@sideboard-ai/core 0.1.83 → 0.1.85

package/dist/mcp/run-stdio.cjs

@@ -54,6 +54,9 @@ function wrapElectronAsNodeLaunch(file, args) {
     args: ["-c", STRIP_NESTED_ELECTRON_THEN_EXEC, "sh", file, ...args]
   };
 }
+function isStrippedElectronLaunch(command, args) {
+  return command === "/bin/sh" && Boolean(args?.[1]?.includes("ELECTRON_RUN_AS_NODE") && args[1].includes("unset"));
+}
 var NESTED_ELECTRON_ENV_PREFIXES, STRIP_NESTED_ELECTRON_THEN_EXEC;
 var init_nested_electron_env = __esm({
   "src/hook/nested-electron-env.ts"() {
@@ -730,20 +733,36 @@ function pushTurnStderr(tail, line, maxLines = 12) {
   tail.push(trimmed);
   while (tail.length > maxLines) tail.shift();
 }
+function looksLikeMinifiedJsDump(line) {
+  if (line.length < 200) return false;
+  return /yield Promise\.all/.test(line) || /\(0,[A-Za-z$]\.\w+\)/.test(line) || /CURSOR_RIPGREP_PATH/.test(line);
+}
+function looksLikeNestedElectronCrash(line) {
+  return /HasCustomHostObject|ElectronInitializeICUandStartNode/i.test(line);
+}
+function clipStderr(text3, maxChars) {
+  const trimmed = text3.trim();
+  if (trimmed.length <= maxChars) return trimmed;
+  return trimmed.slice(0, maxChars);
+}
 function summarizeTurnStderr(tail, maxChars = 500) {
   if (tail.length === 0) return "";
+  const cursorStartup = [...tail].reverse().find((line) => /cursor startup failed:/i.test(line));
+  if (cursorStartup) return clipStderr(cursorStartup, maxChars);
+  if (tail.some(looksLikeNestedElectronCrash)) return NESTED_ELECTRON_SUMMARY;
   const moduleMissing = [...tail].reverse().find((line) => /cannot find module/i.test(line));
-  if (moduleMissing) {
-    return moduleMissing.length <= maxChars ? moduleMissing : moduleMissing.slice(0, maxChars);
+  if (moduleMissing) return clipStderr(moduleMissing, maxChars);
+  const useful = tail.filter((line) => !looksLikeMinifiedJsDump(line));
+  if (useful.length === 0 && tail.some(looksLikeMinifiedJsDump)) {
+    return MINIFIED_DUMP_SUMMARY;
   }
-  const joined = tail.slice(-6).join("\n").trim();
-  if (joined.length <= maxChars) return joined;
-  return joined.slice(joined.length - maxChars);
+  const joined = (useful.length ? useful : tail).slice(-6).join("\n").trim();
+  return clipStderr(joined, maxChars);
 }
 function looksLikeInvalidAgentSession(text3) {
   const lower = text3.trim().toLowerCase();
   if (!lower) return false;
-  return /session not found/.test(lower) || /no conversation found/.test(lower) || /conversation .+ not found/.test(lower) || /thread .+ not found/.test(lower) || /unknown session/.test(lower) || /invalid session/.test(lower) || /session .+ (missing|expired|deleted|gone)/.test(lower) || /cannot resume/.test(lower) || /failed to (load|resume|open) session/.test(lower);
+  return /session not found/.test(lower) || /no conversation found/.test(lower) || /conversation .+ not found/.test(lower) || /thread .+ not found/.test(lower) || /unknown session/.test(lower) || /invalid session/.test(lower) || /session .+ (missing|expired|deleted|gone)/.test(lower) || /cannot resume/.test(lower) || /failed to (load|resume|open) session/.test(lower) || /corrupt local agent checkpoint/.test(lower) || /missing root blob/.test(lower) || /\bagent\b.{0,120}\bnot found\b/.test(lower);
 }
 function looksLikeAgentFailureMessage(text3) {
   const lower = text3.trim().toLowerCase();
@@ -783,6 +802,12 @@ function humanizeAgentFailDetail(detail) {
   if (/context.*(too long|exceed)|prompt is too long|conversation too long/.test(lower)) {
     return `${raw} \u2014 start a new chat or compact context, then retry.`;
   }
+  if (/hascustomhostobject|electroninitializeicuandstartnode|nested chromium/i.test(lower)) {
+    return `${raw} \u2014 retry the turn; if it keeps failing, pick another agent.`;
+  }
+  if (/corrupt local agent checkpoint|missing root blob|truncated crash dump/.test(lower)) {
+    return `${raw} \u2014 retry the turn (Sideboard will start a fresh Cursor session).`;
+  }
   return raw;
 }
 function formatTurnExitError(exitCode, stderrSummary) {
@@ -798,11 +823,13 @@ function formatTurnExitError(exitCode, stderrSummary) {
   if (looksLikeAgentFailureMessage(raw)) return detail;
   return `exit ${code}: ${detail}`;
 }
-var NODE_VERSION_FOOTER;
+var NODE_VERSION_FOOTER, NESTED_ELECTRON_SUMMARY, MINIFIED_DUMP_SUMMARY;
 var init_error_detail = __esm({
   "src/agents/error-detail.ts"() {
     "use strict";
     NODE_VERSION_FOOTER = /^Node\.js v\d+/i;
+    NESTED_ELECTRON_SUMMARY = "Cursor local agent crashed at Electron startup (nested Chromium / HasCustomHostObject)";
+    MINIFIED_DUMP_SUMMARY = "Cursor local agent crashed during startup (truncated crash dump)";
   }
 });
 
@@ -1705,261 +1732,9 @@ var init_gh_errors = __esm({
   }
 });
 
-// src/git/git-auth-mode.ts
-function appendIndexedGitConfig(existing, entries) {
-  const start = Number.parseInt(String(existing?.GIT_CONFIG_COUNT ?? "0"), 10);
-  const count = Number.isFinite(start) && start > 0 ? start : 0;
-  const out = {};
-  entries.forEach((entry, i) => {
-    const n = count + i;
-    out[`GIT_CONFIG_KEY_${n}`] = entry.key;
-    out[`GIT_CONFIG_VALUE_${n}`] = entry.value;
-  });
-  out.GIT_CONFIG_COUNT = String(count + entries.length);
-  return out;
-}
-function githubAgentGitEnv(existing) {
-  return appendIndexedGitConfig(existing, HTTPS_REWRITE);
-}
-function applyGithubGitAuthEnv(existing, opts) {
-  const out = {};
-  if (opts.mode === "gh" || opts.mode === "token") {
-    Object.assign(out, githubAgentGitEnv(existing));
-  }
-  if (opts.mode === "token") {
-    const token = opts.token?.trim();
-    if (token && !existing?.GH_TOKEN?.trim()) {
-      out.GH_TOKEN = token;
-    }
-  }
-  return out;
-}
-function formatGitAuthModeDirective(mode) {
-  switch (mode) {
-    case "gh":
-      return [
-        "Git authentication (Account \u2192 GitHub mode: gh CLI):",
-        "- This process rewrites `git@github.com:` and `ssh://git@github.com/` to HTTPS.",
-        "- `gh` supplies credentials (`gh auth git-credential`). Do not switch remotes to SSH.",
-        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
-      ].join("\n");
-    case "ssh":
-      return [
-        "Git authentication (Account \u2192 GitHub mode: SSH):",
-        "- Keep SSH remotes (`git@github.com:\u2026`). Do not rewrite them to HTTPS.",
-        "- Use this Mac\u2019s SSH agent / keys. If push fails with `Permission denied (publickey)`, tell the user to start ssh-agent or switch Account \u2192 GitHub to Auto / gh CLI \u2014 do not rewrite remotes yourself.",
-        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below (API still uses `gh`)."
