@sideboard-ai/core 0.1.89 → 0.1.92

package/dist/index.cjs

@@ -3068,42 +3068,124 @@ var init_gh_errors = __esm({
   }
 });
 
+// src/git/github-agent-auth.ts
+function githubAgentAuthDir() {
+  const override = process.env.SIDEBOARD_GIT_AUTH_DIR?.trim();
+  if (override) return override;
+  return (0, import_node_path10.join)((0, import_node_os4.homedir)(), ".sideboard-git-auth");
+}
+function githubCredentialStorePath() {
+  return (0, import_node_path10.join)(githubAgentAuthDir(), "git-credentials");
+}
+function githubGhConfigDir() {
+  return (0, import_node_path10.join)(githubAgentAuthDir(), "gh");
+}
+function writePrivateFile2(file, body) {
+  (0, import_node_fs10.mkdirSync)((0, import_node_path10.dirname)(file), { recursive: true, mode: 448 });
+  try {
+    (0, import_node_fs10.chmodSync)((0, import_node_path10.dirname)(file), 448);
+  } catch {
+  }
+  (0, import_node_fs10.writeFileSync)(file, body, { encoding: "utf8", mode: 384 });
+  try {
+    (0, import_node_fs10.chmodSync)(file, 384);
+  } catch {
+  }
+}
+function gitCredentialStoreContents(token) {
+  return `https://x-access-token:${encodeURIComponent(token)}@github.com
+`;
+}
+function ghHostsYml(token, user = "x-access-token") {
+  const u = user.replace(/[^A-Za-z0-9._-]/g, "") || "x-access-token";
+  return [
+    "github.com:",
+    "    git_protocol: https",
+    `    user: ${u}`,
+    `    oauth_token: ${token}`,
+    "    users:",
+    `        ${u}:`,
+    `            oauth_token: ${token}`,
+    ""
+  ].join("\n");
+}
+function materializeGithubAgentAuth(token, user) {
+  const trimmed = token.trim();
+  if (!trimmed) return;
+  const root = githubAgentAuthDir();
+  (0, import_node_fs10.mkdirSync)(root, { recursive: true, mode: 448 });
+  try {
+    (0, import_node_fs10.chmodSync)(root, 448);
+  } catch {
+  }
+  writePrivateFile2(githubCredentialStorePath(), gitCredentialStoreContents(trimmed));
+  const ghDir = githubGhConfigDir();
+  (0, import_node_fs10.mkdirSync)(ghDir, { recursive: true, mode: 448 });
+  writePrivateFile2((0, import_node_path10.join)(ghDir, "hosts.yml"), ghHostsYml(trimmed, user));
+  writePrivateFile2((0, import_node_path10.join)(ghDir, "config.yml"), "git_protocol: https\nprompt: disabled\n");
+}
+function githubAgentAuthReady() {
+  return (0, import_node_fs10.existsSync)(githubCredentialStorePath()) && (0, import_node_fs10.existsSync)((0, import_node_path10.join)(githubGhConfigDir(), "hosts.yml"));
+}
+function githubCredentialHelperGitConfig() {
+  const file = githubCredentialStorePath();
+  return [
+    { key: "credential.helper", value: "" },
+    { key: "credential.helper", value: `store --file=${file}` }
+  ];
+}
+function githubGhConfigEnv() {
+  return {
+    GH_CONFIG_DIR: githubGhConfigDir(),
+    GH_PROMPT_DISABLED: "1"
+  };
+}
+var import_node_fs10, import_node_os4, import_node_path10;
+var init_github_agent_auth = __esm({
+  "src/git/github-agent-auth.ts"() {
+    "use strict";
+    import_node_fs10 = require("fs");
+    import_node_os4 = require("os");
+    import_node_path10 = require("path");
+  }
+});
+
 // src/agents/path.ts
 function prependPathDir(env, dir) {
-  if (!dir || !(0, import_node_fs10.existsSync)(dir)) return;
+  if (!dir || !(0, import_node_fs11.existsSync)(dir)) return;
   const current = env.PATH ?? "";
-  const parts = current.split(import_node_path10.delimiter).filter(Boolean);
+  const parts = current.split(import_node_path11.delimiter).filter(Boolean);
   if (parts.includes(dir)) {
     env.PATH = current;
     return;
   }
-  env.PATH = [dir, ...parts].join(import_node_path10.delimiter);
+  env.PATH = [dir, ...parts].join(import_node_path11.delimiter);
 }
-function conductorBundledBinDir(home = process.env.HOME || process.env.USERPROFILE || (0, import_node_os4.homedir)()) {
-  return (0, import_node_path10.join)(home, "Library", "Application Support", "com.conductor.app", "bin");
+function conductorBundledBinDir(home = process.env.HOME || process.env.USERPROFILE || (0, import_node_os5.homedir)()) {
+  return (0, import_node_path11.join)(home, "Library", "Application Support", "com.conductor.app", "bin");
 }
 function isConductorBundledCli(filePath) {
   const p = (filePath ?? "").replace(/\\/g, "/");
   return p.includes("/com.conductor.app/bin/") || p.endsWith("/com.conductor.app/bin");
 }
 function ensureAgentPath(env = process.env) {
-  const home = env.HOME || env.USERPROFILE || (0, import_node_os4.homedir)();
+  const home = env.HOME || env.USERPROFILE || (0, import_node_os5.homedir)();
   const current = env.PATH ?? "";
-  const parts = current.split(import_node_path10.delimiter).filter(Boolean);
+  const parts = current.split(import_node_path11.delimiter).filter(Boolean);
   const seen = new Set(parts);
   const extras = [
-    ...EXTRA_BIN_DIRS.map((rel) => (0, import_node_path10.join)(home, rel)),
+    ...EXTRA_BIN_DIRS.map((rel) => (0, import_node_path11.join)(home, rel)),
     "/opt/homebrew/bin",
     "/usr/local/bin",
     // Keep after Homebrew/npm so a user-installed CLI still wins.
     conductorBundledBinDir(home)
   ];
   for (const dir of extras.reverse()) {
-    if (!dir || seen.has(dir) || !(0, import_node_fs10.existsSync)(dir)) continue;
+    if (!dir || seen.has(dir) || !(0, import_node_fs11.existsSync)(dir)) continue;
     parts.unshift(dir);
     seen.add(dir);
   }
-  const next = parts.join(import_node_path10.delimiter);
+  const next = parts.join(import_node_path11.delimiter);
   env.PATH = next;
   return next;
 }
@@ -3117,7 +3199,7 @@ function enrichPathWithNpmGlobalBin(env = process.env) {
       stdio: ["ignore", "pipe", "ignore"]
     }).trim().split(/\r?\n/).find(Boolean);
     if (prefix) {
-      const binDir = process.platform === "win32" ? prefix : (0, import_node_path10.join)(prefix, "bin");
+      const binDir = process.platform === "win32" ? prefix : (0, import_node_path11.join)(prefix, "bin");
       prependPathDir(env, binDir);
     }
   } catch {
@@ -3145,14 +3227,14 @@ function withExportedPath(command, pathValue) {
   if (/^(export\s+PATH=|PATH=)/.test(trimmed)) return trimmed;
   return `export PATH=${posixShellSingleQuote(pathValue)} && ${trimmed}`;
 }
-var import_node_fs10, import_node_child_process3, import_node_os4, import_node_path10, EXTRA_BIN_DIRS;
+var import_node_fs11, import_node_child_process3, import_node_os5, import_node_path11, EXTRA_BIN_DIRS;
 var init_path = __esm({
   "src/agents/path.ts"() {
     "use strict";
-    import_node_fs10 = require("fs");
+    import_node_fs11 = require("fs");
     import_node_child_process3 = require("child_process");
-    import_node_os4 = require("os");
-    import_node_path10 = require("path");
+    import_node_os5 = require("os");
+    import_node_path11 = require("path");
     EXTRA_BIN_DIRS = [
       ".local/bin",
       ".cargo/bin",
@@ -3277,42 +3359,46 @@ function appendIndexedGitConfig(existing, entries) {
   return out;
 }
 function githubAgentGitEnv(existing) {
-  return appendIndexedGitConfig(existing, HTTPS_REWRITE);
-}
-function githubHttpsBearerEnv(existing, token) {
-  const rewrite = githubAgentGitEnv(existing);
-  const header = appendIndexedGitConfig(
-    { ...existing, ...rewrite },
-    [
-      {
-        key: "http.https://github.com/.extraHeader",
-        value: `AUTHORIZATION: bearer ${token}`
-      }
-    ]
-  );
-  return { ...rewrite, ...header };
+  const helpers = githubAgentAuthReady() ? githubCredentialHelperGitConfig() : [{ key: "credential.helper", value: "" }];
+  return appendIndexedGitConfig(existing, [...HTTPS_REWRITE, ...helpers]);
 }
 function applyGithubGitAuthEnv(existing, opts) {
   const out = { ...nonInteractiveGitProcessEnv() };
+  const token = opts.token?.trim() || existing?.GH_TOKEN?.trim() || "" || "";
+  if (token) materializeGithubAgentAuth(token);
+  Object.assign(out, githubGhConfigEnv());
   if (opts.mode === "ssh") return out;
-  const existingToken = existing?.GH_TOKEN?.trim() || "";
-  const provided = existingToken ? "" : opts.token?.trim() || "";
-  const token = existingToken || provided;
-  Object.assign(
-    out,
-    token ? githubHttpsBearerEnv(existing, token) : githubAgentGitEnv(existing)
-  );
-  if (provided) out.GH_TOKEN = provided;
+  Object.assign(out, githubAgentGitEnv(existing));
   return out;
 }
+function scrubGithubTokensFromChildEnv(env) {
+  for (const key of GITHUB_CHILD_TOKEN_KEYS) {
+    delete env[key];
+  }
+}
+function mergeAgentGitAuthEnv(env, gitEnv) {
+  Object.assign(env, gitEnv);
+  scrubGithubTokensFromChildEnv(env);
+}
 async function resolveGithubAgentToken(mode, cwd) {
-  if (mode === "ssh") return null;
-  if (mode === "token") return getGithubPat();
-  try {
-    return await resolveGhAuthToken(cwd);
-  } catch {
-    return null;
+  if (tokenMemo && tokenMemo.mode === mode && Date.now() - tokenMemo.at < TOKEN_TTL_MS) {
+    return tokenMemo.value;
+  }
+  let value = null;
+  if (mode === "token") {
+    value = getGithubPat();
+  } else {
+    try {
+      value = await resolveGhAuthToken(cwd);
+    } catch {
+      value = null;
+    }
   }
+  tokenMemo = { mode, value, at: Date.now() };
+  return value;
+}
+function resetGithubAgentTokenMemo() {
+  tokenMemo = null;
 }
 async function resolveAgentGitAuthEnv(existing, opts) {
   let mode = "auto";
@@ -3334,7 +3420,40 @@ async function resolveAgentGitAuthEnv(existing, opts) {
   }
   return applyGithubGitAuthEnv(existing, { mode, token });
 }
-function codexUnattendedGitConfigArgs(sandbox) {
+async function warmGithubAgentAuth(opts) {
+  if (!opts?.force && githubAgentAuthReady()) return;
+  await resolveAgentGitAuthEnv(void 0, opts);
+}
+function normalizeWritableRoot(raw) {
+  const trimmed = raw.trim().replace(/\/+$/, "");
+  return trimmed && (0, import_node_path12.isAbsolute)(trimmed) ? trimmed : null;
+}
+async function resolveCodexGitWritableRoots(cwd) {
+  const roots = /* @__PURE__ */ new Set();
+  const authDir = normalizeWritableRoot(githubAgentAuthDir());
+  if (authDir) roots.add(authDir);
+  try {
+    const [gitDir, commonDir] = await Promise.all([
+      git(["rev-parse", "--absolute-git-dir"], cwd, { reject: false, timeoutMs: 5e3 }),
+      git(["rev-parse", "--path-format=absolute", "--git-common-dir"], cwd, {
+        reject: false,
+        timeoutMs: 5e3
+      })
+    ]);
+    const gitDirPath = gitDir.exitCode === 0 ? normalizeWritableRoot(gitDir.stdout) : null;
+    const commonPath = commonDir.exitCode === 0 ? normalizeWritableRoot(commonDir.stdout) : null;
+    if (gitDirPath) roots.add(gitDirPath);
+    if (commonPath) roots.add(commonPath);
+  } catch {
+  }
+  return [...roots];
+}
+function codexSandboxWritableRootsArgs(roots) {
+  const abs = [...new Set(roots.map(normalizeWritableRoot).filter(Boolean))];
+  if (abs.length === 0) return [];
+  return ["-c", `sandbox_workspace_write.writable_roots=${JSON.stringify(abs)}`];
+}
+function codexUnattendedGitConfigArgs(sandbox, opts) {
   const args = [
     "-c",
     'shell_environment_policy.inherit="all"',
@@ -3343,54 +3462,65 @@ function codexUnattendedGitConfigArgs(sandbox) {
   ];
   if (sandbox === "workspace-write") {
     args.push("-c", "sandbox_workspace_write.network_access=true");
+    args.push(...codexSandboxWritableRootsArgs(opts?.writableRoots ?? []));
   }
   return args;
 }
 function formatGitAuthModeDirective(mode) {
+  const shared = [
+    "- `git` and `gh` already authenticate in this process. Do not look for tokens in the environment, paste credentials into commands, or switch remotes to SSH.",
+    "- Do not set GitHub token environment variables, pass `--with-token`, or run `gh auth login` from this turn.",
+    "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below.",
+    "- If git/gh fail with auth errors, tell the user to run `gh auth login` on this Mac (or set a PAT in Account \u2192 GitHub). Do not wait for a Keychain dialog."
+  ];
   switch (mode) {
     case "gh":
       return [
         "Git authentication (Account \u2192 GitHub mode: gh CLI):",
         "- This process rewrites `git@github.com:` and `ssh://git@github.com/` to HTTPS.",
-        "- `GH_TOKEN` is injected from `gh auth token` (no macOS Keychain prompts). Do not switch remotes to SSH.",
-        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
+        ...shared
       ].join("\n");
     case "ssh":
       return [
         "Git authentication (Account \u2192 GitHub mode: SSH):",
         "- Keep SSH remotes (`git@github.com:\u2026`). Do not rewrite them to HTTPS.",
         "- SSH is batch-mode: it will not prompt for a Keychain password. If push fails with `Permission denied (publickey)`, tell the user to unlock ssh-agent or switch Account \u2192 GitHub to Auto / gh CLI \u2014 do not rewrite remotes yourself.",
-        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below (API still uses `gh`)."
+        "- `gh` already authenticates for PRs/API (no token in the environment). Do not set GitHub token environment variables or run `gh auth login` from this turn.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
       ].join("\n");
     case "token":
       return [
         "Git authentication (Account \u2192 GitHub mode: personal access token):",
         "- This process rewrites GitHub SSH remotes to HTTPS.",
-        "- `GH_TOKEN` is set in the environment. Use HTTPS git and `gh`; do not paste the token into commands or chat.",
-        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
+        ...shared
       ].join("\n");
     case "auto":
     default:
       return [
         "Git authentication (Account \u2192 GitHub mode: auto):",
-        "- This process rewrites GitHub SSH remotes to HTTPS and authenticates with `GH_TOKEN` from `gh` so git/ssh never prompt the macOS Keychain (required for unattended orchestrator turns).",
-        "- Do not switch remotes to SSH. Push with `git push -u origin HEAD`.",
-        "- If HTTPS auth fails, tell the user to run `gh auth login` on this Mac or set Account \u2192 GitHub to a PAT \u2014 do not wait for a Keychain dialog."
+        "- This process rewrites GitHub SSH remotes to HTTPS so git/ssh never prompt the macOS Keychain (required for unattended orchestrator turns).",
+        ...shared
       ].join("\n");
   }
 }
-var HTTPS_REWRITE;
+var import_node_path12, HTTPS_REWRITE, TOKEN_TTL_MS, tokenMemo, GITHUB_CHILD_TOKEN_KEYS;
 var init_git_auth_mode = __esm({
   "src/git/git-auth-mode.ts"() {
     "use strict";
+    import_node_path12 = require("path");
     init_app_settings();
+    init_github_agent_auth();
     init_run();
     HTTPS_REWRITE = [
       { key: "url.https://github.com/.insteadOf", value: "git@github.com:" },
-      { key: "url.https://github.com/.insteadOf", value: "ssh://git@github.com/" },
-      // Empty helper disables ~/.gitconfig osxkeychain so GUI agents cannot pop
-      // "git-credential-osxkeychain wants to use the keychain".
-      { key: "credential.helper", value: "" }
+      { key: "url.https://github.com/.insteadOf", value: "ssh://git@github.com/" }
+    ];
+    TOKEN_TTL_MS = 12 * 60 * 60 * 1e3;
+    tokenMemo = null;
+    GITHUB_CHILD_TOKEN_KEYS = [
+      "GH_TOKEN",
+      "GITHUB_TOKEN",
+      "GH_ENTERPRISE_TOKEN"
     ];
   }
 });
@@ -3751,10 +3881,12 @@ __export(worktree_exports, {
   getPr: () => getPr,
   getPrChecks: () => getPrChecks,
   getPrDetails: () => getPrDetails,
+  getPrForHeadBranch: () => getPrForHeadBranch,
   getPrMeta: () => getPrMeta,
   ghHeadRef: () => ghHeadRef,
   ghRepoSelectArgs: () => ghRepoSelectArgs,
   githubAgentGitEnv: () => githubAgentGitEnv,
+  isDefaultishSourceRef: () => isDefaultishSourceRef,
   isDirty: () => isDirty,
   isPlaceholderBranch: () => isPlaceholderBranch,
   isSideboardScratchPath: () => isSideboardScratchPath,
@@ -3772,6 +3904,7 @@ __export(worktree_exports, {
   resolveDiffBaseRef: () => resolveDiffBaseRef,
   resolveGithubRepoSlug: () => resolveGithubRepoSlug,
   resolvePrSelector: () => resolvePrSelector,
+  resolvePrSelectors: () => resolvePrSelectors,
   resolveRepoRoot: () => resolveRepoRoot,
   resolveWorktreeStartPoint: () => resolveWorktreeStartPoint,
   slugify: () => slugify,
@@ -3880,7 +4013,7 @@ async function originGhRepoEnv(cwd, opts) {
   await ensureGhPreferOrigin(cwd);
   const slug = await resolveGithubRepoSlug(cwd);
   const mode = opts?.mode ?? getGithubGitAuthMode();
-  const token = mode === "token" ? getGithubPat() : mode === "ssh" ? null : await resolveGhAuthToken(cwd);
+  const token = await resolveGithubAgentToken(mode, cwd);
   return {
     ...applyGithubGitAuthEnv(opts?.env, { mode, token }),
     ...slug ? { GH_REPO: slug } : {}
@@ -4020,13 +4153,78 @@ async function getPr(repoPath, number) {
   if (exitCode !== 0 || !stdout.trim()) return null;
   return JSON.parse(stdout);
 }
-function resolvePrSelector(thread) {
-  if (thread.prUrl?.trim()) return thread.prUrl.trim();
+function normalizeGitBranchName(ref) {
+  return ref.trim().replace(/^refs\/heads\//, "").replace(/^origin\//, "");
+}
+function isDefaultishSourceRef(ref) {
+  const n = normalizeGitBranchName(ref ?? "").toLowerCase();
+  return !n || n === "head" || n === "default" || n === "main" || n === "master" || n === "develop" || n === "trunk";
+}
+function resolvePrSelectors(thread) {
+  const out = [];
+  const push = (value) => {
+    const v = value?.trim();
+    if (!v || out.includes(v)) return;
+    out.push(v);
+  };
+  push(thread.prUrl);
   if (thread.sourceType === "pr" && thread.sourceRef?.trim()) {
-    return thread.sourceRef.replace(/^#/, "").trim();
+    push(thread.sourceRef.replace(/^#/, "").trim());
+  }
+  push(thread.branchName);
+  if (thread.sourceType === "branch") {
+    const source = normalizeGitBranchName(thread.sourceRef ?? "");
+    if (source && !isDefaultishSourceRef(source) && source !== thread.branchName?.trim()) {
+      push(source);
+    }
+  }
+  return out;
+}
+function resolvePrSelector(thread) {
+  return resolvePrSelectors(thread)[0] ?? null;
+}
+async function getPrForHeadBranch(repoPath, branch) {
+  const head = normalizeGitBranchName(branch);
+  if (!head || isDefaultishSourceRef(head)) return null;
+  const slug = await resolveGithubRepoSlug(repoPath);
+  const viewArgs = [
+    "pr",
+    "view",
+    head,
+    "--json",
+    "number,title,headRefName,url,isCrossRepository"
+  ];
+  if (slug) viewArgs.push("--repo", slug);
+  const viewed = await gh(viewArgs, repoPath, { reject: false });
+  if (viewed.exitCode === 0 && viewed.stdout.trim()) {
+    try {
+      return JSON.parse(viewed.stdout);
+    } catch {
+      return null;
+    }
+  }
+  const listHead = slug ? ghHeadRef(slug, head) : head;
+  const listArgs = [
+    "pr",
+    "list",
+    "--head",
+    listHead,
+    "--json",
+    "number,title,headRefName,url,isCrossRepository",
+    "--limit",
+    "1",
+    "--state",
+    "open"
+  ];
+  if (slug) listArgs.push("--repo", slug);
+  const listed = await gh(listArgs, repoPath, { reject: false });
+  if (listed.exitCode !== 0 || !listed.stdout.trim()) return null;
+  try {
+    const rows = JSON.parse(listed.stdout);
+    return rows[0] ?? null;
+  } catch {
+    return null;
   }
-  if (thread.branchName?.trim()) return thread.branchName.trim();
-  return null;
 }
 function normalizeGhTime(value) {
   if (typeof value !== "string" || !value.trim()) return null;
@@ -4352,7 +4550,7 @@ async function fetchPrHead(repoPath, number, localBranch) {
     const label = opts?.ghAuth ? `${remote} (gh auth)` : remote;
     const gitOpts = { reject: false };
     if (opts?.ghAuth) {
-      const token = await resolveGhAuthToken(repoPath);
+      const token = await resolveGithubAgentToken(getGithubGitAuthMode(), repoPath);
       if (!token) {
         errors.push(`${label}: gh auth token unavailable`);
         return false;
@@ -4403,7 +4601,7 @@ async function fetchPrHead(repoPath, number, localBranch) {
       const ensureOid = async (remote, opts) => {
         const gitOpts = { reject: false };
         if (opts?.ghAuth) {
-          const token = await resolveGhAuthToken(repoPath);
+          const token = await resolveGithubAgentToken(getGithubGitAuthMode(), repoPath);
           if (!token) return false;
           gitOpts.env = { GIT_TERMINAL_PROMPT: "0" };
           gitOpts.config = {
@@ -4471,8 +4669,8 @@ function isLocalPrFetchBranch(ref) {
 }
 async function createThreadWorktree(opts) {
   let branchName = `thread/${opts.slug}`;
-  const worktreePath = (0, import_node_path11.join)(worktreesRoot(opts.repoPath), opts.slug);
-  if ((0, import_node_fs11.existsSync)(worktreePath)) {
+  const worktreePath = (0, import_node_path13.join)(worktreesRoot(opts.repoPath), opts.slug);
+  if ((0, import_node_fs12.existsSync)(worktreePath)) {
     throw new Error(`Worktree already exists at ${worktreePath}`);
   }
   await ensureGhPreferOrigin(opts.repoPath);
@@ -4541,8 +4739,8 @@ ${add.stdout}`;
 async function createExistingBranchWorktree(opts) {
   const branchName = opts.branchName.trim();
   if (!branchName) throw new Error("branch name required");
-  const worktreePath = (0, import_node_path11.join)(worktreesRoot(opts.repoPath), opts.slug);
-  if ((0, import_node_fs11.existsSync)(worktreePath)) {
+  const worktreePath = (0, import_node_path13.join)(worktreesRoot(opts.repoPath), opts.slug);
+  if ((0, import_node_fs12.existsSync)(worktreePath)) {
     throw new Error(`Worktree already exists at ${worktreePath}`);
   }
   await ensureGhPreferOrigin(opts.repoPath);
@@ -4653,7 +4851,7 @@ async function pushBranch(worktreePath, branchName) {
   if (ssh.exitCode === 0) return;
   const sshErr = (ssh.stderr || ssh.stdout).trim();
   const slug = await resolveGithubRepoSlug(worktreePath);
-  const token = await resolveGhAuthToken(worktreePath);
+  const token = await resolveGithubAgentToken(getGithubGitAuthMode(), worktreePath);
   if (!slug || !token) {
     throw new Error(
       sshErr || `git push origin ${branchName} failed` + (!token ? " (no SSH agent and gh auth token unavailable \u2014 run: gh auth login)" : "")
@@ -4830,10 +5028,10 @@ function sameRepoPath(a, b) {
   return normalizeWorktreePath(a) === normalizeWorktreePath(b);
 }
 function listLocalThreadBranchSlugs(repoPath) {
-  const refsDir = (0, import_node_path11.join)(repoPath, ".git", "refs", "heads", "thread");
-  if (!(0, import_node_fs11.existsSync)(refsDir)) return [];
+  const refsDir = (0, import_node_path13.join)(repoPath, ".git", "refs", "heads", "thread");
+  if (!(0, import_node_fs12.existsSync)(refsDir)) return [];
   try {
-    return (0, import_node_fs11.readdirSync)(refsDir).filter((name) => !name.startsWith(".")).map((name) => normalizeTakenSlug(name));
+    return (0, import_node_fs12.readdirSync)(refsDir).filter((name) => !name.startsWith(".")).map((name) => normalizeTakenSlug(name));
   } catch {
     return [];
   }
@@ -4841,8 +5039,8 @@ function listLocalThreadBranchSlugs(repoPath) {
 function collectTakenTeamSlugs(repoPath) {
   const taken = /* @__PURE__ */ new Set();
   const root = worktreesRoot(repoPath);
-  if ((0, import_node_fs11.existsSync)(root)) {
-    for (const entry of (0, import_node_fs11.readdirSync)(root, { withFileTypes: true })) {
+  if ((0, import_node_fs12.existsSync)(root)) {
+    for (const entry of (0, import_node_fs12.readdirSync)(root, { withFileTypes: true })) {
       if (entry.isDirectory() && entry.name !== ".DS_Store") {
         taken.add(normalizeTakenSlug(entry.name));
       }
@@ -4863,18 +5061,18 @@ function allocateTeamSlug(repoPath) {
   const taken = collectTakenTeamSlugs(repoPath);
   for (let attempt = 0; attempt < 32; attempt++) {
     const team = allocateTeamName(taken);
-    const path2 = (0, import_node_path11.join)(worktreesRoot(repoPath), team.slug);
-    if (!(0, import_node_fs11.existsSync)(path2)) return team;
+    const path2 = (0, import_node_path13.join)(worktreesRoot(repoPath), team.slug);
+    if (!(0, import_node_fs12.existsSync)(path2)) return team;
     taken.add(team.slug);
   }
   throw new Error("No available soccer team worktree directories left");
 }
-var import_node_fs11, import_node_path11;
+var import_node_fs12, import_node_path13;
 var init_worktree = __esm({
   "src/git/worktree.ts"() {
     "use strict";
-    import_node_fs11 = require("fs");
-    import_node_path11 = require("path");
+    import_node_fs12 = require("fs");
+    import_node_path13 = require("path");
     init_paths();
     init_thread_store();
     init_teams();
@@ -4958,7 +5156,7 @@ function coordinatorTurnReminder(opts) {
 function ensureGlobalCoordinatorCwd(opts) {
   const dir = globalAgentCwd();
   try {
-    (0, import_node_fs12.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs13.mkdirSync)(dir, { recursive: true });
   } catch {
     return dir;
   }
@@ -4966,7 +5164,7 @@ function ensureGlobalCoordinatorCwd(opts) {
   let orchId = opts?.orchestratorThreadId?.trim() || "";
   if (!orchId) {
     try {
-      const existing = (0, import_node_fs12.readFileSync)((0, import_node_path12.join)(dir, "AGENTS.md"), "utf8");
+      const existing = (0, import_node_fs13.readFileSync)((0, import_node_path14.join)(dir, "AGENTS.md"), "utf8");
       const m = existing.match(
         /YOUR orchestration thread id is `([0-9a-f-]{36})`/i
       );
@@ -5008,9 +5206,9 @@ function ensureGlobalCoordinatorCwd(opts) {
     "Always ask worktree agents to commit, push, and open draft PRs (`ask_git` / `send_to_thread`). Tell them to merge only when the user explicitly asked. The worktree agent runs git/gh; never merge from this orchestration cwd."
   ].join("\n");
   try {
-    (0, import_node_fs12.writeFileSync)((0, import_node_path12.join)(dir, "CLAUDE.md"), `${body}
+    (0, import_node_fs13.writeFileSync)((0, import_node_path14.join)(dir, "CLAUDE.md"), `${body}
 `, "utf8");
-    (0, import_node_fs12.writeFileSync)((0, import_node_path12.join)(dir, "AGENTS.md"), `${body}
+    (0, import_node_fs13.writeFileSync)((0, import_node_path14.join)(dir, "AGENTS.md"), `${body}
 `, "utf8");
   } catch {
   }
@@ -5042,12 +5240,12 @@ function coordinatorSystemPrompt(opts) {
     formatWorkspaceInventory(opts.workspaces)
   ].join("\n");
 }
-var import_node_fs12, import_node_path12, COORDINATOR_TOOL_PLAYBOOK, SLACK_REPLY_FORMATTING;
+var import_node_fs13, import_node_path14, COORDINATOR_TOOL_PLAYBOOK, SLACK_REPLY_FORMATTING;
 var init_coordinator_prompt = __esm({
   "src/orchestrator/coordinator-prompt.ts"() {
     "use strict";
-    import_node_fs12 = require("fs");
-    import_node_path12 = require("path");
+    import_node_fs13 = require("fs");
+    import_node_path14 = require("path");
     init_worktree();
     init_app_settings();
     init_paths();
@@ -5063,7 +5261,7 @@ var init_coordinator_prompt = __esm({
       "- get_pr_stack / open_pr_stack_layers / add_stack_layer / create_pr_stack \u2014 GitHub stacked PRs (`gh stack`); one worktree per layer",
       "- list_models \u2014 only when you need a specific model (rare); otherwise omit model so Account defaults apply",
       "- list_threads / get_thread \u2014 fleet status (what is going on)",
-      "- ask_user \u2014 multiple-choice questions in the composer (any mode, not only Plan). Explain options in chat first, include a description on every option, then wait for answers.",
+      "- ask_user \u2014 composer multiple-choice only when blocked on a concrete choice (approach fork, which API). Never for hellos, check-ins, or invented \u201Cwhat should we do?\u201D menus \u2014 reply in chat. Explain options first, description on every option, then wait.",
       "- set_caffeinate \u2014 keep this Mac awake across turns (macOS caffeinate). Turn on for Slack / away-from-keyboard work. Turn OFF when the user says they are done, wrapping up, going to sleep, or no longer need the machine awake. Closing this chat also releases it.",
       "Workspaces:",
       "- add_workspace / remove_workspace \u2014 register or unregister a git repo",
@@ -5353,38 +5551,38 @@ __export(workspaces_exports, {
   syncWorkspacesFromThreads: () => syncWorkspacesFromThreads
 });
 function workspacesFile() {
-  return (0, import_node_path13.join)(appDataDir(), "workspaces.json");
+  return (0, import_node_path15.join)(appDataDir(), "workspaces.json");
 }
 function removedWorkspacesFile() {
-  return (0, import_node_path13.join)(appDataDir(), "removed-workspaces.json");
+  return (0, import_node_path15.join)(appDataDir(), "removed-workspaces.json");
 }
 function readAll() {
   const path2 = workspacesFile();
-  if (!(0, import_node_fs13.existsSync)(path2)) return [];
+  if (!(0, import_node_fs14.existsSync)(path2)) return [];
   try {
-    const raw = JSON.parse((0, import_node_fs13.readFileSync)(path2, "utf8"));
+    const raw = JSON.parse((0, import_node_fs14.readFileSync)(path2, "utf8"));
     return Array.isArray(raw) ? raw : [];
   } catch {
     return [];
   }
 }
 function writeAll(list) {
-  (0, import_node_fs13.mkdirSync)(appDataDir(), { recursive: true });
-  (0, import_node_fs13.writeFileSync)(workspacesFile(), JSON.stringify(list, null, 2), "utf8");
+  (0, import_node_fs14.mkdirSync)(appDataDir(), { recursive: true });
+  (0, import_node_fs14.writeFileSync)(workspacesFile(), JSON.stringify(list, null, 2), "utf8");
 }
 function readRemoved() {
   const path2 = removedWorkspacesFile();
-  if (!(0, import_node_fs13.existsSync)(path2)) return /* @__PURE__ */ new Set();
+  if (!(0, import_node_fs14.existsSync)(path2)) return /* @__PURE__ */ new Set();
   try {
-    const raw = JSON.parse((0, import_node_fs13.readFileSync)(path2, "utf8"));
+    const raw = JSON.parse((0, import_node_fs14.readFileSync)(path2, "utf8"));
     return new Set(Array.isArray(raw) ? raw.filter((p) => typeof p === "string") : []);
   } catch {
     return /* @__PURE__ */ new Set();
   }
 }
 function writeRemoved(paths) {
-  (0, import_node_fs13.mkdirSync)(appDataDir(), { recursive: true });
-  (0, import_node_fs13.writeFileSync)(removedWorkspacesFile(), JSON.stringify([...paths].sort(), null, 2), "utf8");
+  (0, import_node_fs14.mkdirSync)(appDataDir(), { recursive: true });
+  (0, import_node_fs14.writeFileSync)(removedWorkspacesFile(), JSON.stringify([...paths].sort(), null, 2), "utf8");
 }
 function rememberRemoved(repoPath) {
   const next = readRemoved();
@@ -5407,7 +5605,7 @@ function listWorkspaces() {
 async function addWorkspace(repoPath) {
   const root = await resolveRepoRoot(repoPath);
   if (!root || root === "/") throw new Error(`Invalid repo path: ${repoPath}`);
-  if (!(0, import_node_fs13.existsSync)(root)) throw new Error(`Repo not found: ${root}`);
+  if (!(0, import_node_fs14.existsSync)(root)) throw new Error(`Repo not found: ${root}`);
   forgetRemoved(root);
   await ensureGhPreferOrigin(root);
   const current = readAll();
@@ -5415,7 +5613,7 @@ async function addWorkspace(repoPath) {
   if (existing) return existing;
   const next = {
     path: root,
-    name: (0, import_node_path13.basename)(root),
+    name: (0, import_node_path15.basename)(root),
     addedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   writeAll([...current, next]);
@@ -5437,10 +5635,10 @@ function syncWorkspacesFromThreads(repoPaths) {
     if (!path2 || path2 === "/" || isGlobalRepoPath(path2) || byPath.has(path2) || removed.has(path2)) {
       continue;
     }
-    if (!(0, import_node_fs13.existsSync)(path2)) continue;
+    if (!(0, import_node_fs14.existsSync)(path2)) continue;
     const ws = {
       path: path2,
-      name: (0, import_node_path13.basename)(path2),
+      name: (0, import_node_path15.basename)(path2),
       addedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     byPath.set(path2, ws);
@@ -5450,12 +5648,12 @@ function syncWorkspacesFromThreads(repoPaths) {
   if (dirty) writeAll(next);
   return next.sort((a, b) => a.name.localeCompare(b.name));
 }
-var import_node_fs13, import_node_path13;
+var import_node_fs14, import_node_path15;
 var init_workspaces = __esm({
   "src/store/workspaces.ts"() {
     "use strict";
-    import_node_fs13 = require("fs");
-    import_node_path13 = require("path");
+    import_node_fs14 = require("fs");
+    import_node_path15 = require("path");
     init_paths();
     init_global_workspace();
     init_worktree();
@@ -5464,32 +5662,32 @@ var init_workspaces = __esm({
 
