replicas-engine 0.1.1036 → 0.1.1038

package/dist/src/chunk-7HOZZI3W.js

@@ -0,0 +1,2058 @@
+#!/usr/bin/env node
+import { createRequire as __createRequire } from 'node:module';
+const require = __createRequire(import.meta.url);
+import {
+  ENGINE_ENV,
+  getCurrentBranch,
+  getOriginDefaultBranch,
+  monolithRequest,
+  readRepoHeadBranches,
+  resolveDiffBase,
+  runGitCommand,
+  setAgentCredentialSnapshot
+} from "./chunk-5TYR5GFS.js";
+import {
+  AppServerProcess,
+  buildCodexAgentEnv
+} from "./chunk-SHHV4JCC.js";
+import {
+  SUBPROCESS_MAX_BUFFER,
+  execFileAsync
+} from "./chunk-XOSNMSSU.js";
+import {
+  isRecord
+} from "./chunk-UZSNFLDQ.js";
+import {
+  CODEX_AUTH_ENV_KEYS,
+  CODEX_AUTH_ENV_KEYS_BY_METHOD,
+  CODEX_QUOTA_STATUS_EVENT_TYPE,
+  DEFAULT_CODEX_MODEL,
+  DEFAULT_HOOK_OUTPUT_PREVIEW_CHARS,
+  GIT_CREDENTIAL_HELPER_FILENAME,
+  IMAGE_MEDIA_TYPES,
+  InFlightMap,
+  SUBAGENT_MCP_SERVER_NAME,
+  SUBAGENT_MCP_TOOL_NAMES,
+  buildCodeHostPrUrl,
+  buildGitCredentialHelperScript,
+  buildOutputPreview,
+  codexAuthEnvFromResponse,
+  codexReasoningEffortForThinkingLevel,
+  createErrorResult,
+  createSuccessResult,
+  decodePathSegments,
+  detectAgentQuotaLimit,
+  fileContentDiff,
+  isGitHubUrl,
+  isSameCredential,
+  listOllamaModels,
+  listOpenAICompatibleModels,
+  normalizeCodexAspTranscriptStatus,
+  parseCodeHostPrUrl,
+  parseGitRemote,
+  readOllamaAuthEnv,
+  resolveOpenAICompatibleModelsUrl,
+  withTimeout
+} from "./chunk-MALHGZWB.js";
+
+// src/managers/codex-token-manager.ts
+import { promises as fs } from "fs";
+import path from "path";
+
+// src/managers/auth-env-transition.ts
+function applyAuthEnvTransition(params) {
+  const prevOwned = new Set(params.authKeysByMethod[params.prevMethod]);
+  for (const key of params.authKeys) {
+    const value = params.newEnvVars[key];
+    if (value !== void 0) {
+      for (const env of params.envs) {
+        env[key] = value;
+      }
+    } else if (prevOwned.has(key)) {
+      for (const env of params.envs) {
+        delete env[key];
+      }
+    }
+  }
+}
+
+// src/services/credential-fallbacks.ts
+var fallbacksByAgent = /* @__PURE__ */ new Map();
+var exhaustedByAgent = /* @__PURE__ */ new Map();
+function clearCredentialFallbacks(provider) {
+  fallbacksByAgent.delete(provider);
+  exhaustedByAgent.delete(provider);
+}
+function recordCredentialFallback(notice) {
+  fallbacksByAgent.set(notice.provider, notice);
+}
+function listCredentialFallbacks() {
+  return [...fallbacksByAgent.values()].filter((notice) => {
+    const live = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS[notice.provider];
+    if (!live) return false;
+    return notice.status === "switched" ? live.method === notice.candidateMethod && live.scope === notice.candidateScope : live.method === notice.exhaustedMethod && live.scope === notice.exhaustedScope;
+  });
+}
+function listExhaustedCredentials(provider) {
+  return [...exhaustedByAgent.get(provider)?.values() ?? []];
+}
+function routineRefreshRequest(provider) {
+  const live = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS[provider];
+  const excludeCredentials = listExhaustedCredentials(provider).filter((spent) => !live || !isSameCredential(spent, live));
+  return {
+    ...excludeCredentials.length > 0 ? { excludeCredentials } : {},
+    ...live ? { currentCredential: live } : {}
+  };
+}
+function recordExhaustedCredential(provider, credential) {
+  const spent = exhaustedByAgent.get(provider) ?? /* @__PURE__ */ new Map();
+  spent.set(`${credential.method}|${credential.scope}|${credential.credentialId ?? ""}`, credential);
+  exhaustedByAgent.set(provider, spent);
+}
+
+// src/managers/base-refresh-manager.ts
+function credentialSwapError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return createErrorResult({
+    message,
+    code: message.includes('"code":"no_credentials"') ? "no_credentials" : "refresh_failed"
+  });
+}
+function refreshDelayMs(expiresAtMs, maxMs = 5 * 60 * 1e3) {
+  const ttlMs = expiresAtMs - Date.now();
+  return Number.isFinite(ttlMs) ? Math.max(1e3, Math.min(maxMs, Math.floor(ttlMs * 0.8))) : maxMs;
+}
+var BaseRefreshManager = class {
+  constructor(managerName, intervalMs = 15 * 60 * 1e3) {
+    this.managerName = managerName;
+    this.intervalMs = intervalMs;
+    this.health = {
+      isRunning: false,
+      intervalMs: this.intervalMs,
+      lastAttemptAt: null,
+      lastSuccessAt: null,
+      lastErrorAt: null,
+      lastErrorMessage: null
+    };
+  }
+  managerName;
+  intervalMs;
+  credentialGeneration = 0;
+  credentialUpdate = Promise.resolve();
+  intervalHandle = null;
+  pendingRefresh = null;
+  health;
+  async start(skipInitialRefresh = false) {
+    if (this.intervalHandle) {
+      return;
+    }
+    const skipReason = this.getSkipReason();
+    if (skipReason) {
+      console.log(`[${this.managerName}] Skipping: ${skipReason}`);
+      return;
+    }
+    console.log(`[${this.managerName}] Starting token refresh service`);
+    this.health.isRunning = true;
+    const config = this.getRuntimeConfig();
+    if (config && !skipInitialRefresh) {
+      this.health.lastAttemptAt = (/* @__PURE__ */ new Date()).toISOString();
+      for (let attempt = 1; attempt <= 3; attempt++) {
+        try {
+          await this.doRefresh(config);
+          this.health.lastSuccessAt = (/* @__PURE__ */ new Date()).toISOString();
+          this.health.lastErrorAt = null;
+          this.health.lastErrorMessage = null;
+          break;
+        } catch (error) {
+          const message = error instanceof Error ? error.message : "Unknown error";
+          this.health.lastErrorAt = (/* @__PURE__ */ new Date()).toISOString();
+          this.health.lastErrorMessage = message;
+          if (attempt < 3) {
+            console.warn(`[${this.managerName}] Initial refresh attempt ${attempt} failed, retrying in 2s...`);
+            await new Promise((resolve) => setTimeout(resolve, 2e3));
+          } else {
+            console.error(`[${this.managerName}] Initial refresh failed after 3 attempts:`, error);
+          }
+        }
+      }
+    }
+    this.scheduleNextRefresh();
+  }
+  async swapCredentials(params) {
+    if (!this.getRuntimeConfig()) {
+      return createErrorResult({ message: `${this.managerName} has no runtime config`, code: "not_configured" });
+    }
+    try {
+      console.log(`[${this.managerName}] Fetching fresh credentials from monolith (${params.failureKind})...`);
+      const excludeCredentials = listExhaustedCredentials(params.provider);
+      await params.refresh({
+        ...excludeCredentials.length > 0 ? { excludeCredentials } : {},
+        ...params.allowedMethods ? { allowedMethods: [...params.allowedMethods] } : {}
+      });
+      if (params.isOauthNow()) {
+        this.start().catch((error) => {
+          console.error(`[${this.managerName}] Failed to restart OAuth refresh service after fallback:`, error);
+        });
+      }
+      return createSuccessResult();
+    } catch (error) {
+      console.error(`[${this.managerName}] Failed to fetch fresh credentials:`, error);
+      return credentialSwapError(error);
+    }
+  }
+  async stop() {
+    if (this.intervalHandle) clearTimeout(this.intervalHandle);
+    this.intervalHandle = null;
+    this.health.isRunning = false;
+    await this.pendingRefresh;
+    console.log(`[${this.managerName}] Stopped`);
+  }
+  getHealthStatus() {
+    return { ...this.health };
+  }
+  getSkipReason() {
+    return null;
+  }
+  getNextRefreshDelayMs() {
+    return this.intervalMs;
+  }
+  applyCredentialUpdate(generation, apply) {
+    const update = this.credentialUpdate.then(async () => {
+      if (generation !== this.credentialGeneration) throw new Error("Credential changed during refresh; retry with the current credential.");
+      await apply();
+    });
+    this.credentialUpdate = update.catch(() => {
+    });
+    return update;
+  }
+  getRuntimeConfig() {
+    if (!ENGINE_ENV.REPLICAS_WORKSPACE_ID) {
+      return null;
+    }
+    return {
+      monolithUrl: ENGINE_ENV.REPLICAS_MONOLITH_URL,
+      workspaceId: ENGINE_ENV.REPLICAS_WORKSPACE_ID,
+      engineSecret: ENGINE_ENV.REPLICAS_ENGINE_SECRET
+    };
+  }
+  scheduleNextRefresh() {
+    const delayMs = this.getNextRefreshDelayMs();
+    this.health.intervalMs = delayMs;
+    this.intervalHandle = setTimeout(async () => {
+      this.pendingRefresh = this.refreshOnce();
+      await this.pendingRefresh;
+      if (this.intervalHandle) this.scheduleNextRefresh();
+    }, delayMs);
+    console.log(`[${this.managerName}] Token refresh scheduled in ${Math.round(delayMs / 1e3)} seconds`);
+  }
+  async refreshOnce(force = false) {
+    if (!force && this.getSkipReason()) {
+      return createSuccessResult();
+    }
+    const config = this.getRuntimeConfig();
+    if (!config) return createSuccessResult();
+    this.health.lastAttemptAt = (/* @__PURE__ */ new Date()).toISOString();
+    try {
+      await this.doRefresh(config);
+      this.health.lastSuccessAt = (/* @__PURE__ */ new Date()).toISOString();
+      this.health.lastErrorAt = null;
+      this.health.lastErrorMessage = null;
+      return createSuccessResult();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      this.health.lastErrorAt = (/* @__PURE__ */ new Date()).toISOString();
+      this.health.lastErrorMessage = message;
+      console.error(`[${this.managerName}] Failed to refresh credentials:`, error);
+      return createErrorResult({ message });
+    }
+  }
+};
+
+// src/managers/codex-token-manager.ts
+var CodexAspAuthMethodChangedError = class extends Error {
+  name = "CodexAspAuthMethodChangedError";
+};
+var CodexTokenManager = class extends BaseRefreshManager {
+  constructor() {
+    super("CodexTokenManager");
+  }
+  getSkipReason() {
+    if (!ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD && ENGINE_ENV.OPENAI_API_KEY) {
+      return "OPENAI_API_KEY is set";
+    }
+    return null;
+  }
+  async doRefresh(_config) {
+    await this.refreshWithRequest(routineRefreshRequest("codex"), true);
+  }
+  async switchCredentials(data) {
+    await this.applyCredentialUpdate(++this.credentialGeneration, async () => {
+      await this.applyCredentialsResponse(data);
+      setAgentCredentialSnapshot("codex", data);
+      const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-NQA54PMC.js");
+      await restartCodexAspHostIfRunning2();
+    });
+    await this.start(true);
+  }
+  async refreshWithRequest(request, restartOnChange = false) {
+    const generation = this.credentialGeneration;
+    const previousEnv = CODEX_AUTH_ENV_KEYS.map((key) => process.env[key]);
+    console.log("[CodexTokenManager] Refreshing Codex credentials...");
+    const response = await monolithRequest("/v1/engine/codex/refresh-credentials", {
+      body: { supportsOpenAICompatibleAuth: true, ...request }
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new Error(`Credentials refresh failed: ${response.status} ${errorText}`);
+    }
+    const data = await response.json();
+    await this.applyCredentialUpdate(generation, async () => {
