@sideboard-ai/core 0.1.84 → 0.1.85

package/dist/{chunk-R753UFSX.js → chunk-WGI6KXKJ.js}

@@ -1,19 +1,23 @@
 import {
   isOrchestratorThread
-} from "./chunk-OIEFHOP7.js";
+} from "./chunk-JTHWVYSD.js";
 import {
   applyConnectedTeamToCli,
   brightsyMcpServerName,
   ensureCliTeamTracked,
   ensureConnectedBrightsyTeamTokens,
   loadBrightsyConfig
-} from "./chunk-BTL7EMGT.js";
+} from "./chunk-HHTHF5BQ.js";
 import {
   extractJsonErrorMessage,
   formatUnknownDetail,
   looksLikeAgentFailureMessage,
   parseCursorRunnerLine
 } from "./chunk-CBJSPTBG.js";
+import {
+  codexUnattendedGitConfigArgs,
+  resolveAgentGitAuthEnv
+} from "./chunk-KRAUS3RF.js";
 import {
   claudeChromeEnabled,
   loadAppSettings,
@@ -33,7 +37,7 @@ import {
   resolveCommandBinarySync,
   run,
   withExportedPath
-} from "./chunk-D4DPQ552.js";
+} from "./chunk-LGXBYZZA.js";
 
 // src/agents/brightsy.ts
 import { existsSync } from "fs";
@@ -736,6 +740,10 @@ async function buildInjectedMcpServers(opts) {
     if (orchId) {
       sideboard.env.SIDEBOARD_ORCHESTRATOR_THREAD_ID = orchId;
     }
+    try {
+      Object.assign(sideboard.env, await resolveAgentGitAuthEnv(sideboard.env));
+    } catch {
+    }
     servers.push(sideboard);
   }
   if (opts.includeBrightsy && isBrightsyConnected()) {
@@ -1017,7 +1025,7 @@ var claudeAdapter = {
       );
     }
     const mode = permissionMode(thread);
-    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-73OAKD3C.js");
+    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-BRIDCBMY.js");
     const isOrchestrator = isOrchestratorThread2(thread);
     const injectedServers = await buildInjectedMcpServers({
       includeSideboard: true,
@@ -1399,6 +1407,8 @@ var codexAdapter = {
       // `codex exec` rejects `--ask-for-approval` (global-only on newer CLIs).
       "-c",
       'approval_policy="never"',
+      // Seatbelt cannot use the login Keychain; default policy also strips GH_TOKEN.
+      ...codexUnattendedGitConfigArgs(mode.codexSandbox),
       ...model ? ["--model", model] : [],
       ...mcpOverrides
     ];

package/dist/{chunk-NW7MEJHO.js → chunk-XVFV56JG.js}

@@ -2,7 +2,7 @@
 
 import {
   resolveGithubRepoSlug
-} from "./chunk-CKBIQ54F.js";
+} from "./chunk-6WQAYBVE.js";
 import {
   resolveThreadDefaults
 } from "./chunk-AY53MPDE.js";

package/dist/{connected-teams-ZRS53OAT.js → connected-teams-BNBM7OIC.js}

@@ -7,9 +7,9 @@ import {
   ensureConnectedBrightsyTeamTokens,
   getConnectedBrightsyTeamsRaw,
   listConnectedBrightsyTeams
-} from "./chunk-BTL7EMGT.js";
+} from "./chunk-HHTHF5BQ.js";
 import "./chunk-M37RITA6.js";
-import "./chunk-D4DPQ552.js";
+import "./chunk-LGXBYZZA.js";
 export {
   applyConnectedTeamToCli,
   brightsyMcpServerName,

