@sideboard-ai/core 0.1.84 → 0.1.85

package/dist/{agents-OPTHS4IX.js → agents-FD77JUOP.js}

@@ -32,18 +32,22 @@ import {
   resolveCursorModelId,
   resolveLoginCommand,
   resolveQuotaFallbackAgent
-} from "./chunk-BBQ6HXKS.js";
-import "./chunk-VROPG6QF.js";
+} from "./chunk-3CCRD6WS.js";
+import "./chunk-6K5VAPVR.js";
 import {
   ORCHESTRATOR_AGENT_KINDS,
   assertOrchestratorCapableAgent,
   coerceOrchestratorAgent,
   isOrchestratorCapableAgent
-} from "./chunk-WJ5TINR6.js";
-import "./chunk-NW7MEJHO.js";
-import "./chunk-CKBIQ54F.js";
+} from "./chunk-6GKDYUTJ.js";
+import "./chunk-XVFV56JG.js";
+import "./chunk-6WQAYBVE.js";
 import "./chunk-B3SJXYIJ.js";
 import "./chunk-7FD7COKE.js";
+import "./chunk-AY53MPDE.js";
+import "./chunk-NSTQ6QKD.js";
+import "./chunk-KGZBYWZ3.js";
+import "./chunk-7MV3RXSC.js";
 import {
   conductorBundledBinDir,
   enrichPathWithNpmGlobalBin,
@@ -52,11 +56,7 @@ import {
   posixShellSingleQuote,
   resolveCommandBinarySync,
   withExportedPath
-} from "./chunk-AE5VBOFE.js";
-import "./chunk-AY53MPDE.js";
-import "./chunk-NSTQ6QKD.js";
-import "./chunk-KGZBYWZ3.js";
-import "./chunk-7MV3RXSC.js";
+} from "./chunk-3KETJKYA.js";
 export {
   CLAUDE_MODEL_CATALOG,
   ORCHESTRATOR_AGENT_KINDS,

package/dist/{agents-JFXM66QA.js → agents-YAYNNJWC.js}

@@ -28,20 +28,20 @@ import {
   resolveCursorModelId,
   resolveLoginCommand,
   resolveQuotaFallbackAgent
-} from "./chunk-R753UFSX.js";
+} from "./chunk-WGI6KXKJ.js";
 import {
   ORCHESTRATOR_AGENT_KINDS,
   assertOrchestratorCapableAgent,
   coerceOrchestratorAgent,
   isOrchestratorCapableAgent
-} from "./chunk-OIEFHOP7.js";
-import "./chunk-JPHG2KCC.js";
-import "./chunk-BTL7EMGT.js";
+} from "./chunk-JTHWVYSD.js";
+import "./chunk-SH75CXJR.js";
+import "./chunk-HHTHF5BQ.js";
 import {
   cursorSdkMessageToEvents,
   parseCursorRunnerLine
 } from "./chunk-CBJSPTBG.js";
-import "./chunk-XW47PL6A.js";
+import "./chunk-KRAUS3RF.js";
 import "./chunk-FKOIHGKV.js";
 import "./chunk-I3FRXL7J.js";
 import "./chunk-5KLC2MWZ.js";
@@ -57,7 +57,7 @@ import {
   posixShellSingleQuote,
   resolveCommandBinarySync,
   withExportedPath
-} from "./chunk-D4DPQ552.js";
+} from "./chunk-LGXBYZZA.js";
 export {
   CLAUDE_MODEL_CATALOG,
   ORCHESTRATOR_AGENT_KINDS,

package/dist/{chunk-ODZ2ZOA4.js → chunk-2N5DVTGH.js}

@@ -1,10 +1,10 @@
 import {
   isGlobalRepoPath
-} from "./chunk-OIEFHOP7.js";
+} from "./chunk-JTHWVYSD.js";
 import {
   ensureGhPreferOrigin,
   resolveRepoRoot
-} from "./chunk-XW47PL6A.js";
+} from "./chunk-KRAUS3RF.js";
 import {
   appDataDir
 } from "./chunk-M37RITA6.js";

