replicas-engine 0.1.1028 → 0.1.1030

package/dist/src/{asp-host-A57BJZPM.js → asp-host-5HX6D4TL.js}

@@ -5,12 +5,12 @@ import {
   getCodexAspHost,
   restartCodexAspHost,
   restartCodexAspHostIfRunning
-} from "./chunk-DU4QTHOX.js";
-import "./chunk-OK37MIB6.js";
-import "./chunk-LY4WTFXS.js";
-import "./chunk-CFLUSFBP.js";
+} from "./chunk-27OEXGGC.js";
+import "./chunk-RVXD24D4.js";
+import "./chunk-NGZ6IR76.js";
+import "./chunk-7PXLG7IJ.js";
 import "./chunk-UZSNFLDQ.js";
-import "./chunk-BFHGBJO2.js";
+import "./chunk-5HLMUJTJ.js";
 import "./chunk-VEQXQN22.js";
 export {
   getCodexAspHost,

package/dist/src/{chunk-DU4QTHOX.js → chunk-27OEXGGC.js}

@@ -5,15 +5,15 @@ import {
   ENGINE_ENV,
   monolithRequest,
   setAgentCredentialSnapshot
-} from "./chunk-OK37MIB6.js";
+} from "./chunk-RVXD24D4.js";
 import {
   AppServerProcess,
   buildCodexAgentEnv
-} from "./chunk-LY4WTFXS.js";
+} from "./chunk-NGZ6IR76.js";
 import {
   SUBPROCESS_MAX_BUFFER,
   execFileAsync
-} from "./chunk-CFLUSFBP.js";
+} from "./chunk-7PXLG7IJ.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
@@ -28,7 +28,7 @@ import {
   listOpenAICompatibleModels,
   readOllamaAuthEnv,
   resolveOpenAICompatibleModelsUrl
-} from "./chunk-BFHGBJO2.js";
+} from "./chunk-5HLMUJTJ.js";
 
 // src/managers/codex-token-manager.ts
 import { promises as fs } from "fs";
@@ -264,7 +264,7 @@ var CodexTokenManager = class extends BaseRefreshManager {
     await this.applyCredentialUpdate(++this.credentialGeneration, async () => {
       await this.applyCredentialsResponse(data);
       setAgentCredentialSnapshot("codex", data);
-      const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-A57BJZPM.js");
+      const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-5HX6D4TL.js");
       await restartCodexAspHostIfRunning2();
     });
     await this.start(true);
@@ -285,7 +285,7 @@ var CodexTokenManager = class extends BaseRefreshManager {
       const accountChanged = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.codex?.credentialId !== data.credentialId;
       await this.applyCredentialsResponse(data);
       if (restartOnChange && (accountChanged || CODEX_AUTH_ENV_KEYS.some((key, index) => process.env[key] !== previousEnv[index]))) {
-        const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-A57BJZPM.js");
+        const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-5HX6D4TL.js");
         await restartCodexAspHostIfRunning2();
       }
       setAgentCredentialSnapshot("codex", data);

package/dist/src/{chunk-BFHGBJO2.js → chunk-5HLMUJTJ.js}

@@ -1258,7 +1258,8 @@ var sendChatMessageRequestSchema = z3.object({
   senderDisplayName: z3.string().optional(),
   senderAvatarUrl: z3.string().optional(),
   errorNotificationTarget: integrationErrorNotificationTargetSchema.optional(),
-  errorNotificationTargets: z3.array(integrationErrorNotificationTargetSchema).optional()
+  errorNotificationTargets: z3.array(integrationErrorNotificationTargetSchema).optional(),
+  streamSlackActivity: z3.boolean().optional()
 }).passthrough();
 function isChatMessageSender(value) {
   return isRecord(value) && (value.messageId === void 0 || typeof value.messageId === "string") && typeof value.senderUserId === "string" && typeof value.senderEmail === "string" && typeof value.recordedAt === "string";
@@ -1548,6 +1549,19 @@ var mcpWorkloadAuthSchema = z4.strictObject({
   type: z4.literal("workspace_identity"),
   audience: workspaceAudienceSchema
 });
+var mcpAuthSchema = z4.discriminatedUnion("type", [
+  mcpWorkloadAuthSchema,
+  z4.strictObject({ type: z4.literal("oauth") })
+]);
+var engineMcpOAuthTokenRequestSchema = z4.object({
+  environment_mcp_id: z4.string().uuid(),
+  force_refresh: z4.boolean().optional()
+});
+var engineMcpOAuthTokenResponseSchema = z4.object({
+  url: z4.string(),
+  access_token: z4.string(),
+  expires_at: z4.string().nullable()
+});
 