package/dist/{connected-teams-35EIRJCP.js → connected-teams-LSQ5TAZP.js}

@@ -9,9 +9,9 @@ import {
   ensureConnectedBrightsyTeamTokens,
   getConnectedBrightsyTeamsRaw,
   listConnectedBrightsyTeams
-} from "./chunk-VROPG6QF.js";
-import "./chunk-AE5VBOFE.js";
+} from "./chunk-6K5VAPVR.js";
 import "./chunk-7MV3RXSC.js";
+import "./chunk-3KETJKYA.js";
 export {
   applyConnectedTeamToCli,
   brightsyMcpServerName,

package/dist/{coordinator-prompt-RCTIIZ6C.js → coordinator-prompt-VN7FF76K.js}

@@ -7,8 +7,8 @@ import {
   enrichWorkspacesWithGithub,
   ensureGlobalCoordinatorCwd,
   formatWorkspaceInventory
-} from "./chunk-JPHG2KCC.js";
-import "./chunk-XW47PL6A.js";
+} from "./chunk-SH75CXJR.js";
+import "./chunk-KRAUS3RF.js";
 import "./chunk-FKOIHGKV.js";
 import "./chunk-I3FRXL7J.js";
 import "./chunk-5KLC2MWZ.js";
@@ -16,7 +16,7 @@ import "./chunk-JT7R45JB.js";
 import "./chunk-FWJYLBO6.js";
 import "./chunk-77WWLBCI.js";
 import "./chunk-M37RITA6.js";
-import "./chunk-D4DPQ552.js";
+import "./chunk-LGXBYZZA.js";
 export {
   COORDINATOR_TOOL_PLAYBOOK,
   SLACK_REPLY_FORMATTING,

package/dist/{coordinator-prompt-DOIOSLUN.js → coordinator-prompt-YYQSPLIP.js}

@@ -9,15 +9,15 @@ import {
   enrichWorkspacesWithGithub,
   ensureGlobalCoordinatorCwd,
   formatWorkspaceInventory
-} from "./chunk-NW7MEJHO.js";
-import "./chunk-CKBIQ54F.js";
+} from "./chunk-XVFV56JG.js";
+import "./chunk-6WQAYBVE.js";
 import "./chunk-B3SJXYIJ.js";
 import "./chunk-7FD7COKE.js";
-import "./chunk-AE5VBOFE.js";
 import "./chunk-AY53MPDE.js";
 import "./chunk-NSTQ6QKD.js";
 import "./chunk-KGZBYWZ3.js";
 import "./chunk-7MV3RXSC.js";
+import "./chunk-3KETJKYA.js";
 export {
   COORDINATOR_TOOL_PLAYBOOK,
   SLACK_REPLY_FORMATTING,

package/dist/{global-workspace-73OAKD3C.js → global-workspace-BRIDCBMY.js}

@@ -14,9 +14,9 @@ import {
   orchestratorSessionPoisonedByBuiltins,
   slackCoordinatorSourceRef,
   takenTeamSlugsForOrchestration
-} from "./chunk-OIEFHOP7.js";
-import "./chunk-JPHG2KCC.js";
-import "./chunk-XW47PL6A.js";
+} from "./chunk-JTHWVYSD.js";
+import "./chunk-SH75CXJR.js";
+import "./chunk-KRAUS3RF.js";
 import "./chunk-FKOIHGKV.js";
 import "./chunk-I3FRXL7J.js";
 import "./chunk-5KLC2MWZ.js";
@@ -26,7 +26,7 @@ import "./chunk-77WWLBCI.js";
 import {
   globalAgentCwd
 } from "./chunk-M37RITA6.js";
-import "./chunk-D4DPQ552.js";
+import "./chunk-LGXBYZZA.js";
 export {
   GLOBAL_WORKSPACE_ID,
   createGlobalChat,

