScopeStats() {
-  const z3 = emptyStat();
+  const z4 = emptyStat();
   return {
-    commits: z3,
-    uncommitted: z3,
-    staged: z3,
-    unstaged: z3,
-    last_turn: z3
+    commits: z4,
+    uncommitted: z4,
+    staged: z4,
+    unstaged: z4,
+    last_turn: z4
   };
 }
 function filesFromDiff(nameStatus, numstat, combinedDiff, maxHunk) {
   const patches = splitCombinedDiff(combinedDiff);
   if (!nameStatus.trim() && patches.size > 0) {
     return [...patches.entries()].map(
-      ([path, patch]) => fileFromPatch(path, patch, maxHunk)
+      ([path2, patch]) => fileFromPatch(path2, patch, maxHunk)
     );
   }
   const counts = parseNumstat(numstat);
   const files = [];
-  for (const { status, path } of parseNameStatus(nameStatus)) {
-    const n = counts.get(path);
+  for (const { status, path: path2 } of parseNameStatus(nameStatus)) {
+    const n = counts.get(path2);
     files.push({
-      path,
+      path: path2,
       status,
-      patch: capPatch(patches.get(path) ?? "", maxHunk),
+      patch: capPatch(patches.get(path2) ?? "", maxHunk),
       additions: n?.additions,
       deletions: n?.deletions
     });
@@ -2127,7 +2420,7 @@ function emptyPathDiff(scope, base, hasLastTurnBase, commitSha = null) {
   };
 }
 async function getPathDiff(worktreePath, repoPath, opts) {
-  const { path, scope, commitSha, lastTurnBase, hasLastTurnBase, includePatches, maxHunk } = opts;
+  const { path: path2, scope, commitSha, lastTurnBase, hasLastTurnBase, includePatches, maxHunk } = opts;
   if (scope === "last_turn" && !lastTurnBase) {
     return emptyPathDiff(scope, "last turn", false);
   }
@@ -2166,7 +2459,7 @@ async function getPathDiff(worktreePath, repoPath, opts) {
     labelBase = "HEAD";
   }
   const diff = await gitDiff(
-    includePatches ? [...diffArgs, "--", path] : ["--name-status", ...diffArgs, "--", path],
+    includePatches ? [...diffArgs, "--", path2] : ["--name-status", ...diffArgs, "--", path2],
     worktreePath,
     { timeoutMs: 4e3 }
   );
@@ -2174,8 +2467,8 @@ async function getPathDiff(worktreePath, repoPath, opts) {
   if (includePatches) {
     const parsed = filesFromDiff("", "", diff.stdout, maxHunk);
     for (const file of parsed) filesMap.set(file.path, file);
-    if (diff.stdout.trim() && !filesMap.has(path)) {
-      filesMap.set(path, fileFromPatch(path, diff.stdout, maxHunk));
+    if (diff.stdout.trim() && !filesMap.has(path2)) {
+      filesMap.set(path2, fileFromPatch(path2, diff.stdout, maxHunk));
     }
   } else {
     for (const file of filesFromDiff(diff.stdout, "", "", maxHunk)) {
@@ -2183,7 +2476,7 @@ async function getPathDiff(worktreePath, repoPath, opts) {
     }
   }
   if (filesMap.size === 0) {
-    const maybe = await listUntrackedPaths(worktreePath, path);
+    const maybe = await listUntrackedPaths(worktreePath, path2);
     if (maybe.length > 0) {
       const extra = includePatches ? await listUntrackedFiles(worktreePath, maxHunk, maybe) : untrackedStubs(maybe);
       for (const file of extra) filesMap.set(file.path, file);
@@ -3016,16 +3309,16 @@ var PASTE_ATTACH_MIN_CHARS = 1200;
 var PASTE_ATTACH_MIN_LINES = 15;
 var PASTED_NAME_RE = /^Pasted text #(\d+)\.txt$/i;
 var PASTED_NAME_ALT_RE = /^pasted-(\d+)\.txt$/i;
-function pastedTextStats(text2) {
-  const chars = text2.length;
+function pastedTextStats(text3) {
+  const chars = text3.length;
   if (chars === 0) return { chars: 0, lines: 0 };
-  const lines = text2.split(/\r\n|\r|\n/).length;
+  const lines = text3.split(/\r\n|\r|\n/).length;
   return { chars, lines };
 }
-function shouldAttachPastedText(text2) {
-  const trimmed = text2.trim();
+function shouldAttachPastedText(text3) {
+  const trimmed = text3.trim();
   if (!trimmed) return false;
-  const { chars, lines } = pastedTextStats(text2);
+  const { chars, lines } = pastedTextStats(text3);
   return chars >= PASTE_ATTACH_MIN_CHARS || lines >= PASTE_ATTACH_MIN_LINES;
 }
 function nextPastedTextName(existing) {
@@ -3036,13 +3329,13 @@ function nextPastedTextName(existing) {
   }
   return `Pasted text #${max + 1}.txt`;
 }
-function buildPastedTextAttachment(text2, opts) {
+function buildPastedTextAttachment(text3, opts) {
   return {
     id: opts?.id ?? randomUUID2(),
     name: opts?.name ?? "Pasted text #1.txt",
     kind: "file",
     path: opts?.path,
-    content: text2
+    content: text3
   };
 }
 
@@ -3090,9 +3383,9 @@ async function tryClaudeSummary(transcript, opts) {
       { cwd: opts?.cwd, reject: false }
     );
     if (exitCode !== 0) return null;
-    const text2 = stdout.trim();
-    if (text2.length < 40) return null;
-    return text2;
+    const text3 = stdout.trim();
+    if (text3.length < 40) return null;
+    return text3;
   } catch {
     return null;
   }
@@ -3141,9 +3434,9 @@ function extractiveSummary(transcript) {
   );
   return parts.join("\n");
 }
-function clipSummary(text2) {
-  if (text2.length <= MAX_SUMMARY_CHARS) return text2;
-  return `${text2.slice(0, MAX_SUMMARY_CHARS)}
+function clipSummary(text3) {
+  if (text3.length <= MAX_SUMMARY_CHARS) return text3;
+  return `${text3.slice(0, MAX_SUMMARY_CHARS)}
 
 [\u2026summary truncated\u2026]`;
 }
@@ -3206,8 +3499,8 @@ function splitForCompaction(messages, thresholds = {}) {
 function formatToolPart(t, detail) {
   if (detail === "summary") {
     const label = t.description || t.detail || t.name;
-    const path = t.filePath ? ` (${t.filePath})` : "";
-    return `- ${t.name}: ${label}${path}`;
+    const path2 = t.filePath ? ` (${t.filePath})` : "";
+    return `- ${t.name}: ${label}${path2}`;
   }
   const lines = [`#### Tool: ${t.name}`, `Status: ${t.status}`];
   if (t.description) lines.push(`Description: ${t.description}`);
@@ -3545,7 +3838,7 @@ async function createThread(input, _onSetupLine) {
   return readThread(thread.id) ?? thread;
 }
 async function listLinearIssues(agent, repoPath) {
-  const { getAdapter: getAdapter2 } = await import("./agents-H7M5CQY2.js");
+  const { getAdapter: getAdapter2 } = await import("./agents-EWPHOM6Y.js");
   await requireAgent(agent, { requireLinear: true });
   const adapter = getAdapter2(agent);
   if (!adapter.listLinearIssues) {
@@ -4043,13 +4336,13 @@ function resolveConductorCursorAgentId(workspacePath) {
   for (const hash of hashes) {
     const agentsFile = join7(CURSOR_SDK_STORE, hash, "agents.ndjson");
     if (!existsSync9(agentsFile)) continue;
-    let text2;
+    let text3;
     try {
-      text2 = readFileSync7(agentsFile, "utf8");
+      text3 = readFileSync7(agentsFile, "utf8");
     } catch {
       continue;
     }
-    for (const line of text2.split("\n")) {
+    for (const line of text3.split("\n")) {
       const trimmed = line.trim();
       if (!trimmed) continue;
       try {
@@ -4088,7 +4381,7 @@ async function adoptThread(input) {
     messages: input.messages ?? []
   });
   writeThread(thread);
-  const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-W72KZL4B.js");
+  const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-TYPJNUSM.js");
   await ensureWorkspace2(repoPath);
   return thread;
 }
@@ -4339,10 +4632,10 @@ function storePath() {
   return join8(appDataDir(), "slack-reply-to.json");
 }
 function readStore() {
-  const path = storePath();
-  if (!existsSync10(path)) return {};
+  const path2 = storePath();
+  if (!existsSync10(path2)) return {};
   try {
-    const parsed = isSecureFileEncrypted(path) ? readSecureJson(path) : JSON.parse(readFileSync8(path, "utf8"));
+    const parsed = isSecureFileEncrypted(path2) ? readSecureJson(path2) : JSON.parse(readFileSync8(path2, "utf8"));
     return parsed?.targets && typeof parsed.targets === "object" ? parsed.targets : {};
   } catch {
     return {};
@@ -4365,12 +4658,12 @@ function storePath2() {
 }
 function readStore2() {
   try {
-    const path = storePath2();
-    const wasEncrypted = isSecureFileEncrypted(path);
-    const parsed = readSecureJson(path);
+    const path2 = storePath2();
+    const wasEncrypted = isSecureFileEncrypted(path2);
+    const parsed = readSecureJson(path2);
     const workspaces = Array.isArray(parsed?.workspaces) ? parsed.workspaces : [];
     if (workspaces.length > 0 && !wasEncrypted && resolveVaultKey()) {
-      writeSecureJson(path, { workspaces });
+      writeSecureJson(path2, { workspaces });
     }
     return workspaces;
   } catch {
@@ -4506,10 +4799,10 @@ function tsNewer(a, b) {
   return Number(a) > Number(b);
 }
 function readStore3() {
-  const path = storePath3();
-  if (!existsSync11(path)) return [];
+  const path2 = storePath3();
+  if (!existsSync11(path2)) return [];
   try {
-    const parsed = isSecureFileEncrypted(path) ? readSecureJson(path) : JSON.parse(readFileSync9(path, "utf8"));
+    const parsed = isSecureFileEncrypted(path2) ? readSecureJson(path2) : JSON.parse(readFileSync9(path2, "utf8"));
     return Array.isArray(parsed?.watches) ? parsed.watches : [];
   } catch {
     return [];
@@ -4539,8 +4832,8 @@ ${input.permalink}` : "";
 