package/dist/{chunk-BBQ6HXKS.js → chunk-3CCRD6WS.js}

@@ -6,17 +6,14 @@ import {
   ensureCliTeamTracked,
   ensureConnectedBrightsyTeamTokens,
   loadBrightsyConfig
-} from "./chunk-VROPG6QF.js";
+} from "./chunk-6K5VAPVR.js";
 import {
   isOrchestratorThread
-} from "./chunk-WJ5TINR6.js";
+} from "./chunk-6GKDYUTJ.js";
 import {
-  enrichPathWithNpmGlobalBin,
-  isConductorBundledCli,
-  resolveCommandBinarySync,
-  run,
-  withExportedPath
-} from "./chunk-AE5VBOFE.js";
+  codexUnattendedGitConfigArgs,
+  resolveAgentGitAuthEnv
+} from "./chunk-6WQAYBVE.js";
 import {
   claudeChromeEnabled,
   isStrippedElectronLaunch,
@@ -28,6 +25,13 @@ import {
 import {
   appDataDir
 } from "./chunk-7MV3RXSC.js";
+import {
+  enrichPathWithNpmGlobalBin,
+  isConductorBundledCli,
+  resolveCommandBinarySync,
+  run,
+  withExportedPath
+} from "./chunk-3KETJKYA.js";
 
 // src/agents/brightsy.ts
 import { existsSync } from "fs";
@@ -814,6 +818,10 @@ async function buildInjectedMcpServers(opts) {
     if (orchId) {
       sideboard.env.SIDEBOARD_ORCHESTRATOR_THREAD_ID = orchId;
     }
+    try {
+      Object.assign(sideboard.env, await resolveAgentGitAuthEnv(sideboard.env));
+    } catch {
+    }
     servers.push(sideboard);
   }
   if (opts.includeBrightsy && isBrightsyConnected()) {
@@ -1092,7 +1100,7 @@ var claudeAdapter = {
       );
     }
     const mode = permissionMode(thread);
-    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-33BIG7KK.js");
+    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-U3XVTQLL.js");
     const isOrchestrator = isOrchestratorThread2(thread);
     const injectedServers = await buildInjectedMcpServers({
       includeSideboard: true,
@@ -1474,6 +1482,8 @@ var codexAdapter = {
       // `codex exec` rejects `--ask-for-approval` (global-only on newer CLIs).
       "-c",
       'approval_policy="never"',
+      // Seatbelt cannot use the login Keychain; default policy also strips GH_TOKEN.
+      ...codexUnattendedGitConfigArgs(mode.codexSandbox),
       ...model ? ["--model", model] : [],
       ...mcpOverrides
     ];

package/dist/{chunk-AE5VBOFE.js → chunk-3KETJKYA.js}

@@ -142,7 +142,10 @@ async function git(args, cwd, opts) {
     env: {
       GIT_TERMINAL_PROMPT: "0",
       GIT_ASKPASS: process.env.GIT_ASKPASS || "echo",
+      SSH_ASKPASS: process.env.SSH_ASKPASS || "echo",
       GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND || "ssh -o BatchMode=yes -o ConnectTimeout=15",
+      GCM_INTERACTIVE: "never",
+      GH_PROMPT_DISABLED: "1",
       ...opts?.env
     }
   });
@@ -151,11 +154,15 @@ async function gh(args, cwd, opts) {
   return run("gh", args, {
     cwd,
     reject: opts?.reject,
-    timeoutMs: opts?.timeoutMs
+    timeoutMs: opts?.timeoutMs,
+    env: {
+      GH_PROMPT_DISABLED: "1",
+      GIT_TERMINAL_PROMPT: "0"
+    }
   });
 }
 async function resolveGhAuthToken(cwd) {
-  const result = await gh(["auth", "token"], cwd, { reject: false });
+  const result = await gh(["auth", "token"], cwd, { reject: false, timeoutMs: 8e3 });
   if (result.exitCode !== 0) return null;
   const token = result.stdout.trim();
   return token || null;

package/dist/{chunk-WJ5TINR6.js → chunk-6GKDYUTJ.js}

@@ -2,12 +2,12 @@
 
 import {
   ensureGlobalCoordinatorCwd
-} from "./chunk-NW7MEJHO.js";
+} from "./chunk-XVFV56JG.js";
 import {
   allocateTeamName,
   takenSlugsFromThread,
   teamSlugFromName
-} from "./chunk-CKBIQ54F.js";
+} from "./chunk-6WQAYBVE.js";
 import {
   createEmptyThread,
   listThreads,

package/dist/{chunk-VROPG6QF.js → chunk-6K5VAPVR.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 
-import {
-  run
-} from "./chunk-AE5VBOFE.js";
 import {
   appDataDir
 } from "./chunk-7MV3RXSC.js";
+import {
+  run
+} from "./chunk-3KETJKYA.js";
 
