@sideboard-ai/core 0.1.77 → 0.1.81

package/dist/{chunk-W7YOTDVO.js → chunk-IFPN6TER.js}

@@ -187,6 +187,9 @@ function normalizeVault(raw) {
   if (typeof raw.slackAppToken === "string" && raw.slackAppToken.trim()) {
     out.slackAppToken = raw.slackAppToken.trim();
   }
+  if (typeof raw.githubPat === "string" && raw.githubPat.trim()) {
+    out.githubPat = raw.githubPat.trim();
+  }
   if (raw.environment && typeof raw.environment === "object") {
     const environment = {};
     for (const [key, value] of Object.entries(raw.environment)) {
@@ -214,6 +217,7 @@ var DEFAULT_AGENTS = /* @__PURE__ */ new Set([
   "brightsy",
   "cursor"
 ]);
+var GITHUB_GIT_AUTH_MODES = ["auto", "gh", "ssh", "token"];
 function hasLinearOAuth(integrations) {
   return Boolean(
     integrations.linearAccessToken?.trim() || integrations.linearRefreshToken?.trim()
@@ -230,12 +234,14 @@ function toPublicAppSettings(settings) {
   const integrations = { ...settings.integrations };
   const slackClientSecret = integrations.slackClientSecret;
   const slackAppToken = integrations.slackAppToken;
+  const githubPat = integrations.githubPat;
   delete integrations.linearApiKey;
   delete integrations.linearAccessToken;
   delete integrations.linearRefreshToken;
   delete integrations.linearClientSecret;
   delete integrations.slackClientSecret;
   delete integrations.slackAppToken;
+  delete integrations.githubPat;
   return {
     ...settings,
     environment,
@@ -244,7 +250,8 @@ function toPublicAppSettings(settings) {
       hasLinearApiKey: hasLinearCredentials(settings.integrations),
       hasLinearOAuth: hasLinearOAuth(settings.integrations),
       hasSlackClientSecret: Boolean(slackClientSecret?.trim()),
-      hasSlackAppToken: Boolean(slackAppToken?.trim())
+      hasSlackAppToken: Boolean(slackAppToken?.trim()),
+      hasGithubPat: Boolean(githubPat?.trim())
     }
   };
 }
@@ -303,6 +310,7 @@ function normalizeBrightsy(raw) {
   return out;
 }
 var ISSUE_SOURCES = /* @__PURE__ */ new Set(["linear", "github"]);
+var GIT_AUTH_MODES = new Set(GITHUB_GIT_AUTH_MODES);
 function normalizeIntegrations(raw) {
   if (!raw || typeof raw !== "object") return {};
   const source = raw;
@@ -367,6 +375,13 @@ function normalizeIntegrations(raw) {
     const label = source.slackDeviceLabel.trim().slice(0, 64);
     if (label) out.slackDeviceLabel = label;
   }
+  if (typeof source.githubGitAuthMode === "string" && GIT_AUTH_MODES.has(source.githubGitAuthMode)) {
+    out.githubGitAuthMode = source.githubGitAuthMode;
+  }
+  if (typeof source.githubPat === "string") {
+    const pat = source.githubPat.trim();
+    if (pat) out.githubPat = pat;
+  }
   return out;
 }
 function normalizeDefaults(raw) {
@@ -516,7 +531,7 @@ function readSettingsFile() {
 }
 function diskHoldsSecrets(disk) {
   return Boolean(
-    disk.integrations.linearApiKey || disk.integrations.linearAccessToken || disk.integrations.linearRefreshToken || disk.integrations.linearClientSecret || disk.integrations.slackClientSecret || disk.integrations.slackAppToken || Object.keys(disk.environment).length > 0
