@sideboard-ai/core 0.1.77 → 0.1.81

package/dist/{agents-LKUHPPEQ.js → agents-EBKJ55PN.js}

@@ -32,16 +32,16 @@ import {
   resolveCursorModelId,
   resolveLoginCommand,
   resolveQuotaFallbackAgent
-} from "./chunk-2FJI5JXX.js";
+} from "./chunk-4AVU4QXO.js";
 import "./chunk-VROPG6QF.js";
 import {
   ORCHESTRATOR_AGENT_KINDS,
   assertOrchestratorCapableAgent,
   coerceOrchestratorAgent,
   isOrchestratorCapableAgent
-} from "./chunk-GWTLKXXP.js";
-import "./chunk-XJNCWYFR.js";
-import "./chunk-OE7YBB5X.js";
+} from "./chunk-P5VDPGAN.js";
+import "./chunk-4HJK57XU.js";
+import "./chunk-FUUVPN4A.js";
 import "./chunk-B3SJXYIJ.js";
 import "./chunk-7FD7COKE.js";
 import {
@@ -53,7 +53,7 @@ import {
   resolveCommandBinarySync,
   withExportedPath
 } from "./chunk-AE5VBOFE.js";
-import "./chunk-PTJJIQK7.js";
+import "./chunk-XKNBSYA7.js";
 import "./chunk-NSTQ6QKD.js";
 import "./chunk-KGZBYWZ3.js";
 import "./chunk-7MV3RXSC.js";

package/dist/{agents-XJV6J3K2.js → agents-UQ7D6U6L.js}

@@ -28,23 +28,23 @@ import {
   resolveCursorModelId,
   resolveLoginCommand,
   resolveQuotaFallbackAgent
-} from "./chunk-QD37IILI.js";
+} from "./chunk-XNECBC6T.js";
 import {
   ORCHESTRATOR_AGENT_KINDS,
   assertOrchestratorCapableAgent,
   coerceOrchestratorAgent,
   isOrchestratorCapableAgent
-} from "./chunk-VERLUKN2.js";
-import "./chunk-EEKSZTMU.js";
+} from "./chunk-6F2TQFJE.js";
+import "./chunk-CQBQWX73.js";
 import "./chunk-BTL7EMGT.js";
 import {
   cursorSdkMessageToEvents,
   parseCursorRunnerLine
 } from "./chunk-SEOICVGB.js";
-import "./chunk-W7YOTDVO.js";
-import "./chunk-JT7R45JB.js";
-import "./chunk-MF2YMEGD.js";
+import "./chunk-YVVXWWCC.js";
 import "./chunk-FKOIHGKV.js";
+import "./chunk-IFPN6TER.js";
+import "./chunk-JT7R45JB.js";
 import "./chunk-FWJYLBO6.js";
 import "./chunk-77WWLBCI.js";
 import "./chunk-M37RITA6.js";

package/dist/{app-settings-3TLA2EJ7.js → app-settings-6IOQYGBK.js}

@@ -1,4 +1,5 @@
 import {
+  GITHUB_GIT_AUTH_MODES,
   HARNESS_ENV_KEYS,
   appSettingsPath,
   applyAppEnvironment,
@@ -22,6 +23,8 @@ import {
   getDefaultEffort,
   getDefaultFast,
   getDefaultModel,
+  getGithubGitAuthMode,
+  getGithubPat,
   getIssueSource,
   getLinearApiKey,
   harnessEnvKey,
@@ -49,11 +52,12 @@ import {
   updateDefaultsSettings,
   updateIntegrationsSettings,
   updateOpencodeSettings
-} from "./chunk-W7YOTDVO.js";
+} from "./chunk-IFPN6TER.js";
 import "./chunk-JT7R45JB.js";
 import "./chunk-77WWLBCI.js";
 import "./chunk-M37RITA6.js";
 export {
+  GITHUB_GIT_AUTH_MODES,
   HARNESS_ENV_KEYS,
   appSettingsPath,
   applyAppEnvironment,
@@ -77,6 +81,8 @@ export {
   getDefaultEffort,
   getDefaultFast,
   getDefaultModel,
+  getGithubGitAuthMode,
+  getGithubPat,
   getIssueSource,
   getLinearApiKey,
   harnessEnvKey,

