@sideboard-ai/core 0.1.77 → 0.1.79

package/dist/{agents-XJV6J3K2.js → agents-EWPHOM6Y.js}

@@ -28,23 +28,23 @@ import {
   resolveCursorModelId,
   resolveLoginCommand,
   resolveQuotaFallbackAgent
-} from "./chunk-QD37IILI.js";
+} from "./chunk-SHCR6RPU.js";
 import {
   ORCHESTRATOR_AGENT_KINDS,
   assertOrchestratorCapableAgent,
   coerceOrchestratorAgent,
   isOrchestratorCapableAgent
-} from "./chunk-VERLUKN2.js";
-import "./chunk-EEKSZTMU.js";
+} from "./chunk-5LXWTU3J.js";
+import "./chunk-HCGEFU3J.js";
 import "./chunk-BTL7EMGT.js";
 import {
   cursorSdkMessageToEvents,
   parseCursorRunnerLine
 } from "./chunk-SEOICVGB.js";
-import "./chunk-W7YOTDVO.js";
-import "./chunk-JT7R45JB.js";
-import "./chunk-MF2YMEGD.js";
+import "./chunk-YVVXWWCC.js";
 import "./chunk-FKOIHGKV.js";
+import "./chunk-IFPN6TER.js";
+import "./chunk-JT7R45JB.js";
 import "./chunk-FWJYLBO6.js";
 import "./chunk-77WWLBCI.js";
 import "./chunk-M37RITA6.js";

package/dist/{agents-LKUHPPEQ.js → agents-GRAPUXWW.js}

@@ -32,16 +32,16 @@ import {
   resolveCursorModelId,
   resolveLoginCommand,
   resolveQuotaFallbackAgent
-} from "./chunk-2FJI5JXX.js";
+} from "./chunk-P33ZQ7ZC.js";
 import "./chunk-VROPG6QF.js";
 import {
   ORCHESTRATOR_AGENT_KINDS,
   assertOrchestratorCapableAgent,
   coerceOrchestratorAgent,
   isOrchestratorCapableAgent
-} from "./chunk-GWTLKXXP.js";
-import "./chunk-XJNCWYFR.js";
-import "./chunk-OE7YBB5X.js";
+} from "./chunk-6T2SKGCS.js";
+import "./chunk-HSLQXL6M.js";
+import "./chunk-FUUVPN4A.js";
 import "./chunk-B3SJXYIJ.js";
 import "./chunk-7FD7COKE.js";
 import {
@@ -53,7 +53,7 @@ import {
   resolveCommandBinarySync,
   withExportedPath
 } from "./chunk-AE5VBOFE.js";
-import "./chunk-PTJJIQK7.js";
+import "./chunk-XKNBSYA7.js";
 import "./chunk-NSTQ6QKD.js";
 import "./chunk-KGZBYWZ3.js";
 import "./chunk-7MV3RXSC.js";

package/dist/{app-settings-3TLA2EJ7.js → app-settings-6IOQYGBK.js}

@@ -1,4 +1,5 @@
 import {
+  GITHUB_GIT_AUTH_MODES,
   HARNESS_ENV_KEYS,
   appSettingsPath,
   applyAppEnvironment,
@@ -22,6 +23,8 @@ import {
   getDefaultEffort,
   getDefaultFast,
   getDefaultModel,
+  getGithubGitAuthMode,
+  getGithubPat,
   getIssueSource,
   getLinearApiKey,
   harnessEnvKey,
@@ -49,11 +52,12 @@ import {
   updateDefaultsSettings,
   updateIntegrationsSettings,
   updateOpencodeSettings
-} from "./chunk-W7YOTDVO.js";
+} from "./chunk-IFPN6TER.js";
 import "./chunk-JT7R45JB.js";
 import "./chunk-77WWLBCI.js";
 import "./chunk-M37RITA6.js";
 export {
+  GITHUB_GIT_AUTH_MODES,
   HARNESS_ENV_KEYS,
   appSettingsPath,
   applyAppEnvironment,
@@ -77,6 +81,8 @@ export {
   getDefaultEffort,
   getDefaultFast,
   getDefaultModel,
+  getGithubGitAuthMode,
+  getGithubPat,
   getIssueSource,
   getLinearApiKey,
   harnessEnvKey,