 ${body}${link}`;
 }
-function isSlackExternalReplyPrompt(text2) {
-  return text2.startsWith("Slack reply from ") && text2.includes("not a command");
+function isSlackExternalReplyPrompt(text3) {
+  return text3.startsWith("Slack reply from ") && text3.includes("not a command");
 }
 function pendingSlackExternalReplies(messages) {
   let i = messages.length - 1;
@@ -4564,9 +4857,9 @@ function formatSlackRepliesForTurn(replies) {
 function listSlackOutboundWatches() {
   return pruneWatches(readStore3());
 }
-function formatOwnerSlackFyi(userName, text2) {
+function formatOwnerSlackFyi(userName, text3) {
   const who = userName.trim() || "Someone";
-  const body = text2.trim() || "(no text)";
+  const body = text3.trim() || "(no text)";
   return `${who} replied in Slack:
 ${body}`;
 }
@@ -4581,7 +4874,7 @@ async function relayExternalReply(opts) {
   const thread = readThread(threadId);
   if (!thread || thread.status === "archived") return true;
   try {
-    const text2 = formatSlackExternalReplyPrompt({
+    const text3 = formatSlackExternalReplyPrompt({
       userName: opts.reply.userName,
       kind: opts.watch.kind,
       toLabel: opts.watch.toLabel,
@@ -4590,7 +4883,7 @@ async function relayExternalReply(opts) {
     });
     appendMessage(threadId, {
       role: "agent",
-      text: text2,
+      text: text3,
       ts: (/* @__PURE__ */ new Date()).toISOString()
     });
   } catch {
@@ -4787,7 +5080,7 @@ async function refreshSlackReplyBadges(opts) {
     const messages = await fetchMessages(token, watch, opts?.fetchImpl);
     const replies = messages.filter((m) => isHumanReply(m, watch)).sort((a, b) => Number(a.ts) - Number(b.ts));
     if (replies.length === 0) continue;
-    const injected = new Set(watch.injectedReplyTs ?? []);
+    const injected2 = new Set(watch.injectedReplyTs ?? []);
     const collected = [...watch.replies ?? []];
     let lastSeenTs = watch.lastSeenTs;
     let latestUser;
@@ -4821,7 +5114,7 @@ async function refreshSlackReplyBadges(opts) {
       latestName = replyUserName;
       latestText = reply.text;
       latestPermalink = permalink;
-      if (injected.has(ts)) {
+      if (injected2.has(ts)) {
         lastSeenTs = ts;
         continue;
       }
@@ -4832,7 +5125,7 @@ async function refreshSlackReplyBadges(opts) {
         fetchImpl: opts?.fetchImpl
       });
       if (!delivered) break;
-      injected.add(ts);
+      injected2.add(ts);
       lastSeenTs = ts;
     }
     watches[i] = {
@@ -4844,7 +5137,7 @@ async function refreshSlackReplyBadges(opts) {
       replyTs: lastSeenTs,
       replyPreview: latestText.slice(0, 140),
       permalink: latestPermalink,
-      injectedReplyTs: [...injected],
+      injectedReplyTs: [...injected2],
       replies: collected.slice(-MAX_REPLIES_PER_WATCH)
     };
     changed = true;
@@ -4873,8 +5166,8 @@ function shouldAutoArchiveOnPrMerge(opts) {
 // src/git/orphan-cleanup.ts
 import { existsSync as existsSync12, readdirSync as readdirSync4, statSync as statSync5 } from "fs";
 import { join as join11 } from "path";
-function isSideboardWorktreePath(path) {
-  return path.includes("/.sideboard/worktrees/") || path.includes("/sideboard/workspaces/");
+function isSideboardWorktreePath(path2) {
+  return path2.includes("/.sideboard/worktrees/") || path2.includes("/sideboard/workspaces/");
 }
 async function findOrphanWorktrees(repoPaths) {
   const threads = listThreads({ includeArchived: true });
@@ -4899,18 +5192,18 @@ async function findOrphanWorktrees(repoPaths) {
     try {
       const wts = await listWorktrees(repoPath);
       for (const wt of wts) {
-        const path = wt.path.replace(/\/$/, "");
-        if (!isSideboardWorktreePath(path)) continue;
-        if (known.has(path)) continue;
-        if (seen.has(path)) continue;
-        seen.add(path);
+        const path2 = wt.path.replace(/\/$/, "");
+        if (!isSideboardWorktreePath(path2)) continue;
+        if (known.has(path2)) continue;
+        if (seen.has(path2)) continue;
+        seen.add(path2);
         let mtimeMs = 0;
         try {
-          mtimeMs = statSync5(path).mtimeMs;
+          mtimeMs = statSync5(path2).mtimeMs;
         } catch {
           mtimeMs = 0;
         }
-        orphans.push({ path, repoPath, mtimeMs });
+        orphans.push({ path: path2, repoPath, mtimeMs });
       }
     } catch {
     }
@@ -4919,17 +5212,17 @@ async function findOrphanWorktrees(repoPaths) {
       if (existsSync12(root)) {
         for (const entry of readdirSync4(root, { withFileTypes: true })) {
           if (!entry.isDirectory()) continue;
-          const path = join11(root, entry.name).replace(/\/$/, "");
-          if (known.has(path) || seen.has(path)) continue;
-          if (!existsSync12(join11(path, ".git"))) continue;
-          seen.add(path);
+          const path2 = join11(root, entry.name).replace(/\/$/, "");
+          if (known.has(path2) || seen.has(path2)) continue;
+          if (!existsSync12(join11(path2, ".git"))) continue;
+          seen.add(path2);
           let mtimeMs = 0;
           try {
-            mtimeMs = statSync5(path).mtimeMs;
+            mtimeMs = statSync5(path2).mtimeMs;
           } catch {
             mtimeMs = Date.now();
           }
-          orphans.push({ path, repoPath, mtimeMs });
+          orphans.push({ path: path2, repoPath, mtimeMs });
         }
       }
     } catch {
@@ -5312,9 +5605,9 @@ function ensureReviewRequestFile(worktreePath) {
   const localAbs = join13(worktreePath, REVIEW_REQUEST_PATH);
   const localContent = readTextIfPresent(localAbs) ?? readTextIfPresent(join13(worktreePath, LEGACY_REVIEW_REQUEST_PATH));
   if (localContent && !shouldRefreshReviewRequestTemplate(localContent)) {
-    const path = existsSync14(localAbs) ? REVIEW_REQUEST_PATH : LEGACY_REVIEW_REQUEST_PATH;
+    const path2 = existsSync14(localAbs) ? REVIEW_REQUEST_PATH : LEGACY_REVIEW_REQUEST_PATH;
     return {
-      path,
+      path: path2,
       name: REVIEW_REQUEST_NAME,
       content: localContent,
       source: "local"
@@ -5330,13 +5623,13 @@ function ensureReviewRequestFile(worktreePath) {
   };
 }
 function buildReviewRequestAttachment(content, opts) {
-  const path = opts?.path ?? REVIEW_REQUEST_PATH;
-  const name = opts?.name ?? (path === REPO_REVIEW_PATH ? REPO_REVIEW_NAME : REVIEW_REQUEST_NAME);
+  const path2 = opts?.path ?? REVIEW_REQUEST_PATH;
+  const name = opts?.name ?? (path2 === REPO_REVIEW_PATH ? REPO_REVIEW_NAME : REVIEW_REQUEST_NAME);
   return {
     id: randomUUID4(),
     name,
     kind: "file",
-    path,
+    path: path2,
     content
   };
 }
@@ -5421,8 +5714,8 @@ function buildQuotaHandoffAttachment(from, limitText, fallbackAgent) {
   );
   const recent = from.messages.slice(-8).map((m) => {
     const role = m.role === "user" ? "User" : m.role === "agent" ? "Agent" : "Summary";
-    const text2 = m.text.trim().replace(/\s+/g, " ").slice(0, 280);
-    return text2 ? `- ${role}: ${text2}` : null;
+    const text3 = m.text.trim().replace(/\s+/g, " ").slice(0, 280);
+    return text3 ? `- ${role}: ${text3}` : null;
   }).filter(Boolean);
   const body = [
     `# Orchestration handoff`,
@@ -5605,7 +5898,7 @@ var Orchestrator = class {
           orphans: orphans.map((o) => ({ path: o.path, repoPath: o.repoPath }))
         });
       }
-      const { autoCleanupOrphansEnabled: autoCleanupOrphansEnabled2 } = await import("./app-settings-3TLA2EJ7.js");
+      const { autoCleanupOrphansEnabled: autoCleanupOrphansEnabled2 } = await import("./app-settings-6IOQYGBK.js");
       if (autoCleanupOrphansEnabled2() && shouldRunWorktreeCleanup() && orphans.length > 0) {
         await cleanupOrphanWorktrees({ repoPaths });
       }
@@ -5762,7 +6055,7 @@ var Orchestrator = class {
   }
   async finishCreateThread(threadId, prompt) {
     await this.runSetupAfterCreate(threadId);
-    const { autoRunAfterSetupEnabled: autoRunAfterSetupEnabled2 } = await import("./app-settings-3TLA2EJ7.js");
+    const { autoRunAfterSetupEnabled: autoRunAfterSetupEnabled2 } = await import("./app-settings-6IOQYGBK.js");
     if (autoRunAfterSetupEnabled2()) {
       try {
         await this.startDev(threadId);
@@ -5842,11 +6135,11 @@ var Orchestrator = class {
     return results;
   }
   /** Edit the text of a not-yet-started queued message. */
-  async editQueuedMessage(threadRef, index, text2) {
+  async editQueuedMessage(threadRef, index, text3) {
     const thread = this.requireThread(threadRef);
     return withThreadLock(thread.id, async () => {
       const current = this.requireThread(thread.id);
-      const trimmed = text2.trim();
+      const trimmed = text3.trim();
       if (!trimmed || index < 0 || index >= current.queue.length) {
         return current;
       }
@@ -6040,14 +6333,16 @@ var Orchestrator = class {
     }
     const isBrightsy = fresh.agent === "brightsy";
     const isOrchestration = isOrchestratorThread(fresh);
+    const { autoRenameBranchEnabled: autoRenameBranchEnabled2, getGithubGitAuthMode: getGithubGitAuthMode2 } = await import("./app-settings-6IOQYGBK.js");
+    const gitAuthMode = getGithubGitAuthMode2();
     const worktreeDirective = isBrightsy || isOrchestration ? null : formatWorktreeDirective(fresh, {
       githubSlug: await resolveGithubRepoSlug(fresh.worktreePath).catch(
         () => null
-      )
+      ),
+      gitAuthMode
     });
     const artifactDirective = isBrightsy ? null : formatArtifactDirective();
     const settings = loadWorkspaceSettings(fresh.worktreePath, fresh.repoPath);
-    const { autoRenameBranchEnabled: autoRenameBranchEnabled2 } = await import("./app-settings-3TLA2EJ7.js");
     const renameBranchDirective = !isBrightsy && !isOrchestration && autoRenameBranchEnabled2() ? formatRenameBranchDirective(fresh, {
       customPrompt: settings?.prompts?.renameBranch
     }) : null;
@@ -6606,6 +6901,14 @@ var Orchestrator = class {
       throw new Error(`${action} is not available on the global coordinator`);
     }
   }
+  /** MCP set_caffeinate is a detached hold — closing the chat must not leave the Mac awake. */
+  releaseOrchestratorCaffeinate(thread) {
+    if (!isOrchestratorThread(thread)) return;
+    try {
+      releaseCaffeinateHoldForThread(thread.id);
+    } catch {
+    }
+  }
   async diff(threadRef, opts) {
     const thread = this.requireThread(threadRef);
     this.assertNotGlobal(thread, "Diff");
@@ -6745,7 +7048,7 @@ var Orchestrator = class {
         updateThread(thread.id, { title: meta.title });
       }
     }
-    const { autoArchiveOnMergeEnabled: autoArchiveOnMergeEnabled2 } = await import("./app-settings-3TLA2EJ7.js");
+    const { autoArchiveOnMergeEnabled: autoArchiveOnMergeEnabled2 } = await import("./app-settings-6IOQYGBK.js");
     const latest = this.requireThread(thread.id);
     if (!shouldAutoArchiveOnPrMerge({
       previousPrState: prevState || null,
@@ -6876,8 +7179,9 @@ var Orchestrator = class {
     return tab;
   }
   /**
-   * Queue a desktop-git-button prompt on a worktree agent (commit/push/PR/merge).
-   * Orchestrators use this instead of running git/gh from the synthetic home.
+   * Desktop git buttons + MCP `ask_git`.
+   * When the worktree is clean, push / open the PR here (HTTPS via `gh` if SSH
+   * is missing). When dirty, queue the worktree agent to commit first.
    */
   async askGit(threadRef, action) {
     if (!AGENT_GIT_ACTIONS.includes(action)) {
@@ -6895,6 +7199,10 @@ var Orchestrator = class {
         "No pull request linked. Ask the worktree agent to open a draft PR first (ask_git create-draft)."
       );
     }
+    if ((action === "commit-push" || action === "create-draft" || action === "create-web") && thread.worktreePath?.trim() && !await isDirty(thread.worktreePath)) {
+      await this.pushAndMaybeOpenPr(thread, action);
+      return this.requireThread(threadRef);
+    }
     let prBase;
     if (action === "resolve-conflicts") {
       try {
@@ -6905,6 +7213,34 @@ var Orchestrator = class {
     }
     return this.send(threadRef, agentGitPrompt(action, { prBase }));
   }
+  /** Push origin (gh HTTPS fallback) and create/update the PR when requested. */
+  async pushAndMaybeOpenPr(thread, action) {
+    const cwd = thread.worktreePath;
+    const branch = await currentBranch(cwd);
+    await pushBranch(cwd, branch);
+    if (action === "commit-push") return;
+    const base = await resolveDefaultBranch(thread.repoPath);
+    const meta = await suggestPrMetadata(cwd, {
+      base,
+      fallbackTitle: thread.prTitle ?? thread.title
+    });
+    const url = await createOrUpdatePr(cwd, {
+      title: meta.title,
+      body: meta.body,
+      base,
+      head: branch,
+      draft: action === "create-draft",
+      web: action === "create-web"
+    });
+    if (!url) return;
+    const patch = { prUrl: url, prTitle: meta.title };
+    try {
+      const fetched = await getPrMeta(cwd, url);
+      if (fetched?.title) patch.prTitle = fetched.title;
+    } catch {
+    }
+    updateThread(thread.id, patch);
+  }
   setThreadOptions(threadRef, patch) {
     const thread = this.requireThread(threadRef);
     const next = {};
@@ -6975,6 +7311,7 @@ var Orchestrator = class {
   async archive(threadRef) {
     const thread = this.requireThread(threadRef);
     this.stop(thread.id);
+    this.releaseOrchestratorCaffeinate(thread);
     if (isGlobalThread(thread)) {
       const archived2 = setStatus(thread.id, "archived");
       this.emit({ type: "status_changed", threadId: archived2.id, status: "archived" });
@@ -6999,7 +7336,7 @@ var Orchestrator = class {
     this.emit({ type: "status_changed", threadId: archived.id, status: "archived" });
     if (thread.repoPath && !isGlobalRepoPath(thread.repoPath)) {
       try {
-        const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-W72KZL4B.js");
+        const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-TYPJNUSM.js");
         await ensureWorkspace2(thread.repoPath);
       } catch {
       }
@@ -7009,6 +7346,7 @@ var Orchestrator = class {
   async purge(threadRef, opts) {
     const thread = this.requireThread(threadRef);
     this.stop(thread.id);
+    this.releaseOrchestratorCaffeinate(thread);
     if (isGlobalThread(thread)) {
       deleteThreadRecord(thread.id);
       return;
@@ -7020,7 +7358,7 @@ var Orchestrator = class {
         await runArchiveScript(thread.repoPath, thread.worktreePath);
       } catch {
       }
-      const { deleteBranchOnPurgeEnabled: deleteBranchOnPurgeEnabled2 } = await import("./app-settings-3TLA2EJ7.js");
+      const { deleteBranchOnPurgeEnabled: deleteBranchOnPurgeEnabled2 } = await import("./app-settings-6IOQYGBK.js");
       const deleteBranch = opts?.deleteBranch ?? deleteBranchOnPurgeEnabled2();
       await removeWorktree(thread.repoPath, thread.worktreePath, {
         deleteBranch: deleteBranch ? thread.branchName : void 0
@@ -7041,7 +7379,7 @@ var Orchestrator = class {
       return restored2;
     }
     if (!existsSync15(thread.worktreePath)) {
-      const { createThreadWorktree: createThreadWorktree2 } = await import("./worktree-VOCH3WS3.js");
+      const { createThreadWorktree: createThreadWorktree2 } = await import("./worktree-5VLLFI5W.js");
       const { execa: execa6 } = await import("execa");
       const slug = thread.worktreePath.split("/").pop();
       const dest = thread.worktreePath;
@@ -7150,7 +7488,7 @@ async function startOrchestration(opts) {
     sourceRef: "default",
     ...createOpts
   }).catch(async () => {
-    const { resolveDefaultBranch: resolveDefaultBranch2, resolveRepoRoot: resolveRepoRoot2 } = await import("./worktree-VOCH3WS3.js");
+    const { resolveDefaultBranch: resolveDefaultBranch2, resolveRepoRoot: resolveRepoRoot2 } = await import("./worktree-5VLLFI5W.js");
     const repo = await resolveRepoRoot2(repoPath);
     const def = await resolveDefaultBranch2(repo);
     return createThread({
@@ -7272,7 +7610,7 @@ function formatPlanQuestionsForChat(questions) {
 // src/mcp/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 import { basename as basename4 } from "path";
 