+      const accountChanged = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.codex?.credentialId !== data.credentialId;
+      await this.applyCredentialsResponse(data);
+      if (restartOnChange && (accountChanged || CODEX_AUTH_ENV_KEYS.some((key, index) => process.env[key] !== previousEnv[index]))) {
+        const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-NQA54PMC.js");
+        await restartCodexAspHostIfRunning2();
+      }
+      setAgentCredentialSnapshot("codex", data);
+    });
+    console.log(`[CodexTokenManager] Credentials refreshed (method=${data.type})`);
+    return data;
+  }
+  async prepareAspOauthOptions() {
+    if (ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD !== "oauth") return {};
+    const response = await this.refreshWithRequest(routineRefreshRequest("codex"));
+    if (response.type !== "oauth") return {};
+    const login = this.buildAspOauthLogin(response);
+    let credential = login.credential;
+    return {
+      chatgptAuthTokens: login.tokens,
+      refreshChatgptAuthTokens: async (params) => {
+        const refreshed = await this.refreshAspOauthCredentials(
+          credential,
+          `Codex ASP requested an external token refresh (${params.reason})`
+        );
+        if (!refreshed.ok) {
+          if (refreshed.error.code === "method_changed") {
+            throw new CodexAspAuthMethodChangedError(refreshed.error.message);
+          }
+          throw new Error(refreshed.error.message);
+        }
+        credential = refreshed.data.credential;
+        return refreshed.data.tokens;
+      }
+    };
+  }
+  async refreshAspOauthCredentials(failedCredential, failureReason) {
+    try {
+      const response = await this.refreshWithRequest({
+        failedMethod: "oauth",
+        ...failedCredential?.method === "oauth" ? { failedCredential } : {},
+        failureKind: "rejected",
+        failureReason
+      });
+      if (response.type !== "oauth") {
+        return createErrorResult({
+          message: `${failureReason}; credentials changed to ${response.type}, so the app server must restart`,
+          code: "method_changed"
+        });
+      }
+      return createSuccessResult(this.buildAspOauthLogin(response));
+    } catch (error) {
+      return credentialSwapError(error);
+    }
+  }
+  async fetchFreshCredentials(failureReason, failureKind = "rejected", failedCredential = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.codex, allowedMethods) {
+    const failedMethod = failedCredential?.method === "ollama" || failedCredential?.method === "oauth" || failedCredential?.method === "api_key" || failedCredential?.method === "openai-compatible" || failedCredential?.method === "foundry" ? failedCredential.method : ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD;
+    return this.swapCredentials({
+      provider: "codex",
+      failureKind,
+      allowedMethods,
+      refresh: async (exclusions) => {
+        await this.refreshWithRequest(
+          failedMethod === "ollama" || failedMethod === "oauth" || failedMethod === "api_key" || failedMethod === "openai-compatible" || failedMethod === "foundry" ? {
+            failedMethod,
+            ...failedCredential?.method === failedMethod ? { failedCredential } : {},
+            failureReason,
+            failureKind,
+            ...exclusions
+          } : exclusions
+        );
+      },
+      isOauthNow: () => ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "oauth"
+    });
+  }
+  async applyCredentialsResponse(response) {
+    await this.removeOauthCredentialsFile();
+    const envVars = codexAuthEnvFromResponse(response);
+    applyAuthEnvTransition({
+      prevMethod: ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD ?? "none",
+      authKeys: CODEX_AUTH_ENV_KEYS,
+      authKeysByMethod: CODEX_AUTH_ENV_KEYS_BY_METHOD,
+      newEnvVars: envVars,
+      envs: [ENGINE_ENV, process.env]
+    });
+    if (response.type === "api_key") {
+      for (const key of CODEX_AUTH_ENV_KEYS_BY_METHOD.api_key) {
+        if (envVars[key] !== void 0) continue;
+        delete ENGINE_ENV[key];
+        delete process.env[key];
+      }
+    }
+  }
+  buildAspOauthLogin(response) {
+    const credential = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.codex;
+    return {
+      tokens: {
+        accessToken: response.accessToken,
+        chatgptAccountId: response.accountId,
+        chatgptPlanType: null
+      },
+      ...credential?.method === "oauth" ? { credential } : {}
+    };
+  }
+  async removeOauthCredentialsFile() {
+    const authPath = path.join(ENGINE_ENV.HOME_DIR, ".codex", "auth.json");
+    try {
+      await fs.unlink(authPath);
+    } catch (error) {
+      if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
+    }
+  }
+};
+var codexTokenManager = new CodexTokenManager();
+
+// src/managers/codex-asp/mappers.ts
+import { existsSync as existsSync3, readFileSync } from "fs";
+
+// src/git/service.ts
+import { readdir, readFile as readFile3, stat } from "fs/promises";
+import { spawn } from "child_process";
+import { isAbsolute, join as join3 } from "path";
+
+// src/utils/state.ts
+import { readFile as readFile2, mkdir as mkdir2 } from "fs/promises";
+import { existsSync } from "fs";
+import { join as join2 } from "path";
+import { homedir } from "os";
+
+// src/utils/file.ts
+import { randomUUID } from "crypto";
+import { mkdir, readFile, rename, unlink, writeFile } from "fs/promises";
+import { dirname, join } from "path";
+
+// src/utils/async-lock.ts
+var AsyncLock = class {
+  chain = Promise.resolve();
+  run(operation) {
+    const result = this.chain.then(operation, operation);
+    this.chain = result.then(() => void 0, () => void 0);
+    return result;
+  }
+  async drain() {
+    await this.chain;
+  }
+};
+
+// src/utils/file.ts
+async function atomicWriteFile(path2, data, options) {
+  const tmpFile = `${path2}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(tmpFile, data, { encoding: "utf-8", mode: options?.mode });
+    await rename(tmpFile, path2);
+  } catch (error) {
+    await unlink(tmpFile).catch(() => void 0);
+    throw error;
+  }
+}
+async function writeSecureCredentialFile(filePath, content, options) {
+  if (options?.ensureParentDir) {
+    await mkdir(dirname(filePath), { recursive: true, mode: 448 });
+  }
+  await atomicWriteFile(filePath, content, { mode: 384 });
+}
+async function configureManagedGitCredentialHelper(homeDir) {
+  const credentialsPath = join(homeDir, ".git-credentials");
+  const helperPath = join(homeDir, GIT_CREDENTIAL_HELPER_FILENAME);
+  await atomicWriteFile(helperPath, buildGitCredentialHelperScript(credentialsPath), { mode: 448 });
+  await execFileAsync("git", ["config", "--global", "credential.helper", helperPath], {
+    env: { ...process.env, HOME: homeDir }
+  });
+  await execFileAsync("git", ["config", "--global", "credential.https://github.com.useHttpPath", "true"], {
+    env: { ...process.env, HOME: homeDir }
+  });
+}
+var credentialFileLock = new AsyncLock();
+function upsertCredentialFileLines(filePath, hosts, lines) {
+  return credentialFileLock.run(async () => {
+    let existing = [];
+    try {
+      existing = (await readFile(filePath, "utf-8")).split("\n").filter(Boolean);
+    } catch {
+      existing = [];
+    }
+    const kept = existing.filter((line) => !hosts.some((host) => line.endsWith(`@${host}`) || line.includes(`@${host}/`)));
+    await writeSecureCredentialFile(filePath, [...lines, ...kept, ""].join("\n"));
+  });
+}
+function removeCredentialFileLines(filePath, shouldRemove) {
+  return credentialFileLock.run(async () => {
+    let existing = [];
+    try {
+      existing = (await readFile(filePath, "utf-8")).split("\n").filter(Boolean);
+    } catch {
+      return;
+    }
+    const kept = existing.filter((line) => !shouldRemove(line));
+    await writeSecureCredentialFile(filePath, [...kept, ""].join("\n"));
+  });
+}
+
+// src/utils/state.ts
+var STATE_DIR = join2(homedir(), ".replicas");
+var STATE_FILE = join2(STATE_DIR, "engine-state.json");
+var DEFAULT_STATE = {
+  repos: {},
+  removedRepos: {}
+};
+var stateWriteLock = new AsyncLock();
+async function updateEngineState(updater) {
+  return stateWriteLock.run(async () => {
+    await mkdir2(STATE_DIR, { recursive: true });
+    const currentState = await loadEngineState();
+    const nextState = updater(currentState);
+    await atomicWriteFile(STATE_FILE, JSON.stringify(nextState, null, 2));
+    return nextState;
+  });
+}
+function isEngineRepoDiff(value) {
+  return isRecord(value) && typeof value.added === "number" && typeof value.removed === "number";
+}
+function coerceRepoState(value) {
+  if (!isRecord(value)) {
+    return null;
+  }
+  if (typeof value.name !== "string") return null;
+  if (typeof value.path !== "string") return null;
+  if (typeof value.defaultBranch !== "string") return null;
+  if (typeof value.currentBranch !== "string") return null;
+  if (!Array.isArray(value.prUrls)) return null;
+  const prUrls = [];
+  for (const entry of value.prUrls) {
+    if (typeof entry !== "string") return null;
+    if (!prUrls.includes(entry)) prUrls.push(entry);
+  }
+  if (!(value.gitDiff === null || isEngineRepoDiff(value.gitDiff))) return null;
+  if (typeof value.startHooksCompleted !== "boolean") return null;
+  return {
+    name: value.name,
+    path: value.path,
+    defaultBranch: value.defaultBranch,
+    currentBranch: value.currentBranch,
+    prUrls,
+    gitDiff: value.gitDiff,
+    startHooksCompleted: value.startHooksCompleted
+  };
+}
+function coerceEngineState(value) {
+  if (!isRecord(value)) {
+    return {};
+  }
+  const partial = {};
+  for (const key of ["repos", "removedRepos"]) {
+    const entries = value[key];
+    if (!isRecord(entries)) continue;
+    const repos = {};
+    for (const [repoName, repoState] of Object.entries(entries)) {
+      const coerced = coerceRepoState(repoState);
+      if (coerced) {
+        repos[repoName] = coerced;
+      }
+    }
+    partial[key] = repos;
+  }
+  return partial;
+}
+async function loadEngineState() {
+  try {
+    if (!existsSync(STATE_FILE)) {
+      return { ...DEFAULT_STATE };
+    }
+    const content = await readFile2(STATE_FILE, "utf-8");
+    const state = coerceEngineState(JSON.parse(content));
+    return {
+      ...DEFAULT_STATE,
+      ...state,
+      repos: state.repos ?? {},
+      removedRepos: state.removedRepos ?? {}
+    };
+  } catch (error) {
+    console.error("[EngineState] Failed to load state, using defaults:", error);
+    return { ...DEFAULT_STATE };
+  }
+}
+async function loadRepoState(repoName) {
+  const state = await loadEngineState();
+  return state.repos[repoName] ?? null;
+}
+async function saveRepoState(repoName, state, fallbackState) {
+  const updated = await updateEngineState((currentState) => {
+    const currentRepoState = currentState.repos[repoName] ?? fallbackState;
+    return {
+      ...currentState,
+      repos: {
+        ...currentState.repos,
+        [repoName]: {
+          ...currentRepoState,
+          ...state,
+          // Publication events and repository refreshes can finish in either order.