 // ../shared/src/runtime-env.ts
 var REPLICAS_RUNTIME_ENV_ALIASES = {
@@ -2748,15 +2762,30 @@ function createUuidFromHex(value) {
 }
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
+// ../shared/src/automations/github/index.ts
+var REVIEW_REQUESTED_EVENT = "pull_request.review_requested";
+
 // ../shared/src/automations/trigger-schemas.ts
+function getReviewerLoginsError(event, logins) {
+  const isReviewRequested = event === REVIEW_REQUESTED_EVENT;
+  if (isReviewRequested === !!logins?.some((login) => login.trim().replace(/^@+/, ""))) return null;
+  return isReviewRequested ? "The PR review requested trigger needs at least one GitHub username" : "Requested reviewers only apply to the PR review requested trigger";
+}
 var repositoryTriggerConfigSchema = z10.object({
   event: z10.string(),
   repository_ids: z10.array(z10.string().regex(UUID_RE, "must be a repository id")).optional(),
   group_pr_events: z10.boolean().optional(),
-  excluded_actors: z10.array(z10.string()).optional()
+  excluded_actors: z10.array(z10.string()).optional(),
+  reviewer_logins: z10.array(z10.string()).optional()
 });
 var cronTriggerSchema = z10.object({ type: z10.literal("cron"), config: z10.object({ schedule: z10.string(), timezone: z10.string().optional() }) });
-var githubTriggerSchema = z10.object({ type: z10.literal("github"), config: repositoryTriggerConfigSchema });
+var githubTriggerSchema = z10.object({
+  type: z10.literal("github"),
+  config: repositoryTriggerConfigSchema.superRefine((config, ctx) => {
+    const message2 = getReviewerLoginsError(config.event, config.reviewer_logins);
+    if (message2) ctx.addIssue({ code: "custom", message: message2, path: ["reviewer_logins"] });
+  })
+});
 var gitlabTriggerSchema = z10.object({ type: z10.literal("gitlab"), config: repositoryTriggerConfigSchema });
 var automationTriggerSchema = z10.discriminatedUnion("type", [
   cronTriggerSchema,
@@ -2776,7 +2805,7 @@ var createEnvironmentMcpRequestSchema = z11.object({
   transport: z11.enum(ENVIRONMENT_MCP_TRANSPORTS),
   config: z11.union([
     z11.object({ command: z11.string().min(1), args: z11.array(z11.string()).optional(), env: stringMap.optional() }),
-    z11.object({ url: z11.url(), headers: stringMap.optional(), auth: mcpWorkloadAuthSchema.optional() })
+    z11.object({ url: z11.url(), headers: stringMap.optional(), auth: mcpAuthSchema.optional() })
   ]).describe("stdio: `{ command, args, env }`. http/sse: `{ url, headers }`.")
 });
 var updateEnvironmentMcpRequestSchema = createEnvironmentMcpRequestSchema.partial();
@@ -3377,7 +3406,7 @@ Trigger shapes:
 { "type": "cron", "config": { "schedule": "0 9 * * 1-5", "timezone": "UTC" } }
 \`\`\`
 
-GitHub events: \`pull_request.opened\`, \`pull_request.synchronize\`, \`pull_request.merged\`, \`pull_request.closed\`. GitLab events: \`merge_request.opened\`, \`merge_request.updated\`, \`merge_request.merged\`, \`merge_request.closed\`. Use one trigger type family per automation and pick the code host the repositories actually live on.
+GitHub events: \`pull_request.opened\`, \`pull_request.synchronize\`, \`pull_request.review_requested\` (requires a \`reviewer_logins\` list of GitHub usernames), \`pull_request.merged\`, \`pull_request.closed\`. GitLab events: \`merge_request.opened\`, \`merge_request.updated\`, \`merge_request.merged\`, \`merge_request.closed\`. Use one trigger type family per automation and pick the code host the repositories actually live on.
 
 Test the hooks before proposing them: run the drafted warm hook and start hook scripts in this workspace (from \`~/workspaces\`) and fix the earliest failure until both exit 0 on a second run.
 
@@ -6456,6 +6485,11 @@ function parseClaudeEvents(events, parentToolUseId) {
   const completedStreamIds = /* @__PURE__ */ new Set();
   const supersededStreamIds = /* @__PURE__ */ new Set();
   let liveStreamId = null;
+  const endStreamingTools = (exceptStreamId) => {
+    for (const streamId of streamingTools.keys()) {
+      if (streamId !== exceptStreamId) streamingTools.delete(streamId);
+    }
+  };
   let compaction;
   const assistantThinking = /* @__PURE__ */ new Map();
   const assistantTextCounts = /* @__PURE__ */ new Map();
@@ -6509,6 +6543,7 @@ function parseClaudeEvents(events, parentToolUseId) {
         supersededStreamIds.add(liveStreamId);
       }
       liveStreamId = payload.streamId;
+      endStreamingTools(payload.streamId);
       const existing = partialIndexes.get(payload.streamId) ?? {};
       if (payload.thinking && !assistantThinking.has(payload.streamId)) {
         const reasoningMessage = {
@@ -6606,6 +6641,7 @@ function parseClaudeEvents(events, parentToolUseId) {
       }
       const streamRefs = messageId ? partialIndexes.get(messageId) : void 0;
       if (messageId) {
+        endStreamingTools(messageId);
         if (liveStreamId !== null && liveStreamId !== messageId) {
           supersededStreamIds.add(liveStreamId);
         }
@@ -6720,6 +6756,7 @@ function parseClaudeEvents(events, parentToolUseId) {
         }
       });
     }
+    if (event.type === "claude-result" || event.type === CHAT_INTERRUPTED_EVENT_TYPE) endStreamingTools();
     if (compaction && (event.type === "claude-result" || event.type === CHAT_INTERRUPTED_EVENT_TYPE)) {
       compaction.status = "failed";
       compaction.completedAt = event.timestamp;
@@ -9339,6 +9376,8 @@ export {
   chatHistoryPageParamsFromQuery,
   paginateChatHistory,
   coerceBackgroundTaskPayload,
+  planItemsFromMessage,
+  getDisplayMessageActivity,
   fileContentDiff,
   skillNamesFromCommand,
   areUserMessagesWithinMatchWindow,
@@ -9358,6 +9397,7 @@ export {
   workspaceTokenRequestSchema,
   workspaceTokenResponseSchema,
   legacyWorkspaceTokenBundleSchema,
+  engineMcpOAuthTokenResponseSchema,
   SANDBOX_SKILL_DIRS,
   HISTORY_ROOT,
   HISTORY_INDEX_FILENAME,