 // src/brightsy/connected-teams.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";

package/dist/{chunk-CKBIQ54F.js → chunk-6WQAYBVE.js}

@@ -6,11 +6,6 @@ import {
 import {
   listThreads
 } from "./chunk-7FD7COKE.js";
-import {
-  gh,
-  git,
-  resolveGhAuthToken
-} from "./chunk-AE5VBOFE.js";
 import {
   getGithubGitAuthMode,
   getGithubPat
@@ -18,6 +13,11 @@ import {
 import {
   worktreesRoot
 } from "./chunk-7MV3RXSC.js";
+import {
+  gh,
+  git,
+  resolveGhAuthToken
+} from "./chunk-3KETJKYA.js";
 
 // src/git/worktree.ts
 import { existsSync, readdirSync } from "fs";
@@ -902,8 +902,20 @@ function formatMergePrError(raw) {
 var HTTPS_REWRITE = [
   { key: "url.https://github.com/.insteadOf", value: "git@github.com:" },
   { key: "url.https://github.com/.insteadOf", value: "ssh://git@github.com/" },
-  { key: "credential.https://github.com.helper", value: "!gh auth git-credential" }
+  // Empty helper disables ~/.gitconfig osxkeychain so GUI agents cannot pop
+  // "git-credential-osxkeychain wants to use the keychain".
+  { key: "credential.helper", value: "" }
 ];
+function nonInteractiveGitProcessEnv() {
+  return {
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_ASKPASS: process.env.GIT_ASKPASS?.trim() || "echo",
+    SSH_ASKPASS: process.env.SSH_ASKPASS?.trim() || "echo",
+    GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND?.trim() || "ssh -o BatchMode=yes -o ConnectTimeout=15",
+    GCM_INTERACTIVE: "never",
+    GH_PROMPT_DISABLED: "1"
+  };
+}
 function appendIndexedGitConfig(existing, entries) {
   const start = Number.parseInt(String(existing?.GIT_CONFIG_COUNT ?? "0"), 10);
   const count = Number.isFinite(start) && start > 0 ? start : 0;
@@ -919,18 +931,72 @@ function appendIndexedGitConfig(existing, entries) {
 function githubAgentGitEnv(existing) {
   return appendIndexedGitConfig(existing, HTTPS_REWRITE);
 }
+function githubHttpsBearerEnv(existing, token) {
+  const rewrite = githubAgentGitEnv(existing);
+  const header = appendIndexedGitConfig(
+    { ...existing, ...rewrite },
+    [
+      {
+        key: "http.https://github.com/.extraHeader",
+        value: `AUTHORIZATION: bearer ${token}`
+      }
+    ]
+  );
+  return { ...rewrite, ...header };
+}
 function applyGithubGitAuthEnv(existing, opts) {
-  const out = {};
-  if (opts.mode === "gh" || opts.mode === "token") {
-    Object.assign(out, githubAgentGitEnv(existing));
+  const out = { ...nonInteractiveGitProcessEnv() };
+  if (opts.mode === "ssh") return out;
+  const existingToken = existing?.GH_TOKEN?.trim() || "";
+  const provided = existingToken ? "" : opts.token?.trim() || "";
+  const token = existingToken || provided;
+  Object.assign(
+    out,
+    token ? githubHttpsBearerEnv(existing, token) : githubAgentGitEnv(existing)
+  );
+  if (provided) out.GH_TOKEN = provided;
+  return out;
+}
+async function resolveGithubAgentToken(mode, cwd) {
+  if (mode === "ssh") return null;
+  if (mode === "token") return getGithubPat();
+  try {
+    return await resolveGhAuthToken(cwd);
+  } catch {
+    return null;
   }
-  if (opts.mode === "token") {
-    const token = opts.token?.trim();
-    if (token && !existing?.GH_TOKEN?.trim()) {
-      out.GH_TOKEN = token;
+}
+async function resolveAgentGitAuthEnv(existing, opts) {
+  let mode = "auto";
+  if (opts?.mode) {
+    mode = opts.mode;
+  } else {
+    try {
+      mode = getGithubGitAuthMode();
+    } catch {
+      mode = "auto";
     }
   }
-  return out;
+  const cwd = opts?.cwd?.trim() || process.cwd();
+  let token = null;
+  try {
+    token = await resolveGithubAgentToken(mode, cwd);
+  } catch {
+    token = null;
+  }
+  return applyGithubGitAuthEnv(existing, { mode, token });
+}
