replicas-engine 0.1.1292 → 0.1.1294

package/dist/src/{asp-host-HGZPMM5B.js → asp-host-RKGMFLDD.js}

@@ -8,12 +8,12 @@ import {
   listRunningCodexModels,
   restartCodexAspHost,
   restartCodexAspHostIfRunning
-} from "./chunk-DYH6IOEA.js";
-import "./chunk-THUCGBYF.js";
-import "./chunk-34PT4Z5G.js";
-import "./chunk-3DNCWVQY.js";
+} from "./chunk-ILADSZLY.js";
+import "./chunk-22SSG3WW.js";
+import "./chunk-BGMMK24G.js";
+import "./chunk-ZGHPW4OS.js";
 import "./chunk-UZSNFLDQ.js";
-import "./chunk-2G5ZU67U.js";
+import "./chunk-4A6I7LPY.js";
 import "./chunk-VEQXQN22.js";
 export {
   CODEX_ULTRAFAST_SERVICE_TIER,

package/dist/src/{chunk-THUCGBYF.js → chunk-22SSG3WW.js}

@@ -4,7 +4,7 @@ const require = __createRequire(import.meta.url);
 import {
   SUBPROCESS_MAX_BUFFER,
   execFileAsync
-} from "./chunk-3DNCWVQY.js";
+} from "./chunk-ZGHPW4OS.js";
 import {
   isRecord as isRecord2
 } from "./chunk-UZSNFLDQ.js";
@@ -22,7 +22,7 @@ import {
   provisionedDeviceSchema,
   readReplicasRuntimeEnv,
   serializePosixEnvFile
-} from "./chunk-2G5ZU67U.js";
+} from "./chunk-4A6I7LPY.js";
 
 // src/runtime-env-loader.ts
 import { readFileSync } from "fs";

package/dist/src/{chunk-2G5ZU67U.js → chunk-4A6I7LPY.js}

@@ -271,6 +271,7 @@ var WEB_APP_PATHS = {
   integrations: `${DASHBOARD_PATH}/integrations`,
   integrationsGithub: `${DASHBOARD_PATH}/integrations/github`,
   integrationsGitlab: `${DASHBOARD_PATH}/integrations/gitlab`,
+  integrationsSlack: `${DASHBOARD_PATH}/integrations/slack`,
   settings: `${DASHBOARD_PATH}/settings`,
   billing: `${DASHBOARD_PATH}/billing`,
   members: `${DASHBOARD_PATH}/members`,
@@ -890,7 +891,11 @@ function paginateEngineLogContent(input) {
 }
 
 // ../shared/src/agent-quota.ts
-var AGENT_FALLBACK_REASONS = ["rate_limit", "out_of_credits", "credits_required", "auth_failed"];
+var AGENT_FALLBACK_REASONS = ["rate_limit", "out_of_credits", "credits_required", "auth_failed", "model_unavailable"];
+var EXHAUSTED_COOLDOWN_MS = 60 * 60 * 1e3;
+function exhaustedUntil(resetsAt) {
+  return new Date(resetsAt ?? Date.now() + EXHAUSTED_COOLDOWN_MS);
+}
 function isAgentFallbackReason(value) {
   return AGENT_FALLBACK_REASONS.some((reason) => reason === value);
 }
@@ -2249,7 +2254,7 @@ function describeAuthFallback(payload) {
   });
   const switched = payload.status === "switched";
   return {
-    headline: payload.reason === "out_of_credits" ? `${agent} is out of credits on ${exhausted}` : payload.reason === "auth_failed" ? `${agent} could not authenticate with ${exhausted}` : payload.reason === "credits_required" ? `The selected model needs usage credits on ${exhausted}` : `${agent} hit its usage limit on ${exhausted}`,
+    headline: payload.reason === "out_of_credits" ? `${agent} is out of credits on ${exhausted}` : payload.reason === "auth_failed" ? `${agent} could not authenticate with ${exhausted}` : payload.reason === "credits_required" ? `The selected model needs usage credits on ${exhausted}` : payload.reason === "model_unavailable" ? `The selected model is not available on ${exhausted}` : `${agent} hit its usage limit on ${exhausted}`,
     outcomeClause: switched ? `switched to ${describeCredential(payload.provider, {
       method: payload.candidateMethod,
       scope: payload.candidateScope,
@@ -2332,6 +2337,7 @@ var forkChatRequestSchema = z10.object({
 function describeQuotaLimit(reason) {
   if (reason === "auth_failed") return "could not authenticate";
   if (reason === "credits_required") return "needed usage credits for the selected model";
+  if (reason === "model_unavailable") return "could not serve the selected model";
   return reason === "out_of_credits" ? "ran out of credits" : "hit its usage limit";
 }
 function describeChatForkReason(reason, provider2) {
@@ -7506,6 +7512,7 @@ function coerceClaudeResultPayload(payload) {
     is_error: typeof payload.is_error === "boolean" ? payload.is_error : void 0,
     subtype: typeof payload.subtype === "string" ? payload.subtype : void 0,
     errors: Array.isArray(payload.errors) ? payload.errors.filter((e) => typeof e === "string") : void 0,
+    result: typeof payload.result === "string" ? payload.result : void 0,
     terminal_reason: typeof payload.terminal_reason === "string" ? payload.terminal_reason : void 0
   };
 }
@@ -7859,7 +7866,7 @@ function parseClaudeEvents(events, parentToolUseId) {
         messages.push({
           id: `error-${event.timestamp}`,
           type: "error",
-          message: genuineErrors.length > 0 ? genuineErrors.join("\n") : "Claude session encountered an unexpected error.",
+          message: genuineErrors.length > 0 ? genuineErrors.join("\n") : payload.result || "Claude session encountered an unexpected error.",
           timestamp: event.timestamp
         });
       }
@@ -10565,6 +10572,7 @@ export {
   isValidThinkingLevel,
   codexReasoningEffortForThinkingLevel,
   getProviderDisplayName,
+  exhaustedUntil,
   detectAgentQuotaLimit,
   listOpenAICompatibleModels,
   resolveOpenAICompatibleModelsUrl,