package/dist/{app-settings-P42Z3VOB.js → app-settings-NILNWNNQ.js}

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 
 import {
+  GITHUB_GIT_AUTH_MODES,
   HARNESS_ENV_KEYS,
   appSettingsPath,
   applyAppEnvironment,
@@ -24,6 +25,8 @@ import {
   getDefaultEffort,
   getDefaultFast,
   getDefaultModel,
+  getGithubGitAuthMode,
+  getGithubPat,
   getIssueSource,
   getLinearApiKey,
   harnessEnvKey,
@@ -51,11 +54,12 @@ import {
   updateDefaultsSettings,
   updateIntegrationsSettings,
   updateOpencodeSettings
-} from "./chunk-PTJJIQK7.js";
+} from "./chunk-XKNBSYA7.js";
 import "./chunk-NSTQ6QKD.js";
 import "./chunk-KGZBYWZ3.js";
 import "./chunk-7MV3RXSC.js";
 export {
+  GITHUB_GIT_AUTH_MODES,
   HARNESS_ENV_KEYS,
   appSettingsPath,
   applyAppEnvironment,
@@ -79,6 +83,8 @@ export {
   getDefaultEffort,
   getDefaultFast,
   getDefaultModel,
+  getGithubGitAuthMode,
+  getGithubPat,
   getIssueSource,
   getLinearApiKey,
   harnessEnvKey,

package/dist/{chunk-VERLUKN2.js → chunk-5LXWTU3J.js}

@@ -1,15 +1,15 @@
 import {
   ensureGlobalCoordinatorCwd
-} from "./chunk-EEKSZTMU.js";
-import {
-  resolveNewThreadOptions,
-  resolveThreadDefaults
-} from "./chunk-W7YOTDVO.js";
+} from "./chunk-HCGEFU3J.js";
 import {
   allocateTeamName,
   takenSlugsFromThread,
   teamSlugFromName
-} from "./chunk-MF2YMEGD.js";
+} from "./chunk-YVVXWWCC.js";
+import {
+  resolveNewThreadOptions,
+  resolveThreadDefaults
+} from "./chunk-IFPN6TER.js";
 import {
   createEmptyThread,
   listThreads,

package/dist/{chunk-2ZIPJRJE.js → chunk-5VTWBI3I.js}

@@ -2,11 +2,11 @@
 
 import {
   isGlobalRepoPath
-} from "./chunk-GWTLKXXP.js";
+} from "./chunk-6T2SKGCS.js";
 import {
   ensureGhPreferOrigin,
   resolveRepoRoot
-} from "./chunk-OE7YBB5X.js";
+} from "./chunk-FUUVPN4A.js";
 import {
   appDataDir
 } from "./chunk-7MV3RXSC.js";

package/dist/{chunk-GWTLKXXP.js → chunk-6T2SKGCS.js}

@@ -2,12 +2,12 @@
 
 import {
   ensureGlobalCoordinatorCwd
-} from "./chunk-XJNCWYFR.js";
+} from "./chunk-HSLQXL6M.js";
 import {
   allocateTeamName,
   takenSlugsFromThread,
   teamSlugFromName
-} from "./chunk-OE7YBB5X.js";
+} from "./chunk-FUUVPN4A.js";
 import {
   createEmptyThread,
   listThreads,
@@ -17,7 +17,7 @@ import {
 import {
   resolveNewThreadOptions,
   resolveThreadDefaults
-} from "./chunk-PTJJIQK7.js";
+} from "./chunk-XKNBSYA7.js";
 import {
   globalAgentCwd
 } from "./chunk-7MV3RXSC.js";

package/dist/{chunk-OE7YBB5X.js → chunk-FUUVPN4A.js}

@@ -11,6 +11,10 @@ import {
   git,
   resolveGhAuthToken
 } from "./chunk-AE5VBOFE.js";
+import {
+  getGithubGitAuthMode,
+  getGithubPat
+} from "./chunk-XKNBSYA7.js";
 import {
   worktreesRoot
 } from "./chunk-7MV3RXSC.js";
@@ -881,6 +885,74 @@ function formatGhLandError(raw, opts) {
   return detail || "Failed to create or update pull request";
 }
 