+          prUrls: [.../* @__PURE__ */ new Set([...currentRepoState.prUrls, ...state.prUrls ?? []])]
+        }
+      }
+    };
+  });
+  return updated.repos[repoName];
+}
+async function markRepoRemoved(repoName) {
+  await updateEngineState((currentState) => {
+    const { [repoName]: removed, ...repos } = currentState.repos;
+    if (!removed) return currentState;
+    return { ...currentState, repos, removedRepos: { ...currentState.removedRepos, [repoName]: removed } };
+  });
+}
+
+// src/git/service.ts
+var FULL_DIFF_MAX_BUFFER = 50 * 1024 * 1024;
+var MAX_DIFF_FILE_BYTES = 1024 * 1024;
+var MAX_UNTRACKED_DIFF_BYTES = 10 * 1024 * 1024;
+var UNTRACKED_STAT_CONCURRENCY = 64;
+var BIG_FILE_THRESHOLD_CONFIG = ["-c", `core.bigFileThreshold=${MAX_DIFF_FILE_BYTES}`];
+function appendUniqueUrl(urls, url) {
+  return urls.includes(url) ? urls : [...urls, url];
+}
+var GitService = class {
+  defaultBranchCache = /* @__PURE__ */ new Map();
+  cachedPrByRepo = /* @__PURE__ */ new Map();
+  // An 'unknown' result usually means the origin isn't wired up yet during provisioning, so caching it would permanently mask a remote added moments later.
+  originInfoCache = /* @__PURE__ */ new Map();
+  // A scratch path can be re-cloned from another repository between two polls, which only its origin reveals.
+  trackedCloneOrigins = /* @__PURE__ */ new Map();
+  // Broadcaster + UI /repos requests fan in here every ~2s; one shared run.
+  listReposInFlight = new InFlightMap();
+  diffStatsInFlight = new InFlightMap();
+  fullDiffInFlight = new InFlightMap();
+  getWorkspaceRoot() {
+    return ENGINE_ENV.WORKSPACE_ROOT;
+  }
+  async listRepositories() {
+    return (await this.listRepositoriesWithCompleteness()).repos;
+  }
+  async listRepositoriesWithCompleteness() {
+    const root = this.getWorkspaceRoot();
+    const rootStat = await this.safeStat(root);
+    if (!rootStat?.isDirectory()) {
+      return { repos: [], complete: false };
+    }
+    const entries = await readdir(root);
+    const repos = [];
+    let complete = true;
+    for (const entry of entries) {
+      const fullPath = join3(root, entry);
+      try {
+        const entryStat = await stat(fullPath);
+        if (!entryStat.isDirectory()) {
+          continue;
+        }
+        const hasGit = Boolean(await this.safeStat(join3(fullPath, ".git")));
+        if (!hasGit) {
+          continue;
+        }
+        repos.push({
+          name: entry,
+          path: fullPath,
+          defaultBranch: await this.resolveDefaultBranch(fullPath)
+        });
+      } catch {
+        complete = false;
+      }
+    }
+    return { repos: repos.sort((a, b) => a.name.localeCompare(b.name)), complete };
+  }
+  async listTrackedRepositories() {
+    const [discovered, state] = await Promise.all([this.listRepositoriesWithCompleteness(), loadEngineState()]);
+    const repos = [...discovered.repos];
+    const removed = new Map(Object.entries(state.removedRepos));
+    for (const repo of Object.values(state.repos)) {
+      if (!isAbsolute(repo.name)) continue;
+      const exists = Boolean(await this.safeStat(join3(repo.path, ".git")));
+      const origin = exists ? (await readFile3(join3(repo.path, ".git", "config"), "utf-8").catch(() => "")).match(/\[remote "origin"\][^[]*?\burl\s*=\s*(\S+)/)?.[1] ?? null : null;
+      const known = this.trackedCloneOrigins.has(repo.path) ? this.trackedCloneOrigins.get(repo.path) : origin;
+      if (exists && origin === known) {
+        this.trackedCloneOrigins.set(repo.path, origin);
+        repos.push({ name: repo.name, path: repo.path, defaultBranch: await this.resolveDefaultBranch(repo.path) });
+      } else {
+        this.trackedCloneOrigins.delete(repo.path);
+        this.defaultBranchCache.delete(repo.path);
+        this.originInfoCache.delete(repo.path);
+        this.cachedPrByRepo.delete(repo.name);
+        await markRepoRemoved(repo.name);
+        removed.set(repo.name, repo);
+      }
+    }
+    const deleted = [...removed.values()].filter((repo) => !repos.some((live) => live.name === repo.name)).map((repo) => ({ ...repo, gitDiff: { added: 0, removed: 0 } }));
+    return { repos, deleted, complete: discovered.complete };
+  }
+  async findTrackedRepository(name) {
+    return (await this.listTrackedRepositories()).repos.find((repo) => repo.name === name);
+  }
+  async trackPushedRepository(worktree) {
+    const commonDir = await runGitCommand(["rev-parse", "--path-format=absolute", "--git-common-dir"], worktree).catch(() => null);
+    if (!commonDir) return false;
+    const { repos } = await this.listTrackedRepositories();
+    if (repos.some((repo) => repo.path === worktree || join3(repo.path, ".git") === commonDir)) return false;
+    const defaultBranch = await this.resolveDefaultBranch(worktree);
+    await saveRepoState(worktree, {}, {
+      name: worktree,
+      path: worktree,
+      defaultBranch,
+      currentBranch: await getCurrentBranch(worktree) ?? defaultBranch,
+      prUrls: [],
+      gitDiff: null,
+      startHooksCompleted: true
+    });
+    return true;
+  }
+  async listRepos(options) {
+    return (await this.listReposWithCompleteness(options)).repos;
+  }
+  async listReposWithCompleteness(options) {
+    const includeDiffs = options?.includeDiffs === true;
+    const key = includeDiffs ? "diffs" : "base";
+    return this.listReposInFlight.run(key, () => this.computeListRepos(includeDiffs));
+  }
+  async computeListRepos(includeDiffs) {
+    const discovered = await this.listTrackedRepositories();
+    const states = [];
+    let complete = discovered.complete;
+    for (const repo of discovered.repos) {
+      try {
+        const [persistedState, currentBranchRaw, gitDiff, codeHost] = await Promise.all([
+          loadRepoState(repo.name),
+          getCurrentBranch(repo.path),
+          this.getGitDiffStats(repo.path, repo.defaultBranch),
+          this.resolveCodeHost(repo.path)
+        ]);
+        const currentBranch = currentBranchRaw ?? repo.defaultBranch;
+        const fullDiff = includeDiffs && gitDiff ? await this.getFullGitDiff(repo.path, repo.defaultBranch) : void 0;
+        if (gitDiff === null) complete = false;
+        if (fullDiff === null) complete = false;
+        states.push({
+          name: repo.name,
+          path: repo.path,
+          defaultBranch: repo.defaultBranch,
+          currentBranch,
+          prUrls: persistedState?.prUrls ?? [],
+          gitDiff: includeDiffs && gitDiff ? { ...gitDiff, ...fullDiff === null ? {} : { fullDiff } } : gitDiff,
+          startHooksCompleted: persistedState?.startHooksCompleted ?? false,
+          ...codeHost
+        });
+      } catch {
+        complete = false;
+      }
+    }
+    return { repos: [...states, ...discovered.deleted], complete };
+  }
+  async refreshRepos(observedBranchesByRepo, options) {
+    return (await this.refreshReposWithCompleteness(observedBranchesByRepo, options)).repos;
+  }
+  async refreshReposWithCompleteness(observedBranchesByRepo, options) {
+    const discovered = await this.listTrackedRepositories();
+    const states = [];
+    let complete = discovered.complete;
+    for (const repo of discovered.repos) {
+      try {
+        const persistedState = await loadRepoState(repo.name);
+        const currentBranch = await getCurrentBranch(repo.path) ?? repo.defaultBranch;
+        const startHooksCompleted = persistedState?.startHooksCompleted ?? false;
+        const observed = /* @__PURE__ */ new Set([
+          ...readRepoHeadBranches(repo.path),
+          ...observedBranchesByRepo?.get(repo.name) ?? []
+        ]);
+        const state = await this.refreshRepoMetadata(
+          repo,
+          currentBranch,
+          startHooksCompleted,
+          persistedState,
+          observed,
+          options?.includeDiffs === true
+        );
+        if (state.gitDiff === null || options?.includeDiffs === true && state.gitDiff.fullDiff === void 0) {
+          complete = false;
+        }
+        states.push(state);
+      } catch {
+        complete = false;
+      }
+    }
+    return { repos: [...states, ...discovered.deleted], complete };
+  }
+  async snapshotCurrentBranches() {
+    const { repos } = await this.listTrackedRepositories();
+    return new Map(repos.map((repo) => [repo.name, readRepoHeadBranches(repo.path)]));
+  }
+  async recordPublishedPullRequest(prUrl) {
+    if (!URL.canParse(prUrl)) return false;
+    const parsed = parseCodeHostPrUrl(prUrl);
+    if (!parsed || !Number.isSafeInteger(parsed.number) || parsed.number <= 0) return false;
+    const url = new URL(prUrl);
+    if (url.host.toLowerCase() !== parsed.host || !["https:", "http:"].includes(url.protocol)) return false;
+    const canonicalUrl = buildCodeHostPrUrl(parsed.repoUrl, parsed.provider, parsed.number);
+    const { repos } = await this.listTrackedRepositories();
+    for (const repo of repos) {
+      const remote = parseGitRemote(await runGitCommand(["remote", "get-url", "origin"], repo.path).catch(() => ""));
+      if (!remote || remote.host !== parsed.host) continue;
+      const sameRepository = parsed.provider === "github" ? remote.path.toLowerCase() === parsed.repositoryPath.toLowerCase() : remote.path === parsed.repositoryPath;
+      if (!sameRepository) continue;
+      await saveRepoState(repo.name, { prUrls: [canonicalUrl] }, {
+        ...repo,
+        currentBranch: await getCurrentBranch(repo.path) ?? repo.defaultBranch,
+        prUrls: [],
+        gitDiff: null,
