replicas-engine 0.1.1306 → 0.1.1308

package/dist/src/{asp-host-AQZFJO5T.js → asp-host-UZTWCJFQ.js}

@@ -8,12 +8,12 @@ import {
   listRunningCodexModels,
   restartCodexAspHost,
   restartCodexAspHostIfRunning
-} from "./chunk-YJ7NCHM6.js";
-import "./chunk-TKAWFIXX.js";
-import "./chunk-OSPDTEXF.js";
-import "./chunk-IHC4JY3Q.js";
+} from "./chunk-XBKJROPE.js";
+import "./chunk-CDRCJUTU.js";
+import "./chunk-QCV7O27G.js";
+import "./chunk-FDLME7OO.js";
 import "./chunk-UZSNFLDQ.js";
-import "./chunk-QBNBBWCE.js";
+import "./chunk-JEP6EFK4.js";
 import "./chunk-VEQXQN22.js";
 export {
   CODEX_ULTRAFAST_SERVICE_TIER,

package/dist/src/{chunk-TKAWFIXX.js → chunk-CDRCJUTU.js}

@@ -4,7 +4,7 @@ const require = __createRequire(import.meta.url);
 import {
   SUBPROCESS_MAX_BUFFER,
   execFileAsync
-} from "./chunk-IHC4JY3Q.js";
+} from "./chunk-FDLME7OO.js";
 import {
   isRecord as isRecord2
 } from "./chunk-UZSNFLDQ.js";
@@ -22,7 +22,7 @@ import {
   provisionedDeviceSchema,
   readReplicasRuntimeEnv,
   serializePosixEnvFile
-} from "./chunk-QBNBBWCE.js";
+} from "./chunk-JEP6EFK4.js";
 
 // src/runtime-env-loader.ts
 import { readFileSync } from "fs";

package/dist/src/{chunk-IHC4JY3Q.js → chunk-FDLME7OO.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   HOOK_EXEC_MAX_BUFFER_BYTES
-} from "./chunk-QBNBBWCE.js";
+} from "./chunk-JEP6EFK4.js";
 
 // src/utils/exec.ts
 import { exec, execFile } from "child_process";

package/dist/src/{chunk-QBNBBWCE.js → chunk-JEP6EFK4.js}

@@ -2148,6 +2148,19 @@ if [ "$1" = "get" ]; then
       fi
     fi
   fi
+  if ! printf '%s
+' "$credential" | grep -q '^password='; then
+    host=$(printf '%s
+' "$request" | sed -n 's/^host=//p')
+    repository=$(printf '%s
+' "$request" | sed -n 's/^path=//p' | sed 's/\\.git$//')
+    # The engine drops every github.com line when GitHub refuses a refresh, so other lines for the host mean this repository was never granted.
+    if grep -q "@$host" ${shellQuotePosix(credentialsPath)} 2>/dev/null; then
+      echo "Replicas: this workspace has no credentials for \${repository:-this repository}. Only the repositories in its environment get them, so the fix is a workspace on an environment that includes it." >&2
+    else
+      echo "Replicas: this workspace has no credentials for $host. Either its environment includes no repository there, or Replicas could not refresh its access; the engine log says which." >&2
+    fi
+  fi
   printf '%s
 ' "$credential"
 elif [ "$1" = "erase" ]; then
@@ -3301,7 +3314,8 @@ Use this when:
 - You're opening pull requests that build on each other (a stack)
 - You need to interact with GitHub issues or actions
 - You need to use the GitHub API for advanced operations
-- You need to include images in PR descriptions`;
+- You need to include images in PR descriptions
+- Pushing or opening a pull request failed`;
 var REFERENCE4 = `# GitHub Integration
 
 This guide covers how to interact with GitHub from within your Replicas workspace. Prefer \`@replicas/sdk\` for API calls so batching and data processing stay in one TypeScript program. The \`gh\` CLI remains useful for ergonomic pull request and git-adjacent workflows.
@@ -3341,6 +3355,14 @@ gh pr checks 123
 gh pr merge 123
 \`\`\`
 
