@sideboard-ai/core 0.1.77 → 0.1.79

package/dist/index.cjs

@@ -79,11 +79,11 @@ var init_thinking_effort = __esm({
 });
 
 // src/hook/settings.ts
-function expandHome(path) {
-  if (path.startsWith("~/") || path === "~") {
-    return (0, import_node_path.join)((0, import_node_os.homedir)(), path.slice(2));
+function expandHome(path2) {
+  if (path2.startsWith("~/") || path2 === "~") {
+    return (0, import_node_path.join)((0, import_node_os.homedir)(), path2.slice(2));
   }
-  return path;
+  return path2;
 }
 function parseAvailableIn(raw) {
   if (!Array.isArray(raw)) return void 0;
@@ -93,9 +93,9 @@ function parseAvailableIn(raw) {
   }
   return out.length ? out : void 0;
 }
-function parseSettingsFile(path, source) {
-  if (!(0, import_node_fs.existsSync)(path)) return null;
-  const raw = (0, import_node_fs.readFileSync)(path, "utf8");
+function parseSettingsFile(path2, source) {
+  if (!(0, import_node_fs.existsSync)(path2)) return null;
+  const raw = (0, import_node_fs.readFileSync)(path2, "utf8");
   const data = (0, import_smol_toml.parse)(raw);
   const scripts = data.scripts ?? {};
   const setup = typeof scripts.setup === "string" ? scripts.setup : void 0;
@@ -386,14 +386,14 @@ var init_paths = __esm({
 });
 
 // src/store/private-file.ts
-function writePrivateFile(path, contents) {
-  (0, import_node_fs3.mkdirSync)((0, import_node_path4.dirname)(path), { recursive: true });
-  (0, import_node_fs3.writeFileSync)(path, contents, { encoding: "utf8", mode: PRIVATE_FILE_MODE });
-  chmodOwnerOnly(path);
+function writePrivateFile(path2, contents) {
+  (0, import_node_fs3.mkdirSync)((0, import_node_path4.dirname)(path2), { recursive: true });
+  (0, import_node_fs3.writeFileSync)(path2, contents, { encoding: "utf8", mode: PRIVATE_FILE_MODE });
+  chmodOwnerOnly(path2);
 }
-function chmodOwnerOnly(path) {
+function chmodOwnerOnly(path2) {
   try {
-    (0, import_node_fs3.chmodSync)(path, PRIVATE_FILE_MODE);
+    (0, import_node_fs3.chmodSync)(path2, PRIVATE_FILE_MODE);
   } catch {
   }
 }
@@ -493,12 +493,12 @@ function decryptEnvelope(envelope, key) {
   ]);
   return JSON.parse(plaintext.toString("utf8"));
 }
-function readSecureJson(path) {
-  if (!(0, import_node_fs4.existsSync)(path)) return null;
-  chmodOwnerOnly(path);
+function readSecureJson(path2) {
+  if (!(0, import_node_fs4.existsSync)(path2)) return null;
+  chmodOwnerOnly(path2);
   let parsed;
   try {
-    parsed = JSON.parse((0, import_node_fs4.readFileSync)(path, "utf8"));
+    parsed = JSON.parse((0, import_node_fs4.readFileSync)(path2, "utf8"));
   } catch {
     return null;
   }
@@ -511,24 +511,24 @@ function readSecureJson(path) {
   }
   return decryptEnvelope(parsed, key);
 }
-function writeSecureJson(path, value) {
+function writeSecureJson(path2, value) {
   const key = resolveVaultKey();
   const body = key ? encryptJson(value, key) : value;
-  writePrivateFile(path, `${JSON.stringify(body, null, 2)}
+  writePrivateFile(path2, `${JSON.stringify(body, null, 2)}
 `);
 }
-function isSecureFileEncrypted(path) {
-  if (!(0, import_node_fs4.existsSync)(path)) return false;
+function isSecureFileEncrypted(path2) {
+  if (!(0, import_node_fs4.existsSync)(path2)) return false;
   try {
-    return isEnvelope(JSON.parse((0, import_node_fs4.readFileSync)(path, "utf8")));
+    return isEnvelope(JSON.parse((0, import_node_fs4.readFileSync)(path2, "utf8")));
   } catch {
     return false;
   }
 }
-function secureFileUnlocksWith(path, key) {
-  if (!(0, import_node_fs4.existsSync)(path) || key.length !== 32) return true;
+function secureFileUnlocksWith(path2, key) {
+  if (!(0, import_node_fs4.existsSync)(path2) || key.length !== 32) return true;
   try {
-    const parsed = JSON.parse((0, import_node_fs4.readFileSync)(path, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs4.readFileSync)(path2, "utf8"));
     if (!isEnvelope(parsed)) return true;
     decryptEnvelope(parsed, key);
     return true;
@@ -583,6 +583,9 @@ function normalizeVault(raw) {
   if (typeof raw.slackAppToken === "string" && raw.slackAppToken.trim()) {
     out.slackAppToken = raw.slackAppToken.trim();
   }
+  if (typeof raw.githubPat === "string" && raw.githubPat.trim()) {
+    out.githubPat = raw.githubPat.trim();
+  }
   if (raw.environment && typeof raw.environment === "object") {
     const environment = {};
     for (const [key, value] of Object.entries(raw.environment)) {
@@ -607,6 +610,7 @@ var init_secret_vault = __esm({
 // src/store/app-settings.ts
 var app_settings_exports = {};
 __export(app_settings_exports, {
+  GITHUB_GIT_AUTH_MODES: () => GITHUB_GIT_AUTH_MODES,
   HARNESS_ENV_KEYS: () => HARNESS_ENV_KEYS,
   appSettingsPath: () => appSettingsPath,
   applyAppEnvironment: () => applyAppEnvironment,
@@ -630,6 +634,8 @@ __export(app_settings_exports, {
   getDefaultEffort: () => getDefaultEffort,
   getDefaultFast: () => getDefaultFast,
   getDefaultModel: () => getDefaultModel,
+  getGithubGitAuthMode: () => getGithubGitAuthMode,
+  getGithubPat: () => getGithubPat,
   getIssueSource: () => getIssueSource,
   getLinearApiKey: () => getLinearApiKey,
   harnessEnvKey: () => harnessEnvKey,
@@ -674,12 +680,14 @@ function toPublicAppSettings(settings) {
   const integrations = { ...settings.integrations };
   const slackClientSecret = integrations.slackClientSecret;
   const slackAppToken = integrations.slackAppToken;
+  const githubPat = integrations.githubPat;
   delete integrations.linearApiKey;
   delete integrations.linearAccessToken;
   delete integrations.linearRefreshToken;
   delete integrations.linearClientSecret;
   delete integrations.slackClientSecret;
   delete integrations.slackAppToken;
+  delete integrations.githubPat;
   return {
     ...settings,
     environment,
@@ -688,7 +696,8 @@ function toPublicAppSettings(settings) {
       hasLinearApiKey: hasLinearCredentials(settings.integrations),
       hasLinearOAuth: hasLinearOAuth(settings.integrations),
       hasSlackClientSecret: Boolean(slackClientSecret?.trim()),
-      hasSlackAppToken: Boolean(slackAppToken?.trim())
+      hasSlackAppToken: Boolean(slackAppToken?.trim()),
+      hasGithubPat: Boolean(githubPat?.trim())
     }
   };
 }
@@ -703,8 +712,8 @@ function normalizeClaude(raw) {
   const source = raw;
   const out = {};
   if (typeof source.executablePath === "string") {
-    const path = source.executablePath.trim();
-    if (path) out.executablePath = path;
+    const path2 = source.executablePath.trim();
+    if (path2) out.executablePath = path2;
   }
   if (typeof source.chromeEnabled === "boolean") {
     out.chromeEnabled = source.chromeEnabled;
@@ -716,8 +725,8 @@ function normalizeCliExecutable(raw) {
   const source = raw;
   const out = {};
   if (typeof source.executablePath === "string") {
-    const path = source.executablePath.trim();
-    if (path) out.executablePath = path;
+    const path2 = source.executablePath.trim();
+    if (path2) out.executablePath = path2;
   }
   return out;
 }
@@ -726,8 +735,8 @@ function normalizeBrightsy(raw) {
   const source = raw;
   const out = {};
   if (typeof source.executablePath === "string") {
-    const path = source.executablePath.trim();
-    if (path) out.executablePath = path;
+    const path2 = source.executablePath.trim();
+    if (path2) out.executablePath = path2;
   }
   if (typeof source.cloudConnectEnabled === "boolean") {
     out.cloudConnectEnabled = source.cloudConnectEnabled;
@@ -804,6 +813,13 @@ function normalizeIntegrations(raw) {
     const label = source.slackDeviceLabel.trim().slice(0, 64);
     if (label) out.slackDeviceLabel = label;
   }
+  if (typeof source.githubGitAuthMode === "string" && GIT_AUTH_MODES.has(source.githubGitAuthMode)) {
+    out.githubGitAuthMode = source.githubGitAuthMode;
+  }
+  if (typeof source.githubPat === "string") {
+    const pat = source.githubPat.trim();
+    if (pat) out.githubPat = pat;
+  }
   return out;
 }
 function normalizeDefaults(raw) {
@@ -931,11 +947,11 @@ function normalizeSettings(raw) {
   };
 }
 function readSettingsFile() {
-  const path = appSettingsPath();
-  if (!(0, import_node_fs5.existsSync)(path)) return { ...EMPTY_SETTINGS };
+  const path2 = appSettingsPath();
+  if (!(0, import_node_fs5.existsSync)(path2)) return { ...EMPTY_SETTINGS };
   try {
-    chmodOwnerOnly(path);
-    const parsed = JSON.parse((0, import_node_fs5.readFileSync)(path, "utf8"));
+    chmodOwnerOnly(path2);
+    const parsed = JSON.parse((0, import_node_fs5.readFileSync)(path2, "utf8"));
