replicas-engine 0.1.1262 → 0.1.1263

package/dist/src/{asp-host-Y3F2DEYR.js → asp-host-J32FRYRC.js}

@@ -8,12 +8,12 @@ import {
   listRunningCodexModels,
   restartCodexAspHost,
   restartCodexAspHostIfRunning
-} from "./chunk-IWENYTHI.js";
-import "./chunk-ARSZGGKG.js";
-import "./chunk-VAPDZVIY.js";
-import "./chunk-DEE2MIUW.js";
+} from "./chunk-E3U4EX4U.js";
+import "./chunk-SJIWGPT3.js";
+import "./chunk-RDJ73FDQ.js";
+import "./chunk-AHPBQSXT.js";
 import "./chunk-UZSNFLDQ.js";
-import "./chunk-WINIX7II.js";
+import "./chunk-FNPPBKJI.js";
 import "./chunk-VEQXQN22.js";
 export {
   CODEX_ULTRAFAST_SERVICE_TIER,

package/dist/src/{chunk-DEE2MIUW.js → chunk-AHPBQSXT.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   HOOK_EXEC_MAX_BUFFER_BYTES
-} from "./chunk-WINIX7II.js";
+} from "./chunk-FNPPBKJI.js";
 
 // src/utils/exec.ts
 import { exec, execFile } from "child_process";

package/dist/src/{chunk-CNWOP7LH.js → chunk-BN2QDNKJ.js}

@@ -5,14 +5,14 @@ import {
   getOriginDefaultBranch,
   monolithRequest,
   runGitCommand
-} from "./chunk-ARSZGGKG.js";
+} from "./chunk-SJIWGPT3.js";
 import {
   extractCommandProtectionCommandText,
   findCommandProtectionGitLookups,
   findGitCommitSignals,
   findPrMergeSignals,
   parseCommandProtectionRequest
-} from "./chunk-WINIX7II.js";
+} from "./chunk-FNPPBKJI.js";
 
 // src/services/command-protection-service.ts
 import { readFile, stat } from "fs/promises";

package/dist/src/{chunk-R76SPM26.js → chunk-DTERKPBR.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   AspClient
-} from "./chunk-VAPDZVIY.js";
+} from "./chunk-RDJ73FDQ.js";
 import {
   ASTER_BASE_URL,
   ASTER_PROVIDER,
@@ -13,7 +13,7 @@ import {
   isRecord,
   readOllamaAuthEnv,
   readOpenAICompatibleAuthEnv
-} from "./chunk-WINIX7II.js";
+} from "./chunk-FNPPBKJI.js";
 
 // src/managers/codex-asp/notification-dispatch.ts
 var TURN_STARTED_METHOD = "turn/started";

package/dist/src/{chunk-IWENYTHI.js → chunk-E3U4EX4U.js}

@@ -10,15 +10,15 @@ import {
   resolveDiffBase,
   runGitCommand,
   setAgentCredentialSnapshot
-} from "./chunk-ARSZGGKG.js";
+} from "./chunk-SJIWGPT3.js";
 import {
   AppServerProcess,
   buildCodexAgentEnv
-} from "./chunk-VAPDZVIY.js";
+} from "./chunk-RDJ73FDQ.js";
 import {
   SUBPROCESS_MAX_BUFFER,
   execFileAsync
-} from "./chunk-DEE2MIUW.js";
+} from "./chunk-AHPBQSXT.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
@@ -55,7 +55,7 @@ import {
   resolveOpenAICompatibleModelsUrl,
   splitMothershipInstructions,
   withTimeout
-} from "./chunk-WINIX7II.js";
+} from "./chunk-FNPPBKJI.js";
 