+### When pushing or opening a pull request fails
+
+Tell the person the real cause and the real fix, not a guess. Check \`git remote -v\`, \`git config --show-origin --get-all credential.helper\`, and \`gh auth status\` first.
+
+- **The Replicas credential helper says this workspace has no credentials for the repository:** the repository isn't in the workspace's environment, so this workspace can't push to it even if you cloned it yourself. Say so, and that a workspace on an environment that includes the repository can make the change. When it says it has no credentials for the whole host, check \`~/.replicas/logs\` for a failed GitHub token refresh before choosing a cause.
+- **\`Resource not accessible by integration\`, or a 403 or 404 that isn't a rate limit:** the token in use can't write to that repository. When it isn't the workspace's own (Replicas configures \`gh\` and the \`~/${GIT_CREDENTIAL_HELPER_FILENAME}\` credential helper), it came from the environment, such as a start hook or variable: say that token lacks access and retry with the workspace's own credentials. Otherwise the Replicas GitHub App can't reach the repository: an organization admin has to install it there or grant it access. A rate limit (\`API rate limit exceeded\`, \`x-ratelimit-remaining: 0\`) only needs a wait and a retry.
+- Say to reconnect GitHub only when the error itself says so, which happens when PR user attribution is on and the person's GitHub account is missing or expired.
+
 ### Stacked Pull Requests
 
 When a change spans pull requests that build on each other, open each one with \`--base\` set to the branch below it, then link them into a GitHub stack. GitHub then shows the whole stack on every pull request in it. The \`gh stack\` extension is pre-installed.
@@ -6045,9 +6067,17 @@ var dreamVerdictSchema = dreamVerdictChecksSchema.extend({ approve: z21.boolean(
 var learnedSkillFormatInstruction = (speaker) => `Write a SKILL.md whose frontmatter has a kebab-case \`name\` and a short \`description\` that starts with "Use when" and names the situations it applies to; the body records only what ${speaker} actually said, restated as a direct instruction, usually one to three lines. Every line of a learning is loaded into future sessions, so leave out anything an agent could infer on its own: no headings, explanations, rules, or examples unless ${speaker} stated those specifics themselves. For "from now on, use Conventional Commits", the body is just "Use Conventional Commits for every commit message and PR title."`;
 
