@sideboard-ai/core 0.1.77 → 0.1.79

package/dist/{chunk-PTJJIQK7.js → chunk-XKNBSYA7.js}

@@ -172,6 +172,9 @@ function normalizeVault(raw) {
   if (typeof raw.slackAppToken === "string" && raw.slackAppToken.trim()) {
     out.slackAppToken = raw.slackAppToken.trim();
   }
+  if (typeof raw.githubPat === "string" && raw.githubPat.trim()) {
+    out.githubPat = raw.githubPat.trim();
+  }
   if (raw.environment && typeof raw.environment === "object") {
     const environment = {};
     for (const [key, value] of Object.entries(raw.environment)) {
@@ -199,6 +202,7 @@ var DEFAULT_AGENTS = /* @__PURE__ */ new Set([
   "brightsy",
   "cursor"
 ]);
+var GITHUB_GIT_AUTH_MODES = ["auto", "gh", "ssh", "token"];
 function hasLinearOAuth(integrations) {
   return Boolean(
     integrations.linearAccessToken?.trim() || integrations.linearRefreshToken?.trim()
@@ -215,12 +219,14 @@ function toPublicAppSettings(settings) {
   const integrations = { ...settings.integrations };
   const slackClientSecret = integrations.slackClientSecret;
   const slackAppToken = integrations.slackAppToken;
+  const githubPat = integrations.githubPat;
   delete integrations.linearApiKey;
   delete integrations.linearAccessToken;
   delete integrations.linearRefreshToken;
   delete integrations.linearClientSecret;
   delete integrations.slackClientSecret;
   delete integrations.slackAppToken;
+  delete integrations.githubPat;
   return {
     ...settings,
     environment,
@@ -229,7 +235,8 @@ function toPublicAppSettings(settings) {
       hasLinearApiKey: hasLinearCredentials(settings.integrations),
       hasLinearOAuth: hasLinearOAuth(settings.integrations),
       hasSlackClientSecret: Boolean(slackClientSecret?.trim()),
-      hasSlackAppToken: Boolean(slackAppToken?.trim())
+      hasSlackAppToken: Boolean(slackAppToken?.trim()),
+      hasGithubPat: Boolean(githubPat?.trim())
     }
   };
 }
@@ -288,6 +295,7 @@ function normalizeBrightsy(raw) {
   return out;
 }
 var ISSUE_SOURCES = /* @__PURE__ */ new Set(["linear", "github"]);
+var GIT_AUTH_MODES = new Set(GITHUB_GIT_AUTH_MODES);
 function normalizeIntegrations(raw) {
   if (!raw || typeof raw !== "object") return {};
   const source = raw;
@@ -352,6 +360,13 @@ function normalizeIntegrations(raw) {
     const label = source.slackDeviceLabel.trim().slice(0, 64);
     if (label) out.slackDeviceLabel = label;
   }
+  if (typeof source.githubGitAuthMode === "string" && GIT_AUTH_MODES.has(source.githubGitAuthMode)) {
+    out.githubGitAuthMode = source.githubGitAuthMode;
+  }
+  if (typeof source.githubPat === "string") {
+    const pat = source.githubPat.trim();
+    if (pat) out.githubPat = pat;
+  }
   return out;
 }
 function normalizeDefaults(raw) {
@@ -501,7 +516,7 @@ function readSettingsFile() {
 }
 function diskHoldsSecrets(disk) {
   return Boolean(
-    disk.integrations.linearApiKey || disk.integrations.linearAccessToken || disk.integrations.linearRefreshToken || disk.integrations.linearClientSecret || disk.integrations.slackClientSecret || disk.integrations.slackAppToken || Object.keys(disk.environment).length > 0