-      ].join("\n");
-    case "token":
-      return [
-        "Git authentication (Account \u2192 GitHub mode: personal access token):",
-        "- This process rewrites GitHub SSH remotes to HTTPS.",
-        "- `GH_TOKEN` is set in the environment. Use HTTPS git and `gh`; do not paste the token into commands or chat.",
-        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
-      ].join("\n");
-    case "auto":
-    default:
-      return [
-        "Git authentication (Account \u2192 GitHub mode: auto):",
-        "- Prefer the existing remote URL (SSH or HTTPS). Do not rewrite remotes unless a push/fetch fails.",
-        '- If `git push` fails with `Permission denied (publickey)`, this shell has no ssh-agent. Retry over HTTPS (do not stop): `git -c url.https://github.com/.insteadOf=git@github.com: -c http.extraHeader="AUTHORIZATION: bearer $(gh auth token)" push -u origin HEAD`.',
-        "- Then create/update the PR with `gh` as below."
-      ].join("\n");
-  }
-}
-var HTTPS_REWRITE;
-var init_git_auth_mode = __esm({
-  "src/git/git-auth-mode.ts"() {
-    "use strict";
-    HTTPS_REWRITE = [
-      { key: "url.https://github.com/.insteadOf", value: "git@github.com:" },
-      { key: "url.https://github.com/.insteadOf", value: "ssh://git@github.com/" },
-      { key: "credential.https://github.com.helper", value: "!gh auth git-credential" }
-    ];
-  }
-});
-
-// src/agents/path.ts
-function prependPathDir(env, dir) {
-  if (!dir || !(0, import_node_fs8.existsSync)(dir)) return;
-  const current = env.PATH ?? "";
-  const parts = current.split(import_node_path8.delimiter).filter(Boolean);
-  if (parts.includes(dir)) {
-    env.PATH = current;
-    return;
-  }
-  env.PATH = [dir, ...parts].join(import_node_path8.delimiter);
-}
-function conductorBundledBinDir(home = process.env.HOME || process.env.USERPROFILE || (0, import_node_os3.homedir)()) {
-  return (0, import_node_path8.join)(home, "Library", "Application Support", "com.conductor.app", "bin");
-}
-function isConductorBundledCli(filePath) {
-  const p = (filePath ?? "").replace(/\\/g, "/");
-  return p.includes("/com.conductor.app/bin/") || p.endsWith("/com.conductor.app/bin");
-}
-function ensureAgentPath(env = process.env) {
-  const home = env.HOME || env.USERPROFILE || (0, import_node_os3.homedir)();
-  const current = env.PATH ?? "";
-  const parts = current.split(import_node_path8.delimiter).filter(Boolean);
-  const seen = new Set(parts);
-  const extras = [
-    ...EXTRA_BIN_DIRS.map((rel) => (0, import_node_path8.join)(home, rel)),
-    "/opt/homebrew/bin",
-    "/usr/local/bin",
-    // Keep after Homebrew/npm so a user-installed CLI still wins.