package/dist/{global-workspace-33BIG7KK.js → global-workspace-U3XVTQLL.js}

@@ -16,18 +16,18 @@ import {
   orchestratorSessionPoisonedByBuiltins,
   slackCoordinatorSourceRef,
   takenTeamSlugsForOrchestration
-} from "./chunk-WJ5TINR6.js";
-import "./chunk-NW7MEJHO.js";
-import "./chunk-CKBIQ54F.js";
+} from "./chunk-6GKDYUTJ.js";
+import "./chunk-XVFV56JG.js";
+import "./chunk-6WQAYBVE.js";
 import "./chunk-B3SJXYIJ.js";
 import "./chunk-7FD7COKE.js";
-import "./chunk-AE5VBOFE.js";
 import "./chunk-AY53MPDE.js";
 import "./chunk-NSTQ6QKD.js";
 import "./chunk-KGZBYWZ3.js";
 import {
   globalAgentCwd
 } from "./chunk-7MV3RXSC.js";
+import "./chunk-3KETJKYA.js";
 export {
   GLOBAL_WORKSPACE_ID,
   createGlobalChat,

package/dist/index.cjs

@@ -2915,80 +2915,6 @@ var init_gh_errors = __esm({
   }
 });
 
-// src/git/git-auth-mode.ts
-function appendIndexedGitConfig(existing, entries) {
-  const start = Number.parseInt(String(existing?.GIT_CONFIG_COUNT ?? "0"), 10);
-  const count = Number.isFinite(start) && start > 0 ? start : 0;
-  const out = {};
-  entries.forEach((entry, i) => {
-    const n = count + i;
-    out[`GIT_CONFIG_KEY_${n}`] = entry.key;
-    out[`GIT_CONFIG_VALUE_${n}`] = entry.value;
-  });
-  out.GIT_CONFIG_COUNT = String(count + entries.length);
-  return out;
-}
-function githubAgentGitEnv(existing) {
-  return appendIndexedGitConfig(existing, HTTPS_REWRITE);
-}
-function applyGithubGitAuthEnv(existing, opts) {
-  const out = {};
-  if (opts.mode === "gh" || opts.mode === "token") {
-    Object.assign(out, githubAgentGitEnv(existing));
-  }
-  if (opts.mode === "token") {
-    const token = opts.token?.trim();
-    if (token && !existing?.GH_TOKEN?.trim()) {
-      out.GH_TOKEN = token;
-    }
-  }
-  return out;
-}
-function formatGitAuthModeDirective(mode) {
-  switch (mode) {
-    case "gh":
-      return [
-        "Git authentication (Account \u2192 GitHub mode: gh CLI):",
-        "- This process rewrites `git@github.com:` and `ssh://git@github.com/` to HTTPS.",
-        "- `gh` supplies credentials (`gh auth git-credential`). Do not switch remotes to SSH.",
-        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
-      ].join("\n");
-    case "ssh":
-      return [
-        "Git authentication (Account \u2192 GitHub mode: SSH):",
-        "- Keep SSH remotes (`git@github.com:\u2026`). Do not rewrite them to HTTPS.",
-        "- Use this Mac\u2019s SSH agent / keys. If push fails with `Permission denied (publickey)`, tell the user to start ssh-agent or switch Account \u2192 GitHub to Auto / gh CLI \u2014 do not rewrite remotes yourself.",
