replicas-engine 0.1.1307 → 0.1.1308

package/dist/src/{asp-host-ES3ZRIPD.js → asp-host-UZTWCJFQ.js}

@@ -8,12 +8,12 @@ import {
   listRunningCodexModels,
   restartCodexAspHost,
   restartCodexAspHostIfRunning
-} from "./chunk-3G23Q57G.js";
-import "./chunk-BKLCEPTJ.js";
-import "./chunk-6HBASR47.js";
-import "./chunk-BLVQL2EL.js";
+} from "./chunk-XBKJROPE.js";
+import "./chunk-CDRCJUTU.js";
+import "./chunk-QCV7O27G.js";
+import "./chunk-FDLME7OO.js";
 import "./chunk-UZSNFLDQ.js";
-import "./chunk-KQBU62MY.js";
+import "./chunk-JEP6EFK4.js";
 import "./chunk-VEQXQN22.js";
 export {
   CODEX_ULTRAFAST_SERVICE_TIER,

package/dist/src/{chunk-BKLCEPTJ.js → chunk-CDRCJUTU.js}

@@ -4,7 +4,7 @@ const require = __createRequire(import.meta.url);
 import {
   SUBPROCESS_MAX_BUFFER,
   execFileAsync
-} from "./chunk-BLVQL2EL.js";
+} from "./chunk-FDLME7OO.js";
 import {
   isRecord as isRecord2
 } from "./chunk-UZSNFLDQ.js";
@@ -22,7 +22,7 @@ import {
   provisionedDeviceSchema,
   readReplicasRuntimeEnv,
   serializePosixEnvFile
-} from "./chunk-KQBU62MY.js";
+} from "./chunk-JEP6EFK4.js";
 
 // src/runtime-env-loader.ts
 import { readFileSync } from "fs";

package/dist/src/{chunk-BLVQL2EL.js → chunk-FDLME7OO.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   HOOK_EXEC_MAX_BUFFER_BYTES
-} from "./chunk-KQBU62MY.js";
+} from "./chunk-JEP6EFK4.js";
 
 // src/utils/exec.ts
 import { exec, execFile } from "child_process";

package/dist/src/{chunk-KQBU62MY.js → chunk-JEP6EFK4.js}

@@ -2148,6 +2148,19 @@ if [ "$1" = "get" ]; then
       fi
     fi
   fi
+  if ! printf '%s
+' "$credential" | grep -q '^password='; then
+    host=$(printf '%s
+' "$request" | sed -n 's/^host=//p')
+    repository=$(printf '%s
+' "$request" | sed -n 's/^path=//p' | sed 's/\\.git$//')
+    # The engine drops every github.com line when GitHub refuses a refresh, so other lines for the host mean this repository was never granted.
+    if grep -q "@$host" ${shellQuotePosix(credentialsPath)} 2>/dev/null; then
+      echo "Replicas: this workspace has no credentials for \${repository:-this repository}. Only the repositories in its environment get them, so the fix is a workspace on an environment that includes it." >&2
+    else
+      echo "Replicas: this workspace has no credentials for $host. Either its environment includes no repository there, or Replicas could not refresh its access; the engine log says which." >&2
+    fi
+  fi
   printf '%s
 ' "$credential"
 elif [ "$1" = "erase" ]; then
@@ -3301,7 +3314,8 @@ Use this when:
 - You're opening pull requests that build on each other (a stack)
 - You need to interact with GitHub issues or actions
 - You need to use the GitHub API for advanced operations
-- You need to include images in PR descriptions`;
+- You need to include images in PR descriptions
+- Pushing or opening a pull request failed`;
 var REFERENCE4 = `# GitHub Integration
 
 This guide covers how to interact with GitHub from within your Replicas workspace. Prefer \`@replicas/sdk\` for API calls so batching and data processing stay in one TypeScript program. The \`gh\` CLI remains useful for ergonomic pull request and git-adjacent workflows.
@@ -3341,6 +3355,14 @@ gh pr checks 123
 gh pr merge 123
 \`\`\`
 