+    disk.integrations.linearApiKey || disk.integrations.linearAccessToken || disk.integrations.linearRefreshToken || disk.integrations.linearClientSecret || disk.integrations.slackClientSecret || disk.integrations.slackAppToken || disk.integrations.githubPat || Object.keys(disk.environment).length > 0
   );
 }
 function mergeVault(disk) {
@@ -541,6 +556,9 @@ function mergeVault(disk) {
   if (vault.slackAppToken && !integrations.slackAppToken) {
     integrations.slackAppToken = vault.slackAppToken;
   }
+  if (vault.githubPat && !integrations.githubPat) {
+    integrations.githubPat = vault.githubPat;
+  }
   return { ...disk, environment, integrations };
 }
 function persistSplit(settings) {
@@ -551,12 +569,14 @@ function persistSplit(settings) {
   const linearClientSecret = integrations.linearClientSecret;
   const slackClientSecret = integrations.slackClientSecret;
   const slackAppToken = integrations.slackAppToken;
+  const githubPat = integrations.githubPat;
   delete integrations.linearApiKey;
   delete integrations.linearAccessToken;
   delete integrations.linearRefreshToken;
   delete integrations.linearClientSecret;
   delete integrations.slackClientSecret;
   delete integrations.slackAppToken;
+  delete integrations.githubPat;
   writePrivateFile(
     appSettingsPath(),
     `${JSON.stringify({ ...settings, environment: {}, integrations }, null, 2)}
@@ -569,6 +589,7 @@ function persistSplit(settings) {
     linearClientSecret,
     slackClientSecret,
     slackAppToken,
+    githubPat,
     environment: settings.environment
   });
 }
@@ -734,6 +755,20 @@ function updateIntegrationsSettings(patch) {
       integrations.slackDeviceLabel = patch.slackDeviceLabel.trim().slice(0, 64);
     }
   }
+  if ("githubGitAuthMode" in patch) {
+    if (patch.githubGitAuthMode == null) {
+      delete integrations.githubGitAuthMode;
+    } else if (GIT_AUTH_MODES.has(patch.githubGitAuthMode)) {
+      integrations.githubGitAuthMode = patch.githubGitAuthMode;
+    }
+  }
+  if ("githubPat" in patch) {
+    if (patch.githubPat == null || patch.githubPat.trim() === "") {
+      delete integrations.githubPat;
+    } else {
+      integrations.githubPat = patch.githubPat.trim();
+    }
+  }
   return saveAppSettings({ ...current, integrations });
 }
 function updateDefaultsSettings(patch) {
@@ -841,6 +876,13 @@ function disconnectLinearConnection() {
 function getIssueSource(settings = loadAppSettings()) {
   return settings.integrations.issueSource ?? "github";
 }
+function getGithubGitAuthMode(settings = loadAppSettings()) {
+  return settings.integrations.githubGitAuthMode ?? "auto";
+}
+function getGithubPat(settings = loadAppSettings()) {
+  const pat = settings.integrations.githubPat?.trim();
+  return pat || null;
+}
 function resolveEffectiveIssueSource(settings = loadAppSettings()) {
   const preferred = getIssueSource(settings);
   if (preferred === "linear" && !isLinearConnected(settings)) return "github";
@@ -1058,6 +1100,7 @@ export {
   isSecureFileEncrypted,
   secureFileUnlocksWith,
   HARNESS_ENV_KEYS,
+  GITHUB_GIT_AUTH_MODES,
   toPublicAppSettings,
   appSettingsPath,
   claudeUserSettingsPath,
@@ -1080,6 +1123,8 @@ export {
   saveLinearOAuth,
   disconnectLinearConnection,
   getIssueSource,
+  getGithubGitAuthMode,
+  getGithubPat,
   resolveEffectiveIssueSource,
   getLinearApiKey,
   brightsyCloudConnectEnabled,