package/dist/src/{chunk-6Q2GHJ6S.js → chunk-A2KHDTEF.js}

@@ -5,14 +5,14 @@ import {
   getOriginDefaultBranch,
   monolithRequest,
   runGitCommand
-} from "./chunk-THUCGBYF.js";
+} from "./chunk-22SSG3WW.js";
 import {
   extractCommandProtectionCommandText,
   findCommandProtectionGitLookups,
   findGitCommitSignals,
   findPrMergeSignals,
   parseCommandProtectionRequest
-} from "./chunk-2G5ZU67U.js";
+} from "./chunk-4A6I7LPY.js";
 
 // src/services/command-protection-service.ts
 import { readFile, stat } from "fs/promises";

package/dist/src/{chunk-34PT4Z5G.js → chunk-BGMMK24G.js}

@@ -3,10 +3,10 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   execFileAsync
-} from "./chunk-3DNCWVQY.js";
+} from "./chunk-ZGHPW4OS.js";
 import {
   isVersionBelow
-} from "./chunk-2G5ZU67U.js";
+} from "./chunk-4A6I7LPY.js";
 
 // src/utils/codex-agent-env.ts
 function buildCodexAgentEnv(source = process.env) {
@@ -240,7 +240,7 @@ function getCodexModelProvider(method) {
   if (method === "foundry") return "azure";
   return method === "ollama" || method === "openai-compatible" ? "replicas_openai_compatible" : "openai";
 }
-var ENGINE_PACKAGE_VERSION = "0.1.1292";
+var ENGINE_PACKAGE_VERSION = "0.1.1294";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";

package/dist/src/{chunk-TXAJDSKC.js → chunk-DGO2DXHA.js}

@@ -5,7 +5,7 @@ import {
   extractCommandProtectionCommandText,
   isRecord,
   parseCodeHostPrUrl
-} from "./chunk-2G5ZU67U.js";
+} from "./chunk-4A6I7LPY.js";
 
 // src/services/published-pull-request-urls.ts
 function publishedPullRequestUrls(result) {

package/dist/src/{chunk-DYH6IOEA.js → chunk-ILADSZLY.js}

@@ -10,15 +10,15 @@ import {
   resolveDiffBase,
   runGitCommand,
   setAgentCredentialSnapshot
-} from "./chunk-THUCGBYF.js";
+} from "./chunk-22SSG3WW.js";
 import {
   AppServerProcess,
   buildCodexAgentEnv
-} from "./chunk-34PT4Z5G.js";
+} from "./chunk-BGMMK24G.js";
 import {
   SUBPROCESS_MAX_BUFFER,
   execFileAsync
-} from "./chunk-3DNCWVQY.js";
+} from "./chunk-ZGHPW4OS.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
@@ -43,6 +43,7 @@ import {
   createSuccessResult,
   decodePathSegments,
   detectAgentQuotaLimit,
+  exhaustedUntil,
   fileContentDiff,
   isGitHubUrl,
   isSameCredential,
@@ -55,7 +56,7 @@ import {
   resolveOpenAICompatibleModelsUrl,
   splitMothershipInstructions,
   withTimeout
-} from "./chunk-2G5ZU67U.js";
+} from "./chunk-4A6I7LPY.js";
 