-    conductorBundledBinDir(home)
-  ];
-  for (const dir of extras.reverse()) {
-    if (!dir || seen.has(dir) || !(0, import_node_fs8.existsSync)(dir)) continue;
-    parts.unshift(dir);
-    seen.add(dir);
-  }
-  const next = parts.join(import_node_path8.delimiter);
-  env.PATH = next;
-  return next;
-}
-function enrichPathWithNpmGlobalBin(env = process.env) {
-  ensureAgentPath(env);
-  try {
-    const prefix = (0, import_node_child_process2.execFileSync)("npm", ["prefix", "-g"], {
-      encoding: "utf8",
-      env: { ...process.env, ...env },
-      timeout: 8e3,
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim().split(/\r?\n/).find(Boolean);
-    if (prefix) {
-      const binDir = process.platform === "win32" ? prefix : (0, import_node_path8.join)(prefix, "bin");
-      prependPathDir(env, binDir);
-    }
-  } catch {
-  }
-  return env.PATH ?? "";
-}
-function posixShellSingleQuote(value) {
-  return `'${value.replace(/'/g, `'\\''`)}'`;
-}
-function resolveCommandBinarySync(command, whichPath) {
-  const trimmed = command.trim();
-  if (!trimmed) return trimmed;
-  const match = /^(\S+)(\s[\s\S]*)?$/.exec(trimmed);
-  if (!match) return trimmed;
-  const bin = match[1];
-  const rest = match[2] ?? "";
-  if (bin.includes("/") || bin.includes("\\")) return trimmed;
-  const abs = whichPath?.trim().split(/\r?\n/).find(Boolean);
-  if (!abs) return trimmed;
-  return `${abs}${rest}`;
-}
-function withExportedPath(command, pathValue) {
-  const trimmed = command.trim();
-  if (!trimmed) return trimmed;
-  if (/^(export\s+PATH=|PATH=)/.test(trimmed)) return trimmed;
-  return `export PATH=${posixShellSingleQuote(pathValue)} && ${trimmed}`;
-}
-var import_node_fs8, import_node_child_process2, import_node_os3, import_node_path8, EXTRA_BIN_DIRS;
-var init_path = __esm({
-  "src/agents/path.ts"() {
-    "use strict";
-    import_node_fs8 = require("fs");
-    import_node_child_process2 = require("child_process");
-    import_node_os3 = require("os");
-    import_node_path8 = require("path");
-    EXTRA_BIN_DIRS = [
-      ".local/bin",
-      ".cargo/bin",
-      ".nvm/current/bin",
-      ".asdf/shims",
-      ".volta/bin",
-      ".npm-global/bin",
-      // fnm default alias (common when shell init is skipped)
-      ".local/share/fnm/aliases/default/bin",
-      // pnpm / npm global bins (where `@brightsy/cli` typically lands)
-      "Library/pnpm",
-      ".pnpm"
-    ];
-  }
-});
-
-// src/git/run.ts
-var run_exports = {};
-__export(run_exports, {
-  gh: () => gh,
-  git: () => git,
-  resolveGhAuthToken: () => resolveGhAuthToken,
-  run: () => run
-});
-async function run(file, args, opts) {
-  ensureAgentPath();
-  try {
-    const result = await (0, import_execa.execa)(file, args, {
-      cwd: opts?.cwd,
-      env: { ...process.env, ...opts?.env },
-      reject: opts?.reject ?? true,
-      ...opts?.timeoutMs != null ? { timeout: opts.timeoutMs } : {}
-    });
-    return {
-      stdout: result.stdout ?? "",
-      stderr: result.stderr ?? "",
-      exitCode: result.exitCode ?? 0
-    };
-  } catch (err) {
-    const e = err;
-    if (opts?.reject === false) {
-      return {
-        stdout: String(e.stdout ?? ""),
-        stderr: String(e.stderr ?? ""),
-        exitCode: e.exitCode ?? 1
-      };
-    }
-    throw err;
-  }
-}
-async function git(args, cwd, opts) {
-  const prefix = [];
-  if (opts?.config) {
-    for (const [key, value] of Object.entries(opts.config)) {
-      if (!key) continue;
-      prefix.push("-c", `${key}=${value}`);
-    }
-  }
-  return run("git", ["--no-pager", ...prefix, ...args], {
-    cwd,
-    reject: opts?.reject,
-    timeoutMs: opts?.timeoutMs,
-    // Never block forever on a credential/SSH prompt inside MCP / Electron.
-    env: {
-      GIT_TERMINAL_PROMPT: "0",
-      GIT_ASKPASS: process.env.GIT_ASKPASS || "echo",
-      GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND || "ssh -o BatchMode=yes -o ConnectTimeout=15",
-      ...opts?.env
-    }
-  });
-}
-async function gh(args, cwd, opts) {
-  return run("gh", args, {
-    cwd,
-    reject: opts?.reject,
-    timeoutMs: opts?.timeoutMs
-  });
-}
-async function resolveGhAuthToken(cwd) {
-  const result = await gh(["auth", "token"], cwd, { reject: false });
-  if (result.exitCode !== 0) return null;
-  const token = result.stdout.trim();
-  return token || null;
-}
-var import_execa;
-var init_run = __esm({
-  "src/git/run.ts"() {
-    "use strict";
-    import_execa = require("execa");
-    init_path();
-  }
-});
-
 // src/store/secret-vault.ts
 function secretVaultPath() {
-  return (0, import_node_path9.join)(appDataDir(), "secrets.json");
+  return (0, import_node_path8.join)(appDataDir(), "secrets.json");
 }
 function loadSecretVault() {
   const parsed = readSecureJson(secretVaultPath());
@@ -2003,11 +1778,11 @@ function normalizeVault(raw) {
   }
   return out;
 }
-var import_node_path9;
+var import_node_path8;
 var init_secret_vault = __esm({
   "src/store/secret-vault.ts"() {
     "use strict";
-    import_node_path9 = require("path");
+    import_node_path8 = require("path");
     init_paths();
     init_secure_file();
   }
@@ -2108,10 +1883,10 @@ function toPublicAppSettings(settings) {
   };
 }
 function appSettingsPath() {
-  return (0, import_node_path10.join)(appDataDir(), "settings.json");
+  return (0, import_node_path9.join)(appDataDir(), "settings.json");
 }
 function claudeUserSettingsPath() {
-  return (0, import_node_path10.join)((0, import_node_os4.homedir)(), ".claude", "settings.json");
+  return (0, import_node_path9.join)((0, import_node_os3.homedir)(), ".claude", "settings.json");
 }
 function normalizeClaude(raw) {
   if (!raw || typeof raw !== "object") return {};
@@ -2354,10 +2129,10 @@ function normalizeSettings(raw) {
 }
 function readSettingsFile() {
   const path = appSettingsPath();
-  if (!(0, import_node_fs9.existsSync)(path)) return { ...EMPTY_SETTINGS };
+  if (!(0, import_node_fs8.existsSync)(path)) return { ...EMPTY_SETTINGS };
   try {
     chmodOwnerOnly(path);
-    const parsed = JSON.parse((0, import_node_fs9.readFileSync)(path, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs8.readFileSync)(path, "utf8"));
     return normalizeSettings(parsed);
   } catch {
     return { ...EMPTY_SETTINGS };
@@ -2742,7 +2517,7 @@ function ensureSlackDeviceIdentity(settings = loadAppSettings()) {
   }
   if (!deviceLabel) {
     try {
-      deviceLabel = (0, import_node_os4.hostname)().split(".")[0]?.trim() || "This Mac";