+// src/git/git-auth-mode.ts
+var HTTPS_REWRITE = [
+  { key: "url.https://github.com/.insteadOf", value: "git@github.com:" },
+  { key: "url.https://github.com/.insteadOf", value: "ssh://git@github.com/" },
+  { key: "credential.https://github.com.helper", value: "!gh auth git-credential" }
+];
+function appendIndexedGitConfig(existing, entries) {
+  const start = Number.parseInt(String(existing?.GIT_CONFIG_COUNT ?? "0"), 10);
+  const count = Number.isFinite(start) && start > 0 ? start : 0;
+  const out = {};
+  entries.forEach((entry, i) => {
+    const n = count + i;
+    out[`GIT_CONFIG_KEY_${n}`] = entry.key;
+    out[`GIT_CONFIG_VALUE_${n}`] = entry.value;
+  });
+  out.GIT_CONFIG_COUNT = String(count + entries.length);
+  return out;
+}
+function githubAgentGitEnv(existing) {
+  return appendIndexedGitConfig(existing, HTTPS_REWRITE);
+}
+function applyGithubGitAuthEnv(existing, opts) {
+  const out = {};
+  if (opts.mode === "gh" || opts.mode === "token") {
+    Object.assign(out, githubAgentGitEnv(existing));
+  }
+  if (opts.mode === "token") {
+    const token = opts.token?.trim();
+    if (token && !existing?.GH_TOKEN?.trim()) {
+      out.GH_TOKEN = token;
+    }
+  }
+  return out;
+}
+function formatGitAuthModeDirective(mode) {
+  switch (mode) {
+    case "gh":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: gh CLI):",
+        "- This process rewrites `git@github.com:` and `ssh://git@github.com/` to HTTPS.",
+        "- `gh` supplies credentials (`gh auth git-credential`). Do not switch remotes to SSH.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
+      ].join("\n");
+    case "ssh":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: SSH):",
+        "- Keep SSH remotes (`git@github.com:\u2026`). Do not rewrite them to HTTPS.",
+        "- Use this Mac\u2019s SSH agent / keys. If push fails with `Permission denied (publickey)`, tell the user to start ssh-agent or switch Account \u2192 GitHub to Auto / gh CLI \u2014 do not rewrite remotes yourself.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below (API still uses `gh`)."
+      ].join("\n");
+    case "token":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: personal access token):",
+        "- This process rewrites GitHub SSH remotes to HTTPS.",
+        "- `GH_TOKEN` is set in the environment. Use HTTPS git and `gh`; do not paste the token into commands or chat.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
+      ].join("\n");
+    case "auto":
+    default:
+      return [
+        "Git authentication (Account \u2192 GitHub mode: auto):",
+        "- Prefer the existing remote URL (SSH or HTTPS). Do not rewrite remotes unless a push/fetch fails.",
+        '- If `git push` fails with `Permission denied (publickey)`, this shell has no ssh-agent. Retry over HTTPS (do not stop): `git -c url.https://github.com/.insteadOf=git@github.com: -c http.extraHeader="AUTHORIZATION: bearer $(gh auth token)" push -u origin HEAD`.',
+        "- Then create/update the PR with `gh` as below."
+      ].join("\n");
+  }
+}
+
 // src/git/pr-gates.ts
 function prIsInMergeQueue(gate) {
   if (gate.isInMergeQueue) return true;
@@ -1253,10 +1325,15 @@ ${view.stderr}`;
     timeoutMs: 15e3
   });
 }
-async function originGhRepoEnv(cwd) {
+async function originGhRepoEnv(cwd, opts) {
   await ensureGhPreferOrigin(cwd);
   const slug = await resolveGithubRepoSlug(cwd);
-  return slug ? { GH_REPO: slug } : {};
+  const mode = opts?.mode ?? getGithubGitAuthMode();
+  const token = mode === "token" ? getGithubPat() : null;
+  return {
+    ...applyGithubGitAuthEnv(opts?.env, { mode, token }),
+    ...slug ? { GH_REPO: slug } : {}
+  };
 }
 async function resolveDefaultBranch(repoPath, opts) {
   const viaOrigin = await git(
@@ -2005,7 +2082,33 @@ async function commitAll(worktreePath, message) {
   return true;
 }
 async function pushBranch(worktreePath, branchName) {
-  await git(["push", "-u", "origin", branchName], worktreePath);
+  const ssh = await git(["push", "-u", "origin", branchName], worktreePath, {
+    reject: false
+  });
+  if (ssh.exitCode === 0) return;
+  const sshErr = (ssh.stderr || ssh.stdout).trim();
+  const slug = await resolveGithubRepoSlug(worktreePath);
+  const token = await resolveGhAuthToken(worktreePath);
+  if (!slug || !token) {
+    throw new Error(
+      sshErr || `git push origin ${branchName} failed` + (!token ? " (no SSH agent and gh auth token unavailable \u2014 run: gh auth login)" : "")
+    );
+  }
+  const tryHttps = async (header) => git(["push", "-u", "origin", branchName], worktreePath, {
+    reject: false,
+    env: { GIT_TERMINAL_PROMPT: "0" },
+    config: {
+      "url.https://github.com/.insteadOf": "git@github.com:",
+      "http.extraHeader": header
+    }
+  });
+  const bearer = await tryHttps(`AUTHORIZATION: bearer ${token}`);
+  if (bearer.exitCode === 0) return;
+  const basic = Buffer.from(`x-access-token:${token}`, "utf8").toString("base64");
+  const basicPush = await tryHttps(`Authorization: Basic ${basic}`);
+  if (basicPush.exitCode === 0) return;
+  const httpsErr = (basicPush.stderr || bearer.stderr || bearer.stdout).trim();
+  throw new Error(httpsErr || sshErr || `git push origin ${branchName} failed`);
 }
 async function mergePr(cwd, selector, opts) {
   const slug = await resolveGithubRepoSlug(cwd);
@@ -2214,6 +2317,8 @@ export {
   worktreeDisplayLabel,
   worktreeDisplayLabelForGroup,
   formatGhLandError,
+  githubAgentGitEnv,
+  formatGitAuthModeDirective,
   detectGhStack,
   getPrStack,
   initPrStack,