-        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below (API still uses `gh`)."
-      ].join("\n");
-    case "token":
-      return [
-        "Git authentication (Account \u2192 GitHub mode: personal access token):",
-        "- This process rewrites GitHub SSH remotes to HTTPS.",
-        "- `GH_TOKEN` is set in the environment. Use HTTPS git and `gh`; do not paste the token into commands or chat.",
-        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
-      ].join("\n");
-    case "auto":
-    default:
-      return [
-        "Git authentication (Account \u2192 GitHub mode: auto):",
-        "- Prefer the existing remote URL (SSH or HTTPS). Do not rewrite remotes unless a push/fetch fails.",
-        '- If `git push` fails with `Permission denied (publickey)`, this shell has no ssh-agent. Retry over HTTPS (do not stop): `git -c url.https://github.com/.insteadOf=git@github.com: -c http.extraHeader="AUTHORIZATION: bearer $(gh auth token)" push -u origin HEAD`.',
-        "- Then create/update the PR with `gh` as below."
-      ].join("\n");
-  }
-}
-var HTTPS_REWRITE;
-var init_git_auth_mode = __esm({
-  "src/git/git-auth-mode.ts"() {
-    "use strict";
-    HTTPS_REWRITE = [
-      { key: "url.https://github.com/.insteadOf", value: "git@github.com:" },
-      { key: "url.https://github.com/.insteadOf", value: "ssh://git@github.com/" },
-      { key: "credential.https://github.com.helper", value: "!gh auth git-credential" }
-    ];
-  }
-});
-
 // src/agents/path.ts
 function prependPathDir(env, dir) {
   if (!dir || !(0, import_node_fs8.existsSync)(dir)) return;
@@ -3140,7 +3066,10 @@ async function git(args, cwd, opts) {
     env: {
       GIT_TERMINAL_PROMPT: "0",
       GIT_ASKPASS: process.env.GIT_ASKPASS || "echo",
+      SSH_ASKPASS: process.env.SSH_ASKPASS || "echo",
       GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND || "ssh -o BatchMode=yes -o ConnectTimeout=15",
+      GCM_INTERACTIVE: "never",
+      GH_PROMPT_DISABLED: "1",
       ...opts?.env
     }
   });
@@ -3149,11 +3078,15 @@ async function gh(args, cwd, opts) {
   return run("gh", args, {
     cwd,
     reject: opts?.reject,
-    timeoutMs: opts?.timeoutMs
+    timeoutMs: opts?.timeoutMs,
+    env: {
+      GH_PROMPT_DISABLED: "1",
+      GIT_TERMINAL_PROMPT: "0"
+    }
   });
 }
 async function resolveGhAuthToken(cwd) {
-  const result = await gh(["auth", "token"], cwd, { reject: false });
+  const result = await gh(["auth", "token"], cwd, { reject: false, timeoutMs: 8e3 });
   if (result.exitCode !== 0) return null;
   const token = result.stdout.trim();
   return token || null;
@@ -3167,6 +3100,148 @@ var init_run = __esm({
   }
 });
 