+      deviceLabel = (0, import_node_os3.hostname)().split(".")[0]?.trim() || "This Mac";
     } catch {
       deviceLabel = "This Mac";
     }
@@ -2830,145 +2605,472 @@ function caffeinateWhileRunningEnabled(settings = loadAppSettings()) {
 function caffeinateWhileSlackListenEnabled(settings = loadAppSettings()) {
   return Boolean(settings.advanced.caffeinateWhileSlackListen);
 }
-function caffeinateWhileCloudConnectEnabled(settings = loadAppSettings()) {
-  return caffeinateWhileSlackListenEnabled(settings);
+function caffeinateWhileCloudConnectEnabled(settings = loadAppSettings()) {
+  return caffeinateWhileSlackListenEnabled(settings);
+}
+function deleteBranchOnPurgeEnabled(settings = loadAppSettings()) {
+  return Boolean(settings.advanced.deleteBranchOnPurge);
+}
+function autoArchiveOnMergeEnabled(settings = loadAppSettings()) {
+  return Boolean(settings.advanced.autoArchiveOnMerge);
+}
+function autoCleanupOrphansEnabled(settings = loadAppSettings()) {
+  return Boolean(settings.advanced.autoCleanupOrphans);
+}
+function orchestrationQuotaOnLimit(settings = loadAppSettings()) {
+  return settings.advanced.orchestrationQuotaOnLimit ?? "switch_agent";
+}
+function orchestrationQuotaFallbackAgent(settings = loadAppSettings()) {
+  const preferred = settings.advanced.orchestrationQuotaFallbackAgent;
+  if (preferred && DEFAULT_AGENTS.has(preferred) && preferred !== "brightsy") {
+    return preferred;
+  }
+  return "cursor";
+}
+function maxConcurrentAgents(settings = loadAppSettings()) {
+  const n = settings.advanced.maxConcurrent;
+  if (typeof n === "number" && Number.isFinite(n)) {
+    return Math.max(1, Math.min(32, Math.floor(n)));
+  }
+  return 3;
+}
+function resolveClaudeExecutable(settings = loadAppSettings()) {
+  return resolveAgentExecutable("claude", settings);
+}
+function resolveAgentExecutable(agent, settings = loadAppSettings()) {
+  const fallback = DEFAULT_CLI_BIN[agent];
+  if (agent === "claude") {
+    const override2 = settings.claude.executablePath?.trim();
+    return override2 || fallback;
+  }
+  if (agent === "codex") {
+    const override2 = settings.codex.executablePath?.trim();
+    return override2 || fallback;
+  }
+  if (agent === "opencode") {
+    const override2 = settings.opencode.executablePath?.trim();
+    return override2 || fallback;
+  }
+  const override = settings.brightsy.executablePath?.trim();
+  return override || fallback;
+}
+function updateAgentExecutable(agent, executablePath) {
+  if (agent === "claude") {
+    return updateClaudeSettings({ executablePath });
+  }
+  if (agent === "codex") {
+    return updateCodexSettings({ executablePath });
+  }
+  if (agent === "opencode") {
+    return updateOpencodeSettings({ executablePath });
+  }
+  return updateBrightsySettings({ executablePath });
+}
+function claudeChromeEnabled(settings = loadAppSettings()) {
+  return Boolean(settings.claude.chromeEnabled);
+}
+function applyAppEnvironment(target = process.env, settings = loadAppSettings()) {
+  for (const [key, value] of Object.entries(settings.environment)) {
+    if (!key || value == null || value === "") continue;
+    if (target[key] == null || target[key] === "") {
+      target[key] = value;
+    }
+  }
+  return target;
+}
+function childEnvWithAppSettings(extra) {
+  const settings = loadAppSettings();
+  const env = stripNestedElectronEnv({ ...process.env });
+  applyAppEnvironment(env, settings);
+  if (extra) {
+    for (const [k, v] of Object.entries(extra)) {
+      if (v != null) env[k] = v;
+    }
+  }
+  return env;
+}
+function harnessEnvKey(harness) {
+  return HARNESS_ENV_KEYS[harness];
+}
+var import_node_crypto3, import_node_fs8, import_node_os3, import_node_path9, HARNESS_ENV_KEYS, DEFAULT_AGENTS, GITHUB_GIT_AUTH_MODES, CLOUD_CONNECT_AGENTS, ISSUE_SOURCES, GIT_AUTH_MODES, EMPTY_SETTINGS, DEFAULT_CLI_BIN;
+var init_app_settings = __esm({
+  "src/store/app-settings.ts"() {
+    "use strict";
+    import_node_crypto3 = require("crypto");
+    import_node_fs8 = require("fs");
+    import_node_os3 = require("os");
+    import_node_path9 = require("path");
+    init_thinking_effort();
+    init_nested_electron_env();
+    init_paths();
+    init_private_file();
+    init_secret_vault();
+    HARNESS_ENV_KEYS = {
+      claude: "ANTHROPIC_API_KEY",
+      codex: "CODEX_API_KEY",
+      cursor: "CURSOR_API_KEY",
+      opencode: null,
+      brightsy: null
+    };
+    DEFAULT_AGENTS = /* @__PURE__ */ new Set([
+      "claude",
+      "codex",
+      "opencode",
+      "brightsy",
+      "cursor"
+    ]);
+    GITHUB_GIT_AUTH_MODES = ["auto", "gh", "ssh", "token"];
+    CLOUD_CONNECT_AGENTS = /* @__PURE__ */ new Set([
+      "claude",
+      "codex",
+      "opencode",
+      "cursor"
+    ]);
+    ISSUE_SOURCES = /* @__PURE__ */ new Set(["linear", "github"]);
+    GIT_AUTH_MODES = new Set(GITHUB_GIT_AUTH_MODES);
+    EMPTY_SETTINGS = {
+      environment: {},
+      claude: {},
+      codex: {},
+      opencode: {},
+      brightsy: {},
+      integrations: {},
+      defaults: {},
+      advanced: {}
+    };
+    DEFAULT_CLI_BIN = {
+      claude: "claude",
+      codex: "codex",
+      opencode: "opencode",
+      brightsy: "brightsy"
+    };
+  }
+});
+
+// src/agents/path.ts
+function prependPathDir(env, dir) {
+  if (!dir || !(0, import_node_fs9.existsSync)(dir)) return;
+  const current = env.PATH ?? "";
+  const parts = current.split(import_node_path10.delimiter).filter(Boolean);
+  if (parts.includes(dir)) {
+    env.PATH = current;
+    return;
+  }
+  env.PATH = [dir, ...parts].join(import_node_path10.delimiter);
+}
+function conductorBundledBinDir(home = process.env.HOME || process.env.USERPROFILE || (0, import_node_os4.homedir)()) {
+  return (0, import_node_path10.join)(home, "Library", "Application Support", "com.conductor.app", "bin");
+}
+function isConductorBundledCli(filePath) {
+  const p = (filePath ?? "").replace(/\\/g, "/");
+  return p.includes("/com.conductor.app/bin/") || p.endsWith("/com.conductor.app/bin");
+}
+function ensureAgentPath(env = process.env) {
+  const home = env.HOME || env.USERPROFILE || (0, import_node_os4.homedir)();
+  const current = env.PATH ?? "";
+  const parts = current.split(import_node_path10.delimiter).filter(Boolean);
+  const seen = new Set(parts);
+  const extras = [
+    ...EXTRA_BIN_DIRS.map((rel) => (0, import_node_path10.join)(home, rel)),
+    "/opt/homebrew/bin",
+    "/usr/local/bin",
+    // Keep after Homebrew/npm so a user-installed CLI still wins.
