@sideboard-ai/core 0.1.84 → 0.1.86

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (37) hide show
  1. package/dist/agents/cursor-runner.cjs +54 -16
  2. package/dist/agents/cursor-runner.js +54 -16
  3. package/dist/{agents-JFXM66QA.js → agents-HJ3Y2JN5.js} +6 -6
  4. package/dist/{agents-OPTHS4IX.js → agents-NDHD3VOL.js} +10 -10
  5. package/dist/{chunk-AE5VBOFE.js → chunk-3KETJKYA.js} +9 -2
  6. package/dist/{chunk-UN3LVQB2.js → chunk-45U4RQ74.js} +2 -2
  7. package/dist/{chunk-R753UFSX.js → chunk-4Y745GLN.js} +14 -4
  8. package/dist/{chunk-VROPG6QF.js → chunk-6K5VAPVR.js} +3 -3
  9. package/dist/{chunk-CKBIQ54F.js → chunk-6ZGTM2E7.js} +88 -20
  10. package/dist/{chunk-WJ5TINR6.js → chunk-EWKHP6DD.js} +2 -2
  11. package/dist/{chunk-NW7MEJHO.js → chunk-HA2QTIWN.js} +1 -1
  12. package/dist/{chunk-BTL7EMGT.js → chunk-HHTHF5BQ.js} +4 -4
  13. package/dist/{chunk-ODZ2ZOA4.js → chunk-IGEL6M4G.js} +2 -2
  14. package/dist/{chunk-BBQ6HXKS.js → chunk-KE6QLNTJ.js} +19 -9
  15. package/dist/{chunk-D4DPQ552.js → chunk-LGXBYZZA.js} +9 -2
  16. package/dist/{chunk-XW47PL6A.js → chunk-OBHZKT2T.js} +86 -16
  17. package/dist/{chunk-OIEFHOP7.js → chunk-U4RZ3IQI.js} +2 -2
  18. package/dist/{chunk-JPHG2KCC.js → chunk-ZN4NDAHV.js} +1 -1
  19. package/dist/{connected-teams-ZRS53OAT.js → connected-teams-BNBM7OIC.js} +2 -2
  20. package/dist/{connected-teams-35EIRJCP.js → connected-teams-LSQ5TAZP.js} +2 -2
  21. package/dist/{coordinator-prompt-RCTIIZ6C.js → coordinator-prompt-HOMHBR2L.js} +3 -3
  22. package/dist/{coordinator-prompt-DOIOSLUN.js → coordinator-prompt-L65MIGCV.js} +3 -3
  23. package/dist/{global-workspace-33BIG7KK.js → global-workspace-MXOLTUAR.js} +4 -4
  24. package/dist/{global-workspace-73OAKD3C.js → global-workspace-VGKPYFE2.js} +4 -4
  25. package/dist/index.cjs +181 -82
  26. package/dist/index.d.cts +32 -6
  27. package/dist/index.d.ts +32 -6
  28. package/dist/index.js +36 -22
  29. package/dist/mcp/run-stdio.cjs +361 -270
  30. package/dist/mcp/run-stdio.js +34 -27
  31. package/dist/{run-V2WZUMJA.js → run-CFKZPY7F.js} +1 -1
  32. package/dist/{run-A4RHY7HH.js → run-XKTAJRWF.js} +1 -1
  33. package/dist/{workspaces-SRITISKA.js → workspaces-2GZ2VNNU.js} +5 -5
  34. package/dist/{workspaces-WDLY34MX.js → workspaces-VWQ5YSND.js} +5 -5
  35. package/dist/{worktree-TUAO74SI.js → worktree-RFCCG23P.js} +2 -2
  36. package/dist/{worktree-SGZVAWOQ.js → worktree-WZJ3CFEN.js} +2 -2
  37. package/package.json +1 -1
@@ -69,6 +69,16 @@ function cursorSessionRecoveryMessage(err, agentId) {
69
69
  }
70
70
  return `Cursor session is unresumable (${detail}) \u2014 starting a new session`;
71
71
  }
72
+ function cursorSendOptions(mcpServers) {
73
+ const opts = { local: { force: true } };
74
+ if (mcpServers && typeof mcpServers === "object" && Object.keys(mcpServers).length > 0) {
75
+ opts.mcpServers = mcpServers;
76
+ }
77
+ return opts;
78
+ }
79
+ function withCursorLocalHangGuards(local) {
80
+ return { ...local, enableAgentRetries: false };
81
+ }
72
82
 
73
83
  // src/agents/error-detail.ts
74
84