package/dist/src/{chunk-CFLUSFBP.js → chunk-7PXLG7IJ.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   HOOK_EXEC_MAX_BUFFER_BYTES
-} from "./chunk-BFHGBJO2.js";
+} from "./chunk-5HLMUJTJ.js";
 
 // src/utils/exec.ts
 import { exec, execFile } from "child_process";

package/dist/src/{chunk-3OGTHVR4.js → chunk-ABUMJRPU.js}

@@ -5,7 +5,7 @@ import {
   extractCommandProtectionCommandText,
   isRecord,
   parseCodeHostPrUrl
-} from "./chunk-BFHGBJO2.js";
+} from "./chunk-5HLMUJTJ.js";
 
 // src/services/published-pull-request-urls.ts
 function publishedPullRequestUrls(result) {

package/dist/src/{chunk-AWQZGS2I.js → chunk-ADUHQPYR.js}

@@ -3,18 +3,18 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   monolithRequest
-} from "./chunk-OK37MIB6.js";
+} from "./chunk-RVXD24D4.js";
 import {
   SUBPROCESS_MAX_BUFFER,
   execFileAsync
-} from "./chunk-CFLUSFBP.js";
+} from "./chunk-7PXLG7IJ.js";
 import {
   extractCommandProtectionCommandText,
   findCommandProtectionGitLookups,
   findGitCommitSignals,
   findPrMergeSignals,
   parseCommandProtectionRequest
-} from "./chunk-BFHGBJO2.js";
+} from "./chunk-5HLMUJTJ.js";
 
 // src/services/command-protection-service.ts
 import { readFile, stat } from "fs/promises";

package/dist/src/{chunk-LY4WTFXS.js → chunk-NGZ6IR76.js}

@@ -3,10 +3,10 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   execFileAsync
-} from "./chunk-CFLUSFBP.js";
+} from "./chunk-7PXLG7IJ.js";
 import {
   isVersionBelow
-} from "./chunk-BFHGBJO2.js";
+} from "./chunk-5HLMUJTJ.js";
 
 // src/utils/codex-agent-env.ts
 function buildCodexAgentEnv(source = process.env) {
@@ -240,7 +240,7 @@ function getCodexModelProvider(method) {
   if (method === "foundry") return "azure";
   return method === "ollama" || method === "openai-compatible" ? "replicas_openai_compatible" : "openai";
 }
-var ENGINE_PACKAGE_VERSION = "0.1.1028";
+var ENGINE_PACKAGE_VERSION = "0.1.1030";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";

package/dist/src/{chunk-OK37MIB6.js → chunk-RVXD24D4.js}

@@ -14,7 +14,7 @@ import {
   isValidAgentProvider,
   parsePosixEnvFile,
   readReplicasRuntimeEnv
-} from "./chunk-BFHGBJO2.js";
+} from "./chunk-5HLMUJTJ.js";
 
 // src/runtime-env-loader.ts
 import { readFileSync } from "fs";

package/dist/src/command-protection-hook.js

@@ -3,13 +3,13 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   evaluateCommandProtection
-} from "./chunk-AWQZGS2I.js";
-import "./chunk-OK37MIB6.js";
-import "./chunk-CFLUSFBP.js";
+} from "./chunk-ADUHQPYR.js";
+import "./chunk-RVXD24D4.js";
+import "./chunk-7PXLG7IJ.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
-import "./chunk-BFHGBJO2.js";
+import "./chunk-5HLMUJTJ.js";
 import "./chunk-VEQXQN22.js";
 
 // src/command-protection-hook.ts

package/dist/src/headless-agent.js

@@ -7,12 +7,12 @@ import {
 import {
   AppServerProcess,
   buildCodexAgentEnv
-} from "./chunk-LY4WTFXS.js";
-import "./chunk-CFLUSFBP.js";
+} from "./chunk-NGZ6IR76.js";
+import "./chunk-7PXLG7IJ.js";
 import {
   AGENT,
   headlessAgentRequestSchema
-} from "./chunk-BFHGBJO2.js";
+} from "./chunk-5HLMUJTJ.js";
 import "./chunk-VEQXQN22.js";
 