+    conductorBundledBinDir(home)
+  ];
+  for (const dir of extras.reverse()) {
+    if (!dir || seen.has(dir) || !(0, import_node_fs9.existsSync)(dir)) continue;
+    parts.unshift(dir);
+    seen.add(dir);
+  }
+  const next = parts.join(import_node_path10.delimiter);
+  env.PATH = next;
+  return next;
+}
+function enrichPathWithNpmGlobalBin(env = process.env) {
+  ensureAgentPath(env);
+  try {
+    const prefix = (0, import_node_child_process2.execFileSync)("npm", ["prefix", "-g"], {
+      encoding: "utf8",
+      env: { ...process.env, ...env },
+      timeout: 8e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim().split(/\r?\n/).find(Boolean);
+    if (prefix) {
+      const binDir = process.platform === "win32" ? prefix : (0, import_node_path10.join)(prefix, "bin");
+      prependPathDir(env, binDir);
+    }
+  } catch {
+  }
+  return env.PATH ?? "";
+}
+function posixShellSingleQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function resolveCommandBinarySync(command, whichPath) {
+  const trimmed = command.trim();
+  if (!trimmed) return trimmed;
+  const match = /^(\S+)(\s[\s\S]*)?$/.exec(trimmed);
+  if (!match) return trimmed;
+  const bin = match[1];
+  const rest = match[2] ?? "";
+  if (bin.includes("/") || bin.includes("\\")) return trimmed;
+  const abs = whichPath?.trim().split(/\r?\n/).find(Boolean);
+  if (!abs) return trimmed;
+  return `${abs}${rest}`;
+}
+function withExportedPath(command, pathValue) {
+  const trimmed = command.trim();
+  if (!trimmed) return trimmed;
+  if (/^(export\s+PATH=|PATH=)/.test(trimmed)) return trimmed;
+  return `export PATH=${posixShellSingleQuote(pathValue)} && ${trimmed}`;
+}
+var import_node_fs9, import_node_child_process2, import_node_os4, import_node_path10, EXTRA_BIN_DIRS;
+var init_path = __esm({
+  "src/agents/path.ts"() {
+    "use strict";
+    import_node_fs9 = require("fs");
+    import_node_child_process2 = require("child_process");
+    import_node_os4 = require("os");
+    import_node_path10 = require("path");
+    EXTRA_BIN_DIRS = [
+      ".local/bin",
+      ".cargo/bin",
+      ".nvm/current/bin",
+      ".asdf/shims",
+      ".volta/bin",
+      ".npm-global/bin",
+      // fnm default alias (common when shell init is skipped)
+      ".local/share/fnm/aliases/default/bin",
+      // pnpm / npm global bins (where `@brightsy/cli` typically lands)
+      "Library/pnpm",
+      ".pnpm"
+    ];
+  }
+});
+
+// src/git/run.ts
+var run_exports = {};
+__export(run_exports, {
+  gh: () => gh,
+  git: () => git,
+  resolveGhAuthToken: () => resolveGhAuthToken,
+  run: () => run
+});
+async function run(file, args, opts) {
+  ensureAgentPath();
+  try {
+    const result = await (0, import_execa.execa)(file, args, {
+      cwd: opts?.cwd,
+      env: { ...process.env, ...opts?.env },
+      reject: opts?.reject ?? true,
+      ...opts?.timeoutMs != null ? { timeout: opts.timeoutMs } : {}
+    });
+    return {
+      stdout: result.stdout ?? "",
+      stderr: result.stderr ?? "",
+      exitCode: result.exitCode ?? 0
+    };
+  } catch (err) {
+    const e = err;
+    if (opts?.reject === false) {
+      return {
+        stdout: String(e.stdout ?? ""),
+        stderr: String(e.stderr ?? ""),
+        exitCode: e.exitCode ?? 1
+      };
+    }
+    throw err;
+  }
+}
+async function git(args, cwd, opts) {
+  const prefix = [];
+  if (opts?.config) {
+    for (const [key, value] of Object.entries(opts.config)) {
+      if (!key) continue;
+      prefix.push("-c", `${key}=${value}`);
+    }
+  }
+  return run("git", ["--no-pager", ...prefix, ...args], {
+    cwd,
+    reject: opts?.reject,
+    timeoutMs: opts?.timeoutMs,
+    // Never block forever on a credential/SSH prompt inside MCP / Electron.