package/dist/{app-settings-P42Z3VOB.js → app-settings-NILNWNNQ.js}

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 
 import {
+  GITHUB_GIT_AUTH_MODES,
   HARNESS_ENV_KEYS,
   appSettingsPath,
   applyAppEnvironment,
@@ -24,6 +25,8 @@ import {
   getDefaultEffort,
   getDefaultFast,
   getDefaultModel,
+  getGithubGitAuthMode,
+  getGithubPat,
   getIssueSource,
   getLinearApiKey,
   harnessEnvKey,
@@ -51,11 +54,12 @@ import {
   updateDefaultsSettings,
   updateIntegrationsSettings,
   updateOpencodeSettings
-} from "./chunk-PTJJIQK7.js";
+} from "./chunk-XKNBSYA7.js";
 import "./chunk-NSTQ6QKD.js";
 import "./chunk-KGZBYWZ3.js";
 import "./chunk-7MV3RXSC.js";
 export {
+  GITHUB_GIT_AUTH_MODES,
   HARNESS_ENV_KEYS,
   appSettingsPath,
   applyAppEnvironment,
@@ -79,6 +83,8 @@ export {
   getDefaultEffort,
   getDefaultFast,
   getDefaultModel,
+  getGithubGitAuthMode,
+  getGithubPat,
   getIssueSource,
   getLinearApiKey,
   harnessEnvKey,

package/dist/{chunk-2FJI5JXX.js → chunk-4AVU4QXO.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-VROPG6QF.js";
 import {
   isOrchestratorThread
-} from "./chunk-GWTLKXXP.js";
+} from "./chunk-P5VDPGAN.js";
 import {
   enrichPathWithNpmGlobalBin,
   isConductorBundledCli,
@@ -22,7 +22,7 @@ import {
   loadAppSettings,
   resolveAgentExecutable,
   resolveClaudeExecutable
-} from "./chunk-PTJJIQK7.js";
+} from "./chunk-XKNBSYA7.js";
 import {
   appDataDir
 } from "./chunk-7MV3RXSC.js";
@@ -30,6 +30,46 @@ import {
 // src/agents/brightsy.ts
 import { existsSync } from "fs";
 