     return normalizeSettings(parsed);
   } catch {
     return { ...EMPTY_SETTINGS };
@@ -943,7 +959,7 @@ function readSettingsFile() {
 }
 function diskHoldsSecrets(disk) {
   return Boolean(
-    disk.integrations.linearApiKey || disk.integrations.linearAccessToken || disk.integrations.linearRefreshToken || disk.integrations.linearClientSecret || disk.integrations.slackClientSecret || disk.integrations.slackAppToken || Object.keys(disk.environment).length > 0
+    disk.integrations.linearApiKey || disk.integrations.linearAccessToken || disk.integrations.linearRefreshToken || disk.integrations.linearClientSecret || disk.integrations.slackClientSecret || disk.integrations.slackAppToken || disk.integrations.githubPat || Object.keys(disk.environment).length > 0
   );
 }
 function mergeVault(disk) {
@@ -968,6 +984,9 @@ function mergeVault(disk) {
   if (vault.slackAppToken && !integrations.slackAppToken) {
     integrations.slackAppToken = vault.slackAppToken;
   }
+  if (vault.githubPat && !integrations.githubPat) {
+    integrations.githubPat = vault.githubPat;
+  }
   return { ...disk, environment, integrations };
 }
 function persistSplit(settings) {
@@ -978,12 +997,14 @@ function persistSplit(settings) {
   const linearClientSecret = integrations.linearClientSecret;
   const slackClientSecret = integrations.slackClientSecret;
   const slackAppToken = integrations.slackAppToken;
+  const githubPat = integrations.githubPat;
   delete integrations.linearApiKey;
   delete integrations.linearAccessToken;
   delete integrations.linearRefreshToken;
   delete integrations.linearClientSecret;
   delete integrations.slackClientSecret;
   delete integrations.slackAppToken;
+  delete integrations.githubPat;
   writePrivateFile(
     appSettingsPath(),
     `${JSON.stringify({ ...settings, environment: {}, integrations }, null, 2)}
@@ -996,6 +1017,7 @@ function persistSplit(settings) {
     linearClientSecret,
     slackClientSecret,
     slackAppToken,
+    githubPat,
     environment: settings.environment
   });
 }
@@ -1161,6 +1183,20 @@ function updateIntegrationsSettings(patch) {
       integrations.slackDeviceLabel = patch.slackDeviceLabel.trim().slice(0, 64);
     }
   }
+  if ("githubGitAuthMode" in patch) {
+    if (patch.githubGitAuthMode == null) {
+      delete integrations.githubGitAuthMode;
+    } else if (GIT_AUTH_MODES.has(patch.githubGitAuthMode)) {
+      integrations.githubGitAuthMode = patch.githubGitAuthMode;
+    }
+  }
+  if ("githubPat" in patch) {
+    if (patch.githubPat == null || patch.githubPat.trim() === "") {
+      delete integrations.githubPat;
+    } else {
+      integrations.githubPat = patch.githubPat.trim();
+    }
+  }
   return saveAppSettings({ ...current, integrations });
 }
 function updateDefaultsSettings(patch) {
@@ -1268,6 +1304,13 @@ function disconnectLinearConnection() {
 function getIssueSource(settings = loadAppSettings()) {
   return settings.integrations.issueSource ?? "github";
 }
+function getGithubGitAuthMode(settings = loadAppSettings()) {
+  return settings.integrations.githubGitAuthMode ?? "auto";
+}
+function getGithubPat(settings = loadAppSettings()) {
+  const pat = settings.integrations.githubPat?.trim();
+  return pat || null;
+}
 function resolveEffectiveIssueSource(settings = loadAppSettings()) {
   const preferred = getIssueSource(settings);
   if (preferred === "linear" && !isLinearConnected(settings)) return "github";
@@ -1468,7 +1511,7 @@ function childEnvWithAppSettings(extra) {
 function harnessEnvKey(harness) {
   return HARNESS_ENV_KEYS[harness];
 }
-var import_node_crypto2, import_node_fs5, import_node_os3, import_node_path6, HARNESS_ENV_KEYS, DEFAULT_AGENTS, CLOUD_CONNECT_AGENTS, ISSUE_SOURCES, EMPTY_SETTINGS, DEFAULT_CLI_BIN;
+var import_node_crypto2, import_node_fs5, import_node_os3, import_node_path6, HARNESS_ENV_KEYS, DEFAULT_AGENTS, GITHUB_GIT_AUTH_MODES, CLOUD_CONNECT_AGENTS, ISSUE_SOURCES, GIT_AUTH_MODES, EMPTY_SETTINGS, DEFAULT_CLI_BIN;
 var init_app_settings = __esm({
   "src/store/app-settings.ts"() {
     "use strict";
@@ -1494,6 +1537,7 @@ var init_app_settings = __esm({
       "brightsy",
       "cursor"
     ]);
+    GITHUB_GIT_AUTH_MODES = ["auto", "gh", "ssh", "token"];
     CLOUD_CONNECT_AGENTS = /* @__PURE__ */ new Set([
       "claude",
       "codex",
@@ -1501,6 +1545,7 @@ var init_app_settings = __esm({
       "cursor"
     ]);
     ISSUE_SOURCES = /* @__PURE__ */ new Set(["linear", "github"]);
+    GIT_AUTH_MODES = new Set(GITHUB_GIT_AUTH_MODES);
     EMPTY_SETTINGS = {
       environment: {},
       claude: {},
@@ -1567,10 +1612,10 @@ function uniqueIds(ids) {
   return out;
 }
 function readHold() {
-  const path = caffeinateHoldPath();
-  if (!(0, import_node_fs6.existsSync)(path)) return null;
+  const path2 = caffeinateHoldPath();
+  if (!(0, import_node_fs6.existsSync)(path2)) return null;
   try {
-    const parsed = JSON.parse((0, import_node_fs6.readFileSync)(path, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs6.readFileSync)(path2, "utf8"));
     if (typeof parsed?.pid === "number" && parsed.pid > 0) {
       return {
         pid: parsed.pid,
@@ -1790,17 +1835,17 @@ async function withThreadLock(id, fn) {
   }
 }
 function readThread(id) {
-  const path = threadFilePath(id);
-  if (!(0, import_node_fs7.existsSync)(path)) return null;
-  const raw = (0, import_node_fs7.readFileSync)(path, "utf8");
+  const path2 = threadFilePath(id);
+  if (!(0, import_node_fs7.existsSync)(path2)) return null;
+  const raw = (0, import_node_fs7.readFileSync)(path2, "utf8");
   return normalizeThread(JSON.parse(raw));
 }
 function writeThread(thread) {
-  const path = threadFilePath(idPath(thread.id));
-  const tmp = `${path}.${process.pid}.tmp`;
+  const path2 = threadFilePath(idPath(thread.id));
+  const tmp = `${path2}.${process.pid}.tmp`;
   const next = { ...thread, updatedAt: nowIso() };
   (0, import_node_fs7.writeFileSync)(tmp, JSON.stringify(next, null, 2), "utf8");
-  (0, import_node_fs7.renameSync)(tmp, path);
+  (0, import_node_fs7.renameSync)(tmp, path2);
 }
 function idPath(id) {
   return id;
@@ -1820,8 +1865,8 @@ function listThreads(opts) {
   return threads.filter((t) => t.status !== "archived");
 }
 function deleteThreadRecord(id) {
-  const path = threadFilePath(id);
-  if ((0, import_node_fs7.existsSync)(path)) (0, import_node_fs7.unlinkSync)(path);
+  const path2 = threadFilePath(id);
+  if ((0, import_node_fs7.existsSync)(path2)) (0, import_node_fs7.unlinkSync)(path2);
   const lock = threadLockPath(id);
   if ((0, import_node_fs7.existsSync)(lock)) {
     try {
@@ -2820,6 +2865,80 @@ var init_gh_errors = __esm({
   }
 });
 
+// src/git/git-auth-mode.ts
+function appendIndexedGitConfig(existing, entries) {
+  const start = Number.parseInt(String(existing?.GIT_CONFIG_COUNT ?? "0"), 10);
+  const count = Number.isFinite(start) && start > 0 ? start : 0;
+  const out = {};
+  entries.forEach((entry, i) => {
+    const n = count + i;
+    out[`GIT_CONFIG_KEY_${n}`] = entry.key;
+    out[`GIT_CONFIG_VALUE_${n}`] = entry.value;
+  });
+  out.GIT_CONFIG_COUNT = String(count + entries.length);
+  return out;
+}
+function githubAgentGitEnv(existing) {
+  return appendIndexedGitConfig(existing, HTTPS_REWRITE);
+}
+function applyGithubGitAuthEnv(existing, opts) {
+  const out = {};
+  if (opts.mode === "gh" || opts.mode === "token") {
+    Object.assign(out, githubAgentGitEnv(existing));
+  }
+  if (opts.mode === "token") {
+    const token = opts.token?.trim();
+    if (token && !existing?.GH_TOKEN?.trim()) {
+      out.GH_TOKEN = token;
+    }
+  }
+  return out;
+}
+function formatGitAuthModeDirective(mode) {
+  switch (mode) {
+    case "gh":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: gh CLI):",
+        "- This process rewrites `git@github.com:` and `ssh://git@github.com/` to HTTPS.",
+        "- `gh` supplies credentials (`gh auth git-credential`). Do not switch remotes to SSH.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
+      ].join("\n");
+    case "ssh":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: SSH):",
+        "- Keep SSH remotes (`git@github.com:\u2026`). Do not rewrite them to HTTPS.",
+        "- Use this Mac\u2019s SSH agent / keys. If push fails with `Permission denied (publickey)`, tell the user to start ssh-agent or switch Account \u2192 GitHub to Auto / gh CLI \u2014 do not rewrite remotes yourself.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below (API still uses `gh`)."