+        startHooksCompleted: false
+      });
+      return true;
+    }
+    return false;
+  }
+  getGitDiffStats(repoPath, defaultBranch) {
+    return this.diffStatsInFlight.run(repoPath, async () => {
+      try {
+        const diffBase = await resolveDiffBase(repoPath, defaultBranch);
+        const shortstat = await runGitCommand([...BIG_FILE_THRESHOLD_CONFIG, "diff", diffBase, "--shortstat", "-M"], repoPath);
+        let added = 0;
+        let removed = 0;
+        const addedMatch = shortstat.match(/(\d+) insertion/);
+        const removedMatch = shortstat.match(/(\d+) deletion/);
+        if (addedMatch) {
+          added = parseInt(addedMatch[1], 10);
+        }
+        if (removedMatch) {
+          removed = parseInt(removedMatch[1], 10);
+        }
+        added += await this.countUntrackedAddedLines(repoPath);
+        return {
+          added,
+          removed
+        };
+      } catch (error) {
+        console.warn(`[GitService] getGitDiffStats failed for ${repoPath} (defaultBranch=${defaultBranch}):`, error instanceof Error ? error.message : error);
+        return null;
+      }
+    });
+  }
+  async listUntrackedFiles(repoPath) {
+    const { stdout } = await execFileAsync("git", ["ls-files", "--others", "--exclude-standard", "-z"], {
+      cwd: repoPath,
+      encoding: "utf-8",
+      maxBuffer: SUBPROCESS_MAX_BUFFER
+    });
+    const paths = stdout.split("\0").filter(Boolean);
+    const files = [];
+    for (let i = 0; i < paths.length; i += UNTRACKED_STAT_CONCURRENCY) {
+      const batch = await Promise.all(paths.slice(i, i + UNTRACKED_STAT_CONCURRENCY).map(async (path2) => {
+        try {
+          return { path: path2, size: (await stat(join3(repoPath, path2))).size };
+        } catch {
+          return null;
+        }
+      }));
+      files.push(...batch.filter((file) => file !== null));
+    }
+    let remainingBytes = MAX_UNTRACKED_DIFF_BYTES;
+    return files.map(({ path: path2, size }) => {
+      const tooLarge = size > MAX_DIFF_FILE_BYTES || size > remainingBytes;
+      if (!tooLarge) remainingBytes -= size;
+      return { path: path2, tooLarge };
+    });
+  }
+  async getUntrackedDiff(repoPath) {
+    const files = await this.listUntrackedFiles(repoPath);
+    const largeFilesDiff = files.filter((file) => file.tooLarge).map(({ path: path2 }) => {
+      const quote = (prefixed) => /[\x00-\x1f"\\]/.test(prefixed) ? JSON.stringify(prefixed) : prefixed;
+      return `diff --git ${quote(`a/${path2}`)} ${quote(`b/${path2}`)}
+new file mode 100644
+Binary files /dev/null and ${quote(`b/${path2}`)} differ
+`;
+    }).join("");
+    const paths = files.filter((file) => !file.tooLarge).map((file) => file.path);
+    if (paths.length === 0) return largeFilesDiff;
+    try {
+      await execFileAsync("git", ["add", "--intent-to-add", "--", ...paths], {
+        cwd: repoPath,
+        maxBuffer: SUBPROCESS_MAX_BUFFER
+      });
+      return await this.readUntrackedDiff(repoPath, paths) + largeFilesDiff;
+    } finally {
+      try {
+        await execFileAsync("git", ["reset", "--", ...paths], {
+          cwd: repoPath,
+          maxBuffer: SUBPROCESS_MAX_BUFFER
+        });
+      } catch {
+      }
+    }
+  }
+  readUntrackedDiff(repoPath, paths) {
+    return new Promise((resolve) => {
+      const child = spawn("git", ["diff", "--", ...paths], {
+        cwd: repoPath,
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      const chunks = [];
+      let total = 0;
+      let truncated = false;
+      child.stdout.on("data", (chunk) => {
+        if (truncated) return;
+        total += chunk.length;
+        if (total > FULL_DIFF_MAX_BUFFER) {
+          truncated = true;
+          chunks.push(chunk.subarray(0, Math.max(0, FULL_DIFF_MAX_BUFFER - (total - chunk.length))));
+          child.kill("SIGTERM");
+          return;
+        }
+        chunks.push(chunk);
+      });
+      child.stderr.on("data", () => {
+      });
+      child.on("error", () => resolve(""));
+      child.on("close", (code) => {
+        if (code === 0 || code === 1 || truncated) {
+          resolve(Buffer.concat(chunks).toString("utf-8"));
+        } else {
+          resolve("");
+        }
+      });
+    });
+  }
+  async countUntrackedAddedLines(repoPath) {
+    try {
+      const files = await this.listUntrackedFiles(repoPath);
+      let total = 0;
+      for (const { path: path2, tooLarge } of files) {
+        if (tooLarge) continue;
+        try {
+          const contents = await readFile3(join3(repoPath, path2));
+          if (contents.length === 0 || contents.includes(0)) {
+            continue;
+          }
+          let lines = 0;
+          for (let index = contents.indexOf(10); index !== -1; index = contents.indexOf(10, index + 1)) {
+            lines += 1;
+          }
+          total += lines + (contents[contents.length - 1] === 10 ? 0 : 1);
+        } catch {
+        }
+      }
+      return total;
+    } catch (error) {
+      console.error("Error counting untracked added lines:", error);
+      return 0;
+    }
+  }
+  getFullGitDiff(repoPath, defaultBranch) {
+    return this.fullDiffInFlight.run(repoPath, async () => {
+      try {
+        const diffBase = await resolveDiffBase(repoPath, defaultBranch);
+        const { stdout: trackedDiff } = await execFileAsync("git", [...BIG_FILE_THRESHOLD_CONFIG, "diff", diffBase, "-M", "-C"], {
+          cwd: repoPath,
+          encoding: "utf-8",
+          maxBuffer: FULL_DIFF_MAX_BUFFER
+        });
+        const untrackedDiff = await this.getUntrackedAsDiff(repoPath);
+        return trackedDiff + untrackedDiff;
+      } catch {
+        return null;
+      }
+    });
+  }
+  async getUntrackedAsDiff(repoPath) {
+    try {
+      return await this.getUntrackedDiff(repoPath);
+    } catch (error) {
+      console.error("Error building untracked diff:", error);
+      return "";
+    }
+  }
+  async getPullRequestUrl(repoName, repoPath, currentBranchArg, persistedRepoStateArg) {
+    try {
+      const currentBranch = currentBranchArg ?? await getCurrentBranch(repoPath);
+      if (!currentBranch) {
+        return { status: "not_found" };
+      }
+      const cachedPr = this.cachedPrByRepo.get(repoName);
+      if (cachedPr && cachedPr.currentBranch === currentBranch) {
+        return { status: "found", url: cachedPr.prUrl };
+      }
+      const persistedRepoState = persistedRepoStateArg ?? await loadRepoState(repoName);
+      this.cachedPrByRepo.delete(repoName);
+      const result = await this.lookupPrOnRemote(repoName, repoPath, currentBranch);
+      if (result.status === "found") {
+        this.cachedPrByRepo.set(repoName, { prUrl: result.url, currentBranch });
+        if (persistedRepoState && !persistedRepoState.prUrls.includes(result.url)) {
+          await saveRepoState(
+            repoName,
+            { prUrls: appendUniqueUrl(persistedRepoState.prUrls, result.url) },
+            persistedRepoState
+          );
+        }
+      }
+      return result;
+    } catch (error) {
+      console.error("Error checking for pull request:", error);
+      return { status: "error" };
+    }
+  }
+  async lookupPrOnRemote(repoName, repoPath, branch) {
+    const origin = await this.getOriginInfo(repoPath);
+    if (origin.provider === "unknown") {
+      return { status: "not_found" };
+    }
+    try {
+      const { stdout } = await execFileAsync("git", ["ls-remote", "--heads", "origin", branch], {
+        cwd: repoPath,
+        encoding: "utf-8",
+        maxBuffer: SUBPROCESS_MAX_BUFFER
+      });
+      if (!stdout.trim()) {
+        return { status: "not_found" };
+      }
+    } catch {
+      return { status: "error" };
+    }
+    if (origin.provider === "gitlab") {
+      return this.lookupGitLabMrOnRemote(repoName, origin.gitLab, branch);
+    }
+    try {
+      const { stdout } = await execFileAsync("gh", ["pr", "view", branch, "--json", "url", "--jq", ".url"], {
+        cwd: repoPath,
+        encoding: "utf-8",
+        maxBuffer: SUBPROCESS_MAX_BUFFER
+      });
+      const prInfo = stdout.trim();
+      return prInfo ? { status: "found", url: prInfo } : { status: "not_found" };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.warn(`[GitService] gh pr view ${branch} failed for ${repoName}: ${message}`);
+      return { status: "error" };
+    }
+  }
+  async lookupGitLabMrOnRemote(repoName, remote, branch) {
+    const token = await this.getGitLabAccessToken(remote.host);
+    if (!token) {
+      return { status: "not_found" };
+    }
+    const url = `${remote.instanceUrl}/api/v4/projects/${encodeURIComponent(remote.projectPath)}/merge_requests?source_branch=${encodeURIComponent(branch)}&order_by=updated_at`;
+    try {
+      const response = await fetch(url, {
+        headers: { Authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(1e4)
+      });
+      if (!response.ok) {
+        console.warn(`[GitService] GitLab MR lookup failed for ${repoName}: ${response.status}`);
+        return response.status === 404 ? { status: "not_found" } : { status: "error" };
+      }
+      const data = await response.json();
+      if (!Array.isArray(data)) return { status: "not_found" };
+      const branchMatches = data.filter((item) => isRecord(item) && item.source_branch === branch);
+      const mergeRequest = branchMatches.find((item) => item.state === "opened") ?? branchMatches[0];
+      if (!isRecord(mergeRequest)) return { status: "not_found" };
+      const webUrl = mergeRequest.web_url;