 // src/mcp/archive-guard.ts
@@ -7468,9 +7806,9 @@ function labelGithubUrl(url) {
     return null;
   }
   if (!/(^|\.)github\.com$/i.test(parsed.hostname)) return null;
-  const path = parsed.pathname;
+  const path2 = parsed.pathname;
   const hash = parsed.hash || "";
-  const pr = path.match(/\/([^/]+)\/([^/]+)\/pull\/(\d+)/i);
+  const pr = path2.match(/\/([^/]+)\/([^/]+)\/pull\/(\d+)/i);
   if (pr) {
     const n = pr[3];
     if (/#discussion_r\d+/i.test(hash) || /#pullrequestreview-\d+/i.test(hash)) {
@@ -7481,11 +7819,11 @@ function labelGithubUrl(url) {
     }
     return { kind: "pr", label: `PR #${n}`, url: raw };
   }
-  const issueComment = path.match(/\/([^/]+)\/([^/]+)\/issues\/(\d+)/i);
+  const issueComment = path2.match(/\/([^/]+)\/([^/]+)\/issues\/(\d+)/i);
   if (issueComment && /#issuecomment-\d+/i.test(hash)) {
     return { kind: "comment", label: `Issue #${issueComment[3]} comment`, url: raw };
   }
-  const blob = path.match(/\/([^/]+)\/([^/]+)\/blob\/[^/]+\/(.+)$/i);
+  const blob = path2.match(/\/([^/]+)\/([^/]+)\/blob\/[^/]+\/(.+)$/i);
   if (blob) {
     const filePath = decodeURIComponent(blob[3]);
     const fileName = filePath.split("/").pop() || filePath;
@@ -7500,8 +7838,8 @@ function labelGithubUrl(url) {
   }
   return { kind: "other", label: "GitHub", url: raw };
 }
-function appendGithubLink(text2, githubUrl) {
-  const body = text2.trimEnd();
+function appendGithubLink(text3, githubUrl) {
+  const body = text3.trimEnd();
   if (!githubUrl?.trim()) return body;
   const labeled = labelGithubUrl(githubUrl);
   if (!labeled) {
@@ -7784,30 +8122,125 @@ function registerSlackTools(server) {
   );
 }
 