+// src/agents/usage.ts
+function sumOptional(a, b) {
+  if (a == null && b == null) return void 0;
+  return (a ?? 0) + (b ?? 0);
+}
+function fromInclusiveInputUsage(opts) {
+  const totalInput = Number(opts.inputTokens) || 0;
+  const outputTokens = Number(opts.outputTokens) || 0;
+  const cached = Number(opts.cachedInputTokens) || 0;
+  if (!totalInput && !outputTokens) return null;
+  const cacheReadTokens = cached > 0 ? Math.min(cached, totalInput) : 0;
+  return {
+    inputTokens: Math.max(0, totalInput - cacheReadTokens),
+    outputTokens,
+    cacheReadTokens: cacheReadTokens || void 0
+  };
+}
+function requestOccupancy(u) {
+  return u.inputTokens + (u.cacheReadTokens ?? 0) + (u.cacheWriteTokens ?? 0);
+}
+function mergeUsage(a, b) {
+  return {
+    inputTokens: (a?.inputTokens ?? 0) + b.inputTokens,
+    outputTokens: (a?.outputTokens ?? 0) + b.outputTokens,
+    cacheReadTokens: sumOptional(a?.cacheReadTokens, b.cacheReadTokens),
+    cacheWriteTokens: sumOptional(a?.cacheWriteTokens, b.cacheWriteTokens),
+    lastRequestTokens: b.lastRequestTokens ?? a?.lastRequestTokens
+  };
+}
+function applyTurnUsage(current, incoming, scope = "request") {
+  if (scope === "turn") {
+    return {
+      ...incoming,
+      lastRequestTokens: current?.lastRequestTokens ?? requestOccupancy(incoming)
+    };
+  }
+  const merged = mergeUsage(current, incoming);
+  return { ...merged, lastRequestTokens: requestOccupancy(incoming) };
+}
+
 // src/agents/brightsy-targets.ts
 function encodeBrightsyTarget(type, id, accountId) {
   if (accountId) return `team:${accountId}:${type}:${id}`;
@@ -205,15 +245,11 @@ ${prompt}`;
 // src/agents/brightsy.ts
 function usageFromBrightsy(usage) {
   if (!usage) return null;
-  const inputTokens = Number(usage.prompt_tokens ?? 0);
-  const outputTokens = Number(usage.completion_tokens ?? 0);
-  if (!inputTokens && !outputTokens) return null;
-  const cached = Number(usage.prompt_tokens_details?.cached_tokens ?? 0);
-  return {
-    inputTokens,
-    outputTokens,
-    cacheReadTokens: cached || void 0
-  };
+  return fromInclusiveInputUsage({
+    inputTokens: Number(usage.prompt_tokens ?? 0),
+    outputTokens: Number(usage.completion_tokens ?? 0),
+    cachedInputTokens: Number(usage.prompt_tokens_details?.cached_tokens ?? 0)
+  });
 }
 function parseBrightsyCliLine(line) {
   const trimmed = line.trim();
@@ -1009,7 +1045,7 @@ var claudeAdapter = {
       );
     }
     const mode = permissionMode(thread);
-    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-TWHMYLTZ.js");
+    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-NUMUJRWG.js");
     const isOrchestrator = isOrchestratorThread2(thread);
     const injectedServers = await buildInjectedMcpServers({
       includeSideboard: true,
@@ -1260,14 +1296,11 @@ async function listCodexModels() {
 }
 function usageFromCodex(usage) {
   if (!usage) return null;
-  const inputTokens = Number(usage.input_tokens ?? 0);
-  const outputTokens = Number(usage.output_tokens ?? 0) + Number(usage.reasoning_output_tokens ?? 0);
-  if (!inputTokens && !outputTokens) return null;
-  return {
-    inputTokens,
-    outputTokens,
-    cacheReadTokens: usage.cached_input_tokens ? Number(usage.cached_input_tokens) : void 0
-  };
+  return fromInclusiveInputUsage({
+    inputTokens: Number(usage.input_tokens ?? 0),
+    outputTokens: Number(usage.output_tokens ?? 0),
+    cachedInputTokens: Number(usage.cached_input_tokens ?? 0)
+  });
 }
 function codexConfigHasNetworkAccess() {
   const candidates = [
@@ -2577,6 +2610,7 @@ export {
   fallbackTurnFailDetail,
   humanizeAgentFailDetail,
   formatTurnExitError,
+  applyTurnUsage,
   encodeBrightsyTarget,
   decodeBrightsyTarget,
   parseBrightsyCliLine,