  function formatUnknownDetail(err) {
@@ -347,7 +357,7 @@ async function main() {
347
357
  });
348
358
  const mode = req.planMode ? "plan" : "agent";
349
359
  const store = localAgentStore();
350
- const local = { cwd: req.cwd, store };
360
+ const local = withCursorLocalHangGuards({ cwd: req.cwd, store });
351
361
  const mcpServers = req.mcpServers && Object.keys(req.mcpServers).length > 0 ? req.mcpServers : void 0;
352
362
  const createOpts = {
353
363
  apiKey,
@@ -379,7 +389,7 @@ async function main() {
379
389
  }
380
390
  }
381
391
  async function sendPrompt(agent) {
382
- const sendOpts = mcpServers ? { mcpServers } : void 0;
392
+ const sendOpts = cursorSendOptions(mcpServers);
383
393
  try {
384
394
  return await agent.send(req.prompt, sendOpts);
385
395
  } catch (err) {
@@ -395,25 +405,53 @@ async function main() {
395
405
  return agent.send(req.prompt, sendOpts);
396
406
  }
397
407
  }
408
+ let liveRun = null;
409
+ let shuttingDown = false;
410
+ const cancelLiveRun = async () => {
411
+ const run = liveRun;
412
+ liveRun = null;
413
+ if (!run) return;
414
+ try {
415
+ await run.cancel();
416
+ } catch {
417
+ }
418
+ };
419
+ const onSignal = () => {
420
+ if (shuttingDown) return;
421
+ shuttingDown = true;
422
+ void Promise.race([
423
+ cancelLiveRun(),
424
+ new Promise((resolve) => {
425
+ setTimeout(resolve, 2e3);
426
+ })
427
+ ]).finally(() => process.exit(1));
428
+ };
429
+ process.once("SIGTERM", onSignal);
430
+ process.once("SIGINT", onSignal);
398
431
  async function runTurn(agent) {
399
432
  emit({ type: "session_id", data: agent.agentId });
400
433
  const run = await sendPrompt(agent);
401
- for await (const msg of run.stream()) {
402
- for (const event of cursorSdkMessageToEvents(msg)) {
403
- emit(event);
434
+ liveRun = run;
435
+ try {
436
+ for await (const msg of run.stream()) {
437
+ for (const event of cursorSdkMessageToEvents(msg)) {
438
+ emit(event);
439
+ }
404
440
  }
441
+ const result = await run.wait();
442
+ if (result.status === "error") {
443
+ const detail = formatUnknownDetail(result.error);
444
+ emit({
445
+ type: "stderr",
446
+ data: detail ? `Cursor run failed (${result.id}): ${detail}` : `Cursor run failed (${result.id})`
447
+ });
448
+ return 2;
449
+ }
450
+ if (result.status === "cancelled") return 0;
451
+ return 0;
452
+ } finally {
453
+ liveRun = null;
405
454
  }
406
- const result = await run.wait();
407
- if (result.status === "error") {
408
- const detail = formatUnknownDetail(result.error);
409
- emit({
410
- type: "stderr",
411
- data: detail ? `Cursor run failed (${result.id}): ${detail}` : `Cursor run failed (${result.id})`
412
- });
413
- return 2;
414
- }
415
- if (result.status === "cancelled") return 0;
416
- return 0;
417
455
  }
418
456
  try {
419
457
  let agent = await openAgent();
@@ -41,6 +41,16 @@ function cursorSessionRecoveryMessage(err, agentId) {
41
41
  }
42
42
  return `Cursor session is unresumable (${detail}) \u2014 starting a new session`;
43
43
  }
44
+ function cursorSendOptions(mcpServers) {
45
