replicas-engine 0.1.206 → 0.1.208

package/dist/src/index.js

@@ -396,7 +396,7 @@ function parseReplicasConfigString(content, filename) {
 }
 
 // ../shared/src/engine/environment.ts
-var DAYTONA_SNAPSHOT_ID = "23-05-2026-royal-york-v5";
+var DAYTONA_SNAPSHOT_ID = "23-05-2026-royal-york-v6";
 
 // ../shared/src/engine/types.ts
 var DEFAULT_CHAT_TITLES = {
@@ -436,6 +436,46 @@ var IMAGE_MEDIA_TYPES = ["image/png", "image/jpeg", "image/gif", "image/webp"];
 // ../shared/src/engine/v1.ts
 var MERGED_MESSAGE_SEPARATOR = "\n\n<!-- replicas:merged -->\n\n";
 
+// ../shared/src/routes/codex.ts
+var CODEX_AUTH_ENV_KEYS = [
+  "OPENAI_API_KEY",
+  "REPLICAS_CODEX_AUTH_METHOD"
+];
+function codexAuthEnvFromResponse(response) {
+  switch (response.type) {
+    case "oauth":
+      return { REPLICAS_CODEX_AUTH_METHOD: "oauth" };
+    case "api_key":
+      return { OPENAI_API_KEY: response.apiKey, REPLICAS_CODEX_AUTH_METHOD: "api_key" };
+  }
+}
+
+// ../shared/src/routes/claude.ts
+var CLAUDE_AUTH_ENV_KEYS = [
+  "ANTHROPIC_API_KEY",
+  "CLAUDE_CODE_USE_BEDROCK",
+  "AWS_ACCESS_KEY_ID",
+  "AWS_SECRET_ACCESS_KEY",
+  "AWS_REGION",
+  "REPLICAS_CLAUDE_AUTH_METHOD"
+];
+function claudeAuthEnvFromResponse(response) {
+  switch (response.type) {
+    case "oauth":
+      return { REPLICAS_CLAUDE_AUTH_METHOD: "oauth" };
+    case "api_key":
+      return { ANTHROPIC_API_KEY: response.apiKey, REPLICAS_CLAUDE_AUTH_METHOD: "api_key" };
+    case "bedrock":
+      return {
+        CLAUDE_CODE_USE_BEDROCK: "1",
+        AWS_ACCESS_KEY_ID: response.awsAccessKeyId,
+        AWS_SECRET_ACCESS_KEY: response.awsSecretAccessKey,
+        AWS_REGION: response.awsRegion,
+        REPLICAS_CLAUDE_AUTH_METHOD: "bedrock"
+      };
+  }
+}
+
 // ../shared/src/routes/workspaces.ts
 var WORKSPACE_FILE_UPLOAD_MAX_SIZE_BYTES = 20 * 1024 * 1024;
 var WORKSPACE_FILE_CONTENT_MAX_SIZE_BYTES = 1 * 1024 * 1024;
@@ -707,12 +747,16 @@ var ClaudeTokenManager = class extends BaseRefreshManager {
     super("ClaudeTokenManager");
   }
   getSkipReason() {
-    if (ENGINE_ENV.ANTHROPIC_API_KEY) {
-      return "ANTHROPIC_API_KEY is set";
+    const method = ENGINE_ENV.REPLICAS_CLAUDE_AUTH_METHOD;
+    if (method === "api_key" || method === "bedrock") {
+      return `auth method is ${method}`;
     }
     return null;
   }
   async doRefresh(config) {
+    await this.refreshWithRequest(config);
+  }
+  async refreshWithRequest(config, request) {
     console.log("[ClaudeTokenManager] Refreshing Claude credentials...");
     const response = await fetch(`${config.monolithUrl}/v1/engine/claude/refresh-credentials`, {
       method: "POST",
@@ -720,39 +764,81 @@ var ClaudeTokenManager = class extends BaseRefreshManager {
         Authorization: `Bearer ${config.engineSecret}`,
         "X-Workspace-Id": config.workspaceId,
         "Content-Type": "application/json"
-      }
+      },
+      ...request ? { body: JSON.stringify(request) } : {}
     });
     if (!response.ok) {
       const errorText = await response.text();
       throw new Error(`Credentials refresh failed: ${response.status} ${errorText}`);
     }
     const data = await response.json();
-    await this.updateClaudeCredentials(data);
-    console.log(`[ClaudeTokenManager] Credentials refreshed successfully, expires at ${data.expiresAt}`);
+    await this.applyCredentialsResponse(data);
+    console.log(`[ClaudeTokenManager] Credentials refreshed (method=${data.type})`);
   }
-  /**
-   * Re-fetches credentials from the monolith after an auth failure is detected.
-   * With the 1-hour refresh threshold, the monolith will have already
-   * proactively refreshed the token, so this just pulls the latest.
-   *
-   * Returns true if credentials were successfully updated, false otherwise.
-   */
-  async fetchFreshCredentials() {
-    if (this.getSkipReason()) {
-      return false;
-    }
+  async fetchFreshCredentials(failureReason) {
     const config = this.getRuntimeConfig();
     if (!config) return false;
