@sideboard-ai/core 0.1.83 → 0.1.85

package/dist/index.cjs

@@ -403,6 +403,9 @@ function wrapElectronAsNodeLaunch(file, args) {
     args: ["-c", STRIP_NESTED_ELECTRON_THEN_EXEC, "sh", file, ...args]
   };
 }
+function isStrippedElectronLaunch(command, args) {
+  return command === "/bin/sh" && Boolean(args?.[1]?.includes("ELECTRON_RUN_AS_NODE") && args[1].includes("unset"));
+}
 var NESTED_ELECTRON_ENV_PREFIXES, STRIP_NESTED_ELECTRON_THEN_EXEC;
 var init_nested_electron_env = __esm({
   "src/hook/nested-electron-env.ts"() {
@@ -2912,80 +2915,6 @@ var init_gh_errors = __esm({
   }
 });
 
-// src/git/git-auth-mode.ts
-function appendIndexedGitConfig(existing, entries) {
-  const start = Number.parseInt(String(existing?.GIT_CONFIG_COUNT ?? "0"), 10);
-  const count = Number.isFinite(start) && start > 0 ? start : 0;
-  const out = {};
-  entries.forEach((entry, i) => {
-    const n = count + i;
-    out[`GIT_CONFIG_KEY_${n}`] = entry.key;
-    out[`GIT_CONFIG_VALUE_${n}`] = entry.value;
-  });
-  out.GIT_CONFIG_COUNT = String(count + entries.length);
-  return out;
-}
-function githubAgentGitEnv(existing) {
-  return appendIndexedGitConfig(existing, HTTPS_REWRITE);
-}
-function applyGithubGitAuthEnv(existing, opts) {
-  const out = {};
-  if (opts.mode === "gh" || opts.mode === "token") {
-    Object.assign(out, githubAgentGitEnv(existing));
-  }
-  if (opts.mode === "token") {
-    const token = opts.token?.trim();
-    if (token && !existing?.GH_TOKEN?.trim()) {
-      out.GH_TOKEN = token;
-    }
-  }
-  return out;
-}
-function formatGitAuthModeDirective(mode) {
-  switch (mode) {
-    case "gh":
-      return [
-        "Git authentication (Account \u2192 GitHub mode: gh CLI):",
-        "- This process rewrites `git@github.com:` and `ssh://git@github.com/` to HTTPS.",
-        "- `gh` supplies credentials (`gh auth git-credential`). Do not switch remotes to SSH.",
-        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
-      ].join("\n");
-    case "ssh":
-      return [
-        "Git authentication (Account \u2192 GitHub mode: SSH):",
-        "- Keep SSH remotes (`git@github.com:\u2026`). Do not rewrite them to HTTPS.",
-        "- Use this Mac\u2019s SSH agent / keys. If push fails with `Permission denied (publickey)`, tell the user to start ssh-agent or switch Account \u2192 GitHub to Auto / gh CLI \u2014 do not rewrite remotes yourself.",
-        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below (API still uses `gh`)."
-      ].join("\n");
-    case "token":
-      return [
-        "Git authentication (Account \u2192 GitHub mode: personal access token):",
-        "- This process rewrites GitHub SSH remotes to HTTPS.",
-        "- `GH_TOKEN` is set in the environment. Use HTTPS git and `gh`; do not paste the token into commands or chat.",
-        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
-      ].join("\n");
-    case "auto":
-    default:
-      return [
-        "Git authentication (Account \u2192 GitHub mode: auto):",
-        "- Prefer the existing remote URL (SSH or HTTPS). Do not rewrite remotes unless a push/fetch fails.",
-        '- If `git push` fails with `Permission denied (publickey)`, this shell has no ssh-agent. Retry over HTTPS (do not stop): `git -c url.https://github.com/.insteadOf=git@github.com: -c http.extraHeader="AUTHORIZATION: bearer $(gh auth token)" push -u origin HEAD`.',
-        "- Then create/update the PR with `gh` as below."
-      ].join("\n");
-  }
-}
-var HTTPS_REWRITE;
-var init_git_auth_mode = __esm({
-  "src/git/git-auth-mode.ts"() {
-    "use strict";
-    HTTPS_REWRITE = [
-      { key: "url.https://github.com/.insteadOf", value: "git@github.com:" },
-      { key: "url.https://github.com/.insteadOf", value: "ssh://git@github.com/" },
-      { key: "credential.https://github.com.helper", value: "!gh auth git-credential" }
-    ];
-  }
-});
-
 // src/agents/path.ts
 function prependPathDir(env, dir) {
   if (!dir || !(0, import_node_fs8.existsSync)(dir)) return;
@@ -3137,7 +3066,10 @@ async function git(args, cwd, opts) {
     env: {
       GIT_TERMINAL_PROMPT: "0",
       GIT_ASKPASS: process.env.GIT_ASKPASS || "echo",
+      SSH_ASKPASS: process.env.SSH_ASKPASS || "echo",
       GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND || "ssh -o BatchMode=yes -o ConnectTimeout=15",
+      GCM_INTERACTIVE: "never",
+      GH_PROMPT_DISABLED: "1",
       ...opts?.env
     }
   });
@@ -3146,11 +3078,15 @@ async function gh(args, cwd, opts) {
   return run("gh", args, {
     cwd,
     reject: opts?.reject,
-    timeoutMs: opts?.timeoutMs
+    timeoutMs: opts?.timeoutMs,
+    env: {
+      GH_PROMPT_DISABLED: "1",
+      GIT_TERMINAL_PROMPT: "0"
+    }
   });
 }
 async function resolveGhAuthToken(cwd) {
-  const result = await gh(["auth", "token"], cwd, { reject: false });
+  const result = await gh(["auth", "token"], cwd, { reject: false, timeoutMs: 8e3 });
   if (result.exitCode !== 0) return null;
   const token = result.stdout.trim();
   return token || null;
@@ -3164,6 +3100,148 @@ var init_run = __esm({
   }
 });
 
+// src/git/git-auth-mode.ts
+function nonInteractiveGitProcessEnv() {
+  return {
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_ASKPASS: process.env.GIT_ASKPASS?.trim() || "echo",
+    SSH_ASKPASS: process.env.SSH_ASKPASS?.trim() || "echo",
+    GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND?.trim() || "ssh -o BatchMode=yes -o ConnectTimeout=15",
+    GCM_INTERACTIVE: "never",
+    GH_PROMPT_DISABLED: "1"
+  };
+}
+function appendIndexedGitConfig(existing, entries) {
+  const start = Number.parseInt(String(existing?.GIT_CONFIG_COUNT ?? "0"), 10);
+  const count = Number.isFinite(start) && start > 0 ? start : 0;
+  const out = {};
+  entries.forEach((entry, i) => {
+    const n = count + i;
+    out[`GIT_CONFIG_KEY_${n}`] = entry.key;
+    out[`GIT_CONFIG_VALUE_${n}`] = entry.value;
+  });
+  out.GIT_CONFIG_COUNT = String(count + entries.length);
+  return out;
+}
+function githubAgentGitEnv(existing) {
+  return appendIndexedGitConfig(existing, HTTPS_REWRITE);
+}
+function githubHttpsBearerEnv(existing, token) {
+  const rewrite = githubAgentGitEnv(existing);
+  const header = appendIndexedGitConfig(
+    { ...existing, ...rewrite },
+    [
+      {
+        key: "http.https://github.com/.extraHeader",
+        value: `AUTHORIZATION: bearer ${token}`
+      }
+    ]
+  );
+  return { ...rewrite, ...header };
+}
+function applyGithubGitAuthEnv(existing, opts) {
+  const out = { ...nonInteractiveGitProcessEnv() };
+  if (opts.mode === "ssh") return out;
+  const existingToken = existing?.GH_TOKEN?.trim() || "";
+  const provided = existingToken ? "" : opts.token?.trim() || "";
+  const token = existingToken || provided;
+  Object.assign(
+    out,
+    token ? githubHttpsBearerEnv(existing, token) : githubAgentGitEnv(existing)
+  );
+  if (provided) out.GH_TOKEN = provided;
+  return out;
+}
+async function resolveGithubAgentToken(mode, cwd) {
+  if (mode === "ssh") return null;
+  if (mode === "token") return getGithubPat();
+  try {
+    return await resolveGhAuthToken(cwd);
+  } catch {
+    return null;
+  }
+}
+async function resolveAgentGitAuthEnv(existing, opts) {
+  let mode = "auto";
+  if (opts?.mode) {
+    mode = opts.mode;
+  } else {
+    try {
+      mode = getGithubGitAuthMode();
+    } catch {
+      mode = "auto";
+    }
+  }
+  const cwd = opts?.cwd?.trim() || process.cwd();
+  let token = null;
+  try {
+    token = await resolveGithubAgentToken(mode, cwd);
+  } catch {
+    token = null;
+  }
+  return applyGithubGitAuthEnv(existing, { mode, token });
+}
+function codexUnattendedGitConfigArgs(sandbox) {
+  const args = [
+    "-c",
+    'shell_environment_policy.inherit="all"',
+    "-c",
+    "shell_environment_policy.ignore_default_excludes=true"
+  ];
+  if (sandbox === "workspace-write") {
+    args.push("-c", "sandbox_workspace_write.network_access=true");
+  }
+  return args;
+}
+function formatGitAuthModeDirective(mode) {
+  switch (mode) {
+    case "gh":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: gh CLI):",
+        "- This process rewrites `git@github.com:` and `ssh://git@github.com/` to HTTPS.",
+        "- `GH_TOKEN` is injected from `gh auth token` (no macOS Keychain prompts). Do not switch remotes to SSH.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
+      ].join("\n");
+    case "ssh":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: SSH):",
+        "- Keep SSH remotes (`git@github.com:\u2026`). Do not rewrite them to HTTPS.",
+        "- SSH is batch-mode: it will not prompt for a Keychain password. If push fails with `Permission denied (publickey)`, tell the user to unlock ssh-agent or switch Account \u2192 GitHub to Auto / gh CLI \u2014 do not rewrite remotes yourself.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below (API still uses `gh`)."