package/dist/{chunk-75U65MBE.js → chunk-K553XK7M.js}

@@ -1,10 +1,10 @@
 import {
   isGlobalRepoPath
-} from "./chunk-VERLUKN2.js";
+} from "./chunk-6F2TQFJE.js";
 import {
   ensureGhPreferOrigin,
   resolveRepoRoot
-} from "./chunk-MF2YMEGD.js";
+} from "./chunk-YVVXWWCC.js";
 import {
   appDataDir
 } from "./chunk-M37RITA6.js";

package/dist/{chunk-GWTLKXXP.js → chunk-P5VDPGAN.js}

@@ -2,12 +2,12 @@
 
 import {
   ensureGlobalCoordinatorCwd
-} from "./chunk-XJNCWYFR.js";
+} from "./chunk-4HJK57XU.js";
 import {
   allocateTeamName,
   takenSlugsFromThread,
   teamSlugFromName
-} from "./chunk-OE7YBB5X.js";
+} from "./chunk-FUUVPN4A.js";
 import {
   createEmptyThread,
   listThreads,
@@ -17,7 +17,7 @@ import {
 import {
   resolveNewThreadOptions,
   resolveThreadDefaults
-} from "./chunk-PTJJIQK7.js";
+} from "./chunk-XKNBSYA7.js";
 import {
   globalAgentCwd
 } from "./chunk-7MV3RXSC.js";

package/dist/{chunk-2ZIPJRJE.js → chunk-TDJ43HUD.js}

@@ -2,11 +2,11 @@
 
 import {
   isGlobalRepoPath
-} from "./chunk-GWTLKXXP.js";
+} from "./chunk-P5VDPGAN.js";
 import {
   ensureGhPreferOrigin,
   resolveRepoRoot
-} from "./chunk-OE7YBB5X.js";
+} from "./chunk-FUUVPN4A.js";
 import {
   appDataDir
 } from "./chunk-7MV3RXSC.js";