package/dist/{chunk-XJNCWYFR.js → chunk-4HJK57XU.js}

@@ -2,10 +2,10 @@
 
 import {
   resolveGithubRepoSlug
-} from "./chunk-OE7YBB5X.js";
+} from "./chunk-FUUVPN4A.js";
 import {
   resolveThreadDefaults
-} from "./chunk-PTJJIQK7.js";
+} from "./chunk-XKNBSYA7.js";
 import {
   globalAgentCwd,
   sideboardReposDir
@@ -70,7 +70,8 @@ var COORDINATOR_TOOL_PLAYBOOK = [
   "Inspect / review / PRs:",
   "- get_diff \u2014 compact diff summary",
   '- request_review \u2014 open a Review chat tab on a worktree thread (attaches .sideboard/review.md when present, else local guidelines; sends "Review changes in this workspace."); then wait_for_turn / get_turn_result on the returned id',
-  "- ask_git \u2014 tell a worktree agent to commit & push, open a draft PR, resolve conflicts, or merge (`Merge PR.`). You only queue that prompt \u2014 the worktree agent runs git/gh (including `gh pr merge`). Then wait_for_turn. Prefer this over paraphrasing.",
+  "- ask_git \u2014 commit & push, open a draft PR, resolve conflicts, or merge. When the worktree is clean, Sideboard pushes / opens the PR itself. When dirty, it queues the worktree agent \u2014 then wait_for_turn. Prefer this over paraphrasing.",
+  '- Merge (`ask_git` action=merge / send_to_thread "Merge PR.") only when the user explicitly asked to merge that PR. Do not merge because the work looks done, CI is green, or a typical flow includes it.',
   '- Or send_to_thread with those exact phrases: "Commit and push.", "Commit, push, and open a draft PR.", "Fix merge conflicts.", "Merge PR." (draft PRs: `gh pr create --draft -R <origin-owner/name>` using the workspace `github:` slug \u2014 never upstream). Never run git/gh from this orchestration cwd, and never merge the PR yourself.',
   "Human-only (do not attempt): ready-for-review land (confirm_land), purge_thread.",
   "Thread links in replies: when mentioning a chat/thread for the user, include a markdown link `[Title](sideboard://thread/<id>)` using the full id (or the link field from create_thread / list_threads). Sideboard renders these as clickable opens.",
@@ -101,7 +102,7 @@ function coordinatorTurnReminder(opts) {
     goal ? `- Goal / title: ${goal}` : null,
     accountDefaultsPlaybookLine(),
     `- For "what's going on": call list_threads (and list_workspaces if needed). Summarize fleet status \u2014 do not ls/git-status this synthetic home.`,
-    "- Existing repo: create_thread on a repoPath \u2192 send_to_thread \u2192 wait_for_turn. Land with ask_git (commit-push / create-draft / merge) on the child, then wait_for_turn \u2014 never git/gh from this cwd.",
+    "- Existing repo: create_thread on a repoPath \u2192 send_to_thread \u2192 wait_for_turn. Commit/push/draft PR with ask_git on the child, then wait_for_turn \u2014 never git/gh from this cwd. Call ask_git merge only if the user explicitly asked to merge.",
     "- New repo: Bash (clone or gh repo create under ~/sideboard/repos/<name>) \u2192 add_workspace \u2192 create_thread \u2192 send_to_thread \u2192 wait_for_turn \u2192 ask_git create-draft.",
     "- When naming threads for the user, link them as `[Title](sideboard://thread/<id>)`.",
     "- If they will wait on Slack or leave the Mac, call set_caffeinate enabled=true. When they say they are done / wrapping up / going to sleep, call set_caffeinate enabled=false. Closing this chat also turns it off."
@@ -155,9 +156,9 @@ function ensureGlobalCoordinatorCwd(opts) {