 // src/managers/codex-token-manager.ts
 import { promises as fs } from "fs";
@@ -291,7 +291,7 @@ var CodexTokenManager = class extends BaseRefreshManager {
     await this.applyCredentialUpdate(++this.credentialGeneration, async () => {
       await this.applyCredentialsResponse(data);
       setAgentCredentialSnapshot("codex", data);
-      const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-Y3F2DEYR.js");
+      const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-J32FRYRC.js");
       await restartCodexAspHostIfRunning2();
     });
     await this.start(true);
@@ -313,7 +313,7 @@ var CodexTokenManager = class extends BaseRefreshManager {
       const accountChanged = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.codex?.credentialId !== data.credentialId;
       await this.applyCredentialsResponse(data);
       if (restartOnChange && (accountChanged || CODEX_AUTH_ENV_KEYS.some((key, index) => process.env[key] !== previousEnv[index]))) {
-        const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-Y3F2DEYR.js");
+        const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-J32FRYRC.js");
         await restartCodexAspHostIfRunning2();
       }
       setAgentCredentialSnapshot("codex", data);

package/dist/src/{chunk-WINIX7II.js → chunk-FNPPBKJI.js}

@@ -2008,6 +2008,8 @@ function parsePosixEnvFile(content) {
 // ../shared/src/engine/environment.ts
 var ENGINE_PORT = 3737;
 var DESKTOP_STREAM_PORT = 6080;
+var DEVICES_DIR = ".ssh/replicas-devices";
+var DEVICE_SCREEN_FILE_SUFFIX = ".screen.json";
 
 // ../shared/src/git.ts
 var GIT_CREDENTIAL_HELPER_FILENAME = ".git-credential-replicas";
@@ -2387,19 +2389,24 @@ var createEnvironmentMcpRequestSchema = z14.object({
   ]).describe("stdio: `{ command, args, env }`. http/sse: `{ url, headers }`.")
 });
 var updateEnvironmentMcpRequestSchema = createEnvironmentMcpRequestSchema.partial();
+var screenPasswordSchema = z14.string().min(1, "Enter the screen password").max(256).describe('Screen Sharing password, for `replicas computer screen`. On a Mac, the "VNC viewers may control screen with password" password. Never returned.');
 var createEnvironmentDeviceRequestSchema = z14.object({
   name: z14.string().regex(/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/, "Use lowercase letters, numbers and dashes").describe("SSH alias in workspaces, e.g. `mac-mini` for `ssh mac-mini`."),
   host: z14.string().max(253).regex(/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?|[0-9A-Fa-f:]+)$/, "Enter a hostname or IP address").describe("Hostname or IP, such as a Tailscale MagicDNS name (`mac-mini`) or a public address."),
   port: z14.number().int().min(1).max(65535).optional().describe("SSH port. Defaults to 22."),
-  username: z14.string().regex(/^[A-Za-z0-9_][A-Za-z0-9._-]{0,63}$/, "Enter the account name on the device").describe("Account the agent signs in as.")
+  username: z14.string().regex(/^[A-Za-z0-9_][A-Za-z0-9._-]{0,63}$/, "Enter the account name on the device").describe("Account the agent signs in as."),
+  screen_password: screenPasswordSchema.optional()
+});
+var updateEnvironmentDeviceRequestSchema = createEnvironmentDeviceRequestSchema.partial().extend({
+  screen_password: z14.union([screenPasswordSchema, z14.literal("")]).optional().describe("New Screen Sharing password, or an empty string to remove it.")
 });
-var updateEnvironmentDeviceRequestSchema = createEnvironmentDeviceRequestSchema.partial();
 var provisionedDeviceSchema = z14.object({
   name: z14.string(),
   host: z14.string(),
   port: z14.number(),
   username: z14.string(),
-  private_key: z14.string()
+  private_key: z14.string(),
+  screen_password: z14.string().optional()
 });
 