package/dist/{chunk-PTJJIQK7.js → chunk-XKNBSYA7.js}

@@ -172,6 +172,9 @@ function normalizeVault(raw) {
   if (typeof raw.slackAppToken === "string" && raw.slackAppToken.trim()) {
     out.slackAppToken = raw.slackAppToken.trim();
   }
+  if (typeof raw.githubPat === "string" && raw.githubPat.trim()) {
+    out.githubPat = raw.githubPat.trim();
+  }
   if (raw.environment && typeof raw.environment === "object") {
     const environment = {};
     for (const [key, value] of Object.entries(raw.environment)) {
@@ -199,6 +202,7 @@ var DEFAULT_AGENTS = /* @__PURE__ */ new Set([
   "brightsy",
   "cursor"
 ]);
+var GITHUB_GIT_AUTH_MODES = ["auto", "gh", "ssh", "token"];
 function hasLinearOAuth(integrations) {
   return Boolean(
     integrations.linearAccessToken?.trim() || integrations.linearRefreshToken?.trim()
@@ -215,12 +219,14 @@ function toPublicAppSettings(settings) {
   const integrations = { ...settings.integrations };
   const slackClientSecret = integrations.slackClientSecret;
   const slackAppToken = integrations.slackAppToken;
+  const githubPat = integrations.githubPat;
   delete integrations.linearApiKey;
   delete integrations.linearAccessToken;
   delete integrations.linearRefreshToken;
   delete integrations.linearClientSecret;
   delete integrations.slackClientSecret;
   delete integrations.slackAppToken;
+  delete integrations.githubPat;
   return {
     ...settings,
     environment,
@@ -229,7 +235,8 @@ function toPublicAppSettings(settings) {
       hasLinearApiKey: hasLinearCredentials(settings.integrations),
       hasLinearOAuth: hasLinearOAuth(settings.integrations),
       hasSlackClientSecret: Boolean(slackClientSecret?.trim()),
-      hasSlackAppToken: Boolean(slackAppToken?.trim())
+      hasSlackAppToken: Boolean(slackAppToken?.trim()),
+      hasGithubPat: Boolean(githubPat?.trim())
     }
   };
 }
@@ -288,6 +295,7 @@ function normalizeBrightsy(raw) {
   return out;
 }
 var ISSUE_SOURCES = /* @__PURE__ */ new Set(["linear", "github"]);
+var GIT_AUTH_MODES = new Set(GITHUB_GIT_AUTH_MODES);
 function normalizeIntegrations(raw) {
   if (!raw || typeof raw !== "object") return {};
   const source = raw;
@@ -352,6 +360,13 @@ function normalizeIntegrations(raw) {
     const label = source.slackDeviceLabel.trim().slice(0, 64);
     if (label) out.slackDeviceLabel = label;
   }
+  if (typeof source.githubGitAuthMode === "string" && GIT_AUTH_MODES.has(source.githubGitAuthMode)) {
+    out.githubGitAuthMode = source.githubGitAuthMode;
+  }
+  if (typeof source.githubPat === "string") {
+    const pat = source.githubPat.trim();
+    if (pat) out.githubPat = pat;
+  }
   return out;
 }
 function normalizeDefaults(raw) {
@@ -501,7 +516,7 @@ function readSettingsFile() {
 }
 function diskHoldsSecrets(disk) {
   return Boolean(
-    disk.integrations.linearApiKey || disk.integrations.linearAccessToken || disk.integrations.linearRefreshToken || disk.integrations.linearClientSecret || disk.integrations.slackClientSecret || disk.integrations.slackAppToken || Object.keys(disk.environment).length > 0
+    disk.integrations.linearApiKey || disk.integrations.linearAccessToken || disk.integrations.linearRefreshToken || disk.integrations.linearClientSecret || disk.integrations.slackClientSecret || disk.integrations.slackAppToken || disk.integrations.githubPat || Object.keys(disk.environment).length > 0