+    disk.integrations.linearApiKey || disk.integrations.linearAccessToken || disk.integrations.linearRefreshToken || disk.integrations.linearClientSecret || disk.integrations.slackClientSecret || disk.integrations.slackAppToken || disk.integrations.githubPat || Object.keys(disk.environment).length > 0
   );
 }
 function mergeVault(disk) {
@@ -526,6 +541,9 @@ function mergeVault(disk) {
   if (vault.slackAppToken && !integrations.slackAppToken) {
     integrations.slackAppToken = vault.slackAppToken;
   }
+  if (vault.githubPat && !integrations.githubPat) {
+    integrations.githubPat = vault.githubPat;
+  }
   return { ...disk, environment, integrations };
 }
 function persistSplit(settings) {
@@ -536,12 +554,14 @@ function persistSplit(settings) {
   const linearClientSecret = integrations.linearClientSecret;
   const slackClientSecret = integrations.slackClientSecret;
   const slackAppToken = integrations.slackAppToken;
+  const githubPat = integrations.githubPat;
   delete integrations.linearApiKey;
   delete integrations.linearAccessToken;
   delete integrations.linearRefreshToken;
   delete integrations.linearClientSecret;
   delete integrations.slackClientSecret;
   delete integrations.slackAppToken;
+  delete integrations.githubPat;
   writePrivateFile(
     appSettingsPath(),
     `${JSON.stringify({ ...settings, environment: {}, integrations }, null, 2)}
@@ -554,6 +574,7 @@ function persistSplit(settings) {
     linearClientSecret,
     slackClientSecret,
     slackAppToken,
+    githubPat,
     environment: settings.environment
   });
 }
@@ -719,6 +740,20 @@ function updateIntegrationsSettings(patch) {
       integrations.slackDeviceLabel = patch.slackDeviceLabel.trim().slice(0, 64);
     }
   }
+  if ("githubGitAuthMode" in patch) {
+    if (patch.githubGitAuthMode == null) {
+      delete integrations.githubGitAuthMode;
+    } else if (GIT_AUTH_MODES.has(patch.githubGitAuthMode)) {
+      integrations.githubGitAuthMode = patch.githubGitAuthMode;
+    }
+  }
+  if ("githubPat" in patch) {
+    if (patch.githubPat == null || patch.githubPat.trim() === "") {
+      delete integrations.githubPat;
+    } else {
+      integrations.githubPat = patch.githubPat.trim();
+    }
+  }
   return saveAppSettings({ ...current, integrations });
 }
 function updateDefaultsSettings(patch) {
@@ -826,6 +861,13 @@ function disconnectLinearConnection() {
 function getIssueSource(settings = loadAppSettings()) {
   return settings.integrations.issueSource ?? "github";
 }
+function getGithubGitAuthMode(settings = loadAppSettings()) {
+  return settings.integrations.githubGitAuthMode ?? "auto";
+}
+function getGithubPat(settings = loadAppSettings()) {
+  const pat = settings.integrations.githubPat?.trim();
+  return pat || null;
+}
 function resolveEffectiveIssueSource(settings = loadAppSettings()) {
   const preferred = getIssueSource(settings);
   if (preferred === "linear" && !isLinearConnected(settings)) return "github";
@@ -1039,6 +1081,7 @@ export {
   writeSecureJson,
   isSecureFileEncrypted,
   HARNESS_ENV_KEYS,
+  GITHUB_GIT_AUTH_MODES,
   toPublicAppSettings,
   appSettingsPath,
   claudeUserSettingsPath,
@@ -1061,6 +1104,8 @@ export {
   saveLinearOAuth,
   disconnectLinearConnection,
   getIssueSource,
+  getGithubGitAuthMode,
+  getGithubPat,
   resolveEffectiveIssueSource,
   getLinearApiKey,
   brightsyCloudConnectEnabled,