 // src/headless-agent.ts

package/dist/src/index.js

@@ -32,7 +32,7 @@ import {
   reportCommandProtectionBlock,
   resolveDiffBase,
   runGitCommand
-} from "./chunk-AWQZGS2I.js";
+} from "./chunk-ADUHQPYR.js";
 import {
   ACCOUNT_RATE_LIMITS_UPDATED_METHOD,
   AGENT_MESSAGE_DELTA_METHOD,
@@ -57,7 +57,7 @@ import {
 } from "./chunk-P73LGPQO.js";
 import {
   publishedPullRequestUrls
-} from "./chunk-3OGTHVR4.js";
+} from "./chunk-ABUMJRPU.js";
 import {
   BaseRefreshManager,
   CodexAspAuthMethodChangedError,
@@ -71,7 +71,7 @@ import {
   refreshDelayMs,
   restartCodexAspHost,
   routineRefreshRequest
-} from "./chunk-DU4QTHOX.js";
+} from "./chunk-27OEXGGC.js";
 import {
   ENGINE_ENV,
   monolithRequest,
@@ -79,16 +79,16 @@ import {
   readRuntimeEnvFile,
   reloadEngineEnv,
   setAgentCredentialSnapshot
-} from "./chunk-OK37MIB6.js";
+} from "./chunk-RVXD24D4.js";
 import {
   AspClient,
   getCodexModelProvider
-} from "./chunk-LY4WTFXS.js";
+} from "./chunk-NGZ6IR76.js";
 import {
   SUBPROCESS_MAX_BUFFER,
   execAsync,
   execFileAsync
-} from "./chunk-CFLUSFBP.js";
+} from "./chunk-7PXLG7IJ.js";
 import {
   isRecord as isRecord2
 } from "./chunk-UZSNFLDQ.js";
@@ -218,6 +218,7 @@ import {
   detectAgentQuotaLimit,
   detectEnvironmentAuthMethod,
   detectLanguageByPath,
+  engineMcpOAuthTokenResponseSchema,
   excludeQueuedAcceptedEvents,
   extractErrorText,
   extractFinalResponse,
@@ -232,6 +233,7 @@ import {
   getClaudeModelContextWindow,
   getDefaultAgentModel,
   getDefaultOllamaModel,
+  getDisplayMessageActivity,
   getEventStreamId,
   getEventTimestampMs,
   getGitHubAccessToken,
@@ -293,6 +295,7 @@ import {
   parseMcpToolName,
   parseReplicasConfigString,
   percentage,
+  planItemsFromMessage,
   raceWithTimeout,
   readJsonlPage,
   readOllamaAuthEnv,
@@ -318,7 +321,7 @@ import {
   workspaceTokenRequestSchema,
   workspaceTokenResponseSchema,
   wrapInTag
-} from "./chunk-BFHGBJO2.js";
+} from "./chunk-5HLMUJTJ.js";
 import {
   cloneMcpConfig,
   ensureCompatibilityImports,
@@ -9636,6 +9639,41 @@ async function applyInfisicalCredentials(data, paths) {
 }
 var infisicalTokenManager = new InfisicalTokenManager();
 