     orchId ? `Pass parentThreadId="${orchId}" (or omit it). Never invent another parentThreadId.` : "Pass `parentThreadId` for children (this chat's id from the turn reminder).",
     "Omit `agent` / `model` on `create_thread` unless you have a reason to override Account defaults.",
     "Never pass `agent=codex` when you yourself are Codex \u2014 nested Codex deadlocks on shared ~/.codex locks. Omit agent (Account default) or use cursor/claude.",
-    "Typical flow (existing): list_workspaces \u2192 list_branches|list_prs|list_issues \u2192 create_thread \u2192 send_to_thread \u2192 wait_for_turn \u2192 ask_git create-draft \u2192 wait_for_turn \u2192 (when ready) ask_git merge \u2192 wait_for_turn.",
+    "Typical flow (existing): list_workspaces \u2192 list_branches|list_prs|list_issues \u2192 create_thread \u2192 send_to_thread \u2192 wait_for_turn \u2192 ask_git create-draft \u2192 wait_for_turn. Merge only if the user explicitly asked (`ask_git` merge).",
     "Typical flow (new app): Bash create/clone under repos dir \u2192 add_workspace \u2192 create_thread \u2192 send_to_thread (implement) \u2192 wait_for_turn \u2192 ask_git create-draft.",
-    "Always ask worktree agents to commit, push, open draft PRs, and merge (`ask_git` / `send_to_thread`). The worktree agent runs git/gh; never merge from this orchestration cwd."
+    "Always ask worktree agents to commit, push, and open draft PRs (`ask_git` / `send_to_thread`). Tell them to merge only when the user explicitly asked. The worktree agent runs git/gh; never merge from this orchestration cwd."
   ].join("\n");
   try {
     writeFileSync(join(dir, "CLAUDE.md"), `${body}
@@ -170,7 +171,6 @@ function ensureGlobalCoordinatorCwd(opts) {
 }
 function coordinatorSystemPrompt(opts) {
   const audience = opts.audience ?? "cloud";
-  const reposDir = sideboardReposDir();
   const intro = audience === "cloud" ? [
     "You are a Sideboard coordinator responding to a request from a Brightsy cloud agent (Discord, Teams, or other chat).",
     "Your reply will be sent back to that cloud agent \u2014 be concise and actionable."
@@ -188,14 +188,8 @@ function coordinatorSystemPrompt(opts) {
     ...intro,
     "You operate across ALL registered workspaces below.",
     "You have no project git home \u2014 this process cwd is synthetic and empty on purpose.",
-    COORDINATOR_TOOL_PLAYBOOK,
-    accountDefaultsPlaybookLine(),
-    coordinatorGreenfieldPlaybook(reposDir),
-    "When creating threads, pass the correct repoPath for the target workspace.",
+    "Follow AGENTS.md / CLAUDE.md in this cwd for the fleet playbook (they are the same document).",
     `YOUR orchestration thread id is ${opts.parentId} \u2014 pass parentThreadId="${opts.parentId}" on create_thread, or omit parentThreadId (Sideboard binds it). Never invent a uuid.`,
-    "Omit agent/model on create_thread unless you need to override Account defaults.",
-    "Typical flow (existing): list_workspaces \u2192 list_branches|list_prs|list_issues \u2192 create_thread \u2192 send_to_thread (implement) \u2192 wait_for_turn \u2192 ask_git create-draft \u2192 wait_for_turn \u2192 (when ready) ask_git merge \u2192 wait_for_turn. Never target upstream. Never git/gh from this orchestration cwd.",
-    "Typical flow (new app): Bash under repos dir (clone or gh repo create) \u2192 add_workspace \u2192 create_thread \u2192 send_to_thread \u2192 wait_for_turn \u2192 ask_git create-draft.",
     `Goal: ${opts.goal}`,
     "Registered workspaces:",
     formatWorkspaceInventory(opts.workspaces)