+      if (typeof webUrl === "string" && webUrl.length > 0) return { status: "found", url: webUrl };
+      const iid = mergeRequest.iid;
+      return typeof iid === "number" ? { status: "found", url: `${remote.instanceUrl}/${remote.projectPath}/-/merge_requests/${iid}` } : { status: "not_found" };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.warn(`[GitService] GitLab MR lookup failed for ${repoName}: ${message}`);
+      return { status: "error" };
+    }
+  }
+  async resolveCodeHost(repoPath) {
+    const origin = await this.getOriginInfo(repoPath);
+    if (origin.provider === "unknown") return {};
+    if (origin.provider === "github") return { provider: origin.provider };
+    return {
+      provider: origin.provider,
+      repositoryUrl: `${origin.gitLab.instanceUrl}/${origin.gitLab.projectPath}`
+    };
+  }
+  async getRepositoryOriginHost(repoPath, refresh = false) {
+    if (refresh) this.originInfoCache.delete(repoPath);
+    const origin = await this.getOriginInfo(repoPath);
+    if (origin.provider === "github") return "github.com";
+    if (origin.provider === "gitlab") return origin.gitLab.host;
+    return null;
+  }
+  async getOriginInfo(repoPath) {
+    const cached = this.originInfoCache.get(repoPath);
+    if (cached !== void 0) {
+      return cached;
+    }
+    let info = { provider: "unknown" };
+    try {
+      const { stdout } = await execFileAsync("git", ["remote", "get-url", "origin"], {
+        cwd: repoPath,
+        encoding: "utf-8",
+        maxBuffer: SUBPROCESS_MAX_BUFFER
+      });
+      const originUrl = stdout.trim();
+      if (isGitHubUrl(originUrl)) {
+        info = { provider: "github" };
+      } else {
+        const gitLabRemote = this.parseGitLabRemote(originUrl);
+        if (gitLabRemote) info = { provider: "gitlab", gitLab: gitLabRemote };
+      }
+    } catch {
+      info = { provider: "unknown" };
+    }
+    if (info.provider !== "unknown") this.originInfoCache.set(repoPath, info);
+    return info;
+  }
+  parseGitLabRemote(remoteUrl) {
+    const parsed = parseGitRemote(remoteUrl);
+    if (!parsed) return null;
+    const projectPath = decodePathSegments(parsed.path.split("/").filter(Boolean)).join("/");
+    return {
+      host: parsed.host,
+      instanceUrl: `${parsed.protocol === "http" ? "http" : "https"}://${parsed.host}`,
+      projectPath
+    };
+  }
+  async getGitLabAccessToken(host) {
+    try {
+      const credentials = await readFile3(join3(ENGINE_ENV.HOME_DIR, ".git-credentials"), "utf-8");
+      for (const line of credentials.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed) continue;
+        try {
+          const parsed = new URL(trimmed);
+          if (parsed.protocol === "https:" && parsed.host.toLowerCase() === host && parsed.password) {
+            return decodeURIComponent(parsed.password);
+          }
+        } catch {
+        }
+      }
+    } catch {
+    }
+    return null;
+  }
+  async resolveDefaultBranch(repoPath) {
+    const cached = this.defaultBranchCache.get(repoPath);
+    if (cached) {
+      return cached;
+    }
+    const fromSymbolicRef = await getOriginDefaultBranch(repoPath);
+    if (fromSymbolicRef) {
+      this.defaultBranchCache.set(repoPath, fromSymbolicRef);
+      return fromSymbolicRef;
+    }
+    return "main";
+  }
+  async refreshRepoMetadata(repo, currentBranch, startHooksCompleted, persistedState, observedBranches, includeDiffs = false) {
+    const notFound = { status: "not_found" };
+    const prResult = currentBranch === repo.defaultBranch ? notFound : await this.getPullRequestUrl(repo.name, repo.path, currentBranch, persistedState);
+    let prUrls = persistedState?.prUrls ?? [];
+    if (prResult.status === "found") {
+      prUrls = appendUniqueUrl(prUrls, prResult.url);
+    }
+    if (observedBranches) {
+      for (const branch of observedBranches) {
+        if (branch === currentBranch || branch === repo.defaultBranch) continue;
+        const branchResult = await this.lookupPrOnRemote(repo.name, repo.path, branch);
+        if (branchResult.status === "found") {
+          prUrls = appendUniqueUrl(prUrls, branchResult.url);
+        }
+      }
+    }
+    const gitDiff = await this.getGitDiffStats(repo.path, repo.defaultBranch);
+    const fullDiff = includeDiffs && gitDiff ? await this.getFullGitDiff(repo.path, repo.defaultBranch) : null;
+    const state = {
+      name: repo.name,
+      path: repo.path,
+      defaultBranch: repo.defaultBranch,
+      currentBranch,
+      prUrls,
+      gitDiff: includeDiffs && gitDiff ? { ...gitDiff, ...fullDiff === null ? {} : { fullDiff } } : gitDiff,
+      startHooksCompleted,
+      ...await this.resolveCodeHost(repo.path)
+    };
+    return saveRepoState(repo.name, state, state);
+  }
+  async safeStat(path2) {
+    try {
+      return await stat(path2);
+    } catch {
+      return null;
+    }
+  }
+};
+var gitService = new GitService();
+
+// src/utils/agent-additional-directories.ts
+async function getAgentAdditionalDirectories() {
+  try {
+    const repos = await gitService.listRepositories();
+    return repos.map((repo) => repo.path);
+  } catch {
+    return [];
+  }
+}
+
+// src/utils/image-utils.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { mkdir as mkdir3, unlink as unlink2, writeFile as writeFile2 } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { join as join4 } from "path";
+function isImageMediaType(value) {
+  return IMAGE_MEDIA_TYPES.includes(value);
+}
+function inferMediaType(url, contentType) {
+  if (contentType) {
+    const normalized = contentType.toLowerCase().split(";")[0].trim();
+    if (isImageMediaType(normalized)) {
+      return normalized;
+    }
+    if (normalized === "image/jpg") {
+      return "image/jpeg";
+    }
+  }
+  const urlLower = url.toLowerCase();
+  if (urlLower.includes(".png")) return "image/png";
+  if (urlLower.includes(".jpg") || urlLower.includes(".jpeg")) return "image/jpeg";
+  if (urlLower.includes(".gif")) return "image/gif";
+  if (urlLower.includes(".webp")) return "image/webp";
+  return "image/jpeg";
+}
+async function fetchImageAsBase64(url) {
+  const hostname = new URL(url).hostname;
+  const provider = hostname === "uploads.linear.app" ? "linear" : hostname === "files.slack.com" ? "slack" : null;
+  const response = provider ? await monolithRequest(`/v1/engine/${provider}/download`, { body: { url } }) : await fetch(url, { redirect: "follow" });
+  if (!response.ok) {
+    throw new Error(`Failed to fetch image from ${url}: ${response.status} ${response.statusText}`);
+  }
+  const contentType = response.headers.get("content-type");
+  if (contentType) {
+    const normalizedContentType = contentType.toLowerCase().split(";")[0].trim();
+    if (!normalizedContentType.startsWith("image/")) {
+      throw new Error(
+        `Expected image content from ${url} but received Content-Type: ${normalizedContentType}. This may indicate an authentication or redirect issue.`
+      );
+    }
+  }
+  const mediaType = inferMediaType(url, contentType);
+  const arrayBuffer = await response.arrayBuffer();
+  const buffer = Buffer.from(arrayBuffer);
+  const data = buffer.toString("base64");
+  return {
+    type: "base64",
+    media_type: mediaType,
+    data
+  };
+}
+async function normalizeImages(images) {
+  const normalized = [];
+  for (const image of images) {
+    if (image.source.type === "base64") {
+      normalized.push({
+        type: "image",
+        source: image.source
+      });
+    } else if (image.source.type === "url") {
+      const base64Source = await fetchImageAsBase64(image.source.url);
+      normalized.push({
+        type: "image",
+        source: base64Source
+      });
+    }
+  }
+  return normalized;
+}
+async function saveNormalizedImagesToTempFiles(images, tempImageDir = join4(homedir2(), ".replicas", "codex", "temp-images")) {
+  await mkdir3(tempImageDir, { recursive: true });
+  const tempPaths = [];
+  try {
+    for (const image of images) {
+      const ext = image.source.media_type.split("/")[1] || "png";
+      const filename = `img_${randomUUID2()}.${ext}`;
+      const filepath = join4(tempImageDir, filename);
+      await writeFile2(filepath, Buffer.from(image.source.data, "base64"));
+      tempPaths.push(filepath);
+    }
+  } catch (error) {
+    await removeTempImageFiles(tempPaths);
+    throw error;
+  }
+  return tempPaths;
+}
+async function removeTempImageFiles(paths) {
+  await Promise.allSettled(paths.map((path2) => unlink2(path2)));
+}
+
+// src/utils/codex-quota.ts
+function buildCodexRateLimitsSnapshot(fields) {
+  if (fields.authMethod !== "oauth") return null;
+  if (fields.unlimited === true) return null;
+  let state = "ok";
+  if (fields.rateLimitResetType?.endsWith("_credits_depleted")) {
+    state = "out_of_credits";
+  } else if (fields.rateLimitResetType !== null) {
+    state = "rate_limited";
+  }
+  return {
+    state,
+    balance: fields.balance,
+    rateLimitResetType: fields.rateLimitResetType,
+    planType: fields.planType
+  };
+}
+var CodexQuotaStatusTracker = class {
+  lastEmittedQuotaState = "ok";
+  latestQuotaSnapshot = null;
+  // OpenAI keeps `rate_limit_reached_type` set in snapshots even while requests
+  // still succeed (the flag is sticky until an authoritative snapshot clears it),
+  // so an out_of_credits reading on its own is not trustworthy. Record it here,
+  // and only surface it via confirmOutOfCredits() once a turn actually fails
+  // with a quota error.