+      ].join("\n");
+    case "token":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: personal access token):",
+        "- This process rewrites GitHub SSH remotes to HTTPS.",
+        "- `GH_TOKEN` is set in the environment. Use HTTPS git and `gh`; do not paste the token into commands or chat.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
+      ].join("\n");
+    case "auto":
+    default:
+      return [
+        "Git authentication (Account \u2192 GitHub mode: auto):",
+        "- Prefer the existing remote URL (SSH or HTTPS). Do not rewrite remotes unless a push/fetch fails.",
+        '- If `git push` fails with `Permission denied (publickey)`, this shell has no ssh-agent. Retry over HTTPS (do not stop): `git -c url.https://github.com/.insteadOf=git@github.com: -c http.extraHeader="AUTHORIZATION: bearer $(gh auth token)" push -u origin HEAD`.',
+        "- Then create/update the PR with `gh` as below."
+      ].join("\n");
+  }
+}
+var HTTPS_REWRITE;
+var init_git_auth_mode = __esm({
+  "src/git/git-auth-mode.ts"() {
+    "use strict";
+    HTTPS_REWRITE = [
+      { key: "url.https://github.com/.insteadOf", value: "git@github.com:" },
+      { key: "url.https://github.com/.insteadOf", value: "ssh://git@github.com/" },
+      { key: "credential.https://github.com.helper", value: "!gh auth git-credential" }
+    ];
+  }
+});
+
 // src/agents/path.ts
 function prependPathDir(env, dir) {
   if (!dir || !(0, import_node_fs8.existsSync)(dir)) return;
@@ -3357,6 +3476,7 @@ __export(worktree_exports, {
   getPrMeta: () => getPrMeta,
   ghHeadRef: () => ghHeadRef,
   ghRepoSelectArgs: () => ghRepoSelectArgs,
+  githubAgentGitEnv: () => githubAgentGitEnv,
   isDirty: () => isDirty,
   isPlaceholderBranch: () => isPlaceholderBranch,
   isSideboardScratchPath: () => isSideboardScratchPath,
@@ -3478,10 +3598,15 @@ ${view.stderr}`;
     timeoutMs: 15e3
   });
 }
-async function originGhRepoEnv(cwd) {
+async function originGhRepoEnv(cwd, opts) {
   await ensureGhPreferOrigin(cwd);
   const slug = await resolveGithubRepoSlug(cwd);
-  return slug ? { GH_REPO: slug } : {};
+  const mode = opts?.mode ?? getGithubGitAuthMode();
+  const token = mode === "token" ? getGithubPat() : null;
+  return {
+    ...applyGithubGitAuthEnv(opts?.env, { mode, token }),
+    ...slug ? { GH_REPO: slug } : {}
+  };
 }
 async function resolveDefaultBranch(repoPath, opts) {
   const viaOrigin = await git(
@@ -4230,7 +4355,33 @@ async function commitAll(worktreePath, message) {
   return true;
 }
 async function pushBranch(worktreePath, branchName) {
-  await git(["push", "-u", "origin", branchName], worktreePath);
+  const ssh = await git(["push", "-u", "origin", branchName], worktreePath, {
+    reject: false
+  });
+  if (ssh.exitCode === 0) return;
+  const sshErr = (ssh.stderr || ssh.stdout).trim();
+  const slug = await resolveGithubRepoSlug(worktreePath);
+  const token = await resolveGhAuthToken(worktreePath);
+  if (!slug || !token) {
+    throw new Error(
+      sshErr || `git push origin ${branchName} failed` + (!token ? " (no SSH agent and gh auth token unavailable \u2014 run: gh auth login)" : "")
+    );
+  }
+  const tryHttps = async (header) => git(["push", "-u", "origin", branchName], worktreePath, {
+    reject: false,
+    env: { GIT_TERMINAL_PROMPT: "0" },
+    config: {
+      "url.https://github.com/.insteadOf": "git@github.com:",
+      "http.extraHeader": header
+    }
+  });
+  const bearer = await tryHttps(`AUTHORIZATION: bearer ${token}`);
+  if (bearer.exitCode === 0) return;
+  const basic = Buffer.from(`x-access-token:${token}`, "utf8").toString("base64");
+  const basicPush = await tryHttps(`Authorization: Basic ${basic}`);
+  if (basicPush.exitCode === 0) return;
+  const httpsErr = (basicPush.stderr || bearer.stderr || bearer.stdout).trim();
+  throw new Error(httpsErr || sshErr || `git push origin ${branchName} failed`);
 }
 async function mergePr(cwd, selector, opts) {
   const slug = await resolveGithubRepoSlug(cwd);
@@ -4418,8 +4569,8 @@ function allocateTeamSlug(repoPath) {
   const taken = collectTakenTeamSlugs(repoPath);
   for (let attempt = 0; attempt < 32; attempt++) {
     const team = allocateTeamName(taken);
-    const path = (0, import_node_path9.join)(worktreesRoot(repoPath), team.slug);
-    if (!(0, import_node_fs9.existsSync)(path)) return team;
+    const path2 = (0, import_node_path9.join)(worktreesRoot(repoPath), team.slug);
+    if (!(0, import_node_fs9.existsSync)(path2)) return team;
     taken.add(team.slug);
   }
   throw new Error("No available soccer team worktree directories left");
@@ -4435,10 +4586,13 @@ var init_worktree = __esm({
     init_teams();
     init_worktree_labels();
     init_gh_errors();
+    init_git_auth_mode();
     init_run();
+    init_app_settings();
     init_pr_gates();
     init_stack();
     init_teams();
+    init_git_auth_mode();
     init_workspace_scratch();
     init_worktree_labels();
   }
@@ -4639,7 +4793,7 @@ var init_coordinator_prompt = __esm({
       "Inspect / review / PRs:",
       "- get_diff \u2014 compact diff summary",
       '- request_review \u2014 open a Review chat tab on a worktree thread (attaches .sideboard/review.md when present, else local guidelines; sends "Review changes in this workspace."); then wait_for_turn / get_turn_result on the returned id',
-      "- ask_git \u2014 tell a worktree agent to commit & push, open a draft PR, resolve conflicts, or merge (`Merge PR.`). You only queue that prompt \u2014 the worktree agent runs git/gh (including `gh pr merge`). Then wait_for_turn. Prefer this over paraphrasing.",
+      "- ask_git \u2014 commit & push, open a draft PR, resolve conflicts, or merge. When the worktree is clean, Sideboard pushes / opens the PR itself. When dirty, it queues the worktree agent \u2014 then wait_for_turn. Prefer this over paraphrasing.",
       '- Or send_to_thread with those exact phrases: "Commit and push.", "Commit, push, and open a draft PR.", "Fix merge conflicts.", "Merge PR." (draft PRs: `gh pr create --draft -R <origin-owner/name>` using the workspace `github:` slug \u2014 never upstream). Never run git/gh from this orchestration cwd, and never merge the PR yourself.',
       "Human-only (do not attempt): ready-for-review land (confirm_land), purge_thread.",
       "Thread links in replies: when mentioning a chat/thread for the user, include a markdown link `[Title](sideboard://thread/<id>)` using the full id (or the link field from create_thread / list_threads). Sideboard renders these as clickable opens.",
@@ -4912,10 +5066,10 @@ function removedWorkspacesFile() {
   return (0, import_node_path11.join)(appDataDir(), "removed-workspaces.json");
 }
 function readAll() {
-  const path = workspacesFile();
-  if (!(0, import_node_fs11.existsSync)(path)) return [];
+  const path2 = workspacesFile();
+  if (!(0, import_node_fs11.existsSync)(path2)) return [];
   try {
-    const raw = JSON.parse((0, import_node_fs11.readFileSync)(path, "utf8"));
+    const raw = JSON.parse((0, import_node_fs11.readFileSync)(path2, "utf8"));
     return Array.isArray(raw) ? raw : [];
   } catch {
     return [];
@@ -4926,10 +5080,10 @@ function writeAll(list) {
   (0, import_node_fs11.writeFileSync)(workspacesFile(), JSON.stringify(list, null, 2), "utf8");
 }
 function readRemoved() {
-  const path = removedWorkspacesFile();
-  if (!(0, import_node_fs11.existsSync)(path)) return /* @__PURE__ */ new Set();
+  const path2 = removedWorkspacesFile();
+  if (!(0, import_node_fs11.existsSync)(path2)) return /* @__PURE__ */ new Set();
   try {
-    const raw = JSON.parse((0, import_node_fs11.readFileSync)(path, "utf8"));
+    const raw = JSON.parse((0, import_node_fs11.readFileSync)(path2, "utf8"));
     return new Set(Array.isArray(raw) ? raw.filter((p) => typeof p === "string") : []);
   } catch {
     return /* @__PURE__ */ new Set();
@@ -4986,17 +5140,17 @@ function syncWorkspacesFromThreads(repoPaths) {
   const removed = readRemoved();
   const byPath = new Map(current.map((w) => [w.path, w]));