+// src/token-cache.ts
+var TokenCache = class {
+  constructor(maxEntries = Infinity) {
+    this.maxEntries = maxEntries;
+  }
+  maxEntries;
+  cache = /* @__PURE__ */ new Map();
+  inflight = /* @__PURE__ */ new Map();
+  get(key, load, force = false) {
+    const cached = this.cache.get(key);
+    if (!force && cached && cached.refreshAt > Date.now()) return Promise.resolve(createSuccessResult(cached.token));
+    const inflightKey = force ? `${key}\0force` : key;
+    let pending = this.inflight.get(inflightKey);
+    if (!pending) {
+      pending = load().then((result) => {
+        this.cache.delete(key);
+        if (!result.ok) return result;
+        const oldest = this.cache.keys().next();
+        if (this.cache.size >= this.maxEntries && !oldest.done) this.cache.delete(oldest.value);
+        this.cache.set(key, result.data);
+        return createSuccessResult(result.data.token);
+      }).finally(() => this.inflight.delete(inflightKey));
+      this.inflight.set(inflightKey, pending);
+    }
+    return pending;
+  }
+};
+async function requestToken(request, path7, body, failureMessage) {
+  try {
+    return createSuccessResult(await request(path7, { body }));
+  } catch (error) {
+    return createErrorResult({ message: error instanceof Error ? error.message : failureMessage, code: 503 });
+  }
+}
+
 // src/workspace-identity-tokens.ts
 var MIN_REMAINING_MS = 5 * 60 * 1e3;
 var MAX_CACHED_AUDIENCES = 32;
@@ -9644,30 +9682,19 @@ var WorkspaceIdentityTokens = class {
     this.request = request;
   }
   request;
-  cache = /* @__PURE__ */ new Map();
-  inflight = /* @__PURE__ */ new Map();
+  tokens = new TokenCache(MAX_CACHED_AUDIENCES);
   async get(audience = WORKSPACE_IDENTITY_AUDIENCE, awsSourceIdentity = false) {
     const parsed = workspaceAudienceSchema.safeParse(audience);
     if (!parsed.success) {
       return createErrorResult({ message: parsed.error.issues[0]?.message ?? "Invalid audience", code: 400 });
     }
     const key = awsSourceIdentity ? `${audience} aws_source_identity` : audience;
-    const cached = this.cache.get(key);
-    if (cached && Date.parse(cached.expires_at) - Date.now() > MIN_REMAINING_MS) return createSuccessResult(cached);
-    let pending = this.inflight.get(key);
-    if (!pending) {
-      pending = this.mint(audience, awsSourceIdentity, key).finally(() => this.inflight.delete(key));
-      this.inflight.set(key, pending);
-    }
-    return pending;
+    return this.tokens.get(key, () => this.mint(audience, awsSourceIdentity));
   }
-  async mint(audience, awsSourceIdentity, key) {
-    let response;
-    try {
-      response = await this.request("/v1/engine/workspace-identity/token", { body: { audience, aws_source_identity: awsSourceIdentity } });
-    } catch (error) {
-      return createErrorResult({ message: error instanceof Error ? error.message : "Workspace identity request failed", code: 503 });
-    }
+  async mint(audience, awsSourceIdentity) {
+    const requested = await requestToken(this.request, "/v1/engine/workspace-identity/token", { audience, aws_source_identity: awsSourceIdentity }, "Workspace identity request failed");
+    if (!requested.ok) return requested;
+    const response = requested.data;
     if (!response.ok) {
       return createErrorResult({ message: `Workspace identity request failed: ${response.status} ${await response.text()}`, code: response.status === 400 ? 400 : 503 });
     }
@@ -9687,11 +9714,7 @@ var WorkspaceIdentityTokens = class {
         return createErrorResult({ message: "AWS source identity is unavailable from this Replicas version", code: 503 });
       }
     }
-    this.cache.delete(key);
-    const oldest = this.cache.keys().next();
-    if (this.cache.size >= MAX_CACHED_AUDIENCES && !oldest.done) this.cache.delete(oldest.value);
-    this.cache.set(key, token);
-    return createSuccessResult(token);
+    return createSuccessResult({ token, refreshAt: Date.parse(token.expires_at) - MIN_REMAINING_MS });
   }
 };
 var workspaceIdentityTokens = new WorkspaceIdentityTokens();
@@ -9729,27 +9752,85 @@ function resolveIdentityRoute(requestUrl) {
   target.search = url3.search;
   return { target, audience: decode(encodedAudience) };
 }
-function readJsonBody(request) {
+function resolveMcpOAuthRoute(requestUrl) {
+  const url3 = new URL(requestUrl, "http://127.0.0.1");
+  const [, kind, environmentMcpId, ...rest] = url3.pathname.split("/");
+  return kind === "mcp-oauth" && environmentMcpId ? { environmentMcpId, rest, search: url3.search } : null;
+}
+var MAX_MCP_OAUTH_BODY_BYTES = 10 * 1024 * 1024;
+function readBody(request, maxBytes) {
   return new Promise((resolve7) => {
     const chunks = [];
     let size = 0;
     request.on("data", (chunk) => {