 // src/brightsy/config.ts
 function brightsyConfigPath() {
-  return (0, import_node_path14.join)((0, import_node_os5.homedir)(), ".brightsy", "config.json");
+  return (0, import_node_path16.join)((0, import_node_os6.homedir)(), ".brightsy", "config.json");
 }
 function loadBrightsyConfig() {
   const path2 = brightsyConfigPath();
-  if (!(0, import_node_fs14.existsSync)(path2)) {
+  if (!(0, import_node_fs15.existsSync)(path2)) {
     throw new Error("Brightsy not logged in \u2014 run `brightsy login` first");
   }
-  const raw = JSON.parse((0, import_node_fs14.readFileSync)(path2, "utf8"));
+  const raw = JSON.parse((0, import_node_fs15.readFileSync)(path2, "utf8"));
   if (!raw.access_token || !raw.account_id) {
     throw new Error("Brightsy config incomplete \u2014 run `brightsy login`");
   }
   return raw;
 }
 function saveBrightsyConfig(cfg) {
-  (0, import_node_fs14.writeFileSync)(brightsyConfigPath(), `${JSON.stringify(cfg, null, 2)}
+  (0, import_node_fs15.writeFileSync)(brightsyConfigPath(), `${JSON.stringify(cfg, null, 2)}
 `, {
     mode: 384
   });
 }
-var import_node_fs14, import_node_os5, import_node_path14;
+var import_node_fs15, import_node_os6, import_node_path16;
 var init_config = __esm({
   "src/brightsy/config.ts"() {
     "use strict";
-    import_node_fs14 = require("fs");
-    import_node_os5 = require("os");
-    import_node_path14 = require("path");
+    import_node_fs15 = require("fs");
+    import_node_os6 = require("os");
+    import_node_path16 = require("path");
   }
 });
 