 // src/managers/codex-token-manager.ts
 import { promises as fs } from "fs";
@@ -81,9 +82,19 @@ function applyAuthEnvTransition(params) {
 // src/services/credential-fallbacks.ts
 var fallbacksByAgent = /* @__PURE__ */ new Map();
 var exhaustedByAgent = /* @__PURE__ */ new Map();
+var fallbackModels = /* @__PURE__ */ new Map();
 function clearCredentialFallbacks(provider) {
   fallbacksByAgent.delete(provider);
   exhaustedByAgent.delete(provider);
+  fallbackModels.delete(provider);
+}
+function recordFallbackModel(provider, credential, model) {
+  fallbackModels.set(provider, { credential, model });
+}
+function getFallbackModel(provider) {
+  const chosen = fallbackModels.get(provider);
+  const live = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS[provider];
+  return chosen && live && isSameCredential(chosen.credential, live) ? chosen.model : void 0;
 }
 function recordCredentialFallback(notice) {
   fallbacksByAgent.set(notice.provider, notice);
@@ -96,7 +107,8 @@ function listCredentialFallbacks() {
   });
 }
 function listExhaustedCredentials(provider) {
-  return [...exhaustedByAgent.get(provider)?.values() ?? []];
+  const now = Date.now();
+  return [...exhaustedByAgent.get(provider)?.values() ?? []].filter((spent) => spent.until > now).map((spent) => spent.credential);
 }
 function routineRefreshRequest(provider) {
   const live = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS[provider];
@@ -106,9 +118,12 @@ function routineRefreshRequest(provider) {
     ...live ? { currentCredential: live } : {}
   };
 }
-function recordExhaustedCredential(provider, credential) {
+function recordExhaustedCredential(provider, credential, resetsAt) {
   const spent = exhaustedByAgent.get(provider) ?? /* @__PURE__ */ new Map();
-  spent.set(`${credential.method}|${credential.scope}|${credential.credentialId ?? ""}`, credential);
+  spent.set(`${credential.method}|${credential.scope}|${credential.credentialId ?? ""}`, {
+    credential,
+    until: exhaustedUntil(resetsAt).getTime()
+  });
   exhaustedByAgent.set(provider, spent);
 }
 
@@ -191,9 +206,9 @@ var BaseRefreshManager = class {
         ...excludeCredentials.length > 0 ? { excludeCredentials } : {},
         ...params.allowedMethods ? { allowedMethods: [...params.allowedMethods] } : {}
       });
-      if (params.isOauthNow()) {
+      if (params.keepRefreshing()) {
         this.start().catch((error) => {
-          console.error(`[${this.managerName}] Failed to restart OAuth refresh service after fallback:`, error);
+          console.error(`[${this.managerName}] Failed to restart the refresh service after fallback:`, error);
         });
       }
       return createSuccessResult();
@@ -291,7 +306,7 @@ var CodexTokenManager = class extends BaseRefreshManager {
     await this.applyCredentialUpdate(++this.credentialGeneration, async () => {
       await this.applyCredentialsResponse(data);
       setAgentCredentialSnapshot("codex", data);
-      const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-HGZPMM5B.js");
+      const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-RKGMFLDD.js");
       await restartCodexAspHostIfRunning2();
     });
     await this.start(true);
@@ -313,7 +328,7 @@ var CodexTokenManager = class extends BaseRefreshManager {
       const accountChanged = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.codex?.credentialId !== data.credentialId;
       await this.applyCredentialsResponse(data);
       if (restartOnChange && (accountChanged || CODEX_AUTH_ENV_KEYS.some((key, index) => process.env[key] !== previousEnv[index]))) {
-        const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-HGZPMM5B.js");
+        const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-RKGMFLDD.js");
         await restartCodexAspHostIfRunning2();
       }
       setAgentCredentialSnapshot("codex", data);
@@ -381,7 +396,7 @@ var CodexTokenManager = class extends BaseRefreshManager {
           } : exclusions
         );
       },
-      isOauthNow: () => ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "oauth"
+      keepRefreshing: () => ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "oauth"
     });
   }
   async applyCredentialsResponse(response) {
@@ -2028,6 +2043,8 @@ async function listRunningCodexModels() {
 
 export {
   clearCredentialFallbacks,
+  recordFallbackModel,
+  getFallbackModel,
   recordCredentialFallback,
   listCredentialFallbacks,
   routineRefreshRequest,

package/dist/src/{chunk-YNXJCLZW.js → chunk-JFKNSCBZ.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   AspClient
-} from "./chunk-34PT4Z5G.js";
+} from "./chunk-BGMMK24G.js";
 import {
   ASTER_BASE_URL,
   ASTER_PROVIDER,
@@ -15,7 +15,7 @@ import {
   isRecord,
   readOllamaAuthEnv,
   readOpenAICompatibleAuthEnv
-} from "./chunk-2G5ZU67U.js";
+} from "./chunk-4A6I7LPY.js";
 
 // src/managers/codex-asp/notification-dispatch.ts
 var TURN_STARTED_METHOD = "turn/started";

package/dist/src/{chunk-3DNCWVQY.js → chunk-ZGHPW4OS.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   HOOK_EXEC_MAX_BUFFER_BYTES
-} from "./chunk-2G5ZU67U.js";
+} from "./chunk-4A6I7LPY.js";
 
 // src/utils/exec.ts
 import { exec, execFile } from "child_process";

package/dist/src/command-protection-hook.js

@@ -3,13 +3,13 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   evaluateCommandProtection
-} from "./chunk-6Q2GHJ6S.js";
-import "./chunk-THUCGBYF.js";
-import "./chunk-3DNCWVQY.js";
+} from "./chunk-A2KHDTEF.js";
+import "./chunk-22SSG3WW.js";
+import "./chunk-ZGHPW4OS.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
-import "./chunk-2G5ZU67U.js";
+import "./chunk-4A6I7LPY.js";
 import "./chunk-VEQXQN22.js";
 