+ const opts = { local: { force: true } };
46
+ if (mcpServers && typeof mcpServers === "object" && Object.keys(mcpServers).length > 0) {
47
+ opts.mcpServers = mcpServers;
48
+ }
49
+ return opts;
50
+ }
51
+ function withCursorLocalHangGuards(local) {
52
+ return { ...local, enableAgentRetries: false };
53
+ }
44
54
 
45
55
  // src/agents/cursor-runner.ts
46
56
  dropNestedElectronEnvFromProcess();
@@ -123,7 +133,7 @@ async function main() {
123
133
  });
124
134
  const mode = req.planMode ? "plan" : "agent";
125
135
  const store = localAgentStore();
126
- const local = { cwd: req.cwd, store };
136
+ const local = withCursorLocalHangGuards({ cwd: req.cwd, store });
127
137
  const mcpServers = req.mcpServers && Object.keys(req.mcpServers).length > 0 ? req.mcpServers : void 0;
128
138
  const createOpts = {
129
139
  apiKey,
@@ -155,7 +165,7 @@ async function main() {
155
165
  }
156
166
  }
157
167
  async function sendPrompt(agent) {
158
- const sendOpts = mcpServers ? { mcpServers } : void 0;
168
+ const sendOpts = cursorSendOptions(mcpServers);
159
169
  try {
160
170
  return await agent.send(req.prompt, sendOpts);
161
171
  } catch (err) {
@@ -171,25 +181,53 @@ async function main() {
171
181
  return agent.send(req.prompt, sendOpts);
172
182
  }
173
183
  }
184
+ let liveRun = null;
185
+ let shuttingDown = false;
186
+ const cancelLiveRun = async () => {
187
+ const run = liveRun;
188
+ liveRun = null;
189
+ if (!run) return;
190
+ try {
191
+ await run.cancel();
192
+ } catch {
193
+ }
194
+ };
195
+ const onSignal = () => {
196
+ if (shuttingDown) return;
197
+ shuttingDown = true;
198
+ void Promise.race([
199
+ cancelLiveRun(),
200
+ new Promise((resolve) => {
201
+ setTimeout(resolve, 2e3);
202
+ })
203
+ ]).finally(() => process.exit(1));
204
+ };
205
+ process.once("SIGTERM", onSignal);
206
+ process.once("SIGINT", onSignal);
174
207
  async function runTurn(agent) {
175
208
  emit({ type: "session_id", data: agent.agentId });
176
209
  const run = await sendPrompt(agent);
177
- for await (const msg of run.stream()) {
178
- for (const event of cursorSdkMessageToEvents(msg)) {
179
- emit(event);
210
+ liveRun = run;
211
+ try {
212
+ for await (const msg of run.stream()) {
213
+ for (const event of cursorSdkMessageToEvents(msg)) {
214
+ emit(event);
215
+ }
180
216
  }
217
+ const result = await run.wait();
218
+ if (result.status === "error") {
219
+ const detail = formatUnknownDetail(result.error);
220
+ emit({
221
+ type: "stderr",
222
+ data: detail ? `Cursor run failed (${result.id}): ${detail}` : `Cursor run failed (${result.id})`
223
+ });
224
+ return 2;
225
+ }
226
+ if (result.status === "cancelled") return 0;
227
+ return 0;
228
+ } finally {
229
+ liveRun = null;
181
230
  }
182
- const result = await run.wait();
183
- if (result.status === "error") {
184
- const detail = formatUnknownDetail(result.error);
185
- emit({
186
- type: "stderr",
187
- data: detail ? `Cursor run failed (${result.id}): ${detail}` : `Cursor run failed (${result.id})`
188
- });
189
- return 2;
190
- }
191
- if (result.status === "cancelled") return 0;