+      ].join("\n");
+    case "token":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: personal access token):",
+        "- This process rewrites GitHub SSH remotes to HTTPS.",
+        "- `GH_TOKEN` is set in the environment. Use HTTPS git and `gh`; do not paste the token into commands or chat.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
+      ].join("\n");
+    case "auto":
+    default:
+      return [
+        "Git authentication (Account \u2192 GitHub mode: auto):",
+        "- This process rewrites GitHub SSH remotes to HTTPS and authenticates with `GH_TOKEN` from `gh` so git/ssh never prompt the macOS Keychain (required for Slack / unattended Cursor).",
+        "- Do not switch remotes to SSH. Push with `git push -u origin HEAD`.",
+        "- If HTTPS auth fails, tell the user to run `gh auth login` on this Mac or set Account \u2192 GitHub to a PAT \u2014 do not wait for a Keychain dialog."
+      ].join("\n");
+  }
+}
+var HTTPS_REWRITE;
+var init_git_auth_mode = __esm({
+  "src/git/git-auth-mode.ts"() {
+    "use strict";
+    init_app_settings();
+    init_run();
+    HTTPS_REWRITE = [
+      { key: "url.https://github.com/.insteadOf", value: "git@github.com:" },
+      { key: "url.https://github.com/.insteadOf", value: "ssh://git@github.com/" },
+      // Empty helper disables ~/.gitconfig osxkeychain so GUI agents cannot pop
+      // "git-credential-osxkeychain wants to use the keychain".
+      { key: "credential.helper", value: "" }
+    ];
+  }
+});
+
 // src/git/pr-gates.ts
 function prIsInMergeQueue(gate) {
   if (gate.isInMergeQueue) return true;
@@ -3649,7 +3727,7 @@ async function originGhRepoEnv(cwd, opts) {
   await ensureGhPreferOrigin(cwd);
   const slug = await resolveGithubRepoSlug(cwd);
   const mode = opts?.mode ?? getGithubGitAuthMode();
-  const token = mode === "token" ? getGithubPat() : null;
+  const token = mode === "token" ? getGithubPat() : mode === "ssh" ? null : await resolveGhAuthToken(cwd);
   return {
     ...applyGithubGitAuthEnv(opts?.env, { mode, token }),
     ...slug ? { GH_REPO: slug } : {}
@@ -5688,20 +5766,36 @@ function pushTurnStderr(tail, line, maxLines = 12) {
   tail.push(trimmed);
   while (tail.length > maxLines) tail.shift();
 }
+function looksLikeMinifiedJsDump(line) {
+  if (line.length < 200) return false;
+  return /yield Promise\.all/.test(line) || /\(0,[A-Za-z$]\.\w+\)/.test(line) || /CURSOR_RIPGREP_PATH/.test(line);
+}
+function looksLikeNestedElectronCrash(line) {
+  return /HasCustomHostObject|ElectronInitializeICUandStartNode/i.test(line);
+}
+function clipStderr(text3, maxChars) {
+  const trimmed = text3.trim();
+  if (trimmed.length <= maxChars) return trimmed;
+  return trimmed.slice(0, maxChars);
+}
 function summarizeTurnStderr(tail, maxChars = 500) {
   if (tail.length === 0) return "";
+  const cursorStartup = [...tail].reverse().find((line) => /cursor startup failed:/i.test(line));
+  if (cursorStartup) return clipStderr(cursorStartup, maxChars);
+  if (tail.some(looksLikeNestedElectronCrash)) return NESTED_ELECTRON_SUMMARY;
   const moduleMissing = [...tail].reverse().find((line) => /cannot find module/i.test(line));
-  if (moduleMissing) {
-    return moduleMissing.length <= maxChars ? moduleMissing : moduleMissing.slice(0, maxChars);
+  if (moduleMissing) return clipStderr(moduleMissing, maxChars);
+  const useful = tail.filter((line) => !looksLikeMinifiedJsDump(line));
+  if (useful.length === 0 && tail.some(looksLikeMinifiedJsDump)) {
+    return MINIFIED_DUMP_SUMMARY;
   }
-  const joined = tail.slice(-6).join("\n").trim();
-  if (joined.length <= maxChars) return joined;
-  return joined.slice(joined.length - maxChars);
+  const joined = (useful.length ? useful : tail).slice(-6).join("\n").trim();
+  return clipStderr(joined, maxChars);
 }
 function looksLikeInvalidAgentSession(text3) {
   const lower = text3.trim().toLowerCase();
   if (!lower) return false;
-  return /session not found/.test(lower) || /no conversation found/.test(lower) || /conversation .+ not found/.test(lower) || /thread .+ not found/.test(lower) || /unknown session/.test(lower) || /invalid session/.test(lower) || /session .+ (missing|expired|deleted|gone)/.test(lower) || /cannot resume/.test(lower) || /failed to (load|resume|open) session/.test(lower);
+  return /session not found/.test(lower) || /no conversation found/.test(lower) || /conversation .+ not found/.test(lower) || /thread .+ not found/.test(lower) || /unknown session/.test(lower) || /invalid session/.test(lower) || /session .+ (missing|expired|deleted|gone)/.test(lower) || /cannot resume/.test(lower) || /failed to (load|resume|open) session/.test(lower) || /corrupt local agent checkpoint/.test(lower) || /missing root blob/.test(lower) || /\bagent\b.{0,120}\bnot found\b/.test(lower);
 }
 function looksLikeAgentFailureMessage(text3) {
   const lower = text3.trim().toLowerCase();
@@ -5741,6 +5835,12 @@ function humanizeAgentFailDetail(detail) {
   if (/context.*(too long|exceed)|prompt is too long|conversation too long/.test(lower)) {
     return `${raw} \u2014 start a new chat or compact context, then retry.`;
   }
+  if (/hascustomhostobject|electroninitializeicuandstartnode|nested chromium/i.test(lower)) {
+    return `${raw} \u2014 retry the turn; if it keeps failing, pick another agent.`;
+  }
+  if (/corrupt local agent checkpoint|missing root blob|truncated crash dump/.test(lower)) {
+    return `${raw} \u2014 retry the turn (Sideboard will start a fresh Cursor session).`;
+  }
   return raw;
 }
 function formatTurnExitError(exitCode, stderrSummary) {
@@ -5756,11 +5856,13 @@ function formatTurnExitError(exitCode, stderrSummary) {
   if (looksLikeAgentFailureMessage(raw)) return detail;
   return `exit ${code}: ${detail}`;
 }
-var NODE_VERSION_FOOTER;
+var NODE_VERSION_FOOTER, NESTED_ELECTRON_SUMMARY, MINIFIED_DUMP_SUMMARY;
 var init_error_detail = __esm({
   "src/agents/error-detail.ts"() {
     "use strict";
     NODE_VERSION_FOOTER = /^Node\.js v\d+/i;
+    NESTED_ELECTRON_SUMMARY = "Cursor local agent crashed at Electron startup (nested Chromium / HasCustomHostObject)";
+    MINIFIED_DUMP_SUMMARY = "Cursor local agent crashed during startup (truncated crash dump)";
   }
 });
 
@@ -6209,7 +6311,12 @@ function applyNodeLaunch(launch, args) {
     return { file: launch.file, args, env: launch.env };
   }
   const wrapped = wrapElectronAsNodeLaunch(launch.file, args);
-  return { file: wrapped.file, args: wrapped.args, env: launch.env };
+  if (process.platform === "win32") {
+    return { file: wrapped.file, args: wrapped.args, env: launch.env };
+  }
+  const env = { ...launch.env };
+  delete env.ELECTRON_RUN_AS_NODE;
+  return { file: wrapped.file, args: wrapped.args, env };
 }
 async function resolveNodeLaunch(scriptPath) {
   if (isAsarPath(scriptPath)) {
@@ -6386,6 +6493,10 @@ async function buildInjectedMcpServers(opts) {
     if (orchId) {
       sideboard.env.SIDEBOARD_ORCHESTRATOR_THREAD_ID = orchId;
     }
+    try {
+      Object.assign(sideboard.env, await resolveAgentGitAuthEnv(sideboard.env));
+    } catch {
+    }
     servers.push(sideboard);
   }
   if (opts.includeBrightsy && isBrightsyConnected()) {