 // src/command-protection-hook.ts

package/dist/src/headless-agent.js

@@ -14,12 +14,12 @@ import {
   recoverCompletedTurn,
   spawnMuseMsp,
   startMuseSession
-} from "./chunk-YNXJCLZW.js";
+} from "./chunk-JFKNSCBZ.js";
 import {
   AppServerProcess,
   buildCodexAgentEnv
-} from "./chunk-34PT4Z5G.js";
-import "./chunk-3DNCWVQY.js";
+} from "./chunk-BGMMK24G.js";
+import "./chunk-ZGHPW4OS.js";
 import {
   AGENT,
   OPENCODE_GO_PROVIDER,
@@ -29,7 +29,7 @@ import {
   headlessAgentUsagePath,
   isRecord,
   withTimeout
-} from "./chunk-2G5ZU67U.js";
+} from "./chunk-4A6I7LPY.js";
 import "./chunk-VEQXQN22.js";
 
 // src/headless-agent.ts

package/dist/src/index.js

@@ -27,7 +27,7 @@ import {
   evaluateCommandProtection,
   extractToolCommand,
   reportCommandProtectionBlock
-} from "./chunk-6Q2GHJ6S.js";
+} from "./chunk-A2KHDTEF.js";
 import {
   ACCOUNT_RATE_LIMITS_UPDATED_METHOD,
   AGENT_MESSAGE_DELTA_METHOD,
@@ -65,10 +65,10 @@ import {
   spawnMuseMsp,
   startMuseSession,
   uuidV7
-} from "./chunk-YNXJCLZW.js";
+} from "./chunk-JFKNSCBZ.js";
 import {
   publishedPullRequestUrls
-} from "./chunk-TXAJDSKC.js";
+} from "./chunk-DGO2DXHA.js";
 import {
   ACCOUNT_RATE_LIMITS_READ_METHOD,
   AsyncLock,
@@ -117,6 +117,7 @@ import {
   formatTurnFailure,
   getAgentAdditionalDirectories,
   getCodexAspHost,
+  getFallbackModel,
   getReconciledActiveTurnId,
   gitService,
   isQuotaErrorMessage,
@@ -129,6 +130,7 @@ import {
   normalizeImages,
   recordCredentialFallback,
   recordExhaustedCredential,
+  recordFallbackModel,
   refreshDelayMs,
   removeCredentialFileLines,
   removeTempImageFiles,
@@ -141,7 +143,7 @@ import {
   timestampFromSeconds,
   upsertCredentialFileLines,
   writeSecureCredentialFile
-} from "./chunk-DYH6IOEA.js";
+} from "./chunk-ILADSZLY.js";
 import {
   ENGINE_ENV,
   monolithRequest,
@@ -151,15 +153,15 @@ import {
   resolveDiffBase,
   setAgentCredentialSnapshot,
   setLinearSessionId
-} from "./chunk-THUCGBYF.js";
+} from "./chunk-22SSG3WW.js";
 import {
   getCodexModelProvider
-} from "./chunk-34PT4Z5G.js";
+} from "./chunk-BGMMK24G.js";
 import {
   SUBPROCESS_MAX_BUFFER,
   execAsync,
   execFileAsync
-} from "./chunk-3DNCWVQY.js";
+} from "./chunk-ZGHPW4OS.js";
 import {
   isRecord as isRecord2
 } from "./chunk-UZSNFLDQ.js";
@@ -409,7 +411,7 @@ import {
   workspaceTokenRequestSchema,
   workspaceTokenResponseSchema,
   wrapInTag
-} from "./chunk-2G5ZU67U.js";
+} from "./chunk-4A6I7LPY.js";
 import {
   cloneMcpConfig,
   ensureCompatibilityImports,
@@ -8815,6 +8817,7 @@ var ClaudeTokenManager = class extends BaseRefreshManager {
   wipeCheckRunning = false;
   wipeCheckPending = false;
   refreshQueue = Promise.resolve();
+  fellBack = false;
   constructor() {
     super("ClaudeTokenManager");
   }
@@ -8829,7 +8832,7 @@ var ClaudeTokenManager = class extends BaseRefreshManager {
   }
   getSkipReason() {
     const method = ENGINE_ENV.REPLICAS_CLAUDE_AUTH_METHOD;
-    if (method === "ollama" || method === "api_key" || method === "bedrock" || method === "foundry") {
+    if ((method === "ollama" || method === "api_key" || method === "bedrock" || method === "foundry") && !this.fellBack) {
       return `auth method is ${method}`;
     }
     return null;
@@ -8838,6 +8841,7 @@ var ClaudeTokenManager = class extends BaseRefreshManager {
     await this.refreshWithRequest(() => routineRefreshRequest("claude"));
   }
   async switchCredentials(data) {
+    this.fellBack = false;
     await this.applyCredentialUpdate(++this.credentialGeneration, () => this.applyCredentialsResponse(data));
     await this.start(true);
   }
@@ -8860,6 +8864,7 @@ var ClaudeTokenManager = class extends BaseRefreshManager {
   async fetchFreshCredentials(failureReason, failureKind = "rejected", failedCredential = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.claude, allowedMethods, resetsAt) {
     const configuredMethod = ENGINE_ENV.REPLICAS_CLAUDE_AUTH_METHOD;
     const failedMethod = failedCredential?.method === "ollama" || failedCredential?.method === "oauth" || failedCredential?.method === "api_key" || failedCredential?.method === "bedrock" || failedCredential?.method === "foundry" ? failedCredential.method : configuredMethod === "ollama" || configuredMethod === "oauth" || configuredMethod === "api_key" || configuredMethod === "bedrock" || configuredMethod === "foundry" ? configuredMethod : void 0;
+    this.fellBack = true;
     return this.swapCredentials({
       provider: "claude",
       failureKind,
@@ -8872,7 +8877,7 @@ var ClaudeTokenManager = class extends BaseRefreshManager {
         ...resetsAt ? { resetsAt } : {},
         ...exclusions
       } : exclusions),
-      isOauthNow: () => ENGINE_ENV.REPLICAS_CLAUDE_AUTH_METHOD === "oauth"
+      keepRefreshing: () => !this.getSkipReason()
     });
   }
   // A one-year token goes in CLAUDE_CODE_OAUTH_TOKEN, and a leftover file login would otherwise be refreshed and wiped.