@@ -5592,22 +5790,22 @@ __export(connected_teams_exports, {
   listConnectedBrightsyTeams: () => listConnectedBrightsyTeams
 });
 function storePath() {
-  return (0, import_node_path15.join)(appDataDir(), "brightsy-teams.json");
+  return (0, import_node_path17.join)(appDataDir(), "brightsy-teams.json");
 }
 function readStore() {
   const path2 = storePath();
-  if (!(0, import_node_fs15.existsSync)(path2)) return [];
+  if (!(0, import_node_fs16.existsSync)(path2)) return [];
   try {
-    const parsed = JSON.parse((0, import_node_fs15.readFileSync)(path2, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs16.readFileSync)(path2, "utf8"));
     return Array.isArray(parsed.teams) ? parsed.teams : [];
   } catch {
     return [];
   }
 }
 function writeStore(teams) {
-  (0, import_node_fs15.mkdirSync)(appDataDir(), { recursive: true });
+  (0, import_node_fs16.mkdirSync)(appDataDir(), { recursive: true });
   const path2 = storePath();
-  (0, import_node_fs15.writeFileSync)(path2, `${JSON.stringify({ teams }, null, 2)}
+  (0, import_node_fs16.writeFileSync)(path2, `${JSON.stringify({ teams }, null, 2)}
 `, {
     mode: 384
   });
@@ -5769,12 +5967,12 @@ function brightsyMcpServerName(slug) {
   const cleaned = slug.replace(/[^A-Za-z0-9_-]/g, "_").replace(/^_+|_+$/g, "");
   return `brightsy_${cleaned || "team"}`;
 }
-var import_node_fs15, import_node_path15;
+var import_node_fs16, import_node_path17;
 var init_connected_teams = __esm({
   "src/brightsy/connected-teams.ts"() {
     "use strict";
-    import_node_fs15 = require("fs");
-    import_node_path15 = require("path");
+    import_node_fs16 = require("fs");
+    import_node_path17 = require("path");
     init_paths();
     init_accounts();
     init_config();
@@ -5911,17 +6109,27 @@ function extractJsonErrorMessage(obj) {
   }
   return null;
 }
+function isPinnedStderrLine(line) {
+  if (/^\s*at\s/.test(line)) return false;
+  return /cannot find (?:package|module)|ERR_MODULE_NOT_FOUND|cursor startup failed:/i.test(
+    line
+  );
+}
 function pushTurnStderr(tail, line, maxLines = 12) {
   const trimmed = line.trim();
   if (!trimmed) return;
   if (NODE_VERSION_FOOTER.test(trimmed)) return;
   if (/^reconnecting\.\.\./i.test(trimmed)) return;
   tail.push(trimmed);
-  while (tail.length > maxLines) tail.shift();
+  while (tail.length > maxLines) {
+    const dropIdx = tail.findIndex((l) => !isPinnedStderrLine(l));
+    if (dropIdx === -1) tail.shift();
+    else tail.splice(dropIdx, 1);
+  }
 }
 function looksLikeMinifiedJsDump(line) {
   if (line.length < 200) return false;
-  return /yield Promise\.all/.test(line) || /\(0,[A-Za-z$]\.\w+\)/.test(line) || /CURSOR_RIPGREP_PATH/.test(line);
+  return /yield Promise\.all/.test(line) || /\(0,[A-Za-z$]\.\w+\)/.test(line) || /CURSOR_RIPGREP_PATH/.test(line) || /findFilesWithRipgrep/.test(line) || /@cursor\/sdk\/dist\//.test(line);
 }
 function looksLikeNestedElectronCrash(line) {
   return /HasCustomHostObject|ElectronInitializeICUandStartNode/i.test(line);
@@ -5936,7 +6144,15 @@ function summarizeTurnStderr(tail, maxChars = 500) {
   const cursorStartup = [...tail].reverse().find((line) => /cursor startup failed:/i.test(line));
   if (cursorStartup) return clipStderr(cursorStartup, maxChars);
   if (tail.some(looksLikeNestedElectronCrash)) return NESTED_ELECTRON_SUMMARY;
-  const moduleMissing = [...tail].reverse().find((line) => /cannot find module/i.test(line));
+  if (tail.some(
+    (line) => /\[resource_exhausted\]|resource_exhausted/i.test(line) || /findFilesWithRipgrep/.test(line)
+  )) {
+    return clipStderr(
+      "Cursor local file search failed (ripgrep / resource_exhausted). Wait a minute and retry; if it keeps happening, check Cursor usage.",
+      maxChars
+    );
+  }
+  const moduleMissing = [...tail].reverse().find((line) => /cannot find (?:package|module)/i.test(line));
   if (moduleMissing) return clipStderr(moduleMissing, maxChars);
   const useful = tail.filter((line) => !looksLikeMinifiedJsDump(line));
   if (useful.length === 0 && tail.some(looksLikeMinifiedJsDump)) {
@@ -5955,7 +6171,7 @@ function looksLikeAgentFailureMessage(text3) {
   if (!lower) return false;
   return /you've hit your|hit your (session|weekly|opus) limit|usage limit/.test(lower) || /credit balance is too low|out of credits|insufficient.?quota|quota.?exceeded/.test(lower) || /invalid user api key|invalid api key|not logged in|not authenticated|unauthorized/.test(
     lower
-  ) || /\b429\b|too many requests|rate.?limit/.test(lower) || /prompt is too long|context.*(too long|exceed)|conversation too long/.test(lower);
+  ) || /\b429\b|too many requests|rate.?limit/.test(lower) || /prompt is too long|context.*(too long|exceed)|conversation too long/.test(lower) || /\[resource_exhausted\]|resource_exhausted/.test(lower) || /findFilesWithRipgrep/.test(text3);
 }
 function fallbackTurnFailDetail(assistantText) {
   const t = assistantText.trim();
@@ -5977,6 +6193,9 @@ function humanizeAgentFailDetail(detail) {
   if (/\b429\b|rate.?limit|too many requests/.test(lower)) {
     return `${raw} \u2014 wait a moment and retry.`;
   }
+  if (/\[resource_exhausted\]|resource_exhausted|findfileswithripgrep/.test(lower)) {
+    return "Cursor local file search failed (ripgrep / resource_exhausted). Wait a minute and retry; if it keeps happening, check Cursor usage.";
+  }
   if (/invalid user api key|invalid api key|not logged in|not authenticated|unauthorized|authentication|please run.*login|codex login|claude auth|cursor api/.test(
     lower
   )) {
@@ -6303,11 +6522,11 @@ async function syncCliForTarget(accountId) {
   }
   applyConnectedTeamToCli(team);
 }
-var import_node_fs16, brightsyAdapter;
+var import_node_fs17, brightsyAdapter;
 var init_brightsy = __esm({
   "src/agents/brightsy.ts"() {
     "use strict";
-    import_node_fs16 = require("fs");
+    import_node_fs17 = require("fs");
     init_run();
     init_connected_teams();
     init_config();
@@ -6322,7 +6541,7 @@ var init_brightsy = __esm({
       async detect() {
         const brightsy = resolveAgentExecutable("brightsy");
         if (brightsy !== "brightsy") {
-          if (!(0, import_node_fs16.existsSync)(brightsy)) {
+          if (!(0, import_node_fs17.existsSync)(brightsy)) {
             return {
               agent: "brightsy",
               installed: false,
@@ -6457,13 +6676,38 @@ var init_profile = __esm({
 
 // src/agents/node-launch.ts
 function isAsarPath(filePath) {
+  if (/\.asar\.unpacked([/\\]|$)/.test(filePath)) return false;
   return /\.asar([/\\]|$)/.test(filePath);
 }
+function unpackedAsarPath(filePath) {
+  if (!isAsarPath(filePath)) return null;
+  const unpacked = filePath.replace(/\.asar(?=[/\\])/, ".asar.unpacked");
+  if (unpacked === filePath) return null;
+  return (0, import_node_fs18.existsSync)(unpacked) ? unpacked : null;
+}
+function nodeReadableScriptPath(scriptPath) {
+  return unpackedAsarPath(scriptPath) ?? scriptPath;
+}
+async function findSystemNode() {
+  const whichNode = await run("which", ["node"], { reject: false });
+  const fromWhich = whichNode.exitCode === 0 && whichNode.stdout.trim() ? whichNode.stdout.trim() : "";
+  if (fromWhich && !isElectronLikeCommand(fromWhich)) return fromWhich;
+  const fallbacks = [
+    ...WELL_KNOWN_NODE_BINS,
+    (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".local/share/fnm/aliases/default/bin/node"),
+    (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".nvm/current/bin/node")
+  ];
+  for (const bin of fallbacks) {
+    if ((0, import_node_fs18.existsSync)(bin) && !isElectronLikeCommand(bin)) return bin;
+  }
+  return null;
+}
 function applyNodeLaunch(launch, args) {
+  const readableArgs = args.map(nodeReadableScriptPath);
   if (!launch.env.ELECTRON_RUN_AS_NODE) {
-    return { file: launch.file, args, env: launch.env };
+    return { file: launch.file, args: readableArgs, env: launch.env };
   }
-  const wrapped = wrapElectronAsNodeLaunch(launch.file, args);
+  const wrapped = wrapElectronAsNodeLaunch(launch.file, readableArgs);
   if (process.platform === "win32") {
     return { file: wrapped.file, args: wrapped.args, env: launch.env };
   }
@@ -6472,27 +6716,73 @@ function applyNodeLaunch(launch, args) {
   return { file: wrapped.file, args: wrapped.args, env };
 }
 async function resolveNodeLaunch(scriptPath) {
-  if (isAsarPath(scriptPath)) {
-    return {
-      file: process.execPath,
-      env: { ELECTRON_RUN_AS_NODE: "1" }
-    };
-  }
-  const whichNode = await run("which", ["node"], { reject: false });
-  const nodeBin = whichNode.exitCode === 0 && whichNode.stdout.trim() ? whichNode.stdout.trim() : null;
-  if (nodeBin) {
-    return { file: nodeBin, env: {} };
+  const script = nodeReadableScriptPath(scriptPath);
+  if (!isAsarPath(script)) {
+    const nodeBin = await findSystemNode();
+    if (nodeBin) {
+      return { file: nodeBin, env: {} };
+    }
   }
   return {
     file: process.execPath,
     env: { ELECTRON_RUN_AS_NODE: "1" }
   };
 }
+var import_node_fs18, import_node_os7, import_node_path18, WELL_KNOWN_NODE_BINS;
 var init_node_launch = __esm({
   "src/agents/node-launch.ts"() {
     "use strict";
+    import_node_fs18 = require("fs");
+    import_node_os7 = require("os");
+    import_node_path18 = require("path");
     init_nested_electron_env();
     init_run();
+    WELL_KNOWN_NODE_BINS = [
+      "/opt/homebrew/bin/node",
+      "/usr/local/bin/node"
+    ];
+  }
+});
+
+// src/agents/packaged-runtime.ts
+function electronResourcesPath() {
+  const resources = process.resourcesPath;
+  if (typeof resources !== "string" || !resources) return null;
+  return resources;
+}
+function packagedCursorRuntimeDir() {
+  const resources = electronResourcesPath();
+  if (!resources) return null;
+  const dir = (0, import_node_path19.join)(resources, "cursor-runtime");
+  if (!(0, import_node_fs19.existsSync)((0, import_node_path19.join)(dir, "core-dist", "agents", "cursor-runner.js"))) return null;
+  return dir;
+}
+function packagedCursorRunnerPath() {
+  const dir = packagedCursorRuntimeDir();
+  return dir ? (0, import_node_path19.join)(dir, "core-dist", "agents", "cursor-runner.js") : null;
+}
+function packagedMcpDir() {
+  const resources = electronResourcesPath();
+  if (!resources) return null;
+  const dir = (0, import_node_path19.join)(resources, "sideboard-mcp");
+  if (!(0, import_node_fs19.existsSync)((0, import_node_path19.join)(dir, "core-dist", "mcp", "run-stdio.js"))) return null;
+  return dir;
+}
+function packagedMcpStdioPath() {
+  const dir = packagedMcpDir();
+  return dir ? (0, import_node_path19.join)(dir, "core-dist", "mcp", "run-stdio.js") : null;
+}
+function packagedCursorRipgrepCandidate(platformPkg, binName) {
+  const dir = packagedCursorRuntimeDir();
+  if (!dir) return null;
+  return (0, import_node_path19.join)(dir, "node_modules", platformPkg, "bin", binName);
+}
+var import_node_fs19, import_node_path19;
+var init_packaged_runtime = __esm({
+  "src/agents/packaged-runtime.ts"() {
+    "use strict";
+    import_node_fs19 = require("fs");
+    import_node_path19 = require("path");
   }
 });
 
@@ -6579,35 +6869,37 @@ function corePackageDir() {
   try {
     const url = import_meta.url;
     if (typeof url === "string" && url.length > 0) {
-      return (0, import_node_path16.dirname)((0, import_node_url.fileURLToPath)(url));
+      return (0, import_node_path20.dirname)((0, import_node_url.fileURLToPath)(url));
     }
   } catch {
   }
   try {
-    const req = (0, import_node_module.createRequire)((0, import_node_path16.join)(process.cwd(), "package.json"));
-    return (0, import_node_path16.dirname)(req.resolve("@sideboard-ai/core"));
+    const req = (0, import_node_module.createRequire)((0, import_node_path20.join)(process.cwd(), "package.json"));
+    return (0, import_node_path20.dirname)(req.resolve("@sideboard-ai/core"));
   } catch {
     return process.cwd();
   }
 }
 function findSideboardMcpJsEntry() {
   const override = process.env.SIDEBOARD_MCP_ENTRY?.trim() || process.env.SIDEBOARD_CLI?.trim();
-  if (override && (0, import_node_fs17.existsSync)(override)) return override;
+  if (override && (0, import_node_fs20.existsSync)(override)) return override;
+  const packaged = packagedMcpStdioPath();
+  if (packaged) return packaged;
   let dir = corePackageDir();
   for (let i = 0; i < 10; i++) {
     const candidates = [
-      (0, import_node_path16.join)(dir, "mcp/run-stdio.js"),
-      (0, import_node_path16.join)(dir, "mcp/run-stdio.cjs"),
-      (0, import_node_path16.join)(dir, "dist/mcp/run-stdio.js"),
-      (0, import_node_path16.join)(dir, "dist/mcp/run-stdio.cjs"),
-      (0, import_node_path16.join)(dir, "packages/core/dist/mcp/run-stdio.js"),
-      (0, import_node_path16.join)(dir, "packages/cli/dist/index.js"),
-      (0, import_node_path16.join)(dir, "cli/dist/index.js")
+      (0, import_node_path20.join)(dir, "mcp/run-stdio.js"),
+      (0, import_node_path20.join)(dir, "mcp/run-stdio.cjs"),
+      (0, import_node_path20.join)(dir, "dist/mcp/run-stdio.js"),
+      (0, import_node_path20.join)(dir, "dist/mcp/run-stdio.cjs"),
+      (0, import_node_path20.join)(dir, "packages/core/dist/mcp/run-stdio.js"),
+      (0, import_node_path20.join)(dir, "packages/cli/dist/index.js"),
+      (0, import_node_path20.join)(dir, "cli/dist/index.js")
     ];
     for (const p of candidates) {
-      if ((0, import_node_fs17.existsSync)(p)) return p;
+      if ((0, import_node_fs20.existsSync)(p) && !isAsarPath(p)) return p;
     }
-    const parent = (0, import_node_path16.dirname)(dir);
+    const parent = (0, import_node_path20.dirname)(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -6619,12 +6911,14 @@ async function resolveSideboardMcpServer() {
     const isCli = /[/\\]cli[/\\]dist[/\\]index\.js$/.test(entry);
     const scriptArgs = isCli ? [entry, "mcp"] : [entry];
     const launch = applyNodeLaunch(await resolveNodeLaunch(entry), scriptArgs);
-    return {
-      name: "sideboard",
-      command: launch.file,
-      args: launch.args,
-      ...Object.keys(launch.env).length > 0 ? { env: launch.env } : {}
-    };
+    if (launch.file !== "/bin/sh" && !isElectronLikeCommand(launch.file)) {
+      return {
+        name: "sideboard",
+        command: launch.file,
+        args: launch.args,
+        ...Object.keys(launch.env).length > 0 ? { env: launch.env } : {}
+      };
+    }
   }
   const which = await run("which", ["sideboard"], { reject: false });
   if (which.exitCode === 0 && which.stdout.trim()) {
@@ -6647,7 +6941,10 @@ async function buildInjectedMcpServers(opts) {
       sideboard.env.SIDEBOARD_ORCHESTRATOR_THREAD_ID = orchId;
     }
     try {
-      Object.assign(sideboard.env, await resolveAgentGitAuthEnv(sideboard.env));
+      mergeAgentGitAuthEnv(
+        sideboard.env,
+        await resolveAgentGitAuthEnv(sideboard.env)
+      );
     } catch {
     }
     servers.push(sideboard);
@@ -6669,9 +6966,6 @@ async function buildInjectedMcpServers(opts) {
   }
   return servers;
 }
-function shSingleQuote(value) {
-  return `'${value.replace(/'/g, `'\\''`)}'`;
-}
 function cursorSafeMcpLaunch(command, args) {
   if (process.platform === "win32") {
     return args && args.length > 0 ? { command, args } : { command };
@@ -6679,31 +6973,13 @@ function cursorSafeMcpLaunch(command, args) {
   const unwrapped = unwrapStrippedElectronLaunch(command, args);
   const file = unwrapped?.file ?? command;
   const fileArgs = unwrapped?.args ?? args ?? [];
-  if (!isElectronLikeCommand(file)) {
-    return fileArgs.length > 0 ? { command: file, args: fileArgs } : { command: file };
-  }
-  const dir = (0, import_node_path16.join)(appDataDir(), "mcp-launch");
-  (0, import_node_fs17.mkdirSync)(dir, { recursive: true });
-  const wrap = (0, import_node_path16.join)(dir, "cursor-electron-as-node.sh");
-  const execLine = [file, ...fileArgs].map(shSingleQuote).join(" ");
-  (0, import_node_fs17.writeFileSync)(
-    wrap,
-    [
-      "#!/bin/sh",
-      "vars=`printenv | awk -F= '/^(ELECTRON_|CHROME_)/{print $1}'`",
-      '[ -n "$vars" ] && unset $vars',
-      "export ELECTRON_RUN_AS_NODE=1",
-      `exec ${execLine} "$@"`,
-      ""
-    ].join("\n"),
-    { mode: 493 }
-  );
-  return { command: wrap };
+  return fileArgs.length > 0 ? { command: file, args: fileArgs } : { command: file };
 }
 function mcpSpawnEnv(env) {
   if (!env) return void 0;
   const out = { ...env };
   delete out.ELECTRON_RUN_AS_NODE;
+  delete out.ELECTRON_RUN_AS_NODE;
   return Object.keys(out).length > 0 ? out : void 0;
 }
 function toCursorMcpServers(servers) {
@@ -6763,22 +7039,22 @@ function writeMcpServersConfig(servers) {
       ...env ? { env } : {}
     };
   }
-  const dir = (0, import_node_fs17.mkdtempSync)((0, import_node_path16.join)((0, import_node_os6.tmpdir)(), "sideboard-mcp-"));
-  const cfgPath = (0, import_node_path16.join)(dir, "mcp.json");
-  (0, import_node_fs17.writeFileSync)(cfgPath, JSON.stringify({ mcpServers }, null, 2));
+  const dir = (0, import_node_fs20.mkdtempSync)((0, import_node_path20.join)((0, import_node_os8.tmpdir)(), "sideboard-mcp-"));
+  const cfgPath = (0, import_node_path20.join)(dir, "mcp.json");
+  (0, import_node_fs20.writeFileSync)(cfgPath, JSON.stringify({ mcpServers }, null, 2));
   return cfgPath;
 }
 async function writeInjectedMcpConfig(opts) {
   return writeMcpServersConfig(await buildInjectedMcpServers(opts));
 }
-var import_node_fs17, import_node_module, import_node_os6, import_node_path16, import_node_url, import_meta, SIDEBOARD_MCP_ALLOWED_TOOLS, SIDEBOARD_ARTIFACT_MCP_ALLOWED_TOOLS, BRIGHTSY_MCP_ALLOWED_TOOLS, brightsyMcpCommandCache, BRIGHTSY_WORD;
+var import_node_fs20, import_node_module, import_node_os8, import_node_path20, import_node_url, import_meta, SIDEBOARD_MCP_ALLOWED_TOOLS, SIDEBOARD_ARTIFACT_MCP_ALLOWED_TOOLS, BRIGHTSY_MCP_ALLOWED_TOOLS, brightsyMcpCommandCache, BRIGHTSY_WORD;
 var init_injected_mcp = __esm({
   "src/agents/injected-mcp.ts"() {
     "use strict";
-    import_node_fs17 = require("fs");
+    import_node_fs20 = require("fs");
     import_node_module = require("module");
-    import_node_os6 = require("os");
-    import_node_path16 = require("path");
+    import_node_os8 = require("os");
+    import_node_path20 = require("path");
     import_node_url = require("url");
     init_run();
     init_config();
@@ -6787,6 +7063,7 @@ var init_injected_mcp = __esm({
     init_app_settings();
     init_paths();
     init_node_launch();
+    init_packaged_runtime();
     init_nested_electron_env();
     init_git_auth_mode();
     import_meta = {};
@@ -6860,7 +7137,7 @@ var PLAN_MODE_INSTRUCTION;
 var init_types = __esm({
   "src/agents/types.ts"() {
     "use strict";
-    PLAN_MODE_INSTRUCTION = "Plan mode is active and must remain active until the user turns Plan mode off in the UI (or Approves / Hands off the plan). Analyze the codebase, search and read files as needed, and produce or refine a clear implementation plan. Do not modify, create, or delete any project files except via Sideboard MCP present_plan (writes .context/attachments/plan.md). When you need a clarifying decision (approach forks, auth choice, scope): (1) first write a short chat message that explains the decision and what each option means (tradeoffs, when to pick it) \u2014 do not leave the user staring at bare labels; (2) then call Sideboard MCP ask_user with the same options, including a description on every option. Sideboard shows questions in the composer and mirrors them in chat. After ask_user, wait for the user's next message with their answers before finalizing the plan. When the plan is ready for approval: (1) call present_plan with the full markdown plan (title + content) so Sideboard saves .context/attachments/plan.md and shows it in chat for Approve / Hand off / Copy; (2) Claude should also call ExitPlanMode after present_plan. Do not skip present_plan \u2014 the plan must be a markdown file, not only chat prose.";
+    PLAN_MODE_INSTRUCTION = "Plan mode is active and must remain active until the user turns Plan mode off in the UI (or Approves / Hands off the plan). Analyze the codebase, search and read files as needed, and produce or refine a clear implementation plan. Do not modify, create, or delete any project files except via Sideboard MCP present_plan (writes .context/attachments/plan.md). When you need a clarifying decision (approach forks, auth choice, scope) \u2014 not greetings, check-ins, or an invented task menu: (1) first write a short chat message that explains the decision and what each option means (tradeoffs, when to pick it) \u2014 do not leave the user staring at bare labels; (2) then call Sideboard MCP ask_user with the same options, including a description on every option. If one option is the obvious default, proceed without asking. Sideboard shows questions in the composer and mirrors them in chat. After ask_user, wait for the user's next message with their answers before finalizing the plan. When the plan is ready for approval: (1) call present_plan with the full markdown plan (title + content) so Sideboard saves .context/attachments/plan.md and shows it in chat for Approve / Hand off / Copy; (2) Claude should also call ExitPlanMode after present_plan. Do not skip present_plan \u2014 the plan must be a markdown file, not only chat prose.";
   }
 });
 