-// src/mcp/server.ts
-var MAX_ORCH_THREADS = 5;
-var CREATE_THREAD_TIMEOUT_MS = 9e4;
-function withTimeout(promise, ms, label) {
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => {
-      reject(new Error(`${label} timed out after ${Math.round(ms / 1e3)}s`));
-    }, ms);
-    promise.then(
-      (value) => {
-        clearTimeout(timer);
-        resolve(value);
-      },
-      (err) => {
-        clearTimeout(timer);
-        reject(err);
-      }
+// src/mcp/linear-tools.ts
+import { z as z2 } from "zod";
+function text2(payload, isError = false) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(payload, null, 2) }],
+    ...isError ? { isError: true } : {}
+  };
+}
+function fail2(err) {
+  return text2(
+    { error: err instanceof Error ? err.message : String(err) },
+    true
+  );
+}
+var prioritySchema = z2.number().int().min(0).max(4).optional().describe("0 none, 1 urgent, 2 high, 3 medium, 4 low");
+function registerLinearTools(server) {
+  server.tool(
+    "linear_list_teams",
+    "List Linear teams (id, key, name) and workflow states for the connected Account. Use team key (e.g. ENG) on linear_create_issue; use state name or type (started, completed) on create/update. Viewer id is for assignee=me.",
+    {},
+    async () => {
+      try {
+        return text2(await listLinearTeams());
+      } catch (err) {
+        return fail2(err);
+      }
+    }
+  );
+  server.tool(
+    "linear_get_issue",
+    "Get a Linear issue by uuid or identifier (ENG-123).",
+    { id: z2.string() },
+    async ({ id }) => {
+      try {
+        return text2(await getLinearIssue(id));
+      } catch (err) {
+        return fail2(err);
+      }
+    }
+  );
+  server.tool(
+    "linear_create_issue",
+    'Create a Linear issue. Call linear_list_teams first. team is id, key, or name. state is name, type (unstarted/started/completed/canceled/backlog), or id. assignee is "me" or a user id.',
+    {
+      team: z2.string(),
+      title: z2.string(),
+      description: z2.string().optional(),
+      state: z2.string().optional(),
+      assignee: z2.string().nullable().optional(),
+      priority: prioritySchema
+    },
+    async (args) => {
+      try {
+        return text2(await createLinearIssue(args));
+      } catch (err) {
+        return fail2(err);
+      }
+    }
+  );
+  server.tool(
+    "linear_update_issue",
+    'Update a Linear issue (uuid or ENG-123). Pass at least one of title, description, state, assignee, priority. state is name, type, or id. assignee is "me", a user id, or null to unassign.',
+    {
+      id: z2.string(),
+      title: z2.string().optional(),
+      description: z2.string().optional(),
+      state: z2.string().optional(),
+      assignee: z2.string().nullable().optional(),
+      priority: prioritySchema
+    },
+    async (args) => {
+      try {
+        return text2(await updateLinearIssue(args));
+      } catch (err) {
+        return fail2(err);
+      }
+    }
+  );
+  server.tool(
+    "linear_comment",
+    "Add a markdown comment on a Linear issue (uuid or ENG-123).",
+    {
+      id: z2.string(),
+      body: z2.string()
+    },
+    async (args) => {
+      try {
+        return text2(await commentLinearIssue(args));
+      } catch (err) {
+        return fail2(err);
+      }
+    }
+  );
+}
+
+// src/mcp/server.ts
+var MAX_ORCH_THREADS = 5;
+var CREATE_THREAD_TIMEOUT_MS = 9e4;
+function withTimeout(promise, ms, label) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      reject(new Error(`${label} timed out after ${Math.round(ms / 1e3)}s`));
+    }, ms);
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (err) => {
+        clearTimeout(timer);
+        reject(err);
+      }
     );
   });
 }
 async function startMcpServer() {
   const orch = getOrchestrator();
   try {
-    const { maxConcurrentAgents: maxConcurrentAgents2 } = await import("./app-settings-3TLA2EJ7.js");
+    const { maxConcurrentAgents: maxConcurrentAgents2 } = await import("./app-settings-6IOQYGBK.js");
     orch.setMaxConcurrent(maxConcurrentAgents2());
   } catch {
   }
@@ -7860,7 +8293,7 @@ async function startMcpServer() {
   server.tool(
     "get_thread",
     "Get a compact thread summary by id/ref",
-    { ref: z2.string() },
+    { ref: z3.string() },
     async ({ ref }) => {
       const t = orch.getThread(ref);
       if (!t) {
@@ -7889,14 +8322,14 @@ async function startMcpServer() {
     "present_artifact",
     "Show an HTML, SVG, markdown, or React document in Sideboard\u2019s Claude-style side column (desktop). Use instead of claude.ai\u2019s artifact tool \u2014 pass the full document content. Prefer type=html for interactive pages. For type=react, pass a single component module that `export default`s a component (JSX/TSX ok) \u2014 Sideboard bootstraps React/ReactDOM/Babel and renders it; only `react`/`react-dom` imports are available, no other npm packages.",
     {
-      title: z2.string().describe("Short title shown in the artifact pane header"),
-      type: z2.enum(["html", "svg", "markdown", "react"]).describe(
+      title: z3.string().describe("Short title shown in the artifact pane header"),
+      type: z3.enum(["html", "svg", "markdown", "react"]).describe(
         "Artifact kind \u2014 html opens an iframe preview; react transpiles and renders a default-exported component in a sandboxed iframe"
       ),
-      content: z2.string().describe(
+      content: z3.string().describe(
         "Full document body (complete HTML page, SVG markup, markdown, or a React component module with a default export)"
       ),
-      artifact_id: z2.string().optional().describe("Stable id when updating the same artifact across turns")
+      artifact_id: z3.string().optional().describe("Stable id when updating the same artifact across turns")
     },
     async ({ title, type, artifact_id }) => {
       const id = artifact_id?.trim() || `artifact_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
@@ -7914,15 +8347,15 @@ async function startMcpServer() {
     "ask_user",
     "Ask the user clarifying multiple-choice questions in Sideboard\u2019s composer (plan mode). Before calling, write a short chat message explaining the decision and what each option means. Include a description on every option. Use for approach forks and requirements \u2014 not for \u201Cis the plan ready?\u201D. After calling, stop and wait for their next message with answers.",
     {
-      questions: z2.array(
-        z2.object({
-          question: z2.string().describe("Full question text ending with ?"),
-          header: z2.string().max(24).optional().describe("Short label shown above the question"),
-          multiSelect: z2.boolean().optional().describe("Allow selecting multiple options"),
-          options: z2.array(
-            z2.object({
-              label: z2.string(),
-              description: z2.string().optional().describe("What this option means / when to choose it (strongly preferred)")
+      questions: z3.array(
+        z3.object({
+          question: z3.string().describe("Full question text ending with ?"),
+          header: z3.string().max(24).optional().describe("Short label shown above the question"),
+          multiSelect: z3.boolean().optional().describe("Allow selecting multiple options"),
+          options: z3.array(
+            z3.object({
+              label: z3.string(),
+              description: z3.string().optional().describe("What this option means / when to choose it (strongly preferred)")
             })
           ).min(2).max(6).describe("2\u20136 choices (Sideboard also offers Other)")
         })
@@ -7941,9 +8374,9 @@ async function startMcpServer() {
     "present_plan",
     "Save the implementation plan as markdown to .context/attachments/plan.md and show it in Sideboard chat for user approval (Copy / Hand off / Approve). Call this when the plan is ready \u2014 required in plan mode. Pass the full plan body in content. Then Claude should call ExitPlanMode.",
     {
-      title: z2.string().optional().describe("Short plan title (defaults to Plan)"),
-      content: z2.string().min(1).describe("Full plan markdown (headings, steps, risks, open questions)"),
-      thread_id: z2.string().optional().describe("Sideboard thread id when cwd is not the worktree")
+      title: z3.string().optional().describe("Short plan title (defaults to Plan)"),
+      content: z3.string().min(1).describe("Full plan markdown (headings, steps, risks, open questions)"),
+      thread_id: z3.string().optional().describe("Sideboard thread id when cwd is not the worktree")
     },
     async ({ title, content, thread_id }) => {
       const { writePlanFile: writePlanFile2 } = await import("./plan-file-6O7G4VPQ.js");
@@ -7952,10 +8385,10 @@ async function startMcpServer() {
         const t = orch.getThread(thread_id.trim());
         if (t?.worktreePath?.trim()) root = t.worktreePath;
       }
-      const path = writePlanFile2(root, content);
+      const path2 = writePlanFile2(root, content);
       const payload = {
         ok: true,
-        path,
+        path: path2,
         title: title?.trim() || "Plan",
         message: "Plan saved to .context/attachments/plan.md and shown in Sideboard chat for approval."
       };
@@ -7966,15 +8399,15 @@ async function startMcpServer() {
     "present_schema",
     "Open Sideboard\u2019s schema-driven side column (filterable table and/or form). Pass JSON Schema + optional schemaUi. Prefer datasource=inline with embedded resource/records. Use datasource=brightsy with resource_id only when the user is logged into Brightsy.",
     {
-      title: z2.string().describe("Pane title"),
-      mode: z2.enum(["table", "form"]).optional().describe("table = list/filter records; form = edit one record"),
-      datasource: z2.enum(["brightsy", "inline"]).optional().describe("brightsy resolves via login; inline uses embedded resource/records"),
-      resource_id: z2.string().optional().describe("Brightsy record type UUID (or generic resource id)"),
-      record_id: z2.string().optional().describe("Record id when opening form mode"),
-      resource: z2.record(z2.unknown()).optional().describe("Inline { id, title, schema, schemaUi?, slug? }"),
-      record: z2.record(z2.unknown()).optional().describe("Inline record { id, data, published_at? }"),
-      records: z2.array(z2.record(z2.unknown())).optional().describe("Inline records for table mode"),
-      pane_id: z2.string().optional().describe("Stable pane id across updates")
+      title: z3.string().describe("Pane title"),
+      mode: z3.enum(["table", "form"]).optional().describe("table = list/filter records; form = edit one record"),
+      datasource: z3.enum(["brightsy", "inline"]).optional().describe("brightsy resolves via login; inline uses embedded resource/records"),
+      resource_id: z3.string().optional().describe("Brightsy record type UUID (or generic resource id)"),
+      record_id: z3.string().optional().describe("Record id when opening form mode"),
+      resource: z3.record(z3.unknown()).optional().describe("Inline { id, title, schema, schemaUi?, slug? }"),
+      record: z3.record(z3.unknown()).optional().describe("Inline record { id, data, published_at? }"),
+      records: z3.array(z3.record(z3.unknown())).optional().describe("Inline records for table mode"),
+      pane_id: z3.string().optional().describe("Stable pane id across updates")
     },
     async (args) => {
       const id = args.pane_id?.trim() || `schema_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
@@ -7995,10 +8428,10 @@ async function startMcpServer() {
     "present_files",
     "Open Sideboard\u2019s Files column (CMS-style file manager: browse, upload, pick). Use datasource=brightsy when the user is logged into Brightsy account storage; datasource=memory for a session-local demo store. Prefer this over claiming a file manager UI is unavailable. Pair with present_schema when editing records that need media.",
     {
-      title: z2.string().optional().describe("Pane title (default: Files)"),
-      datasource: z2.enum(["brightsy", "memory"]).optional().describe("brightsy = account storage via login; memory = session demo store"),
-      path: z2.string().optional().describe("Initial folder path (e.g. public)"),
-      pane_id: z2.string().optional().describe("Stable pane id across updates")
+      title: z3.string().optional().describe("Pane title (default: Files)"),
+      datasource: z3.enum(["brightsy", "memory"]).optional().describe("brightsy = account storage via login; memory = session demo store"),
+      path: z3.string().optional().describe("Initial folder path (e.g. public)"),
+      pane_id: z3.string().optional().describe("Stable pane id across updates")
     },
     async (args) => {
       const id = args.pane_id?.trim() || `files_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
@@ -8014,19 +8447,21 @@ async function startMcpServer() {
     }
   );
   registerSlackTools(server);
+  registerLinearTools(server);
   if (sideboardMcpProfile() !== "worktree") {
-    const { getCaffeinateHold: getCaffeinateHold2, setCaffeinateHold: setCaffeinateHold2 } = await import("./caffeinate-hold-KLC6SABD.js");
-    const { resolveNewThreadOptions: resolveNewThreadOptions2, resolveThreadDefaults: resolveThreadDefaults2 } = await import("./app-settings-3TLA2EJ7.js");
+    const { getCaffeinateHold: getCaffeinateHold2, setCaffeinateHold: setCaffeinateHold2 } = await import("./caffeinate-hold-EAZNWJBE.js");
+    const { resolveNewThreadOptions: resolveNewThreadOptions2, resolveThreadDefaults: resolveThreadDefaults2 } = await import("./app-settings-6IOQYGBK.js");
     const accountDefaults = resolveThreadDefaults2();
     const accountDefaultsHint = `Account defaults: agent=${accountDefaults.agent}, model=${accountDefaults.model?.trim() || "Auto"}, effort=${accountDefaults.effort}`;
     server.tool(
       "set_caffeinate",
-      "Keep this Mac awake with caffeinate (like Claude Code) across turns \u2014 independent of Settings toggles. Turn ON when the user will be away from the keyboard, is driving work from Slack, or asks you to keep the machine awake. Turn OFF when they say they are done, wrapping up, going to sleep, or no longer need the Mac awake. macOS only.",
+      "Keep this Mac awake with caffeinate (like Claude Code) across turns \u2014 independent of Settings toggles. Turn ON when the user will be away from the keyboard, is driving work from Slack, or asks you to keep the machine awake. Turn OFF when they say they are done, wrapping up, going to sleep, or no longer need the Mac awake. Closing or archiving this orchestration chat also releases the hold. macOS only.",
       {
-        enabled: z2.boolean().describe("true = hold caffeinate on; false = release and let the Mac sleep")
+        enabled: z3.boolean().describe("true = hold caffeinate on; false = release and let the Mac sleep")
       },
       async ({ enabled }) => {
-        const state = setCaffeinateHold2(enabled);
+        const threadId = process.env.SIDEBOARD_ORCHESTRATOR_THREAD_ID?.trim() || null;
+        const state = setCaffeinateHold2(enabled, { threadId });
         if (enabled && !state.held) {
           return {
             content: [
@@ -8049,7 +8484,7 @@ async function startMcpServer() {
               text: JSON.stringify({
                 ...getCaffeinateHold2(),
                 ok: true,
-                message: state.held ? "Mac will stay awake until you call set_caffeinate with enabled=false (or the user says they are done)." : "Caffeinate hold released. The Mac can sleep (unless Settings caffeinate toggles are on)."
+                message: state.held ? "Mac will stay awake until you call set_caffeinate with enabled=false, the user says they are done, or this orchestration chat is closed." : "Caffeinate hold released. The Mac can sleep (unless Settings caffeinate toggles are on)."
               })
             }
           ]
@@ -8060,15 +8495,15 @@ async function startMcpServer() {
       "create_thread",
       `Create a new worktree thread (chat) from branch, pr, or ticket. Pass repoPath from list_workspaces. From an orchestration chat, omit parentThreadId (Sideboard binds the child to this chat) or pass the exact id from the turn reminder \u2014 never invent a uuid. Prefer omitting agent/model so Sideboard applies ${accountDefaultsHint}. Then use send_to_thread to chat.`,
       {
-        sourceType: z2.enum(["branch", "pr", "ticket"]),
-        sourceRef: z2.string(),
-        agent: z2.enum(["claude", "codex", "opencode", "brightsy", "cursor"]).optional().describe(`Omit to use Account default agent (${accountDefaults.agent})`),
-        model: z2.string().nullable().optional().describe(
+        sourceType: z3.enum(["branch", "pr", "ticket"]),
+        sourceRef: z3.string(),
+        agent: z3.enum(["claude", "codex", "opencode", "brightsy", "cursor"]).optional().describe(`Omit to use Account default agent (${accountDefaults.agent})`),
+        model: z3.string().nullable().optional().describe(
           `Usually omit to use Account default model (${accountDefaults.model?.trim() || "Auto"}). Pass null only to force Auto / agent-default.`
         ),
-        repoPath: z2.string(),
-        title: z2.string().optional(),
-        parentThreadId: z2.string().optional().describe(
+        repoPath: z3.string(),
+        title: z3.string().optional(),
+        parentThreadId: z3.string().optional().describe(
           "Orchestration: omit (preferred) or pass YOUR chat id from the turn reminder / AGENTS.md. Do not invent uuids."
         )
       },
@@ -8175,9 +8610,9 @@ async function startMcpServer() {
       "send_to_thread",
       "Queue a prompt on a worktree thread chat (runs under concurrency cap). Use after create_thread to start or continue a conversation. For commit/push/PR/merge, prefer ask_git (canonical desktop-button phrases). Set force_stop=true to interrupt an in-flight/queued turn (kill + clear queue) before queueing this prompt \u2014 use when the thread is mid-turn or has stale queued prompts you need to replace.",
       {
-        ref: z2.string(),
-        prompt: z2.string(),
-        force_stop: z2.boolean().optional()
+        ref: z3.string(),
+        prompt: z3.string(),
+        force_stop: z3.boolean().optional()
       },
       async ({ ref, prompt, force_stop }) => {
         if (force_stop) {
@@ -8206,8 +8641,8 @@ async function startMcpServer() {
       "wait_for_turn",
       "Block until the thread finishes its current/queued turn (avoids polling). Use after send_to_thread or ask_git to read the agent reply.",
       {
-        ref: z2.string(),
-        timeoutMs: z2.number().optional()
+        ref: z3.string(),
+        timeoutMs: z3.number().optional()
       },
       async ({ ref, timeoutMs }) => {
         const thread = await orch.waitForTurn(ref, timeoutMs ?? 6e5);
@@ -8229,7 +8664,7 @@ async function startMcpServer() {
     server.tool(
       "get_turn_result",
       "Final assistant message only (not full transcript)",
-      { ref: z2.string() },
+      { ref: z3.string() },
       async ({ ref }) => {
         const result = orch.getTurnResult(ref);
         return { content: [{ type: "text", text: JSON.stringify(result) }] };
@@ -8239,8 +8674,8 @@ async function startMcpServer() {
       "stop_thread",
       "Force-stop a thread: kill any in-flight agent turn AND clear queued prompts so drainQueue cannot continue. Does not archive the worktree. Optional force defaults to true.",
       {
-        ref: z2.string(),
-        force: z2.boolean().optional()
+        ref: z3.string(),
+        force: z3.boolean().optional()
       },
       async ({ ref, force }) => {
         const t = orch.getThread(ref);
@@ -8270,7 +8705,7 @@ async function startMcpServer() {
     server.tool(
       "archive_thread",
       "Archive a thread (stops agent/dev, runs archive script, removes worktree when last chat tab). Coordinators commit, push, open PRs, and merge only by asking the worktree agent (ask_git).",
-      { ref: z2.string() },
+      { ref: z3.string() },
       async ({ ref }) => {
         const t = orch.getThread(ref);
         if (!t) {
@@ -8303,7 +8738,7 @@ async function startMcpServer() {
     server.tool(
       "restore_thread",
       "Restore an archived thread (recreates worktree from branch when needed)",
-      { ref: z2.string() },
+      { ref: z3.string() },
       async ({ ref }) => {
         try {
           const restored = await orch.restore(ref);
@@ -8329,8 +8764,8 @@ async function startMcpServer() {
       "get_diff",
       "Compact diff summary (capped hunks, paginated)",
       {
-        ref: z2.string(),
-        maxFiles: z2.number().optional()
+        ref: z3.string(),
+        maxFiles: z3.number().optional()
       },
       async ({ ref, maxFiles }) => {
         const summary = await orch.diffSummary(ref);
@@ -8350,7 +8785,7 @@ async function startMcpServer() {
     server.tool(
       "request_review",
       'Start a merge-readiness Review on a worktree agent thread (same as the desktop Review button). Opens a new Review chat tab, attaches .sideboard/review.md when present (else local Review request.md / stock template), and sends "Review changes in this workspace." Expect Approve / Approve with nits / Request changes / Needs more information. Pass a worktree thread ref \u2014 not the orchestrator. Then wait_for_turn / get_turn_result on the returned review tab id.',
-      { ref: z2.string().describe("Worktree thread id/ref to review") },
+      { ref: z3.string().describe("Worktree thread id/ref to review") },
       async ({ ref }) => {
         try {
           const tab = await orch.requestReview(ref);
@@ -8377,10 +8812,10 @@ async function startMcpServer() {
     );
     server.tool(
       "ask_git",
-      "Tell a worktree agent to commit & push, open a draft PR, resolve conflicts, or merge the linked PR \u2014 same short prompts as the desktop git buttons. The worktree agent runs git/gh (`gh pr merge`); this only queues the prompt. Pass a worktree thread ref (not the orchestrator). Then wait_for_turn / get_turn_result. Do not run git or gh from the orchestration cwd.",
+      "Commit & push, open a draft PR, resolve conflicts, or merge \u2014 same actions as the desktop git buttons. When the worktree is clean, Sideboard pushes / opens the PR itself (HTTPS via `gh` if SSH is missing). When dirty, queues the worktree agent to commit; then wait_for_turn. Pass a worktree thread ref (not the orchestrator). Do not run git or gh from the orchestration cwd.",
       {
-        ref: z2.string().describe("Worktree thread id/ref"),
-        action: z2.enum(AGENT_GIT_ACTIONS).describe(
+        ref: z3.string().describe("Worktree thread id/ref"),
+        action: z3.enum(AGENT_GIT_ACTIONS).describe(
           "commit-push | create-draft | create-web | resolve-conflicts | merge"
         )
       },
@@ -8407,7 +8842,7 @@ async function startMcpServer() {
         }
       }
     );
-    const agentEnum = z2.enum(["claude", "codex", "opencode", "brightsy", "cursor"]);
+    const agentEnum = z3.enum(["claude", "codex", "opencode", "brightsy", "cursor"]);
     server.tool(
       "list_models",
       "List models for an agent. Prefer Auto: do not call this unless you have a reason to pin a specific model (user request, cost/latency, capability). Omit agent to list all.",
@@ -8430,11 +8865,11 @@ async function startMcpServer() {
       "fork_worktree",
       "Fork a worktree agent chat into a NEW git worktree + chat (desktop \u201CFork to new workspace\u201D). Seeds a transcript (through through_index, default all). Optional agent override. Leave model unset for Auto (default) \u2014 only pass model when you have a reason. Not for the orchestrator. Then send_to_thread / wait_for_turn on the returned id.",
       {
-        ref: z2.string().describe("Worktree thread id/ref to fork"),
-        through_index: z2.number().optional().describe("Inclusive message index to include in the transcript (default: all)"),
+        ref: z3.string().describe("Worktree thread id/ref to fork"),
+        through_index: z3.number().optional().describe("Inclusive message index to include in the transcript (default: all)"),
         agent: agentEnum.optional().describe("Agent for the forked chat (default: same as source)"),
-        model: z2.string().nullable().optional().describe("Usually omit (Auto). Only set from list_models when you need a specific model"),
-        title: z2.string().optional()
+        model: z3.string().nullable().optional().describe("Usually omit (Auto). Only set from list_models when you need a specific model"),
+        title: z3.string().optional()
       },
       async ({ ref, through_index, agent, model, title }) => {
         try {
@@ -8475,11 +8910,11 @@ async function startMcpServer() {
       "fork_chat",
       "Fork a chat into a NEW tab on the SAME workspace: worktree agent \u2192 same worktree tab; Global orchestration chat \u2192 new orchestration chat (same synthetic home). Seeds a transcript; optional agent override. Leave model unset for Auto unless you have a reason. Orchestration forks require an MCP-capable agent (claude, cursor, codex, opencode \u2014 not brightsy). Slack / Global orchestrators use this to continue an orchestration chat on another agent after session limits. Then send_to_thread / wait_for_turn on the returned id. Use fork_worktree only for worktree agents that need a new git worktree.",
       {
-        ref: z2.string().describe("Thread id/ref to fork (worktree agent or orchestration chat)"),
-        through_index: z2.number().optional().describe("Inclusive message index to include in the transcript (default: all)"),
+        ref: z3.string().describe("Thread id/ref to fork (worktree agent or orchestration chat)"),
+        through_index: z3.number().optional().describe("Inclusive message index to include in the transcript (default: all)"),
         agent: agentEnum.optional().describe("Agent for the forked chat (default: same as source)"),
-        model: z2.string().nullable().optional().describe("Usually omit (Auto). Only set from list_models when you need a specific model"),
-        title: z2.string().optional()
+        model: z3.string().nullable().optional().describe("Usually omit (Auto). Only set from list_models when you need a specific model"),
+        title: z3.string().optional()
       },
       async ({ ref, through_index, agent, model, title }) => {
         try {
@@ -8525,8 +8960,8 @@ async function startMcpServer() {
       "run_dev_script",
       "Start a .sideboard/.conductor run script for a thread (default script if name omitted); returns port",
       {
-        ref: z2.string(),
-        name: z2.string().optional()
+        ref: z3.string(),
+        name: z3.string().optional()
       },
       async ({ ref, name }) => {
         const result = await orch.startDev(ref, name);
@@ -8548,7 +8983,7 @@ async function startMcpServer() {
     server.tool(
       "list_run_scripts",
       "List named run scripts available for a thread",
-      { ref: z2.string() },
+      { ref: z3.string() },
       async ({ ref }) => {
         const scripts = orch.listThreadRunScripts(ref);
         const active = orch.getActiveRuns(ref);
@@ -8566,8 +9001,8 @@ async function startMcpServer() {
       "stop_dev_script",
       "Stop a running script for a thread (all scripts if name omitted)",
       {
-        ref: z2.string(),
-        name: z2.string().optional()
+        ref: z3.string(),
+        name: z3.string().optional()
       },
       async ({ ref, name }) => {
         orch.stopDev(ref, name);
@@ -8577,7 +9012,7 @@ async function startMcpServer() {
     server.tool(
       "run_setup",
       "Re-run workspace setup (Sideboard/Conductor settings or .cursor/worktrees.json)",
-      { ref: z2.string() },
+      { ref: z3.string() },
       async ({ ref }) => {
         const result = await orch.runSetup(ref);
         return {
@@ -8588,7 +9023,7 @@ async function startMcpServer() {
     server.tool(
       "add_workspace",
       "Register a git repo as a Sideboard workspace",
-      { repoPath: z2.string() },
+      { repoPath: z3.string() },
       async ({ repoPath }) => {
         const ws = await orch.addWorkspace(repoPath);
         return { content: [{ type: "text", text: JSON.stringify(ws) }] };
@@ -8597,7 +9032,7 @@ async function startMcpServer() {
     server.tool(
       "remove_workspace",
       "Unregister a Sideboard workspace (does not archive threads)",
-      { repoPath: z2.string() },
+      { repoPath: z3.string() },
       async ({ repoPath }) => {
         orch.removeWorkspace(repoPath);
         return { content: [{ type: "text", text: "ok" }] };
@@ -8607,12 +9042,12 @@ async function startMcpServer() {
       "fanout",
       "Best-of-n: create one thread per agent with the same prompt (parallel attempts)",
       {
-        prompt: z2.string(),
-        agents: z2.array(z2.enum(["claude", "codex", "opencode", "brightsy", "cursor"])),
-        repoPath: z2.string(),
-        sourceType: z2.enum(["branch", "pr", "ticket"]).optional(),
-        sourceRef: z2.string().optional(),
-        title: z2.string().optional()
+        prompt: z3.string(),
+        agents: z3.array(z3.enum(["claude", "codex", "opencode", "brightsy", "cursor"])),
+        repoPath: z3.string(),
+        sourceType: z3.enum(["branch", "pr", "ticket"]).optional(),
+        sourceRef: z3.string().optional(),
+        title: z3.string().optional()
       },
       async (args) => {
         const threads = await orch.bestOfN(args);
@@ -8639,8 +9074,8 @@ async function startMcpServer() {
       "list_branches",
       "List git branches in a registered workspace. Pass repoPath from list_workspaces (unmerged into the default branch by default \u2014 for create_thread sourceType=branch).",
       {
-        repoPath: z2.string(),
-        unmergedOnly: z2.boolean().optional()
+        repoPath: z3.string(),
+        unmergedOnly: z3.boolean().optional()
       },
       async ({ repoPath, unmergedOnly }) => {
         const root = await resolveRepoRoot(repoPath);
@@ -8660,7 +9095,7 @@ async function startMcpServer() {
     server.tool(
       "list_prs",
       "List open GitHub PRs for a registered workspace. Pass repoPath from list_workspaces (uses gh against that repo remote). Then create_thread with sourceType=pr.",
-      { repoPath: z2.string() },
+      { repoPath: z3.string() },
       async ({ repoPath }) => {
         const root = await resolveRepoRoot(repoPath);
         const prs = await listPrs(root);
@@ -8679,7 +9114,7 @@ async function startMcpServer() {
     server.tool(
       "get_pr_stack",
       "Load the GitHub PR stack for a thread worktree (`gh stack view --json`). Returns null JSON when the branch is not stacked. Prefer this before ask_git merge on stacked PRs.",
-      { ref: z2.string() },
+      { ref: z3.string() },
       async ({ ref }) => {
         const stack = await orch.getPrStack(ref);
         return {
@@ -8691,8 +9126,8 @@ async function startMcpServer() {
       "open_pr_stack_layers",
       "Materialize one worktree+thread per stack layer (or a single 1-based layer). Pass a thread ref already on the stack.",
       {
-        ref: z2.string(),
-        layer: z2.number().int().positive().optional()
+        ref: z3.string(),
+        layer: z3.number().int().positive().optional()
       },
       async ({ ref, layer }) => {
         const result = await orch.openPrStackLayers(ref, { layer });
@@ -8726,9 +9161,9 @@ async function startMcpServer() {
       "add_stack_layer",
       "Add a branch on top of the current stack (`gh stack add`) and open a worktree+thread for it.",
       {
-        ref: z2.string(),
-        branchName: z2.string(),
-        title: z2.string().optional()
+        ref: z3.string(),
+        branchName: z3.string(),
+        title: z3.string().optional()
       },
       async ({ ref, branchName, title }) => {
         const result = await orch.addStackLayer(ref, branchName, { title });
@@ -8757,11 +9192,11 @@ async function startMcpServer() {
       "create_pr_stack",
       "Create a new GitHub PR stack with one Sideboard worktree per layer (bottom\u2192top branch names). Requires `gh extension install github/gh-stack`.",
       {
-        repoPath: z2.string(),
-        branches: z2.array(z2.string()).min(1),
-        agent: z2.enum(["claude", "codex", "opencode", "brightsy", "cursor"]),
-        base: z2.string().optional(),
-        title: z2.string().optional()
+        repoPath: z3.string(),
+        branches: z3.array(z3.string()).min(1),
+        agent: z3.enum(["claude", "codex", "opencode", "brightsy", "cursor"]),
+        base: z3.string().optional(),
+        title: z3.string().optional()
       },
       async (args) => {
         const result = await orch.createPrStack({
@@ -8799,7 +9234,7 @@ async function startMcpServer() {
     server.tool(
       "list_issues",
       "List issues from Sideboard Account connections (Linear API or GitHub Issues; Linear\u2192GitHub fallback when Linear is not connected). Pass repoPath from list_workspaces \u2014 GitHub Issues are scoped to that repo. Then create_thread with sourceType=ticket.",
-      { repoPath: z2.string() },
+      { repoPath: z3.string() },
       async ({ repoPath }) => {
         const root = await resolveRepoRoot(repoPath);
         const result = await listIssues(root);
@@ -8810,8 +9245,8 @@ async function startMcpServer() {
       "list_linear_issues",
       "Deprecated: prefer list_issues. Lists assigned Linear issues via the chosen agent MCP connector",
       {
-        agent: z2.enum(["claude", "codex", "opencode"]),
-        repoPath: z2.string()
+        agent: z3.enum(["claude", "codex", "opencode"]),
+        repoPath: z3.string()
       },
       async ({ agent, repoPath }) => {
         const issues = await listLinearIssues(agent, repoPath);
@@ -8824,18 +9259,7 @@ async function startMcpServer() {
 }
 