@@ -11226,7 +11231,7 @@ var MuseTokenManager = class extends BaseRefreshManager {
         await writeSecureCredentialFile(MUSE_AUTH_PATH, serializeMuseAuthFile(data), { ensureParentDir: true });
         setAgentCredentialSnapshot("muse", data);
       },
-      isOauthNow: () => false
+      keepRefreshing: () => false
     });
   }
 };
@@ -11271,7 +11276,7 @@ var OpencodeTokenManager = class extends BaseRefreshManager {
         Object.assign(process.env, data.auth.env);
         setAgentCredentialSnapshot("opencode", data);
       },
-      isOauthNow: () => false
+      keepRefreshing: () => false
     });
   }
 };
@@ -11300,8 +11305,14 @@ function describeLoginFailure(provider, login, configuredMethod, revoked) {
   const agent = getProviderDisplayName(provider);
   const method = login?.method ?? configuredMethod;
   const name = login ? describeCredential(provider, login) : `the ${agent} credential this workspace uses`;
+  const orgLogin = login?.scope === CREDENTIAL_SCOPE.ORG;
+  const agentsPage = orgLogin ? `Organization \u2192 Coding Agents: ${DEFAULT_WEB_APP_URL}${WEB_APP_PATHS.agents}` : `Personal \u2192 Coding Agents: ${DEFAULT_WEB_APP_URL}${WEB_APP_PATHS.accountAgents}`;
+  if (provider === "claude" && (method === "oauth" || revoked)) {
+    const fixer = orgLogin ? "an organization admin" : login?.account?.ownerName ?? "you";
+    return `${agent} could not sign in with ${name}. The login expired or was revoked. Replicas recently switched to one-year Claude logins, so ${fixer} should update the Replicas CLI (\`npm install -g replicas-cli@latest\`) and reconnect with \`replicas claude-auth${orgLogin ? " --org" : ""}\`. Claude logins are listed in ${agentsPage}`;
+  }
   const why = revoked ? "It was signed out, revoked, or expired." : method === "api_key" ? "The key may be invalid, revoked, out of credits, or missing access to the selected model." : method === "bedrock" ? "Check its credentials, region, IAM permissions, and Claude model access." : method === "foundry" ? `Check its API key, resource, and ${agent} deployment names.` : "It was rejected even after a refresh.";
-  const reconnect = login?.scope === CREDENTIAL_SCOPE.ORG ? `An organization admin can reconnect it in Organization \u2192 Coding Agents: ${DEFAULT_WEB_APP_URL}${WEB_APP_PATHS.agents}` : `Reconnect it in Personal \u2192 Coding Agents: ${DEFAULT_WEB_APP_URL}${WEB_APP_PATHS.accountAgents}`;
+  const reconnect = orgLogin ? `An organization admin can reconnect it in ${agentsPage}` : `Reconnect it in ${agentsPage}`;
   return `${agent} could not sign in with ${name}. ${why} ${reconnect}`;
 }
 var fallbackLocks = /* @__PURE__ */ new Map();
@@ -11325,7 +11336,7 @@ var AuthFallbackCoordinator = class {
     const live = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS[this.provider];
     const exhausted = attempted ?? live;
     const alreadyReplaced = !!exhausted && !!live && !isSameCredential(live, exhausted);
-    if (exhausted) recordExhaustedCredential(this.provider, exhausted);
+    if (exhausted) recordExhaustedCredential(this.provider, exhausted, resetsAt);
     const { userId, excludeProviders, forkable } = this.context();
     const plan = await monolithService.getFallbackPlan({
       provider: this.provider,
@@ -11342,20 +11353,18 @@ var AuthFallbackCoordinator = class {
     for (const step of steps) {
       if (step.kind === "harness") {
         if (!forkable || !isAgentAvailable(step.provider)) continue;
-        if (reason === "auth_failed") break;
+        if (reason === "auth_failed" || reason === "model_unavailable") continue;
         return { outcome: "fork", target: step };
       }
       if (alreadyReplaced && live) {
         if (step.methods.length > 0 && !step.methods.includes(live.method)) continue;
-        this.recordNotice(reason, exhausted, live, "switched", detail);
-        const model2 = step.models?.[live.method];
-        return { outcome: "switched", ...model2 ? { model: model2 } : {} };
+        return this.switched(reason, exhausted, live, step, detail);
       }
       if (!tokenManager || !exhausted) continue;
       const swap = await tokenManager.fetchFreshCredentials(
         `${this.provider} ${describeQuotaLimit(reason)}: ${detail}`,
         // Skipped via the exclusion above, not rested, so Settings doesn't show a usage limit.
-        reason === "auth_failed" || reason === "credits_required" ? "rejected" : "exhausted",
+        reason === "auth_failed" || reason === "credits_required" || reason === "model_unavailable" ? "rejected" : "exhausted",
         exhausted,
         step.methods.length > 0 ? step.methods : void 0,
         resetsAt
@@ -11369,15 +11378,19 @@ var AuthFallbackCoordinator = class {
         failed = true;
         continue;
       }
-      this.recordNotice(reason, exhausted, applied, "switched", detail);