@@ -6970,11 +7247,11 @@ function parseIssuesJson(raw) {
   }
   return [];
 }
-var import_node_fs18, BASE_ALLOWED_TOOLS, CLAUDE_CHROME_ALLOWED_TOOLS, CLAUDE_PROMPT_ARG_MAX, claudeAdapter;
+var import_node_fs21, BASE_ALLOWED_TOOLS, CLAUDE_CHROME_ALLOWED_TOOLS, CLAUDE_PROMPT_ARG_MAX, claudeAdapter;
 var init_claude = __esm({
   "src/agents/claude.ts"() {
     "use strict";
-    import_node_fs18 = require("fs");
+    import_node_fs21 = require("fs");
     init_run();
     init_app_settings();
     init_claude_mcp();
@@ -7003,7 +7280,7 @@ var init_claude = __esm({
       async detect() {
         const claude = resolveClaudeExecutable();
         if (claude !== "claude") {
-          if (!(0, import_node_fs18.existsSync)(claude)) {
+          if (!(0, import_node_fs21.existsSync)(claude)) {
             return {
               agent: "claude",
               installed: false,
@@ -7240,7 +7517,7 @@ async function listCodexModels() {
   if (codex === "codex") {
     const which = await run("which", ["codex"], { reject: false });
     if (which.exitCode !== 0) return FALLBACK_CODEX_MODELS;
-  } else if (!(0, import_node_fs19.existsSync)(codex)) {
+  } else if (!(0, import_node_fs22.existsSync)(codex)) {
     return FALLBACK_CODEX_MODELS;
   }
   const listed = await run(codex, ["debug", "models"], { reject: false });
@@ -7275,12 +7552,12 @@ function usageFromCodex(usage) {
 }
 function codexConfigHasNetworkAccess() {
   const candidates = [
-    (0, import_node_path17.join)((0, import_node_os7.homedir)(), ".codex", "config.toml"),
-    (0, import_node_path17.join)((0, import_node_os7.homedir)(), ".config", "codex", "config.toml")
+    (0, import_node_path21.join)((0, import_node_os9.homedir)(), ".codex", "config.toml"),
+    (0, import_node_path21.join)((0, import_node_os9.homedir)(), ".config", "codex", "config.toml")
   ];
   for (const path2 of candidates) {
-    if (!(0, import_node_fs19.existsSync)(path2)) continue;
-    const text3 = (0, import_node_fs19.readFileSync)(path2, "utf8");
+    if (!(0, import_node_fs22.existsSync)(path2)) continue;
+    const text3 = (0, import_node_fs22.readFileSync)(path2, "utf8");
     if (/network_access\s*=\s*true/.test(text3)) return true;
   }
   return false;
@@ -7312,21 +7589,21 @@ function asRecord(value) {
   return void 0;
 }
 function codexLooksAuthenticated() {
-  const authPath = (0, import_node_path17.join)((0, import_node_os7.homedir)(), ".codex", "auth.json");
-  if (!(0, import_node_fs19.existsSync)(authPath)) return false;
+  const authPath = (0, import_node_path21.join)((0, import_node_os9.homedir)(), ".codex", "auth.json");
+  if (!(0, import_node_fs22.existsSync)(authPath)) return false;
   try {
-    return (0, import_node_fs19.statSync)(authPath).size > 2;
+    return (0, import_node_fs22.statSync)(authPath).size > 2;
   } catch {
     return false;
   }
 }
-var import_node_fs19, import_node_os7, import_node_path17, CODEX_PROMPT_ARG_MAX, FALLBACK_CODEX_MODELS, cachedCodexModels, CODEX_MODEL_CACHE_MS, codexAdapter;
+var import_node_fs22, import_node_os9, import_node_path21, CODEX_PROMPT_ARG_MAX, FALLBACK_CODEX_MODELS, cachedCodexModels, CODEX_MODEL_CACHE_MS, codexAdapter;
 var init_codex = __esm({
   "src/agents/codex.ts"() {
     "use strict";
-    import_node_fs19 = require("fs");
-    import_node_os7 = require("os");
-    import_node_path17 = require("path");
+    import_node_fs22 = require("fs");
+    import_node_os9 = require("os");
+    import_node_path21 = require("path");
     init_run();
     init_app_settings();
     init_global_workspace();
@@ -7351,7 +7628,7 @@ var init_codex = __esm({
       async detect() {
         const codex = resolveAgentExecutable("codex");
         if (codex !== "codex") {
-          if (!(0, import_node_fs19.existsSync)(codex)) {
+          if (!(0, import_node_fs22.existsSync)(codex)) {
             return {
               agent: "codex",
               installed: false,
@@ -7424,8 +7701,13 @@ var init_codex = __esm({
           // `codex exec` rejects `--ask-for-approval` (global-only on newer CLIs).
           "-c",
           'approval_policy="never"',
-          // Seatbelt cannot use the login Keychain; default policy also strips GH_TOKEN.
-          ...codexUnattendedGitConfigArgs(mode.codexSandbox),
+          // Seatbelt cannot use the login Keychain; inherit GH_CONFIG_DIR / GIT_CONFIG_*.
+          // Default policy also strips *TOKEN*. Linked worktrees need the main
+          // repo `.git` (+ `.git/worktrees/<name>`) as writable_roots so git commit
+          // can create index.lock.
+          ...codexUnattendedGitConfigArgs(mode.codexSandbox, {
+            writableRoots: mode.codexSandbox === "workspace-write" ? await resolveCodexGitWritableRoots(thread.worktreePath) : []
+          }),
           ...model ? ["--model", model] : [],
           ...mcpOverrides
         ];
@@ -7746,6 +8028,74 @@ var init_cursor_events = __esm({
   }
 });
 
+// src/agents/cursor-ripgrep.ts
+function rgBinaryName() {
+  return process.platform === "win32" ? "rg.exe" : "rg";
+}
+function platformRipgrepPackage() {
+  return `@cursor/sdk-${process.platform}-${process.arch}`;
+}
+function usableRipgrepPath(candidate) {
+  const raw = candidate?.trim();
+  if (!raw || !(0, import_node_path22.isAbsolute)(raw)) return null;
+  const readable = nodeReadableScriptPath(raw);
+  if (!(0, import_node_fs23.existsSync)(readable) || isAsarPath(readable)) return null;
+  return readable;
+}
+function walkForBundledRipgrep(startFile) {
+  if (!startFile) return null;
+  const pkg = platformRipgrepPackage();
+  const name = rgBinaryName();
+  let dir = (0, import_node_path22.dirname)((0, import_node_path22.resolve)(startFile));
+  const root = (0, import_node_path22.parse)(dir).root;
+  while (dir !== root) {
+    const hit = usableRipgrepPath((0, import_node_path22.join)(dir, "node_modules", pkg, "bin", name));
+    if (hit) return hit;
+    const next = (0, import_node_path22.dirname)(dir);
+    if (next === dir) break;
+    dir = next;
+  }
+  return null;
+}
+function requireResolveBundledRipgrep(fromFile) {
+  try {
+    const req = (0, import_node_module2.createRequire)(fromFile);
+    const pkgJson = req.resolve(`${platformRipgrepPackage()}/package.json`);
+    return usableRipgrepPath((0, import_node_path22.join)((0, import_node_path22.dirname)(pkgJson), "bin", rgBinaryName()));
+  } catch {
+    return null;
+  }
+}
+function resolveCursorRipgrepPath(opts) {
+  const env = opts?.env ?? process.env;
+  const fromEnv = usableRipgrepPath(env[RIPGREP_ENV]);
+  if (fromEnv) return fromEnv;
+  const fromPackaged = usableRipgrepPath(
+    packagedCursorRipgrepCandidate(platformRipgrepPackage(), rgBinaryName())
+  );
+  if (fromPackaged) return fromPackaged;
+  const start = opts?.startFile?.trim() || process.argv[1] || (0, import_node_url2.fileURLToPath)(import_meta2.url);
+  return walkForBundledRipgrep(start) ?? requireResolveBundledRipgrep(start);
+}
+function cursorRipgrepEnv(opts) {
+  const path2 = resolveCursorRipgrepPath(opts);
+  return path2 ? { [RIPGREP_ENV]: path2 } : {};
+}
+var import_node_fs23, import_node_module2, import_node_path22, import_node_url2, import_meta2, RIPGREP_ENV;
+var init_cursor_ripgrep = __esm({
+  "src/agents/cursor-ripgrep.ts"() {
+    "use strict";
+    import_node_fs23 = require("fs");
+    import_node_module2 = require("module");
+    import_node_path22 = require("path");
+    import_node_url2 = require("url");
+    init_node_launch();
+    init_packaged_runtime();
+    import_meta2 = {};
+    RIPGREP_ENV = "CURSOR_RIPGREP_PATH";
+  }
+});
+
 // src/agents/cursor.ts
 function resolveCursorApiKey() {
   const fromEnv = (process.env.CURSOR_API_KEY || "").trim();
@@ -7785,51 +8135,55 @@ function entryDir() {
   const cjsDir = typeof __dirname !== "undefined" ? __dirname : "";
   if (cjsDir) return cjsDir;
   try {
-    return (0, import_node_path18.dirname)((0, import_node_url2.fileURLToPath)(import_meta2.url));
+    return (0, import_node_path23.dirname)((0, import_node_url3.fileURLToPath)(import_meta3.url));
   } catch {
     try {
-      const req = (0, import_node_module2.createRequire)(process.cwd() + "/");
-      return (0, import_node_path18.dirname)(req.resolve("@sideboard-ai/core"));
+      const req = (0, import_node_module3.createRequire)(process.cwd() + "/");
+      return (0, import_node_path23.dirname)(req.resolve("@sideboard-ai/core"));
     } catch {
       return process.cwd();
     }
   }
 }
 function cursorRunnerPath() {
+  const packaged = packagedCursorRunnerPath();
+  if (packaged) return packaged;
   const root = entryDir();
   const candidates = [
-    (0, import_node_path18.join)(root, "agents", "cursor-runner.js"),
-    (0, import_node_path18.join)(root, "agents", "cursor-runner.cjs"),
+    (0, import_node_path23.join)(root, "agents", "cursor-runner.js"),
+    (0, import_node_path23.join)(root, "agents", "cursor-runner.cjs"),
     // If somehow resolved from package root instead of dist/
-    (0, import_node_path18.join)(root, "dist", "agents", "cursor-runner.js"),
-    (0, import_node_path18.join)(root, "dist", "agents", "cursor-runner.cjs"),
+    (0, import_node_path23.join)(root, "dist", "agents", "cursor-runner.js"),
+    (0, import_node_path23.join)(root, "dist", "agents", "cursor-runner.cjs"),
     // Source tree (dev): packages/core/src/agents/cursor-runner.ts
-    (0, import_node_path18.join)(root, "cursor-runner.ts"),
-    (0, import_node_path18.join)(root, "src", "agents", "cursor-runner.ts")
+    (0, import_node_path23.join)(root, "cursor-runner.ts"),
+    (0, import_node_path23.join)(root, "src", "agents", "cursor-runner.ts")
   ];
   for (const candidate of candidates) {
-    if ((0, import_node_fs20.existsSync)(candidate)) return candidate;
+    if ((0, import_node_fs24.existsSync)(candidate)) return candidate;
   }
   return candidates[0];
 }
-var import_node_fs20, import_node_module2, import_node_path18, import_node_url2, import_sdk, import_meta2, FALLBACK_CURSOR_MODELS, cachedModels, MODEL_CACHE_MS, cursorAdapter;
+var import_node_fs24, import_node_module3, import_node_path23, import_node_url3, import_sdk, import_meta3, FALLBACK_CURSOR_MODELS, cachedModels, MODEL_CACHE_MS, cursorAdapter;
 var init_cursor = __esm({
   "src/agents/cursor.ts"() {
     "use strict";
-    import_node_fs20 = require("fs");
-    import_node_module2 = require("module");
-    import_node_path18 = require("path");
-    import_node_url2 = require("url");
+    import_node_fs24 = require("fs");
+    import_node_module3 = require("module");
+    import_node_path23 = require("path");
+    import_node_url3 = require("url");
     import_sdk = require("@cursor/sdk");
     init_run();
     init_app_settings();
     init_global_workspace();
     init_cursor_events();
     init_injected_mcp();
+    init_cursor_ripgrep();
     init_node_launch();
+    init_packaged_runtime();
     init_turn_input();
     init_cursor_events();
-    import_meta2 = {};
+    import_meta3 = {};
     FALLBACK_CURSOR_MODELS = [
       { id: "default", displayName: "Auto" },
       { id: "composer-2.5", displayName: "Composer 2.5" },
@@ -7896,6 +8250,7 @@ var init_cursor = __esm({
           stdin: JSON.stringify(req),
           env: {
             ...launch.env,
+            ...cursorRipgrepEnv({ startFile: runner }),
             ...apiKey ? { CURSOR_API_KEY: apiKey } : {}
           }
         };
@@ -7947,7 +8302,7 @@ async function listOpencodeModels() {
   if (opencode === "opencode") {
     const which = await run("which", ["opencode"], { reject: false });
     if (which.exitCode !== 0) return FALLBACK_OPENCODE_MODELS;
-  } else if (!(0, import_node_fs21.existsSync)(opencode)) {
+  } else if (!(0, import_node_fs25.existsSync)(opencode)) {
     return FALLBACK_OPENCODE_MODELS;
   }
   const listed = await run(opencode, ["models"], { reject: false });
@@ -7977,11 +8332,11 @@ function usageFromOpencode(tokens) {
     cacheWriteTokens: tokens.cache?.write ? Number(tokens.cache.write) : void 0
   };
 }
-var import_node_fs21, FALLBACK_OPENCODE_MODELS, cachedOpencodeModels, OPENCODE_MODEL_CACHE_MS, opencodeAdapter;
+var import_node_fs25, FALLBACK_OPENCODE_MODELS, cachedOpencodeModels, OPENCODE_MODEL_CACHE_MS, opencodeAdapter;
 var init_opencode = __esm({
   "src/agents/opencode.ts"() {
     "use strict";
-    import_node_fs21 = require("fs");
+    import_node_fs25 = require("fs");
     init_run();
     init_app_settings();
     init_global_workspace();
@@ -8007,7 +8362,7 @@ var init_opencode = __esm({
       async detect() {
         const opencode = resolveAgentExecutable("opencode");
         if (opencode !== "opencode") {
-          if (!(0, import_node_fs21.existsSync)(opencode)) {
+          if (!(0, import_node_fs25.existsSync)(opencode)) {
             return {
               agent: "opencode",
               installed: false,
@@ -8804,40 +9159,40 @@ __export(plan_file_exports, {
   writePlanFile: () => writePlanFile
 });
 function ensureAttachmentsGitignore2(worktreePath) {
-  const gitignoreAbs = (0, import_node_path31.join)(worktreePath, ATTACHMENTS_DIR, ".gitignore");
-  if ((0, import_node_fs35.existsSync)(gitignoreAbs)) return;
-  (0, import_node_fs35.mkdirSync)((0, import_node_path31.dirname)(gitignoreAbs), { recursive: true });
-  (0, import_node_fs35.writeFileSync)(gitignoreAbs, attachmentsGitignoreBody(), "utf8");
+  const gitignoreAbs = (0, import_node_path36.join)(worktreePath, ATTACHMENTS_DIR, ".gitignore");
+  if ((0, import_node_fs39.existsSync)(gitignoreAbs)) return;
+  (0, import_node_fs39.mkdirSync)((0, import_node_path36.dirname)(gitignoreAbs), { recursive: true });
+  (0, import_node_fs39.writeFileSync)(gitignoreAbs, attachmentsGitignoreBody(), "utf8");
 }
 function planFileAbs(worktreePath) {
-  return (0, import_node_path31.join)(worktreePath, PLAN_FILE_REL);
+  return (0, import_node_path36.join)(worktreePath, PLAN_FILE_REL);
 }
 function readTextIfPresent2(abs) {
-  if (!(0, import_node_fs35.existsSync)(abs)) return null;
+  if (!(0, import_node_fs39.existsSync)(abs)) return null;
   try {
-    const content = (0, import_node_fs35.readFileSync)(abs, "utf8");
+    const content = (0, import_node_fs39.readFileSync)(abs, "utf8");
     return content.trim() ? content : null;
   } catch {
     return null;
   }
 }
 function readPlanFile(worktreePath) {
-  return readTextIfPresent2(planFileAbs(worktreePath)) ?? readTextIfPresent2((0, import_node_path31.join)(worktreePath, `${LEGACY_ATTACHMENTS_DIR}/plan.md`)) ?? readTextIfPresent2((0, import_node_path31.join)(worktreePath, LEGACY_PLAN_FILE_REL));
+  return readTextIfPresent2(planFileAbs(worktreePath)) ?? readTextIfPresent2((0, import_node_path36.join)(worktreePath, `${LEGACY_ATTACHMENTS_DIR}/plan.md`)) ?? readTextIfPresent2((0, import_node_path36.join)(worktreePath, LEGACY_PLAN_FILE_REL));
 }
 function writePlanFile(worktreePath, content) {
   ensureAttachmentsGitignore2(worktreePath);
   const abs = planFileAbs(worktreePath);
-  (0, import_node_fs35.mkdirSync)((0, import_node_path31.dirname)(abs), { recursive: true });
+  (0, import_node_fs39.mkdirSync)((0, import_node_path36.dirname)(abs), { recursive: true });
   const body = content.trimEnd() + (content.endsWith("\n") ? "" : "\n");
-  (0, import_node_fs35.writeFileSync)(abs, body, "utf8");
+  (0, import_node_fs39.writeFileSync)(abs, body, "utf8");
   return PLAN_FILE_REL;
 }
-var import_node_fs35, import_node_path31;
+var import_node_fs39, import_node_path36;
 var init_plan_file = __esm({
   "src/plan/plan-file.ts"() {
     "use strict";
-    import_node_fs35 = require("fs");
-    import_node_path31 = require("path");
+    import_node_fs39 = require("fs");
+    import_node_path36 = require("path");
     init_workspace_scratch();
     init_plan_present();
     init_plan_present();
@@ -8852,10 +9207,10 @@ __export(cursor_recover_exports, {
 function recoverFinishedCursorRun(opts) {
   const agentId = opts.agentId.trim();
   if (!agentId) return null;
-  const runsPath = (0, import_node_path32.join)(appDataDir(), "cursor-sdk-store", "runs.ndjson");
-  if (!(0, import_node_fs36.existsSync)(runsPath)) return null;
+  const runsPath = (0, import_node_path37.join)(appDataDir(), "cursor-sdk-store", "runs.ndjson");
+  if (!(0, import_node_fs40.existsSync)(runsPath)) return null;
   try {
-    const lines = (0, import_node_fs36.readFileSync)(runsPath, "utf8").split("\n");
+    const lines = (0, import_node_fs40.readFileSync)(runsPath, "utf8").split("\n");
     let best = null;
     for (const line of lines) {
       const trimmed = line.trim();
@@ -8881,12 +9236,12 @@ function recoverFinishedCursorRun(opts) {
     return null;
   }
 }
-var import_node_fs36, import_node_path32;
+var import_node_fs40, import_node_path37;
 var init_cursor_recover = __esm({
   "src/agents/cursor-recover.ts"() {
     "use strict";
-    import_node_fs36 = require("fs");
-    import_node_path32 = require("path");
+    import_node_fs40 = require("fs");
+    import_node_path37 = require("path");
     init_paths();
   }
 });
@@ -9040,6 +9395,7 @@ __export(index_exports, {
   cleanupOrphanWorktrees: () => cleanupOrphanWorktrees,
   cloneRepoIntoSideboard: () => cloneRepoIntoSideboard,
   codexAdapter: () => codexAdapter,
+  codexSandboxWritableRootsArgs: () => codexSandboxWritableRootsArgs,
   codexUnattendedGitConfigArgs: () => codexUnattendedGitConfigArgs,
   coerceOrchestratorAgent: () => coerceOrchestratorAgent,
   collectTakenTeamSlugs: () => collectTakenTeamSlugs,
@@ -9156,6 +9512,7 @@ __export(index_exports, {
   getPr: () => getPr,
   getPrChecks: () => getPrChecks,
   getPrDetails: () => getPrDetails,
+  getPrForHeadBranch: () => getPrForHeadBranch,
   getPrMeta: () => getPrMeta,
   getPrStack: () => getPrStack,
   getRepoSetupInfo: () => getRepoSetupInfo,
@@ -9192,6 +9549,7 @@ __export(index_exports, {
   isCloudCoordinatorThread: () => isCloudCoordinatorThread,
   isConductorBundledCli: () => isConductorBundledCli,
   isCursorAutoModel: () => isCursorAutoModel,
+  isDefaultishSourceRef: () => isDefaultishSourceRef,
   isDirty: () => isDirty,
   isGhRateLimitError: () => isGhRateLimitError,
   isGlobalRepoPath: () => isGlobalRepoPath,
@@ -9258,8 +9616,10 @@ __export(index_exports, {
   maybeCompactContext: () => maybeCompactContext,
   mcpAllowTools: () => mcpAllowTools,
   mcpAuthWarnings: () => mcpAuthWarnings,
+  mergeAgentGitAuthEnv: () => mergeAgentGitAuthEnv,
   mergePr: () => mergePr,
   mergePrStack: () => mergePrStack,
+  mergeSideboardIntoMcpServersJson: () => mergeSideboardIntoMcpServersJson,
   mergeUsage: () => mergeUsage,
   nextPastedTextName: () => nextPastedTextName,
   nextThinkingEffort: () => nextThinkingEffort,
@@ -9310,6 +9670,7 @@ __export(index_exports, {
   recordSlackOutboundWatch: () => recordSlackOutboundWatch,
   refreshGitHubAuth: () => refreshGitHubAuth,
   refreshSlackReplyBadges: () => refreshSlackReplyBadges,
+  registerPackagedUserMcpClients: () => registerPackagedUserMcpClients,
   releaseCaffeinateHoldForThread: () => releaseCaffeinateHoldForThread,
   removeWorkspace: () => removeWorkspace,
   removeWorktree: () => removeWorktree,
@@ -9318,9 +9679,11 @@ __export(index_exports, {
   requestReview: () => requestReview,
   requireAgent: () => requireAgent,
   resetGhStackDetectCache: () => resetGhStackDetectCache,
+  resetGithubAgentTokenMemo: () => resetGithubAgentTokenMemo,
   resolveAgentExecutable: () => resolveAgentExecutable,
   resolveAgentGitAuthEnv: () => resolveAgentGitAuthEnv,
   resolveClaudeExecutable: () => resolveClaudeExecutable,
+  resolveCodexGitWritableRoots: () => resolveCodexGitWritableRoots,
   resolveCommandBinarySync: () => resolveCommandBinarySync,
   resolveConductorCursorAgentId: () => resolveConductorCursorAgentId,
   resolveCursorModelId: () => resolveCursorModelId,
@@ -9337,6 +9700,7 @@ __export(index_exports, {
   resolveNewThreadOptions: () => resolveNewThreadOptions,
   resolvePlanMarkdown: () => resolvePlanMarkdown,
   resolvePrSelector: () => resolvePrSelector,
+  resolvePrSelectors: () => resolvePrSelectors,
   resolveQuotaFallbackAgent: () => resolveQuotaFallbackAgent,
   resolveRepoRoot: () => resolveRepoRoot,
   resolveReviewGuidelines: () => resolveReviewGuidelines,
@@ -9359,6 +9723,7 @@ __export(index_exports, {
   sanitizeMcpServerName: () => sanitizeMcpServerName,
   saveAppSettings: () => saveAppSettings,
   saveLinearOAuth: () => saveLinearOAuth,
+  scrubGithubTokensFromChildEnv: () => scrubGithubTokensFromChildEnv,
   secureFileUnlocksWith: () => secureFileUnlocksWith,
   setCaffeinateHold: () => setCaffeinateHold,
   setHttpFetchImpl: () => setHttpFetchImpl,
@@ -9429,7 +9794,10 @@ __export(index_exports, {
   updateLinearIssue: () => updateLinearIssue,
   updateOpencodeSettings: () => updateOpencodeSettings,
   updateThread: () => updateThread,
+  userClaudeMcpConfigPath: () => userClaudeMcpConfigPath,
+  userCursorMcpConfigPath: () => userCursorMcpConfigPath,
   validateLinearApiKey: () => validateLinearApiKey,
+  warmGithubAgentAuth: () => warmGithubAgentAuth,
   withAgentInstructions: () => withAgentInstructions,
   withExportedPath: () => withExportedPath,
   withThreadLock: () => withThreadLock,
@@ -10513,10 +10881,9 @@ async function spawnAgentTurn(thread, input, onEvent) {
   const env = childEnvWithAppSettings(cmd.env);
   try {
     if (isOrchestratorThread(thread)) {
-      Object.assign(env, await resolveAgentGitAuthEnv(env));
+      mergeAgentGitAuthEnv(env, await resolveAgentGitAuthEnv(env));
     } else {
-      const originEnv = await originGhRepoEnv(thread.worktreePath, { env });
-      Object.assign(env, originEnv);
+      mergeAgentGitAuthEnv(env, await originGhRepoEnv(thread.worktreePath, { env }));
     }
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
@@ -10611,8 +10978,8 @@ init_usage();
 init_claude_mcp();
 