   let dirty = false;
-  for (const path of repoPaths) {
-    if (!path || path === "/" || isGlobalRepoPath(path) || byPath.has(path) || removed.has(path)) {
+  for (const path2 of repoPaths) {
+    if (!path2 || path2 === "/" || isGlobalRepoPath(path2) || byPath.has(path2) || removed.has(path2)) {
       continue;
     }
-    if (!(0, import_node_fs11.existsSync)(path)) continue;
+    if (!(0, import_node_fs11.existsSync)(path2)) continue;
     const ws = {
-      path,
-      name: (0, import_node_path11.basename)(path),
+      path: path2,
+      name: (0, import_node_path11.basename)(path2),
       addedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
-    byPath.set(path, ws);
+    byPath.set(path2, ws);
     dirty = true;
   }
   const next = [...byPath.values()];
@@ -5020,11 +5174,11 @@ function brightsyConfigPath() {
   return (0, import_node_path12.join)((0, import_node_os5.homedir)(), ".brightsy", "config.json");
 }
 function loadBrightsyConfig() {
-  const path = brightsyConfigPath();
-  if (!(0, import_node_fs12.existsSync)(path)) {
+  const path2 = brightsyConfigPath();
+  if (!(0, import_node_fs12.existsSync)(path2)) {
     throw new Error("Brightsy not logged in \u2014 run `brightsy login` first");
   }
-  const raw = JSON.parse((0, import_node_fs12.readFileSync)(path, "utf8"));
+  const raw = JSON.parse((0, import_node_fs12.readFileSync)(path2, "utf8"));
   if (!raw.access_token || !raw.account_id) {
     throw new Error("Brightsy config incomplete \u2014 run `brightsy login`");
   }
@@ -5148,10 +5302,10 @@ function storePath() {
   return (0, import_node_path13.join)(appDataDir(), "brightsy-teams.json");
 }
 function readStore() {
-  const path = storePath();
-  if (!(0, import_node_fs13.existsSync)(path)) return [];
+  const path2 = storePath();
+  if (!(0, import_node_fs13.existsSync)(path2)) return [];
   try {
-    const parsed = JSON.parse((0, import_node_fs13.readFileSync)(path, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs13.readFileSync)(path2, "utf8"));
     return Array.isArray(parsed.teams) ? parsed.teams : [];
   } catch {
     return [];
@@ -5159,8 +5313,8 @@ function readStore() {
 }
 function writeStore(teams) {
   (0, import_node_fs13.mkdirSync)(appDataDir(), { recursive: true });
-  const path = storePath();
-  (0, import_node_fs13.writeFileSync)(path, `${JSON.stringify({ teams }, null, 2)}
+  const path2 = storePath();
+  (0, import_node_fs13.writeFileSync)(path2, `${JSON.stringify({ teams }, null, 2)}
 `, {
     mode: 384
   });
@@ -6700,9 +6854,9 @@ function codexConfigHasNetworkAccess() {
     (0, import_node_path15.join)((0, import_node_os7.homedir)(), ".codex", "config.toml"),
     (0, import_node_path15.join)((0, import_node_os7.homedir)(), ".config", "codex", "config.toml")
   ];
-  for (const path of candidates) {
-    if (!(0, import_node_fs17.existsSync)(path)) continue;
-    const text3 = (0, import_node_fs17.readFileSync)(path, "utf8");
+  for (const path2 of candidates) {
+    if (!(0, import_node_fs17.existsSync)(path2)) continue;
+    const text3 = (0, import_node_fs17.readFileSync)(path2, "utf8");
     if (/network_access\s*=\s*true/.test(text3)) return true;
   }
   return false;
@@ -8166,8 +8320,8 @@ function extractPresentedPlan(parts) {
     const content = typeof input.content === "string" ? input.content : typeof input.plan === "string" ? input.plan : typeof input.markdown === "string" ? input.markdown : "";
     if (!content.trim()) continue;
     const title = typeof input.title === "string" && input.title.trim() ? input.title.trim() : "Plan";
-    const path = typeof input.path === "string" && input.path.trim() ? input.path.trim() : PLAN_FILE_REL;
-    return { title, content: content.trim(), path, source: "present_plan" };
+    const path2 = typeof input.path === "string" && input.path.trim() ? input.path.trim() : PLAN_FILE_REL;
+    return { title, content: content.trim(), path: path2, source: "present_plan" };
   }
   return null;
 }
@@ -8356,6 +8510,7 @@ __export(index_exports, {
   CONTEXT_MIN_MESSAGES: () => CONTEXT_MIN_MESSAGES,
   COORDINATOR_TOOL_PLAYBOOK: () => COORDINATOR_TOOL_PLAYBOOK,
   FAMOUS_SOCCER_TEAMS: () => FAMOUS_SOCCER_TEAMS,
+  GITHUB_GIT_AUTH_MODES: () => GITHUB_GIT_AUTH_MODES,
   GLOBAL_WORKSPACE_ID: () => GLOBAL_WORKSPACE_ID,
   HARNESS_ENV_KEYS: () => HARNESS_ENV_KEYS,
   LEGACY_ATTACHMENTS_DIR: () => LEGACY_ATTACHMENTS_DIR,
@@ -8405,10 +8560,12 @@ __export(index_exports, {
   allocateTeamSlug: () => allocateTeamSlug,
   appDataDir: () => appDataDir,
   appSettingsPath: () => appSettingsPath,
+  appendIndexedGitConfig: () => appendIndexedGitConfig,
   appendMessage: () => appendMessage,
   applyAgentEvent: () => applyAgentEvent,
   applyAppEnvironment: () => applyAppEnvironment,
   applyCompaction: () => applyCompaction,
+  applyGithubGitAuthEnv: () => applyGithubGitAuthEnv,
   applyThreadIntoMain: () => applyThreadIntoMain,
   applyTurnUsage: () => applyTurnUsage,
   assertOrchestratorCapableAgent: () => assertOrchestratorCapableAgent,
@@ -8523,6 +8680,7 @@ __export(index_exports, {
   formatBrightsyFetchError: () => formatBrightsyFetchError,
   formatFetchError: () => formatFetchError,
   formatGhLandError: () => formatGhLandError,
+  formatGitAuthModeDirective: () => formatGitAuthModeDirective,
   formatIpcInvokeError: () => formatIpcInvokeError,
   formatMessagesAsTranscript: () => formatMessagesAsTranscript,
   formatPlanQuestionAnswers: () => formatPlanQuestionAnswers,
@@ -8549,6 +8707,8 @@ __export(index_exports, {
   getDiff: () => getDiff,
   getDiffSummary: () => getDiffSummary,
   getGitHubStatus: () => getGitHubStatus,
+  getGithubGitAuthMode: () => getGithubGitAuthMode,
+  getGithubPat: () => getGithubPat,
   getIssueSource: () => getIssueSource,
   getLinearApiKey: () => getLinearApiKey,
   getLinearAuthToken: () => getLinearAuthToken,
@@ -8567,6 +8727,7 @@ __export(index_exports, {
   ghHeadRef: () => ghHeadRef,
   ghRepoSelectArgs: () => ghRepoSelectArgs,
   git: () => git,
+  githubAgentGitEnv: () => githubAgentGitEnv,
   globalAgentCwd: () => globalAgentCwd,
   handleSlackInbound: () => handleSlackInbound,
   harnessEnvKey: () => harnessEnvKey,
@@ -8789,6 +8950,7 @@ __export(index_exports, {
   startSlackOAuth: () => startSlackOAuth,
   startSlackRelayServer: () => startSlackRelayServer,
   stripBrightsyNdjsonNoise: () => stripBrightsyNdjsonNoise,
+  stripNestedElectronEnv: () => stripNestedElectronEnv,
   submitPrStack: () => submitPrStack,
   suggestSlug: () => suggestSlug,
   summarizeConversation: () => summarizeConversation,
@@ -8847,6 +9009,7 @@ init_workspaces();
 init_global_workspace();
 init_run();
 init_gh_errors();
+init_git_auth_mode();
 init_worktree();
 init_stack();
 
@@ -9613,8 +9776,8 @@ function toolDetail(name, input) {
   if (!input) return void 0;
   const command = str2(input.command) ?? str2(input.cmd);
   if (command) return command;
-  const path = str2(input.file_path) ?? str2(input.path) ?? str2(input.filePath) ?? str2(input.filename);
-  if (path) return path;
+  const path2 = str2(input.file_path) ?? str2(input.path) ?? str2(input.filePath) ?? str2(input.filename);
+  if (path2) return path2;
   const pattern = str2(input.pattern) ?? str2(input.glob) ?? str2(input.glob_pattern);
   if (pattern) return pattern;
   const query = str2(input.query) ?? str2(input.prompt);
@@ -9658,12 +9821,12 @@ function toolDescription(name, input) {
     return "Run shell command";
   }
   if (/edit|write|apply/i.test(name)) {
-    const path = str2(input.file_path) ?? str2(input.path);
-    return path ? `Edit ${path.split("/").pop()}` : "Edit file";
+    const path2 = str2(input.file_path) ?? str2(input.path);
+    return path2 ? `Edit ${path2.split("/").pop()}` : "Edit file";
   }
   if (/read/i.test(name)) {
-    const path = str2(input.file_path) ?? str2(input.path);
-    return path ? `Read ${path.split("/").pop()}` : "Read file";
+    const path2 = str2(input.file_path) ?? str2(input.path);
+    return path2 ? `Read ${path2.split("/").pop()}` : "Read file";