@@ -6408,10 +6519,19 @@ async function buildInjectedMcpServers(opts) {
 function toCursorMcpServers(servers) {
   const out = {};
   for (const s of servers) {
+    const env = s.env ? { ...s.env } : void 0;
+    if (env) delete env.ELECTRON_RUN_AS_NODE;
+    let command = s.command;
+    let args = s.args;
+    if (process.platform !== "win32" && !isStrippedElectronLaunch(command, args)) {
+      const wrapped = wrapElectronAsNodeLaunch(command, args ?? []);
+      command = wrapped.file;
+      args = wrapped.args;
+    }
     out[s.name] = {
-      command: s.command,
-      ...s.args ? { args: s.args } : {},
-      ...s.env ? { env: s.env } : {}
+      command,
+      ...args && args.length > 0 ? { args } : {},
+      ...env && Object.keys(env).length > 0 ? { env } : {}
     };
   }
   return out;
@@ -6481,6 +6601,8 @@ var init_injected_mcp = __esm({
     init_app_settings();
     init_paths();
     init_node_launch();
+    init_nested_electron_env();
+    init_git_auth_mode();
     import_meta = {};
     SIDEBOARD_MCP_ALLOWED_TOOLS = [
       "mcp__sideboard",
@@ -7024,6 +7146,7 @@ var init_codex = __esm({
     init_global_workspace();
     init_error_detail();
     init_usage();
+    init_git_auth_mode();
     init_injected_mcp();
     init_turn_input();
     init_types();
@@ -7115,6 +7238,8 @@ var init_codex = __esm({
           // `codex exec` rejects `--ask-for-approval` (global-only on newer CLIs).
           "-c",
           'approval_policy="never"',
+          // Seatbelt cannot use the login Keychain; default policy also strips GH_TOKEN.
+          ...codexUnattendedGitConfigArgs(mode.codexSandbox),
           ...model ? ["--model", model] : [],
           ...mcpOverrides
         ];
@@ -8728,6 +8853,7 @@ __export(index_exports, {
   cleanupOrphanWorktrees: () => cleanupOrphanWorktrees,
   cloneRepoIntoSideboard: () => cloneRepoIntoSideboard,
   codexAdapter: () => codexAdapter,
+  codexUnattendedGitConfigArgs: () => codexUnattendedGitConfigArgs,
   coerceOrchestratorAgent: () => coerceOrchestratorAgent,
   collectTakenTeamSlugs: () => collectTakenTeamSlugs,
   commentLinearIssue: () => commentLinearIssue,
@@ -8948,6 +9074,7 @@ __export(index_exports, {
   mergeUsage: () => mergeUsage,
   nextPastedTextName: () => nextPastedTextName,
   nextThinkingEffort: () => nextThinkingEffort,
+  nonInteractiveGitProcessEnv: () => nonInteractiveGitProcessEnv,
   normalizeParseResult: () => normalizeParseResult,
   normalizeThinkingEffort: () => normalizeThinkingEffort,
   normalizeThread: () => normalizeThread,
@@ -9003,6 +9130,7 @@ __export(index_exports, {
   requireAgent: () => requireAgent,
   resetGhStackDetectCache: () => resetGhStackDetectCache,
   resolveAgentExecutable: () => resolveAgentExecutable,
+  resolveAgentGitAuthEnv: () => resolveAgentGitAuthEnv,
   resolveClaudeExecutable: () => resolveClaudeExecutable,
   resolveCommandBinarySync: () => resolveCommandBinarySync,
   resolveConductorCursorAgentId: () => resolveConductorCursorAgentId,
@@ -9012,6 +9140,7 @@ __export(index_exports, {
   resolveEffectiveIssueSource: () => resolveEffectiveIssueSource,
   resolveFilesToCopy: () => resolveFilesToCopy,
   resolveGhAuthToken: () => resolveGhAuthToken,
+  resolveGithubAgentToken: () => resolveGithubAgentToken,
   resolveGithubRepoSlug: () => resolveGithubRepoSlug,
   resolveLinearState: () => resolveLinearState,
   resolveLinearTeam: () => resolveLinearTeam,
@@ -9883,6 +10012,7 @@ init_agents();
 var import_node_readline = require("readline");
 var import_execa2 = require("execa");
 init_worktree();
+init_git_auth_mode();
 init_app_settings();
 init_global_workspace();
 init_brightsy();
@@ -10145,14 +10275,16 @@ async function spawnAgentTurn(thread, input, onEvent) {
     );
   }
   const env = childEnvWithAppSettings(cmd.env);
-  if (!isOrchestratorThread(thread)) {
-    try {
+  try {
+    if (isOrchestratorThread(thread)) {
+      Object.assign(env, await resolveAgentGitAuthEnv(env));
+    } else {
       const originEnv = await originGhRepoEnv(thread.worktreePath, { env });
       Object.assign(env, originEnv);
-    } catch (err) {
-      const detail = err instanceof Error ? err.message : String(err);
-      console.warn(`[sideboard] originGhRepoEnv failed (${thread.worktreePath}): ${detail}`);
     }
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    console.warn(`[sideboard] git auth env failed (${thread.worktreePath}): ${detail}`);
   }
   const child = (0, import_execa2.execa)(cmd.file, cmd.args, {
     cwd: cmd.cwd,
@@ -10505,6 +10637,7 @@ var import_execa3 = require("execa");
 var import_node_readline2 = require("readline");
 init_settings();
 init_nested_electron_env();
+init_git_auth_mode();
 init_nested_electron_env();
 var PORT_RANGE_SIZE = 10;
 function matchSimpleGlob(pattern, name) {
@@ -10678,6 +10811,10 @@ async function spawnWorkspaceScript(command, opts) {
     },
     loginEnv
   );
+  try {
+    Object.assign(env, await resolveAgentGitAuthEnv(env, { cwd: opts.worktreePath }));
+  } catch {
+  }
   const shell = process.platform === "darwin" ? "zsh" : "bash";
   const child = (0, import_execa3.execa)(shell, ["-lc", command], {
     cwd: opts.worktreePath,
@@ -15322,7 +15459,7 @@ var Orchestrator = class {
       }
       let lastStderr = summarizeTurnStderr(stderrTail);
       let detail = lastStderr || (exitCode !== 0 ? fallbackTurnFailDetail(assistantText) : "");
-      if (exitCode !== 0 && !assistantText && parts.length === 0 && !this.stoppedTurns.has(threadId) && looksLikeInvalidAgentSession(detail) && this.requireThread(threadId).sessionId && this.requireThread(threadId).agent !== "cursor" && this.requireThread(threadId).agent !== "brightsy") {
+      if (exitCode !== 0 && !assistantText && parts.length === 0 && !this.stoppedTurns.has(threadId) && looksLikeInvalidAgentSession(detail) && this.requireThread(threadId).sessionId && this.requireThread(threadId).agent !== "brightsy") {
         updateThread(threadId, { sessionId: null });
         pushTurnStderr(
           stderrTail,
@@ -20192,6 +20329,7 @@ async function startSlackRelayServer(opts) {
   cleanupOrphanWorktrees,
   cloneRepoIntoSideboard,
   codexAdapter,
+  codexUnattendedGitConfigArgs,
   coerceOrchestratorAgent,
   collectTakenTeamSlugs,
   commentLinearIssue,
@@ -20412,6 +20550,7 @@ async function startSlackRelayServer(opts) {
   mergeUsage,
   nextPastedTextName,
   nextThinkingEffort,
+  nonInteractiveGitProcessEnv,
   normalizeParseResult,
   normalizeThinkingEffort,
   normalizeThread,
@@ -20467,6 +20606,7 @@ async function startSlackRelayServer(opts) {
   requireAgent,
   resetGhStackDetectCache,
   resolveAgentExecutable,
+  resolveAgentGitAuthEnv,
   resolveClaudeExecutable,
   resolveCommandBinarySync,
   resolveConductorCursorAgentId,
@@ -20476,6 +20616,7 @@ async function startSlackRelayServer(opts) {
   resolveEffectiveIssueSource,
   resolveFilesToCopy,
   resolveGhAuthToken,
+  resolveGithubAgentToken,
   resolveGithubRepoSlug,
   resolveLinearState,
   resolveLinearTeam,

package/dist/index.d.cts

@@ -638,9 +638,9 @@ type IssueSource = 'linear' | 'github';
  * How Sideboard and worktree agents authenticate GitHub git operations.