 // src/agents/instructions.ts
-var import_node_fs22 = require("fs");
-var import_node_path19 = require("path");
+var import_node_fs26 = require("fs");
+var import_node_path24 = require("path");
 init_git_auth_mode();
 init_worktree_labels();
 function normPath3(p) {
@@ -10745,9 +11112,10 @@ function formatArtifactDirective() {
     "Files / media browser (CMS file manager column):",
     "4) Call Sideboard MCP `present_files` with optional title, path, and datasource (brightsy|memory).",
     "   Opens the Files column for browse/upload/pick. Do NOT say a file manager UI is missing.",
-    "Multiple-choice questions (any mode \u2014 not only Plan):",
-    "5) Call Sideboard MCP `ask_user` when the user should pick from predefined options (approach forks, requirements, which API). First write a short chat message that explains the decision and what each option means (tradeoffs, when to pick it). Include a description on every option. After calling, stop and wait for their next message with answers. Do not ask multiple-choice questions as plain chat bullets \u2014 use ask_user so Sideboard shows the composer picker.",
-    "Never say artifacts, CMS UI, or the Files column are unavailable. Prefer present_schema for list/edit/publish; present_files for storage UI; html fences for standalone pages; ask_user for predefined-option questions."
+    "Multiple-choice questions:",
+    "5) Call Sideboard MCP `ask_user` only when work is blocked on choosing among a few concrete options (approach forks, which API, auth vs cookies). First write a short chat message that explains the decision and what each option means (tradeoffs, when to pick it). Include a description on every option. After calling, stop and wait for their next message with answers. If you are asking a real multiple-choice, use ask_user rather than chat bullets so Sideboard shows the composer picker.",
+    "Do not call ask_user for greetings, check-ins, \u201Chello\u201D, open-ended how-can-I-help, or to invent a menu of possible next tasks \u2014 reply in chat. If one option is the obvious default, proceed without asking.",
+    "Never say artifacts, CMS UI, or the Files column are unavailable. Prefer present_schema for list/edit/publish; present_files for storage UI; html fences for standalone pages; ask_user only for those blocked predefined-option questions."
   ].join("\n");
 }
 function formatUiReminder() {
@@ -10758,7 +11126,7 @@ function formatUiReminder() {
     "CMS forms/tables: MCP present_schema (Brightsy resource_id or inline schema+schemaUi).",
     "Files column: MCP present_files (brightsy account storage or memory).",
     "Do not say artifacts/CMS UI are unavailable.",
-    "Multiple-choice questions: MCP ask_user (composer picker, any mode). Explain options in chat first, then wait for answers."
+    "ask_user: only when blocked on a real multiple-choice (approach fork, which API). Never for hellos, check-ins, or \u201Cwhat next?\u201D menus \u2014 reply in chat."
   ].join(" ");
 }
 var FILES_BY_AGENT = {
@@ -10782,11 +11150,11 @@ function loadAgentInstructions(worktreePath, agent) {
   const out = [];
   for (const rel of candidates) {
     if (seenPaths.has(rel)) continue;
-    const abs = (0, import_node_path19.join)(worktreePath, rel);
-    if (!(0, import_node_fs22.existsSync)(abs)) continue;
+    const abs = (0, import_node_path24.join)(worktreePath, rel);
+    if (!(0, import_node_fs26.existsSync)(abs)) continue;
     try {
-      if (!(0, import_node_fs22.statSync)(abs).isFile()) continue;
-      let content = (0, import_node_fs22.readFileSync)(abs, "utf8");
+      if (!(0, import_node_fs26.statSync)(abs).isFile()) continue;
+      let content = (0, import_node_fs26.readFileSync)(abs, "utf8");
       if (!content.trim()) continue;
       if (content.length > MAX_CHARS_PER_FILE) {
         content = `${content.slice(0, MAX_CHARS_PER_FILE)}
@@ -10868,9 +11236,9 @@ async function requireAgent(agent, opts) {
 init_settings();
 
 // src/hook/conductor.ts
-var import_node_fs23 = require("fs");
+var import_node_fs27 = require("fs");
 var import_node_net = require("net");
-var import_node_path20 = require("path");
+var import_node_path25 = require("path");
 var import_execa4 = require("execa");
 var import_node_readline3 = require("readline");
 init_settings();
@@ -10885,9 +11253,9 @@ function matchSimpleGlob(pattern, name) {
   return new RegExp(`^${escaped}$`).test(name);
 }
 function readWorktreeInclude(repoPath) {
-  const path2 = (0, import_node_path20.join)(repoPath, ".worktreeinclude");
-  if (!(0, import_node_fs23.existsSync)(path2)) return [];
-  return (0, import_node_fs23.readFileSync)(path2, "utf8").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
+  const path2 = (0, import_node_path25.join)(repoPath, ".worktreeinclude");
+  if (!(0, import_node_fs27.existsSync)(path2)) return [];
+  return (0, import_node_fs27.readFileSync)(path2, "utf8").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
 }
 function resolveFilesToCopy(repoPath) {
   const fromInclude = readWorktreeInclude(repoPath);
@@ -10897,10 +11265,10 @@ function resolveFilesToCopy(repoPath) {
   if (settings?.fileIncludeGlobs?.length) {
     const matched = [];
     try {
-      for (const entry of (0, import_node_fs23.readdirSync)(repoPath, { withFileTypes: true })) {
+      for (const entry of (0, import_node_fs27.readdirSync)(repoPath, { withFileTypes: true })) {
         if (!entry.isFile()) continue;
         for (const glob of settings.fileIncludeGlobs) {
-          if (matchSimpleGlob(glob, entry.name) || matchSimpleGlob((0, import_node_path20.basename)(glob), entry.name)) {
+          if (matchSimpleGlob(glob, entry.name) || matchSimpleGlob((0, import_node_path25.basename)(glob), entry.name)) {
             matched.push(entry.name);
             break;
           }
@@ -10912,7 +11280,7 @@ function resolveFilesToCopy(repoPath) {
   }
   const defaults = [];
   try {
-    for (const entry of (0, import_node_fs23.readdirSync)(repoPath, { withFileTypes: true })) {
+    for (const entry of (0, import_node_fs27.readdirSync)(repoPath, { withFileTypes: true })) {
       if (entry.isFile() && entry.name.startsWith(".env")) {
         defaults.push(entry.name);
       }
@@ -10926,11 +11294,11 @@ function copyConfiguredFiles(repoPath, worktreePath) {
   const patterns = resolveFilesToCopy(repoPath);
   const copied = [];
   for (const rel of patterns) {
-    const src = (0, import_node_path20.join)(repoPath, rel);
-    if (!(0, import_node_fs23.existsSync)(src)) continue;
-    const dest = (0, import_node_path20.join)(worktreePath, rel);
-    (0, import_node_fs23.mkdirSync)((0, import_node_path20.dirname)(dest), { recursive: true });
-    (0, import_node_fs23.copyFileSync)(src, dest);
+    const src = (0, import_node_path25.join)(repoPath, rel);
+    if (!(0, import_node_fs27.existsSync)(src)) continue;
+    const dest = (0, import_node_path25.join)(worktreePath, rel);
+    (0, import_node_fs27.mkdirSync)((0, import_node_path25.dirname)(dest), { recursive: true });
+    (0, import_node_fs27.copyFileSync)(src, dest);
     copied.push(rel);
   }
   return copied;
@@ -10966,7 +11334,7 @@ function buildWorkspaceScriptEnv(opts, baseEnv) {
   const env = stripNestedElectronEnv({
     ...baseEnv ?? process.env
   });
-  const name = opts.workspaceName ?? (0, import_node_path20.basename)(opts.worktreePath);
+  const name = opts.workspaceName ?? (0, import_node_path25.basename)(opts.worktreePath);
   const ports = opts.ports ?? [];
   const primary = ports[0];
   env.SIDEBOARD_WORKSPACE_NAME = name;
@@ -11052,7 +11420,10 @@ async function spawnWorkspaceScript(command, opts) {
     loginEnv
   );
   try {
-    Object.assign(env, await resolveAgentGitAuthEnv(env, { cwd: opts.worktreePath }));
+    mergeAgentGitAuthEnv(
+      env,
+      await resolveAgentGitAuthEnv(env, { cwd: opts.worktreePath })
+    );
   } catch {
   }
   const shell = process.platform === "darwin" ? "zsh" : "bash";
@@ -11224,12 +11595,12 @@ init_convention_setup();
 init_cursor_worktrees();
 