 // ../shared/src/user-message-matching.ts
+var parsedTimestamps = /* @__PURE__ */ new Map();
 function parseTimestampMs(timestamp) {
-  const value = typeof timestamp === "number" ? timestamp : Date.parse(timestamp);
-  return Number.isFinite(value) ? value : 0;
+  if (typeof timestamp === "number") return Number.isFinite(timestamp) ? timestamp : 0;
+  let value = parsedTimestamps.get(timestamp);
+  if (value === void 0) {
+    const parsed = Date.parse(timestamp);
+    value = Number.isFinite(parsed) ? parsed : 0;
+    if (parsedTimestamps.size >= 5e4) parsedTimestamps.clear();
+    parsedTimestamps.set(timestamp, value);
+  }
+  return value;
 }
 function areUserMessagesWithinMatchWindow(a, b) {
   return a.content === b.content && Math.abs(parseTimestampMs(a.timestamp) - parseTimestampMs(b.timestamp)) <= USER_MESSAGE_MATCH_GRACE_PERIOD_MS;
@@ -8232,6 +8262,7 @@ function isAgentBackendEvent(value) {
   const candidate = value;
   return typeof candidate.timestamp === "string" && typeof candidate.type === "string" && typeof candidate.payload === "object" && candidate.payload !== null;
 }
+var strippedUserContents = /* @__PURE__ */ new Map();
 function filterDisplayMessages(messages, provider2) {
   let result = messages;
   if (provider2 === "codex") {
@@ -8242,7 +8273,13 @@ function filterDisplayMessages(messages, provider2) {
   }
   result = result.flatMap((msg) => {
     if (msg.type !== "user") return [msg];
-    const { content, files, walkthroughs, appshots, annotations } = stripAttachmentNote(stripReplicasInstructionBlock(msg.content).trim());
+    let stripped = strippedUserContents.get(msg.content);
+    if (!stripped) {
+      stripped = stripAttachmentNote(stripReplicasInstructionBlock(msg.content).trim());
+      if (strippedUserContents.size >= 5e3) strippedUserContents.clear();
+      strippedUserContents.set(msg.content, stripped);
+    }
+    const { content, files, walkthroughs, appshots, annotations } = stripped;
     if (INTERRUPTED_MESSAGE_REGEX.test(content)) {
       return [{ id: msg.id, type: "interruption", timestamp: msg.timestamp }];
     }
@@ -10808,6 +10845,24 @@ export {
   SUBAGENT_SERVICE_TIERS,
   serviceTierRequestFields,
   TERMINAL_RTC_ICE_SERVER,
+  REPLICAS_RUNTIME_ENV_ALIASES,
+  readReplicasRuntimeEnv,
+  shellQuotePosix,
+  serializePosixEnvFile,
+  parsePosixEnvUnsetKeys,
+  parsePosixEnvFile,
+  ENGINE_PORT,
+  DESKTOP_STREAM_PORT,
+  DEVICES_DIR,
+  DEVICE_SCREEN_FILE_SUFFIX,
+  GIT_CREDENTIAL_HELPER_FILENAME,
+  GITHUB_CREDENTIAL_REFRESH_PATH,
+  GITLAB_CREDENTIAL_REFRESH_PATH,
+  getGitHubAccessToken,
+  githubCredentialLines,
+  buildGitCredentialHelperScript,
+  parseGitRemote,
+  gitIdentityConfigCommands,
   HISTORY_ROOT,
   HISTORY_INDEX_FILENAME,
   REPLICAS_INSTRUCTIONS_TAG,
@@ -10864,24 +10919,6 @@ export {
   clampTokensToWindow,
   buildCodexTokenUsageContextUsagePayload,
   extractLatestContextUsage,
-  REPLICAS_RUNTIME_ENV_ALIASES,
-  readReplicasRuntimeEnv,
-  shellQuotePosix,
-  serializePosixEnvFile,
-  parsePosixEnvUnsetKeys,
-  parsePosixEnvFile,
-  ENGINE_PORT,
-  DESKTOP_STREAM_PORT,
-  DEVICES_DIR,
-  DEVICE_SCREEN_FILE_SUFFIX,
-  GIT_CREDENTIAL_HELPER_FILENAME,
-  GITHUB_CREDENTIAL_REFRESH_PATH,
-  GITLAB_CREDENTIAL_REFRESH_PATH,
-  getGitHubAccessToken,
-  githubCredentialLines,
-  buildGitCredentialHelperScript,
-  parseGitRemote,
-  gitIdentityConfigCommands,
   InFlightMap,
   createProviderSlashCommand,
   mergeSlashCommands,

package/dist/src/{chunk-VZXRPXJI.js → chunk-KZV23QDU.js}

@@ -6,7 +6,7 @@ import {
   getOriginDefaultBranch,
   monolithRequest,
   runGitCommand
-} from "./chunk-TKAWFIXX.js";
+} from "./chunk-CDRCJUTU.js";
 import {
   extractCommandProtectionCommandText,
   findCommandProtectionGitLookups,
@@ -14,7 +14,7 @@ import {
   findPrMergeSignals,
   findScoutRepoWriteSignals,
   parseCommandProtectionRequest
-} from "./chunk-QBNBBWCE.js";
+} from "./chunk-JEP6EFK4.js";
 
 // src/services/command-protection-service.ts
 import { readFile, stat } from "fs/promises";

package/dist/src/{chunk-4AY3GCWL.js → chunk-MAMNSZ53.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   AspClient
-} from "./chunk-OSPDTEXF.js";
+} from "./chunk-QCV7O27G.js";
 import {
   ASTER_BASE_URL,
   ASTER_PROVIDER,
@@ -15,7 +15,7 @@ import {
   isRecord,
   readOllamaAuthEnv,
   readOpenAICompatibleAuthEnv
-} from "./chunk-QBNBBWCE.js";
+} from "./chunk-JEP6EFK4.js";
 