  * A declared mode so the app and injected prompts agree. Sideboard never
  * uses a third-party GitHub App (including Conductor.build) for git auth.
- * - `auto` (default): keep remotes as-is (SSH first); prompt HTTPS/`gh` fallback
- * - `gh`: rewrite SSH remotes to HTTPS; `gh auth git-credential`
- * - `ssh`: keep `git@` remotes; use this Mac’s SSH agent
+ * - `auto` (default): HTTPS in the agent process with `gh`’s token (no Keychain prompts)
+ * - `gh`: same HTTPS rewrite; `GH_TOKEN` from `gh auth token`
+ * - `ssh`: keep `git@` remotes; batch-mode SSH (no Keychain dialog — fails if agent locked)
  * - `token`: stored PAT + HTTPS rewrite; `GH_TOKEN` in the agent env
  */
 type GithubGitAuthMode = 'auto' | 'gh' | 'ssh' | 'token';
@@ -1145,6 +1145,11 @@ declare function formatMergePrError(raw: string): string;
 declare function formatIpcInvokeError(err: unknown): string;
 
 type EnvLike = NodeJS.ProcessEnv | Record<string, string | undefined>;
+/**
+ * Fail closed instead of a macOS Keychain / SSH passphrase dialog.
+ * Slack turns cannot click those prompts.
+ */
+declare function nonInteractiveGitProcessEnv(): Record<string, string>;
 /**
  * Append `GIT_CONFIG_KEY_n` / `VALUE_n` entries without clobbering inherited
  * command-scoped git config (enterprise insteadOf, custom certs, …).
@@ -1154,18 +1159,39 @@ declare function appendIndexedGitConfig(existing: EnvLike | undefined, entries:
     value: string;
 }>): Record<string, string>;
 /**
- * Rewrite GitHub SSH remotes to HTTPS and let `gh` supply credentials.
- * GUI / agent shells often have no ssh-agent; `gh` keyring still works.
+ * Rewrite GitHub SSH remotes to HTTPS for this process only (does not edit
+ * the stored remote). Credential helper is cleared so osxkeychain cannot prompt.
  */
 declare function githubAgentGitEnv(existing?: EnvLike): Record<string, string>;
 /**
  * Extra env for a worktree agent given Account → GitHub git-auth mode.
  * Does not set `GH_REPO` (caller adds that after resolving origin).
+ *
+ * `auto` and `gh` rewrite to HTTPS in-process and inject `GH_TOKEN` when
+ * provided so Cursor / Slack never talk to the login keychain.
  */
 declare function applyGithubGitAuthEnv(existing: EnvLike | undefined, opts: {
     mode: GithubGitAuthMode;
     token?: string | null;
 }): Record<string, string>;
+/** PAT or `gh auth token`, resolved in the Sideboard parent (not the agent). */
+declare function resolveGithubAgentToken(mode: GithubGitAuthMode, cwd: string): Promise<string | null>;
+/**
+ * Non-interactive GitHub env for agent / MCP children (HTTPS + token when
+ * possible). Safe to call without a git checkout (`cwd` only needed for `gh`).
+ * Always returns at least {@link nonInteractiveGitProcessEnv} — settings/vault
+ * failures must not skip Keychain suppression.
+ */
+declare function resolveAgentGitAuthEnv(existing?: EnvLike, opts?: {
+    cwd?: string;
+    mode?: GithubGitAuthMode;
+}): Promise<Record<string, string>>;
+/**
+ * Codex `exec -c` so sandboxed shells keep Sideboard’s git env.
+ * Default `shell_environment_policy` drops `*TOKEN*` / `*KEY*` and
+ * `workspace-write` has no network — both force `gh`/git onto Keychain or a hang.
+ */
+declare function codexUnattendedGitConfigArgs(sandbox: 'read-only' | 'workspace-write' | 'danger-full-access' | string): string[];
 /** Injected prompt block so agents use the same git path as Sideboard. */
 declare function formatGitAuthModeDirective(mode: GithubGitAuthMode): string;
 
@@ -4332,4 +4358,4 @@ interface SlackRelayClientOptions {
  */
 declare function runSlackRelayClient(opts: SlackRelayClientOptions): Promise<void>;
 
-export { AGENT_GIT_ACTIONS, ATTACHMENTS_DIR, type ActiveRun, type AddStackLayerInput, type AdoptInput, type AdvancedAppSettings, type AgentAdapter, type AgentEvent, type AgentGitAction, type AgentInstructionFile, type AgentKind, type AgentModelCatalog, type AgentModelInfo, type AgentSetupActionResult, type AgentSetupInfo, type AgentSetupKind, type AgentStatus, type AgentTurnInput, type AnthropicCacheControl, type AppSettings, type ApplyIntoMainResult, type AttachCommand, type Autonomy, BAKED_SLACK_RELAY_URL, BRIGHTSY_MCP_ALLOWED_TOOLS, type BranchInfo, type BrightsyAccount, type BrightsyChatTarget, type BrightsyChatTargets, type BrightsyCloudConnectAgent, type BrightsyHarnessSettings, type BrightsySession, BrightsySideboardApi, type BrightsyTeamTargets, CLAUDE_MODEL_CATALOG, CLOUD_COORDINATOR_BUSY_REPLY, CLOUD_COORDINATOR_STOPPED_REPLY, CLOUD_COORDINATOR_TIMEOUT_REPLY, CLOUD_ORCHESTRATOR_GOAL, CONTEXT_COMPACT_CHARS, CONTEXT_KEEP_RECENT_CHARS, CONTEXT_KEEP_RECENT_MESSAGES, CONTEXT_MIN_MESSAGES, COORDINATOR_TOOL_PLAYBOOK, type CaffeinateHoldState, type ClaudeHarnessSettings, type CleanupOrphansResult, type CliAgentKind, type CliExecutableSettings, type CloudConnectAgent, type CloudConnectOptions, type CloudConnectStatus, type CompactResult, type CompactThresholds, type ComposerFileBuffer, type ConductorSettings, type ConductorWorkspace, type ConnectedBrightsyTeamInfo, type CreateChatTabInput, type CreateGlobalChatOpts, type CreateStackInput, type CreateThreadInput, type CreateWorktreeResult, type CursorModelInfo, type CursorSdkStreamMessage, type CursorTurnRequest, type CursorWorktreesConfig, type DefaultsAppSettings, type DevServerHandle, type DiffCommentInput, type DiffCommentLine, type DiffCommit, type DiffFile, type DiffResult, type DiffScope, type DiffScopeStat, type ExpandResult, FAMOUS_SOCCER_TEAMS, type ForkChatTabInput, type ForkThreadWorktreeInput, type FormatGhLandErrorOptions, GITHUB_GIT_AUTH_MODES, GLOBAL_WORKSPACE_ID, type GetDiffOptions, type GhStackStatus, type GitHubStatus, type GitWorktreeStatus, type GithubGitAuthMode, HARNESS_ENV_KEYS, type HarnessId, type InitStackFromThreadInput, type IntegrationsSettings, type IpcApi, type IssueInfo, type IssueSource, LEGACY_ATTACHMENTS_DIR, LEGACY_PLAN_FILE_REL, LEGACY_REVIEW_REQUEST_PATH, LINEAR_OAUTH_CANCELLED, LINEAR_OAUTH_PORT, LINEAR_OAUTH_REDIRECT, LINEAR_OAUTH_SCOPES, type LandPreview, type LandResult, type LinearComment, type LinearIssue, LinearOAuthCancelledError, type LinearTeam, type LinearTeamsResult, type LinearWorkflowState, type ListIssuesResult, MAX_ANTHROPIC_CACHE_CONTROL_BLOCKS, type McpServerStatus, type MessagePart, ORCHESTRATOR_AGENT_KINDS, type OpenPrStackLayersInput, type OpenStackLayerInput, type OpenStackLayerResult, type