 // src/diff/diff.ts
-var import_node_fs24 = require("fs");
-var import_node_path21 = require("path");
+var import_node_fs28 = require("fs");
+var import_node_path26 = require("path");
 init_run();
 init_worktree();
 async function inspectGitWorktree(worktreePath) {
-  if (!worktreePath || !(0, import_node_fs24.existsSync)(worktreePath)) return "missing_worktree";
+  if (!worktreePath || !(0, import_node_fs28.existsSync)(worktreePath)) return "missing_worktree";
   const check = await git(["rev-parse", "--is-inside-work-tree"], worktreePath, {
     reject: false
   });
@@ -11237,7 +11608,7 @@ async function inspectGitWorktree(worktreePath) {
   return "ok";
 }
 async function initializeGitRepository(worktreePath) {
-  if (!worktreePath || !(0, import_node_fs24.existsSync)(worktreePath)) {
+  if (!worktreePath || !(0, import_node_fs28.existsSync)(worktreePath)) {
     throw new Error("Worktree not found");
   }
   const status = await inspectGitWorktree(worktreePath);
@@ -11372,11 +11743,11 @@ new file mode 100644
   };
 }
 async function untrackedPatch(worktreePath, path2, maxHunk) {
-  const abs = (0, import_node_path21.join)(worktreePath, path2);
+  const abs = (0, import_node_path26.join)(worktreePath, path2);
   try {
-    const st = (0, import_node_fs24.statSync)(abs);
+    const st = (0, import_node_fs28.statSync)(abs);
     if (st.isFile() && st.size > maxHunk) {
-      const buf = (0, import_node_fs24.readFileSync)(abs).subarray(0, maxHunk);
+      const buf = (0, import_node_fs28.readFileSync)(abs).subarray(0, maxHunk);
       return syntheticAddPatch(path2, buf.toString("utf8"), maxHunk);
     }
   } catch {
@@ -11877,8 +12248,8 @@ var DEFAULT_UPLOAD_MAX_BYTES = 5e7;
 function readWorktreeFileForUpload(worktreePath, relativePath, opts) {
   assertSafeRelativePath(relativePath);
   const maxBytes = opts?.maxBytes ?? DEFAULT_UPLOAD_MAX_BYTES;
-  const abs = (0, import_node_path21.join)(worktreePath, relativePath);
-  const st = (0, import_node_fs24.statSync)(abs);
+  const abs = (0, import_node_path26.join)(worktreePath, relativePath);
+  const st = (0, import_node_fs28.statSync)(abs);
   if (!st.isFile()) {
     throw new Error(`Not a file: ${relativePath}`);
   }
@@ -11887,7 +12258,7 @@ function readWorktreeFileForUpload(worktreePath, relativePath, opts) {
       `File too large to upload (${st.size} bytes; max ${maxBytes})`
     );
   }
-  const buf = (0, import_node_fs24.readFileSync)(abs);
+  const buf = (0, import_node_fs28.readFileSync)(abs);
   return {
     path: relativePath,
     contentBase64: buf.toString("base64"),
@@ -11897,12 +12268,12 @@ function readWorktreeFileForUpload(worktreePath, relativePath, opts) {
 function readWorktreeFile(worktreePath, relativePath, opts) {
   assertSafeRelativePath(relativePath);
   const maxBytes = opts?.maxBytes ?? 2e5;
-  const abs = (0, import_node_path21.join)(worktreePath, relativePath);
-  const st = (0, import_node_fs24.statSync)(abs);
+  const abs = (0, import_node_path26.join)(worktreePath, relativePath);
+  const st = (0, import_node_fs28.statSync)(abs);
   if (!st.isFile()) {
     throw new Error(`Not a file: ${relativePath}`);
   }
-  const buf = (0, import_node_fs24.readFileSync)(abs);
+  const buf = (0, import_node_fs28.readFileSync)(abs);
   if (isImageRelativePath(relativePath)) {
     const maxImageBytes = Math.max(maxBytes, 15e6);
     const truncated2 = buf.length > maxImageBytes;
@@ -11945,9 +12316,9 @@ function assertSafeRelativePath(relativePath) {
 }
 function writeWorktreeFile(worktreePath, relativePath, content) {
   assertSafeRelativePath(relativePath);
-  const abs = (0, import_node_path21.join)(worktreePath, relativePath);
-  (0, import_node_fs24.mkdirSync)((0, import_node_path21.dirname)(abs), { recursive: true });
-  (0, import_node_fs24.writeFileSync)(abs, content, "utf8");
+  const abs = (0, import_node_path26.join)(worktreePath, relativePath);
+  (0, import_node_fs28.mkdirSync)((0, import_node_path26.dirname)(abs), { recursive: true });
+  (0, import_node_fs28.writeFileSync)(abs, content, "utf8");
   return { path: relativePath };
 }
 async function getDiffSummary(worktreePath, repoPath, opts) {
@@ -11966,9 +12337,9 @@ async function getDiffSummary(worktreePath, repoPath, opts) {
 }
 
 // src/skills/discover.ts
-var import_node_fs25 = require("fs");
-var import_node_os8 = require("os");
-var import_node_path22 = require("path");
+var import_node_fs29 = require("fs");
+var import_node_os10 = require("os");
+var import_node_path27 = require("path");
 function toCommand(name) {
   return name.normalize("NFKD").replace(/[\u0300-\u036f]/g, "").toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
@@ -12000,7 +12371,7 @@ function parseFrontmatter(content) {
 }
 function readSkill(skillMd, source) {
   try {
-    const content = (0, import_node_fs25.readFileSync)(skillMd, "utf8");
+    const content = (0, import_node_fs29.readFileSync)(skillMd, "utf8");
     const { name: fmName, description } = parseFrontmatter(content);
     const dirName = skillMd.split("/").slice(-2, -1)[0] || "skill";
     const name = fmName || dirName;
@@ -12019,19 +12390,19 @@ function readSkill(skillMd, source) {
   }
 }
 function scanSkillsDir(dir, source, out) {
-  if (!(0, import_node_fs25.existsSync)(dir)) return;
+  if (!(0, import_node_fs29.existsSync)(dir)) return;
   let entries;
   try {
-    entries = (0, import_node_fs25.readdirSync)(dir);
+    entries = (0, import_node_fs29.readdirSync)(dir);
   } catch {
     return;
   }
   for (const entry of entries) {
     if (entry.startsWith(".")) continue;
-    const skillMd = (0, import_node_path22.join)(dir, entry, "SKILL.md");
-    if (!(0, import_node_fs25.existsSync)(skillMd)) continue;
+    const skillMd = (0, import_node_path27.join)(dir, entry, "SKILL.md");
+    if (!(0, import_node_fs29.existsSync)(skillMd)) continue;
     try {
-      if (!(0, import_node_fs25.statSync)(skillMd).isFile()) continue;
+      if (!(0, import_node_fs29.statSync)(skillMd).isFile()) continue;
     } catch {
       continue;
     }
@@ -12040,24 +12411,24 @@ function scanSkillsDir(dir, source, out) {
   }
 }
 function scanClaudePluginSkills(pluginsRoot, out) {
-  if (!(0, import_node_fs25.existsSync)(pluginsRoot)) return;
+  if (!(0, import_node_fs29.existsSync)(pluginsRoot)) return;
   const walk = (dir, depth, lookingForSkillsDir) => {
     if (depth > 7) return;
     let entries;
     try {
-      entries = (0, import_node_fs25.readdirSync)(dir);
+      entries = (0, import_node_fs29.readdirSync)(dir);
     } catch {
       return;
     }
     if (lookingForSkillsDir && entries.includes("SKILL.md")) {
-      const skill = readSkill((0, import_node_path22.join)(dir, "SKILL.md"), "cli");
+      const skill = readSkill((0, import_node_path27.join)(dir, "SKILL.md"), "cli");
       if (skill) out.push(skill);
     }
     for (const entry of entries) {
       if (entry === "node_modules" || entry === ".git") continue;
-      const full = (0, import_node_path22.join)(dir, entry);
+      const full = (0, import_node_path27.join)(dir, entry);
       try {
-        if (!(0, import_node_fs25.statSync)(full).isDirectory()) continue;
+        if (!(0, import_node_fs29.statSync)(full).isDirectory()) continue;
       } catch {
         continue;
       }
@@ -12072,20 +12443,20 @@ function scanClaudePluginSkills(pluginsRoot, out) {
   walk(pluginsRoot, 0, false);
 }
 function discoverSkills(worktreePath) {
-  const home = (0, import_node_os8.homedir)();
+  const home = (0, import_node_os10.homedir)();
   const collected = [];
   for (const rel of [".claude/skills", ".cursor/skills", ".sideboard/skills", ".brightsy/skills", "skills"]) {
-    scanSkillsDir((0, import_node_path22.join)(worktreePath, rel), "workspace", collected);
+    scanSkillsDir((0, import_node_path27.join)(worktreePath, rel), "workspace", collected);
   }
   for (const abs of [
-    (0, import_node_path22.join)(home, ".claude/skills"),
-    (0, import_node_path22.join)(home, ".cursor/skills"),
-    (0, import_node_path22.join)(home, ".sideboard/skills"),
-    (0, import_node_path22.join)(home, ".brightsy/skills")
+    (0, import_node_path27.join)(home, ".claude/skills"),
+    (0, import_node_path27.join)(home, ".cursor/skills"),
+    (0, import_node_path27.join)(home, ".sideboard/skills"),
+    (0, import_node_path27.join)(home, ".brightsy/skills")
   ]) {
     scanSkillsDir(abs, "user", collected);
   }
-  scanClaudePluginSkills((0, import_node_path22.join)(home, ".claude/plugins"), collected);
+  scanClaudePluginSkills((0, import_node_path27.join)(home, ".claude/plugins"), collected);
   const rank = { workspace: 0, user: 1, cli: 2 };
   const byCommand = /* @__PURE__ */ new Map();
   for (const skill of collected) {
@@ -12097,7 +12468,7 @@ function discoverSkills(worktreePath) {
   return [...byCommand.values()].sort((a, b) => a.command.localeCompare(b.command));
 }
 function readSkillBody(skillPath, maxChars = 12e3) {
-  const raw = (0, import_node_fs25.readFileSync)(skillPath, "utf8");
+  const raw = (0, import_node_fs29.readFileSync)(skillPath, "utf8");
   if (raw.startsWith("---")) {
     const end = raw.indexOf("\n---", 3);
     if (end >= 0) {
@@ -12238,8 +12609,8 @@ function buildDiffCommentAttachment(input) {
 }
 
 // src/composer/stage-files.ts
-var import_node_fs26 = require("fs");
-var import_node_path23 = require("path");
+var import_node_fs30 = require("fs");
+var import_node_path28 = require("path");
 var import_node_crypto5 = require("crypto");
 init_workspace_scratch();
 var IMAGE_EXTENSIONS2 = /* @__PURE__ */ new Set([
@@ -12265,7 +12636,7 @@ var IMAGE_MIME_BY_EXT = {
 var MAX_INLINE_BYTES = 4e5;
 var MAX_PREVIEW_BYTES = 5e6;
 function fileExtension(filePath) {
-  const base = (0, import_node_path23.basename)(filePath).toLowerCase();
+  const base = (0, import_node_path28.basename)(filePath).toLowerCase();
   return base.includes(".") ? base.split(".").pop() || "" : "";
 }
 function isImageFilePath(filePath) {
@@ -12275,22 +12646,22 @@ function imageMimeType(filePath) {
   return IMAGE_MIME_BY_EXT[fileExtension(filePath)] || "image/png";
 }
 function ensureAttachmentsDir(worktreePath) {
-  const dir = (0, import_node_path23.join)(worktreePath, ATTACHMENTS_DIR);
-  (0, import_node_fs26.mkdirSync)(dir, { recursive: true });
-  const gi = (0, import_node_path23.join)(dir, ".gitignore");
-  if (!(0, import_node_fs26.existsSync)(gi)) {
-    (0, import_node_fs26.writeFileSync)(gi, attachmentsGitignoreBody(), "utf8");
+  const dir = (0, import_node_path28.join)(worktreePath, ATTACHMENTS_DIR);
+  (0, import_node_fs30.mkdirSync)(dir, { recursive: true });
+  const gi = (0, import_node_path28.join)(dir, ".gitignore");
+  if (!(0, import_node_fs30.existsSync)(gi)) {
+    (0, import_node_fs30.writeFileSync)(gi, attachmentsGitignoreBody(), "utf8");
   }
   return dir;
 }
 function uniqueAttachmentName(dir, originalName) {
   const safe = originalName.replace(/[/\\]/g, "_") || "file";
-  if (!(0, import_node_fs26.existsSync)((0, import_node_path23.join)(dir, safe))) return safe;
-  const ext = (0, import_node_path23.extname)(safe);
+  if (!(0, import_node_fs30.existsSync)((0, import_node_path28.join)(dir, safe))) return safe;
+  const ext = (0, import_node_path28.extname)(safe);
   const stem = ext ? safe.slice(0, -ext.length) : safe;
   for (let i = 1; i < 1e4; i++) {
     const candidate = `${stem}-${i}${ext}`;
-    if (!(0, import_node_fs26.existsSync)((0, import_node_path23.join)(dir, candidate))) return candidate;
+    if (!(0, import_node_fs30.existsSync)((0, import_node_path28.join)(dir, candidate))) return candidate;
   }
   return `${stem}-${(0, import_node_crypto5.randomUUID)()}${ext}`;
 }
@@ -12342,9 +12713,9 @@ function attachmentFromBuffer(name, buf, opts) {
   };
 }
 function attachmentFromAbsolutePath(absolutePath) {
-  const name = (0, import_node_path23.basename)(absolutePath);
+  const name = (0, import_node_path28.basename)(absolutePath);
   try {
-    const st = (0, import_node_fs26.statSync)(absolutePath);
+    const st = (0, import_node_fs30.statSync)(absolutePath);
     if (!st.isFile()) {
       return {
         id: (0, import_node_crypto5.randomUUID)(),
@@ -12353,7 +12724,7 @@ function attachmentFromAbsolutePath(absolutePath) {
         content: `(not a file: ${absolutePath})`
       };
     }
-    const buf = (0, import_node_fs26.readFileSync)(absolutePath);
+    const buf = (0, import_node_fs30.readFileSync)(absolutePath);
     return attachmentFromBuffer(name, buf, { sourceLabel: absolutePath });
   } catch (err) {
     return {
@@ -12369,15 +12740,15 @@ function stageAbsolutePathsAsAttachments(worktreePath, absolutePaths) {
   const dir = ensureAttachmentsDir(worktreePath);
   const out = [];
   for (const abs of absolutePaths) {
-    const originalName = (0, import_node_path23.basename)(abs);
+    const originalName = (0, import_node_path28.basename)(abs);
     try {
-      const st = (0, import_node_fs26.statSync)(abs);
+      const st = (0, import_node_fs30.statSync)(abs);
       if (!st.isFile()) continue;
       const name = uniqueAttachmentName(dir, originalName);
-      const destAbs = (0, import_node_path23.join)(dir, name);
-      (0, import_node_fs26.copyFileSync)(abs, destAbs);
+      const destAbs = (0, import_node_path28.join)(dir, name);
+      (0, import_node_fs30.copyFileSync)(abs, destAbs);
       const rel = `${ATTACHMENTS_DIR}/${name}`;
-      const buf = (0, import_node_fs26.readFileSync)(destAbs);
+      const buf = (0, import_node_fs30.readFileSync)(destAbs);
       out.push(attachmentFromBuffer(name, buf, { path: rel, sourceLabel: abs }));
     } catch (err) {
       out.push({
@@ -12399,8 +12770,8 @@ function stageBuffersAsAttachments(worktreePath, buffers) {
     try {
       const buf = Buffer.from(item.dataBase64, "base64");
       const name = uniqueAttachmentName(dir, originalName);
-      const destAbs = (0, import_node_path23.join)(dir, name);
-      (0, import_node_fs26.writeFileSync)(destAbs, buf);
+      const destAbs = (0, import_node_path28.join)(dir, name);
+      (0, import_node_fs30.writeFileSync)(destAbs, buf);
       const rel = `${ATTACHMENTS_DIR}/${name}`;
       out.push(attachmentFromBuffer(name, buf, { path: rel }));
     } catch (err) {
@@ -12436,18 +12807,18 @@ function attachmentsFromWorktreePaths(worktreePath, relativePaths) {
     if (!rel || rel.includes("..") || rel.startsWith("/")) {
       out.push({
         id: (0, import_node_crypto5.randomUUID)(),
-        name: (0, import_node_path23.basename)(rel) || "file",
+        name: (0, import_node_path28.basename)(rel) || "file",
         kind: "file",
         content: `(invalid path: ${rel})`
       });
       continue;
     }
-    const name = (0, import_node_path23.basename)(rel);
+    const name = (0, import_node_path28.basename)(rel);
     try {
-      const abs = (0, import_node_path23.join)(worktreePath, rel);
-      const st = (0, import_node_fs26.statSync)(abs);
+      const abs = (0, import_node_path28.join)(worktreePath, rel);
+      const st = (0, import_node_fs30.statSync)(abs);
       if (!st.isFile()) continue;
-      const buf = (0, import_node_fs26.readFileSync)(abs);
+      const buf = (0, import_node_fs30.readFileSync)(abs);
       out.push(attachmentFromBuffer(name, buf, { path: rel, sourceLabel: abs }));
     } catch (err) {
       out.push({
@@ -12935,7 +13306,7 @@ async function confirmLand(thread, opts) {
 }
 
 // src/threads/create.ts
-var import_node_fs27 = require("fs");
+var import_node_fs31 = require("fs");
 init_worktree();
 init_app_settings();
 init_thread_store();
@@ -12949,12 +13320,13 @@ async function createThread(input, _onSetupLine) {
   });
   await requireAgent(resolved.agent);
   const repoPath = await resolveRepoRoot(input.repoPath);
-  if (!(0, import_node_fs27.existsSync)(repoPath)) {
+  if (!(0, import_node_fs31.existsSync)(repoPath)) {
     throw new Error(`Repo not found: ${repoPath}`);
   }
   let sourceRef = input.sourceRef;
   let sourceIsFork = false;
   let prUrl = null;
+  let prTitle = null;
   if (input.sourceType === "pr") {
     const num2 = Number(input.sourceRef.replace(/^#/, ""));
     if (!Number.isFinite(num2)) throw new Error(`Invalid PR number: ${input.sourceRef}`);
@@ -12970,6 +13342,12 @@ async function createThread(input, _onSetupLine) {
   } else if (input.sourceType === "branch") {
     if (!sourceRef || sourceRef === "HEAD" || sourceRef === "default") {
       sourceRef = await resolveDefaultBranch(repoPath);
+    } else {
+      const existing = await getPrForHeadBranch(repoPath, sourceRef);
+      if (existing?.url) {
+        prUrl = existing.url;
+        prTitle = existing.title;
+      }
     }
   } else if (input.sourceType === "adopt") {
     throw new Error("Use adoptThread() for adopt sources");
@@ -13000,7 +13378,8 @@ async function createThread(input, _onSetupLine) {
     sourceIsFork,
     parentThreadId: input.parentThreadId ?? null,
     status: "idle",
-    prUrl
+    prUrl,
+    prTitle
   });
   writeThread(thread);
   await ensureWorkspace(repoPath);
@@ -13176,7 +13555,7 @@ async function forkThreadWorktree(input, onSetupLine) {
 }
 
 // src/threads/stack-layers.ts
-var import_node_fs28 = require("fs");
+var import_node_fs32 = require("fs");
 init_run();
 init_stack();
 init_worktree();
@@ -13244,7 +13623,7 @@ async function openStackLayer(input, _onSetupLine) {
   let createdWorktree = false;
   const trees = await listWorktrees(repoPath);
   const checkedOut = trees.find((w) => w.branch === branchName);
-  if (checkedOut?.path && (0, import_node_fs28.existsSync)(checkedOut.path)) {
+  if (checkedOut?.path && (0, import_node_fs32.existsSync)(checkedOut.path)) {
     if (input.reuseExistingWorktree !== false) {
       worktreePath = checkedOut.path;
     } else {
@@ -13386,7 +13765,7 @@ async function initStackFromThread(input, onSetupLine) {
 async function createPrStack(input, onSetupLine) {
   await requireAgent(input.agent);
   const repoPath = await resolveRepoRoot(input.repoPath);
-  if (!(0, import_node_fs28.existsSync)(repoPath)) throw new Error(`Repo not found: ${repoPath}`);
+  if (!(0, import_node_fs32.existsSync)(repoPath)) throw new Error(`Repo not found: ${repoPath}`);
   if (!input.branches.length) throw new Error("At least one branch name required");
   const status = await detectGhStack(repoPath);
   if (!status.available) throw new Error(status.reason);
@@ -13453,7 +13832,7 @@ async function createPrStack(input, onSetupLine) {
     }
   }
   const claimed = new Set(threads.map((t) => t.worktreePath));
-  if (!claimed.has(bootstrap.worktreePath) && (0, import_node_fs28.existsSync)(bootstrap.worktreePath)) {
+  if (!claimed.has(bootstrap.worktreePath) && (0, import_node_fs32.existsSync)(bootstrap.worktreePath)) {
     try {
       await removeWorktree(repoPath, bootstrap.worktreePath, {
         deleteBranch: bootstrap.branchName
@@ -13476,20 +13855,26 @@ function stackAgentDefaultsFrom(input) {
 