package/dist/{chunk-VERLUKN2.js → chunk-6F2TQFJE.js}

@@ -1,15 +1,15 @@
 import {
   ensureGlobalCoordinatorCwd
-} from "./chunk-EEKSZTMU.js";
-import {
-  resolveNewThreadOptions,
-  resolveThreadDefaults
-} from "./chunk-W7YOTDVO.js";
+} from "./chunk-CQBQWX73.js";
 import {
   allocateTeamName,
   takenSlugsFromThread,
   teamSlugFromName
-} from "./chunk-MF2YMEGD.js";
+} from "./chunk-YVVXWWCC.js";
+import {
+  resolveNewThreadOptions,
+  resolveThreadDefaults
+} from "./chunk-IFPN6TER.js";
 import {
   createEmptyThread,
   listThreads,

package/dist/{chunk-EEKSZTMU.js → chunk-CQBQWX73.js}

@@ -1,9 +1,9 @@
-import {
-  resolveThreadDefaults
-} from "./chunk-W7YOTDVO.js";
 import {
   resolveGithubRepoSlug
-} from "./chunk-MF2YMEGD.js";
+} from "./chunk-YVVXWWCC.js";
+import {
+  resolveThreadDefaults
+} from "./chunk-IFPN6TER.js";
 import {
   globalAgentCwd,
   sideboardReposDir
@@ -68,7 +68,8 @@ var COORDINATOR_TOOL_PLAYBOOK = [
   "Inspect / review / PRs:",
   "- get_diff \u2014 compact diff summary",
   '- request_review \u2014 open a Review chat tab on a worktree thread (attaches .sideboard/review.md when present, else local guidelines; sends "Review changes in this workspace."); then wait_for_turn / get_turn_result on the returned id',
-  "- ask_git \u2014 tell a worktree agent to commit & push, open a draft PR, resolve conflicts, or merge (`Merge PR.`). You only queue that prompt \u2014 the worktree agent runs git/gh (including `gh pr merge`). Then wait_for_turn. Prefer this over paraphrasing.",
+  "- ask_git \u2014 commit & push, open a draft PR, resolve conflicts, or merge. When the worktree is clean, Sideboard pushes / opens the PR itself. When dirty, it queues the worktree agent \u2014 then wait_for_turn. Prefer this over paraphrasing.",
+  '- Merge (`ask_git` action=merge / send_to_thread "Merge PR.") only when the user explicitly asked to merge that PR. Do not merge because the work looks done, CI is green, or a typical flow includes it.',
   '- Or send_to_thread with those exact phrases: "Commit and push.", "Commit, push, and open a draft PR.", "Fix merge conflicts.", "Merge PR." (draft PRs: `gh pr create --draft -R <origin-owner/name>` using the workspace `github:` slug \u2014 never upstream). Never run git/gh from this orchestration cwd, and never merge the PR yourself.',
   "Human-only (do not attempt): ready-for-review land (confirm_land), purge_thread.",
   "Thread links in replies: when mentioning a chat/thread for the user, include a markdown link `[Title](sideboard://thread/<id>)` using the full id (or the link field from create_thread / list_threads). Sideboard renders these as clickable opens.",
@@ -99,7 +100,7 @@ function coordinatorTurnReminder(opts) {
     goal ? `- Goal / title: ${goal}` : null,
     accountDefaultsPlaybookLine(),
     `- For "what's going on": call list_threads (and list_workspaces if needed). Summarize fleet status \u2014 do not ls/git-status this synthetic home.`,
-    "- Existing repo: create_thread on a repoPath \u2192 send_to_thread \u2192 wait_for_turn. Land with ask_git (commit-push / create-draft / merge) on the child, then wait_for_turn \u2014 never git/gh from this cwd.",
+    "- Existing repo: create_thread on a repoPath \u2192 send_to_thread \u2192 wait_for_turn. Commit/push/draft PR with ask_git on the child, then wait_for_turn \u2014 never git/gh from this cwd. Call ask_git merge only if the user explicitly asked to merge.",
     "- New repo: Bash (clone or gh repo create under ~/sideboard/repos/<name>) \u2192 add_workspace \u2192 create_thread \u2192 send_to_thread \u2192 wait_for_turn \u2192 ask_git create-draft.",
     "- When naming threads for the user, link them as `[Title](sideboard://thread/<id>)`.",