package/dist/{chunk-EEKSZTMU.js → chunk-HCGEFU3J.js}

@@ -1,9 +1,9 @@
-import {
-  resolveThreadDefaults
-} from "./chunk-W7YOTDVO.js";
 import {
   resolveGithubRepoSlug
-} from "./chunk-MF2YMEGD.js";
+} from "./chunk-YVVXWWCC.js";
+import {
+  resolveThreadDefaults
+} from "./chunk-IFPN6TER.js";
 import {
   globalAgentCwd,
   sideboardReposDir
@@ -68,7 +68,7 @@ var COORDINATOR_TOOL_PLAYBOOK = [
   "Inspect / review / PRs:",
   "- get_diff \u2014 compact diff summary",
   '- request_review \u2014 open a Review chat tab on a worktree thread (attaches .sideboard/review.md when present, else local guidelines; sends "Review changes in this workspace."); then wait_for_turn / get_turn_result on the returned id',
-  "- ask_git \u2014 tell a worktree agent to commit & push, open a draft PR, resolve conflicts, or merge (`Merge PR.`). You only queue that prompt \u2014 the worktree agent runs git/gh (including `gh pr merge`). Then wait_for_turn. Prefer this over paraphrasing.",
+  "- ask_git \u2014 commit & push, open a draft PR, resolve conflicts, or merge. When the worktree is clean, Sideboard pushes / opens the PR itself. When dirty, it queues the worktree agent \u2014 then wait_for_turn. Prefer this over paraphrasing.",
   '- Or send_to_thread with those exact phrases: "Commit and push.", "Commit, push, and open a draft PR.", "Fix merge conflicts.", "Merge PR." (draft PRs: `gh pr create --draft -R <origin-owner/name>` using the workspace `github:` slug \u2014 never upstream). Never run git/gh from this orchestration cwd, and never merge the PR yourself.',
   "Human-only (do not attempt): ready-for-review land (confirm_land), purge_thread.",
   "Thread links in replies: when mentioning a chat/thread for the user, include a markdown link `[Title](sideboard://thread/<id>)` using the full id (or the link field from create_thread / list_threads). Sideboard renders these as clickable opens.",