   );
 }
 function mergeVault(disk) {
@@ -526,6 +541,9 @@ function mergeVault(disk) {
   if (vault.slackAppToken && !integrations.slackAppToken) {
     integrations.slackAppToken = vault.slackAppToken;
   }
+  if (vault.githubPat && !integrations.githubPat) {
+    integrations.githubPat = vault.githubPat;
+  }
   return { ...disk, environment, integrations };
 }
 function persistSplit(settings) {
@@ -536,12 +554,14 @@ function persistSplit(settings) {
   const linearClientSecret = integrations.linearClientSecret;
   const slackClientSecret = integrations.slackClientSecret;
   const slackAppToken = integrations.slackAppToken;
+  const githubPat = integrations.githubPat;
   delete integrations.linearApiKey;
   delete integrations.linearAccessToken;
   delete integrations.linearRefreshToken;
   delete integrations.linearClientSecret;
   delete integrations.slackClientSecret;
   delete integrations.slackAppToken;
+  delete integrations.githubPat;
   writePrivateFile(
     appSettingsPath(),
     `${JSON.stringify({ ...settings, environment: {}, integrations }, null, 2)}
@@ -554,6 +574,7 @@ function persistSplit(settings) {
     linearClientSecret,
     slackClientSecret,
     slackAppToken,
+    githubPat,
     environment: settings.environment
   });
 }
@@ -719,6 +740,20 @@ function updateIntegrationsSettings(patch) {
       integrations.slackDeviceLabel = patch.slackDeviceLabel.trim().slice(0, 64);
     }
   }
+  if ("githubGitAuthMode" in patch) {
+    if (patch.githubGitAuthMode == null) {
+      delete integrations.githubGitAuthMode;
+    } else if (GIT_AUTH_MODES.has(patch.githubGitAuthMode)) {
+      integrations.githubGitAuthMode = patch.githubGitAuthMode;
+    }
+  }
+  if ("githubPat" in patch) {
+    if (patch.githubPat == null || patch.githubPat.trim() === "") {
+      delete integrations.githubPat;
+    } else {
+      integrations.githubPat = patch.githubPat.trim();
+    }
+  }
   return saveAppSettings({ ...current, integrations });
 }
 function updateDefaultsSettings(patch) {
@@ -826,6 +861,13 @@ function disconnectLinearConnection() {
 function getIssueSource(settings = loadAppSettings()) {
   return settings.integrations.issueSource ?? "github";
 }
+function getGithubGitAuthMode(settings = loadAppSettings()) {
+  return settings.integrations.githubGitAuthMode ?? "auto";
+}
+function getGithubPat(settings = loadAppSettings()) {
+  const pat = settings.integrations.githubPat?.trim();
+  return pat || null;
+}
 function resolveEffectiveIssueSource(settings = loadAppSettings()) {
   const preferred = getIssueSource(settings);
   if (preferred === "linear" && !isLinearConnected(settings)) return "github";
@@ -1039,6 +1081,7 @@ export {
   writeSecureJson,
   isSecureFileEncrypted,
   HARNESS_ENV_KEYS,
+  GITHUB_GIT_AUTH_MODES,
   toPublicAppSettings,
   appSettingsPath,
   claudeUserSettingsPath,
@@ -1061,6 +1104,8 @@ export {
   saveLinearOAuth,
   disconnectLinearConnection,
   getIssueSource,
+  getGithubGitAuthMode,
+  getGithubPat,
   resolveEffectiveIssueSource,
   getLinearApiKey,
   brightsyCloudConnectEnabled,