 // src/brightsy/api.ts
-function formatBrightsyFetchError(err, url) {
-  if (!(err instanceof Error)) return `${String(err)} (${url})`;
-  const cause = err.cause;
-  let detail = "";
-  if (cause instanceof Error) {
-    const code = typeof cause.code === "string" ? cause.code : void 0;
-    detail = code ? ` [${code}: ${cause.message}]` : ` [${cause.message}]`;
-  } else if (cause != null) {
-    detail = ` [${String(cause)}]`;
-  }
-  return `${err.message}${detail} (${url})`;
-}
+var formatBrightsyFetchError = formatFetchError;
 var BrightsySideboardApi = class {
   cfg;
   fetchImpl;
@@ -8856,9 +9280,9 @@ var BrightsySideboardApi = class {
   get endpoint() {
     return (this.cfg.endpoint || "https://brightsy.ai").replace(/\/$/, "");
   }
-  async request(path, init = {}) {
+  async request(path2, init = {}) {
     await this.refreshIfNeeded();
-    const url = `${this.endpoint}${path}`;
+    const url = `${this.endpoint}${path2}`;
     const headers = {
       Authorization: `Bearer ${this.cfg.access_token}`,
       Accept: "application/json"
@@ -8955,8 +9379,8 @@ var BrightsySideboardApi = class {
 };
 function taskMessageText(task) {
   const parts = task.message?.parts ?? [];
-  const text2 = parts.find((p) => p.kind === "text")?.text ?? "";
-  return text2.trim();
+  const text3 = parts.find((p) => p.kind === "text")?.text ?? "";
+  return text3.trim();
 }
 
 // src/brightsy/cloud-connect.ts
@@ -9152,63 +9576,128 @@ async function runCloudConnect(opts) {
 
 // src/slack/oauth.ts
 import { randomBytes as randomBytes2 } from "crypto";
-import { createServer as createServer3 } from "http";
 
 // src/slack/baked-app.ts
 var BAKED_SLACK_CLIENT_ID = "7592788819232.11813536272562";
-var BAKED_SLACK_CLIENT_SECRET = "10290abf6ad0dc11fe6fc321a6215299";
-var BAKED_SLACK_RELAY_URL = "wss://slack-relay.sideboard.cloud/desktop";
+var BAKED_SLACK_RELAY_URL = "wss://relay.sideboard.cloud/slack/desktop";
 function hasBakedSlackOAuth() {
-  return Boolean(BAKED_SLACK_CLIENT_ID.trim() && BAKED_SLACK_CLIENT_SECRET.trim());
+  return Boolean(BAKED_SLACK_CLIENT_ID.trim());
 }
 function slackRelayUrl() {
   return process.env.SIDEBOARD_SLACK_RELAY_URL?.trim() || BAKED_SLACK_RELAY_URL.trim();
 }
 