-      const model = step.models?.[applied.method];
-      return { outcome: "switched", ...model ? { model } : {} };
+      return this.switched(reason, exhausted, applied, step, detail);
     }
     if (!tokenManager || !exhausted) return { outcome: "unavailable" };
     if (!failed) return { outcome: "not_configured" };
     this.recordNotice(reason, exhausted, exhausted, "failed", "Replicas could not load an alternate credential.");
     return { outcome: "failed" };
   }
+  switched(reason, exhausted, applied, step, detail) {
+    this.recordNotice(reason, exhausted, applied, "switched", detail);
+    const model = step.models?.[applied.method];
+    if (model) recordFallbackModel(this.provider, applied, model);
+    return { outcome: "switched", ...model ? { model } : {} };
+  }
   recordNotice(reason, exhausted, applied, status, detail) {
     const payload = {
       provider: this.provider,
@@ -12964,6 +12977,12 @@ var ClaudeAuthError = class extends Error {
     this.name = "ClaudeAuthError";
   }
 };
+var ClaudeModelUnavailableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ClaudeModelUnavailableError";
+  }
+};
 var ClaudeTransientTurnError = class extends Error {
   constructor(message, midTurn = false) {
     super(message);
@@ -13030,6 +13049,8 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
   sessionLinearForwarder = null;
   pendingTurn = null;
   attemptSawActivity = false;
+  // A broken login the turn moved past; if the turn still fails, it is the error the user can act on.
+  turnLoginFailure = null;
   sessionActivity = createClaudeSessionActivity();
   backgroundContinuationTimer = null;
   pendingInterrupt = false;
@@ -13416,6 +13437,7 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
     let missingSessionReset = false;
     let currentRequest = request;
     let carriedSteers = /* @__PURE__ */ new Map();
+    this.turnLoginFailure = null;
     await this.goalClear?.catch(() => {
     });
     try {
@@ -13433,8 +13455,9 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
           if (this.turnPromptRecorded) {
             currentRequest = { ...currentRequest, message: CLAUDE_RETRY_PROMPT, images: [], goalMode: false };
           }
-          const quotaKind = _ClaudeManager.quotaLimitKind(error);
-          const isAuthError = !quotaKind && _ClaudeManager.isAuthError(error);
+          const modelUnavailable = error instanceof ClaudeModelUnavailableError;
+          const quotaKind = modelUnavailable ? null : _ClaudeManager.quotaLimitKind(error);
+          const isAuthError = !quotaKind && !modelUnavailable && _ClaudeManager.isAuthError(error);
           if (isAuthError && authRetries < MAX_AUTH_RETRIES) {
             authRetries++;
             console.error(
@@ -13445,9 +13468,14 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
             const refreshed = await claudeTokenManager.fetchFreshCredentials(
               error instanceof Error ? error.message : String(error),
               "rejected",
-              attemptedCredential
+              attemptedCredential,
+              attemptedCredential ? [attemptedCredential.method] : void 0
             );
             if (refreshed.ok) {
+              const live = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.claude;
+              if (attemptedCredential && live && !isSameCredential(attemptedCredential, live)) {
+                this.turnLoginFailure ??= describeLoginFailure("claude", attemptedCredential, resolveClaudeAuthMethodForMessage(), false);
+              }
               attempt++;
               continue;
             }
@@ -13456,13 +13484,16 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
             loginRevoked = (method === "oauth" || method === "unknown") && failure?.code === "oauth_disconnected";
             namedLogin = failure?.credential;
           }
-          if (quotaKind || isAuthError) {
-            const reason = quotaKind ?? "auth_failed";
-            const detail = error instanceof ClaudeQuotaError ? error.message : extractErrorText(error);
+          if (quotaKind || isAuthError || modelUnavailable) {
+            const reason = quotaKind ?? (modelUnavailable ? "model_unavailable" : "auth_failed");
+            const detail = error instanceof ClaudeQuotaError || error instanceof ClaudeModelUnavailableError ? error.message : extractErrorText(error);
             const repeated = !!attemptedCredential && failedCredentials.some((failed) => isSameCredential(failed, attemptedCredential));
             if (attemptedCredential) failedCredentials.push(attemptedCredential);
             const fallback = repeated ? { outcome: "unavailable" } : await this.fallBackCredential(reason, detail, attemptedCredential, error instanceof ClaudeQuotaError ? error.resetsAt : void 0);
             if (fallback.outcome === "switched") {