package/dist/{chunk-QD37IILI.js → chunk-XNECBC6T.js}

@@ -1,6 +1,6 @@
 import {
   isOrchestratorThread
-} from "./chunk-VERLUKN2.js";
+} from "./chunk-6F2TQFJE.js";
 import {
   applyConnectedTeamToCli,
   brightsyMcpServerName,
@@ -19,7 +19,7 @@ import {
   loadAppSettings,
   resolveAgentExecutable,
   resolveClaudeExecutable
-} from "./chunk-W7YOTDVO.js";
+} from "./chunk-IFPN6TER.js";
 import {
   appDataDir
 } from "./chunk-M37RITA6.js";
@@ -34,6 +34,53 @@ import {
 // src/agents/brightsy.ts
 import { existsSync } from "fs";
 
+// src/agents/usage.ts
+function sumOptional(a, b) {
+  if (a == null && b == null) return void 0;
+  return (a ?? 0) + (b ?? 0);
+}
+function fromInclusiveInputUsage(opts) {
+  const totalInput = Number(opts.inputTokens) || 0;
+  const outputTokens = Number(opts.outputTokens) || 0;
+  const cached = Number(opts.cachedInputTokens) || 0;
+  if (!totalInput && !outputTokens) return null;
+  const cacheReadTokens = cached > 0 ? Math.min(cached, totalInput) : 0;
+  return {
+    inputTokens: Math.max(0, totalInput - cacheReadTokens),
+    outputTokens,
+    cacheReadTokens: cacheReadTokens || void 0
+  };
+}
+function requestOccupancy(u) {
+  return u.inputTokens + (u.cacheReadTokens ?? 0) + (u.cacheWriteTokens ?? 0);
+}
+function mergeUsage(a, b) {
+  return {
+    inputTokens: (a?.inputTokens ?? 0) + b.inputTokens,
+    outputTokens: (a?.outputTokens ?? 0) + b.outputTokens,
+    cacheReadTokens: sumOptional(a?.cacheReadTokens, b.cacheReadTokens),
+    cacheWriteTokens: sumOptional(a?.cacheWriteTokens, b.cacheWriteTokens),
+    lastRequestTokens: b.lastRequestTokens ?? a?.lastRequestTokens
+  };
+}
+function applyTurnUsage(current, incoming, scope = "request") {
+  if (scope === "turn") {
+    return {
+      ...incoming,
+      lastRequestTokens: current?.lastRequestTokens ?? requestOccupancy(incoming)
+    };
+  }
+  const merged = mergeUsage(current, incoming);
+  return { ...merged, lastRequestTokens: requestOccupancy(incoming) };
+}
+function totalTokens(u) {
+  return u.inputTokens + u.outputTokens + (u.cacheReadTokens ?? 0) + (u.cacheWriteTokens ?? 0);
+}
+function contextTokens(u) {
+  if (u.lastRequestTokens != null && u.lastRequestTokens > 0) return u.lastRequestTokens;
+  return requestOccupancy(u);
+}
+
 // src/agents/brightsy-targets.ts
 function encodeBrightsyTarget(type, id, accountId) {
   if (accountId) return `team:${accountId}:${type}:${id}`;
@@ -131,15 +178,11 @@ var MAX_ANTHROPIC_CACHE_CONTROL_BLOCKS = 4;
 // src/agents/brightsy.ts
 function usageFromBrightsy(usage) {
   if (!usage) return null;
-  const inputTokens = Number(usage.prompt_tokens ?? 0);
-  const outputTokens = Number(usage.completion_tokens ?? 0);
-  if (!inputTokens && !outputTokens) return null;
-  const cached = Number(usage.prompt_tokens_details?.cached_tokens ?? 0);
-  return {
-    inputTokens,
-    outputTokens,
-    cacheReadTokens: cached || void 0
-  };
+  return fromInclusiveInputUsage({
+    inputTokens: Number(usage.prompt_tokens ?? 0),
+    outputTokens: Number(usage.completion_tokens ?? 0),
+    cachedInputTokens: Number(usage.prompt_tokens_details?.cached_tokens ?? 0)
+  });
 }
 function parseBrightsyCliLine(line) {
   const trimmed = line.trim();
@@ -949,7 +992,7 @@ var claudeAdapter = {
       );
     }
     const mode = permissionMode(thread);
-    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-YNMNO4CL.js");
+    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-DZM4ZFGU.js");
     const isOrchestrator = isOrchestratorThread2(thread);
     const injectedServers = await buildInjectedMcpServers({
       includeSideboard: true,
@@ -1200,14 +1243,11 @@ async function listCodexModels() {
 }
 function usageFromCodex(usage) {
   if (!usage) return null;
-  const inputTokens = Number(usage.input_tokens ?? 0);
-  const outputTokens = Number(usage.output_tokens ?? 0) + Number(usage.reasoning_output_tokens ?? 0);
-  if (!inputTokens && !outputTokens) return null;
-  return {
-    inputTokens,
-    outputTokens,
-    cacheReadTokens: usage.cached_input_tokens ? Number(usage.cached_input_tokens) : void 0
-  };
+  return fromInclusiveInputUsage({
+    inputTokens: Number(usage.input_tokens ?? 0),
+    outputTokens: Number(usage.output_tokens ?? 0),
+    cachedInputTokens: Number(usage.cached_input_tokens ?? 0)
+  });
 }
 function codexConfigHasNetworkAccess() {
   const candidates = [
@@ -2339,6 +2379,12 @@ function allAdapters() {
 }
 
 export {
+  fromInclusiveInputUsage,
+  requestOccupancy,
+  mergeUsage,
+  applyTurnUsage,
+  totalTokens,
+  contextTokens,
   encodeBrightsyTarget,
   decodeBrightsyTarget,
   normalizeTurnInput,

package/dist/{chunk-MF2YMEGD.js → chunk-YVVXWWCC.js}

@@ -1,6 +1,10 @@
 import {
   isWorkspaceScratchPath
 } from "./chunk-FKOIHGKV.js";
+import {
+  getGithubGitAuthMode,
+  getGithubPat
+} from "./chunk-IFPN6TER.js";
 import {
   listThreads
 } from "./chunk-FWJYLBO6.js";
@@ -886,6 +890,74 @@ function formatIpcInvokeError(err) {
   return formatGhLandError(msg);
 }
 