+### When pushing or opening a pull request fails
+
+Tell the person the real cause and the real fix, not a guess. Check \`git remote -v\`, \`git config --show-origin --get-all credential.helper\`, and \`gh auth status\` first.
+
+- **The Replicas credential helper says this workspace has no credentials for the repository:** the repository isn't in the workspace's environment, so this workspace can't push to it even if you cloned it yourself. Say so, and that a workspace on an environment that includes the repository can make the change. When it says it has no credentials for the whole host, check \`~/.replicas/logs\` for a failed GitHub token refresh before choosing a cause.
+- **\`Resource not accessible by integration\`, or a 403 or 404 that isn't a rate limit:** the token in use can't write to that repository. When it isn't the workspace's own (Replicas configures \`gh\` and the \`~/${GIT_CREDENTIAL_HELPER_FILENAME}\` credential helper), it came from the environment, such as a start hook or variable: say that token lacks access and retry with the workspace's own credentials. Otherwise the Replicas GitHub App can't reach the repository: an organization admin has to install it there or grant it access. A rate limit (\`API rate limit exceeded\`, \`x-ratelimit-remaining: 0\`) only needs a wait and a retry.
+- Say to reconnect GitHub only when the error itself says so, which happens when PR user attribution is on and the person's GitHub account is missing or expired.
+
 ### Stacked Pull Requests
 
 When a change spans pull requests that build on each other, open each one with \`--base\` set to the branch below it, then link them into a GitHub stack. GitHub then shows the whole stack on every pull request in it. The \`gh stack\` extension is pre-installed.
@@ -10823,6 +10845,24 @@ export {
   SUBAGENT_SERVICE_TIERS,
   serviceTierRequestFields,
   TERMINAL_RTC_ICE_SERVER,
+  REPLICAS_RUNTIME_ENV_ALIASES,
+  readReplicasRuntimeEnv,
+  shellQuotePosix,
+  serializePosixEnvFile,
+  parsePosixEnvUnsetKeys,
+  parsePosixEnvFile,
+  ENGINE_PORT,
+  DESKTOP_STREAM_PORT,
+  DEVICES_DIR,
+  DEVICE_SCREEN_FILE_SUFFIX,
+  GIT_CREDENTIAL_HELPER_FILENAME,
+  GITHUB_CREDENTIAL_REFRESH_PATH,
+  GITLAB_CREDENTIAL_REFRESH_PATH,
+  getGitHubAccessToken,
+  githubCredentialLines,
+  buildGitCredentialHelperScript,
+  parseGitRemote,
+  gitIdentityConfigCommands,
   HISTORY_ROOT,
   HISTORY_INDEX_FILENAME,
   REPLICAS_INSTRUCTIONS_TAG,
@@ -10879,24 +10919,6 @@ export {
   clampTokensToWindow,
   buildCodexTokenUsageContextUsagePayload,
   extractLatestContextUsage,
-  REPLICAS_RUNTIME_ENV_ALIASES,
-  readReplicasRuntimeEnv,
-  shellQuotePosix,
-  serializePosixEnvFile,
-  parsePosixEnvUnsetKeys,
-  parsePosixEnvFile,
-  ENGINE_PORT,
-  DESKTOP_STREAM_PORT,
-  DEVICES_DIR,
-  DEVICE_SCREEN_FILE_SUFFIX,
-  GIT_CREDENTIAL_HELPER_FILENAME,
-  GITHUB_CREDENTIAL_REFRESH_PATH,
-  GITLAB_CREDENTIAL_REFRESH_PATH,
-  getGitHubAccessToken,
-  githubCredentialLines,
-  buildGitCredentialHelperScript,
-  parseGitRemote,
-  gitIdentityConfigCommands,
   InFlightMap,
   createProviderSlashCommand,
   mergeSlashCommands,

package/dist/src/{chunk-2MMS6MVA.js → chunk-KZV23QDU.js}

@@ -6,7 +6,7 @@ import {
   getOriginDefaultBranch,
   monolithRequest,
   runGitCommand
-} from "./chunk-BKLCEPTJ.js";
+} from "./chunk-CDRCJUTU.js";
 import {
   extractCommandProtectionCommandText,
   findCommandProtectionGitLookups,
@@ -14,7 +14,7 @@ import {
   findPrMergeSignals,
   findScoutRepoWriteSignals,
   parseCommandProtectionRequest
-} from "./chunk-KQBU62MY.js";
+} from "./chunk-JEP6EFK4.js";
 