     "- If they will wait on Slack or leave the Mac, call set_caffeinate enabled=true. When they say they are done / wrapping up / going to sleep, call set_caffeinate enabled=false. Closing this chat also turns it off."
@@ -153,9 +154,9 @@ function ensureGlobalCoordinatorCwd(opts) {
     orchId ? `Pass parentThreadId="${orchId}" (or omit it). Never invent another parentThreadId.` : "Pass `parentThreadId` for children (this chat's id from the turn reminder).",
     "Omit `agent` / `model` on `create_thread` unless you have a reason to override Account defaults.",
     "Never pass `agent=codex` when you yourself are Codex \u2014 nested Codex deadlocks on shared ~/.codex locks. Omit agent (Account default) or use cursor/claude.",
-    "Typical flow (existing): list_workspaces \u2192 list_branches|list_prs|list_issues \u2192 create_thread \u2192 send_to_thread \u2192 wait_for_turn \u2192 ask_git create-draft \u2192 wait_for_turn \u2192 (when ready) ask_git merge \u2192 wait_for_turn.",
+    "Typical flow (existing): list_workspaces \u2192 list_branches|list_prs|list_issues \u2192 create_thread \u2192 send_to_thread \u2192 wait_for_turn \u2192 ask_git create-draft \u2192 wait_for_turn. Merge only if the user explicitly asked (`ask_git` merge).",
     "Typical flow (new app): Bash create/clone under repos dir \u2192 add_workspace \u2192 create_thread \u2192 send_to_thread (implement) \u2192 wait_for_turn \u2192 ask_git create-draft.",
-    "Always ask worktree agents to commit, push, open draft PRs, and merge (`ask_git` / `send_to_thread`). The worktree agent runs git/gh; never merge from this orchestration cwd."
+    "Always ask worktree agents to commit, push, and open draft PRs (`ask_git` / `send_to_thread`). Tell them to merge only when the user explicitly asked. The worktree agent runs git/gh; never merge from this orchestration cwd."
   ].join("\n");
   try {
     writeFileSync(join(dir, "CLAUDE.md"), `${body}
@@ -168,7 +169,6 @@ function ensureGlobalCoordinatorCwd(opts) {
 }
 function coordinatorSystemPrompt(opts) {
   const audience = opts.audience ?? "cloud";
-  const reposDir = sideboardReposDir();
   const intro = audience === "cloud" ? [
     "You are a Sideboard coordinator responding to a request from a Brightsy cloud agent (Discord, Teams, or other chat).",
     "Your reply will be sent back to that cloud agent \u2014 be concise and actionable."
@@ -186,14 +186,8 @@ function coordinatorSystemPrompt(opts) {
     ...intro,
     "You operate across ALL registered workspaces below.",
     "You have no project git home \u2014 this process cwd is synthetic and empty on purpose.",
-    COORDINATOR_TOOL_PLAYBOOK,
-    accountDefaultsPlaybookLine(),
-    coordinatorGreenfieldPlaybook(reposDir),
-    "When creating threads, pass the correct repoPath for the target workspace.",
+    "Follow AGENTS.md / CLAUDE.md in this cwd for the fleet playbook (they are the same document).",
     `YOUR orchestration thread id is ${opts.parentId} \u2014 pass parentThreadId="${opts.parentId}" on create_thread, or omit parentThreadId (Sideboard binds it). Never invent a uuid.`,
-    "Omit agent/model on create_thread unless you need to override Account defaults.",
-    "Typical flow (existing): list_workspaces \u2192 list_branches|list_prs|list_issues \u2192 create_thread \u2192 send_to_thread (implement) \u2192 wait_for_turn \u2192 ask_git create-draft \u2192 wait_for_turn \u2192 (when ready) ask_git merge \u2192 wait_for_turn. Never target upstream. Never git/gh from this orchestration cwd.",
-    "Typical flow (new app): Bash under repos dir (clone or gh repo create) \u2192 add_workspace \u2192 create_thread \u2192 send_to_thread \u2192 wait_for_turn \u2192 ask_git create-draft.",
     `Goal: ${opts.goal}`,
     "Registered workspaces:",
     formatWorkspaceInventory(opts.workspaces)