+// src/git/git-auth-mode.ts
+function nonInteractiveGitProcessEnv() {
+  return {
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_ASKPASS: process.env.GIT_ASKPASS?.trim() || "echo",
+    SSH_ASKPASS: process.env.SSH_ASKPASS?.trim() || "echo",
+    GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND?.trim() || "ssh -o BatchMode=yes -o ConnectTimeout=15",
+    GCM_INTERACTIVE: "never",
+    GH_PROMPT_DISABLED: "1"
+  };
+}
+function appendIndexedGitConfig(existing, entries) {
+  const start = Number.parseInt(String(existing?.GIT_CONFIG_COUNT ?? "0"), 10);
+  const count = Number.isFinite(start) && start > 0 ? start : 0;
+  const out = {};
+  entries.forEach((entry, i) => {
+    const n = count + i;
+    out[`GIT_CONFIG_KEY_${n}`] = entry.key;
+    out[`GIT_CONFIG_VALUE_${n}`] = entry.value;
+  });
+  out.GIT_CONFIG_COUNT = String(count + entries.length);
+  return out;
+}
+function githubAgentGitEnv(existing) {
+  return appendIndexedGitConfig(existing, HTTPS_REWRITE);
+}
+function githubHttpsBearerEnv(existing, token) {
+  const rewrite = githubAgentGitEnv(existing);
+  const header = appendIndexedGitConfig(
+    { ...existing, ...rewrite },
+    [
+      {
+        key: "http.https://github.com/.extraHeader",
+        value: `AUTHORIZATION: bearer ${token}`
+      }
+    ]
+  );
+  return { ...rewrite, ...header };
+}
+function applyGithubGitAuthEnv(existing, opts) {
+  const out = { ...nonInteractiveGitProcessEnv() };
+  if (opts.mode === "ssh") return out;
+  const existingToken = existing?.GH_TOKEN?.trim() || "";
+  const provided = existingToken ? "" : opts.token?.trim() || "";
+  const token = existingToken || provided;
+  Object.assign(
+    out,
+    token ? githubHttpsBearerEnv(existing, token) : githubAgentGitEnv(existing)
+  );
+  if (provided) out.GH_TOKEN = provided;
+  return out;
+}
+async function resolveGithubAgentToken(mode, cwd) {
+  if (mode === "ssh") return null;
+  if (mode === "token") return getGithubPat();
+  try {
+    return await resolveGhAuthToken(cwd);
+  } catch {
+    return null;
+  }
+}
+async function resolveAgentGitAuthEnv(existing, opts) {
+  let mode = "auto";
+  if (opts?.mode) {
+    mode = opts.mode;
+  } else {
+    try {
+      mode = getGithubGitAuthMode();
+    } catch {
+      mode = "auto";
+    }
+  }
+  const cwd = opts?.cwd?.trim() || process.cwd();
+  let token = null;
+  try {
+    token = await resolveGithubAgentToken(mode, cwd);
+  } catch {
+    token = null;
+  }
+  return applyGithubGitAuthEnv(existing, { mode, token });
+}
+function codexUnattendedGitConfigArgs(sandbox) {
+  const args = [
+    "-c",
+    'shell_environment_policy.inherit="all"',
+    "-c",
+    "shell_environment_policy.ignore_default_excludes=true"
+  ];
+  if (sandbox === "workspace-write") {
+    args.push("-c", "sandbox_workspace_write.network_access=true");
+  }
+  return args;
+}
+function formatGitAuthModeDirective(mode) {
+  switch (mode) {
+    case "gh":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: gh CLI):",
+        "- This process rewrites `git@github.com:` and `ssh://git@github.com/` to HTTPS.",
+        "- `GH_TOKEN` is injected from `gh auth token` (no macOS Keychain prompts). Do not switch remotes to SSH.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
+      ].join("\n");
+    case "ssh":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: SSH):",
+        "- Keep SSH remotes (`git@github.com:\u2026`). Do not rewrite them to HTTPS.",
+        "- SSH is batch-mode: it will not prompt for a Keychain password. If push fails with `Permission denied (publickey)`, tell the user to unlock ssh-agent or switch Account \u2192 GitHub to Auto / gh CLI \u2014 do not rewrite remotes yourself.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below (API still uses `gh`)."
+      ].join("\n");
+    case "token":
+      return [