+function codexUnattendedGitConfigArgs(sandbox) {
+  const args = [
+    "-c",
+    'shell_environment_policy.inherit="all"',
+    "-c",
+    "shell_environment_policy.ignore_default_excludes=true"
+  ];
+  if (sandbox === "workspace-write") {
+    args.push("-c", "sandbox_workspace_write.network_access=true");
+  }
+  return args;
 }
 function formatGitAuthModeDirective(mode) {
   switch (mode) {
@@ -938,14 +1004,14 @@ function formatGitAuthModeDirective(mode) {
       return [
         "Git authentication (Account \u2192 GitHub mode: gh CLI):",
         "- This process rewrites `git@github.com:` and `ssh://git@github.com/` to HTTPS.",
-        "- `gh` supplies credentials (`gh auth git-credential`). Do not switch remotes to SSH.",
+        "- `GH_TOKEN` is injected from `gh auth token` (no macOS Keychain prompts). Do not switch remotes to SSH.",
         "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
       ].join("\n");
     case "ssh":
       return [
         "Git authentication (Account \u2192 GitHub mode: SSH):",
         "- Keep SSH remotes (`git@github.com:\u2026`). Do not rewrite them to HTTPS.",
-        "- Use this Mac\u2019s SSH agent / keys. If push fails with `Permission denied (publickey)`, tell the user to start ssh-agent or switch Account \u2192 GitHub to Auto / gh CLI \u2014 do not rewrite remotes yourself.",
+        "- SSH is batch-mode: it will not prompt for a Keychain password. If push fails with `Permission denied (publickey)`, tell the user to unlock ssh-agent or switch Account \u2192 GitHub to Auto / gh CLI \u2014 do not rewrite remotes yourself.",
         "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below (API still uses `gh`)."
       ].join("\n");
     case "token":
@@ -959,9 +1025,9 @@ function formatGitAuthModeDirective(mode) {
     default:
       return [
         "Git authentication (Account \u2192 GitHub mode: auto):",
-        "- Prefer the existing remote URL (SSH or HTTPS). Do not rewrite remotes unless a push/fetch fails.",
-        '- If `git push` fails with `Permission denied (publickey)`, this shell has no ssh-agent. Retry over HTTPS (do not stop): `git -c url.https://github.com/.insteadOf=git@github.com: -c http.extraHeader="AUTHORIZATION: bearer $(gh auth token)" push -u origin HEAD`.',
-        "- Then create/update the PR with `gh` as below."
+        "- This process rewrites GitHub SSH remotes to HTTPS and authenticates with `GH_TOKEN` from `gh` so git/ssh never prompt the macOS Keychain (required for Slack / unattended Cursor).",
+        "- Do not switch remotes to SSH. Push with `git push -u origin HEAD`.",
+        "- If HTTPS auth fails, tell the user to run `gh auth login` on this Mac or set Account \u2192 GitHub to a PAT \u2014 do not wait for a Keychain dialog."
       ].join("\n");
   }
 }
@@ -1342,7 +1408,7 @@ async function originGhRepoEnv(cwd, opts) {
   await ensureGhPreferOrigin(cwd);
   const slug = await resolveGithubRepoSlug(cwd);
   const mode = opts?.mode ?? getGithubGitAuthMode();
-  const token = mode === "token" ? getGithubPat() : null;
+  const token = mode === "token" ? getGithubPat() : mode === "ssh" ? null : await resolveGhAuthToken(cwd);
   return {
     ...applyGithubGitAuthEnv(opts?.env, { mode, token }),
     ...slug ? { GH_REPO: slug } : {}
@@ -2347,6 +2413,8 @@ export {
   worktreeDisplayLabelForGroup,
   formatGhLandError,
   githubAgentGitEnv,
+  resolveAgentGitAuthEnv,
+  codexUnattendedGitConfigArgs,
   formatGitAuthModeDirective,
   detectGhStack,
   getPrStack,

package/dist/{chunk-BTL7EMGT.js → chunk-HHTHF5BQ.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-M37RITA6.js";
 import {
   run
-} from "./chunk-D4DPQ552.js";
+} from "./chunk-LGXBYZZA.js";
 