       size += chunk.length;
-      if (size <= MAX_TOKEN_REQUEST_BYTES) chunks.push(chunk);
-    });
-    request.on("end", () => {
-      if (size > MAX_TOKEN_REQUEST_BYTES) return resolve7(null);
-      const text = Buffer.concat(chunks).toString("utf8").trim();
-      try {
-        resolve7(text ? JSON.parse(text) : {});
-      } catch {
-        resolve7(null);
-      }
+      if (size > maxBytes) resolve7("too_large");
+      else chunks.push(chunk);
     });
+    request.on("end", () => resolve7(Buffer.concat(chunks)));
     request.on("error", () => resolve7(null));
   });
 }
-function createIdentityProxy(tokens) {
+function forward(request, response, target, token, onResponse = (incoming) => pipeResponse(incoming, response)) {
+  const headers = { host: target.host };
+  for (const [name, value] of Object.entries(request.headers)) {
+    if (!STRIPPED_HEADERS.has(name) && !name.startsWith("x-replicas-") && value !== void 0) headers[name] = value;
+  }
+  headers.authorization = `Bearer ${token}`;
+  const upstream = (target.protocol === "https:" ? https : http).request(target, { method: request.method, headers }, onResponse);
+  upstream.on("error", () => {
+    if (!response.headersSent) response.writeHead(502);
+    response.end();
+  });
+  response.on("close", () => upstream.destroy());
+  return upstream;
+}
+function pipeResponse(incoming, response) {
+  response.writeHead(incoming.statusCode ?? 502, incoming.headers);
+  incoming.pipe(response);
+  response.on("close", () => incoming.destroy());
+}
+async function proxyMcpOAuth(request, response, tokens, route) {
+  const body = await readBody(request, MAX_MCP_OAUTH_BODY_BYTES);
+  if (body === "too_large") {
+    response.writeHead(413, { connection: "close" }).end();
+    return;
+  }
+  if (!body) {
+    response.writeHead(400).end();
+    return;
+  }
+  const send = async (forceRefresh) => {
+    const token = await tokens.get(route.environmentMcpId, forceRefresh);
+    if (!token.ok) {
+      response.writeHead(token.error.code ?? 503).end(token.error.message);
+      return;
+    }
+    const target = new URL(token.data.url);
+    if (route.rest.length) target.pathname = [target.pathname.replace(/\/$/, ""), ...route.rest].join("/");
+    target.search = route.search;
+    forward(request, response, target, token.data.access_token, (incoming) => {
+      if (incoming.statusCode === 401 && !forceRefresh) {
+        incoming.resume();
+        void send(true);
+        return;
+      }
+      pipeResponse(incoming, response);
+    }).end(body);
+  };
+  await send(false);
+}
+async function readJsonBody(request) {
+  const body = await readBody(request, MAX_TOKEN_REQUEST_BYTES);
+  if (!body || body === "too_large") return null;
+  const text = body.toString("utf8").trim();
+  try {
+    return text ? JSON.parse(text) : {};
+  } catch {
+    return null;
+  }
+}
+function createIdentityProxy(tokens, mcpOAuthTokens2) {
   return http.createServer(async (request, response) => {
     const url3 = new URL(request.url ?? "/", "http://127.0.0.1");
     if (url3.pathname === IDENTITY_TOKEN_PATH) {
@@ -9767,6 +9848,11 @@ function createIdentityProxy(tokens) {
       response.end(JSON.stringify(result.ok ? result.data : { error: result.error.message }));
       return;
     }
+    const mcpOAuthRoute = resolveMcpOAuthRoute(request.url ?? "/");
+    if (mcpOAuthRoute) {
+      await proxyMcpOAuth(request, response, mcpOAuthTokens2, mcpOAuthRoute);
+      return;
+    }
     const route = resolveIdentityRoute(request.url ?? "/");
     if (!route) {
       response.writeHead(404).end("Unknown identity route");
@@ -9777,29 +9863,46 @@ function createIdentityProxy(tokens) {
       response.writeHead(token.error.code ?? 503).end(token.error.message);
       return;
     }
-    const headers = { host: route.target.host };
-    for (const [name, value] of Object.entries(request.headers)) {
-      if (!STRIPPED_HEADERS.has(name) && !name.startsWith("x-replicas-") && value !== void 0) headers[name] = value;
-    }
-    headers.authorization = `Bearer ${token.data.token}`;
-    const upstream = (route.target.protocol === "https:" ? https : http).request(
-      route.target,
-      { method: request.method, headers },
-      (incoming) => {
-        response.writeHead(incoming.statusCode ?? 502, incoming.headers);
-        incoming.pipe(response);
-        response.on("close", () => incoming.destroy());
-      }
-    );
-    upstream.on("error", () => {
-      if (!response.headersSent) response.writeHead(502);
-      response.end();
-    });
-    response.on("close", () => upstream.destroy());
-    request.pipe(upstream);
+    request.pipe(forward(request, response, route.target, token.data.token));
   });
 }
 