package/dist/{chunk-XJNCWYFR.js → chunk-HSLQXL6M.js}

@@ -2,10 +2,10 @@
 
 import {
   resolveGithubRepoSlug
-} from "./chunk-OE7YBB5X.js";
+} from "./chunk-FUUVPN4A.js";
 import {
   resolveThreadDefaults
-} from "./chunk-PTJJIQK7.js";
+} from "./chunk-XKNBSYA7.js";
 import {
   globalAgentCwd,
   sideboardReposDir
@@ -70,7 +70,7 @@ var COORDINATOR_TOOL_PLAYBOOK = [
   "Inspect / review / PRs:",
   "- get_diff \u2014 compact diff summary",
   '- request_review \u2014 open a Review chat tab on a worktree thread (attaches .sideboard/review.md when present, else local guidelines; sends "Review changes in this workspace."); then wait_for_turn / get_turn_result on the returned id',
-  "- ask_git \u2014 tell a worktree agent to commit & push, open a draft PR, resolve conflicts, or merge (`Merge PR.`). You only queue that prompt \u2014 the worktree agent runs git/gh (including `gh pr merge`). Then wait_for_turn. Prefer this over paraphrasing.",
+  "- ask_git \u2014 commit & push, open a draft PR, resolve conflicts, or merge. When the worktree is clean, Sideboard pushes / opens the PR itself. When dirty, it queues the worktree agent \u2014 then wait_for_turn. Prefer this over paraphrasing.",
   '- Or send_to_thread with those exact phrases: "Commit and push.", "Commit, push, and open a draft PR.", "Fix merge conflicts.", "Merge PR." (draft PRs: `gh pr create --draft -R <origin-owner/name>` using the workspace `github:` slug \u2014 never upstream). Never run git/gh from this orchestration cwd, and never merge the PR yourself.',
   "Human-only (do not attempt): ready-for-review land (confirm_land), purge_thread.",
   "Thread links in replies: when mentioning a chat/thread for the user, include a markdown link `[Title](sideboard://thread/<id>)` using the full id (or the link field from create_thread / list_threads). Sideboard renders these as clickable opens.",