+// src/git/git-auth-mode.ts
+var HTTPS_REWRITE = [
+  { key: "url.https://github.com/.insteadOf", value: "git@github.com:" },
+  { key: "url.https://github.com/.insteadOf", value: "ssh://git@github.com/" },
+  { key: "credential.https://github.com.helper", value: "!gh auth git-credential" }
+];
+function appendIndexedGitConfig(existing, entries) {
+  const start = Number.parseInt(String(existing?.GIT_CONFIG_COUNT ?? "0"), 10);
+  const count = Number.isFinite(start) && start > 0 ? start : 0;
+  const out = {};
+  entries.forEach((entry, i) => {
+    const n = count + i;
+    out[`GIT_CONFIG_KEY_${n}`] = entry.key;
+    out[`GIT_CONFIG_VALUE_${n}`] = entry.value;
+  });
+  out.GIT_CONFIG_COUNT = String(count + entries.length);
+  return out;
+}
+function githubAgentGitEnv(existing) {
+  return appendIndexedGitConfig(existing, HTTPS_REWRITE);
+}
+function applyGithubGitAuthEnv(existing, opts) {
+  const out = {};
+  if (opts.mode === "gh" || opts.mode === "token") {
+    Object.assign(out, githubAgentGitEnv(existing));
+  }
+  if (opts.mode === "token") {
+    const token = opts.token?.trim();
+    if (token && !existing?.GH_TOKEN?.trim()) {
+      out.GH_TOKEN = token;
+    }
+  }
+  return out;
+}
+function formatGitAuthModeDirective(mode) {
+  switch (mode) {
+    case "gh":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: gh CLI):",
+        "- This process rewrites `git@github.com:` and `ssh://git@github.com/` to HTTPS.",
+        "- `gh` supplies credentials (`gh auth git-credential`). Do not switch remotes to SSH.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
+      ].join("\n");
+    case "ssh":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: SSH):",
+        "- Keep SSH remotes (`git@github.com:\u2026`). Do not rewrite them to HTTPS.",
+        "- Use this Mac\u2019s SSH agent / keys. If push fails with `Permission denied (publickey)`, tell the user to start ssh-agent or switch Account \u2192 GitHub to Auto / gh CLI \u2014 do not rewrite remotes yourself.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below (API still uses `gh`)."
+      ].join("\n");
+    case "token":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: personal access token):",
+        "- This process rewrites GitHub SSH remotes to HTTPS.",
+        "- `GH_TOKEN` is set in the environment. Use HTTPS git and `gh`; do not paste the token into commands or chat.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
+      ].join("\n");
+    case "auto":
+    default:
+      return [
+        "Git authentication (Account \u2192 GitHub mode: auto):",
+        "- Prefer the existing remote URL (SSH or HTTPS). Do not rewrite remotes unless a push/fetch fails.",
+        '- If `git push` fails with `Permission denied (publickey)`, this shell has no ssh-agent. Retry over HTTPS (do not stop): `git -c url.https://github.com/.insteadOf=git@github.com: -c http.extraHeader="AUTHORIZATION: bearer $(gh auth token)" push -u origin HEAD`.',
+        "- Then create/update the PR with `gh` as below."
+      ].join("\n");
+  }
+}
+
 // src/git/pr-gates.ts
 function prIsInMergeQueue(gate) {
   if (gate.isInMergeQueue) return true;
@@ -1286,10 +1358,15 @@ ${view.stderr}`;
     timeoutMs: 15e3
   });
 }
-async function originGhRepoEnv(cwd) {
+async function originGhRepoEnv(cwd, opts) {
   await ensureGhPreferOrigin(cwd);
   const slug = await resolveGithubRepoSlug(cwd);
-  return slug ? { GH_REPO: slug } : {};
+  const mode = opts?.mode ?? getGithubGitAuthMode();
+  const token = mode === "token" ? getGithubPat() : null;
+  return {
+    ...applyGithubGitAuthEnv(opts?.env, { mode, token }),
+    ...slug ? { GH_REPO: slug } : {}
+  };
 }
 async function resolveDefaultBranch(repoPath, opts) {
   const viaOrigin = await git(
@@ -2038,7 +2115,33 @@ async function commitAll(worktreePath, message) {
   return true;
 }
 async function pushBranch(worktreePath, branchName) {
-  await git(["push", "-u", "origin", branchName], worktreePath);
+  const ssh = await git(["push", "-u", "origin", branchName], worktreePath, {
+    reject: false
+  });
+  if (ssh.exitCode === 0) return;
+  const sshErr = (ssh.stderr || ssh.stdout).trim();
+  const slug = await resolveGithubRepoSlug(worktreePath);
+  const token = await resolveGhAuthToken(worktreePath);
+  if (!slug || !token) {
+    throw new Error(
+      sshErr || `git push origin ${branchName} failed` + (!token ? " (no SSH agent and gh auth token unavailable \u2014 run: gh auth login)" : "")
+    );
+  }
+  const tryHttps = async (header) => git(["push", "-u", "origin", branchName], worktreePath, {
+    reject: false,
+    env: { GIT_TERMINAL_PROMPT: "0" },
+    config: {
+      "url.https://github.com/.insteadOf": "git@github.com:",
+      "http.extraHeader": header
+    }
+  });
+  const bearer = await tryHttps(`AUTHORIZATION: bearer ${token}`);
+  if (bearer.exitCode === 0) return;
+  const basic = Buffer.from(`x-access-token:${token}`, "utf8").toString("base64");
+  const basicPush = await tryHttps(`Authorization: Basic ${basic}`);
+  if (basicPush.exitCode === 0) return;
+  const httpsErr = (basicPush.stderr || bearer.stderr || bearer.stdout).trim();
+  throw new Error(httpsErr || sshErr || `git push origin ${branchName} failed`);
 }
 async function mergePr(cwd, selector, opts) {
   const slug = await resolveGithubRepoSlug(cwd);
@@ -2251,6 +2354,10 @@ export {
   extractGhErrorDetail,
   formatGhLandError,
   formatIpcInvokeError,
+  appendIndexedGitConfig,
+  githubAgentGitEnv,
+  applyGithubGitAuthEnv,
+  formatGitAuthModeDirective,
   detectGhStack,
   resetGhStackDetectCache,
   parseGhStackViewJson,