+        "Git authentication (Account \u2192 GitHub mode: personal access token):",
+        "- This process rewrites GitHub SSH remotes to HTTPS.",
+        "- `GH_TOKEN` is set in the environment. Use HTTPS git and `gh`; do not paste the token into commands or chat.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
+      ].join("\n");
+    case "auto":
+    default:
+      return [
+        "Git authentication (Account \u2192 GitHub mode: auto):",
+        "- This process rewrites GitHub SSH remotes to HTTPS and authenticates with `GH_TOKEN` from `gh` so git/ssh never prompt the macOS Keychain (required for Slack / unattended Cursor).",
+        "- Do not switch remotes to SSH. Push with `git push -u origin HEAD`.",
+        "- If HTTPS auth fails, tell the user to run `gh auth login` on this Mac or set Account \u2192 GitHub to a PAT \u2014 do not wait for a Keychain dialog."
+      ].join("\n");
+  }
+}
+var HTTPS_REWRITE;
+var init_git_auth_mode = __esm({
+  "src/git/git-auth-mode.ts"() {
+    "use strict";
+    init_app_settings();
+    init_run();
+    HTTPS_REWRITE = [
+      { key: "url.https://github.com/.insteadOf", value: "git@github.com:" },
+      { key: "url.https://github.com/.insteadOf", value: "ssh://git@github.com/" },
+      // Empty helper disables ~/.gitconfig osxkeychain so GUI agents cannot pop
+      // "git-credential-osxkeychain wants to use the keychain".
+      { key: "credential.helper", value: "" }
+    ];
+  }
+});
+
 // src/git/pr-gates.ts
 function prIsInMergeQueue(gate) {
   if (gate.isInMergeQueue) return true;
@@ -3652,7 +3727,7 @@ async function originGhRepoEnv(cwd, opts) {
   await ensureGhPreferOrigin(cwd);
   const slug = await resolveGithubRepoSlug(cwd);
   const mode = opts?.mode ?? getGithubGitAuthMode();
-  const token = mode === "token" ? getGithubPat() : null;
+  const token = mode === "token" ? getGithubPat() : mode === "ssh" ? null : await resolveGhAuthToken(cwd);
   return {
     ...applyGithubGitAuthEnv(opts?.env, { mode, token }),
     ...slug ? { GH_REPO: slug } : {}
@@ -6418,6 +6493,10 @@ async function buildInjectedMcpServers(opts) {
     if (orchId) {
       sideboard.env.SIDEBOARD_ORCHESTRATOR_THREAD_ID = orchId;
     }
+    try {
+      Object.assign(sideboard.env, await resolveAgentGitAuthEnv(sideboard.env));
+    } catch {
+    }
     servers.push(sideboard);
   }
   if (opts.includeBrightsy && isBrightsyConnected()) {
@@ -6523,6 +6602,7 @@ var init_injected_mcp = __esm({
     init_paths();
     init_node_launch();
     init_nested_electron_env();
+    init_git_auth_mode();
     import_meta = {};
     SIDEBOARD_MCP_ALLOWED_TOOLS = [
       "mcp__sideboard",
@@ -7066,6 +7146,7 @@ var init_codex = __esm({
     init_global_workspace();
     init_error_detail();
     init_usage();
+    init_git_auth_mode();
     init_injected_mcp();
     init_turn_input();
     init_types();
@@ -7157,6 +7238,8 @@ var init_codex = __esm({
           // `codex exec` rejects `--ask-for-approval` (global-only on newer CLIs).
           "-c",
           'approval_policy="never"',
+          // Seatbelt cannot use the login Keychain; default policy also strips GH_TOKEN.
+          ...codexUnattendedGitConfigArgs(mode.codexSandbox),
           ...model ? ["--model", model] : [],
           ...mcpOverrides
         ];
@@ -8770,6 +8853,7 @@ __export(index_exports, {
   cleanupOrphanWorktrees: () => cleanupOrphanWorktrees,
   cloneRepoIntoSideboard: () => cloneRepoIntoSideboard,
   codexAdapter: () => codexAdapter,
+  codexUnattendedGitConfigArgs: () => codexUnattendedGitConfigArgs,
   coerceOrchestratorAgent: () => coerceOrchestratorAgent,
   collectTakenTeamSlugs: () => collectTakenTeamSlugs,
   commentLinearIssue: () => commentLinearIssue,
@@ -8990,6 +9074,7 @@ __export(index_exports, {
   mergeUsage: () => mergeUsage,
   nextPastedTextName: () => nextPastedTextName,