 // src/brightsy/connected-teams.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
@@ -36,7 +36,7 @@ function saveBrightsyConfig(cfg) {
 
 // src/brightsy/accounts.ts
 async function loadConnectedTeams() {
-  const { listConnectedBrightsyTeams: listConnectedBrightsyTeams2 } = await import("./connected-teams-ZRS53OAT.js");
+  const { listConnectedBrightsyTeams: listConnectedBrightsyTeams2 } = await import("./connected-teams-BNBM7OIC.js");
   return listConnectedBrightsyTeams2();
 }
 async function runBrightsyTeamsJson(args) {
@@ -68,7 +68,7 @@ async function getBrightsySession() {
     const data = await runBrightsyTeamsJson([]);
     const accounts = Array.isArray(data.teams) ? data.teams : [];
     const active = data.active ?? accounts.find((a) => a.active) ?? null;
-    const { ensureCliTeamTracked: ensureCliTeamTracked2 } = await import("./connected-teams-ZRS53OAT.js");
+    const { ensureCliTeamTracked: ensureCliTeamTracked2 } = await import("./connected-teams-BNBM7OIC.js");
     const connectedTeams = ensureCliTeamTracked2(
       active ? { id: active.id, slug: active.slug, name: active.name } : void 0
     );
@@ -108,7 +108,7 @@ async function performBrightsyAccountSwitch(accountIdOrSlug) {
   return { cfg, target: data.active };
 }
 async function switchBrightsyAccount(accountIdOrSlug) {
-  const { connectBrightsyTeam: connectBrightsyTeam2 } = await import("./connected-teams-ZRS53OAT.js");
+  const { connectBrightsyTeam: connectBrightsyTeam2 } = await import("./connected-teams-BNBM7OIC.js");
   await connectBrightsyTeam2(accountIdOrSlug);
   return getBrightsySession();
 }

package/dist/{chunk-UN3LVQB2.js → chunk-JFQ2M6NQ.js}

@@ -2,11 +2,11 @@
 
 import {
   isGlobalRepoPath
-} from "./chunk-WJ5TINR6.js";
+} from "./chunk-6GKDYUTJ.js";
 import {
   ensureGhPreferOrigin,
   resolveRepoRoot
-} from "./chunk-CKBIQ54F.js";
+} from "./chunk-6WQAYBVE.js";
 import {
   appDataDir
 } from "./chunk-7MV3RXSC.js";

package/dist/{chunk-OIEFHOP7.js → chunk-JTHWVYSD.js}

@@ -1,11 +1,11 @@
 import {
   ensureGlobalCoordinatorCwd
-} from "./chunk-JPHG2KCC.js";
+} from "./chunk-SH75CXJR.js";
 import {
   allocateTeamName,
   takenSlugsFromThread,
   teamSlugFromName
-} from "./chunk-XW47PL6A.js";
+} from "./chunk-KRAUS3RF.js";
 import {
   resolveNewThreadOptions,
   resolveThreadDefaults

package/dist/{chunk-XW47PL6A.js → chunk-KRAUS3RF.js}

@@ -15,7 +15,7 @@ import {
   gh,
   git,
   resolveGhAuthToken
-} from "./chunk-D4DPQ552.js";
+} from "./chunk-LGXBYZZA.js";
 