 // src/services/command-protection-service.ts
 import { readFile, stat } from "fs/promises";

package/dist/src/{chunk-WPAD4FUY.js → chunk-MAMNSZ53.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   AspClient
-} from "./chunk-6HBASR47.js";
+} from "./chunk-QCV7O27G.js";
 import {
   ASTER_BASE_URL,
   ASTER_PROVIDER,
@@ -15,7 +15,7 @@ import {
   isRecord,
   readOllamaAuthEnv,
   readOpenAICompatibleAuthEnv
-} from "./chunk-KQBU62MY.js";
+} from "./chunk-JEP6EFK4.js";
 
 // src/managers/codex-asp/notification-dispatch.ts
 var TURN_STARTED_METHOD = "turn/started";

package/dist/src/{chunk-6HBASR47.js → chunk-QCV7O27G.js}

@@ -3,10 +3,10 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   execFileAsync
-} from "./chunk-BLVQL2EL.js";
+} from "./chunk-FDLME7OO.js";
 import {
   isVersionBelow
-} from "./chunk-KQBU62MY.js";
+} from "./chunk-JEP6EFK4.js";
 
 // src/utils/codex-agent-env.ts
 function buildCodexAgentEnv(source = process.env) {
@@ -240,7 +240,7 @@ function getCodexModelProvider(method) {
   if (method === "foundry") return "azure";
   return method === "ollama" || method === "openai-compatible" ? "replicas_openai_compatible" : "openai";
 }
-var ENGINE_PACKAGE_VERSION = "0.1.1307";
+var ENGINE_PACKAGE_VERSION = "0.1.1308";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";

package/dist/src/{chunk-3G23Q57G.js → chunk-XBKJROPE.js}

@@ -10,15 +10,15 @@ import {
   resolveDiffBase,
   runGitCommand,
   setAgentCredentialSnapshot
-} from "./chunk-BKLCEPTJ.js";
+} from "./chunk-CDRCJUTU.js";
 import {
   AppServerProcess,
   buildCodexAgentEnv
-} from "./chunk-6HBASR47.js";
+} from "./chunk-QCV7O27G.js";
 import {
   SUBPROCESS_MAX_BUFFER,
   execFileAsync
-} from "./chunk-BLVQL2EL.js";
+} from "./chunk-FDLME7OO.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
@@ -56,7 +56,7 @@ import {
   resolveOpenAICompatibleModelsUrl,
   splitMothershipInstructions,
   withTimeout
-} from "./chunk-KQBU62MY.js";
+} from "./chunk-JEP6EFK4.js";
 
 // src/managers/codex-token-manager.ts
 import { promises as fs } from "fs";
@@ -306,7 +306,7 @@ var CodexTokenManager = class extends BaseRefreshManager {
     await this.applyCredentialUpdate(++this.credentialGeneration, async () => {
       await this.applyCredentialsResponse(data);
       setAgentCredentialSnapshot("codex", data);
-      const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-ES3ZRIPD.js");
+      const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-UZTWCJFQ.js");
       await restartCodexAspHostIfRunning2();
     });
     await this.start(true);
@@ -328,7 +328,7 @@ var CodexTokenManager = class extends BaseRefreshManager {
       const accountChanged = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.codex?.credentialId !== data.credentialId;
       await this.applyCredentialsResponse(data);
       if (restartOnChange && (accountChanged || CODEX_AUTH_ENV_KEYS.some((key, index) => process.env[key] !== previousEnv[index]))) {
-        const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-ES3ZRIPD.js");
+        const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-UZTWCJFQ.js");
         await restartCodexAspHostIfRunning2();
       }
       setAgentCredentialSnapshot("codex", data);

package/dist/src/{chunk-TCQYJSJG.js → chunk-Z5IQAQDK.js}

@@ -5,7 +5,7 @@ import {
   extractCommandProtectionCommandText,
   isRecord,
   parseCodeHostPrUrl
-} from "./chunk-KQBU62MY.js";
+} from "./chunk-JEP6EFK4.js";
 
 // src/services/published-pull-request-urls.ts
 function publishedPullRequestUrls(result) {

package/dist/src/command-protection-hook.js

@@ -3,13 +3,13 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   evaluateCommandProtection
-} from "./chunk-2MMS6MVA.js";
-import "./chunk-BKLCEPTJ.js";
-import "./chunk-BLVQL2EL.js";
+} from "./chunk-KZV23QDU.js";
+import "./chunk-CDRCJUTU.js";
+import "./chunk-FDLME7OO.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
-import "./chunk-KQBU62MY.js";
+import "./chunk-JEP6EFK4.js";
 import "./chunk-VEQXQN22.js";
 