 // src/slack/oauth-redirect.ts
-var SLACK_OAUTH_PORT = 19847;
-var SLACK_OAUTH_LOCAL_CALLBACK = `http://127.0.0.1:${SLACK_OAUTH_PORT}/callback`;
-var SLACK_OAUTH_REDIRECT = "https://slack-relay.sideboard.cloud/callback";
-var SLACK_OAUTH_BOUNCE_PATH = "/callback";
-var BOUNCE_PARAMS = ["code", "state", "error", "error_description"];
+var SLACK_OAUTH_CALLBACK_PATH = "/slack/callback";
+var SLACK_OAUTH_RESULT_PATH = "/slack/oauth/result";
+var SLACK_RELAY_DESKTOP_PATH = "/slack/desktop";
+var SLACK_OAUTH_LOCAL_PORT = 19847;
+var SLACK_OAUTH_LOCAL_CALLBACK = `http://127.0.0.1:${SLACK_OAUTH_LOCAL_PORT}${SLACK_OAUTH_CALLBACK_PATH}`;
+var SLACK_OAUTH_REDIRECT = `https://relay.sideboard.cloud${SLACK_OAUTH_CALLBACK_PATH}`;
 function slackOAuthRedirectUri() {
   return process.env.SIDEBOARD_SLACK_OAUTH_REDIRECT?.trim() || SLACK_OAUTH_REDIRECT;
 }
-function slackOAuthLocalBounceTarget(params) {
-  const dest = new URL(SLACK_OAUTH_LOCAL_CALLBACK);
-  for (const key of BOUNCE_PARAMS) {
-    const value = params.get(key);
-    if (value) dest.searchParams.set(key, value);
-  }
-  return dest.toString();
-}
 function escapeHtml(value) {
   return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-function slackOAuthBounceHtml(target) {
-  const safe = escapeHtml(target);
-  return `<!doctype html><html><head><meta charset="utf-8"><meta http-equiv="refresh" content="0;url=${safe}"><title>Connecting Slack</title>
+function slackOAuthHtmlPage(title, body) {
+  return `<!doctype html><html><head><meta charset="utf-8"><title>${escapeHtml(title)}</title>
 <style>body{font-family:ui-sans-serif,system-ui,sans-serif;padding:48px 24px;max-width:36rem;margin:0 auto;color:#1a1a1a}
-h1{font-size:1.25rem}p{line-height:1.5;color:#444}a{color:#111}</style>
-<script>location.replace(${JSON.stringify(target)})</script>
-</head><body><h1>Connecting Slack</h1><p>Returning to Sideboard\u2026 <a href="${safe}">Continue</a></p></body></html>`;
+h1{font-size:1.25rem}p{line-height:1.5;color:#444}</style></head><body>${body}</body></html>`;
 }
-function slackOAuthBounceResponse(reqUrl) {
+function parseSlackOAuthCallbackUrl(reqUrl) {
   let url;
   try {
     url = new URL(reqUrl, SLACK_OAUTH_REDIRECT);
   } catch {
     return null;
   }
-  if (url.pathname !== SLACK_OAUTH_BOUNCE_PATH) return null;
-  const target = slackOAuthLocalBounceTarget(url.searchParams);
+  if (url.pathname !== SLACK_OAUTH_CALLBACK_PATH) return null;
+  return url;
+}
+function parseSlackOAuthResultUrl(reqUrl) {
+  let url;
+  try {
+    url = new URL(reqUrl, SLACK_OAUTH_REDIRECT);
+  } catch {
+    return null;
+  }
+  if (url.pathname !== SLACK_OAUTH_RESULT_PATH) return null;
+  return url;
+}
+
+// src/slack/oauth-exchange.ts
+var PENDING_TTL_MS = 5 * 6e4;
+var SlackOAuthPendingStore = class {
+  items = /* @__PURE__ */ new Map();
+  put(state, value) {
+    const id = state.trim();
+    if (!id) return;
+    this.sweep();
+    const existing = this.items.get(id);
+    if (existing && existing.value.ok && !value.ok) return;
+    this.items.set(id, { expiresAt: Date.now() + PENDING_TTL_MS, value });
+  }
+  /** Consume a pending result. Missing/expired → null (desktop should keep polling). */
+  take(state) {
+    const id = state.trim();
+    if (!id) return null;
+    this.sweep();
+    const row = this.items.get(id);
+    if (!row) return null;
+    this.items.delete(id);
+    return row.value;
+  }
+  sweep() {
+    const now = Date.now();
+    for (const [key, row] of this.items) {
+      if (row.expiresAt <= now) this.items.delete(key);
+    }
+  }
+};
+function slackRelayHttpOrigin(relayWsUrl) {
+  const raw = (relayWsUrl ?? slackRelayUrl()).trim();
+  const http = raw.replace(/^ws/i, "http");
+  const u = new URL(http);
+  return `${u.protocol}//${u.host}`;
+}
+function slackOAuthResultUrl(state, relayWsUrl) {
+  const u = new URL(SLACK_OAUTH_RESULT_PATH, slackRelayHttpOrigin(relayWsUrl));
+  u.searchParams.set("state", state);
+  return u.toString();
+}
+function slackOAuthRelayClientId() {
+  return process.env.SIDEBOARD_SLACK_CLIENT_ID?.trim() || BAKED_SLACK_CLIENT_ID.trim();
+}
+function slackOAuthRelayRedirectUri() {
+  return slackOAuthRedirectUri() || SLACK_OAUTH_REDIRECT;
+}
+async function exchangeSlackOAuthCode(opts) {
+  const body = new URLSearchParams({
+    client_id: opts.clientId,
+    client_secret: opts.clientSecret,
+    code: opts.code,
+    redirect_uri: opts.redirectUri
+  });
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const res = await fetchImpl("https://slack.com/api/oauth.v2.access", {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body
+  });
+  const data = await res.json();
+  if (!data.ok) {
+    throw new Error(`Slack OAuth exchange failed: ${data.error || res.status}`);
+  }
+  const teamId = data.team?.id?.trim();
+  if (!teamId) throw new Error("Slack OAuth did not return a team id");
   return {
-    status: 302,
-    headers: {
-      Location: target,
-      "Content-Type": "text/html; charset=utf-8"
-    },
-    body: slackOAuthBounceHtml(target)
+    team_id: teamId,
+    team_name: data.team?.name?.trim() || teamId,
+    user_id: data.authed_user?.id?.trim() || void 0,
+    bot_token: data.access_token?.trim() || void 0,
+    user_token: data.authed_user?.access_token?.trim() || void 0,
+    scopes: [data.scope, data.authed_user?.scope].filter(Boolean).join(",")
   };
 }
 
@@ -9244,13 +9733,13 @@ var SLACK_USER_SCOPES = [
 function slackOAuthCredentials() {
   const settings = loadAppSettings();
   const clientId = process.env.SIDEBOARD_SLACK_CLIENT_ID?.trim() || settings.integrations.slackClientId?.trim() || BAKED_SLACK_CLIENT_ID.trim();
-  const clientSecret = process.env.SIDEBOARD_SLACK_CLIENT_SECRET?.trim() || settings.integrations.slackClientSecret?.trim() || BAKED_SLACK_CLIENT_SECRET.trim();
-  if (!clientId || !clientSecret) {
+  const clientSecret = process.env.SIDEBOARD_SLACK_CLIENT_SECRET?.trim() || settings.integrations.slackClientSecret?.trim() || "";
+  if (!clientId) {
     throw new Error(
-      "Slack browser sign-in needs a Slack app Client ID and Secret (Account \u2192 Slack, or SIDEBOARD_SLACK_CLIENT_ID / SIDEBOARD_SLACK_CLIENT_SECRET). You can still paste an xoxb- or xoxp- token."
+      "Slack browser sign-in needs a Slack app Client ID (Account \u2192 Slack, or SIDEBOARD_SLACK_CLIENT_ID). You can still paste an xoxb- or xoxp- token."
     );
   }
-  return { clientId, clientSecret };
+  return { clientId, clientSecret: clientSecret || null };
 }
 var SLACK_OAUTH_CANCELLED = "Slack sign-in cancelled";
 var SlackOAuthCancelledError = class extends Error {
@@ -9275,127 +9764,100 @@ function slackOAuthAuthorizeUrl(clientId, state) {
   });
   return `https://slack.com/oauth/v2/authorize?${params.toString()}`;
 }
-function htmlPage2(title, body) {
-  return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title>
-<style>body{font-family:ui-sans-serif,system-ui,sans-serif;padding:48px 24px;max-width:36rem;margin:0 auto;color:#1a1a1a}
-h1{font-size:1.25rem}p{line-height:1.5;color:#444}</style></head><body>${body}</body></html>`;
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(new SlackOAuthCancelledError());
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(new SlackOAuthCancelledError());
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function upsertFromPayload(payload) {
+  return upsertSlackWorkspace({
+    team_id: payload.team_id,
+    team_name: payload.team_name,
+    user_id: payload.user_id,
+    bot_token: payload.bot_token,
+    user_token: payload.user_token,
+    scopes: payload.scopes,
+    connected_at: (/* @__PURE__ */ new Date()).toISOString()
+  });
 }
 async function startSlackOAuth(opts) {
   if (opts?.signal?.aborted) {
     throw new SlackOAuthCancelledError();
   }
-  const { clientId, clientSecret } = slackOAuthCredentials();
+  const { clientId } = slackOAuthCredentials();
   const state = randomBytes2(16).toString("hex");
   const authorizeUrl = slackOAuthAuthorizeUrl(clientId, state);
   const timeoutMs = opts?.timeoutMs ?? 5 * 6e4;
-  const code = await new Promise((resolve, reject) => {
-    let settled = false;
-    const finish = (err, value) => {
-      if (settled) return;
-      settled = true;
-      cleanup();
-      if (err) reject(err);
-      else resolve(value);
-    };
-    const server = createServer3((req, res2) => {
-      try {
-        const url = new URL(req.url || "/", `http://127.0.0.1:${SLACK_OAUTH_PORT}`);
-        if (url.pathname !== "/callback") {
-          res2.writeHead(404);
-          res2.end("Not found");
-          return;
-        }
-        const err = url.searchParams.get("error");
-        const gotState = url.searchParams.get("state");
-        const gotCode = url.searchParams.get("code");
-        if (err) {
-          res2.writeHead(400, { "Content-Type": "text/html" });
-          res2.end(htmlPage2("Slack", `<h1>Authorization cancelled</h1><p>${err}</p>`));
-          finish(new SlackOAuthCancelledError(`Slack OAuth: ${err}`));
-          return;
-        }
-        if (gotState !== state || !gotCode) {
-          res2.writeHead(400, { "Content-Type": "text/html" });
-          res2.end(htmlPage2("Slack", "<h1>Invalid callback</h1><p>State or code missing.</p>"));
-          finish(new Error("Slack OAuth callback was invalid"));
-          return;
-        }
-        res2.writeHead(200, { "Content-Type": "text/html" });
-        res2.end(
-          htmlPage2(
-            "Slack connected",
-            "<h1>Slack workspace connected</h1><p>You can close this tab and return to Sideboard.</p>"
-          )
-        );
-        finish(void 0, gotCode);
-      } catch (e) {
-        finish(e instanceof Error ? e : new Error(String(e)));
-      }
-    });
-    const timer = setTimeout(() => {
-      finish(new Error("Slack sign-in timed out \u2014 try again"));
-    }, timeoutMs);
-    const onAbort = () => finish(new SlackOAuthCancelledError());
-    const cleanup = () => {
-      clearTimeout(timer);
-      opts?.signal?.removeEventListener("abort", onAbort);
-      server.close();
-    };
-    opts?.signal?.addEventListener("abort", onAbort, { once: true });
+  const pollIntervalMs = opts?.pollIntervalMs ?? 400;
+  const fetchImpl = opts?.fetchImpl ?? fetch;
+  const resultUrl = opts?.resultUrlForState?.(state) ?? slackOAuthResultUrl(state);
+  await Promise.resolve(opts?.openUrl?.(authorizeUrl));
+  if (opts?.signal?.aborted) {
+    throw new SlackOAuthCancelledError();
+  }
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
     if (opts?.signal?.aborted) {
-      onAbort();
-      return;
+      throw new SlackOAuthCancelledError();
     }
-    server.on("error", (e) => {
-      finish(
-        e instanceof Error && e.code === "EADDRINUSE" ? new Error(
-          `Port ${SLACK_OAUTH_PORT} is in use. Close whatever is bound there, or paste a Slack token instead.`
-        ) : e instanceof Error ? e : new Error(String(e))
-      );
-    });
-    server.listen(SLACK_OAUTH_PORT, "127.0.0.1", () => {
-      void Promise.resolve(opts?.openUrl?.(authorizeUrl)).catch((e) => {
-        finish(e instanceof Error ? e : new Error(String(e)));
+    let res;
+    try {
+      res = await fetchImpl(resultUrl);
+    } catch {
+      if (opts?.signal?.aborted) throw new SlackOAuthCancelledError();
+      await sleep(pollIntervalMs, opts?.signal);
+      continue;
+    }
+    let data;
+    try {
+      data = await res.json();
+    } catch {
+      await sleep(pollIntervalMs, opts?.signal);
+      continue;
+    }
+    if (data.ok && data.team_id?.trim()) {
+      return upsertFromPayload({
+        team_id: data.team_id.trim(),
+        team_name: data.team_name?.trim() || data.team_id.trim(),
+        user_id: data.user_id?.trim() || void 0,
+        bot_token: data.bot_token?.trim() || void 0,
+        user_token: data.user_token?.trim() || void 0,
+        scopes: data.scopes?.trim() || ""
       });
-    });
-  });
-  const body = new URLSearchParams({
-    client_id: clientId,
-    client_secret: clientSecret,
-    code,
-    redirect_uri: slackOAuthRedirectUri()
-  });
-  const res = await fetch("https://slack.com/api/oauth.v2.access", {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body
-  });
-  const data = await res.json();
-  if (!data.ok) {
-    throw new Error(`Slack OAuth exchange failed: ${data.error || res.status}`);
+    }
+    const err = data.error?.trim();
+    if (err && err !== "pending") {
+      if (/cancel/i.test(err) || /access_denied/i.test(err)) {
+        throw new SlackOAuthCancelledError(`Slack OAuth: ${err}`);
+      }
+      throw new Error(err.startsWith("Slack") ? err : `Slack OAuth: ${err}`);
+    }
+    await sleep(pollIntervalMs, opts?.signal);
   }
-  const teamId = data.team?.id?.trim();
-  if (!teamId) throw new Error("Slack OAuth did not return a team id");
-  return upsertSlackWorkspace({
-    team_id: teamId,
-    team_name: data.team?.name?.trim() || teamId,
-    user_id: data.authed_user?.id,
-    bot_token: data.access_token,
-    user_token: data.authed_user?.access_token,
-    scopes: [data.scope, data.authed_user?.scope].filter(Boolean).join(","),
-    connected_at: (/* @__PURE__ */ new Date()).toISOString()
-  });
+  throw new Error("Slack sign-in timed out \u2014 try again");
 }
 