+    env: {
+      GIT_TERMINAL_PROMPT: "0",
+      GIT_ASKPASS: process.env.GIT_ASKPASS || "echo",
+      SSH_ASKPASS: process.env.SSH_ASKPASS || "echo",
+      GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND || "ssh -o BatchMode=yes -o ConnectTimeout=15",
+      GCM_INTERACTIVE: "never",
+      GH_PROMPT_DISABLED: "1",
+      ...opts?.env
+    }
+  });
 }
-function deleteBranchOnPurgeEnabled(settings = loadAppSettings()) {
-  return Boolean(settings.advanced.deleteBranchOnPurge);
+async function gh(args, cwd, opts) {
+  return run("gh", args, {
+    cwd,
+    reject: opts?.reject,
+    timeoutMs: opts?.timeoutMs,
+    env: {
+      GH_PROMPT_DISABLED: "1",
+      GIT_TERMINAL_PROMPT: "0"
+    }
+  });
 }
-function autoArchiveOnMergeEnabled(settings = loadAppSettings()) {
-  return Boolean(settings.advanced.autoArchiveOnMerge);
+async function resolveGhAuthToken(cwd) {
+  const result = await gh(["auth", "token"], cwd, { reject: false, timeoutMs: 8e3 });
+  if (result.exitCode !== 0) return null;
+  const token = result.stdout.trim();
+  return token || null;
 }
-function autoCleanupOrphansEnabled(settings = loadAppSettings()) {
-  return Boolean(settings.advanced.autoCleanupOrphans);
+var import_execa;
+var init_run = __esm({
+  "src/git/run.ts"() {
+    "use strict";
+    import_execa = require("execa");
+    init_path();
+  }
+});
+
+// src/git/git-auth-mode.ts
+function nonInteractiveGitProcessEnv() {
+  return {
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_ASKPASS: process.env.GIT_ASKPASS?.trim() || "echo",
+    SSH_ASKPASS: process.env.SSH_ASKPASS?.trim() || "echo",
+    GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND?.trim() || "ssh -o BatchMode=yes -o ConnectTimeout=15",
+    GCM_INTERACTIVE: "never",
+    GH_PROMPT_DISABLED: "1"
+  };
 }
-function orchestrationQuotaOnLimit(settings = loadAppSettings()) {
-  return settings.advanced.orchestrationQuotaOnLimit ?? "switch_agent";
+function appendIndexedGitConfig(existing, entries) {
+  const start = Number.parseInt(String(existing?.GIT_CONFIG_COUNT ?? "0"), 10);
+  const count = Number.isFinite(start) && start > 0 ? start : 0;
+  const out = {};
+  entries.forEach((entry, i) => {
+    const n = count + i;
+    out[`GIT_CONFIG_KEY_${n}`] = entry.key;
+    out[`GIT_CONFIG_VALUE_${n}`] = entry.value;
+  });
+  out.GIT_CONFIG_COUNT = String(count + entries.length);
+  return out;
 }
-function orchestrationQuotaFallbackAgent(settings = loadAppSettings()) {
-  const preferred = settings.advanced.orchestrationQuotaFallbackAgent;
-  if (preferred && DEFAULT_AGENTS.has(preferred) && preferred !== "brightsy") {
-    return preferred;
-  }
-  return "cursor";
+function githubAgentGitEnv(existing) {
+  return appendIndexedGitConfig(existing, HTTPS_REWRITE);
 }
-function maxConcurrentAgents(settings = loadAppSettings()) {
-  const n = settings.advanced.maxConcurrent;
-  if (typeof n === "number" && Number.isFinite(n)) {
-    return Math.max(1, Math.min(32, Math.floor(n)));
-  }
-  return 3;
+function githubHttpsBearerEnv(existing, token) {
+  const rewrite = githubAgentGitEnv(existing);
+  const header = appendIndexedGitConfig(
+    { ...existing, ...rewrite },
+    [
+      {
+        key: "http.https://github.com/.extraHeader",
+        value: `AUTHORIZATION: bearer ${token}`
+      }
+    ]
+  );
+  return { ...rewrite, ...header };
 }
-function resolveClaudeExecutable(settings = loadAppSettings()) {
-  return resolveAgentExecutable("claude", settings);
+function applyGithubGitAuthEnv(existing, opts) {
+  const out = { ...nonInteractiveGitProcessEnv() };
+  if (opts.mode === "ssh") return out;
+  const existingToken = existing?.GH_TOKEN?.trim() || "";
+  const provided = existingToken ? "" : opts.token?.trim() || "";
+  const token = existingToken || provided;
+  Object.assign(
+    out,
+    token ? githubHttpsBearerEnv(existing, token) : githubAgentGitEnv(existing)
+  );
+  if (provided) out.GH_TOKEN = provided;
+  return out;
 }
-function resolveAgentExecutable(agent, settings = loadAppSettings()) {
-  const fallback = DEFAULT_CLI_BIN[agent];
-  if (agent === "claude") {
-    const override2 = settings.claude.executablePath?.trim();
-    return override2 || fallback;
-  }
-  if (agent === "codex") {
-    const override2 = settings.codex.executablePath?.trim();
-    return override2 || fallback;
-  }
-  if (agent === "opencode") {
-    const override2 = settings.opencode.executablePath?.trim();
-    return override2 || fallback;
+async function resolveGithubAgentToken(mode, cwd) {
+  if (mode === "ssh") return null;
+  if (mode === "token") return getGithubPat();
+  try {
+    return await resolveGhAuthToken(cwd);
+  } catch {
+    return null;
   }
-  const override = settings.brightsy.executablePath?.trim();
-  return override || fallback;
 }
-function updateAgentExecutable(agent, executablePath) {
-  if (agent === "claude") {
-    return updateClaudeSettings({ executablePath });
-  }
-  if (agent === "codex") {
-    return updateCodexSettings({ executablePath });
+async function resolveAgentGitAuthEnv(existing, opts) {
+  let mode = "auto";
+  if (opts?.mode) {
+    mode = opts.mode;
+  } else {
+    try {
+      mode = getGithubGitAuthMode();
+    } catch {
+      mode = "auto";
+    }
   }
-  if (agent === "opencode") {
-    return updateOpencodeSettings({ executablePath });