package/dist/{chunk-W7YOTDVO.js → chunk-IFPN6TER.js}

@@ -187,6 +187,9 @@ function normalizeVault(raw) {
   if (typeof raw.slackAppToken === "string" && raw.slackAppToken.trim()) {
     out.slackAppToken = raw.slackAppToken.trim();
   }
+  if (typeof raw.githubPat === "string" && raw.githubPat.trim()) {
+    out.githubPat = raw.githubPat.trim();
+  }
   if (raw.environment && typeof raw.environment === "object") {
     const environment = {};
     for (const [key, value] of Object.entries(raw.environment)) {
@@ -214,6 +217,7 @@ var DEFAULT_AGENTS = /* @__PURE__ */ new Set([
   "brightsy",
   "cursor"
 ]);
+var GITHUB_GIT_AUTH_MODES = ["auto", "gh", "ssh", "token"];
 function hasLinearOAuth(integrations) {
   return Boolean(
     integrations.linearAccessToken?.trim() || integrations.linearRefreshToken?.trim()
@@ -230,12 +234,14 @@ function toPublicAppSettings(settings) {
   const integrations = { ...settings.integrations };
   const slackClientSecret = integrations.slackClientSecret;
   const slackAppToken = integrations.slackAppToken;
+  const githubPat = integrations.githubPat;
   delete integrations.linearApiKey;
   delete integrations.linearAccessToken;
   delete integrations.linearRefreshToken;
   delete integrations.linearClientSecret;
   delete integrations.slackClientSecret;
   delete integrations.slackAppToken;
+  delete integrations.githubPat;
   return {
     ...settings,
     environment,
@@ -244,7 +250,8 @@ function toPublicAppSettings(settings) {
       hasLinearApiKey: hasLinearCredentials(settings.integrations),
       hasLinearOAuth: hasLinearOAuth(settings.integrations),
       hasSlackClientSecret: Boolean(slackClientSecret?.trim()),
-      hasSlackAppToken: Boolean(slackAppToken?.trim())
+      hasSlackAppToken: Boolean(slackAppToken?.trim()),
+      hasGithubPat: Boolean(githubPat?.trim())
     }
   };
 }
@@ -303,6 +310,7 @@ function normalizeBrightsy(raw) {
   return out;
 }
 var ISSUE_SOURCES = /* @__PURE__ */ new Set(["linear", "github"]);
+var GIT_AUTH_MODES = new Set(GITHUB_GIT_AUTH_MODES);
 function normalizeIntegrations(raw) {
   if (!raw || typeof raw !== "object") return {};
   const source = raw;
@@ -367,6 +375,13 @@ function normalizeIntegrations(raw) {
     const label = source.slackDeviceLabel.trim().slice(0, 64);
     if (label) out.slackDeviceLabel = label;
   }
+  if (typeof source.githubGitAuthMode === "string" && GIT_AUTH_MODES.has(source.githubGitAuthMode)) {
+    out.githubGitAuthMode = source.githubGitAuthMode;
+  }
+  if (typeof source.githubPat === "string") {
+    const pat = source.githubPat.trim();
+    if (pat) out.githubPat = pat;
+  }
   return out;
 }
 function normalizeDefaults(raw) {
@@ -516,7 +531,7 @@ function readSettingsFile() {
 }
 function diskHoldsSecrets(disk) {
   return Boolean(
-    disk.integrations.linearApiKey || disk.integrations.linearAccessToken || disk.integrations.linearRefreshToken || disk.integrations.linearClientSecret || disk.integrations.slackClientSecret || disk.integrations.slackAppToken || Object.keys(disk.environment).length > 0
+    disk.integrations.linearApiKey || disk.integrations.linearAccessToken || disk.integrations.linearRefreshToken || disk.integrations.linearClientSecret || disk.integrations.slackClientSecret || disk.integrations.slackAppToken || disk.integrations.githubPat || Object.keys(disk.environment).length > 0
   );
 }
 function mergeVault(disk) {
@@ -541,6 +556,9 @@ function mergeVault(disk) {
   if (vault.slackAppToken && !integrations.slackAppToken) {
     integrations.slackAppToken = vault.slackAppToken;
   }
+  if (vault.githubPat && !integrations.githubPat) {
+    integrations.githubPat = vault.githubPat;
+  }
   return { ...disk, environment, integrations };
 }
 function persistSplit(settings) {
@@ -551,12 +569,14 @@ function persistSplit(settings) {
   const linearClientSecret = integrations.linearClientSecret;
   const slackClientSecret = integrations.slackClientSecret;
   const slackAppToken = integrations.slackAppToken;
+  const githubPat = integrations.githubPat;
   delete integrations.linearApiKey;
   delete integrations.linearAccessToken;
   delete integrations.linearRefreshToken;
   delete integrations.linearClientSecret;
   delete integrations.slackClientSecret;
   delete integrations.slackAppToken;
+  delete integrations.githubPat;
   writePrivateFile(
     appSettingsPath(),
     `${JSON.stringify({ ...settings, environment: {}, integrations }, null, 2)}
@@ -569,6 +589,7 @@ function persistSplit(settings) {
     linearClientSecret,
     slackClientSecret,
     slackAppToken,
+    githubPat,
     environment: settings.environment
   });
 }
@@ -734,6 +755,20 @@ function updateIntegrationsSettings(patch) {
       integrations.slackDeviceLabel = patch.slackDeviceLabel.trim().slice(0, 64);
     }
   }
+  if ("githubGitAuthMode" in patch) {
+    if (patch.githubGitAuthMode == null) {
+      delete integrations.githubGitAuthMode;
+    } else if (GIT_AUTH_MODES.has(patch.githubGitAuthMode)) {
+      integrations.githubGitAuthMode = patch.githubGitAuthMode;
+    }
+  }
+  if ("githubPat" in patch) {
+    if (patch.githubPat == null || patch.githubPat.trim() === "") {
+      delete integrations.githubPat;
+    } else {
+      integrations.githubPat = patch.githubPat.trim();
+    }
+  }
   return saveAppSettings({ ...current, integrations });
 }
 function updateDefaultsSettings(patch) {
@@ -841,6 +876,13 @@ function disconnectLinearConnection() {
 function getIssueSource(settings = loadAppSettings()) {
   return settings.integrations.issueSource ?? "github";
 }
+function getGithubGitAuthMode(settings = loadAppSettings()) {
+  return settings.integrations.githubGitAuthMode ?? "auto";
+}
+function getGithubPat(settings = loadAppSettings()) {
+  const pat = settings.integrations.githubPat?.trim();
+  return pat || null;
+}
 function resolveEffectiveIssueSource(settings = loadAppSettings()) {
   const preferred = getIssueSource(settings);
   if (preferred === "linear" && !isLinearConnected(settings)) return "github";
@@ -1058,6 +1100,7 @@ export {
   isSecureFileEncrypted,
   secureFileUnlocksWith,
   HARNESS_ENV_KEYS,
+  GITHUB_GIT_AUTH_MODES,
   toPublicAppSettings,
   appSettingsPath,
   claudeUserSettingsPath,
@@ -1080,6 +1123,8 @@ export {
   saveLinearOAuth,
   disconnectLinearConnection,
   getIssueSource,
+  getGithubGitAuthMode,
+  getGithubPat,
   resolveEffectiveIssueSource,
   getLinearApiKey,
   brightsyCloudConnectEnabled,