 // src/threads/adopt.ts
 var import_node_child_process4 = require("child_process");
-var import_node_fs29 = require("fs");
-var import_node_os9 = require("os");
-var import_node_path24 = require("path");
-var import_better_sqlite3 = __toESM(require("better-sqlite3"), 1);
+var import_node_fs33 = require("fs");
+var import_node_os11 = require("os");
+var import_node_path29 = require("path");
+var import_node_module4 = require("module");
 init_worktree();
 init_thread_store();
-var CONDUCTOR_APP_SUPPORT = (0, import_node_path24.join)(
+var import_meta4 = {};
+var CONDUCTOR_APP_SUPPORT = (0, import_node_path29.join)(
   process.env.HOME ?? "",
   "Library",
   "Application Support",
   "com.conductor.app"
 );
-var CONDUCTOR_DB = (0, import_node_path24.join)(CONDUCTOR_APP_SUPPORT, "conductor.db");
-var CURSOR_SDK_STORE = (0, import_node_path24.join)(CONDUCTOR_APP_SUPPORT, "cursor-sdk-store");
+var CONDUCTOR_DB = (0, import_node_path29.join)(CONDUCTOR_APP_SUPPORT, "conductor.db");
+var CURSOR_SDK_STORE = (0, import_node_path29.join)(CONDUCTOR_APP_SUPPORT, "cursor-sdk-store");
+function openReadonlySqlite(file) {
+  const req = (0, import_node_module4.createRequire)(import_meta4.url);
+  const Database = req("better-sqlite3");
+  return new Database(file, { readonly: true, fileMustExist: true });
+}
 function mapAgentType(raw) {
   if (!raw) return null;
   const v = raw.toLowerCase();
@@ -13501,21 +13886,21 @@ function mapAgentType(raw) {
   return null;
 }
 function resolveConductorCursorAgentId(workspacePath) {
-  if (!workspacePath || !(0, import_node_fs29.existsSync)(CURSOR_SDK_STORE)) return null;
+  if (!workspacePath || !(0, import_node_fs33.existsSync)(CURSOR_SDK_STORE)) return null;
   const normalized = workspacePath.replace(/\/$/, "");
   let best = null;
   let hashes;
   try {
-    hashes = (0, import_node_fs29.readdirSync)(CURSOR_SDK_STORE);
+    hashes = (0, import_node_fs33.readdirSync)(CURSOR_SDK_STORE);
   } catch {
     return null;
   }
   for (const hash of hashes) {
-    const agentsFile = (0, import_node_path24.join)(CURSOR_SDK_STORE, hash, "agents.ndjson");
-    if (!(0, import_node_fs29.existsSync)(agentsFile)) continue;
+    const agentsFile = (0, import_node_path29.join)(CURSOR_SDK_STORE, hash, "agents.ndjson");
+    if (!(0, import_node_fs33.existsSync)(agentsFile)) continue;
     let text3;
     try {
-      text3 = (0, import_node_fs29.readFileSync)(agentsFile, "utf8");
+      text3 = (0, import_node_fs33.readFileSync)(agentsFile, "utf8");
     } catch {
       continue;
     }
@@ -13539,7 +13924,7 @@ function resolveConductorCursorAgentId(workspacePath) {
   return best?.agentId ?? null;
 }
 async function adoptThread(input) {
-  if (!(0, import_node_fs29.existsSync)(input.worktreePath)) {
+  if (!(0, import_node_fs33.existsSync)(input.worktreePath)) {
     throw new Error(`Worktree not found: ${input.worktreePath}`);
   }
   const repoPath = await resolveRepoRoot(input.worktreePath);
@@ -13566,23 +13951,23 @@ function conductorDbPath() {
   return CONDUCTOR_DB;
 }
 function listConductorWorkspaces() {
-  if (!(0, import_node_fs29.existsSync)(CONDUCTOR_DB)) {
+  if (!(0, import_node_fs33.existsSync)(CONDUCTOR_DB)) {
     throw new Error(`Conductor DB not found at ${CONDUCTOR_DB}`);
   }
-  const tmp = (0, import_node_fs29.mkdtempSync)((0, import_node_path24.join)((0, import_node_os9.tmpdir)(), "sideboard-conductor-"));
-  const snapshot = (0, import_node_path24.join)(tmp, "conductor.db");
+  const tmp = (0, import_node_fs33.mkdtempSync)((0, import_node_path29.join)((0, import_node_os11.tmpdir)(), "sideboard-conductor-"));
+  const snapshot = (0, import_node_path29.join)(tmp, "conductor.db");
   try {
-    (0, import_node_fs29.copyFileSync)(CONDUCTOR_DB, snapshot);
+    (0, import_node_fs33.copyFileSync)(CONDUCTOR_DB, snapshot);
     for (const suffix of ["-wal", "-shm"]) {
       const src = `${CONDUCTOR_DB}${suffix}`;
-      if ((0, import_node_fs29.existsSync)(src)) {
+      if ((0, import_node_fs33.existsSync)(src)) {
         try {
-          (0, import_node_fs29.copyFileSync)(src, `${snapshot}${suffix}`);
+          (0, import_node_fs33.copyFileSync)(src, `${snapshot}${suffix}`);
         } catch {
         }
       }
     }
-    const db = new import_better_sqlite3.default(snapshot, { readonly: true, fileMustExist: true });
+    const db = openReadonlySqlite(snapshot);
     try {
       const tables = db.prepare(`SELECT name FROM sqlite_master WHERE type='table'`).all();
       const names = new Set(tables.map((t) => t.name));
@@ -13653,27 +14038,27 @@ function listConductorWorkspaces() {
       db.close();
     }
   } finally {
-    (0, import_node_fs29.rmSync)(tmp, { recursive: true, force: true });
+    (0, import_node_fs33.rmSync)(tmp, { recursive: true, force: true });
   }
 }
 function importConductorWorkspace(workspaceId) {
-  if (!(0, import_node_fs29.existsSync)(CONDUCTOR_DB)) {
+  if (!(0, import_node_fs33.existsSync)(CONDUCTOR_DB)) {
     throw new Error(`Conductor DB not found at ${CONDUCTOR_DB}`);
   }
-  const tmp = (0, import_node_fs29.mkdtempSync)((0, import_node_path24.join)((0, import_node_os9.tmpdir)(), "sideboard-conductor-"));
-  const snapshot = (0, import_node_path24.join)(tmp, "conductor.db");
+  const tmp = (0, import_node_fs33.mkdtempSync)((0, import_node_path29.join)((0, import_node_os11.tmpdir)(), "sideboard-conductor-"));
+  const snapshot = (0, import_node_path29.join)(tmp, "conductor.db");
   try {
-    (0, import_node_fs29.copyFileSync)(CONDUCTOR_DB, snapshot);
+    (0, import_node_fs33.copyFileSync)(CONDUCTOR_DB, snapshot);
     for (const suffix of ["-wal", "-shm"]) {
       const src = `${CONDUCTOR_DB}${suffix}`;
-      if ((0, import_node_fs29.existsSync)(src)) {
+      if ((0, import_node_fs33.existsSync)(src)) {
         try {
-          (0, import_node_fs29.copyFileSync)(src, `${snapshot}${suffix}`);
+          (0, import_node_fs33.copyFileSync)(src, `${snapshot}${suffix}`);
         } catch {
         }
       }
     }
-    const db = new import_better_sqlite3.default(snapshot, { readonly: true, fileMustExist: true });
+    const db = openReadonlySqlite(snapshot);
     try {
       const row = db.prepare(
         `SELECT
@@ -13686,7 +14071,7 @@ function importConductorWorkspace(workspaceId) {
       ).get(workspaceId);
       if (!row) throw new Error(`Conductor workspace not found: ${workspaceId}`);
       const worktreePath = String(row.workspacePath);
-      if (!(0, import_node_fs29.existsSync)(worktreePath)) {
+      if (!(0, import_node_fs33.existsSync)(worktreePath)) {
         throw new Error(`Conductor worktree missing on disk: ${worktreePath}`);
       }
       let sessionId = null;
@@ -13749,7 +14134,7 @@ function importConductorWorkspace(workspaceId) {
       db.close();
     }
   } finally {
-    (0, import_node_fs29.rmSync)(tmp, { recursive: true, force: true });
+    (0, import_node_fs33.rmSync)(tmp, { recursive: true, force: true });
   }
 }
 async function importConductorWorkspaceAsync(workspaceId) {
@@ -13760,8 +14145,8 @@ async function importConductorWorkspaceAsync(workspaceId) {
 var import_node_events = require("events");
 
 // src/slack/outbound-watch.ts
-var import_node_fs31 = require("fs");
-var import_node_path27 = require("path");
+var import_node_fs35 = require("fs");
+var import_node_path32 = require("path");
 init_paths();
 init_private_file();
 init_secure_file();
@@ -13807,19 +14192,19 @@ async function slackAuthTest(token) {
 }
 
 // src/slack/reply-target.ts
-var import_node_fs30 = require("fs");
-var import_node_path25 = require("path");
+var import_node_fs34 = require("fs");
+var import_node_path30 = require("path");
 init_paths();
 init_private_file();
 init_secure_file();
 function storePath2() {
-  return (0, import_node_path25.join)(appDataDir(), "slack-reply-to.json");
+  return (0, import_node_path30.join)(appDataDir(), "slack-reply-to.json");
 }
 function readStore2() {
   const path2 = storePath2();
-  if (!(0, import_node_fs30.existsSync)(path2)) return {};
+  if (!(0, import_node_fs34.existsSync)(path2)) return {};
   try {
-    const parsed = isSecureFileEncrypted(path2) ? readSecureJson(path2) : JSON.parse((0, import_node_fs30.readFileSync)(path2, "utf8"));
+    const parsed = isSecureFileEncrypted(path2) ? readSecureJson(path2) : JSON.parse((0, import_node_fs34.readFileSync)(path2, "utf8"));
     return parsed?.targets && typeof parsed.targets === "object" ? parsed.targets : {};
   } catch {
     return {};
@@ -13836,11 +14221,11 @@ function getSlackReplyTarget(threadId) {
 }
 
 // src/slack/workspaces.ts
-var import_node_path26 = require("path");
+var import_node_path31 = require("path");
 init_paths();
 init_secure_file();
 function storePath3() {
-  return (0, import_node_path26.join)(appDataDir(), "slack-workspaces.json");
+  return (0, import_node_path31.join)(appDataDir(), "slack-workspaces.json");
 }
 function readStore3() {
   try {
@@ -13956,7 +14341,7 @@ var POLL_INTERVAL_MS = 12e3;
 var lastPollMs = 0;
 var nameCache = /* @__PURE__ */ new Map();
 function storePath4() {
-  return (0, import_node_path27.join)(appDataDir(), "slack-outbound-watch.json");
+  return (0, import_node_path32.join)(appDataDir(), "slack-outbound-watch.json");
 }
 function watchId(teamId, channelId, ts) {
   return `${teamId}:${channelId}:${ts}`;
@@ -13986,9 +14371,9 @@ function tsNewer(a, b) {
 }
 function readStore4() {
   const path2 = storePath4();
-  if (!(0, import_node_fs31.existsSync)(path2)) return [];
+  if (!(0, import_node_fs35.existsSync)(path2)) return [];
   try {
-    const parsed = isSecureFileEncrypted(path2) ? readSecureJson(path2) : JSON.parse((0, import_node_fs31.readFileSync)(path2, "utf8"));
+    const parsed = isSecureFileEncrypted(path2) ? readSecureJson(path2) : JSON.parse((0, import_node_fs35.readFileSync)(path2, "utf8"));
     return Array.isArray(parsed?.watches) ? parsed.watches : [];
   } catch {
     return [];
@@ -14333,7 +14718,7 @@ async function refreshSlackReplyBadges(opts) {
 }
 
 // src/orchestrator/orchestrator.ts
-var import_node_fs37 = require("fs");
+var import_node_fs41 = require("fs");
 init_error_detail();
 init_agents();
 init_worktree();
@@ -14354,8 +14739,8 @@ function shouldAutoArchiveOnPrMerge(opts) {
 }
 
 // src/git/orphan-cleanup.ts
-var import_node_fs32 = require("fs");
-var import_node_path28 = require("path");
+var import_node_fs36 = require("fs");
+var import_node_path33 = require("path");
 init_worktree();
 init_thread_store();
 init_paths();
@@ -14370,9 +14755,9 @@ async function findOrphanWorktrees(repoPaths) {
     repoPaths?.length ? repoPaths : threads.map((t) => t.repoPath).filter(Boolean)
   );
   const homeRoot = sideboardWorkspacesDir();
-  if ((0, import_node_fs32.existsSync)(homeRoot)) {
+  if ((0, import_node_fs36.existsSync)(homeRoot)) {
     try {
-      for (const entry of (0, import_node_fs32.readdirSync)(homeRoot, { withFileTypes: true })) {
+      for (const entry of (0, import_node_fs36.readdirSync)(homeRoot, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
         void entry;
       }
@@ -14382,7 +14767,7 @@ async function findOrphanWorktrees(repoPaths) {
   const orphans = [];
   const seen = /* @__PURE__ */ new Set();
   for (const repoPath of repos) {
-    if (!repoPath || !(0, import_node_fs32.existsSync)(repoPath)) continue;
+    if (!repoPath || !(0, import_node_fs36.existsSync)(repoPath)) continue;
     try {
       const wts = await listWorktrees(repoPath);
       for (const wt of wts) {
@@ -14393,7 +14778,7 @@ async function findOrphanWorktrees(repoPaths) {
         seen.add(path2);
         let mtimeMs = 0;
         try {
-          mtimeMs = (0, import_node_fs32.statSync)(path2).mtimeMs;
+          mtimeMs = (0, import_node_fs36.statSync)(path2).mtimeMs;
         } catch {
           mtimeMs = 0;
         }
@@ -14403,16 +14788,16 @@ async function findOrphanWorktrees(repoPaths) {
     }
     try {
       const root = worktreesRoot(repoPath);
-      if ((0, import_node_fs32.existsSync)(root)) {
-        for (const entry of (0, import_node_fs32.readdirSync)(root, { withFileTypes: true })) {
+      if ((0, import_node_fs36.existsSync)(root)) {
+        for (const entry of (0, import_node_fs36.readdirSync)(root, { withFileTypes: true })) {
           if (!entry.isDirectory()) continue;
-          const path2 = (0, import_node_path28.join)(root, entry.name).replace(/\/$/, "");
+          const path2 = (0, import_node_path33.join)(root, entry.name).replace(/\/$/, "");
           if (known.has(path2) || seen.has(path2)) continue;
-          if (!(0, import_node_fs32.existsSync)((0, import_node_path28.join)(path2, ".git"))) continue;
+          if (!(0, import_node_fs36.existsSync)((0, import_node_path33.join)(path2, ".git"))) continue;
           seen.add(path2);
           let mtimeMs = 0;
           try {
-            mtimeMs = (0, import_node_fs32.statSync)(path2).mtimeMs;
+            mtimeMs = (0, import_node_fs36.statSync)(path2).mtimeMs;
           } catch {
             mtimeMs = Date.now();
           }
@@ -14558,8 +14943,8 @@ async function applyThreadIntoMain(thread, opts) {
 }
 
 // src/git/clone-repo.ts
-var import_node_fs33 = require("fs");
-var import_node_path29 = require("path");
+var import_node_fs37 = require("fs");
+var import_node_path34 = require("path");
 var import_execa6 = require("execa");
 init_paths();
 init_workspaces();
@@ -14569,12 +14954,12 @@ async function cloneRepoIntoSideboard(opts) {
   if (!url) throw new Error("Clone URL is required");
   let name = opts.name?.trim();
   if (!name) {
-    const leaf = (0, import_node_path29.basename)(url.replace(/\/$/, "").replace(/\.git$/, ""));
+    const leaf = (0, import_node_path34.basename)(url.replace(/\/$/, "").replace(/\.git$/, ""));
     name = leaf || "repo";
   }
   name = name.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "repo";
-  const dest = (0, import_node_path29.join)(sideboardReposDir(), name);
-  if ((0, import_node_fs33.existsSync)(dest)) {
+  const dest = (0, import_node_path34.join)(sideboardReposDir(), name);
+  if ((0, import_node_fs37.existsSync)(dest)) {
     const repoPath2 = await resolveRepoRoot(dest);
     const workspace2 = await ensureWorkspace(repoPath2);
     return { repoPath: repoPath2, workspace: workspace2 };
@@ -14596,8 +14981,8 @@ init_orchestrator_capable();
 
 // src/review/request-review.ts
 var import_node_crypto8 = require("crypto");
-var import_node_fs34 = require("fs");
-var import_node_path30 = require("path");
+var import_node_fs38 = require("fs");
+var import_node_path35 = require("path");
 init_global_workspace();
 init_thread_store();
 