192
- return 0;
193
231
  }
194
232
  try {
195
233
  let agent = await openAgent();
@@ -28,20 +28,20 @@ import {
28
28
  resolveCursorModelId,
29
29
  resolveLoginCommand,
30
30
  resolveQuotaFallbackAgent
31
- } from "./chunk-R753UFSX.js";
31
+ } from "./chunk-4Y745GLN.js";
32
32
  import {
33
33
  ORCHESTRATOR_AGENT_KINDS,
34
34
  assertOrchestratorCapableAgent,
35
35
  coerceOrchestratorAgent,
36
36
  isOrchestratorCapableAgent
37
- } from "./chunk-OIEFHOP7.js";
38
- import "./chunk-JPHG2KCC.js";
39
- import "./chunk-BTL7EMGT.js";
37
+ } from "./chunk-U4RZ3IQI.js";
38
+ import "./chunk-ZN4NDAHV.js";
39
+ import "./chunk-HHTHF5BQ.js";
40
40
  import {
41
41
  cursorSdkMessageToEvents,
42
42
  parseCursorRunnerLine
43
43
  } from "./chunk-CBJSPTBG.js";
44
- import "./chunk-XW47PL6A.js";
44
+ import "./chunk-OBHZKT2T.js";
45
45
  import "./chunk-FKOIHGKV.js";
46
46
  import "./chunk-I3FRXL7J.js";
47
47
  import "./chunk-5KLC2MWZ.js";
@@ -57,7 +57,7 @@ import {
57
57
  posixShellSingleQuote,
58
58
  resolveCommandBinarySync,
59
59
  withExportedPath
60
- } from "./chunk-D4DPQ552.js";
60
+ } from "./chunk-LGXBYZZA.js";
61
61
  export {
62
62
  CLAUDE_MODEL_CATALOG,
63
63
  ORCHESTRATOR_AGENT_KINDS,
@@ -32,18 +32,22 @@ import {
32
32
  resolveCursorModelId,
33
33
  resolveLoginCommand,
34
34
  resolveQuotaFallbackAgent
35
- } from "./chunk-BBQ6HXKS.js";
36
- import "./chunk-VROPG6QF.js";
35
+ } from "./chunk-KE6QLNTJ.js";
36
+ import "./chunk-6K5VAPVR.js";
37
37
  import {
38
38
  ORCHESTRATOR_AGENT_KINDS,
39
39
  assertOrchestratorCapableAgent,
40
40
  coerceOrchestratorAgent,
41
41
  isOrchestratorCapableAgent
42
- } from "./chunk-WJ5TINR6.js";
43
- import "./chunk-NW7MEJHO.js";
44
- import "./chunk-CKBIQ54F.js";
42
+ } from "./chunk-EWKHP6DD.js";
43
+ import "./chunk-HA2QTIWN.js";
44
+ import "./chunk-6ZGTM2E7.js";
45
45
  import "./chunk-B3SJXYIJ.js";
46
46
  import "./chunk-7FD7COKE.js";
47
+ import "./chunk-AY53MPDE.js";
48
+ import "./chunk-NSTQ6QKD.js";
49
+ import "./chunk-KGZBYWZ3.js";
50
+ import "./chunk-7MV3RXSC.js";
47
51
  import {
48
52
  conductorBundledBinDir,
49
53
  enrichPathWithNpmGlobalBin,
@@ -52,11 +56,7 @@ import {
52
56
  posixShellSingleQuote,
53
57
  resolveCommandBinarySync,
54
58
  withExportedPath
55
- } from "./chunk-AE5VBOFE.js";
56
- import "./chunk-AY53MPDE.js";
57
- import "./chunk-NSTQ6QKD.js";
58
- import "./chunk-KGZBYWZ3.js";
59
- import "./chunk-7MV3RXSC.js";
59
+ } from "./chunk-3KETJKYA.js";
60
60
  export {
61
61
  CLAUDE_MODEL_CATALOG,
62
62
  ORCHESTRATOR_AGENT_KINDS,
@@ -142,7 +142,10 @@ async function git(args, cwd, opts) {
142
142
  env: {
143
143
  GIT_TERMINAL_PROMPT: "0",
144
144
  GIT_ASKPASS: process.env.GIT_ASKPASS || "echo",
145
+ SSH_ASKPASS: process.env.SSH_ASKPASS || "echo",
145
146
  GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND || "ssh -o BatchMode=yes -o ConnectTimeout=15",
147
+ GCM_INTERACTIVE: "never",
148
+ GH_PROMPT_DISABLED: "1",
146
149
  ...opts?.env
147
150
  }
148
151
  });
@@ -151,11 +154,15 @@ async function gh(args, cwd, opts) {