+  observe(snapshot) {
+    this.latestQuotaSnapshot = snapshot;
+    if (snapshot.state === "out_of_credits") return null;
+    if (snapshot.state === this.lastEmittedQuotaState) return null;
+    return this.emit(snapshot);
+  }
+  confirmOutOfCredits() {
+    if (this.latestQuotaSnapshot?.state !== "out_of_credits") return null;
+    return this.emit(this.latestQuotaSnapshot);
+  }
+  recordTurnSuccess() {
+    if (this.lastEmittedQuotaState === "ok") return null;
+    return this.emit({
+      state: "ok",
+      balance: this.latestQuotaSnapshot?.balance ?? null,
+      rateLimitResetType: null,
+      planType: this.latestQuotaSnapshot?.planType ?? null
+    });
+  }
+  emit(snapshot) {
+    this.lastEmittedQuotaState = snapshot.state;
+    this.latestQuotaSnapshot = snapshot;
+    const payload = {
+      state: snapshot.state,
+      balance: snapshot.balance,
+      rateLimitResetType: snapshot.rateLimitResetType,
+      planType: snapshot.planType
+    };
+    return {
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      type: CODEX_QUOTA_STATUS_EVENT_TYPE,
+      payload
+    };
+  }
+};
+
+// src/managers/subagent-mcp-config.ts
+import { existsSync as existsSync2 } from "fs";
+import { dirname as dirname2, join as join5 } from "path";
+import { fileURLToPath } from "url";
+import { createRequire } from "module";
+var SUBAGENT_MCP_TOOL_TIMEOUT_MS = 24 * 60 * 60 * 1e3 + 6e4;
+function subagentMcpProcessConfig(parentChatId) {
+  const directory = dirname2(fileURLToPath(import.meta.url));
+  const builtEntry = join5(directory, "subagent-mcp.js");
+  const sourceEntry = join5(directory, "..", "subagent-mcp.ts");
+  const entry = existsSync2(builtEntry) ? builtEntry : sourceEntry;
+  return {
+    command: process.execPath,
+    args: [
+      ...entry.endsWith(".ts") ? ["--import", createRequire(import.meta.url).resolve("tsx/esm")] : [],
+      entry,
+      "--parent",
+      parentChatId
+    ]
+  };
+}
+function subagentCodexMcpConfig(parentChatId) {
+  return {
+    ...subagentMcpProcessConfig(parentChatId),
+    env_vars: ["REPLICAS_ENGINE_PORT", "REPLICAS_ENGINE_SECRET"],
+    enabled_tools: [...SUBAGENT_MCP_TOOL_NAMES],
+    required: true,
+    default_tools_approval_mode: "approve",
+    startup_timeout_sec: 10,
+    tool_timeout_sec: Math.ceil(SUBAGENT_MCP_TOOL_TIMEOUT_MS / 1e3)
+  };
+}
+
+// src/managers/codex-asp/mappers.ts
+var localImageCache = /* @__PURE__ */ new Map();
+var DEFAULT_MODEL = DEFAULT_CODEX_MODEL;
+var THREAD_START_METHOD = "thread/start";
+var THREAD_RESUME_METHOD = "thread/resume";
+var THREAD_READ_METHOD = "thread/read";
+var THREAD_GOAL_SET_METHOD = "thread/goal/set";
+var THREAD_GOAL_GET_METHOD = "thread/goal/get";
+var THREAD_GOAL_CLEAR_METHOD = "thread/goal/clear";
+var THREAD_COMPACT_START_METHOD = "thread/compact/start";
+var THREAD_INJECT_ITEMS_METHOD = "thread/inject_items";
+var THREAD_SETTINGS_UPDATE_METHOD = "thread/settings/update";
+var TURN_START_METHOD = "turn/start";
+var TURN_INTERRUPT_METHOD = "turn/interrupt";
+var TURN_STEER_METHOD = "turn/steer";
+var ACCOUNT_RATE_LIMITS_READ_METHOD = "account/rateLimits/read";
+var MODEL_LIST_METHOD = "model/list";
+var SKILLS_LIST_METHOD = "skills/list";
+var MAX_CODEX_ASP_TRANSCRIPT_OUTPUT_CHARS = DEFAULT_HOOK_OUTPUT_PREVIEW_CHARS;
+function getReconciledActiveTurnId(error, expectedTurnId) {
+  const message = error instanceof Error ? error.message : String(error);
+  const match = message.match(/expected active turn id ([0-9a-f-]{36}) but found ([0-9a-f-]{36})/i);
+  return match?.[1]?.toLowerCase() === expectedTurnId.toLowerCase() ? match[2] ?? null : null;
+}
+function codexApprovalPolicyOverrides() {
+  return {
+    approvalPolicy: "untrusted",
+    approvalsReviewer: "user"
+  };
+}
+function toReasoningEffort(thinkingLevel) {
+  return codexReasoningEffortForThinkingLevel(thinkingLevel);
+}
+function extractRateLimitsSnapshot(rateLimits) {
+  const credits = rateLimits.credits;
+  return buildCodexRateLimitsSnapshot({
+    authMethod: ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD ?? "none",
+    unlimited: credits?.unlimited ?? null,
+    balance: credits?.balance ?? null,
+    rateLimitResetType: rateLimits.rateLimitReachedType || null,
+    planType: rateLimits.planType
+  });
+}
+function timestampFromSeconds(value) {
+  return new Date((value ?? Date.now() / 1e3) * 1e3).toISOString();
+}
+function timestampFromMilliseconds(value) {
+  return new Date(value ?? Date.now()).toISOString();
+}
+function stringifyToolOutput(value) {
+  if (value === null || value === void 0) return void 0;
+  if (typeof value === "string") return truncateCodexAspTranscriptOutput(value);
+  if (typeof value === "object" && "content" in value && Array.isArray(value.content)) {
+    const text = value.content.map((item) => {
+      if (typeof item === "string") return item;
+      if (item && typeof item === "object" && "text" in item && typeof item.text === "string") {
+        return item.text;
+      }
+      return "";
+    }).filter(Boolean).join("\n");
+    if (text) return truncateCodexAspTranscriptOutput(text);
+  }
+  try {
+    return truncateCodexAspTranscriptOutput(JSON.stringify(value));
+  } catch {
+    return truncateCodexAspTranscriptOutput(String(value));
+  }
+}
+function stringifyCollabAgentStates(states) {
+  const entries = Object.entries(states).map(([threadId, state]) => {
+    const message = state?.message?.trim();
+    return `${threadId}: ${state?.status ?? "unknown"}${message ? ` - ${message}` : ""}`;
+  });
+  return entries.length > 0 ? truncateCodexAspTranscriptOutput(entries.join("\n")) : void 0;
+}
+function codexSubagentTranscriptItem({
+  id,
+  description,
+  prompt,
+  receiverThreadIds,
+  model,
+  output,
+  timestamp,
+  status
+}) {
+  return {
+    type: "subagent",
+    id,
+    description,
+    prompt,
+    subagentType: "codex",
+    receiverThreadIds,
+    ...model ? { model } : {},
+    ...output ? { output } : {},
+    timestamp,
+    status
+  };
+}
+function truncateCodexAspTranscriptOutput(output, maxChars = MAX_CODEX_ASP_TRANSCRIPT_OUTPUT_CHARS) {
+  return buildOutputPreview(output, {
+    maxChars,
+    truncateFrom: "tail",
+    marker: "\n[output truncated: showing tail of output]\n"
+  }).output;
+}
+function appendCodexAspTranscriptOutput(current, delta, maxChars = MAX_CODEX_ASP_TRANSCRIPT_OUTPUT_CHARS) {
+  return truncateCodexAspTranscriptOutput(`${current ?? ""}${delta}`, maxChars);
+}
+function transcriptPatchOperation(change) {
+  const action = change.kind.type;
+  const diff = change.diff.trim().length === 0 ? void 0 : action === "update" ? change.diff : fileContentDiff(change.path, change.diff, action);
+  return {
+    action,
+    path: change.path,
+    ...change.kind.type === "update" && change.kind.move_path ? { moveTo: change.kind.move_path } : {},
+    ...diff ? { diff } : {}
+  };
+}
+function transcriptItemsForTurn(turn) {
+  const userItems = turn.items.filter((item) => item.type === "userMessage");
+  const otherItems = turn.items.filter((item) => item.type !== "userMessage");
+  return [...userItems, ...otherItems];
+}
+function userImageForLocalPath(path2) {
+  const cached = localImageCache.get(path2);
+  if (cached) return cached;
+  if (!existsSync3(path2)) return null;
+  const image = {
+    type: "image",
+    mediaType: inferMediaType(path2),
+    data: readFileSync(path2).toString("base64")
+  };
+  if (image.data.length > 0) localImageCache.set(path2, image);
+  return image;
+}
+function userImagesForInput(input) {
+  const images = input.filter((item) => item.type === "localImage").map((item) => userImageForLocalPath(item.path)).filter((image) => image !== null && image.data.length > 0);
+  return images.length > 0 ? images : void 0;
+}
+function itemToTranscriptItem(item, timestamp, status) {
+  if (item.type === "userMessage") {
+    const content = item.content.filter((input) => input.type === "text").map((input) => input.text).join("\n");
+    const skillNames = item.content.filter((input) => input.type === "skill").map((input) => input.name).filter((name) => name.trim().length > 0);
+    return {
+      type: "userMessage",
+      id: item.id,
+      content,
+      ...skillNames.length > 0 ? { skillNames } : {},
+      images: userImagesForInput(item.content),
+      timestamp
+    };
+  }
+  if (item.type === "agentMessage") {
+    return {
+      type: "agentMessage",
+      id: item.id,
+      text: item.text,
+      phase: item.phase,
+      timestamp
+    };
+  }
+  if (item.type === "reasoning") {
+    return {