@@ -14745,22 +15130,22 @@ function shouldRefreshReviewRequestTemplate(content) {
   return LEGACY_REVIEW_TEMPLATE_MARKERS.every((m) => trimmed.includes(m));
 }
 function readTextIfPresent(abs) {
-  if (!(0, import_node_fs34.existsSync)(abs)) return null;
+  if (!(0, import_node_fs38.existsSync)(abs)) return null;
   try {
-    const content = (0, import_node_fs34.readFileSync)(abs, "utf8");
+    const content = (0, import_node_fs38.readFileSync)(abs, "utf8");
     return content.trim() ? content : null;
   } catch {
     return null;
   }
 }
 function ensureAttachmentsGitignore(worktreePath) {
-  const gitignoreAbs = (0, import_node_path30.join)(worktreePath, ATTACHMENTS_DIR, ".gitignore");
-  if ((0, import_node_fs34.existsSync)(gitignoreAbs)) return;
-  (0, import_node_fs34.mkdirSync)((0, import_node_path30.dirname)(gitignoreAbs), { recursive: true });
-  (0, import_node_fs34.writeFileSync)(gitignoreAbs, attachmentsGitignoreBody(), "utf8");
+  const gitignoreAbs = (0, import_node_path35.join)(worktreePath, ATTACHMENTS_DIR, ".gitignore");
+  if ((0, import_node_fs38.existsSync)(gitignoreAbs)) return;
+  (0, import_node_fs38.mkdirSync)((0, import_node_path35.dirname)(gitignoreAbs), { recursive: true });
+  (0, import_node_fs38.writeFileSync)(gitignoreAbs, attachmentsGitignoreBody(), "utf8");
 }
 function resolveReviewGuidelines(worktreePath) {
-  const repoAbs = (0, import_node_path30.join)(worktreePath, REPO_REVIEW_PATH);
+  const repoAbs = (0, import_node_path35.join)(worktreePath, REPO_REVIEW_PATH);
   const repoContent = readTextIfPresent(repoAbs);
   if (repoContent) {
     return {
@@ -14770,7 +15155,7 @@ function resolveReviewGuidelines(worktreePath) {
       source: "repo"
     };
   }
-  const localAbs = (0, import_node_path30.join)(worktreePath, REVIEW_REQUEST_PATH);
+  const localAbs = (0, import_node_path35.join)(worktreePath, REVIEW_REQUEST_PATH);
   const localContent = readTextIfPresent(localAbs);
   if (localContent && !shouldRefreshReviewRequestTemplate(localContent)) {
     return {
@@ -14780,7 +15165,7 @@ function resolveReviewGuidelines(worktreePath) {
       source: "local"
     };
   }
-  const legacyAbs = (0, import_node_path30.join)(worktreePath, LEGACY_REVIEW_REQUEST_PATH);
+  const legacyAbs = (0, import_node_path35.join)(worktreePath, LEGACY_REVIEW_REQUEST_PATH);
   const legacyContent = readTextIfPresent(legacyAbs);
   if (legacyContent && !shouldRefreshReviewRequestTemplate(legacyContent)) {
     return {
@@ -14791,8 +15176,8 @@ function resolveReviewGuidelines(worktreePath) {
     };
   }
   ensureAttachmentsGitignore(worktreePath);
-  (0, import_node_fs34.mkdirSync)((0, import_node_path30.dirname)(localAbs), { recursive: true });
-  (0, import_node_fs34.writeFileSync)(localAbs, REVIEW_REQUEST_TEMPLATE, "utf8");
+  (0, import_node_fs38.mkdirSync)((0, import_node_path35.dirname)(localAbs), { recursive: true });
+  (0, import_node_fs38.writeFileSync)(localAbs, REVIEW_REQUEST_TEMPLATE, "utf8");
   return {
     path: REVIEW_REQUEST_PATH,
     name: REVIEW_REQUEST_NAME,
@@ -14801,7 +15186,7 @@ function resolveReviewGuidelines(worktreePath) {
   };
 }
 function ensureReviewRequestFile(worktreePath) {
-  const repoAbs = (0, import_node_path30.join)(worktreePath, REPO_REVIEW_PATH);
+  const repoAbs = (0, import_node_path35.join)(worktreePath, REPO_REVIEW_PATH);
   const repoContent = readTextIfPresent(repoAbs);
   if (repoContent) {
     return {
@@ -14811,10 +15196,10 @@ function ensureReviewRequestFile(worktreePath) {
       source: "repo"
     };
   }
-  const localAbs = (0, import_node_path30.join)(worktreePath, REVIEW_REQUEST_PATH);
-  const localContent = readTextIfPresent(localAbs) ?? readTextIfPresent((0, import_node_path30.join)(worktreePath, LEGACY_REVIEW_REQUEST_PATH));
+  const localAbs = (0, import_node_path35.join)(worktreePath, REVIEW_REQUEST_PATH);
+  const localContent = readTextIfPresent(localAbs) ?? readTextIfPresent((0, import_node_path35.join)(worktreePath, LEGACY_REVIEW_REQUEST_PATH));
   if (localContent && !shouldRefreshReviewRequestTemplate(localContent)) {
-    const path2 = (0, import_node_fs34.existsSync)(localAbs) ? REVIEW_REQUEST_PATH : LEGACY_REVIEW_REQUEST_PATH;
+    const path2 = (0, import_node_fs38.existsSync)(localAbs) ? REVIEW_REQUEST_PATH : LEGACY_REVIEW_REQUEST_PATH;
     return {
       path: path2,
       name: REVIEW_REQUEST_NAME,
@@ -14822,8 +15207,8 @@ function ensureReviewRequestFile(worktreePath) {
       source: "local"
     };
   }
-  (0, import_node_fs34.mkdirSync)((0, import_node_path30.dirname)(repoAbs), { recursive: true });
-  (0, import_node_fs34.writeFileSync)(repoAbs, REVIEW_REQUEST_TEMPLATE, "utf8");
+  (0, import_node_fs38.mkdirSync)((0, import_node_path35.dirname)(repoAbs), { recursive: true });
+  (0, import_node_fs38.writeFileSync)(repoAbs, REVIEW_REQUEST_TEMPLATE, "utf8");
   return {
     path: REPO_REVIEW_PATH,
     name: REPO_REVIEW_NAME,
@@ -14843,7 +15228,7 @@ function buildReviewRequestAttachment(content, opts) {
   };
 }
 function readExistingReviewRequestFile(worktreePath) {
-  return readTextIfPresent((0, import_node_path30.join)(worktreePath, REPO_REVIEW_PATH)) ?? readTextIfPresent((0, import_node_path30.join)(worktreePath, REVIEW_REQUEST_PATH)) ?? readTextIfPresent((0, import_node_path30.join)(worktreePath, LEGACY_REVIEW_REQUEST_PATH));
+  return readTextIfPresent((0, import_node_path35.join)(worktreePath, REPO_REVIEW_PATH)) ?? readTextIfPresent((0, import_node_path35.join)(worktreePath, REVIEW_REQUEST_PATH)) ?? readTextIfPresent((0, import_node_path35.join)(worktreePath, LEGACY_REVIEW_REQUEST_PATH));
 }
 async function requestReview(threadRef, send2) {
   const from = findThreadByRef(threadRef);
@@ -15104,7 +15489,7 @@ var Orchestrator = class {
         }
         continue;
       }
-      if (!(0, import_node_fs37.existsSync)(thread.worktreePath)) {
+      if (!(0, import_node_fs41.existsSync)(thread.worktreePath)) {
         setStatus(thread.id, "broken", "Worktree missing on disk");
         this.emit({ type: "status_changed", threadId: thread.id, status: "broken" });
         continue;
@@ -16196,8 +16581,9 @@ var Orchestrator = class {
     return result;
   }
   async mergePr(threadRef) {
-    const { thread, selector, cwd } = await this.withPrSelector(threadRef);
+    const { thread, selectors, cwd } = await this.withPrSelector(threadRef);
     this.assertNotGlobal(thread, "Merge PR");
+    const selector = selectors[0];
     if (!selector) throw new Error("No pull request linked to this thread");
     const result = await mergePr(cwd, selector);
     const state = normalizePrState(result.state) || "MERGED";
@@ -16217,29 +16603,34 @@ var Orchestrator = class {
     await this.persistPrMetaAndMaybeArchive(thread, metaLike);
     return { url: metaLike.url, state };
   }
-  /** Resolve PR selector and optionally persist `prUrl` when found. */
+  /** Resolve PR selectors and optionally persist `prUrl` when found. */
   async withPrSelector(threadRef) {
     const thread = this.requireThread(threadRef);
-    const selector = resolvePrSelector(thread);
+    const selectors = resolvePrSelectors(thread);
     const cwd = thread.worktreePath;
     if (!cwd?.trim()) {
       throw new Error(`Thread ${threadRef} has no worktreePath`);
     }
-    return { thread, selector, cwd };
+    return { thread, selectors, cwd };
   }
   async getPrChecks(threadRef) {
-    const { selector, cwd } = await this.withPrSelector(threadRef);
-    if (!selector) return null;
-    return getPrChecks(cwd, selector);
+    const { selectors, cwd } = await this.withPrSelector(threadRef);
+    for (const selector of selectors) {
+      const checks = await getPrChecks(cwd, selector);
+      if (checks) return checks;
+    }
+    return null;
   }
   async getPrMeta(threadRef) {
-    const { thread, selector, cwd } = await this.withPrSelector(threadRef);
-    if (!selector) return null;
-    const meta = await getPrMeta(cwd, selector);
-    if (meta) {
-      await this.persistPrMetaAndMaybeArchive(thread, meta);
+    const { thread, selectors, cwd } = await this.withPrSelector(threadRef);
+    for (const selector of selectors) {
+      const meta = await getPrMeta(cwd, selector);
+      if (meta) {
+        await this.persistPrMetaAndMaybeArchive(thread, meta);
+        return meta;
+      }
     }
-    return meta;
+    return null;
   }
   /**
    * Persist PR URL/title/state and Conductor-style auto-archive when the PR
@@ -16363,9 +16754,12 @@ var Orchestrator = class {
     return { stack: result.stack, threads: result.threads };
   }
   async getPrDetails(threadRef) {
-    const { thread, selector, cwd } = await this.withPrSelector(threadRef);
-    if (!selector) return null;
-    const details = await getPrDetails(cwd, selector);
+    const { thread, selectors, cwd } = await this.withPrSelector(threadRef);
+    let details = null;
+    for (const selector of selectors) {
+      details = await getPrDetails(cwd, selector);
+      if (details) break;
+    }
     if (details) {
       const patch = {};
       if (details.url && details.url !== thread.prUrl) patch.prUrl = details.url;
@@ -16592,7 +16986,7 @@ var Orchestrator = class {
       this.emit({ type: "status_changed", threadId: restored2.id, status: restored2.status });
       return restored2;
     }
-    if (!(0, import_node_fs37.existsSync)(thread.worktreePath)) {
+    if (!(0, import_node_fs41.existsSync)(thread.worktreePath)) {
       const { createThreadWorktree: createThreadWorktree2 } = await Promise.resolve().then(() => (init_worktree(), worktree_exports));
       const { execa: execa7 } = await import("execa");
       const slug = thread.worktreePath.split("/").pop();
@@ -16833,7 +17227,7 @@ init_coordinator_prompt();
 var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
 var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
 var import_zod3 = require("zod");
-var import_node_path33 = require("path");
+var import_node_path38 = require("path");
 init_worktree();
 init_global_workspace();
 init_list_models();
@@ -17447,6 +17841,7 @@ function registerLinearTools(server) {
 }
 
 // src/mcp/server.ts
+init_git_auth_mode();
 var MAX_ORCH_THREADS = 5;
 var CREATE_THREAD_TIMEOUT_MS = 9e4;
 function withTimeout(promise, ms, label) {
@@ -17468,6 +17863,14 @@ function withTimeout(promise, ms, label) {
 }
 async function startMcpServer() {
   const orch = getOrchestrator();
+  try {
+    await warmGithubAgentAuth();
+  } catch (err) {
+    console.error(
+      "[sideboard-mcp] GitHub agent auth warm skipped:",
+      err instanceof Error ? err.message : err
+    );
+  }
   try {
     const { maxConcurrentAgents: maxConcurrentAgents2 } = await Promise.resolve().then(() => (init_app_settings(), app_settings_exports));
     orch.setMaxConcurrent(maxConcurrentAgents2());
@@ -17511,7 +17914,7 @@ async function startMcpServer() {
     async () => {
       const threads = orch.getThreads(true);
       const lines = threads.map((t) => {
-        const repo = t.repoPath === GLOBAL_WORKSPACE_ID ? "Orchestration" : (0, import_node_path33.basename)(t.repoPath) || t.repoPath;
+        const repo = t.repoPath === GLOBAL_WORKSPACE_ID ? "Orchestration" : (0, import_node_path38.basename)(t.repoPath) || t.repoPath;
         return `${t.id.slice(0, 8)}  ${t.status.padEnd(9)}  ${t.agent.padEnd(8)}  ${repo}  ${t.sourceType}:${t.sourceRef}  ${t.title}  sideboard://thread/${t.id}${t.devPort ? `  http://localhost:${t.devPort}` : ""}`;
       });
       return {
@@ -17574,7 +17977,7 @@ async function startMcpServer() {
   );
   server.tool(
     "ask_user",
-    "Ask the user clarifying multiple-choice questions in Sideboard\u2019s composer (any mode \u2014 not only Plan). Before calling, write a short chat message explaining the decision and what each option means. Include a description on every option. Use when the user should pick from predefined options (approach forks, requirements, which API) \u2014 not for \u201Cis the plan ready?\u201D. After calling, stop and wait for their next message with answers.",
+    "Ask the user a clarifying multiple-choice question in Sideboard\u2019s composer. Call only when work is blocked on choosing among a few concrete options (approach fork, which API, auth vs cookies). Do not call for greetings, check-ins, \u201Chello\u201D, open-ended how-can-I-help, or to invent a menu of possible next tasks \u2014 reply in chat instead. If one option is the obvious default, proceed without asking. Before calling, write a short chat message explaining the decision and what each option means. Include a description on every option. After calling, stop and wait for answers. Not for \u201Cis the plan ready?\u201D.",
     {
       questions: import_zod3.z.array(
         import_zod3.z.object({
@@ -18819,6 +19222,76 @@ init_accounts();
 init_connected_teams();
 init_injected_mcp();
 
+// src/agents/user-mcp-config.ts
+var import_node_fs42 = require("fs");
+var import_node_os12 = require("os");
+var import_node_path39 = require("path");
+init_paths();
+init_injected_mcp();
+function userCursorMcpConfigPath() {
+  return (0, import_node_path39.join)((0, import_node_os12.homedir)(), ".cursor", "mcp.json");
+}
+function userClaudeMcpConfigPath() {
+  return (0, import_node_path39.join)((0, import_node_os12.homedir)(), ".claude.json");
+}
+function asObject(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return { ...value };
+}
+function stripElectronSpawnEnv(env) {
+  if (!env) return void 0;
+  const next = { ...env };
+  delete next.ELECTRON_RUN_AS_NODE;
+  delete next.ELECTRON_RUN_AS_NODE;
+  return Object.keys(next).length > 0 ? next : void 0;
+}
+function mergeSideboardIntoMcpServersJson(existing, sideboard) {
+  const root = asObject(existing);
+  const servers = asObject(root.mcpServers);
+  const env = stripElectronSpawnEnv(sideboard.env);
+  servers.sideboard = {
+    command: sideboard.command,
+    ...sideboard.args && sideboard.args.length > 0 ? { args: sideboard.args } : {},
+    ...env ? { env } : {}
+  };
+  return { ...root, mcpServers: servers };
+}
+function writeMergedMcpServersJson(configPath, sideboard) {
+  let existing = {};
+  if ((0, import_node_fs42.existsSync)(configPath)) {
+    try {
+      existing = JSON.parse((0, import_node_fs42.readFileSync)(configPath, "utf8"));
+    } catch {
+      existing = {};
+    }
+  }
+  const next = mergeSideboardIntoMcpServersJson(existing, sideboard);
+  (0, import_node_fs42.mkdirSync)((0, import_node_path39.dirname)(configPath), { recursive: true });
+  (0, import_node_fs42.writeFileSync)(configPath, `${JSON.stringify(next, null, 2)}
+`);
+}
+function launchFromResolved(server) {
+  return {
+    command: server.command,
+    args: server.args,
+    env: {
+      ...server.env ?? {},
+      SIDEBOARD_APP_DATA: appDataDir()
+    }
+  };
+}
+async function registerPackagedUserMcpClients() {
+  const launch = launchFromResolved(await resolveSideboardMcpServer());
+  const cursor = userCursorMcpConfigPath();
+  writeMergedMcpServersJson(cursor, launch);
+  const claude = userClaudeMcpConfigPath();
+  if ((0, import_node_fs42.existsSync)(claude)) {
+    writeMergedMcpServersJson(claude, launch);
+    return { cursor, claude };
+  }
+  return { cursor };
+}
+
 // src/slack/oauth.ts
 var import_node_crypto10 = require("crypto");
 init_app_settings();
@@ -20125,9 +20598,9 @@ var import_node_http3 = require("http");
 var import_ws3 = require("ws");
 
 // src/slack/relay-static.ts
-var import_node_fs38 = require("fs");
+var import_node_fs43 = require("fs");
 var import_promises = require("fs/promises");
-var import_node_path34 = __toESM(require("path"), 1);
+var import_node_path40 = __toESM(require("path"), 1);
 var TYPES = {
   ".css": "text/css; charset=utf-8",
   ".html": "text/html; charset=utf-8",
@@ -20158,9 +20631,9 @@ function resolveStaticPath(root, requestUrl) {
     return null;
   }
   if (!pathname.startsWith("/") || pathname.includes("\0")) return null;
-  const rootResolved = import_node_path34.default.resolve(root);
-  const candidate = import_node_path34.default.resolve(rootResolved, `.${pathname}`);
-  if (candidate !== rootResolved && !candidate.startsWith(rootResolved + import_node_path34.default.sep)) {
+  const rootResolved = import_node_path40.default.resolve(root);
+  const candidate = import_node_path40.default.resolve(rootResolved, `.${pathname}`);
+  if (candidate !== rootResolved && !candidate.startsWith(rootResolved + import_node_path40.default.sep)) {
     return null;
   }
   return candidate;
@@ -20174,7 +20647,7 @@ async function fileSize(file) {
   }
 }
 function sendFile(req, res, file, size) {
-  const ext = import_node_path34.default.extname(file).toLowerCase();
+  const ext = import_node_path40.default.extname(file).toLowerCase();
   res.writeHead(200, {
     "Content-Type": TYPES[ext] ?? "application/octet-stream",
     "Content-Length": size,
@@ -20184,7 +20657,7 @@ function sendFile(req, res, file, size) {
     res.end();
     return true;
   }
-  (0, import_node_fs38.createReadStream)(file).pipe(res);
+  (0, import_node_fs43.createReadStream)(file).pipe(res);
   return true;
 }
 async function tryServeStatic(req, res, root) {
@@ -20193,7 +20666,7 @@ async function tryServeStatic(req, res, root) {
   if (!candidate) return false;
   const direct = await fileSize(candidate);
   if (direct != null) return sendFile(req, res, candidate, direct);
-  const asIndex = import_node_path34.default.join(candidate, "index.html");
+  const asIndex = import_node_path40.default.join(candidate, "index.html");
   const indexSize = await fileSize(asIndex);
   if (indexSize != null) return sendFile(req, res, asIndex, indexSize);
   return false;
@@ -20526,6 +20999,7 @@ async function startSlackRelayServer(opts) {
   cleanupOrphanWorktrees,
   cloneRepoIntoSideboard,
   codexAdapter,
+  codexSandboxWritableRootsArgs,
   codexUnattendedGitConfigArgs,
   coerceOrchestratorAgent,
   collectTakenTeamSlugs,
@@ -20642,6 +21116,7 @@ async function startSlackRelayServer(opts) {
   getPr,
   getPrChecks,
   getPrDetails,
+  getPrForHeadBranch,
   getPrMeta,
   getPrStack,
   getRepoSetupInfo,
@@ -20678,6 +21153,7 @@ async function startSlackRelayServer(opts) {
   isCloudCoordinatorThread,
   isConductorBundledCli,
   isCursorAutoModel,
+  isDefaultishSourceRef,
   isDirty,
   isGhRateLimitError,
   isGlobalRepoPath,
@@ -20744,8 +21220,10 @@ async function startSlackRelayServer(opts) {
   maybeCompactContext,
   mcpAllowTools,
   mcpAuthWarnings,
+  mergeAgentGitAuthEnv,
   mergePr,
   mergePrStack,
+  mergeSideboardIntoMcpServersJson,
   mergeUsage,
   nextPastedTextName,
   nextThinkingEffort,
@@ -20796,6 +21274,7 @@ async function startSlackRelayServer(opts) {
   recordSlackOutboundWatch,
   refreshGitHubAuth,
   refreshSlackReplyBadges,
+  registerPackagedUserMcpClients,
   releaseCaffeinateHoldForThread,
   removeWorkspace,
   removeWorktree,
@@ -20804,9 +21283,11 @@ async function startSlackRelayServer(opts) {
   requestReview,
   requireAgent,
   resetGhStackDetectCache,
+  resetGithubAgentTokenMemo,
   resolveAgentExecutable,
   resolveAgentGitAuthEnv,
   resolveClaudeExecutable,
+  resolveCodexGitWritableRoots,
   resolveCommandBinarySync,
   resolveConductorCursorAgentId,
   resolveCursorModelId,
@@ -20823,6 +21304,7 @@ async function startSlackRelayServer(opts) {
   resolveNewThreadOptions,
   resolvePlanMarkdown,
   resolvePrSelector,
+  resolvePrSelectors,
   resolveQuotaFallbackAgent,
   resolveRepoRoot,
   resolveReviewGuidelines,
@@ -20845,6 +21327,7 @@ async function startSlackRelayServer(opts) {
   sanitizeMcpServerName,
   saveAppSettings,
   saveLinearOAuth,
+  scrubGithubTokensFromChildEnv,
   secureFileUnlocksWith,
   setCaffeinateHold,
   setHttpFetchImpl,
@@ -20915,7 +21398,10 @@ async function startSlackRelayServer(opts) {
   updateLinearIssue,
   updateOpencodeSettings,
   updateThread,
+  userClaudeMcpConfigPath,
+  userCursorMcpConfigPath,
   validateLinearApiKey,
+  warmGithubAgentAuth,
   withAgentInstructions,
   withExportedPath,
   withThreadLock,