package/dist/{chunk-OE7YBB5X.js → chunk-FUUVPN4A.js}

@@ -11,6 +11,10 @@ import {
   git,
   resolveGhAuthToken
 } from "./chunk-AE5VBOFE.js";
+import {
+  getGithubGitAuthMode,
+  getGithubPat
+} from "./chunk-XKNBSYA7.js";
 import {
   worktreesRoot
 } from "./chunk-7MV3RXSC.js";
@@ -881,6 +885,74 @@ function formatGhLandError(raw, opts) {
   return detail || "Failed to create or update pull request";
 }
 
+// src/git/git-auth-mode.ts
+var HTTPS_REWRITE = [
+  { key: "url.https://github.com/.insteadOf", value: "git@github.com:" },
+  { key: "url.https://github.com/.insteadOf", value: "ssh://git@github.com/" },
+  { key: "credential.https://github.com.helper", value: "!gh auth git-credential" }
+];
+function appendIndexedGitConfig(existing, entries) {
+  const start = Number.parseInt(String(existing?.GIT_CONFIG_COUNT ?? "0"), 10);
+  const count = Number.isFinite(start) && start > 0 ? start : 0;
+  const out = {};
+  entries.forEach((entry, i) => {
+    const n = count + i;
+    out[`GIT_CONFIG_KEY_${n}`] = entry.key;
+    out[`GIT_CONFIG_VALUE_${n}`] = entry.value;
+  });
+  out.GIT_CONFIG_COUNT = String(count + entries.length);
+  return out;
+}
+function githubAgentGitEnv(existing) {
+  return appendIndexedGitConfig(existing, HTTPS_REWRITE);
+}
+function applyGithubGitAuthEnv(existing, opts) {
+  const out = {};
+  if (opts.mode === "gh" || opts.mode === "token") {
+    Object.assign(out, githubAgentGitEnv(existing));
+  }
+  if (opts.mode === "token") {
+    const token = opts.token?.trim();
+    if (token && !existing?.GH_TOKEN?.trim()) {
+      out.GH_TOKEN = token;
+    }
+  }
+  return out;
+}
+function formatGitAuthModeDirective(mode) {
+  switch (mode) {
+    case "gh":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: gh CLI):",
+        "- This process rewrites `git@github.com:` and `ssh://git@github.com/` to HTTPS.",
+        "- `gh` supplies credentials (`gh auth git-credential`). Do not switch remotes to SSH.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
+      ].join("\n");
+    case "ssh":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: SSH):",
+        "- Keep SSH remotes (`git@github.com:\u2026`). Do not rewrite them to HTTPS.",
+        "- Use this Mac\u2019s SSH agent / keys. If push fails with `Permission denied (publickey)`, tell the user to start ssh-agent or switch Account \u2192 GitHub to Auto / gh CLI \u2014 do not rewrite remotes yourself.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below (API still uses `gh`)."
+      ].join("\n");
+    case "token":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: personal access token):",
+        "- This process rewrites GitHub SSH remotes to HTTPS.",
+        "- `GH_TOKEN` is set in the environment. Use HTTPS git and `gh`; do not paste the token into commands or chat.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
+      ].join("\n");
+    case "auto":
+    default:
+      return [
+        "Git authentication (Account \u2192 GitHub mode: auto):",
+        "- Prefer the existing remote URL (SSH or HTTPS). Do not rewrite remotes unless a push/fetch fails.",
+        '- If `git push` fails with `Permission denied (publickey)`, this shell has no ssh-agent. Retry over HTTPS (do not stop): `git -c url.https://github.com/.insteadOf=git@github.com: -c http.extraHeader="AUTHORIZATION: bearer $(gh auth token)" push -u origin HEAD`.',
+        "- Then create/update the PR with `gh` as below."
+      ].join("\n");
+  }
+}
+
 // src/git/pr-gates.ts
 function prIsInMergeQueue(gate) {
   if (gate.isInMergeQueue) return true;
@@ -1253,10 +1325,15 @@ ${view.stderr}`;
     timeoutMs: 15e3
   });
 }
-async function originGhRepoEnv(cwd) {
+async function originGhRepoEnv(cwd, opts) {
   await ensureGhPreferOrigin(cwd);
   const slug = await resolveGithubRepoSlug(cwd);
-  return slug ? { GH_REPO: slug } : {};
+  const mode = opts?.mode ?? getGithubGitAuthMode();
+  const token = mode === "token" ? getGithubPat() : null;
+  return {
+    ...applyGithubGitAuthEnv(opts?.env, { mode, token }),
+    ...slug ? { GH_REPO: slug } : {}
+  };
 }
 async function resolveDefaultBranch(repoPath, opts) {
   const viaOrigin = await git(
@@ -2005,7 +2082,33 @@ async function commitAll(worktreePath, message) {
   return true;
 }
 async function pushBranch(worktreePath, branchName) {
-  await git(["push", "-u", "origin", branchName], worktreePath);
+  const ssh = await git(["push", "-u", "origin", branchName], worktreePath, {
+    reject: false
+  });
+  if (ssh.exitCode === 0) return;
+  const sshErr = (ssh.stderr || ssh.stdout).trim();
+  const slug = await resolveGithubRepoSlug(worktreePath);
+  const token = await resolveGhAuthToken(worktreePath);
+  if (!slug || !token) {
+    throw new Error(
+      sshErr || `git push origin ${branchName} failed` + (!token ? " (no SSH agent and gh auth token unavailable \u2014 run: gh auth login)" : "")
+    );
+  }
+  const tryHttps = async (header) => git(["push", "-u", "origin", branchName], worktreePath, {
+    reject: false,
+    env: { GIT_TERMINAL_PROMPT: "0" },
+    config: {
+      "url.https://github.com/.insteadOf": "git@github.com:",
+      "http.extraHeader": header
+    }
+  });
+  const bearer = await tryHttps(`AUTHORIZATION: bearer ${token}`);
+  if (bearer.exitCode === 0) return;
+  const basic = Buffer.from(`x-access-token:${token}`, "utf8").toString("base64");
+  const basicPush = await tryHttps(`Authorization: Basic ${basic}`);
+  if (basicPush.exitCode === 0) return;
+  const httpsErr = (basicPush.stderr || bearer.stderr || bearer.stdout).trim();
+  throw new Error(httpsErr || sshErr || `git push origin ${branchName} failed`);
 }
 async function mergePr(cwd, selector, opts) {
   const slug = await resolveGithubRepoSlug(cwd);
@@ -2214,6 +2317,8 @@ export {
   worktreeDisplayLabel,
   worktreeDisplayLabelForGroup,
   formatGhLandError,
+  githubAgentGitEnv,
+  formatGitAuthModeDirective,
   detectGhStack,
   getPrStack,
   initPrStack,