package/dist/{chunk-MF2YMEGD.js → chunk-YVVXWWCC.js}

@@ -1,6 +1,10 @@
 import {
   isWorkspaceScratchPath
 } from "./chunk-FKOIHGKV.js";
+import {
+  getGithubGitAuthMode,
+  getGithubPat
+} from "./chunk-IFPN6TER.js";
 import {
   listThreads
 } from "./chunk-FWJYLBO6.js";
@@ -886,6 +890,74 @@ function formatIpcInvokeError(err) {
   return formatGhLandError(msg);
 }
 
+// src/git/git-auth-mode.ts
+var HTTPS_REWRITE = [
+  { key: "url.https://github.com/.insteadOf", value: "git@github.com:" },
+  { key: "url.https://github.com/.insteadOf", value: "ssh://git@github.com/" },
+  { key: "credential.https://github.com.helper", value: "!gh auth git-credential" }
+];
+function appendIndexedGitConfig(existing, entries) {
+  const start = Number.parseInt(String(existing?.GIT_CONFIG_COUNT ?? "0"), 10);
+  const count = Number.isFinite(start) && start > 0 ? start : 0;
+  const out = {};
+  entries.forEach((entry, i) => {
+    const n = count + i;
+    out[`GIT_CONFIG_KEY_${n}`] = entry.key;
+    out[`GIT_CONFIG_VALUE_${n}`] = entry.value;
+  });
+  out.GIT_CONFIG_COUNT = String(count + entries.length);
+  return out;
+}
+function githubAgentGitEnv(existing) {
+  return appendIndexedGitConfig(existing, HTTPS_REWRITE);
+}
+function applyGithubGitAuthEnv(existing, opts) {
+  const out = {};
+  if (opts.mode === "gh" || opts.mode === "token") {
+    Object.assign(out, githubAgentGitEnv(existing));
+  }
+  if (opts.mode === "token") {
+    const token = opts.token?.trim();
+    if (token && !existing?.GH_TOKEN?.trim()) {
+      out.GH_TOKEN = token;
+    }
+  }
+  return out;
+}
+function formatGitAuthModeDirective(mode) {
+  switch (mode) {
+    case "gh":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: gh CLI):",
+        "- This process rewrites `git@github.com:` and `ssh://git@github.com/` to HTTPS.",
+        "- `gh` supplies credentials (`gh auth git-credential`). Do not switch remotes to SSH.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
+      ].join("\n");
+    case "ssh":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: SSH):",
+        "- Keep SSH remotes (`git@github.com:\u2026`). Do not rewrite them to HTTPS.",
+        "- Use this Mac\u2019s SSH agent / keys. If push fails with `Permission denied (publickey)`, tell the user to start ssh-agent or switch Account \u2192 GitHub to Auto / gh CLI \u2014 do not rewrite remotes yourself.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below (API still uses `gh`)."
+      ].join("\n");
+    case "token":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: personal access token):",
+        "- This process rewrites GitHub SSH remotes to HTTPS.",
+        "- `GH_TOKEN` is set in the environment. Use HTTPS git and `gh`; do not paste the token into commands or chat.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
+      ].join("\n");
+    case "auto":
+    default:
+      return [
+        "Git authentication (Account \u2192 GitHub mode: auto):",
+        "- Prefer the existing remote URL (SSH or HTTPS). Do not rewrite remotes unless a push/fetch fails.",
+        '- If `git push` fails with `Permission denied (publickey)`, this shell has no ssh-agent. Retry over HTTPS (do not stop): `git -c url.https://github.com/.insteadOf=git@github.com: -c http.extraHeader="AUTHORIZATION: bearer $(gh auth token)" push -u origin HEAD`.',
+        "- Then create/update the PR with `gh` as below."
+      ].join("\n");
+  }
+}
+
 // src/git/pr-gates.ts
 function prIsInMergeQueue(gate) {
   if (gate.isInMergeQueue) return true;
@@ -1286,10 +1358,15 @@ ${view.stderr}`;
     timeoutMs: 15e3
   });
 }
-async function originGhRepoEnv(cwd) {
+async function originGhRepoEnv(cwd, opts) {
   await ensureGhPreferOrigin(cwd);
   const slug = await resolveGithubRepoSlug(cwd);
-  return slug ? { GH_REPO: slug } : {};
+  const mode = opts?.mode ?? getGithubGitAuthMode();
+  const token = mode === "token" ? getGithubPat() : null;
+  return {
+    ...applyGithubGitAuthEnv(opts?.env, { mode, token }),
+    ...slug ? { GH_REPO: slug } : {}
+  };
 }
 async function resolveDefaultBranch(repoPath, opts) {
   const viaOrigin = await git(
@@ -2038,7 +2115,33 @@ async function commitAll(worktreePath, message) {
   return true;
 }
 async function pushBranch(worktreePath, branchName) {
-  await git(["push", "-u", "origin", branchName], worktreePath);
+  const ssh = await git(["push", "-u", "origin", branchName], worktreePath, {
+    reject: false
+  });
+  if (ssh.exitCode === 0) return;
+  const sshErr = (ssh.stderr || ssh.stdout).trim();
+  const slug = await resolveGithubRepoSlug(worktreePath);
+  const token = await resolveGhAuthToken(worktreePath);
+  if (!slug || !token) {
+    throw new Error(
+      sshErr || `git push origin ${branchName} failed` + (!token ? " (no SSH agent and gh auth token unavailable \u2014 run: gh auth login)" : "")
+    );
+  }
+  const tryHttps = async (header) => git(["push", "-u", "origin", branchName], worktreePath, {
+    reject: false,
+    env: { GIT_TERMINAL_PROMPT: "0" },
+    config: {
+      "url.https://github.com/.insteadOf": "git@github.com:",
+      "http.extraHeader": header
+    }
+  });
+  const bearer = await tryHttps(`AUTHORIZATION: bearer ${token}`);
+  if (bearer.exitCode === 0) return;
+  const basic = Buffer.from(`x-access-token:${token}`, "utf8").toString("base64");
+  const basicPush = await tryHttps(`Authorization: Basic ${basic}`);
+  if (basicPush.exitCode === 0) return;
+  const httpsErr = (basicPush.stderr || bearer.stderr || bearer.stdout).trim();
+  throw new Error(httpsErr || sshErr || `git push origin ${branchName} failed`);
 }
 async function mergePr(cwd, selector, opts) {
   const slug = await resolveGithubRepoSlug(cwd);
@@ -2251,6 +2354,10 @@ export {
   extractGhErrorDetail,
   formatGhLandError,
   formatIpcInvokeError,
+  appendIndexedGitConfig,
+  githubAgentGitEnv,
+  applyGithubGitAuthEnv,
+  formatGitAuthModeDirective,
   detectGhStack,
   resetGhStackDetectCache,
   parseGhStackViewJson,