   }
   if (/grep/i.test(name)) return "Search files";
   if (/glob/i.test(name)) return "Find files";
@@ -9892,8 +10055,13 @@ async function spawnAgentTurn(thread, input, onEvent) {
   }
   const env = childEnvWithAppSettings(cmd.env);
   if (!isOrchestratorThread(thread)) {
-    const originEnv = await originGhRepoEnv(thread.worktreePath).catch(() => ({}));
-    Object.assign(env, originEnv);
+    try {
+      const originEnv = await originGhRepoEnv(thread.worktreePath, { env });
+      Object.assign(env, originEnv);
+    } catch (err) {
+      const detail = err instanceof Error ? err.message : String(err);
+      console.warn(`[sideboard] originGhRepoEnv failed (${thread.worktreePath}): ${detail}`);
+    }
   }
   const child = (0, import_execa2.execa)(cmd.file, cmd.args, {
     cwd: cmd.cwd,
@@ -9983,6 +10151,7 @@ init_claude_mcp();
 // src/agents/instructions.ts
 var import_node_fs20 = require("fs");
 var import_node_path17 = require("path");
+init_git_auth_mode();
 init_worktree_labels();
 function normPath2(p) {
   return p.replace(/\/+$/, "");
@@ -10032,6 +10201,8 @@ function formatWorktreeDirective(thread, opts) {
   lines.push(
     "- Push with `git push -u origin HEAD` (or the current branch name). Do not `git push upstream`."
   );
+  lines.push("");
+  lines.push(formatGitAuthModeDirective(opts?.gitAuthMode ?? "auto"));
   lines.push(
     "- Derive the PR title and body from what the changes actually do and why \u2014 inspect the diff/commits and the user request. Do not use the soccer-team worktree nickname or placeholder branch as the PR title."
   );
@@ -10219,9 +10390,9 @@ function matchSimpleGlob(pattern, name) {
   return new RegExp(`^${escaped}$`).test(name);
 }
 function readWorktreeInclude(repoPath) {
-  const path = (0, import_node_path18.join)(repoPath, ".worktreeinclude");
-  if (!(0, import_node_fs21.existsSync)(path)) return [];
-  return (0, import_node_fs21.readFileSync)(path, "utf8").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
+  const path2 = (0, import_node_path18.join)(repoPath, ".worktreeinclude");
+  if (!(0, import_node_fs21.existsSync)(path2)) return [];
+  return (0, import_node_fs21.readFileSync)(path2, "utf8").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
 }
 function resolveFilesToCopy(repoPath) {
   const fromInclude = readWorktreeInclude(repoPath);
@@ -10296,8 +10467,20 @@ async function captureLoginEnv() {
   cachedLoginEnv = { ...process.env };
   return { ...cachedLoginEnv };
 }
+var NESTED_ELECTRON_ENV_PREFIXES = ["ELECTRON_", "CHROME_"];
+function stripNestedElectronEnv(env) {
+  const out = { ...env };
+  for (const key of Object.keys(out)) {
+    if (NESTED_ELECTRON_ENV_PREFIXES.some((prefix) => key.startsWith(prefix))) {
+      delete out[key];
+    }
+  }
+  return out;
+}
 function buildWorkspaceScriptEnv(opts, baseEnv) {
-  const env = { ...baseEnv ?? process.env };
+  const env = stripNestedElectronEnv({
+    ...baseEnv ?? process.env
+  });
   const name = opts.workspaceName ?? (0, import_node_path18.basename)(opts.worktreePath);
   const ports = opts.ports ?? [];
   const primary = ports[0];
@@ -10522,10 +10705,10 @@ var import_node_path19 = require("path");
 var import_execa4 = require("execa");
 var import_node_readline3 = require("readline");
 function loadCursorWorktreesJson(rootPath) {
-  const path = (0, import_node_path19.join)(rootPath, ".cursor", "worktrees.json");
-  if (!(0, import_node_fs22.existsSync)(path)) return null;
+  const path2 = (0, import_node_path19.join)(rootPath, ".cursor", "worktrees.json");
+  if (!(0, import_node_fs22.existsSync)(path2)) return null;
   try {
-    return JSON.parse((0, import_node_fs22.readFileSync)(path, "utf8"));
+    return JSON.parse((0, import_node_fs22.readFileSync)(path2, "utf8"));
   } catch {
     return null;
   }
@@ -10628,9 +10811,9 @@ function parseNameStatus(stdout) {
   const out = [];
   for (const line of stdout.split("\n").filter(Boolean)) {
     const [status, ...pathParts] = line.split("	");
-    const path = pathParts[pathParts.length - 1];
-    if (!status || !path) continue;
-    out.push({ status: status[0] ?? status, path });
+    const path2 = pathParts[pathParts.length - 1];
+    if (!status || !path2) continue;
+    out.push({ status: status[0] ?? status, path: path2 });
   }
   return out;
 }
@@ -10638,12 +10821,12 @@ function parseNumstat(stdout) {
   const map = /* @__PURE__ */ new Map();
   for (const line of stdout.split("\n").filter(Boolean)) {
     const [addRaw, delRaw, ...pathParts] = line.split("	");
-    const path = pathParts[pathParts.length - 1];
-    if (!path) continue;
+    const path2 = pathParts[pathParts.length - 1];
+    if (!path2) continue;
     const additions = addRaw === "-" ? 0 : Number(addRaw);
     const deletions = delRaw === "-" ? 0 : Number(delRaw);
     if (!Number.isFinite(additions) && !Number.isFinite(deletions)) continue;
-    map.set(path, {
+    map.set(path2, {
       additions: Number.isFinite(additions) ? additions : 0,
       deletions: Number.isFinite(deletions) ? deletions : 0
     });
@@ -10720,70 +10903,70 @@ function splitCombinedDiff(stdout) {
   }
   return map;
 }
-function syntheticAddPatch(path, content, maxHunk) {
+function syntheticAddPatch(path2, content, maxHunk) {
   const lines = content.split("\n");
   const body = lines.map((l) => `+${l}`).join("\n");
-  const header = `diff --git a/${path} b/${path}
+  const header = `diff --git a/${path2} b/${path2}
 new file mode 100644
 --- /dev/null
-+++ b/${path}
++++ b/${path2}
 @@ -0,0 +1,${lines.length} @@
 `;
   return {
-    path,
+    path: path2,
     status: "A",
     patch: capPatch(`${header}${body}`, maxHunk),
     additions: lines.length,
     deletions: 0
   };
 }
-async function untrackedPatch(worktreePath, path, maxHunk) {
-  const abs = (0, import_node_path20.join)(worktreePath, path);
+async function untrackedPatch(worktreePath, path2, maxHunk) {
+  const abs = (0, import_node_path20.join)(worktreePath, path2);
   try {
     const st = (0, import_node_fs23.statSync)(abs);
     if (st.isFile() && st.size > maxHunk) {
       const buf = (0, import_node_fs23.readFileSync)(abs).subarray(0, maxHunk);
-      return syntheticAddPatch(path, buf.toString("utf8"), maxHunk);
+      return syntheticAddPatch(path2, buf.toString("utf8"), maxHunk);
     }
   } catch {
   }
   const { stdout: patch } = await git(
-    ["diff", "--no-ext-diff", "--no-color", "--no-index", "--", "/dev/null", path],
+    ["diff", "--no-ext-diff", "--no-color", "--no-index", "--", "/dev/null", path2],
     worktreePath,
     { reject: false, timeoutMs: 4e3 }
   );
-  const normalized = patch.replace(/^diff --git a\/.+? b\/.+?$/m, `diff --git a/${path} b/${path}`).replace(/^--- .*$/m, "--- /dev/null").replace(/^\+\+\+ .*$/m, `+++ b/${path}`);
+  const normalized = patch.replace(/^diff --git a\/.+? b\/.+?$/m, `diff --git a/${path2} b/${path2}`).replace(/^--- .*$/m, "--- /dev/null").replace(/^\+\+\+ .*$/m, `+++ b/${path2}`);
   const addLines = normalized.split("\n").filter((l) => l.startsWith("+") && !l.startsWith("+++")).length;
   return {
-    path,
+    path: path2,
     status: "A",
     patch: capPatch(normalized, maxHunk),
     additions: addLines,
     deletions: 0
   };
 }
-async function listUntrackedPaths(worktreePath, path) {
+async function listUntrackedPaths(worktreePath, path2) {
   const args = ["ls-files", "-z", "--others", "--exclude-standard"];
-  if (path) args.push("--", path);
+  if (path2) args.push("--", path2);
   const { stdout } = await git(args, worktreePath, { reject: false });
   return stdout.split("\0").filter(Boolean).filter((p) => !isSideboardScratchPath(p));
 }
 async function listUntrackedFiles(worktreePath, maxHunk, paths) {
   const list = paths ?? await listUntrackedPaths(worktreePath);
   if (list.length === 0) return [];
-  return Promise.all(list.map((path) => untrackedPatch(worktreePath, path, maxHunk)));
+  return Promise.all(list.map((path2) => untrackedPatch(worktreePath, path2, maxHunk)));