151
154
  return run("gh", args, {
152
155
  cwd,
153
156
  reject: opts?.reject,
154
- timeoutMs: opts?.timeoutMs
157
+ timeoutMs: opts?.timeoutMs,
158
+ env: {
159
+ GH_PROMPT_DISABLED: "1",
160
+ GIT_TERMINAL_PROMPT: "0"
161
+ }
155
162
  });
156
163
  }
157
164
  async function resolveGhAuthToken(cwd) {
158
- const result = await gh(["auth", "token"], cwd, { reject: false });
165
+ const result = await gh(["auth", "token"], cwd, { reject: false, timeoutMs: 8e3 });
159
166
  if (result.exitCode !== 0) return null;
160
167
  const token = result.stdout.trim();
161
168
  return token || null;
@@ -2,11 +2,11 @@
2
2
 
3
3
  import {
4
4
  isGlobalRepoPath
5
- } from "./chunk-WJ5TINR6.js";
5
+ } from "./chunk-EWKHP6DD.js";
6
6
  import {
7
7
  ensureGhPreferOrigin,
8
8
  resolveRepoRoot
9
- } from "./chunk-CKBIQ54F.js";
9
+ } from "./chunk-6ZGTM2E7.js";
10
10
  import {
11
11
  appDataDir
12
12
  } from "./chunk-7MV3RXSC.js";
@@ -1,19 +1,23 @@
1
1
  import {
2
2
  isOrchestratorThread
3
- } from "./chunk-OIEFHOP7.js";
3
+ } from "./chunk-U4RZ3IQI.js";
4
4
  import {
5
5
  applyConnectedTeamToCli,
6
6
  brightsyMcpServerName,
7
7
  ensureCliTeamTracked,
8
8
  ensureConnectedBrightsyTeamTokens,
9
9
  loadBrightsyConfig
10
- } from "./chunk-BTL7EMGT.js";
10
+ } from "./chunk-HHTHF5BQ.js";
11
11
  import {
12
12
  extractJsonErrorMessage,
13
13
  formatUnknownDetail,
14
14
  looksLikeAgentFailureMessage,
15
15
  parseCursorRunnerLine
16
16
  } from "./chunk-CBJSPTBG.js";
17
+ import {
18
+ codexUnattendedGitConfigArgs,
19
+ resolveAgentGitAuthEnv
20
+ } from "./chunk-OBHZKT2T.js";
17
21
  import {
18
22
  claudeChromeEnabled,
19
23
  loadAppSettings,
@@ -33,7 +37,7 @@ import {
33
37
  resolveCommandBinarySync,
34
38
  run,
35
39
  withExportedPath
36
- } from "./chunk-D4DPQ552.js";
40
+ } from "./chunk-LGXBYZZA.js";
37
41
 
38
42
  // src/agents/brightsy.ts
39
43
  import { existsSync } from "fs";
@@ -736,6 +740,10 @@ async function buildInjectedMcpServers(opts) {
736
740
  if (orchId) {
737
741
  sideboard.env.SIDEBOARD_ORCHESTRATOR_THREAD_ID = orchId;
738
742
  }
743
+ try {
744
+ Object.assign(sideboard.env, await resolveAgentGitAuthEnv(sideboard.env));
745
+ } catch {
746
+ }
739
747
  servers.push(sideboard);
740
748
  }
741
749
  if (opts.includeBrightsy && isBrightsyConnected()) {
@@ -1017,7 +1025,7 @@ var claudeAdapter = {
1017
1025
  );
1018
1026
  }
1019
1027
  const mode = permissionMode(thread);
1020
- const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-73OAKD3C.js");
1028
+ const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-VGKPYFE2.js");
1021
1029
  const isOrchestrator = isOrchestratorThread2(thread);
1022
1030
  const injectedServers = await buildInjectedMcpServers({
1023
1031
  includeSideboard: true,
@@ -1399,6 +1407,8 @@ var codexAdapter = {
1399
1407
  // `codex exec` rejects `--ask-for-approval` (global-only on newer CLIs).
1400
1408
  "-c",
1401
1409
  'approval_policy="never"',
1410
+ // Seatbelt cannot use the login Keychain; default policy also strips GH_TOKEN.