 // src/slack/socket-mode.ts
 import { WebSocket as WsWebSocket } from "ws";
 var BACKOFF_START_MS = 1e3;
 var BACKOFF_MAX_MS = 3e4;
-function stripSlackMentions(text2) {
-  return text2.replace(/<@[^>]+>/g, "").replace(/\s+/g, " ").trim();
+function stripSlackMentions(text3) {
+  return text3.replace(/<@[^>]+>/g, "").replace(/\s+/g, " ").trim();
 }
-function isSlackStopCommand(text2) {
-  const t = stripSlackMentions(text2).toLowerCase();
+function isSlackStopCommand(text3) {
+  const t = stripSlackMentions(text3).toLowerCase();
   return t === "stop" || t === "sideboard_force_stop";
 }
 function parseSlackSocketFrame(raw) {
@@ -9417,8 +9879,8 @@ function inboundFromSocketFrame(frame) {
   const ts = event.ts?.trim();
   if (!channelId || !ts) return null;
   const rawText = event.text?.trim() ?? "";
-  const text2 = stripSlackMentions(rawText);
-  if (!text2) return null;
+  const text3 = stripSlackMentions(rawText);
+  if (!text3) return null;
   const teamId = (frame.payload?.team_id || event.team || "").trim();
   if (!teamId) return null;
   const isDm = event.type === "message" && (event.channel_type === "im" || event.channel_type === "mpim" || !event.channel_type && channelId.startsWith("D"));
@@ -9430,7 +9892,7 @@ function inboundFromSocketFrame(frame) {
     ts,
     threadTs: event.thread_ts?.trim() || void 0,
     userId: event.user?.trim(),
-    text: text2,
+    text: text3,
     kind: isMention ? "mention" : "dm"
   };
 }
@@ -9681,7 +10143,40 @@ function parseSlackRelayServerMessage(raw) {
   }
 }
 
+// src/slack/public-dns.ts
+import { lookup as systemLookup, Resolver } from "dns";
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+var PUBLIC_DNS = ["1.1.1.1", "8.8.8.8"];
+function finishLookup(options, callback, address, family) {
+  if (options.all) {
+    callback(null, [{ address, family }]);
+    return;
+  }
+  callback(null, address, family);
+}
+var lookupPreferPublicDns = (hostname, options, callback) => {
+  if (options.family === 6) {
+    systemLookup(hostname, options, (err, address, family) => {
+      callback(err, address, family);
+    });
+    return;
+  }
+  const resolver = new Resolver();
+  resolver.setServers(PUBLIC_DNS);
+  resolver.resolve4(hostname, (err, addresses) => {
+    if (!err && addresses[0]) {
+      finishLookup(options, callback, addresses[0], 4);
+      return;
+    }
+    systemLookup(hostname, options, (sysErr, address, family) => {
+      callback(sysErr, address, family);
+    });
+  });
+};
+
 // src/slack/relay-client.ts
+import { WebSocket as WsWebSocket2 } from "ws";
 var BACKOFF_START_MS2 = 1e3;
 var BACKOFF_MAX_MS2 = 3e4;
 function wait2(ms, signal) {
@@ -9706,7 +10201,11 @@ function send(ws, msg) {
 }
 async function runSlackRelayClient(opts) {
   const log = opts.onLog ?? (() => void 0);
-  const Ws = resolveWebSocket(opts.WebSocketImpl);
+  const Ws = opts.WebSocketImpl ? resolveWebSocket(opts.WebSocketImpl) : class {
+    constructor(url2) {
+      return new WsWebSocket2(url2, { lookup: lookupPreferPublicDns });
+    }
+  };
   const url = opts.url.trim();
   const deviceId = opts.deviceId.trim();
   if (!url) throw new Error("Slack relay URL is empty");
@@ -9869,12 +10368,12 @@ function formatSlackInboundPrompt(msg) {
 
 ${msg.text}`;
 }
-function isSlackInboundUserPrompt(text2) {
-  return text2.startsWith("Slack DM\n") || text2.startsWith("Slack @mention\n");
+function isSlackInboundUserPrompt(text3) {
+  return text3.startsWith("Slack DM\n") || text3.startsWith("Slack @mention\n");
 }
-function formatSlackSignedReply(deviceLabel, text2) {
+function formatSlackSignedReply(deviceLabel, text3) {
   const label = deviceLabel.trim();
-  const body = text2.trim();
+  const body = text3.trim();
   if (!body) return body;
   if (!label) return body;
   const head = `${label}:`;
@@ -9883,8 +10382,8 @@ function formatSlackSignedReply(deviceLabel, text2) {
   }
   return `${label}: ${body}`;
 }
-function signForThisMac(text2) {
-  return formatSlackSignedReply(ensureSlackDeviceIdentity().deviceLabel, text2);
+function signForThisMac(text3) {
+  return formatSlackSignedReply(ensureSlackDeviceIdentity().deviceLabel, text3);
 }
 function slackReplyThreadTs(msg) {
   if (msg.threadTs && msg.threadTs !== msg.ts) return msg.threadTs;
@@ -9927,7 +10426,7 @@ async function ackSlackInboundSeen(msg, opts) {
     log(`react error: ${errMsg}${hint}`);
   }
 }
-async function postSlackText(target, text2, opts) {
+async function postSlackText(target, text3, opts) {
   const stub = {
     teamId: target.teamId,
     channelId: target.channelId,
@@ -9937,7 +10436,7 @@ async function postSlackText(target, text2, opts) {
     kind: "dm"
   };
   if (opts.postReply) {
-    await opts.postReply(stub, text2);
+    await opts.postReply(stub, text3);
     return;
   }
   const token = writeTokenForTeam(target.teamId);
@@ -9946,29 +10445,29 @@ async function postSlackText(target, text2, opts) {
     "chat.postMessage",
     {
       channel: target.channelId,
-      text: text2,
+      text: text3,
       thread_ts: target.threadTs
     },
     opts.fetchImpl
   );
 }
-async function postSlackReply(msg, text2, opts) {
+async function postSlackReply(msg, text3, opts) {
   await postSlackText(
     {
       teamId: msg.teamId,
       channelId: msg.channelId,
       threadTs: slackReplyThreadTs(msg)
     },
-    signForThisMac(text2),
+    signForThisMac(text3),
     opts
   );
 }
 var lastRelayed = /* @__PURE__ */ new Map();
-function markRelayed(threadId, text2) {
-  lastRelayed.set(threadId, `${threadId}:${text2}`);
+function markRelayed(threadId, text3) {
+  lastRelayed.set(threadId, `${threadId}:${text3}`);
 }
-function alreadyRelayed(threadId, text2) {
-  return lastRelayed.get(threadId) === `${threadId}:${text2}`;
+function alreadyRelayed(threadId, text3) {
+  return lastRelayed.get(threadId) === `${threadId}:${text3}`;
 }
 async function relayCoordinatorReplyToSlack(threadId, opts) {
   const target = getSlackReplyTarget(threadId);
@@ -9977,14 +10476,14 @@ async function relayCoordinatorReplyToSlack(threadId, opts) {
   const lastUser = thread ? [...thread.messages].reverse().find((m) => m.role === "user") : void 0;
   if (lastUser && isSlackInboundUserPrompt(lastUser.text)) return;
   const result = getOrchestrator().getTurnResult(threadId);
-  const text2 = result.text.trim();
-  if (!text2) return;
-  if (alreadyRelayed(threadId, text2)) return;
-  markRelayed(threadId, text2);
+  const text3 = result.text.trim();
+  if (!text3) return;
+  if (alreadyRelayed(threadId, text3)) return;
+  markRelayed(threadId, text3);
   const log = opts.onLog ?? (() => void 0);
   try {
-    await postSlackText(target, signForThisMac(text2), opts);
-    log(`replied ${target.threadTs ?? target.channelId} (${text2.length} chars)`);
+    await postSlackText(target, signForThisMac(text3), opts);
+    log(`replied ${target.threadTs ?? target.channelId} (${text3.length} chars)`);
   } catch (err) {
     lastRelayed.delete(threadId);
     const errMsg = err instanceof Error ? err.message : String(err);
@@ -10148,10 +10647,10 @@ function resolveSlackListenMode(opts) {
 }
 
 // src/slack/relay-hub.ts
-function parseSlackDeviceDestination(text2) {
-  const m = text2.match(/^\s*(?:to\s+)?(?:@|#)?([A-Za-z][\w-]{0,63})\s*[:：]\s*/);
-  if (!m) return { label: null, rest: text2 };
-  return { label: m[1], rest: text2.slice(m[0].length) };
+function parseSlackDeviceDestination(text3) {
+  const m = text3.match(/^\s*(?:to\s+)?(?:@|#)?([A-Za-z][\w-]{0,63})\s*[:：]\s*/);
+  if (!m) return { label: null, rest: text3 };
+  return { label: m[1], rest: text3.slice(m[0].length) };
 }
 var SlackRelayHub = class {
   sessions = /* @__PURE__ */ new Map();
@@ -10369,40 +10868,222 @@ var SlackRelayHub = class {
 };
 