+  const cwd = opts?.cwd?.trim() || process.cwd();
+  let token = null;
+  try {
+    token = await resolveGithubAgentToken(mode, cwd);
+  } catch {
+    token = null;
   }
-  return updateBrightsySettings({ executablePath });
-}
-function claudeChromeEnabled(settings = loadAppSettings()) {
-  return Boolean(settings.claude.chromeEnabled);
+  return applyGithubGitAuthEnv(existing, { mode, token });
 }
-function applyAppEnvironment(target = process.env, settings = loadAppSettings()) {
-  for (const [key, value] of Object.entries(settings.environment)) {
-    if (!key || value == null || value === "") continue;
-    if (target[key] == null || target[key] === "") {
-      target[key] = value;
-    }
+function codexUnattendedGitConfigArgs(sandbox) {
+  const args = [
+    "-c",
+    'shell_environment_policy.inherit="all"',
+    "-c",
+    "shell_environment_policy.ignore_default_excludes=true"
+  ];
+  if (sandbox === "workspace-write") {
+    args.push("-c", "sandbox_workspace_write.network_access=true");
   }
-  return target;
+  return args;
 }
-function childEnvWithAppSettings(extra) {
-  const settings = loadAppSettings();
-  const env = stripNestedElectronEnv({ ...process.env });
-  applyAppEnvironment(env, settings);
-  if (extra) {
-    for (const [k, v] of Object.entries(extra)) {
-      if (v != null) env[k] = v;
-    }
+function formatGitAuthModeDirective(mode) {
+  switch (mode) {
+    case "gh":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: gh CLI):",
+        "- This process rewrites `git@github.com:` and `ssh://git@github.com/` to HTTPS.",
+        "- `GH_TOKEN` is injected from `gh auth token` (no macOS Keychain prompts). Do not switch remotes to SSH.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
+      ].join("\n");
+    case "ssh":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: SSH):",
+        "- Keep SSH remotes (`git@github.com:\u2026`). Do not rewrite them to HTTPS.",
+        "- SSH is batch-mode: it will not prompt for a Keychain password. If push fails with `Permission denied (publickey)`, tell the user to unlock ssh-agent or switch Account \u2192 GitHub to Auto / gh CLI \u2014 do not rewrite remotes yourself.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below (API still uses `gh`)."
+      ].join("\n");
+    case "token":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: personal access token):",
+        "- This process rewrites GitHub SSH remotes to HTTPS.",
+        "- `GH_TOKEN` is set in the environment. Use HTTPS git and `gh`; do not paste the token into commands or chat.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
+      ].join("\n");
+    case "auto":
+    default:
+      return [
+        "Git authentication (Account \u2192 GitHub mode: auto):",
+        "- This process rewrites GitHub SSH remotes to HTTPS and authenticates with `GH_TOKEN` from `gh` so git/ssh never prompt the macOS Keychain (required for Slack / unattended Cursor).",
+        "- Do not switch remotes to SSH. Push with `git push -u origin HEAD`.",
+        "- If HTTPS auth fails, tell the user to run `gh auth login` on this Mac or set Account \u2192 GitHub to a PAT \u2014 do not wait for a Keychain dialog."
+      ].join("\n");
   }
-  return env;
-}
-function harnessEnvKey(harness) {
-  return HARNESS_ENV_KEYS[harness];
 }
-var import_node_crypto3, import_node_fs9, import_node_os4, import_node_path10, HARNESS_ENV_KEYS, DEFAULT_AGENTS, GITHUB_GIT_AUTH_MODES, CLOUD_CONNECT_AGENTS, ISSUE_SOURCES, GIT_AUTH_MODES, EMPTY_SETTINGS, DEFAULT_CLI_BIN;
-var init_app_settings = __esm({
-  "src/store/app-settings.ts"() {
+var HTTPS_REWRITE;
+var init_git_auth_mode = __esm({
+  "src/git/git-auth-mode.ts"() {
     "use strict";
-    import_node_crypto3 = require("crypto");
-    import_node_fs9 = require("fs");
-    import_node_os4 = require("os");
-    import_node_path10 = require("path");
-    init_thinking_effort();
-    init_nested_electron_env();
-    init_paths();
-    init_private_file();
-    init_secret_vault();
-    HARNESS_ENV_KEYS = {
-      claude: "ANTHROPIC_API_KEY",
-      codex: "CODEX_API_KEY",
-      cursor: "CURSOR_API_KEY",
-      opencode: null,
-      brightsy: null
-    };
-    DEFAULT_AGENTS = /* @__PURE__ */ new Set([
-      "claude",
-      "codex",
-      "opencode",
-      "brightsy",
-      "cursor"
-    ]);
-    GITHUB_GIT_AUTH_MODES = ["auto", "gh", "ssh", "token"];
-    CLOUD_CONNECT_AGENTS = /* @__PURE__ */ new Set([
-      "claude",
-      "codex",
-      "opencode",
-      "cursor"
-    ]);
-    ISSUE_SOURCES = /* @__PURE__ */ new Set(["linear", "github"]);
-    GIT_AUTH_MODES = new Set(GITHUB_GIT_AUTH_MODES);
-    EMPTY_SETTINGS = {
-      environment: {},
-      claude: {},
-      codex: {},
-      opencode: {},
-      brightsy: {},
-      integrations: {},
-      defaults: {},
-      advanced: {}
-    };
-    DEFAULT_CLI_BIN = {
-      claude: "claude",
-      codex: "codex",
-      opencode: "opencode",
-      brightsy: "brightsy"
-    };
+    init_app_settings();
+    init_run();
+    HTTPS_REWRITE = [
+      { key: "url.https://github.com/.insteadOf", value: "git@github.com:" },
+      { key: "url.https://github.com/.insteadOf", value: "ssh://git@github.com/" },
+      // Empty helper disables ~/.gitconfig osxkeychain so GUI agents cannot pop
+      // "git-credential-osxkeychain wants to use the keychain".