1411
+ ...codexUnattendedGitConfigArgs(mode.codexSandbox),
1402
1412
  ...model ? ["--model", model] : [],
1403
1413
  ...mcpOverrides
1404
1414
  ];
@@ -1,11 +1,11 @@
1
1
  #!/usr/bin/env node
2
2
 
3
- import {
4
- run
5
- } from "./chunk-AE5VBOFE.js";
6
3
  import {
7
4
  appDataDir
8
5
  } from "./chunk-7MV3RXSC.js";
6
+ import {
7
+ run
8
+ } from "./chunk-3KETJKYA.js";
9
9
 
10
10
  // src/brightsy/connected-teams.ts
11
11
  import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
@@ -6,11 +6,6 @@ import {
6
6
  import {
7
7
  listThreads
8
8
  } from "./chunk-7FD7COKE.js";
9
- import {
10
- gh,
11
- git,
12
- resolveGhAuthToken
13
- } from "./chunk-AE5VBOFE.js";
14
9
  import {
15
10
  getGithubGitAuthMode,
16
11
  getGithubPat
@@ -18,6 +13,11 @@ import {
18
13
  import {
19
14
  worktreesRoot
20
15
  } from "./chunk-7MV3RXSC.js";
16
+ import {
17
+ gh,
18
+ git,
19
+ resolveGhAuthToken
20
+ } from "./chunk-3KETJKYA.js";
21
21
 
22
22
  // src/git/worktree.ts
23
23
  import { existsSync, readdirSync } from "fs";
@@ -902,8 +902,20 @@ function formatMergePrError(raw) {
902
902
  var HTTPS_REWRITE = [
903
903
  { key: "url.https://github.com/.insteadOf", value: "git@github.com:" },
904
904
  { key: "url.https://github.com/.insteadOf", value: "ssh://git@github.com/" },
905
- { key: "credential.https://github.com.helper", value: "!gh auth git-credential" }
905
+ // Empty helper disables ~/.gitconfig osxkeychain so GUI agents cannot pop
906
+ // "git-credential-osxkeychain wants to use the keychain".
907
+ { key: "credential.helper", value: "" }
906
908
  ];
909
+ function nonInteractiveGitProcessEnv() {
910
+ return {
911
+ GIT_TERMINAL_PROMPT: "0",
912
+ GIT_ASKPASS: process.env.GIT_ASKPASS?.trim() || "echo",
913
+ SSH_ASKPASS: process.env.SSH_ASKPASS?.trim() || "echo",
914
+ GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND?.trim() || "ssh -o BatchMode=yes -o ConnectTimeout=15",
915
+ GCM_INTERACTIVE: "never",
916
+ GH_PROMPT_DISABLED: "1"
917
+ };
918
+ }
907
919
  function appendIndexedGitConfig(existing, entries) {
908
920
  const start = Number.parseInt(String(existing?.GIT_CONFIG_COUNT ?? "0"), 10);
909
921
  const count = Number.isFinite(start) && start > 0 ? start : 0;
@@ -919,18 +931,72 @@ function appendIndexedGitConfig(existing, entries) {
919
931
  function githubAgentGitEnv(existing) {
920
932
  return appendIndexedGitConfig(existing, HTTPS_REWRITE);
921
933
  }
934
+ function githubHttpsBearerEnv(existing, token) {
935
+ const rewrite = githubAgentGitEnv(existing);
936
+ const header = appendIndexedGitConfig(
937
+ { ...existing, ...rewrite },
938
+ [
939
+ {
940
+ key: "http.https://github.com/.extraHeader",
941
+ value: `AUTHORIZATION: bearer ${token}`
942
+ }
943
+ ]
944
+ );
945
+ return { ...rewrite, ...header };
946
+ }
922
947
  function applyGithubGitAuthEnv(existing, opts) {
923
- const out = {};
924
- if (opts.mode === "gh" || opts.mode === "token") {
925
- Object.assign(out, githubAgentGitEnv(existing));
948
+ const out = { ...nonInteractiveGitProcessEnv() };
949
+ if (opts.mode === "ssh") return out;
950
+ const existingToken = existing?.GH_TOKEN?.trim() || "";
951
+ const provided = existingToken ? "" : opts.token?.trim() || "";
952
+ const token = existingToken || provided;
953
+ Object.assign(
954
+ out,
955
+ token ? githubHttpsBearerEnv(existing, token) : githubAgentGitEnv(existing)
956
+ );
957
+ if (provided) out.GH_TOKEN = provided;
958
+ return out;
959
+ }
960
+ async function resolveGithubAgentToken(mode, cwd) {
961
+ if (mode === "ssh") return null;
962
+ if (mode === "token") return getGithubPat();
963
+ try {
964