package/dist/{coordinator-prompt-LLFJUO2R.js → coordinator-prompt-JQF72JKX.js}

@@ -7,11 +7,11 @@ import {
   enrichWorkspacesWithGithub,
   ensureGlobalCoordinatorCwd,
   formatWorkspaceInventory
-} from "./chunk-EEKSZTMU.js";
-import "./chunk-W7YOTDVO.js";
-import "./chunk-JT7R45JB.js";
-import "./chunk-MF2YMEGD.js";
+} from "./chunk-CQBQWX73.js";
+import "./chunk-YVVXWWCC.js";
 import "./chunk-FKOIHGKV.js";
+import "./chunk-IFPN6TER.js";
+import "./chunk-JT7R45JB.js";
 import "./chunk-FWJYLBO6.js";
 import "./chunk-77WWLBCI.js";
 import "./chunk-M37RITA6.js";

package/dist/{coordinator-prompt-MRCMMRSF.js → coordinator-prompt-NYNEFKIV.js}

@@ -9,12 +9,12 @@ import {
   enrichWorkspacesWithGithub,
   ensureGlobalCoordinatorCwd,
   formatWorkspaceInventory
-} from "./chunk-XJNCWYFR.js";
-import "./chunk-OE7YBB5X.js";
+} from "./chunk-4HJK57XU.js";
+import "./chunk-FUUVPN4A.js";
 import "./chunk-B3SJXYIJ.js";
 import "./chunk-7FD7COKE.js";
 import "./chunk-AE5VBOFE.js";
-import "./chunk-PTJJIQK7.js";
+import "./chunk-XKNBSYA7.js";
 import "./chunk-NSTQ6QKD.js";
 import "./chunk-KGZBYWZ3.js";
 import "./chunk-7MV3RXSC.js";