 // ../shared/src/routes/workspaces.ts
@@ -10541,6 +10548,8 @@ export {
   parsePosixEnvFile,
   ENGINE_PORT,
   DESKTOP_STREAM_PORT,
+  DEVICES_DIR,
+  DEVICE_SCREEN_FILE_SUFFIX,
   GIT_CREDENTIAL_HELPER_FILENAME,
   GITHUB_CREDENTIAL_REFRESH_PATH,
   GITLAB_CREDENTIAL_REFRESH_PATH,

package/dist/src/{chunk-XDF5QDJU.js → chunk-KGZ2ER7G.js}

@@ -5,7 +5,7 @@ import {
   extractCommandProtectionCommandText,
   isRecord,
   parseCodeHostPrUrl
-} from "./chunk-WINIX7II.js";
+} from "./chunk-FNPPBKJI.js";
 
 // src/services/published-pull-request-urls.ts
 function publishedPullRequestUrls(result) {

package/dist/src/{chunk-VAPDZVIY.js → chunk-RDJ73FDQ.js}

@@ -3,10 +3,10 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   execFileAsync
-} from "./chunk-DEE2MIUW.js";
+} from "./chunk-AHPBQSXT.js";
 import {
   isVersionBelow
-} from "./chunk-WINIX7II.js";
+} from "./chunk-FNPPBKJI.js";
 
 // src/utils/codex-agent-env.ts
 function buildCodexAgentEnv(source = process.env) {
@@ -240,7 +240,7 @@ function getCodexModelProvider(method) {
   if (method === "foundry") return "azure";
   return method === "ollama" || method === "openai-compatible" ? "replicas_openai_compatible" : "openai";
 }
-var ENGINE_PACKAGE_VERSION = "0.1.1262";
+var ENGINE_PACKAGE_VERSION = "0.1.1263";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";

package/dist/src/{chunk-ARSZGGKG.js → chunk-SJIWGPT3.js}

@@ -4,7 +4,7 @@ const require = __createRequire(import.meta.url);
 import {
   SUBPROCESS_MAX_BUFFER,
   execFileAsync
-} from "./chunk-DEE2MIUW.js";
+} from "./chunk-AHPBQSXT.js";
 import {
   isRecord as isRecord2
 } from "./chunk-UZSNFLDQ.js";
@@ -20,7 +20,7 @@ import {
   parsePosixEnvFile,
   provisionedDeviceSchema,
   readReplicasRuntimeEnv
-} from "./chunk-WINIX7II.js";
+} from "./chunk-FNPPBKJI.js";
 
 // src/runtime-env-loader.ts
 import { readFileSync } from "fs";

package/dist/src/command-protection-hook.js

@@ -3,13 +3,13 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   evaluateCommandProtection
-} from "./chunk-CNWOP7LH.js";
-import "./chunk-ARSZGGKG.js";
-import "./chunk-DEE2MIUW.js";
+} from "./chunk-BN2QDNKJ.js";
+import "./chunk-SJIWGPT3.js";
+import "./chunk-AHPBQSXT.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
-import "./chunk-WINIX7II.js";
+import "./chunk-FNPPBKJI.js";
 import "./chunk-VEQXQN22.js";
 
 // src/command-protection-hook.ts

package/dist/src/headless-agent.js

@@ -13,12 +13,12 @@ import {
   recoverCompletedTurn,
   spawnMuseMsp,
   startMuseSession
-} from "./chunk-R76SPM26.js";
+} from "./chunk-DTERKPBR.js";
 import {
   AppServerProcess,
   buildCodexAgentEnv
-} from "./chunk-VAPDZVIY.js";
-import "./chunk-DEE2MIUW.js";
+} from "./chunk-RDJ73FDQ.js";
+import "./chunk-AHPBQSXT.js";
 import {
   AGENT,
   OPENCODE_GO_PROVIDER,
@@ -28,7 +28,7 @@ import {
   headlessAgentUsagePath,
   isRecord,
   withTimeout
-} from "./chunk-WINIX7II.js";
+} from "./chunk-FNPPBKJI.js";
 import "./chunk-VEQXQN22.js";
 