+      type: "reasoning",
+      id: item.id,
+      text: [...item.summary, ...item.content].filter(Boolean).join("\n").trim(),
+      timestamp,
+      status
+    };
+  }
+  if (item.type === "commandExecution") {
+    const exitCode = item.exitCode ?? null;
+    return {
+      type: "commandExecution",
+      id: item.id,
+      command: item.command,
+      ...item.aggregatedOutput ? { output: truncateCodexAspTranscriptOutput(item.aggregatedOutput) } : {},
+      exitCode,
+      timestamp,
+      status: normalizeCodexAspTranscriptStatus(item.status, typeof exitCode === "number" && exitCode !== 0)
+    };
+  }
+  if (item.type === "fileChange") {
+    return {
+      type: "fileChange",
+      id: item.id,
+      operations: item.changes.map(transcriptPatchOperation),
+      output: item.status,
+      exitCode: item.status === "completed" ? 0 : 1,
+      timestamp,
+      status: normalizeCodexAspTranscriptStatus(item.status)
+    };
+  }
+  if (item.type === "mcpToolCall") {
+    return {
+      type: "toolCall",
+      id: item.id,
+      server: item.server,
+      tool: item.tool,
+      input: item.arguments,
+      output: item.error?.message ? truncateCodexAspTranscriptOutput(item.error.message) : stringifyToolOutput(item.result),
+      timestamp,
+      status: normalizeCodexAspTranscriptStatus(item.status, item.status === "failed")
+    };
+  }
+  if (item.type === "dynamicToolCall") {
+    if (item.namespace === "collab" && item.tool === "wait") {
+      return null;
+    }
+    return {
+      type: "toolCall",
+      id: item.id,
+      server: item.namespace ?? "dynamic",
+      tool: item.tool,
+      input: item.arguments,
+      output: stringifyToolOutput(item.contentItems),
+      timestamp,
+      status: normalizeCodexAspTranscriptStatus(item.status, item.success === false)
+    };
+  }
+  if (item.type === "collabAgentToolCall") {
+    if (item.tool === "spawnAgent" && item.receiverThreadIds.length > 0) {
+      return codexSubagentTranscriptItem({
+        id: item.id,
+        description: item.receiverThreadIds.length === 1 ? "Codex subagent" : `Codex subagents (${item.receiverThreadIds.length})`,
+        prompt: item.prompt ?? "",
+        receiverThreadIds: item.receiverThreadIds,
+        model: item.model ?? void 0,
+        output: stringifyCollabAgentStates(item.agentsStates),
+        timestamp,
+        status: normalizeCodexAspTranscriptStatus(item.status, item.status === "failed")
+      });
+    }
+    if (item.tool === "wait") {
+      return null;
+    }
+    return {
+      type: "toolCall",
+      id: item.id,
+      server: "collab",
+      tool: item.tool,
+      input: item.prompt ?? void 0,
+      output: stringifyToolOutput(item.agentsStates),
+      timestamp,
+      status: normalizeCodexAspTranscriptStatus(item.status, item.status === "failed")
+    };
+  }
+  if (item.type === "subAgentActivity" && item.kind === "started") {
+    return codexSubagentTranscriptItem({
+      id: item.id,
+      description: item.agentPath,
+      prompt: "",
+      receiverThreadIds: [item.agentThreadId],
+      timestamp,
+      status
+    });
+  }
+  if (item.type === "webSearch") {
+    return {
+      type: "webSearch",
+      id: item.id,
+      query: item.query,
+      timestamp,
+      status
+    };
+  }
+  if (item.type === "plan") {
+    return {
+      type: "plan",
+      id: item.id,
+      text: item.text,
+      timestamp,
+      status
+    };
+  }
+  if (item.type === "contextCompaction") {
+    return {
+      type: "contextCompaction",
+      id: item.id,
+      timestamp,
+      status
+    };
+  }
+  if (item.type === "imageView" || item.type === "imageGeneration" || item.type === "hookPrompt") {
+    return null;
+  }
+  if (item.type === "enteredReviewMode" || item.type === "exitedReviewMode") {
+    return {
+      type: "reasoning",
+      id: item.id,
+      text: item.review,
+      timestamp,
+      status
+    };
+  }
+  return null;
+}
+function aspGoalToChatGoal(goal) {
+  return {
+    threadId: goal.threadId,
+    objective: goal.objective,
+    status: goal.status,
+    tokenBudget: goal.tokenBudget,
+    tokensUsed: goal.tokensUsed,
+    timeUsedSeconds: goal.timeUsedSeconds,
+    createdAt: timestampFromSeconds(goal.createdAt),
+    updatedAt: timestampFromSeconds(goal.updatedAt)
+  };
+}
+function isQuotaTurnFailure(turn) {
+  const info = turn.error?.codexErrorInfo;
+  if (!info) return false;
+  if (info === "usageLimitExceeded") return true;
+  if (typeof info === "object") {
+    return Object.values(info).some((detail) => isRecord(detail) && detail.httpStatusCode === 429);
+  }
+  return false;
+}
+function isQuotaErrorMessage(error) {
+  return error instanceof Error && detectAgentQuotaLimit(error.message) !== null;
+}
+function formatTurnFailure(turn) {
+  const turnError = turn.error;
+  if (!turnError) {
+    return "Codex ASP turn failed without error details";
+  }
+  const parts = [`Codex ASP turn failed: ${turnError.message}`];
+  if (turnError.codexErrorInfo !== null) {
+    parts.push(`codexErrorInfo=${JSON.stringify(turnError.codexErrorInfo)}`);
+  }
+  if (turnError.additionalDetails) {
+    parts.push(`details=${turnError.additionalDetails}`);
+  }
+  return parts.join(" ");
+}
+function threadToAspTranscript(thread) {
+  return turnsToAspTranscript(thread.id, timestampFromSeconds(thread.updatedAt), thread.turns);
+}
+function turnsToAspTranscript(threadId, updatedAt, sourceTurns) {
+  const turns = sourceTurns.map((turn, index) => ({ turn, index })).sort((a, b) => (a.turn.startedAt ?? a.turn.completedAt ?? Number.MAX_SAFE_INTEGER) - (b.turn.startedAt ?? b.turn.completedAt ?? Number.MAX_SAFE_INTEGER) || a.index - b.index).map(({ turn }) => {
+    const startedAt = timestampFromSeconds(turn.startedAt);
+    const completedAt = turn.completedAt === null ? null : timestampFromSeconds(turn.completedAt);
+    const itemTimestamp = completedAt ?? startedAt;
+    const status = normalizeCodexAspTranscriptStatus(turn.status);
+    const items = [];
+    for (const item of transcriptItemsForTurn(turn)) {
+      const transcriptItem = itemToTranscriptItem(item, item.type === "userMessage" ? startedAt : itemTimestamp, status);
+      if (transcriptItem) {
+        items.push(transcriptItem);
+      }
+    }
+    if (turn.error) {
+      items.push({
+        type: "error",
+        id: `${turn.id}-error`,
+        message: formatTurnFailure(turn),
+        timestamp: itemTimestamp
+      });
+    }
+    return {
+      id: turn.id,
+      status: turn.status,
+      startedAt,
+      completedAt,
+      items
+    };
+  });
+  return { threadId, updatedAt, turns };
+}
+async function buildThreadStartParams(workingDirectory, request, developerInstructions, serviceTier, subagentMcpParentChatId) {
+  const additionalDirectories = await getAgentAdditionalDirectories();
+  return {
+    model: request.model ?? DEFAULT_MODEL,
+    ...serviceTier !== void 0 ? { serviceTier } : {},
+    cwd: workingDirectory,
+    runtimeWorkspaceRoots: additionalDirectories,
+    sandbox: "danger-full-access",
+    ...codexApprovalPolicyOverrides(),
+    developerInstructions: developerInstructions ?? null,
+    config: {
+      web_search: ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "ollama" ? "disabled" : "live",
+      model_reasoning_summary: "auto",
+      ...subagentMcpParentChatId ? {
+        // Codex gates its native collaboration tools on `agents.enabled`; `features.multi_agent` is now a no-op.
+        "agents.enabled": false,
+        [`mcp_servers.${SUBAGENT_MCP_SERVER_NAME}`]: subagentCodexMcpConfig(subagentMcpParentChatId)
+      } : {}
+    },
+    experimentalRawEvents: false
+  };
+}
+async function buildThreadResumeParams(workingDirectory, threadId, request, developerInstructions, serviceTier, subagentMcpParentChatId) {
+  const additionalDirectories = await getAgentAdditionalDirectories();
+  return {
+    threadId,
+    model: request.model ?? DEFAULT_MODEL,
+    ...serviceTier !== void 0 ? { serviceTier } : {},
+    cwd: workingDirectory,
+    runtimeWorkspaceRoots: additionalDirectories,
+    sandbox: "danger-full-access",
+    ...codexApprovalPolicyOverrides(),
+    developerInstructions: developerInstructions ?? null,
+    config: {
+      web_search: ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "ollama" ? "disabled" : "live",
+      model_reasoning_summary: "auto",
+      ...subagentMcpParentChatId ? {
+        // Codex gates its native collaboration tools on `agents.enabled`; `features.multi_agent` is now a no-op.