+// src/mcp-oauth-tokens.ts
+var MIN_REMAINING_MS2 = 60 * 1e3;
+var MAX_CACHE_MS = 5 * 60 * 1e3;
+var McpOAuthTokens = class {
+  constructor(request = monolithRequest) {
+    this.request = request;
+  }
+  request;
+  tokens = new TokenCache();
+  get(environmentMcpId, forceRefresh = false) {
+    return this.tokens.get(environmentMcpId, () => this.fetch(environmentMcpId, forceRefresh), forceRefresh);
+  }
+  async fetch(environmentMcpId, forceRefresh) {
+    const requested = await requestToken(
+      this.request,
+      "/v1/engine/mcp-oauth/token",
+      { environment_mcp_id: environmentMcpId, force_refresh: forceRefresh },
+      "MCP OAuth token request failed"
+    );
+    if (!requested.ok) return requested;
+    const response = requested.data;
+    const data = await response.json().catch(() => null);
+    const parsed = engineMcpOAuthTokenResponseSchema.safeParse(data);
+    if (!response.ok || !parsed.success) {
+      const message = isRecord(data) && typeof data.error === "string" ? data.error : `MCP OAuth token request failed: ${response.status}`;
+      return createErrorResult({ message, code: response.ok ? 502 : response.status });
+    }
+    const remaining = parsed.data.expires_at ? Date.parse(parsed.data.expires_at) - Date.now() : Infinity;
+    return createSuccessResult({
+      token: parsed.data,
+      refreshAt: Date.now() + Math.min(Math.max(remaining - MIN_REMAINING_MS2, remaining / 2), MAX_CACHE_MS)
+    });
+  }
+};
+var mcpOAuthTokens = new McpOAuthTokens();
+
 // src/lifecycle.ts
 import { readFileSync, rmSync, writeFileSync } from "fs";
 var CLAIM_FILE = "/tmp/replicas-engine.claim";
@@ -50655,7 +50758,7 @@ data: ${JSON.stringify(payload)}
 }
 async function parseBody(req, res) {
   try {
-    const body = await readBody(req);
+    const body = await readBody2(req);
     if (!body || typeof body !== "object") {
       sendJson(res, 400, { ok: false, error: "Invalid request body" });
       return null;
@@ -50666,7 +50769,7 @@ async function parseBody(req, res) {
     return null;
   }
 }
-function readBody(req) {
+function readBody2(req) {
   return new Promise((resolve7, reject) => {
     let size = 0;
     const chunks = [];
@@ -53623,9 +53726,9 @@ function Clone2(value) {
 // ../node_modules/.bun/typebox@1.3.7/node_modules/typebox/build/value/clean/from_union.mjs
 function FromUnion9(context, type, value) {
   for (const schema of type.anyOf) {
-    const clean = FromType19(context, schema, Clone2(value));
-    if (Check2(context, schema, clean))
-      return clean;
+    const clean2 = FromType19(context, schema, Clone2(value));
+    if (Check2(context, schema, clean2))
+      return clean2;
   }
   return value;
 }
@@ -60531,6 +60634,106 @@ async function buildForkHandoff(input) {
   };
 }
 