 // src/git/worktree.ts
 import { existsSync, readdirSync } from "fs";
@@ -908,8 +908,20 @@ function formatIpcInvokeError(err) {
 var HTTPS_REWRITE = [
   { key: "url.https://github.com/.insteadOf", value: "git@github.com:" },
   { key: "url.https://github.com/.insteadOf", value: "ssh://git@github.com/" },
-  { key: "credential.https://github.com.helper", value: "!gh auth git-credential" }
+  // Empty helper disables ~/.gitconfig osxkeychain so GUI agents cannot pop
+  // "git-credential-osxkeychain wants to use the keychain".
+  { key: "credential.helper", value: "" }
 ];
+function nonInteractiveGitProcessEnv() {
+  return {
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_ASKPASS: process.env.GIT_ASKPASS?.trim() || "echo",
+    SSH_ASKPASS: process.env.SSH_ASKPASS?.trim() || "echo",
+    GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND?.trim() || "ssh -o BatchMode=yes -o ConnectTimeout=15",
+    GCM_INTERACTIVE: "never",
+    GH_PROMPT_DISABLED: "1"
+  };
+}
 function appendIndexedGitConfig(existing, entries) {
   const start = Number.parseInt(String(existing?.GIT_CONFIG_COUNT ?? "0"), 10);
   const count = Number.isFinite(start) && start > 0 ? start : 0;
@@ -925,18 +937,72 @@ function appendIndexedGitConfig(existing, entries) {
 function githubAgentGitEnv(existing) {
   return appendIndexedGitConfig(existing, HTTPS_REWRITE);
 }
+function githubHttpsBearerEnv(existing, token) {
+  const rewrite = githubAgentGitEnv(existing);
+  const header = appendIndexedGitConfig(
+    { ...existing, ...rewrite },
+    [
+      {
+        key: "http.https://github.com/.extraHeader",
+        value: `AUTHORIZATION: bearer ${token}`
+      }
+    ]
+  );
+  return { ...rewrite, ...header };
+}
 function applyGithubGitAuthEnv(existing, opts) {
-  const out = {};
-  if (opts.mode === "gh" || opts.mode === "token") {
-    Object.assign(out, githubAgentGitEnv(existing));
+  const out = { ...nonInteractiveGitProcessEnv() };
+  if (opts.mode === "ssh") return out;
+  const existingToken = existing?.GH_TOKEN?.trim() || "";
+  const provided = existingToken ? "" : opts.token?.trim() || "";
+  const token = existingToken || provided;
+  Object.assign(
+    out,
+    token ? githubHttpsBearerEnv(existing, token) : githubAgentGitEnv(existing)
+  );
+  if (provided) out.GH_TOKEN = provided;
+  return out;
+}
+async function resolveGithubAgentToken(mode, cwd) {
+  if (mode === "ssh") return null;
+  if (mode === "token") return getGithubPat();
+  try {
+    return await resolveGhAuthToken(cwd);
+  } catch {
+    return null;
   }
-  if (opts.mode === "token") {
-    const token = opts.token?.trim();
-    if (token && !existing?.GH_TOKEN?.trim()) {
-      out.GH_TOKEN = token;
+}
+async function resolveAgentGitAuthEnv(existing, opts) {
+  let mode = "auto";
+  if (opts?.mode) {
+    mode = opts.mode;
+  } else {
+    try {
+      mode = getGithubGitAuthMode();
+    } catch {
+      mode = "auto";
     }
   }
-  return out;
+  const cwd = opts?.cwd?.trim() || process.cwd();
+  let token = null;
+  try {
+    token = await resolveGithubAgentToken(mode, cwd);
+  } catch {
+    token = null;
+  }
+  return applyGithubGitAuthEnv(existing, { mode, token });
+}
+function codexUnattendedGitConfigArgs(sandbox) {
+  const args = [
+    "-c",
+    'shell_environment_policy.inherit="all"',
+    "-c",
+    "shell_environment_policy.ignore_default_excludes=true"
+  ];
+  if (sandbox === "workspace-write") {
+    args.push("-c", "sandbox_workspace_write.network_access=true");
+  }
+  return args;
 }
 function formatGitAuthModeDirective(mode) {
   switch (mode) {
@@ -944,14 +1010,14 @@ function formatGitAuthModeDirective(mode) {
       return [
         "Git authentication (Account \u2192 GitHub mode: gh CLI):",
         "- This process rewrites `git@github.com:` and `ssh://git@github.com/` to HTTPS.",
-        "- `gh` supplies credentials (`gh auth git-credential`). Do not switch remotes to SSH.",
+        "- `GH_TOKEN` is injected from `gh auth token` (no macOS Keychain prompts). Do not switch remotes to SSH.",
         "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
       ].join("\n");
     case "ssh":
       return [
         "Git authentication (Account \u2192 GitHub mode: SSH):",
         "- Keep SSH remotes (`git@github.com:\u2026`). Do not rewrite them to HTTPS.",
-        "- Use this Mac\u2019s SSH agent / keys. If push fails with `Permission denied (publickey)`, tell the user to start ssh-agent or switch Account \u2192 GitHub to Auto / gh CLI \u2014 do not rewrite remotes yourself.",
+        "- SSH is batch-mode: it will not prompt for a Keychain password. If push fails with `Permission denied (publickey)`, tell the user to unlock ssh-agent or switch Account \u2192 GitHub to Auto / gh CLI \u2014 do not rewrite remotes yourself.",
         "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below (API still uses `gh`)."
       ].join("\n");
     case "token":
@@ -965,9 +1031,9 @@ function formatGitAuthModeDirective(mode) {
     default:
       return [
         "Git authentication (Account \u2192 GitHub mode: auto):",
-        "- Prefer the existing remote URL (SSH or HTTPS). Do not rewrite remotes unless a push/fetch fails.",
-        '- If `git push` fails with `Permission denied (publickey)`, this shell has no ssh-agent. Retry over HTTPS (do not stop): `git -c url.https://github.com/.insteadOf=git@github.com: -c http.extraHeader="AUTHORIZATION: bearer $(gh auth token)" push -u origin HEAD`.',
-        "- Then create/update the PR with `gh` as below."
+        "- This process rewrites GitHub SSH remotes to HTTPS and authenticates with `GH_TOKEN` from `gh` so git/ssh never prompt the macOS Keychain (required for Slack / unattended Cursor).",
+        "- Do not switch remotes to SSH. Push with `git push -u origin HEAD`.",
+        "- If HTTPS auth fails, tell the user to run `gh auth login` on this Mac or set Account \u2192 GitHub to a PAT \u2014 do not wait for a Keychain dialog."
       ].join("\n");
   }
 }
@@ -1376,7 +1442,7 @@ async function originGhRepoEnv(cwd, opts) {
   await ensureGhPreferOrigin(cwd);
   const slug = await resolveGithubRepoSlug(cwd);
   const mode = opts?.mode ?? getGithubGitAuthMode();
-  const token = mode === "token" ? getGithubPat() : null;
+  const token = mode === "token" ? getGithubPat() : mode === "ssh" ? null : await resolveGhAuthToken(cwd);
   return {
     ...applyGithubGitAuthEnv(opts?.env, { mode, token }),
     ...slug ? { GH_REPO: slug } : {}
@@ -2386,9 +2452,13 @@ export {
   isPrNotMergeableError,
   formatMergePrError,
   formatIpcInvokeError,
+  nonInteractiveGitProcessEnv,
   appendIndexedGitConfig,
   githubAgentGitEnv,
   applyGithubGitAuthEnv,
+  resolveGithubAgentToken,
+  resolveAgentGitAuthEnv,
+  codexUnattendedGitConfigArgs,
   formatGitAuthModeDirective,
   detectGhStack,
   resetGhStackDetectCache,