package/dist/{chunk-2FJI5JXX.js → chunk-P33ZQ7ZC.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-VROPG6QF.js";
 import {
   isOrchestratorThread
-} from "./chunk-GWTLKXXP.js";
+} from "./chunk-6T2SKGCS.js";
 import {
   enrichPathWithNpmGlobalBin,
   isConductorBundledCli,
@@ -22,7 +22,7 @@ import {
   loadAppSettings,
   resolveAgentExecutable,
   resolveClaudeExecutable
-} from "./chunk-PTJJIQK7.js";
+} from "./chunk-XKNBSYA7.js";
 import {
   appDataDir
 } from "./chunk-7MV3RXSC.js";
@@ -1009,7 +1009,7 @@ var claudeAdapter = {
       );
     }
     const mode = permissionMode(thread);
-    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-TWHMYLTZ.js");
+    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-RI367AM6.js");
     const isOrchestrator = isOrchestratorThread2(thread);
     const injectedServers = await buildInjectedMcpServers({
       includeSideboard: true,

package/dist/{chunk-75U65MBE.js → chunk-PW5YHHP3.js}

@@ -1,10 +1,10 @@
 import {
   isGlobalRepoPath
-} from "./chunk-VERLUKN2.js";
+} from "./chunk-5LXWTU3J.js";
 import {
   ensureGhPreferOrigin,
   resolveRepoRoot
-} from "./chunk-MF2YMEGD.js";
+} from "./chunk-YVVXWWCC.js";
 import {
   appDataDir
 } from "./chunk-M37RITA6.js";

package/dist/{chunk-QD37IILI.js → chunk-SHCR6RPU.js}

@@ -1,6 +1,6 @@
 import {
   isOrchestratorThread
-} from "./chunk-VERLUKN2.js";
+} from "./chunk-5LXWTU3J.js";
 import {
   applyConnectedTeamToCli,
   brightsyMcpServerName,
@@ -19,7 +19,7 @@ import {
   loadAppSettings,
   resolveAgentExecutable,
   resolveClaudeExecutable
-} from "./chunk-W7YOTDVO.js";
+} from "./chunk-IFPN6TER.js";
 import {
   appDataDir
 } from "./chunk-M37RITA6.js";
@@ -949,7 +949,7 @@ var claudeAdapter = {
       );
     }
     const mode = permissionMode(thread);
-    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-YNMNO4CL.js");
+    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-VG44RZUH.js");
     const isOrchestrator = isOrchestratorThread2(thread);
     const injectedServers = await buildInjectedMcpServers({
       includeSideboard: true,