 }
 function untrackedStubs(paths) {
-  return paths.map((path) => ({
-    path,
+  return paths.map((path2) => ({
+    path: path2,
     status: "A",
     patch: "",
     additions: 0,
     deletions: 0
   }));
 }
-function pathspec(path) {
-  return path ? ["--", path] : [];
+function pathspec(path2) {
+  return path2 ? ["--", path2] : [];
 }
 function gitDiff(args, cwd, opts) {
   return git(["diff", "--no-ext-diff", "--no-color", ...args], cwd, {
@@ -10791,7 +10974,7 @@ function gitDiff(args, cwd, opts) {
     timeoutMs: opts?.timeoutMs
   });
 }
-function fileFromPatch(path, patch, maxHunk) {
+function fileFromPatch(path2, patch, maxHunk) {
   let status = "M";
   if (/^new file mode /m.test(patch) || /^--- \/dev\/null/m.test(patch)) {
     status = "A";
@@ -10803,15 +10986,15 @@ function fileFromPatch(path, patch, maxHunk) {
   const additions = patch.split("\n").filter((l) => l.startsWith("+") && !l.startsWith("+++")).length;
   const deletions = patch.split("\n").filter((l) => l.startsWith("-") && !l.startsWith("---")).length;
   return {
-    path,
+    path: path2,
     status,
     patch: capPatch(patch, maxHunk),
     additions,
     deletions
   };
 }
-async function gitDiffParts(worktreePath, diffArgs, includePatches, path) {
-  const extra = pathspec(path);
+async function gitDiffParts(worktreePath, diffArgs, includePatches, path2) {
+  const extra = pathspec(path2);
   if (includePatches) {
     const diff = await gitDiff([...diffArgs, ...extra], worktreePath, {
       timeoutMs: 4e3
@@ -10849,17 +11032,17 @@ function filesFromDiff(nameStatus, numstat, combinedDiff, maxHunk) {
   const patches = splitCombinedDiff(combinedDiff);
   if (!nameStatus.trim() && patches.size > 0) {
     return [...patches.entries()].map(
-      ([path, patch]) => fileFromPatch(path, patch, maxHunk)
+      ([path2, patch]) => fileFromPatch(path2, patch, maxHunk)
     );
   }
   const counts = parseNumstat(numstat);
   const files = [];
-  for (const { status, path } of parseNameStatus(nameStatus)) {
-    const n = counts.get(path);
+  for (const { status, path: path2 } of parseNameStatus(nameStatus)) {
+    const n = counts.get(path2);
     files.push({
-      path,
+      path: path2,
       status,
-      patch: capPatch(patches.get(path) ?? "", maxHunk),
+      patch: capPatch(patches.get(path2) ?? "", maxHunk),
       additions: n?.additions,
       deletions: n?.deletions
     });
@@ -10943,7 +11126,7 @@ function emptyPathDiff(scope, base, hasLastTurnBase, commitSha = null) {
   };
 }
 async function getPathDiff(worktreePath, repoPath, opts) {
-  const { path, scope, commitSha, lastTurnBase, hasLastTurnBase, includePatches, maxHunk } = opts;
+  const { path: path2, scope, commitSha, lastTurnBase, hasLastTurnBase, includePatches, maxHunk } = opts;
   if (scope === "last_turn" && !lastTurnBase) {
     return emptyPathDiff(scope, "last turn", false);
   }
@@ -10982,7 +11165,7 @@ async function getPathDiff(worktreePath, repoPath, opts) {
     labelBase = "HEAD";
   }
   const diff = await gitDiff(
-    includePatches ? [...diffArgs, "--", path] : ["--name-status", ...diffArgs, "--", path],
+    includePatches ? [...diffArgs, "--", path2] : ["--name-status", ...diffArgs, "--", path2],
     worktreePath,
     { timeoutMs: 4e3 }
   );
@@ -10990,8 +11173,8 @@ async function getPathDiff(worktreePath, repoPath, opts) {
   if (includePatches) {
     const parsed = filesFromDiff("", "", diff.stdout, maxHunk);
     for (const file of parsed) filesMap.set(file.path, file);
-    if (diff.stdout.trim() && !filesMap.has(path)) {
-      filesMap.set(path, fileFromPatch(path, diff.stdout, maxHunk));
+    if (diff.stdout.trim() && !filesMap.has(path2)) {
+      filesMap.set(path2, fileFromPatch(path2, diff.stdout, maxHunk));
     }
   } else {
     for (const file of filesFromDiff(diff.stdout, "", "", maxHunk)) {
@@ -10999,7 +11182,7 @@ async function getPathDiff(worktreePath, repoPath, opts) {
     }
   }
   if (filesMap.size === 0) {
-    const maybe = await listUntrackedPaths(worktreePath, path);
+    const maybe = await listUntrackedPaths(worktreePath, path2);
     if (maybe.length > 0) {
       const extra = includePatches ? await listUntrackedFiles(worktreePath, maxHunk, maybe) : untrackedStubs(maybe);
       for (const file of extra) filesMap.set(file.path, file);
@@ -12025,8 +12208,8 @@ function splitForCompaction(messages, thresholds = {}) {
 function formatToolPart(t, detail) {
   if (detail === "summary") {
     const label = t.description || t.detail || t.name;
-    const path = t.filePath ? ` (${t.filePath})` : "";
-    return `- ${t.name}: ${label}${path}`;
+    const path2 = t.filePath ? ` (${t.filePath})` : "";
+    return `- ${t.name}: ${label}${path2}`;
   }
   const lines = [`#### Tool: ${t.name}`, `Status: ${t.status}`];
   if (t.description) lines.push(`Description: ${t.description}`);
@@ -13182,10 +13365,10 @@ function storePath2() {
   return (0, import_node_path24.join)(appDataDir(), "slack-reply-to.json");
 }
 function readStore2() {
-  const path = storePath2();
-  if (!(0, import_node_fs29.existsSync)(path)) return {};
+  const path2 = storePath2();
+  if (!(0, import_node_fs29.existsSync)(path2)) return {};
   try {
-    const parsed = isSecureFileEncrypted(path) ? readSecureJson(path) : JSON.parse((0, import_node_fs29.readFileSync)(path, "utf8"));
+    const parsed = isSecureFileEncrypted(path2) ? readSecureJson(path2) : JSON.parse((0, import_node_fs29.readFileSync)(path2, "utf8"));
     return parsed?.targets && typeof parsed.targets === "object" ? parsed.targets : {};
   } catch {
     return {};
@@ -13210,12 +13393,12 @@ function storePath3() {
 }
 function readStore3() {
   try {
-    const path = storePath3();
-    const wasEncrypted = isSecureFileEncrypted(path);
-    const parsed = readSecureJson(path);
+    const path2 = storePath3();
+    const wasEncrypted = isSecureFileEncrypted(path2);
+    const parsed = readSecureJson(path2);
     const workspaces = Array.isArray(parsed?.workspaces) ? parsed.workspaces : [];
     if (workspaces.length > 0 && !wasEncrypted && resolveVaultKey()) {
-      writeSecureJson(path, { workspaces });
+      writeSecureJson(path2, { workspaces });
     }
     return workspaces;
   } catch {
@@ -13351,10 +13534,10 @@ function tsNewer(a, b) {
   return Number(a) > Number(b);
 }
 function readStore4() {
-  const path = storePath4();
-  if (!(0, import_node_fs30.existsSync)(path)) return [];
+  const path2 = storePath4();
+  if (!(0, import_node_fs30.existsSync)(path2)) return [];
   try {
-    const parsed = isSecureFileEncrypted(path) ? readSecureJson(path) : JSON.parse((0, import_node_fs30.readFileSync)(path, "utf8"));
+    const parsed = isSecureFileEncrypted(path2) ? readSecureJson(path2) : JSON.parse((0, import_node_fs30.readFileSync)(path2, "utf8"));
     return Array.isArray(parsed?.watches) ? parsed.watches : [];
   } catch {
     return [];
@@ -13726,8 +13909,8 @@ init_worktree();
 init_thread_store();
 init_paths();
 init_app_settings();
-function isSideboardWorktreePath(path) {
-  return path.includes("/.sideboard/worktrees/") || path.includes("/sideboard/workspaces/");
+function isSideboardWorktreePath(path2) {
+  return path2.includes("/.sideboard/worktrees/") || path2.includes("/sideboard/workspaces/");
 }
 async function findOrphanWorktrees(repoPaths) {
   const threads = listThreads({ includeArchived: true });
@@ -13752,18 +13935,18 @@ async function findOrphanWorktrees(repoPaths) {
     try {
       const wts = await listWorktrees(repoPath);
       for (const wt of wts) {
-        const path = wt.path.replace(/\/$/, "");
-        if (!isSideboardWorktreePath(path)) continue;
-        if (known.has(path)) continue;
-        if (seen.has(path)) continue;
-        seen.add(path);
+        const path2 = wt.path.replace(/\/$/, "");
+        if (!isSideboardWorktreePath(path2)) continue;
+        if (known.has(path2)) continue;
+        if (seen.has(path2)) continue;
+        seen.add(path2);
         let mtimeMs = 0;