package/dist/{coordinator-prompt-LLFJUO2R.js → coordinator-prompt-2OVON2LQ.js}

@@ -7,11 +7,11 @@ import {
   enrichWorkspacesWithGithub,
   ensureGlobalCoordinatorCwd,
   formatWorkspaceInventory
-} from "./chunk-EEKSZTMU.js";
-import "./chunk-W7YOTDVO.js";
-import "./chunk-JT7R45JB.js";
-import "./chunk-MF2YMEGD.js";
+} from "./chunk-HCGEFU3J.js";
+import "./chunk-YVVXWWCC.js";
 import "./chunk-FKOIHGKV.js";
+import "./chunk-IFPN6TER.js";
+import "./chunk-JT7R45JB.js";
 import "./chunk-FWJYLBO6.js";
 import "./chunk-77WWLBCI.js";
 import "./chunk-M37RITA6.js";

package/dist/{coordinator-prompt-MRCMMRSF.js → coordinator-prompt-K2R34A5T.js}

@@ -9,12 +9,12 @@ import {
   enrichWorkspacesWithGithub,
   ensureGlobalCoordinatorCwd,
   formatWorkspaceInventory
-} from "./chunk-XJNCWYFR.js";
-import "./chunk-OE7YBB5X.js";
+} from "./chunk-HSLQXL6M.js";
+import "./chunk-FUUVPN4A.js";
 import "./chunk-B3SJXYIJ.js";
 import "./chunk-7FD7COKE.js";
 import "./chunk-AE5VBOFE.js";
-import "./chunk-PTJJIQK7.js";
+import "./chunk-XKNBSYA7.js";
 import "./chunk-NSTQ6QKD.js";
 import "./chunk-KGZBYWZ3.js";
 import "./chunk-7MV3RXSC.js";

package/dist/{global-workspace-TWHMYLTZ.js → global-workspace-RI367AM6.js}

@@ -16,13 +16,13 @@ import {
   orchestratorSessionPoisonedByBuiltins,
   slackCoordinatorSourceRef,
   takenTeamSlugsForOrchestration
-} from "./chunk-GWTLKXXP.js";
-import "./chunk-XJNCWYFR.js";
-import "./chunk-OE7YBB5X.js";
+} from "./chunk-6T2SKGCS.js";
+import "./chunk-HSLQXL6M.js";
+import "./chunk-FUUVPN4A.js";
 import "./chunk-B3SJXYIJ.js";
 import "./chunk-7FD7COKE.js";
 import "./chunk-AE5VBOFE.js";
-import "./chunk-PTJJIQK7.js";
+import "./chunk-XKNBSYA7.js";
 import "./chunk-NSTQ6QKD.js";
 import "./chunk-KGZBYWZ3.js";
 import {

package/dist/{global-workspace-YNMNO4CL.js → global-workspace-VG44RZUH.js}

@@ -14,12 +14,12 @@ import {
   orchestratorSessionPoisonedByBuiltins,
   slackCoordinatorSourceRef,
   takenTeamSlugsForOrchestration
-} from "./chunk-VERLUKN2.js";
-import "./chunk-EEKSZTMU.js";
-import "./chunk-W7YOTDVO.js";
-import "./chunk-JT7R45JB.js";
-import "./chunk-MF2YMEGD.js";
+} from "./chunk-5LXWTU3J.js";
+import "./chunk-HCGEFU3J.js";
+import "./chunk-YVVXWWCC.js";
 import "./chunk-FKOIHGKV.js";
+import "./chunk-IFPN6TER.js";
+import "./chunk-JT7R45JB.js";
 import "./chunk-FWJYLBO6.js";
 import "./chunk-77WWLBCI.js";
 import {