package/dist/{chunk-D4DPQ552.js → chunk-LGXBYZZA.js}

@@ -139,7 +139,10 @@ async function git(args, cwd, opts) {
     env: {
       GIT_TERMINAL_PROMPT: "0",
       GIT_ASKPASS: process.env.GIT_ASKPASS || "echo",
+      SSH_ASKPASS: process.env.SSH_ASKPASS || "echo",
       GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND || "ssh -o BatchMode=yes -o ConnectTimeout=15",
+      GCM_INTERACTIVE: "never",
+      GH_PROMPT_DISABLED: "1",
       ...opts?.env
     }
   });
@@ -148,11 +151,15 @@ async function gh(args, cwd, opts) {
   return run("gh", args, {
     cwd,
     reject: opts?.reject,
-    timeoutMs: opts?.timeoutMs
+    timeoutMs: opts?.timeoutMs,
+    env: {
+      GH_PROMPT_DISABLED: "1",
+      GIT_TERMINAL_PROMPT: "0"
+    }
   });
 }
 async function resolveGhAuthToken(cwd) {
-  const result = await gh(["auth", "token"], cwd, { reject: false });
+  const result = await gh(["auth", "token"], cwd, { reject: false, timeoutMs: 8e3 });
   if (result.exitCode !== 0) return null;
   const token = result.stdout.trim();
   return token || null;

package/dist/{chunk-JPHG2KCC.js → chunk-SH75CXJR.js}

@@ -1,6 +1,6 @@
 import {
   resolveGithubRepoSlug
-} from "./chunk-XW47PL6A.js";
+} from "./chunk-KRAUS3RF.js";
 import {
   resolveThreadDefaults
 } from "./chunk-I3FRXL7J.js";