         try {
-          mtimeMs = (0, import_node_fs31.statSync)(path).mtimeMs;
+          mtimeMs = (0, import_node_fs31.statSync)(path2).mtimeMs;
         } catch {
           mtimeMs = 0;
         }
-        orphans.push({ path, repoPath, mtimeMs });
+        orphans.push({ path: path2, repoPath, mtimeMs });
       }
     } catch {
     }
@@ -13772,17 +13955,17 @@ async function findOrphanWorktrees(repoPaths) {
       if ((0, import_node_fs31.existsSync)(root)) {
         for (const entry of (0, import_node_fs31.readdirSync)(root, { withFileTypes: true })) {
           if (!entry.isDirectory()) continue;
-          const path = (0, import_node_path27.join)(root, entry.name).replace(/\/$/, "");
-          if (known.has(path) || seen.has(path)) continue;
-          if (!(0, import_node_fs31.existsSync)((0, import_node_path27.join)(path, ".git"))) continue;
-          seen.add(path);
+          const path2 = (0, import_node_path27.join)(root, entry.name).replace(/\/$/, "");
+          if (known.has(path2) || seen.has(path2)) continue;
+          if (!(0, import_node_fs31.existsSync)((0, import_node_path27.join)(path2, ".git"))) continue;
+          seen.add(path2);
           let mtimeMs = 0;
           try {
-            mtimeMs = (0, import_node_fs31.statSync)(path).mtimeMs;
+            mtimeMs = (0, import_node_fs31.statSync)(path2).mtimeMs;
           } catch {
             mtimeMs = Date.now();
           }
-          orphans.push({ path, repoPath, mtimeMs });
+          orphans.push({ path: path2, repoPath, mtimeMs });
         }
       }
     } catch {
@@ -14176,9 +14359,9 @@ function ensureReviewRequestFile(worktreePath) {
   const localAbs = (0, import_node_path29.join)(worktreePath, REVIEW_REQUEST_PATH);
   const localContent = readTextIfPresent(localAbs) ?? readTextIfPresent((0, import_node_path29.join)(worktreePath, LEGACY_REVIEW_REQUEST_PATH));
   if (localContent && !shouldRefreshReviewRequestTemplate(localContent)) {
-    const path = (0, import_node_fs33.existsSync)(localAbs) ? REVIEW_REQUEST_PATH : LEGACY_REVIEW_REQUEST_PATH;
+    const path2 = (0, import_node_fs33.existsSync)(localAbs) ? REVIEW_REQUEST_PATH : LEGACY_REVIEW_REQUEST_PATH;
     return {
-      path,
+      path: path2,
       name: REVIEW_REQUEST_NAME,
       content: localContent,
       source: "local"
@@ -14194,13 +14377,13 @@ function ensureReviewRequestFile(worktreePath) {
   };
 }
 function buildReviewRequestAttachment(content, opts) {
-  const path = opts?.path ?? REVIEW_REQUEST_PATH;
-  const name = opts?.name ?? (path === REPO_REVIEW_PATH ? REPO_REVIEW_NAME : REVIEW_REQUEST_NAME);
+  const path2 = opts?.path ?? REVIEW_REQUEST_PATH;
+  const name = opts?.name ?? (path2 === REPO_REVIEW_PATH ? REPO_REVIEW_NAME : REVIEW_REQUEST_NAME);
   return {
     id: (0, import_node_crypto8.randomUUID)(),
     name,
     kind: "file",
-    path,
+    path: path2,
     content
   };
 }
@@ -14920,14 +15103,16 @@ var Orchestrator = class {
     }
     const isBrightsy = fresh.agent === "brightsy";
     const isOrchestration = isOrchestratorThread(fresh);
+    const { autoRenameBranchEnabled: autoRenameBranchEnabled2, getGithubGitAuthMode: getGithubGitAuthMode2 } = await Promise.resolve().then(() => (init_app_settings(), app_settings_exports));
+    const gitAuthMode = getGithubGitAuthMode2();
     const worktreeDirective = isBrightsy || isOrchestration ? null : formatWorktreeDirective(fresh, {
       githubSlug: await resolveGithubRepoSlug(fresh.worktreePath).catch(
         () => null
-      )
+      ),
+      gitAuthMode
     });
     const artifactDirective = isBrightsy ? null : formatArtifactDirective();
     const settings = loadWorkspaceSettings(fresh.worktreePath, fresh.repoPath);
-    const { autoRenameBranchEnabled: autoRenameBranchEnabled2 } = await Promise.resolve().then(() => (init_app_settings(), app_settings_exports));
     const renameBranchDirective = !isBrightsy && !isOrchestration && autoRenameBranchEnabled2() ? formatRenameBranchDirective(fresh, {
       customPrompt: settings?.prompts?.renameBranch
     }) : null;
@@ -15764,8 +15949,9 @@ var Orchestrator = class {
     return tab;
   }
   /**
-   * Queue a desktop-git-button prompt on a worktree agent (commit/push/PR/merge).
-   * Orchestrators use this instead of running git/gh from the synthetic home.
+   * Desktop git buttons + MCP `ask_git`.
+   * When the worktree is clean, push / open the PR here (HTTPS via `gh` if SSH
+   * is missing). When dirty, queue the worktree agent to commit first.
    */
   async askGit(threadRef, action) {
     if (!AGENT_GIT_ACTIONS.includes(action)) {
@@ -15783,6 +15969,10 @@ var Orchestrator = class {
         "No pull request linked. Ask the worktree agent to open a draft PR first (ask_git create-draft)."
       );
     }
+    if ((action === "commit-push" || action === "create-draft" || action === "create-web") && thread.worktreePath?.trim() && !await isDirty(thread.worktreePath)) {
+      await this.pushAndMaybeOpenPr(thread, action);
+      return this.requireThread(threadRef);
+    }
     let prBase;
     if (action === "resolve-conflicts") {
       try {
@@ -15793,6 +15983,34 @@ var Orchestrator = class {
     }
     return this.send(threadRef, agentGitPrompt(action, { prBase }));
   }
+  /** Push origin (gh HTTPS fallback) and create/update the PR when requested. */
+  async pushAndMaybeOpenPr(thread, action) {
+    const cwd = thread.worktreePath;
+    const branch = await currentBranch(cwd);
+    await pushBranch(cwd, branch);
+    if (action === "commit-push") return;
+    const base = await resolveDefaultBranch(thread.repoPath);
+    const meta = await suggestPrMetadata(cwd, {
+      base,
+      fallbackTitle: thread.prTitle ?? thread.title
+    });
+    const url = await createOrUpdatePr(cwd, {
+      title: meta.title,
+      body: meta.body,
+      base,
+      head: branch,
+      draft: action === "create-draft",
+      web: action === "create-web"
+    });
+    if (!url) return;
+    const patch = { prUrl: url, prTitle: meta.title };
+    try {
+      const fetched = await getPrMeta(cwd, url);
+      if (fetched?.title) patch.prTitle = fetched.title;
+    } catch {
+    }
+    updateThread(thread.id, patch);
+  }
   setThreadOptions(threadRef, patch) {
     const thread = this.requireThread(threadRef);
     const next = {};
@@ -16373,9 +16591,9 @@ function labelGithubUrl(url) {
     return null;
   }
   if (!/(^|\.)github\.com$/i.test(parsed.hostname)) return null;
-  const path = parsed.pathname;
+  const path2 = parsed.pathname;
   const hash = parsed.hash || "";
-  const pr = path.match(/\/([^/]+)\/([^/]+)\/pull\/(\d+)/i);
+  const pr = path2.match(/\/([^/]+)\/([^/]+)\/pull\/(\d+)/i);
   if (pr) {
     const n = pr[3];
     if (/#discussion_r\d+/i.test(hash) || /#pullrequestreview-\d+/i.test(hash)) {
@@ -16386,11 +16604,11 @@ function labelGithubUrl(url) {
     }
     return { kind: "pr", label: `PR #${n}`, url: raw };
   }
-  const issueComment = path.match(/\/([^/]+)\/([^/]+)\/issues\/(\d+)/i);
+  const issueComment = path2.match(/\/([^/]+)\/([^/]+)\/issues\/(\d+)/i);
   if (issueComment && /#issuecomment-\d+/i.test(hash)) {
     return { kind: "comment", label: `Issue #${issueComment[3]} comment`, url: raw };
   }
-  const blob = path.match(/\/([^/]+)\/([^/]+)\/blob\/[^/]+\/(.+)$/i);
+  const blob = path2.match(/\/([^/]+)\/([^/]+)\/blob\/[^/]+\/(.+)$/i);
   if (blob) {
     const filePath = decodeURIComponent(blob[3]);
     const fileName = filePath.split("/").pop() || filePath;
@@ -16952,10 +17170,10 @@ async function startMcpServer() {
         const t = orch.getThread(thread_id.trim());
         if (t?.worktreePath?.trim()) root = t.worktreePath;
       }
-      const path = writePlanFile2(root, content);
+      const path2 = writePlanFile2(root, content);
       const payload = {
         ok: true,
-        path,
+        path: path2,
         title: title?.trim() || "Plan",
         message: "Plan saved to .context/attachments/plan.md and shown in Sideboard chat for approval."