 // src/headless-agent.ts

package/dist/src/index.js

@@ -27,7 +27,7 @@ import {
   evaluateCommandProtection,
   extractToolCommand,
   reportCommandProtectionBlock
-} from "./chunk-CNWOP7LH.js";
+} from "./chunk-BN2QDNKJ.js";
 import {
   ACCOUNT_RATE_LIMITS_UPDATED_METHOD,
   AGENT_MESSAGE_DELTA_METHOD,
@@ -64,10 +64,10 @@ import {
   spawnMuseMsp,
   startMuseSession,
   uuidV7
-} from "./chunk-R76SPM26.js";
+} from "./chunk-DTERKPBR.js";
 import {
   publishedPullRequestUrls
-} from "./chunk-XDF5QDJU.js";
+} from "./chunk-KGZ2ER7G.js";
 import {
   ACCOUNT_RATE_LIMITS_READ_METHOD,
   AsyncLock,
@@ -140,7 +140,7 @@ import {
   timestampFromSeconds,
   upsertCredentialFileLines,
   writeSecureCredentialFile
-} from "./chunk-IWENYTHI.js";
+} from "./chunk-E3U4EX4U.js";
 import {
   ENGINE_ENV,
   monolithRequest,
@@ -149,15 +149,15 @@ import {
   reloadEngineEnv,
   resolveDiffBase,
   setAgentCredentialSnapshot
-} from "./chunk-ARSZGGKG.js";
+} from "./chunk-SJIWGPT3.js";
 import {
   getCodexModelProvider
-} from "./chunk-VAPDZVIY.js";
+} from "./chunk-RDJ73FDQ.js";
 import {
   SUBPROCESS_MAX_BUFFER,
   execAsync,
   execFileAsync
-} from "./chunk-DEE2MIUW.js";
+} from "./chunk-AHPBQSXT.js";
 import {
   isRecord as isRecord2
 } from "./chunk-UZSNFLDQ.js";
@@ -207,6 +207,8 @@ import {
   DEFAULT_START_HOOK_TIMEOUT_MS,
   DEFAULT_WEB_APP_URL,
   DESKTOP_STREAM_PORT,
+  DEVICES_DIR,
+  DEVICE_SCREEN_FILE_SUFFIX,
   ENGINE_ACTIVATE_PATH,
   ENGINE_HEALTH_MAX_WAIT_MS,
   ENGINE_HEALTH_WAIT_HEADER,
@@ -397,7 +399,7 @@ import {
   workspaceTokenRequestSchema,
   workspaceTokenResponseSchema,
   wrapInTag
-} from "./chunk-WINIX7II.js";
+} from "./chunk-FNPPBKJI.js";
 import {
   cloneMcpConfig,
   ensureCompatibilityImports,
@@ -10523,7 +10525,7 @@ async function registerDesktopPreview(signal) {
 // src/services/device-service.ts
 import { mkdir as mkdir7, rm as rm2, writeFile as writeFile4 } from "fs/promises";
 import { join as join8 } from "path";
-var DEVICES_DIR = join8(ENGINE_ENV.HOME_DIR, ".ssh", "replicas-devices");
+var DEVICES_DIR2 = join8(ENGINE_ENV.HOME_DIR, DEVICES_DIR);
 var TAILSCALED_UNIT = "replicas-tailscaled";
 function sshConfig(devices, tailnet) {
   return devices.map((device) => [
@@ -10531,7 +10533,7 @@ function sshConfig(devices, tailnet) {
     `  HostName ${device.host}`,
     `  Port ${device.port}`,
     `  User ${device.username}`,
-    `  IdentityFile ${join8(DEVICES_DIR, device.name)}`,
+    `  IdentityFile ${join8(DEVICES_DIR2, device.name)}`,
     "  IdentitiesOnly yes",
     "  StrictHostKeyChecking accept-new",
     "  ServerAliveInterval 30",
@@ -10565,24 +10567,33 @@ async function joinTailnet(authKey, workspaceId, signal) {
 }
 async function connectDevices(signal) {
   const { REPLICAS_ENV_DEVICES: devices, TS_AUTHKEY: authKey, REPLICAS_WORKSPACE_ID: workspaceId } = ENGINE_ENV;
-  await rm2(DEVICES_DIR, { recursive: true, force: true });
+  await rm2(DEVICES_DIR2, { recursive: true, force: true });
   if (devices.length === 0) {
     await execFileAsync("sudo", ["systemctl", "stop", TAILSCALED_UNIT], { signal }).catch(() => void 0);