+              if (isAuthError) {
+                this.turnLoginFailure ??= describeLoginFailure("claude", attemptedCredential ?? namedLogin, resolveClaudeAuthMethodForMessage(), loginRevoked);
+              }
               if (fallback.model) currentRequest = { ...currentRequest, model: fallback.model };
               authRetries = 0;
               loginRevoked = false;
@@ -13475,6 +13506,10 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
               await this.emitQuotaExhaustedEvent(quotaKind, fallback, detail, attemptedCredential);
               return;
             }
+            if (modelUnavailable) {
+              await this.emitTerminalErrorResult(detail, [`${detail} No other credential in the fallback chain could serve it. Pick a different model, or check Settings \u2192 Fallbacks.`]);
+              return;
+            }
             failedLogin = { credential: attemptedCredential ?? namedLogin, revoked: loginRevoked };
             throw error;
           }
@@ -13525,6 +13560,7 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
       if (failedLogin) {
         await this.emitAuthRetryExhaustedEvent(lastError, failedLogin.credential, failedLogin.revoked);
       }
+      this.turnLoginFailure = null;
       try {
         await this.historyFile.flush();
         await this.onTurnComplete();
@@ -13544,7 +13580,7 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
         subtype: "error_during_execution",
         is_error: true,
         result,
-        errors,
+        errors: [.../* @__PURE__ */ new Set([...this.turnLoginFailure ? [this.turnLoginFailure] : [], ...errors])],
         session_id: this.sessionId ?? "",
         parent_tool_use_id: null
       }
@@ -13611,7 +13647,10 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
       this.buildCombinedInstructions(customInstructions, true),
       "Background tasks must have a concrete completion condition. Use foreground commands for sequential work and managed workspace services for servers. Reserve persistent Monitor tasks for ongoing watches the user requested. You may end a turn while actual background work continues, but do not promise a later update unless a task was successfully launched. Report completion or failure when its notification arrives. Always give background commands a short description: the chat shows it to the user when the task finishes."
     ].filter(Boolean).join("\n\n");
-    const resolvedModel = normalizeClaudeModel(model) || (resolveClaudeAuthMethodForMessage() === "ollama" ? DEFAULT_OLLAMA_MODEL : void 0) || DEFAULT_CLAUDE_MODEL;
+    const requestedModel = normalizeClaudeModel(model);
+    const authMethod = resolveClaudeAuthMethodForMessage();
+    const isClaudeModel = !!requestedModel && /^claude-/i.test(requestedModel);
+    const resolvedModel = authMethod === "ollama" ? getFallbackModel("claude") ?? (requestedModel && !isClaudeModel ? requestedModel : DEFAULT_OLLAMA_MODEL) : (authMethod === "oauth" || authMethod === "api_key") && requestedModel && !isClaudeModel ? DEFAULT_CLAUDE_MODEL : requestedModel || DEFAULT_CLAUDE_MODEL;
     const claudeCodeModel = toClaudeCodeModel(
       resolvedModel,
       ENGINE_ENV.REPLICAS_CLAUDE_AUTH_METHOD === "bedrock" || ENGINE_ENV.CLAUDE_CODE_USE_BEDROCK === "1"
@@ -13894,7 +13933,7 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
         }
         const authErrorMessage = _ClaudeManager.detectAuthErrorInMessage(msg);
         const transientErrorMessage = _ClaudeManager.detectTransientTurnErrorInMessage(msg);
-        const turnError = authErrorMessage ? new ClaudeAuthError(authErrorMessage) : msg.type === "result" && msg.subtype !== "success" && msg.num_turns === 0 && msg.errors.some((err) => err.startsWith("No conversation found with session ID")) ? new ClaudeMissingSessionError(msg.errors.join("\n")) : _ClaudeManager.detectQuotaErrorInMessage(msg, creditsRequired, resetsAt) ?? (transientErrorMessage ? new ClaudeTransientTurnError(transientErrorMessage, this.pendingTurn?.sawActivity ?? false) : null);
+        const turnError = authErrorMessage ? new ClaudeAuthError(authErrorMessage) : _ClaudeManager.isModelUnavailableMessage(msg) ? new ClaudeModelUnavailableError(_ClaudeManager.assistantText(msg)) : msg.type === "result" && msg.subtype !== "success" && msg.num_turns === 0 && msg.errors.some((err) => err.startsWith("No conversation found with session ID")) ? new ClaudeMissingSessionError(msg.errors.join("\n")) : _ClaudeManager.detectQuotaErrorInMessage(msg, creditsRequired, resetsAt) ?? (transientErrorMessage ? new ClaudeTransientTurnError(transientErrorMessage, this.pendingTurn?.sawActivity ?? false) : null);
         if (turnError) {
           suppressLinearResponseFlush = true;
           turnFailed = true;
@@ -13931,7 +13970,9 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