   nextThinkingEffort: () => nextThinkingEffort,
+  nonInteractiveGitProcessEnv: () => nonInteractiveGitProcessEnv,
   normalizeParseResult: () => normalizeParseResult,
   normalizeThinkingEffort: () => normalizeThinkingEffort,
   normalizeThread: () => normalizeThread,
@@ -9045,6 +9130,7 @@ __export(index_exports, {
   requireAgent: () => requireAgent,
   resetGhStackDetectCache: () => resetGhStackDetectCache,
   resolveAgentExecutable: () => resolveAgentExecutable,
+  resolveAgentGitAuthEnv: () => resolveAgentGitAuthEnv,
   resolveClaudeExecutable: () => resolveClaudeExecutable,
   resolveCommandBinarySync: () => resolveCommandBinarySync,
   resolveConductorCursorAgentId: () => resolveConductorCursorAgentId,
@@ -9054,6 +9140,7 @@ __export(index_exports, {
   resolveEffectiveIssueSource: () => resolveEffectiveIssueSource,
   resolveFilesToCopy: () => resolveFilesToCopy,
   resolveGhAuthToken: () => resolveGhAuthToken,
+  resolveGithubAgentToken: () => resolveGithubAgentToken,
   resolveGithubRepoSlug: () => resolveGithubRepoSlug,
   resolveLinearState: () => resolveLinearState,
   resolveLinearTeam: () => resolveLinearTeam,
@@ -9925,6 +10012,7 @@ init_agents();
 var import_node_readline = require("readline");
 var import_execa2 = require("execa");
 init_worktree();
+init_git_auth_mode();
 init_app_settings();
 init_global_workspace();
 init_brightsy();
@@ -10187,14 +10275,16 @@ async function spawnAgentTurn(thread, input, onEvent) {
     );
   }
   const env = childEnvWithAppSettings(cmd.env);
-  if (!isOrchestratorThread(thread)) {
-    try {
+  try {
+    if (isOrchestratorThread(thread)) {
+      Object.assign(env, await resolveAgentGitAuthEnv(env));
+    } else {
       const originEnv = await originGhRepoEnv(thread.worktreePath, { env });
       Object.assign(env, originEnv);
-    } catch (err) {
-      const detail = err instanceof Error ? err.message : String(err);
-      console.warn(`[sideboard] originGhRepoEnv failed (${thread.worktreePath}): ${detail}`);
     }
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    console.warn(`[sideboard] git auth env failed (${thread.worktreePath}): ${detail}`);
   }
   const child = (0, import_execa2.execa)(cmd.file, cmd.args, {
     cwd: cmd.cwd,
@@ -10547,6 +10637,7 @@ var import_execa3 = require("execa");
 var import_node_readline2 = require("readline");
 init_settings();
 init_nested_electron_env();
+init_git_auth_mode();
 init_nested_electron_env();
 var PORT_RANGE_SIZE = 10;
 function matchSimpleGlob(pattern, name) {
@@ -10720,6 +10811,10 @@ async function spawnWorkspaceScript(command, opts) {
     },
     loginEnv
   );
+  try {
+    Object.assign(env, await resolveAgentGitAuthEnv(env, { cwd: opts.worktreePath }));
+  } catch {
+  }
   const shell = process.platform === "darwin" ? "zsh" : "bash";
   const child = (0, import_execa3.execa)(shell, ["-lc", command], {
     cwd: opts.worktreePath,
@@ -20234,6 +20329,7 @@ async function startSlackRelayServer(opts) {
   cleanupOrphanWorktrees,
   cloneRepoIntoSideboard,
   codexAdapter,
+  codexUnattendedGitConfigArgs,
   coerceOrchestratorAgent,
   collectTakenTeamSlugs,
   commentLinearIssue,
@@ -20454,6 +20550,7 @@ async function startSlackRelayServer(opts) {
   mergeUsage,
   nextPastedTextName,
   nextThinkingEffort,
+  nonInteractiveGitProcessEnv,
   normalizeParseResult,
   normalizeThinkingEffort,
   normalizeThread,
@@ -20509,6 +20606,7 @@ async function startSlackRelayServer(opts) {
   requireAgent,
   resetGhStackDetectCache,
   resolveAgentExecutable,
+  resolveAgentGitAuthEnv,
   resolveClaudeExecutable,
   resolveCommandBinarySync,
   resolveConductorCursorAgentId,
@@ -20518,6 +20616,7 @@ async function startSlackRelayServer(opts) {
   resolveEffectiveIssueSource,
   resolveFilesToCopy,
   resolveGhAuthToken,
+  resolveGithubAgentToken,
   resolveGithubRepoSlug,
   resolveLinearState,
   resolveLinearTeam,