 // src/managers/codex-asp/notification-dispatch.ts
 var TURN_STARTED_METHOD = "turn/started";

package/dist/src/{chunk-OSPDTEXF.js → chunk-QCV7O27G.js}

@@ -3,10 +3,10 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   execFileAsync
-} from "./chunk-IHC4JY3Q.js";
+} from "./chunk-FDLME7OO.js";
 import {
   isVersionBelow
-} from "./chunk-QBNBBWCE.js";
+} from "./chunk-JEP6EFK4.js";
 
 // src/utils/codex-agent-env.ts
 function buildCodexAgentEnv(source = process.env) {
@@ -240,7 +240,7 @@ function getCodexModelProvider(method) {
   if (method === "foundry") return "azure";
   return method === "ollama" || method === "openai-compatible" ? "replicas_openai_compatible" : "openai";
 }
-var ENGINE_PACKAGE_VERSION = "0.1.1306";
+var ENGINE_PACKAGE_VERSION = "0.1.1308";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";

package/dist/src/{chunk-YJ7NCHM6.js → chunk-XBKJROPE.js}

@@ -10,15 +10,15 @@ import {
   resolveDiffBase,
   runGitCommand,
   setAgentCredentialSnapshot
-} from "./chunk-TKAWFIXX.js";
+} from "./chunk-CDRCJUTU.js";
 import {
   AppServerProcess,
   buildCodexAgentEnv
-} from "./chunk-OSPDTEXF.js";
+} from "./chunk-QCV7O27G.js";
 import {
   SUBPROCESS_MAX_BUFFER,
   execFileAsync
-} from "./chunk-IHC4JY3Q.js";
+} from "./chunk-FDLME7OO.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
@@ -56,7 +56,7 @@ import {
   resolveOpenAICompatibleModelsUrl,
   splitMothershipInstructions,
   withTimeout
-} from "./chunk-QBNBBWCE.js";
+} from "./chunk-JEP6EFK4.js";
 
 // src/managers/codex-token-manager.ts
 import { promises as fs } from "fs";
@@ -306,7 +306,7 @@ var CodexTokenManager = class extends BaseRefreshManager {
     await this.applyCredentialUpdate(++this.credentialGeneration, async () => {
       await this.applyCredentialsResponse(data);
       setAgentCredentialSnapshot("codex", data);
-      const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-AQZFJO5T.js");
+      const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-UZTWCJFQ.js");
       await restartCodexAspHostIfRunning2();
     });
     await this.start(true);
@@ -328,7 +328,7 @@ var CodexTokenManager = class extends BaseRefreshManager {
       const accountChanged = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.codex?.credentialId !== data.credentialId;
       await this.applyCredentialsResponse(data);
       if (restartOnChange && (accountChanged || CODEX_AUTH_ENV_KEYS.some((key, index) => process.env[key] !== previousEnv[index]))) {
-        const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-AQZFJO5T.js");
+        const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-UZTWCJFQ.js");
         await restartCodexAspHostIfRunning2();
       }
       setAgentCredentialSnapshot("codex", data);

package/dist/src/{chunk-DDUTPOJ3.js → chunk-Z5IQAQDK.js}

@@ -5,7 +5,7 @@ import {
   extractCommandProtectionCommandText,
   isRecord,
   parseCodeHostPrUrl
-} from "./chunk-QBNBBWCE.js";
+} from "./chunk-JEP6EFK4.js";
 
 // src/services/published-pull-request-urls.ts
 function publishedPullRequestUrls(result) {

package/dist/src/command-protection-hook.js

@@ -3,13 +3,13 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   evaluateCommandProtection
-} from "./chunk-VZXRPXJI.js";
-import "./chunk-TKAWFIXX.js";
-import "./chunk-IHC4JY3Q.js";
+} from "./chunk-KZV23QDU.js";
+import "./chunk-CDRCJUTU.js";
+import "./chunk-FDLME7OO.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
-import "./chunk-QBNBBWCE.js";
+import "./chunk-JEP6EFK4.js";
 import "./chunk-VEQXQN22.js";
 