OrchestrationQuotaOnLimit, Orchestrator, type OrchestratorAgentKind, type OrchestratorEvent, type OrchestratorRuntime, type OrphanWorktree, PASTE_ATTACH_MIN_CHARS, PASTE_ATTACH_MIN_LINES, PLAN_FILE_NAME, PLAN_FILE_REL, PLAN_MODE_INSTRUCTION, type PendingPlanQuestions, type PlanQuestion, type PlanQuestionAnswer, type PlanQuestionOption, type PlanToolPartLike, type PrActor, type PrCheckRun, type PrCommentInfo, type PrCommitInfo, type PrDetails, type PrInfo, type PrMeta, type PrReviewInfo, type PrStack, type PrStackLayer, type PresentedPlan, type PublicAppSettings, type PublicIntegrationsSettings, REPO_REVIEW_NAME, REPO_REVIEW_PATH, REVIEW_REQUEST_NAME, REVIEW_REQUEST_PATH, REVIEW_REQUEST_PREFILL, REVIEW_REQUEST_TEMPLATE, type RepoSettings, type RepoSetupInfo, type RequestReviewResult, type ResolvedReviewGuidelines, type ReviewGuidelinesSource, type RunMode, type RunScript, SIDEBOARD_FORCE_STOP, SIDEBOARD_MCP_ALLOWED_TOOLS, SIDEBOARD_MCP_PROFILE_ENV, SLACK_LISTEN_BUSY_REPLY, SLACK_LISTEN_STOPPED_REPLY, SLACK_LISTEN_TIMEOUT_REPLY, SLACK_OAUTH_CANCELLED, SLACK_OAUTH_REDIRECT, SLACK_REPLY_FORMATTING, SLACK_SEEN_REACTION, type ScriptHandle, type SideboardMcpProfile, type SkillInfo, type SlackInboundMessage, type SlackListenOptions, type SlackListenStatus, SlackOAuthCancelledError, type SlackOutboundReply, type SlackOutboundWatch, type SlackRelayClientMessage, type SlackRelayClientOptions, SlackRelayHub, type SlackRelayServerHandle, type SlackRelayServerMessage, type SlackRelayServerOptions, type SlackReplyBadge, type SlackWorkspaceInfo, type SourceType, type SpawnTurnHandle, type SummarizeResult, THINKING_EFFORTS, type TeamName, type ThinkingEffort, type Thread, type ThreadAttachment, type ThreadMessage, type ThreadOptionsPatch, type ThreadStatus, type TokenUsage, type ToolPartLike, type TranscriptToolDetail, type TurnCommand, type UsageScope, type Workspace, type WorkspaceInventoryEntry, type WorkspaceScriptEnvOpts, ackSlackInboundSeen, addPrStackLayer, addStackLayerFromThread, addWorkspace, adoptThread, agentGitPrompt, allAdapters, allocatePort, allocatePortRange, allocateTeamName, allocateTeamSlug, appDataDir, appSettingsPath, appendIndexedGitConfig, appendMessage, applyAgentEvent, applyAppEnvironment, applyCompaction, applyGithubGitAuthEnv, applyThreadIntoMain, applyTurnUsage, assertOrchestratorCapableAgent, attachmentFromAbsolutePath, attachmentsFromBuffers, attachmentsFromWorktreePaths, attachmentsGitignoreBody, autoArchiveOnMergeEnabled, autoCleanupOrphansEnabled, autoRenameBranchEnabled, autoRunAfterSetupEnabled, branchDisplayLabel, brightsyAdapter, brightsyCloudConnectAgent, brightsyCloudConnectEnabled, brightsyConfigPath, brightsyInjectWorktreeMcpEnabled, brightsyMcpAllowedTools, brightsyMcpServerName, buildCachedUserContent, buildClaudeStreamJsonUserMessage, buildDiffCommentAttachment, buildForkTranscriptAttachment, buildPastedTextAttachment, buildReviewRequestAttachment, buildSessionSeed, buildWorkspaceScriptEnv, caffeinateHoldPath, caffeinateWhileCloudConnectEnabled, caffeinateWhileRunningEnabled, caffeinateWhileSlackListenEnabled, captureLoginEnv, captureTurnBaseline, checkoutPrStackLayer, childEnvWithAppSettings, claudeAdapter, claudeChromeEnabled, claudeUserSettingsPath, cleanupOrphanWorktrees, cloneRepoIntoSideboard, codexAdapter, coerceOrchestratorAgent, collectTakenTeamSlugs, commentLinearIssue, commitAll, conductorBundledBinDir, conductorDbPath, confirmLand, connectBrightsyTeam, connectSlackToken, contextTokens, coordinatorSystemPrompt, coordinatorTurnReminder, copyConfiguredFiles, countCacheControlBlocks, createChatTab, createEmptyThread, createExistingBranchWorktree, createGlobalChat, createLinearIssue, createLinearPkce, createOrUpdatePr, createPrStack, createThread, createThreadWorktree, currentBranch, cursorAdapter, cursorSdkMessageToEvents, decodeBrightsyTarget, deleteBranchOnPurgeEnabled, deleteThreadRecord, detectAgents, detectGhStack, detectLocalMergeConflicts, disconnectBrightsyTeam, disconnectLinear, disconnectLinearConnection, disconnectSlackWorkspace, discoverSkills, dismissSlackReplyBadge, dropCachedPrefixOnResume, encodeBrightsyTarget, enrichPathWithNpmGlobalBin, enrichWorkspacesWithGithub, ensureAgentPath, ensureCloudCoordinator, ensureGhPreferOrigin, ensureGlobalCoordinatorCwd, ensureReviewRequestFile, ensureSlackCoordinator, ensureSlackDeviceIdentity, ensureWorkspace, estimateMessageChars, estimateThreadChars, expandComposerPrompt, extractGhErrorDetail, extractPendingPlanQuestions, extractPresentedPlan, extractiveSummary, fetchPrHead, finalizeParts, findInvalidCacheControlTtlOrder, findOrphanWorktrees, findThreadByRef, findThreadForStackLayer, flattenTurnInput, forkChatTab, forkMessageSlice, forkThreadWorktree, formatAgentInstructions, formatArtifactDirective, formatBrightsyFetchError, formatFetchError, formatGhLandError, formatGitAuthModeDirective, formatIpcInvokeError, formatMergePrError, formatMessagesAsTranscript, formatPlanQuestionAnswers, formatPlanQuestionsForChat, formatProcessGuideDirective, formatRateLimitResetHint, formatRenameBranchDirective, formatSlackExternalReplyPrompt, formatSlackInboundPrompt, formatSlackRepliesForTurn, formatSlackSignedReply, formatTranscriptMarkdown, formatUiReminder, formatWorkspaceInventory, formatWorktreeDirective, formatWorktreeReminder, fromInclusiveInputUsage, getAdapter, getAgentSetupInfo, getBrightsySession, getCaffeinateHold, getDefaultAgent, getDefaultEffort, getDefaultFast, getDefaultModel, getDefaultRunScript, getDiff, getDiffSummary, getGitHubStatus, getGithubGitAuthMode, getGithubPat, getIssueSource, getLinearApiKey, getLinearAuthToken, getLinearIssue, getOrchestrator, getPr, getPrChecks, getPrDetails, getPrMeta, getPrStack, getRepoSetupInfo, getRunMode, getRunScript, getSlackWorkspace, gh, ghHeadRef, ghRepoSelectArgs, git, githubAgentGitEnv, globalAgentCwd, handleSlackInbound, harnessEnvKey, hasBakedLinearOAuth, hasBakedSlackOAuth, hasConductorHook, hasCursorWorktreeSetup, hasRepoHook, hasWorkspaceHook, healOrchestrationSoccerTitles, httpFetch, importConductorWorkspace, importConductorWorkspaceAsync, initPrStack, initStackFromThread, initializeGitRepository, inspectGitWorktree, installAgent, isAskUserToolName, isBrightsyConnected, isBrightsyNdjsonLine, isCloudCoordinatorThread, isConductorBundledCli, isCursorAutoModel, isDirty, isGhRateLimitError, isGlobalRepoPath, isGlobalThread, isImageFilePath, isInPrStack, isInboundForThisDesktop, isLinearConnected, isLinearOAuthCancelled, isOrchestratorCapableAgent, isOrchestratorThread, isPidAlive, isPlaceholderBranch, isPrNotMergeableError, isPresentPlanToolName, isSessionQuotaLimit, isSideboardScratchPath, isSlackCoordinatorThread, isSlackExternalReplyPrompt, isSlackOAuthCancelled, isThinkingEffort, isThreadCaffeinated, isWorkspaceScratchPath, linearAuthorizationHeader, linearGraphql, linearOAuthAuthorizeUrl, linearOAuthCredentials, listAgentSetupInfo, listBranchCommits, listBranches, listBrightsyAccounts, listBrightsyChatTargets, listCodexModels, listConductorWorkspaces, listConnectedBrightsyTeams, listCursorModels, listGitHubIssues, listGlobalThreads, listIssues, listLinearIssues, listLinearIssuesDirect, listLinearTeams, listModelsForAgent, listOpencodeModels, listPrs, listRunScripts, listSlackOutboundWatches, listSlackReplyBadges, listSlackWorkspaces, listThreads, listWorkspaces, listWorktreeFiles, listWorktrees, loadAgentInstructions, loadAppSettings, loadBrightsyConfig, loadConductorSettings, loadRepoSettings, loadWorkspaceSettings, locksDir, loginAgent, lookupSoccerTeam, maxConcurrentAgents, maybeCompactContext, mcpAllowTools, mcpAuthWarnings, mergePr, mergePrStack, mergeUsage, nextPastedTextName, nextThinkingEffort, normalizeParseResult, normalizeThinkingEffort, normalizeThread, normalizeTurnInput, normalizeWorktreePath, openInSystemTerminal, openPrStackLayers, openStackLayer, opencodeAdapter, orchestrationQuotaFallbackAgent, orchestrationQuotaOnLimit, orchestrationTitleNeedsSoccerNickname, orchestratorSessionPoisonedByBuiltins, originGhRepoEnv, parseCursorRunnerLine, parseForceStopMessage, parseGhStackViewJson, parseGithubSlugFromRemoteUrl, parseMcpList, parsePlanQuestionsInput, parseSessionQuotaResetAt, parseSlackRelayClientMessage, parseSlackRelayServerMessage, partsToAssistantText, pastedTextStats, pendingSlackExternalReplies, permalinkForSlackReplyBadge, permissionMode, persistVaultKeyInKeychain, planFileAbs, posixShellSingleQuote, prepareTerminalCommand, previewLand, promptMentionsBrightsy, pushBranch, readExistingReviewRequestFile, readKeychainVaultKey, readPlanFile, readSkillBody, readThread, readWorktreeFile, readWorktreeFileForUpload, readWorktreeInclude, recordSlackOutboundWatch, refreshGitHubAuth, refreshSlackReplyBadges, releaseCaffeinateHoldForThread, removeWorkspace, removeWorktree, repoSlug, requestOccupancy, requestReview, requireAgent, resetGhStackDetectCache, resolveAgentExecutable, resolveClaudeExecutable, resolveCommandBinarySync, resolveConductorCursorAgentId, resolveCursorModelId, resolveDefaultBranch, resolveDiffBaseRef, resolveEffectiveIssueSource, resolveFilesToCopy, resolveGhAuthToken, resolveGithubRepoSlug, resolveLinearState, resolveLinearTeam, resolveLoginCommand, resolveNewThreadOptions, resolvePlanMarkdown, resolvePrSelector, resolveQuotaFallbackAgent, resolveRepoRoot, resolveReviewGuidelines, resolveSlackListenMode, resolveThreadDefaults, resolveThreadEffort, resolveVaultKey, resolveWorktreeStartPoint, rewriteLinearError, run, runArchiveScript, runCloudConnect, runCursorWorktreeSetup, runSetupScript, runSlackListen, runSlackRelayClient, sameWorktreePath, sanitizeMcpServerName, saveAppSettings, saveLinearOAuth, secureFileUnlocksWith, setCaffeinateHold, setHttpFetchImpl, setStatus, setVaultMasterKey, settingsSourceLabel, shouldAttachPastedText, shouldCompactContext, shouldInjectBrightsyMcp, shouldRefreshReviewRequestTemplate, shouldRunWorktreeCleanup, sideboardHomeDir, sideboardMcpProfile, sideboardReposDir, sideboardWorkspacesDir, slackAppLevelToken, slackArchiveUrl, slackCoordinatorSourceRef, slackListenEnabled, slackOAuthCredentials, slackOAuthResultUrl, slackRelayUrl, slugify, spawnAgentTurn, splitForCompaction, stackAgentDefaultsFrom, stackIdFrom, stackMergeReadiness, stageAbsolutePathsAsAttachments, stageBuffersAsAttachments, startDevServer, startLinearOAuth, startMcpServer, startOrchestration, startSlackOAuth, startSlackRelayServer, stripBrightsyNdjsonNoise, stripNestedElectronEnv, submitPrStack, suggestSlug, summarizeConversation, switchBrightsyAccount, syncWorkspacesFromThreads, takenTeamSlugsForChatTab, takenTeamSlugsForOrchestration, taskMessageText, thinkingEffortBars, thinkingEffortLabel, threadDisplayLabel, threadFilePath, threadLockPath, threadRequestsBrightsyMcp, threadsDir, threadsSharingWorktree, toPublicAppSettings, toolDescription, toolDetail, toolFilePath, totalTokens, updateAdvancedSettings, updateAgentExecutable, updateAppEnvironment, updateBrightsySettings, updateClaudeSettings, updateCodexSettings, updateDefaultsSettings, updateIntegrationsSettings, updateLinearIssue, updateOpencodeSettings, updateThread, validateLinearApiKey, withAgentInstructions, withExportedPath, withThreadLock, workspaceSettingsSourceLabel, worktreeCleanupSettings, worktreeDisplayLabel, worktreeDisplayLabelForGroup, worktreeNameFromPath, worktreesRoot, writeInjectedMcpConfig, writePlanFile, writeThread, writeWorktreeFile };
+export { AGENT_GIT_ACTIONS, ATTACHMENTS_DIR, type ActiveRun, type AddStackLayerInput, type AdoptInput, type AdvancedAppSettings, type AgentAdapter, type AgentEvent, type AgentGitAction, type AgentInstructionFile, type AgentKind, type AgentModelCatalog, type AgentModelInfo, type AgentSetupActionResult, type AgentSetupInfo, type AgentSetupKind, type AgentStatus, type AgentTurnInput, type AnthropicCacheControl, type AppSettings, type ApplyIntoMainResult, type AttachCommand, type Autonomy, BAKED_SLACK_RELAY_URL, BRIGHTSY_MCP_ALLOWED_TOOLS, type BranchInfo, type BrightsyAccount, type BrightsyChatTarget, type BrightsyChatTargets, type BrightsyCloudConnectAgent, type BrightsyHarnessSettings, type BrightsySession, BrightsySideboardApi, type BrightsyTeamTargets, CLAUDE_MODEL_CATALOG, CLOUD_COORDINATOR_BUSY_REPLY, CLOUD_COORDINATOR_STOPPED_REPLY, CLOUD_COORDINATOR_TIMEOUT_REPLY, CLOUD_ORCHESTRATOR_GOAL, CONTEXT_COMPACT_CHARS, CONTEXT_KEEP_RECENT_CHARS, CONTEXT_KEEP_RECENT_MESSAGES, CONTEXT_MIN_MESSAGES, COORDINATOR_TOOL_PLAYBOOK, type CaffeinateHoldState, type ClaudeHarnessSettings, type CleanupOrphansResult, type CliAgentKind, type CliExecutableSettings, type CloudConnectAgent, type CloudConnectOptions, type CloudConnectStatus, type CompactResult, type CompactThresholds, type ComposerFileBuffer, type ConductorSettings, type ConductorWorkspace, type ConnectedBrightsyTeamInfo, type CreateChatTabInput, type CreateGlobalChatOpts, type