 // src/slack/relay-server.ts
-import { createServer as createServer4 } from "http";
+import { createServer as createServer3 } from "http";
 import { WebSocketServer } from "ws";
+
+// src/slack/relay-static.ts
+import { createReadStream } from "fs";
+import { stat } from "fs/promises";
+import path from "path";
+var TYPES = {
+  ".css": "text/css; charset=utf-8",
+  ".html": "text/html; charset=utf-8",
+  ".ico": "image/x-icon",
+  ".jpeg": "image/jpeg",
+  ".jpg": "image/jpeg",
+  ".js": "text/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".png": "image/png",
+  ".svg": "image/svg+xml",
+  ".txt": "text/plain; charset=utf-8",
+  ".webp": "image/webp",
+  ".woff2": "font/woff2"
+};
+function requestHostname(req) {
+  const raw = req.headers.host ?? "";
+  return raw.split(":")[0]?.toLowerCase() ?? "";
+}
+function hostnameAllowed(host, allowed) {
+  if (!allowed || allowed.length === 0) return true;
+  return allowed.includes(host);
+}
+function resolveStaticPath(root, requestUrl) {
+  let pathname;
+  try {
+    pathname = decodeURIComponent(new URL(requestUrl, "http://relay.local").pathname);
+  } catch {
+    return null;
+  }
+  if (!pathname.startsWith("/") || pathname.includes("\0")) return null;
+  const rootResolved = path.resolve(root);
+  const candidate = path.resolve(rootResolved, `.${pathname}`);
+  if (candidate !== rootResolved && !candidate.startsWith(rootResolved + path.sep)) {
+    return null;
+  }
+  return candidate;
+}
+async function fileSize(file) {
+  try {
+    const st = await stat(file);
+    return st.isFile() ? st.size : null;
+  } catch {
+    return null;
+  }
+}
+function sendFile(req, res, file, size) {
+  const ext = path.extname(file).toLowerCase();
+  res.writeHead(200, {
+    "Content-Type": TYPES[ext] ?? "application/octet-stream",
+    "Content-Length": size,
+    "Cache-Control": ext === ".html" ? "no-cache" : "public, max-age=3600"
+  });
+  if (req.method === "HEAD") {
+    res.end();
+    return true;
+  }
+  createReadStream(file).pipe(res);
+  return true;
+}
+async function tryServeStatic(req, res, root) {
+  if (req.method !== "GET" && req.method !== "HEAD") return false;
+  const candidate = resolveStaticPath(root, req.url || "/");
+  if (!candidate) return false;
+  const direct = await fileSize(candidate);
+  if (direct != null) return sendFile(req, res, candidate, direct);
+  const asIndex = path.join(candidate, "index.html");
+  const indexSize = await fileSize(asIndex);
+  if (indexSize != null) return sendFile(req, res, asIndex, indexSize);
+  return false;
+}
+
+// src/slack/relay-server.ts
+function sendHtml(res, status, title, body) {
+  res.writeHead(status, { "Content-Type": "text/html; charset=utf-8" });
+  res.end(slackOAuthHtmlPage(title, body));
+}
+function sendJson(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
 async function startSlackRelayServer(opts) {
   const log = opts.onLog ?? console.log;
   const appToken = opts.appToken.trim();
   if (!appToken.startsWith("xapp-")) {
     throw new Error("SIDEBOARD_SLACK_APP_TOKEN must be an xapp-\u2026 app-level token");
   }
+  const clientId = (opts.clientId ?? slackOAuthRelayClientId()).trim();
+  const clientSecret = (opts.clientSecret ?? process.env.SIDEBOARD_SLACK_CLIENT_SECRET ?? "").trim();
+  const redirectUri = (opts.oauthRedirectUri ?? slackOAuthRelayRedirectUri()).trim();
+  const pending = new SlackOAuthPendingStore();
   const hub = opts.hub ?? new SlackRelayHub({
     fetchImpl: opts.fetchImpl,
     onLog: log
   });
-  const httpServer = createServer4((req, res) => {
-    const bounce = slackOAuthBounceResponse(req.url || "/");
-    if (bounce) {
-      res.writeHead(bounce.status, bounce.headers);
-      res.end(bounce.body);
-      return;
+  const handleCallback = async (reqUrl, res) => {
+    const url2 = parseSlackOAuthCallbackUrl(reqUrl);
+    if (!url2) return false;
+    const error = url2.searchParams.get("error")?.trim();
+    const state = url2.searchParams.get("state")?.trim() ?? "";
+    const code = url2.searchParams.get("code")?.trim() ?? "";
+    if (error) {
+      if (state) pending.put(state, { ok: false, error: `Slack OAuth: ${error}` });
+      sendHtml(
+        res,
+        400,
+        "Slack",
+        `<h1>Authorization cancelled</h1><p>${escapeHtml(error)}</p>`
+      );
+      return true;
     }
-    if (req.url === "/health" || req.url === "/") {
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(
-        JSON.stringify({
-          ok: true,
-          service: "sideboard-slack-relay",
-          sessions: hub.listSessions().length
-        })
+    if (!state || !code) {
+      sendHtml(res, 400, "Slack", "<h1>Invalid callback</h1><p>State or code missing.</p>");
+      return true;
+    }
+    if (!clientSecret) {
+      pending.put(state, {
+        ok: false,
+        error: "Relay is missing SIDEBOARD_SLACK_CLIENT_SECRET"
+      });
+      sendHtml(
+        res,
+        500,
+        "Slack",
+        "<h1>Relay misconfigured</h1><p>OAuth client secret is not set on the relay.</p>"
       );
-      return;
+      return true;
+    }
+    try {
+      const payload = await exchangeSlackOAuthCode({
+        clientId,
+        clientSecret,
+        code,
+        redirectUri,
+        fetchImpl: opts.fetchImpl
+      });
+      pending.put(state, { ok: true, payload });
+      sendHtml(
+        res,
+        200,
+        "Slack connected",
+        "<h1>Slack workspace connected</h1><p>You can close this tab and return to Sideboard.</p>"
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      pending.put(state, { ok: false, error: message });
+      sendHtml(res, 400, "Slack", `<h1>Could not connect Slack</h1><p>${escapeHtml(message)}</p>`);
+    }
+    return true;
+  };
+  const handleResult = (reqUrl, res) => {
+    const url2 = parseSlackOAuthResultUrl(reqUrl);
+    if (!url2) return false;
+    const state = url2.searchParams.get("state")?.trim() ?? "";
+    const value = pending.take(state);
+    if (!value) {
+      sendJson(res, 404, { ok: false, error: "pending" });
+      return true;
+    }
+    if (!value.ok) {
+      sendJson(res, 400, { ok: false, error: value.error });
+      return true;
     }
-    res.writeHead(404);
-    res.end("Not found");
+    sendJson(res, 200, { ok: true, ...value.payload });
+    return true;
+  };
+  const httpServer = createServer3((req, res) => {
+    void (async () => {
+      const reqUrl = req.url || "/";
+      if (await handleCallback(reqUrl, res)) return;
+      if (handleResult(reqUrl, res)) return;
+      if (req.url === "/health") {
+        sendJson(res, 200, {
+          ok: true,
+          service: "sideboard-slack-relay",
+          sessions: hub.listSessions().length,
+          oauth: Boolean(clientSecret)
+        });
+        return;
+      }
+      const hostname = requestHostname(req);
+      const canonical = (opts.canonicalSiteHost ?? "www.sideboard.cloud").toLowerCase();
+      if (opts.redirectHosts?.includes(hostname) && hostname !== canonical) {
+        res.writeHead(301, { Location: `https://${canonical}${reqUrl}` });
+        res.end();
+        return;
+      }
+      if (opts.staticRoot && hostnameAllowed(hostname, opts.staticHosts) && await tryServeStatic(req, res, opts.staticRoot)) {
+        return;
+      }
+      if (req.url === "/") {
+        sendJson(res, 200, {
+          ok: true,
+          service: "sideboard-slack-relay",
+          sessions: hub.listSessions().length,
+          oauth: Boolean(clientSecret)
+        });
+        return;
+      }
+      res.writeHead(404);
+      res.end("Not found");
+    })().catch((err) => {
+      log(`http error: ${err instanceof Error ? err.message : String(err)}`);
+      if (!res.headersSent) {
+        res.writeHead(500);
+        res.end("Internal error");
+      }
+    });
   });
-  const wss = new WebSocketServer({ server: httpServer, path: "/desktop" });
+  const wss = new WebSocketServer({ server: httpServer, path: SLACK_RELAY_DESKTOP_PATH });
   wss.on("connection", (ws, _req) => {
     const socket = {
       send: (data) => {
@@ -10440,12 +11121,12 @@ async function startSlackRelayServer(opts) {
   });
   const address = httpServer.address();
   const boundPort = typeof address === "object" && address ? address.port : typeof port === "number" ? port : 0;
-  const url = `ws://${host === "0.0.0.0" ? "127.0.0.1" : host}:${boundPort}/desktop`;
+  const url = `ws://${host === "0.0.0.0" ? "127.0.0.1" : host}:${boundPort}${SLACK_RELAY_DESKTOP_PATH}`;
   log(`relay listening on ${url}`);
   const ac = new AbortController();
   const onAbort = () => ac.abort();
   opts.signal?.addEventListener("abort", onAbort, { once: true });
-  const socketModeDone = runSlackSocketMode({
+  const socketModeDone = opts.skipSocketMode ? Promise.resolve() : runSlackSocketMode({
     appToken,
     signal: ac.signal,
     fetchImpl: opts.fetchImpl,
@@ -10492,6 +11173,7 @@ export {
   CONTEXT_MIN_MESSAGES,
   COORDINATOR_TOOL_PLAYBOOK,
   FAMOUS_SOCCER_TEAMS,
+  GITHUB_GIT_AUTH_MODES,
   GLOBAL_WORKSPACE_ID,
   HARNESS_ENV_KEYS,
   LEGACY_ATTACHMENTS_DIR,
@@ -10522,8 +11204,6 @@ export {
   SLACK_LISTEN_STOPPED_REPLY,
   SLACK_LISTEN_TIMEOUT_REPLY,
   SLACK_OAUTH_CANCELLED,
-  SLACK_OAUTH_LOCAL_CALLBACK,
-  SLACK_OAUTH_PORT,
   SLACK_OAUTH_REDIRECT,
   SLACK_REPLY_FORMATTING,
   SLACK_SEEN_REACTION,
@@ -10543,10 +11223,12 @@ export {
   allocateTeamSlug,
   appDataDir,
   appSettingsPath,
+  appendIndexedGitConfig,
   appendMessage,
   applyAgentEvent,
   applyAppEnvironment,
   applyCompaction,
+  applyGithubGitAuthEnv,
   applyThreadIntoMain,
   applyTurnUsage,
   assertOrchestratorCapableAgent,
@@ -10590,6 +11272,7 @@ export {
   codexAdapter,
   coerceOrchestratorAgent,
   collectTakenTeamSlugs,
+  commentLinearIssue,
   commitAll,
   conductorBundledBinDir,
   conductorDbPath,
@@ -10605,6 +11288,7 @@ export {
   createEmptyThread,
   createExistingBranchWorktree,
   createGlobalChat,
+  createLinearIssue,
   createLinearPkce,
   createOrUpdatePr,
   createPrStack,
@@ -10657,7 +11341,9 @@ export {
   formatAgentInstructions,
   formatArtifactDirective,
   formatBrightsyFetchError,
+  formatFetchError,
   formatGhLandError,
+  formatGitAuthModeDirective,
   formatIpcInvokeError,
   formatMessagesAsTranscript,
   formatPlanQuestionAnswers,
@@ -10684,9 +11370,12 @@ export {
   getDiff,
   getDiffSummary,
   getGitHubStatus,
+  getGithubGitAuthMode,
+  getGithubPat,
   getIssueSource,
   getLinearApiKey,
   getLinearAuthToken,
+  getLinearIssue,
   getOrchestrator,
   getPr,
   getPrChecks,
@@ -10701,6 +11390,7 @@ export {
   ghHeadRef,
   ghRepoSelectArgs,
   git,
+  githubAgentGitEnv,
   globalAgentCwd,
   handleSlackInbound,
   harnessEnvKey,
@@ -10711,6 +11401,7 @@ export {
   hasRepoHook,
   hasWorkspaceHook,
   healOrchestrationSoccerTitles,
+  httpFetch,
   importConductorWorkspace,
   importConductorWorkspaceAsync,
   initPrStack,
@@ -10744,8 +11435,10 @@ export {
   isSlackExternalReplyPrompt,
   isSlackOAuthCancelled,
   isThinkingEffort,
+  isThreadCaffeinated,
   isWorkspaceScratchPath,
   linearAuthorizationHeader,
+  linearGraphql,
   linearOAuthAuthorizeUrl,
   linearOAuthCredentials,
   listAgentSetupInfo,
@@ -10762,6 +11455,7 @@ export {
   listIssues,
   listLinearIssues,
   listLinearIssuesDirect,
+  listLinearTeams,
   listModelsForAgent,
   listOpencodeModels,
   listPrs,
@@ -10837,6 +11531,7 @@ export {
   recordSlackOutboundWatch,
   refreshGitHubAuth,
   refreshSlackReplyBadges,
+  releaseCaffeinateHoldForThread,
   removeWorkspace,
   removeWorktree,
   repoSlug,
@@ -10855,6 +11550,8 @@ export {
   resolveFilesToCopy,
   resolveGhAuthToken,
   resolveGithubRepoSlug,
+  resolveLinearState,
+  resolveLinearTeam,
   resolveLoginCommand,
   resolveNewThreadOptions,
   resolvePlanMarkdown,
@@ -10867,6 +11564,7 @@ export {
   resolveThreadEffort,
   resolveVaultKey,
   resolveWorktreeStartPoint,
+  rewriteLinearError,
   run,
   runArchiveScript,
   runCloudConnect,
@@ -10880,6 +11578,7 @@ export {
   saveLinearOAuth,
   secureFileUnlocksWith,
   setCaffeinateHold,
+  setHttpFetchImpl,
   setStatus,
   setVaultMasterKey,
   settingsSourceLabel,
@@ -10897,6 +11596,7 @@ export {
   slackCoordinatorSourceRef,
   slackListenEnabled,
   slackOAuthCredentials,
+  slackOAuthResultUrl,
   slackRelayUrl,
   slugify,
   spawnAgentTurn,
@@ -10913,6 +11613,7 @@ export {
   startSlackOAuth,
   startSlackRelayServer,
   stripBrightsyNdjsonNoise,
+  stripNestedElectronEnv,
   submitPrStack,
   suggestSlug,
   summarizeConversation,
@@ -10942,6 +11643,7 @@ export {
   updateCodexSettings,
   updateDefaultsSettings,
   updateIntegrationsSettings,
+  updateLinearIssue,
   updateOpencodeSettings,
   updateThread,
   validateLinearApiKey,