 // src/command-protection-hook.ts

package/dist/src/headless-agent.js

@@ -14,12 +14,12 @@ import {
   recoverCompletedTurn,
   spawnMuseMsp,
   startMuseSession
-} from "./chunk-4AY3GCWL.js";
+} from "./chunk-MAMNSZ53.js";
 import {
   AppServerProcess,
   buildCodexAgentEnv
-} from "./chunk-OSPDTEXF.js";
-import "./chunk-IHC4JY3Q.js";
+} from "./chunk-QCV7O27G.js";
+import "./chunk-FDLME7OO.js";
 import {
   AGENT,
   OPENCODE_GO_PROVIDER,
@@ -29,7 +29,7 @@ import {
   headlessAgentUsagePath,
   isRecord,
   withTimeout
-} from "./chunk-QBNBBWCE.js";
+} from "./chunk-JEP6EFK4.js";
 import "./chunk-VEQXQN22.js";
 
 // src/headless-agent.ts

package/dist/src/index.js

@@ -27,7 +27,7 @@ import {
   evaluateCommandProtection,
   extractToolCommand,
   reportCommandProtectionBlock
-} from "./chunk-VZXRPXJI.js";
+} from "./chunk-KZV23QDU.js";
 import {
   ACCOUNT_RATE_LIMITS_UPDATED_METHOD,
   AGENT_MESSAGE_DELTA_METHOD,
@@ -65,10 +65,10 @@ import {
   spawnMuseMsp,
   startMuseSession,
   uuidV7
-} from "./chunk-4AY3GCWL.js";
+} from "./chunk-MAMNSZ53.js";
 import {
   publishedPullRequestUrls
-} from "./chunk-DDUTPOJ3.js";
+} from "./chunk-Z5IQAQDK.js";
 import {
   ACCOUNT_RATE_LIMITS_READ_METHOD,
   AsyncLock,
@@ -143,7 +143,7 @@ import {
   timestampFromSeconds,
   upsertCredentialFileLines,
   writeSecureCredentialFile
-} from "./chunk-YJ7NCHM6.js";
+} from "./chunk-XBKJROPE.js";
 import {
   ENGINE_ENV,
   monolithRequest,
@@ -153,15 +153,15 @@ import {
   resolveDiffBase,
   setAgentCredentialSnapshot,
   setLinearSessionId
-} from "./chunk-TKAWFIXX.js";
+} from "./chunk-CDRCJUTU.js";
 import {
   getCodexModelProvider
-} from "./chunk-OSPDTEXF.js";
+} from "./chunk-QCV7O27G.js";
 import {
   SUBPROCESS_MAX_BUFFER,
   execAsync,
   execFileAsync
-} from "./chunk-IHC4JY3Q.js";
+} from "./chunk-FDLME7OO.js";
 import {
   isRecord as isRecord2
 } from "./chunk-UZSNFLDQ.js";
@@ -415,7 +415,7 @@ import {
   workspaceTokenRequestSchema,
   workspaceTokenResponseSchema,
   wrapInTag
-} from "./chunk-QBNBBWCE.js";
+} from "./chunk-JEP6EFK4.js";
 import {
   cloneMcpConfig,
   ensureCompatibilityImports,

package/dist/src/post-tool-pr-hook.js

@@ -3,13 +3,13 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   publishedPullRequestUrls
-} from "./chunk-DDUTPOJ3.js";
+} from "./chunk-Z5IQAQDK.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
 import {
   shouldRefreshPullRequests
-} from "./chunk-QBNBBWCE.js";
+} from "./chunk-JEP6EFK4.js";
 import "./chunk-VEQXQN22.js";
 
 // src/services/post-tool-pr-notifier.ts

package/dist/src/subagent-mcp.js

@@ -11,7 +11,7 @@ import {
   spawnSubagentRequestSchema,
   subagentResponseSchema,
   waitSubagentRequestSchema
-} from "./chunk-QBNBBWCE.js";
+} from "./chunk-JEP6EFK4.js";
 import "./chunk-VEQXQN22.js";
 
 // src/subagent-mcp.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.1306",
+  "version": "0.1.1308",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",