     return;
   }
-  await mkdir7(DEVICES_DIR, { recursive: true, mode: 448 });
-  await Promise.all(devices.map((device) => writeFile4(join8(DEVICES_DIR, device.name), device.private_key, { mode: 384 })));
-  await writeFile4(join8(DEVICES_DIR, "devices.conf"), sshConfig(devices, authKey !== void 0), { mode: 384 });
+  await mkdir7(DEVICES_DIR2, { recursive: true, mode: 448 });
+  await Promise.all(devices.flatMap((device) => [
+    writeFile4(join8(DEVICES_DIR2, device.name), device.private_key, { mode: 384 }),
+    ...device.screen_password === void 0 ? [] : [writeFile4(
+      join8(DEVICES_DIR2, `${device.name}${DEVICE_SCREEN_FILE_SUFFIX}`),
+      JSON.stringify({ username: device.username, password: device.screen_password }),
+      { mode: 384 }
+    )]
+  ]));
+  await writeFile4(join8(DEVICES_DIR2, "devices.conf"), sshConfig(devices, authKey !== void 0), { mode: 384 });
   if (authKey && workspaceId) await joinTailnet(authKey, workspaceId, signal);
 }
 function devicesInstruction() {
   const devices = ENGINE_ENV.REPLICAS_ENV_DEVICES;
   if (devices.length === 0) return void 0;
   const list = devices.map((device) => `\`${device.name}\` (${device.username}@${device.host})`).join(", ");
+  const screens = devices.filter((device) => device.screen_password !== void 0).map((device) => `\`${device.name}\``);
   return [
     `The user's own computers are reachable over SSH by name: ${list}. Use \`ssh <name>\`, \`scp\` and \`rsync\` as usual, and \`ssh -L\` to reach a service running on one.`,
     "They are personal machines with the user's files and accounts: change only what the task needs, and ask before anything destructive or hard to undo.",
-    ...ENGINE_ENV.TS_AUTHKEY ? ["They are reached through the user's tailnet. If a connection fails, `tailscale status` shows whether this workspace joined it."] : []
+    ...ENGINE_ENV.TS_AUTHKEY ? ["They are reached through the user's tailnet. If a connection fails, `tailscale status` shows whether this workspace joined it."] : [],
+    ...screens.length > 0 ? [`To see and control the screen of ${screens.join(", ")}, run \`replicas computer screen <name>\`: it shows on this desktop, where the other \`replicas computer\` commands drive it. Prefer \`ssh\` when a command does the job.`] : []
   ].join(" ");
 }
 

package/dist/src/post-tool-pr-hook.js

@@ -3,13 +3,13 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   publishedPullRequestUrls
-} from "./chunk-XDF5QDJU.js";
+} from "./chunk-KGZ2ER7G.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
 import {
   shouldRefreshPullRequests
-} from "./chunk-WINIX7II.js";
+} from "./chunk-FNPPBKJI.js";
 import "./chunk-VEQXQN22.js";
 
 // src/services/post-tool-pr-notifier.ts

package/dist/src/subagent-mcp.js

@@ -11,7 +11,7 @@ import {
   spawnSubagentRequestSchema,
   subagentResponseSchema,
   waitSubagentRequestSchema
-} from "./chunk-WINIX7II.js";
+} from "./chunk-FNPPBKJI.js";
 import "./chunk-VEQXQN22.js";
 
 // src/subagent-mcp.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.1262",
+  "version": "0.1.1263",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",