+// src/services/chat/slack-activity-stream.ts
+var FLUSH_INTERVAL_MS = 3e3;
+var MAX_ACTIVITY_LENGTH = 300;
+var MAX_DONE_ATTEMPTS = 3;
+var sendQueue = Promise.resolve();
+var truncate = (text, max) => text.length > max ? `${text.slice(0, max - 1)}\u2026` : text;
+var clean = (text) => truncate(text.replace(/\s+/g, " ").trim(), MAX_ACTIVITY_LENGTH);
+function describeStep(message) {
+  const plan = planItemsFromMessage(message);
+  if (plan) {
+    const current = plan.find((item) => item.status === "in_progress");
+    return plan.length ? `Plan ${plan.filter((item) => item.status === "completed").length}/${plan.length}${current ? ` \xB7 ${current.text}` : ""}` : null;
+  }
+  if (message.type === "tool_call") {
+    const input = summarizeInput(message.input);
+    return input ? `${toolAction(message.tool)}: ${input}` : toolAction(message.tool);
+  }
+  const activity = getDisplayMessageActivity(message);
+  if (!activity || activity.kind === "error") return null;
+  return (activity.summary ? `${activity.title}: ${activity.summary}` : activity.title).trim().split("\n")[0];
+}
+var SlackActivityStream = class {
+  constructor(turnId, provider) {
+    this.turnId = turnId;
+    this.provider = provider;
+    this.timer = setInterval(() => this.enqueue(false), FLUSH_INTERVAL_MS);
+    this.timer.unref?.();
+  }
+  turnId;
+  provider;
+  events = [];
+  timer;
+  sent = null;
+  attempted = false;
+  dirty = false;
+  stopped = false;
+  queued = false;
+  noteEvent(event) {
+    if (event.type === CLAUDE_PARTIAL_MESSAGE_EVENT_TYPE) return;
+    const partialType = event.type === CODEX_ITEM_PARTIAL_EVENT_TYPE ? codexItemFromEvent(event)?.item.type : void 0;
+    if (partialType === "agentMessage" || partialType === "reasoning") return;
+    const streamId = getEventStreamId(event);
+    const index = streamId ? this.events.findLastIndex((previous) => getEventStreamId(previous) === streamId) : -1;
+    if (index >= 0) this.events[index] = event;
+    else this.events.push(event);
+    this.dirty = true;
+  }
+  finish() {
+    clearInterval(this.timer);
+    this.enqueue(true);
+  }
+  enqueue(done) {
+    if (!done && this.queued) return;
+    this.queued = true;
+    sendQueue = sendQueue.then(async () => {
+      this.queued = false;
+      for (let attempt = 1; !await this.flush(done) && done && attempt < MAX_DONE_ATTEMPTS; attempt++) {
+        await new Promise((resolve7) => setTimeout(resolve7, FLUSH_INTERVAL_MS));
+      }
+    }).catch((error) => console.error("[SlackActivityStream] Flush failed:", error));
+  }
+  async flush(done) {
+    if (this.stopped) return true;
+    if (done && !this.attempted) {
+      this.stopped = true;
+      return true;
+    }
+    let activity = {};
+    if (!done) {
+      if (!this.dirty) return true;
+      this.dirty = false;
+      const messages = parseDisplayMessages(this.events, this.provider);
+      const thought = messages.map((message) => message.type === "agent" || message.type === "reasoning" ? message.content : "").findLast((text) => text.trim());
+      const step = messages.map(describeStep).findLast(Boolean);
+      activity = {
+        ...thought ? { thought: clean(thought) } : {},
+        ...step ? { step: clean(step) } : {}
+      };
+      if (!activity.thought && !activity.step || JSON.stringify(activity) === this.sent) return true;
+    }
+    this.attempted = true;
+    const event = {
+      type: "slack_activity",
+      payload: { turnId: this.turnId, ...done ? { done } : activity }
+    };
+    const response = await monolithRequest("/v1/engine/webhook", { body: event, signal: AbortSignal.timeout(15e3) }).catch(() => null);
+    if (response?.status === 409) {
+      this.stopped = true;
+      return true;
+    }
+    if (!response?.ok) {
+      this.dirty = true;
+      return false;
+    }
+    this.sent = JSON.stringify(activity);
+    if (done) this.stopped = true;
+    return true;
+  }
+};
+
 // src/services/chat/chat-service.ts
 var CHATS_BACKUP_FILE = `${CHATS_FILE}.bak`;
 function createTurnMetadata(message, messageId, recordedAt) {
@@ -60993,6 +61196,9 @@ var ChatService = class {
       ...request.errorNotificationTargets ?? [],
       ...request.errorNotificationTarget ? [request.errorNotificationTarget] : []
     ];
+    if (request.streamSlackActivity && chat.persisted.parentChatId === null) {
+      chat.slackActivityMessageIds.add(result.messageId);
+    }
     if (notificationTargets.length > 0) {
       const existingTargets = chat.errorNotificationTargets.get(result.messageId) ?? [];
       chat.errorNotificationTargets.set(result.messageId, [
@@ -61135,6 +61341,7 @@ var ChatService = class {
     for (const messageId of removed) {
       chat.acceptedUserEvents.delete(messageId);
       chat.errorNotificationTargets.delete(messageId);
+      chat.slackActivityMessageIds.delete(messageId);
     }
     await this.persistAllChats().catch((error) => {
       console.error("[ChatService] Failed to persist queued-message removals:", error);
@@ -61240,6 +61447,9 @@ var ChatService = class {
         target.pendingMessageIds = [];
         target.acceptedUserEvents.clear();
       }
+      target.slackActivity?.finish();
+      target.slackActivity = null;
+      target.slackActivityMessageIds.clear();
       if (hasChatStarted(this.toSummary(target))) {
         target.persisted.deletedAt = deletedAt;
       } else {
@@ -61661,6 +61871,8 @@ var ChatService = class {
       settledProcessing: null,
       errorNotificationTargets: /* @__PURE__ */ new Map(),
       activeErrorNotificationTargets: [],
+      slackActivityMessageIds: /* @__PURE__ */ new Set(),
+      slackActivity: null,
       quotaExhaustion: null,
       lastSendRequest: null
     };
@@ -61715,6 +61927,8 @@ var ChatService = class {
     this.agentTokenUsageTracker.startTurn(context);
     chat.activeErrorNotificationTargets = chat.errorNotificationTargets.get(messageId) ?? [];
     chat.errorNotificationTargets.delete(messageId);
+    chat.slackActivity?.finish();
+    chat.slackActivity = chat.slackActivityMessageIds.delete(messageId) ? new SlackActivityStream(messageId, chat.persisted.provider) : null;
   }
   async handleTurnStarted(chatId, message) {
     const chat = this.getRuntimeChat(chatId);
@@ -61764,6 +61978,7 @@ var ChatService = class {
       });
     }
     this.agentTokenUsageTracker.noteAgentEvent(chatId, event);
+    chat.slackActivity?.noteEvent(event);
     const parentToolUseId = typeof event.payload.parent_tool_use_id === "string" ? event.payload.parent_tool_use_id : null;
     const messages = parseDisplayMessages([event], chat.persisted.provider, { filter: false, parentToolUseId });
     if (chat.hasActiveTurn) this.agentChatActivityTrackerService.noteSkillMcpCalls(chatId, messages);
@@ -61854,6 +62069,8 @@ var ChatService = class {
     }
     chat.hasActiveTurn = false;
     chat.activeMessageId = null;
+    chat.slackActivity?.finish();
+    chat.slackActivity = null;
     this.endTrackedTurn(chatId);
     const completedAt = (/* @__PURE__ */ new Date()).toISOString();
     const processing = chat.provider.getQueue().length > 0 || (chat.provider.hasActiveBackgroundTasks?.() ?? false);
@@ -64677,7 +64894,7 @@ async function startBackgroundServices(signal) {
   heartbeatService.start(bootTimeMs);
   if (!identityProxyStarted) {
     identityProxyStarted = true;
-    createIdentityProxy(workspaceIdentityTokens).on("error", (error) => console.error("[identity-proxy] failed to listen:", error)).listen(IDENTITY_PROXY_PORT, "127.0.0.1");
+    createIdentityProxy(workspaceIdentityTokens, mcpOAuthTokens).on("error", (error) => console.error("[identity-proxy] failed to listen:", error)).listen(IDENTITY_PROXY_PORT, "127.0.0.1");
   }
   for (const manager of tokenManagers.slice(1)) {
     if (signal.aborted) return;

package/dist/src/post-tool-pr-hook.js

@@ -3,13 +3,13 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   publishedPullRequestUrls
-} from "./chunk-3OGTHVR4.js";
+} from "./chunk-ABUMJRPU.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
 import {
   shouldRefreshPullRequests
-} from "./chunk-BFHGBJO2.js";
+} from "./chunk-5HLMUJTJ.js";
 import "./chunk-VEQXQN22.js";
 
 // src/services/post-tool-pr-notifier.ts

package/dist/src/subagent-mcp.js

@@ -9,7 +9,7 @@ import {
   spawnSubagentRequestSchema,
   subagentResponseSchema,
   waitSubagentRequestSchema
-} from "./chunk-BFHGBJO2.js";
+} from "./chunk-5HLMUJTJ.js";
 import "./chunk-VEQXQN22.js";
 
 // src/subagent-mcp.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.1028",
+  "version": "0.1.1030",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",