         if (!this.pendingTurn && msg.type === "system" && (msg.subtype === "init" || msg.subtype === "session_state_changed" && msg.state === "running")) {
           this.pendingBackgroundCompletion = true;
         }
-        await this.handleMessage(msg);
+        const loginFailure = msg.type === "result" && msg.user_message_uuid && this.pendingTurn?.userMessageUuids.has(msg.user_message_uuid) ? this.turnLoginFailure : null;
+        await this.handleMessage(msg.type === "result" && loginFailure && isClaudeResultError(msg) ? msg.subtype === "success" ? { ...msg, result: `${loginFailure}
+${msg.result}` } : { ...msg, errors: [loginFailure, ...msg.errors] } : msg);
         if (this.activeQuery !== response) break;
         const linearSessionId = this.linearSessionId;
         if (linearSessionId && this.sessionLinearForwarder) {
@@ -14184,6 +14225,12 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
       console.warn("[ClaudeManager] Failed to record context usage:", error instanceof Error ? error.message : error);
     }
   }
+  static isModelUnavailableMessage(message) {
+    return message.type === "assistant" && "error" in message && message.error === "model_not_found";
+  }
+  static assistantText(message) {
+    return message.type === "assistant" && Array.isArray(message.message?.content) ? message.message.content.map((block) => "text" in block ? block.text : "").join("\n") : "";
+  }
   static isAuthError(error) {
     if (error instanceof ClaudeAuthError) return true;
     return isClaudeAuthErrorText(error instanceof Error ? error.message : String(error));
@@ -14195,8 +14242,7 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
   static detectQuotaErrorInMessage(message, creditsRequired, resetsAt) {
     const quotaError = (text2, kind2) => new ClaudeQuotaError(text2, creditsRequired ? "credits_required" : kind2, resetsAt);
     if (message.type === "assistant" && "error" in message) {
-      const content = Array.isArray(message.message?.content) ? message.message.content.map((block) => "text" in block ? block.text : "").join("\n") : "";
-      const text2 = [typeof message.error === "string" ? message.error : "", content].filter(Boolean).join("\n");
+      const text2 = [typeof message.error === "string" ? message.error : "", _ClaudeManager.assistantText(message)].filter(Boolean).join("\n");
       const kind2 = detectAgentQuotaLimit(text2);
       if (kind2) return quotaError(text2, kind2);
     }
@@ -60049,7 +60095,7 @@ function terminalErrorsFromEvent(event, provider) {
     const payload = coerceClaudeResultPayload(event.payload);
     if (!isClaudeResultError(payload)) return null;
     const errors2 = stripAgentDiagnosticErrors(payload.errors ?? []);
-    return errors2.length > 0 ? errors2 : ["Claude run failed"];
+    return errors2.length > 0 ? errors2 : [payload.result || "Claude run failed"];
   }
   if (event.type === CODEX_QUOTA_STATUS_EVENT_TYPE) {
     return event.payload.state === "out_of_credits" ? ["Codex is out of credits. Top up the connected OpenAI account to resume."] : null;
@@ -61360,7 +61406,8 @@ ${note}`;
       chatId: persisted.id,
       originChatId,
       chatTitle: () => persisted.title,
-      onModelSwitched,
+      // Claude maps the model on each turn while the fallback credential is live, so the chat keeps its own for when the primary returns.
+      ...baseProvider === "claude" ? {} : { onModelSwitched },
       onChatCredential,
       lastSenderKey: persisted.lastSenderKey,
       onLastSenderKeyChanged,
@@ -63577,7 +63624,9 @@ data: ${JSON.stringify("Terminal session not found")}
     return c.json(await environmentDetailsService.getDetails());
   });
   app2.post("/claude/refresh-now", async (c) => {
-    const result = await claudeTokenManager.refreshOnce();
+    const reconnected = c.req.query("reconnected") === "1";
+    if (reconnected) clearCredentialFallbacks("claude");
+    const result = await claudeTokenManager.refreshOnce(reconnected);
     if (!result.ok) {
       return c.json(jsonError("Failed to refresh Claude credentials", result.error.message), 502);
     }

package/dist/src/post-tool-pr-hook.js

@@ -3,13 +3,13 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   publishedPullRequestUrls
-} from "./chunk-TXAJDSKC.js";
+} from "./chunk-DGO2DXHA.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
 import {
   shouldRefreshPullRequests
-} from "./chunk-2G5ZU67U.js";
+} from "./chunk-4A6I7LPY.js";
 import "./chunk-VEQXQN22.js";
 
 // src/services/post-tool-pr-notifier.ts

package/dist/src/subagent-mcp.js

@@ -11,7 +11,7 @@ import {
   spawnSubagentRequestSchema,
   subagentResponseSchema,
   waitSubagentRequestSchema
-} from "./chunk-2G5ZU67U.js";
+} from "./chunk-4A6I7LPY.js";
 import "./chunk-VEQXQN22.js";
 
 // src/subagent-mcp.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.1292",
+  "version": "0.1.1294",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",