 // src/command-protection-hook.ts

package/dist/src/headless-agent.js

@@ -14,12 +14,12 @@ import {
   recoverCompletedTurn,
   spawnMuseMsp,
   startMuseSession
-} from "./chunk-WPAD4FUY.js";
+} from "./chunk-MAMNSZ53.js";
 import {
   AppServerProcess,
   buildCodexAgentEnv
-} from "./chunk-6HBASR47.js";
-import "./chunk-BLVQL2EL.js";
+} from "./chunk-QCV7O27G.js";
+import "./chunk-FDLME7OO.js";
 import {
   AGENT,
   OPENCODE_GO_PROVIDER,
@@ -29,7 +29,7 @@ import {
   headlessAgentUsagePath,
   isRecord,
   withTimeout
-} from "./chunk-KQBU62MY.js";
+} from "./chunk-JEP6EFK4.js";
 import "./chunk-VEQXQN22.js";
 
 // src/headless-agent.ts

package/dist/src/index.js

@@ -27,7 +27,7 @@ import {
   evaluateCommandProtection,
   extractToolCommand,
   reportCommandProtectionBlock
-} from "./chunk-2MMS6MVA.js";
+} from "./chunk-KZV23QDU.js";
 import {
   ACCOUNT_RATE_LIMITS_UPDATED_METHOD,
   AGENT_MESSAGE_DELTA_METHOD,
@@ -65,10 +65,10 @@ import {
   spawnMuseMsp,
   startMuseSession,
   uuidV7
-} from "./chunk-WPAD4FUY.js";
+} from "./chunk-MAMNSZ53.js";
 import {
   publishedPullRequestUrls
-} from "./chunk-TCQYJSJG.js";
+} from "./chunk-Z5IQAQDK.js";
 import {
   ACCOUNT_RATE_LIMITS_READ_METHOD,
   AsyncLock,
@@ -143,7 +143,7 @@ import {
   timestampFromSeconds,
   upsertCredentialFileLines,
   writeSecureCredentialFile
-} from "./chunk-3G23Q57G.js";
+} from "./chunk-XBKJROPE.js";
 import {
   ENGINE_ENV,
   monolithRequest,
@@ -153,15 +153,15 @@ import {
   resolveDiffBase,
   setAgentCredentialSnapshot,
   setLinearSessionId
-} from "./chunk-BKLCEPTJ.js";
+} from "./chunk-CDRCJUTU.js";
 import {
   getCodexModelProvider
-} from "./chunk-6HBASR47.js";
+} from "./chunk-QCV7O27G.js";
 import {
   SUBPROCESS_MAX_BUFFER,
   execAsync,
   execFileAsync
-} from "./chunk-BLVQL2EL.js";
+} from "./chunk-FDLME7OO.js";
 import {
   isRecord as isRecord2
 } from "./chunk-UZSNFLDQ.js";
@@ -415,7 +415,7 @@ import {
   workspaceTokenRequestSchema,
   workspaceTokenResponseSchema,
   wrapInTag
-} from "./chunk-KQBU62MY.js";
+} from "./chunk-JEP6EFK4.js";
 import {
   cloneMcpConfig,
   ensureCompatibilityImports,

package/dist/src/post-tool-pr-hook.js

@@ -3,13 +3,13 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   publishedPullRequestUrls
-} from "./chunk-TCQYJSJG.js";
+} from "./chunk-Z5IQAQDK.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
 import {
   shouldRefreshPullRequests
-} from "./chunk-KQBU62MY.js";
+} from "./chunk-JEP6EFK4.js";
 import "./chunk-VEQXQN22.js";
 
 // src/services/post-tool-pr-notifier.ts

package/dist/src/subagent-mcp.js

@@ -11,7 +11,7 @@ import {
   spawnSubagentRequestSchema,
   subagentResponseSchema,
   waitSubagentRequestSchema
-} from "./chunk-KQBU62MY.js";
+} from "./chunk-JEP6EFK4.js";
 import "./chunk-VEQXQN22.js";
 
 // src/subagent-mcp.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.1307",
+  "version": "0.1.1308",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",