CreateStackInput, type CreateThreadInput, type CreateWorktreeResult, type CursorModelInfo, type CursorSdkStreamMessage, type CursorTurnRequest, type CursorWorktreesConfig, type DefaultsAppSettings, type DevServerHandle, type DiffCommentInput, type DiffCommentLine, type DiffCommit, type DiffFile, type DiffResult, type DiffScope, type DiffScopeStat, type ExpandResult, FAMOUS_SOCCER_TEAMS, type ForkChatTabInput, type ForkThreadWorktreeInput, type FormatGhLandErrorOptions, GITHUB_GIT_AUTH_MODES, GLOBAL_WORKSPACE_ID, type GetDiffOptions, type GhStackStatus, type GitHubStatus, type GitWorktreeStatus, type GithubGitAuthMode, HARNESS_ENV_KEYS, type HarnessId, type InitStackFromThreadInput, type IntegrationsSettings, type IpcApi, type IssueInfo, type IssueSource, LEGACY_ATTACHMENTS_DIR, LEGACY_PLAN_FILE_REL, LEGACY_REVIEW_REQUEST_PATH, LINEAR_OAUTH_CANCELLED, LINEAR_OAUTH_PORT, LINEAR_OAUTH_REDIRECT, LINEAR_OAUTH_SCOPES, type LandPreview, type LandResult, type LinearComment, type LinearIssue, LinearOAuthCancelledError, type LinearTeam, type LinearTeamsResult, type LinearWorkflowState, type ListIssuesResult, MAX_ANTHROPIC_CACHE_CONTROL_BLOCKS, type McpServerStatus, type MessagePart, ORCHESTRATOR_AGENT_KINDS, type OpenPrStackLayersInput, type OpenStackLayerInput, type OpenStackLayerResult, type OrchestrationQuotaOnLimit, Orchestrator, type OrchestratorAgentKind, type OrchestratorEvent, type OrchestratorRuntime, type OrphanWorktree, PASTE_ATTACH_MIN_CHARS, PASTE_ATTACH_MIN_LINES, PLAN_FILE_NAME, PLAN_FILE_REL, PLAN_MODE_INSTRUCTION, type PendingPlanQuestions, type PlanQuestion, type PlanQuestionAnswer, type PlanQuestionOption, type PlanToolPartLike, type PrActor, type PrCheckRun, type PrCommentInfo, type PrCommitInfo, type PrDetails, type PrInfo, type PrMeta, type PrReviewInfo, type PrStack, type PrStackLayer, type PresentedPlan, type PublicAppSettings, type PublicIntegrationsSettings, REPO_REVIEW_NAME, REPO_REVIEW_PATH, REVIEW_REQUEST_NAME, REVIEW_REQUEST_PATH, REVIEW_REQUEST_PREFILL, REVIEW_REQUEST_TEMPLATE, type RepoSettings, type RepoSetupInfo, type RequestReviewResult, type ResolvedReviewGuidelines, type ReviewGuidelinesSource, type RunMode, type RunScript, SIDEBOARD_FORCE_STOP, SIDEBOARD_MCP_ALLOWED_TOOLS, SIDEBOARD_MCP_PROFILE_ENV, SLACK_LISTEN_BUSY_REPLY, SLACK_LISTEN_STOPPED_REPLY, SLACK_LISTEN_TIMEOUT_REPLY, SLACK_OAUTH_CANCELLED, SLACK_OAUTH_REDIRECT, SLACK_REPLY_FORMATTING, SLACK_SEEN_REACTION, type ScriptHandle, type SideboardMcpProfile, type SkillInfo, type SlackInboundMessage, type SlackListenOptions, type SlackListenStatus, SlackOAuthCancelledError, type SlackOutboundReply, type SlackOutboundWatch, type SlackRelayClientMessage, type SlackRelayClientOptions, SlackRelayHub, type SlackRelayServerHandle, type SlackRelayServerMessage, type SlackRelayServerOptions, type SlackReplyBadge, type SlackWorkspaceInfo, type SourceType, type SpawnTurnHandle, type SummarizeResult, THINKING_EFFORTS, type TeamName, type ThinkingEffort, type Thread, type ThreadAttachment, type ThreadMessage, type ThreadOptionsPatch, type ThreadStatus, type TokenUsage, type ToolPartLike, type TranscriptToolDetail, type TurnCommand, type UsageScope, type Workspace, type WorkspaceInventoryEntry, type WorkspaceScriptEnvOpts, ackSlackInboundSeen, addPrStackLayer, addStackLayerFromThread, addWorkspace, adoptThread, agentGitPrompt, allAdapters, allocatePort, allocatePortRange, allocateTeamName, allocateTeamSlug, appDataDir, appSettingsPath, appendIndexedGitConfig, appendMessage, applyAgentEvent, applyAppEnvironment, applyCompaction, applyGithubGitAuthEnv, applyThreadIntoMain, applyTurnUsage, assertOrchestratorCapableAgent, attachmentFromAbsolutePath, attachmentsFromBuffers, attachmentsFromWorktreePaths, attachmentsGitignoreBody, autoArchiveOnMergeEnabled, autoCleanupOrphansEnabled, autoRenameBranchEnabled, autoRunAfterSetupEnabled, branchDisplayLabel, brightsyAdapter, brightsyCloudConnectAgent, brightsyCloudConnectEnabled, brightsyConfigPath, brightsyInjectWorktreeMcpEnabled, brightsyMcpAllowedTools, brightsyMcpServerName, buildCachedUserContent, buildClaudeStreamJsonUserMessage, buildDiffCommentAttachment, buildForkTranscriptAttachment, buildPastedTextAttachment, buildReviewRequestAttachment, buildSessionSeed, buildWorkspaceScriptEnv, caffeinateHoldPath, caffeinateWhileCloudConnectEnabled, caffeinateWhileRunningEnabled, caffeinateWhileSlackListenEnabled, captureLoginEnv, captureTurnBaseline, checkoutPrStackLayer, childEnvWithAppSettings, claudeAdapter, claudeChromeEnabled, claudeUserSettingsPath, cleanupOrphanWorktrees, cloneRepoIntoSideboard, codexAdapter, codexUnattendedGitConfigArgs, coerceOrchestratorAgent, collectTakenTeamSlugs, commentLinearIssue, commitAll, conductorBundledBinDir, conductorDbPath, confirmLand, connectBrightsyTeam, connectSlackToken, contextTokens, coordinatorSystemPrompt, coordinatorTurnReminder, copyConfiguredFiles, countCacheControlBlocks, createChatTab, createEmptyThread, createExistingBranchWorktree, createGlobalChat, createLinearIssue, createLinearPkce, createOrUpdatePr, createPrStack, createThread, createThreadWorktree, currentBranch, cursorAdapter, cursorSdkMessageToEvents, decodeBrightsyTarget, deleteBranchOnPurgeEnabled, deleteThreadRecord, detectAgents, detectGhStack, detectLocalMergeConflicts, disconnectBrightsyTeam, disconnectLinear, disconnectLinearConnection, disconnectSlackWorkspace, discoverSkills, dismissSlackReplyBadge, dropCachedPrefixOnResume, encodeBrightsyTarget, enrichPathWithNpmGlobalBin, enrichWorkspacesWithGithub, ensureAgentPath, ensureCloudCoordinator, ensureGhPreferOrigin, ensureGlobalCoordinatorCwd, ensureReviewRequestFile, ensureSlackCoordinator, ensureSlackDeviceIdentity, ensureWorkspace, estimateMessageChars, estimateThreadChars, expandComposerPrompt, extractGhErrorDetail, extractPendingPlanQuestions, extractPresentedPlan, extractiveSummary, fetchPrHead, finalizeParts, findInvalidCacheControlTtlOrder, findOrphanWorktrees, findThreadByRef, findThreadForStackLayer, flattenTurnInput, forkChatTab, forkMessageSlice, forkThreadWorktree, formatAgentInstructions, formatArtifactDirective, formatBrightsyFetchError, formatFetchError, formatGhLandError, formatGitAuthModeDirective, formatIpcInvokeError, formatMergePrError, formatMessagesAsTranscript, formatPlanQuestionAnswers, formatPlanQuestionsForChat, formatProcessGuideDirective, formatRateLimitResetHint, formatRenameBranchDirective, formatSlackExternalReplyPrompt, formatSlackInboundPrompt, formatSlackRepliesForTurn, formatSlackSignedReply, formatTranscriptMarkdown, formatUiReminder, formatWorkspaceInventory, formatWorktreeDirective, formatWorktreeReminder, fromInclusiveInputUsage, getAdapter, getAgentSetupInfo, getBrightsySession, getCaffeinateHold, getDefaultAgent, getDefaultEffort, getDefaultFast, getDefaultModel, getDefaultRunScript, getDiff, getDiffSummary, getGitHubStatus, getGithubGitAuthMode, getGithubPat, getIssueSource, getLinearApiKey, getLinearAuthToken, getLinearIssue, getOrchestrator, getPr, getPrChecks, getPrDetails, getPrMeta, getPrStack, getRepoSetupInfo, getRunMode, getRunScript, getSlackWorkspace, gh, ghHeadRef, ghRepoSelectArgs, git, githubAgentGitEnv, globalAgentCwd, handleSlackInbound, harnessEnvKey, hasBakedLinearOAuth, hasBakedSlackOAuth, hasConductorHook, hasCursorWorktreeSetup, hasRepoHook, hasWorkspaceHook, healOrchestrationSoccerTitles, httpFetch, importConductorWorkspace, importConductorWorkspaceAsync, initPrStack, initStackFromThread, initializeGitRepository, inspectGitWorktree, installAgent, isAskUserToolName, isBrightsyConnected, isBrightsyNdjsonLine, isCloudCoordinatorThread, isConductorBundledCli, isCursorAutoModel, isDirty, isGhRateLimitError, isGlobalRepoPath, isGlobalThread, isImageFilePath, isInPrStack, isInboundForThisDesktop, isLinearConnected, isLinearOAuthCancelled, isOrchestratorCapableAgent, isOrchestratorThread, isPidAlive, isPlaceholderBranch, isPrNotMergeableError, isPresentPlanToolName, isSessionQuotaLimit, isSideboardScratchPath, isSlackCoordinatorThread, isSlackExternalReplyPrompt, isSlackOAuthCancelled, isThinkingEffort, isThreadCaffeinated, isWorkspaceScratchPath, linearAuthorizationHeader, linearGraphql, linearOAuthAuthorizeUrl, linearOAuthCredentials, listAgentSetupInfo, listBranchCommits, listBranches, listBrightsyAccounts, listBrightsyChatTargets, listCodexModels, listConductorWorkspaces, listConnectedBrightsyTeams, listCursorModels, listGitHubIssues, listGlobalThreads, listIssues, listLinearIssues, listLinearIssuesDirect, listLinearTeams, listModelsForAgent, listOpencodeModels, listPrs, listRunScripts, listSlackOutboundWatches, listSlackReplyBadges, listSlackWorkspaces, listThreads, listWorkspaces, listWorktreeFiles, listWorktrees, loadAgentInstructions, loadAppSettings, loadBrightsyConfig, loadConductorSettings, loadRepoSettings, loadWorkspaceSettings, locksDir, loginAgent, lookupSoccerTeam, maxConcurrentAgents, maybeCompactContext, mcpAllowTools, mcpAuthWarnings, mergePr, mergePrStack, mergeUsage, nextPastedTextName, nextThinkingEffort, nonInteractiveGitProcessEnv, normalizeParseResult, normalizeThinkingEffort, normalizeThread, normalizeTurnInput, normalizeWorktreePath, openInSystemTerminal, openPrStackLayers, openStackLayer, opencodeAdapter, orchestrationQuotaFallbackAgent, orchestrationQuotaOnLimit, orchestrationTitleNeedsSoccerNickname, orchestratorSessionPoisonedByBuiltins, originGhRepoEnv, parseCursorRunnerLine, parseForceStopMessage, parseGhStackViewJson, parseGithubSlugFromRemoteUrl, parseMcpList, parsePlanQuestionsInput, parseSessionQuotaResetAt, parseSlackRelayClientMessage, parseSlackRelayServerMessage, partsToAssistantText, pastedTextStats, pendingSlackExternalReplies, permalinkForSlackReplyBadge, permissionMode, persistVaultKeyInKeychain, planFileAbs, posixShellSingleQuote, prepareTerminalCommand, previewLand, promptMentionsBrightsy, pushBranch, readExistingReviewRequestFile, readKeychainVaultKey, readPlanFile, readSkillBody, readThread, readWorktreeFile, readWorktreeFileForUpload, readWorktreeInclude, recordSlackOutboundWatch, refreshGitHubAuth, refreshSlackReplyBadges, releaseCaffeinateHoldForThread, removeWorkspace, removeWorktree, repoSlug, requestOccupancy, requestReview, requireAgent, resetGhStackDetectCache, resolveAgentExecutable, resolveAgentGitAuthEnv, resolveClaudeExecutable, resolveCommandBinarySync, resolveConductorCursorAgentId, resolveCursorModelId, resolveDefaultBranch, resolveDiffBaseRef, resolveEffectiveIssueSource, resolveFilesToCopy, resolveGhAuthToken, resolveGithubAgentToken, resolveGithubRepoSlug, resolveLinearState, resolveLinearTeam, resolveLoginCommand, resolveNewThreadOptions, resolvePlanMarkdown, resolvePrSelector, resolveQuotaFallbackAgent, resolveRepoRoot, resolveReviewGuidelines, resolveSlackListenMode, resolveThreadDefaults, resolveThreadEffort, resolveVaultKey, resolveWorktreeStartPoint, rewriteLinearError, run, runArchiveScript, runCloudConnect, runCursorWorktreeSetup, runSetupScript, runSlackListen, runSlackRelayClient, sameWorktreePath, sanitizeMcpServerName, saveAppSettings, saveLinearOAuth, secureFileUnlocksWith, setCaffeinateHold, setHttpFetchImpl, setStatus, setVaultMasterKey, settingsSourceLabel, shouldAttachPastedText, shouldCompactContext, shouldInjectBrightsyMcp, shouldRefreshReviewRequestTemplate, shouldRunWorktreeCleanup, sideboardHomeDir, sideboardMcpProfile, sideboardReposDir, sideboardWorkspacesDir, slackAppLevelToken, slackArchiveUrl, slackCoordinatorSourceRef, slackListenEnabled, slackOAuthCredentials, slackOAuthResultUrl, slackRelayUrl, slugify, spawnAgentTurn, splitForCompaction, stackAgentDefaultsFrom, stackIdFrom, stackMergeReadiness, stageAbsolutePathsAsAttachments, stageBuffersAsAttachments, startDevServer, startLinearOAuth, startMcpServer, startOrchestration, startSlackOAuth, startSlackRelayServer, stripBrightsyNdjsonNoise, stripNestedElectronEnv, submitPrStack, suggestSlug, summarizeConversation, switchBrightsyAccount, syncWorkspacesFromThreads, takenTeamSlugsForChatTab, takenTeamSlugsForOrchestration, taskMessageText, thinkingEffortBars, thinkingEffortLabel, threadDisplayLabel, threadFilePath, threadLockPath, threadRequestsBrightsyMcp, threadsDir, threadsSharingWorktree, toPublicAppSettings, toolDescription, toolDetail, toolFilePath, totalTokens, updateAdvancedSettings, updateAgentExecutable, updateAppEnvironment, updateBrightsySettings, updateClaudeSettings, updateCodexSettings, updateDefaultsSettings, updateIntegrationsSettings, updateLinearIssue, updateOpencodeSettings, updateThread, validateLinearApiKey, withAgentInstructions, withExportedPath, withThreadLock, workspaceSettingsSourceLabel, worktreeCleanupSettings, worktreeDisplayLabel, worktreeDisplayLabelForGroup, worktreeNameFromPath, worktreesRoot, writeInjectedMcpConfig, writePlanFile, writeThread, writeWorktreeFile };