+ return await resolveGhAuthToken(cwd);
965
+ } catch {
966
+ return null;
926
967
  }
927
- if (opts.mode === "token") {
928
- const token = opts.token?.trim();
929
- if (token && !existing?.GH_TOKEN?.trim()) {
930
- out.GH_TOKEN = token;
968
+ }
969
+ async function resolveAgentGitAuthEnv(existing, opts) {
970
+ let mode = "auto";
971
+ if (opts?.mode) {
972
+ mode = opts.mode;
973
+ } else {
974
+ try {
975
+ mode = getGithubGitAuthMode();
976
+ } catch {
977
+ mode = "auto";
931
978
  }
932
979
  }
933
- return out;
980
+ const cwd = opts?.cwd?.trim() || process.cwd();
981
+ let token = null;
982
+ try {
983
+ token = await resolveGithubAgentToken(mode, cwd);
984
+ } catch {
985
+ token = null;
986
+ }
987
+ return applyGithubGitAuthEnv(existing, { mode, token });
988
+ }
989
+ function codexUnattendedGitConfigArgs(sandbox) {
990
+ const args = [
991
+ "-c",
992
+ 'shell_environment_policy.inherit="all"',
993
+ "-c",
994
+ "shell_environment_policy.ignore_default_excludes=true"
995
+ ];
996
+ if (sandbox === "workspace-write") {
997
+ args.push("-c", "sandbox_workspace_write.network_access=true");
998
+ }
999
+ return args;
934
1000
  }
935
1001
  function formatGitAuthModeDirective(mode) {
936
1002
  switch (mode) {
@@ -938,14 +1004,14 @@ function formatGitAuthModeDirective(mode) {
938
1004
  return [
939
1005
  "Git authentication (Account \u2192 GitHub mode: gh CLI):",
940
1006
  "- This process rewrites `git@github.com:` and `ssh://git@github.com/` to HTTPS.",
941
- "- `gh` supplies credentials (`gh auth git-credential`). Do not switch remotes to SSH.",
1007
+ "- `GH_TOKEN` is injected from `gh auth token` (no macOS Keychain prompts). Do not switch remotes to SSH.",
942
1008
  "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
943
1009
  ].join("\n");
944
1010
  case "ssh":
945
1011
  return [
946
1012
  "Git authentication (Account \u2192 GitHub mode: SSH):",
947
1013
  "- Keep SSH remotes (`git@github.com:\u2026`). Do not rewrite them to HTTPS.",
948
- "- Use this Mac\u2019s SSH agent / keys. If push fails with `Permission denied (publickey)`, tell the user to start ssh-agent or switch Account \u2192 GitHub to Auto / gh CLI \u2014 do not rewrite remotes yourself.",
1014
+ "- SSH is batch-mode: it will not prompt for a Keychain password. If push fails with `Permission denied (publickey)`, tell the user to unlock ssh-agent or switch Account \u2192 GitHub to Auto / gh CLI \u2014 do not rewrite remotes yourself.",
949
1015
  "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below (API still uses `gh`)."
950
1016
  ].join("\n");
951
1017
  case "token":
@@ -959,9 +1025,9 @@ function formatGitAuthModeDirective(mode) {
959
1025
  default:
960
1026
  return [
961
1027
  "Git authentication (Account \u2192 GitHub mode: auto):",
962
- "- Prefer the existing remote URL (SSH or HTTPS). Do not rewrite remotes unless a push/fetch fails.",
963
- '- If `git push` fails with `Permission denied (publickey)`, this shell has no ssh-agent. Retry over HTTPS (do not stop): `git -c url.https://github.com/.insteadOf=git@github.com: -c http.extraHeader="AUTHORIZATION: bearer $(gh auth token)" push -u origin HEAD`.',
964
- "- Then create/update the PR with `gh` as below."
1028
+ "- This process rewrites GitHub SSH remotes to HTTPS and authenticates with `GH_TOKEN` from `gh` so git/ssh never prompt the macOS Keychain (required for unattended orchestrator turns).",
1029
+ "- Do not switch remotes to SSH. Push with `git push -u origin HEAD`.",
1030
+ "- If HTTPS auth fails, tell the user to run `gh auth login` on this Mac or set Account \u2192 GitHub to a PAT \u2014 do not wait for a Keychain dialog."