+      { key: "credential.helper", value: "" }
+    ];
   }
 });
 
@@ -3429,7 +3531,7 @@ async function originGhRepoEnv(cwd, opts) {
   await ensureGhPreferOrigin(cwd);
   const slug = await resolveGithubRepoSlug(cwd);
   const mode = opts?.mode ?? getGithubGitAuthMode();
-  const token = mode === "token" ? getGithubPat() : null;
+  const token = mode === "token" ? getGithubPat() : mode === "ssh" ? null : await resolveGhAuthToken(cwd);
   return {
     ...applyGithubGitAuthEnv(opts?.env, { mode, token }),
     ...slug ? { GH_REPO: slug } : {}
@@ -5605,7 +5707,12 @@ function applyNodeLaunch(launch, args) {
     return { file: launch.file, args, env: launch.env };
   }
   const wrapped = wrapElectronAsNodeLaunch(launch.file, args);
-  return { file: wrapped.file, args: wrapped.args, env: launch.env };
+  if (process.platform === "win32") {
+    return { file: wrapped.file, args: wrapped.args, env: launch.env };
+  }
+  const env = { ...launch.env };
+  delete env.ELECTRON_RUN_AS_NODE;
+  return { file: wrapped.file, args: wrapped.args, env };
 }
 async function resolveNodeLaunch(scriptPath) {
   if (isAsarPath(scriptPath)) {
@@ -5782,6 +5889,10 @@ async function buildInjectedMcpServers(opts) {
     if (orchId) {
       sideboard.env.SIDEBOARD_ORCHESTRATOR_THREAD_ID = orchId;
     }
+    try {
+      Object.assign(sideboard.env, await resolveAgentGitAuthEnv(sideboard.env));
+    } catch {
+    }
     servers.push(sideboard);
   }
   if (opts.includeBrightsy && isBrightsyConnected()) {
@@ -5804,10 +5915,19 @@ async function buildInjectedMcpServers(opts) {
 function toCursorMcpServers(servers) {
   const out = {};
   for (const s of servers) {
+    const env = s.env ? { ...s.env } : void 0;
+    if (env) delete env.ELECTRON_RUN_AS_NODE;
+    let command = s.command;
+    let args = s.args;
+    if (process.platform !== "win32" && !isStrippedElectronLaunch(command, args)) {
+      const wrapped = wrapElectronAsNodeLaunch(command, args ?? []);
+      command = wrapped.file;
+      args = wrapped.args;
+    }
     out[s.name] = {
-      command: s.command,
-      ...s.args ? { args: s.args } : {},
-      ...s.env ? { env: s.env } : {}
+      command,
+      ...args && args.length > 0 ? { args } : {},
+      ...env && Object.keys(env).length > 0 ? { env } : {}
     };
   }
   return out;
@@ -5874,6 +5994,8 @@ var init_injected_mcp = __esm({
     init_app_settings();
     init_paths();
     init_node_launch();
+    init_nested_electron_env();
+    init_git_auth_mode();
     import_meta = {};
     SIDEBOARD_MCP_ALLOWED_TOOLS = [
       "mcp__sideboard",
@@ -6413,6 +6535,7 @@ var init_codex = __esm({
     init_global_workspace();
     init_error_detail();
     init_usage();
+    init_git_auth_mode();
     init_injected_mcp();
     init_turn_input();
     init_types();
@@ -6504,6 +6627,8 @@ var init_codex = __esm({
           // `codex exec` rejects `--ask-for-approval` (global-only on newer CLIs).
           "-c",
           'approval_policy="never"',
+          // Seatbelt cannot use the login Keychain; default policy also strips GH_TOKEN.
+          ...codexUnattendedGitConfigArgs(mode.codexSandbox),
           ...model ? ["--model", model] : [],
           ...mcpOverrides
         ];
@@ -8783,6 +8908,7 @@ init_error_detail();
 var import_node_readline = require("readline");
 var import_execa2 = require("execa");
 init_worktree();
+init_git_auth_mode();
 init_app_settings();
 init_global_workspace();
 init_brightsy();
@@ -9045,14 +9171,16 @@ async function spawnAgentTurn(thread, input, onEvent) {
     );
   }
   const env = childEnvWithAppSettings(cmd.env);
-  if (!isOrchestratorThread(thread)) {
-    try {
+  try {
+    if (isOrchestratorThread(thread)) {
+      Object.assign(env, await resolveAgentGitAuthEnv(env));
+    } else {
       const originEnv = await originGhRepoEnv(thread.worktreePath, { env });
       Object.assign(env, originEnv);
-    } catch (err) {
-      const detail = err instanceof Error ? err.message : String(err);
-      console.warn(`[sideboard] originGhRepoEnv failed (${thread.worktreePath}): ${detail}`);
     }
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    console.warn(`[sideboard] git auth env failed (${thread.worktreePath}): ${detail}`);
   }
   const child = (0, import_execa2.execa)(cmd.file, cmd.args, {
     cwd: cmd.cwd,
@@ -9266,6 +9394,7 @@ var import_execa3 = require("execa");
 var import_node_readline2 = require("readline");
 init_settings();
 init_nested_electron_env();
+init_git_auth_mode();
 init_nested_electron_env();
 var PORT_RANGE_SIZE = 10;
 function matchSimpleGlob(pattern, name) {
@@ -9439,6 +9568,10 @@ async function spawnWorkspaceScript(command, opts) {
     },
     loginEnv
   );
+  try {
+    Object.assign(env, await resolveAgentGitAuthEnv(env, { cwd: opts.worktreePath }));
+  } catch {
+  }
   const shell = process.platform === "darwin" ? "zsh" : "bash";
   const child = (0, import_execa3.execa)(shell, ["-lc", command], {
     cwd: opts.worktreePath,
@@ -13412,7 +13545,7 @@ var Orchestrator = class {
       }
       let lastStderr = summarizeTurnStderr(stderrTail);
       let detail = lastStderr || (exitCode !== 0 ? fallbackTurnFailDetail(assistantText) : "");
-      if (exitCode !== 0 && !assistantText && parts.length === 0 && !this.stoppedTurns.has(threadId) && looksLikeInvalidAgentSession(detail) && this.requireThread(threadId).sessionId && this.requireThread(threadId).agent !== "cursor" && this.requireThread(threadId).agent !== "brightsy") {
+      if (exitCode !== 0 && !assistantText && parts.length === 0 && !this.stoppedTurns.has(threadId) && looksLikeInvalidAgentSession(detail) && this.requireThread(threadId).sessionId && this.requireThread(threadId).agent !== "brightsy") {
         updateThread(threadId, { sessionId: null });
         pushTurnStderr(
           stderrTail,