       };
@@ -17379,7 +17597,7 @@ async function startMcpServer() {
     );
     server.tool(
       "ask_git",
-      "Tell a worktree agent to commit & push, open a draft PR, resolve conflicts, or merge the linked PR \u2014 same short prompts as the desktop git buttons. The worktree agent runs git/gh (`gh pr merge`); this only queues the prompt. Pass a worktree thread ref (not the orchestrator). Then wait_for_turn / get_turn_result. Do not run git or gh from the orchestration cwd.",
+      "Commit & push, open a draft PR, resolve conflicts, or merge \u2014 same actions as the desktop git buttons. When the worktree is clean, Sideboard pushes / opens the PR itself (HTTPS via `gh` if SSH is missing). When dirty, queues the worktree agent to commit; then wait_for_turn. Pass a worktree thread ref (not the orchestrator). Do not run git or gh from the orchestration cwd.",
       {
         ref: import_zod3.z.string().describe("Worktree thread id/ref"),
         action: import_zod3.z.enum(AGENT_GIT_ACTIONS).describe(
@@ -17852,9 +18070,9 @@ var BrightsySideboardApi = class {
   get endpoint() {
     return (this.cfg.endpoint || "https://brightsy.ai").replace(/\/$/, "");
   }
-  async request(path, init = {}) {
+  async request(path2, init = {}) {
     await this.refreshIfNeeded();
-    const url = `${this.endpoint}${path}`;
+    const url = `${this.endpoint}${path2}`;
     const headers = {
       Authorization: `Bearer ${this.cfg.access_token}`,
       Accept: "application/json"
@@ -19461,6 +19679,83 @@ var SlackRelayHub = class {
 // src/slack/relay-server.ts
 var import_node_http3 = require("http");
 var import_ws3 = require("ws");
+
+// src/slack/relay-static.ts
+var import_node_fs37 = require("fs");
+var import_promises = require("fs/promises");
+var import_node_path33 = __toESM(require("path"), 1);
+var TYPES = {
+  ".css": "text/css; charset=utf-8",
+  ".html": "text/html; charset=utf-8",
+  ".ico": "image/x-icon",
+  ".jpeg": "image/jpeg",
+  ".jpg": "image/jpeg",
+  ".js": "text/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".png": "image/png",
+  ".svg": "image/svg+xml",
+  ".txt": "text/plain; charset=utf-8",
+  ".webp": "image/webp",
+  ".woff2": "font/woff2"
+};
+function requestHostname(req) {
+  const raw = req.headers.host ?? "";
+  return raw.split(":")[0]?.toLowerCase() ?? "";
+}
+function hostnameAllowed(host, allowed) {
+  if (!allowed || allowed.length === 0) return true;
+  return allowed.includes(host);
+}
+function resolveStaticPath(root, requestUrl) {
+  let pathname;
+  try {
+    pathname = decodeURIComponent(new URL(requestUrl, "http://relay.local").pathname);
+  } catch {
+    return null;
+  }
+  if (!pathname.startsWith("/") || pathname.includes("\0")) return null;
+  const rootResolved = import_node_path33.default.resolve(root);
+  const candidate = import_node_path33.default.resolve(rootResolved, `.${pathname}`);
+  if (candidate !== rootResolved && !candidate.startsWith(rootResolved + import_node_path33.default.sep)) {
+    return null;
+  }
+  return candidate;
+}
+async function fileSize(file) {
+  try {
+    const st = await (0, import_promises.stat)(file);
+    return st.isFile() ? st.size : null;
+  } catch {
+    return null;
+  }
+}
+function sendFile(req, res, file, size) {
+  const ext = import_node_path33.default.extname(file).toLowerCase();
+  res.writeHead(200, {
+    "Content-Type": TYPES[ext] ?? "application/octet-stream",
+    "Content-Length": size,
+    "Cache-Control": ext === ".html" ? "no-cache" : "public, max-age=3600"
+  });
+  if (req.method === "HEAD") {
+    res.end();
+    return true;
+  }
+  (0, import_node_fs37.createReadStream)(file).pipe(res);
+  return true;
+}
+async function tryServeStatic(req, res, root) {
+  if (req.method !== "GET" && req.method !== "HEAD") return false;
+  const candidate = resolveStaticPath(root, req.url || "/");
+  if (!candidate) return false;
+  const direct = await fileSize(candidate);
+  if (direct != null) return sendFile(req, res, candidate, direct);
+  const asIndex = import_node_path33.default.join(candidate, "index.html");
+  const indexSize = await fileSize(asIndex);
+  if (indexSize != null) return sendFile(req, res, asIndex, indexSize);
+  return false;
+}
+
+// src/slack/relay-server.ts
 function sendHtml(res, status, title, body) {
   res.writeHead(status, { "Content-Type": "text/html; charset=utf-8" });
   res.end(slackOAuthHtmlPage(title, body));
@@ -19559,7 +19854,26 @@ async function startSlackRelayServer(opts) {
       const reqUrl = req.url || "/";
       if (await handleCallback(reqUrl, res)) return;
       if (handleResult(reqUrl, res)) return;
-      if (req.url === "/health" || req.url === "/") {
+      if (req.url === "/health") {
+        sendJson(res, 200, {
+          ok: true,
+          service: "sideboard-slack-relay",
+          sessions: hub.listSessions().length,
+          oauth: Boolean(clientSecret)
+        });
+        return;
+      }
+      const hostname2 = requestHostname(req);
+      const canonical = (opts.canonicalSiteHost ?? "www.sideboard.cloud").toLowerCase();
+      if (opts.redirectHosts?.includes(hostname2) && hostname2 !== canonical) {
+        res.writeHead(301, { Location: `https://${canonical}${reqUrl}` });
+        res.end();
+        return;
+      }
+      if (opts.staticRoot && hostnameAllowed(hostname2, opts.staticHosts) && await tryServeStatic(req, res, opts.staticRoot)) {
+        return;
+      }
+      if (req.url === "/") {
         sendJson(res, 200, {
           ok: true,
           service: "sideboard-slack-relay",
@@ -19669,6 +19983,7 @@ async function startSlackRelayServer(opts) {
   CONTEXT_MIN_MESSAGES,
   COORDINATOR_TOOL_PLAYBOOK,
   FAMOUS_SOCCER_TEAMS,
+  GITHUB_GIT_AUTH_MODES,
   GLOBAL_WORKSPACE_ID,
   HARNESS_ENV_KEYS,
   LEGACY_ATTACHMENTS_DIR,
@@ -19718,10 +20033,12 @@ async function startSlackRelayServer(opts) {
   allocateTeamSlug,
   appDataDir,
   appSettingsPath,
+  appendIndexedGitConfig,
   appendMessage,
   applyAgentEvent,
   applyAppEnvironment,
   applyCompaction,
+  applyGithubGitAuthEnv,
   applyThreadIntoMain,
   applyTurnUsage,
   assertOrchestratorCapableAgent,
@@ -19836,6 +20153,7 @@ async function startSlackRelayServer(opts) {
   formatBrightsyFetchError,
   formatFetchError,
   formatGhLandError,
+  formatGitAuthModeDirective,
   formatIpcInvokeError,
   formatMessagesAsTranscript,
   formatPlanQuestionAnswers,
@@ -19862,6 +20180,8 @@ async function startSlackRelayServer(opts) {
   getDiff,
   getDiffSummary,
   getGitHubStatus,
+  getGithubGitAuthMode,
+  getGithubPat,
   getIssueSource,
   getLinearApiKey,
   getLinearAuthToken,
@@ -19880,6 +20200,7 @@ async function startSlackRelayServer(opts) {
   ghHeadRef,
   ghRepoSelectArgs,
   git,
+  githubAgentGitEnv,
   globalAgentCwd,
   handleSlackInbound,
   harnessEnvKey,
@@ -20102,6 +20423,7 @@ async function startSlackRelayServer(opts) {
   startSlackOAuth,
   startSlackRelayServer,
   stripBrightsyNdjsonNoise,
+  stripNestedElectronEnv,
   submitPrStack,
   suggestSlug,
   summarizeConversation,