965
1031
  ].join("\n");
966
1032
  }
967
1033
  }
@@ -1342,7 +1408,7 @@ async function originGhRepoEnv(cwd, opts) {
1342
1408
  await ensureGhPreferOrigin(cwd);
1343
1409
  const slug = await resolveGithubRepoSlug(cwd);
1344
1410
  const mode = opts?.mode ?? getGithubGitAuthMode();
1345
- const token = mode === "token" ? getGithubPat() : null;
1411
+ const token = mode === "token" ? getGithubPat() : mode === "ssh" ? null : await resolveGhAuthToken(cwd);
1346
1412
  return {
1347
1413
  ...applyGithubGitAuthEnv(opts?.env, { mode, token }),
1348
1414
  ...slug ? { GH_REPO: slug } : {}
@@ -2347,6 +2413,8 @@ export {
2347
2413
  worktreeDisplayLabelForGroup,
2348
2414
  formatGhLandError,
2349
2415
  githubAgentGitEnv,
2416
+ resolveAgentGitAuthEnv,
2417
+ codexUnattendedGitConfigArgs,
2350
2418
  formatGitAuthModeDirective,
2351
2419
  detectGhStack,
2352
2420
  getPrStack,
@@ -2,12 +2,12 @@
2
2
 
3
3
  import {
4
4
  ensureGlobalCoordinatorCwd
5
- } from "./chunk-NW7MEJHO.js";
5
+ } from "./chunk-HA2QTIWN.js";
6
6
  import {
7
7
  allocateTeamName,
8
8
  takenSlugsFromThread,
9
9
  teamSlugFromName
10
- } from "./chunk-CKBIQ54F.js";
10
+ } from "./chunk-6ZGTM2E7.js";
11
11
  import {
12
12
  createEmptyThread,
13
13
  listThreads,
@@ -2,7 +2,7 @@
2
2
 
3
3
  import {
4
4
  resolveGithubRepoSlug
5
- } from "./chunk-CKBIQ54F.js";
5
+ } from "./chunk-6ZGTM2E7.js";
6
6
  import {
7
7
  resolveThreadDefaults
8
8
  } from "./chunk-AY53MPDE.js";
@@ -3,7 +3,7 @@ import {
3
3
  } from "./chunk-M37RITA6.js";
4
4
  import {
5
5
  run
6
- } from "./chunk-D4DPQ552.js";
6
+ } from "./chunk-LGXBYZZA.js";
7
7
 
8
8
  // src/brightsy/connected-teams.ts
9
9
  import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
@@ -36,7 +36,7 @@ function saveBrightsyConfig(cfg) {
36
36
 
37
37
  // src/brightsy/accounts.ts
38
38
  async function loadConnectedTeams() {
39
- const { listConnectedBrightsyTeams: listConnectedBrightsyTeams2 } = await import("./connected-teams-ZRS53OAT.js");
39
+ const { listConnectedBrightsyTeams: listConnectedBrightsyTeams2 } = await import("./connected-teams-BNBM7OIC.js");
40
40
  return listConnectedBrightsyTeams2();
41
41
  }
42
42
  async function runBrightsyTeamsJson(args) {
@@ -68,7 +68,7 @@ async function getBrightsySession() {
68
68
  const data = await runBrightsyTeamsJson([]);
69
69
  const accounts = Array.isArray(data.teams) ? data.teams : [];
70
70
  const active = data.active ?? accounts.find((a) => a.active) ?? null;
71
- const { ensureCliTeamTracked: ensureCliTeamTracked2 } = await import("./connected-teams-ZRS53OAT.js");
71
+ const { ensureCliTeamTracked: ensureCliTeamTracked2 } = await import("./connected-teams-BNBM7OIC.js");
72
72
  const connectedTeams = ensureCliTeamTracked2(
73
73
  active ? { id: active.id, slug: active.slug, name: active.name } : void 0
74
74
  );
@@ -108,7 +108,7 @@ async function performBrightsyAccountSwitch(accountIdOrSlug) {
108
108
  return { cfg, target: data.active };
109
109
  }
110
110
  async function switchBrightsyAccount(accountIdOrSlug) {
111
- const { connectBrightsyTeam: connectBrightsyTeam2 } = await import("./connected-teams-ZRS53OAT.js");
111
+ const { connectBrightsyTeam: connectBrightsyTeam2 } = await import("./connected-teams-BNBM7OIC.js");
112
112
  await connectBrightsyTeam2(accountIdOrSlug);
113
113
  return getBrightsySession();
114
114
  }
@@ -1,10 +1,10 @@
1
1
  import {
2
2
  isGlobalRepoPath
3
- } from "./chunk-OIEFHOP7.js";
3
+ } from "./chunk-U4RZ3IQI.js";
4
4
  import {
5
5
  ensureGhPreferOrigin,
6
6
  resolveRepoRoot
7
- } from "./chunk-XW47PL6A.js";
7
+ } from "./chunk-OBHZKT2T.js";
8
8
  import {
9
9
  appDataDir
10
10
  } from "./chunk-M37RITA6.js";