+        "agents.enabled": false,
+        [`mcp_servers.${SUBAGENT_MCP_SERVER_NAME}`]: subagentCodexMcpConfig(subagentMcpParentChatId)
+      } : {}
+    },
+    excludeTurns: false
+  };
+}
+async function buildTurnInput(request) {
+  const input = [{
+    type: "text",
+    text: request.message,
+    text_elements: []
+  }];
+  if (!request.images || request.images.length === 0) {
+    return { input, tempImagePaths: [] };
+  }
+  const normalizedImages = await normalizeImages(request.images);
+  const tempImagePaths = await saveNormalizedImagesToTempFiles(normalizedImages);
+  input.push(...tempImagePaths.map((path2) => ({
+    type: "localImage",
+    path: path2
+  })));
+  return { input, tempImagePaths };
+}
+async function buildTurnStartParams(threadId, request, serviceTier) {
+  const effort = toReasoningEffort(request.thinkingLevel);
+  const model = request.model ?? DEFAULT_MODEL;
+  const { input, tempImagePaths } = await buildTurnInput(request);
+  return {
+    params: {
+      threadId,
+      input,
+      model,
+      ...serviceTier !== void 0 ? { serviceTier } : {},
+      ...codexApprovalPolicyOverrides(),
+      ...effort ? { effort } : {},
+      collaborationMode: {
+        mode: request.planMode ? "plan" : "default",
+        settings: {
+          model,
+          reasoning_effort: effort ?? null,
+          developer_instructions: null
+        }
+      }
+    },
+    tempImagePaths
+  };
+}
+
+// src/managers/codex-asp/openai-compatible-model-catalog.ts
+import { writeFile as writeFile3 } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join6 } from "path";
+var CATALOG_TTL_MS = 6e4;
+var CODEX_MODEL_CATALOG_PATH = join6(tmpdir(), "replicas-openai-compatible-model-catalog.json");
+var cachedCatalog = null;
+async function writeCodexModelCatalog(modelsUrl) {
+  const ollama = ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "ollama" ? readOllamaAuthEnv("codex", process.env) : null;
+  const [models, { stdout }] = await Promise.all([
+    ollama ? listOllamaModels(ollama) : listOpenAICompatibleModels({
+      apiKey: ENGINE_ENV.OPENAI_API_KEY,
+      authorizationHeader: ENGINE_ENV.CODEX_OPENAI_AUTHORIZATION_HEADER,
+      baseUrl: ENGINE_ENV.CODEX_OPENAI_BASE_URL ?? "",
+      modelsUrl
+    }),
+    execFileAsync("codex", ["debug", "models"], { maxBuffer: SUBPROCESS_MAX_BUFFER })
+  ]);
+  const payload = JSON.parse(stdout);
+  const template = isRecord(payload) && Array.isArray(payload.models) ? payload.models.find((model) => isRecord(model) && model.slug === "gpt-5.2") ?? payload.models.find(isRecord) : null;
+  if (!isRecord(template)) throw new Error("Codex did not return a model catalog template");
+  await writeFile3(CODEX_MODEL_CATALOG_PATH, JSON.stringify({
+    models: models.flatMap((model) => model.contextWindow ? [{
+      ...template,
+      ...ollama ? { apply_patch_tool_type: null, support_verbosity: false, supports_search_tool: false, input_modalities: ["text"] } : {},
+      slug: model.id,
+      display_name: model.displayName,
+      description: model.description ?? model.displayName,
+      context_window: model.contextWindow,
+      max_context_window: model.contextWindow,
+      effective_context_window_percent: 100,
+      auto_compact_token_limit: Math.floor(model.contextWindow * 0.9)
+    }] : [])
+  }));
+  return [
+    `model_catalog_json=${JSON.stringify(CODEX_MODEL_CATALOG_PATH)}`,
+    "features.remote_models=false"
+  ];
+}
+async function getOpenAICompatibleCodexModelCatalogConfig() {
+  if (ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD !== "openai-compatible" && ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD !== "ollama" || !ENGINE_ENV.CODEX_OPENAI_BASE_URL) return [];
+  const modelsUrl = resolveOpenAICompatibleModelsUrl({
+    baseUrl: ENGINE_ENV.CODEX_OPENAI_BASE_URL,
+    modelsUrl: ENGINE_ENV.CODEX_OPENAI_MODELS_URL ?? ""
+  });
+  const key = `${modelsUrl}:${JSON.stringify(ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.codex ?? null)}`;
+  if (!cachedCatalog || cachedCatalog.key !== key || cachedCatalog.expiresAt <= Date.now()) {
+    cachedCatalog = {
+      key,
+      expiresAt: Date.now() + CATALOG_TTL_MS,
+      config: writeCodexModelCatalog(modelsUrl).catch((error) => {
+        console.warn("[CodexAspManager] Failed to prepare OpenAI-compatible model catalog:", error);
+        return [];
+      })
+    };
+  }
+  return cachedCatalog.config;
+}
+
+// src/managers/codex-asp/asp-host.ts
+var CODEX_ULTRAFAST_SERVICE_TIER = "ultrafast";
+var RUNNING_MODEL_LIST_TIMEOUT_MS = 3e3;
+var hostPromise = null;
+var activeProcess = null;
+var restartPromise = null;
+var modelCatalog = null;
+async function getCodexAspHost() {
+  if (restartPromise) {
+    await restartPromise;
+  }
+  hostPromise ??= (async () => {
+    try {
+      const oauthOptions = await codexTokenManager.prepareAspOauthOptions();
+      const process2 = new AppServerProcess({
+        cwd: ENGINE_ENV.WORKSPACE_ROOT,
+        env: buildCodexAgentEnv(),
+        configOverrides: await getOpenAICompatibleCodexModelCatalogConfig(),
+        ...oauthOptions
+      });
+      const { client } = await process2.start();
+      activeProcess = process2;
+      process2.on("exit", () => {
+        if (activeProcess === process2) {
+          activeProcess = null;
+        }
+        hostPromise = null;
+      });
+      return { client };
+    } catch (error) {
+      hostPromise = null;
+      throw error;
+    }
+  })();
+  return hostPromise;
+}
+async function restartCodexAspHost() {
+  if (restartPromise) {
+    return restartPromise;
+  }
+  restartPromise = (async () => {
+    const process2 = activeProcess;
+    hostPromise = null;
+    activeProcess = null;
+    if (process2) {
+      await process2.stop();
+    }
+  })();
+  try {
+    await restartPromise;
+  } finally {
+    restartPromise = null;
+  }
+}
+async function restartCodexAspHostIfRunning() {
+  if (activeProcess) await restartCodexAspHost();
+}
+function listCodexModels(host) {
+  if (modelCatalog?.client !== host.client) {
+    const models = (async () => {
+      const models2 = [];
+      let cursor = null;
+      do {
+        const response = await host.client.request(
+          MODEL_LIST_METHOD,
+          { cursor, includeHidden: true }
+        );
+        models2.push(...response.data);
+        cursor = response.nextCursor;
+      } while (cursor);
+      return models2;
+    })();
+    modelCatalog = { client: host.client, models };
+    models.catch(() => {
+      if (modelCatalog?.models === models) modelCatalog = null;
+    });
+  }
+  return modelCatalog.models;
+}
+async function listRunningCodexModels() {
+  if (!activeProcess || !hostPromise) return void 0;
+  try {
+    return await withTimeout(hostPromise.then(listCodexModels), RUNNING_MODEL_LIST_TIMEOUT_MS, "Codex model list timed out");
+  } catch {
+    return void 0;
+  }
+}
+
+export {
+  clearCredentialFallbacks,
+  recordCredentialFallback,
+  listCredentialFallbacks,
+  routineRefreshRequest,
+  recordExhaustedCredential,
+  refreshDelayMs,
+  BaseRefreshManager,
+  AsyncLock,
+  atomicWriteFile,
+  writeSecureCredentialFile,
+  configureManagedGitCredentialHelper,
+  upsertCredentialFileLines,
+  removeCredentialFileLines,
+  loadRepoState,
+  saveRepoState,
+  gitService,
+  applyAuthEnvTransition,
+  getAgentAdditionalDirectories,
+  normalizeImages,
+  removeTempImageFiles,
+  CodexQuotaStatusTracker,
+  SUBAGENT_MCP_TOOL_TIMEOUT_MS,
+  subagentMcpProcessConfig,
+  DEFAULT_MODEL,
+  THREAD_START_METHOD,
+  THREAD_RESUME_METHOD,
+  THREAD_READ_METHOD,
+  THREAD_GOAL_SET_METHOD,
+  THREAD_GOAL_GET_METHOD,
+  THREAD_GOAL_CLEAR_METHOD,
+  THREAD_COMPACT_START_METHOD,
+  THREAD_INJECT_ITEMS_METHOD,
+  THREAD_SETTINGS_UPDATE_METHOD,
+  TURN_START_METHOD,
+  TURN_INTERRUPT_METHOD,
+  TURN_STEER_METHOD,
+  ACCOUNT_RATE_LIMITS_READ_METHOD,
+  SKILLS_LIST_METHOD,
+  getReconciledActiveTurnId,
+  extractRateLimitsSnapshot,
+  timestampFromSeconds,
+  timestampFromMilliseconds,
+  appendCodexAspTranscriptOutput,
+  itemToTranscriptItem,
+  aspGoalToChatGoal,
+  isQuotaTurnFailure,
+  isQuotaErrorMessage,
+  formatTurnFailure,
+  threadToAspTranscript,
+  buildThreadStartParams,
+  buildThreadResumeParams,
+  buildTurnInput,
+  buildTurnStartParams,
+  CODEX_ULTRAFAST_SERVICE_TIER,
+  getCodexAspHost,
+  restartCodexAspHost,
+  restartCodexAspHostIfRunning,
+  listCodexModels,
+  listRunningCodexModels,
+  CodexAspAuthMethodChangedError,
+  codexTokenManager
+};