     try {
       console.log("[ClaudeTokenManager] Fetching fresh credentials from monolith after auth failure...");
-      await this.doRefresh(config);
+      const failedMethod = ENGINE_ENV.REPLICAS_CLAUDE_AUTH_METHOD;
+      await this.refreshWithRequest(config, failedMethod && failedMethod !== "none" ? {
+        failedMethod,
+        failureReason
+      } : void 0);
+      if (ENGINE_ENV.REPLICAS_CLAUDE_AUTH_METHOD === "oauth") {
+        this.start().catch((error) => {
+          console.error("[ClaudeTokenManager] Failed to restart OAuth refresh service after fallback:", error);
+        });
+      }
       return true;
     } catch (error) {
       console.error("[ClaudeTokenManager] Failed to fetch fresh credentials:", error);
       return false;
     }
   }
-  async updateClaudeCredentials(credentials) {
+  async applyCredentialsResponse(response) {
+    if (response.type === "oauth") {
+      await this.writeOauthCredentialsFile({
+        accessToken: response.accessToken,
+        refreshToken: response.refreshToken,
+        expiresAt: response.expiresAt,
+        scopes: response.scopes,
+        subscriptionType: response.subscriptionType
+      });
+    } else {
+      await this.removeOauthCredentialsFile();
+    }
+    const envVars = claudeAuthEnvFromResponse(response);
+    for (const key of CLAUDE_AUTH_ENV_KEYS) {
+      switch (key) {
+        case "REPLICAS_CLAUDE_AUTH_METHOD":
+          ENGINE_ENV.REPLICAS_CLAUDE_AUTH_METHOD = envVars.REPLICAS_CLAUDE_AUTH_METHOD;
+          break;
+        case "ANTHROPIC_API_KEY":
+          ENGINE_ENV.ANTHROPIC_API_KEY = envVars.ANTHROPIC_API_KEY;
+          break;
+        case "CLAUDE_CODE_USE_BEDROCK":
+          ENGINE_ENV.CLAUDE_CODE_USE_BEDROCK = envVars.CLAUDE_CODE_USE_BEDROCK;
+          break;
+        case "AWS_ACCESS_KEY_ID":
+          ENGINE_ENV.AWS_ACCESS_KEY_ID = envVars.AWS_ACCESS_KEY_ID;
+          break;
+        case "AWS_SECRET_ACCESS_KEY":
+          ENGINE_ENV.AWS_SECRET_ACCESS_KEY = envVars.AWS_SECRET_ACCESS_KEY;
+          break;
+        case "AWS_REGION":
+          ENGINE_ENV.AWS_REGION = envVars.AWS_REGION;
+          break;
+      }
+      const value = envVars[key];
+      if (value !== void 0) {
+        process.env[key] = value;
+      } else {
+        delete process.env[key];
+      }
+    }
+  }
+  async writeOauthCredentialsFile(credentials) {
     const workspaceHome = ENGINE_ENV.HOME_DIR;
     const claudeDir = path2.join(workspaceHome, ".claude");
     const credentialsPath = path2.join(claudeDir, ".credentials.json");
@@ -773,6 +859,13 @@ var ClaudeTokenManager = class extends BaseRefreshManager {
       console.error("[ClaudeTokenManager] Failed to update credentials file:", error);
     }
   }
+  async removeOauthCredentialsFile() {
+    const credentialsPath = path2.join(ENGINE_ENV.HOME_DIR, ".claude", ".credentials.json");
+    try {
+      await fs2.unlink(credentialsPath);
+    } catch {
+    }
+  }
 };
 var claudeTokenManager = new ClaudeTokenManager();
 
@@ -784,12 +877,18 @@ var CodexTokenManager = class extends BaseRefreshManager {
     super("CodexTokenManager");
   }
   getSkipReason() {
-    if (ENGINE_ENV.OPENAI_API_KEY) {
+    if (ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "api_key") {
+      return "auth method is api_key";
+    }
+    if (!ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD && ENGINE_ENV.OPENAI_API_KEY) {
       return "OPENAI_API_KEY is set";
     }
     return null;
   }
   async doRefresh(config) {
+    await this.refreshWithRequest(config);
+  }
+  async refreshWithRequest(config, request) {
     console.log("[CodexTokenManager] Refreshing Codex credentials...");
     const response = await fetch(`${config.monolithUrl}/v1/engine/codex/refresh-credentials`, {
       method: "POST",
@@ -797,17 +896,63 @@ var CodexTokenManager = class extends BaseRefreshManager {
         Authorization: `Bearer ${config.engineSecret}`,
         "X-Workspace-Id": config.workspaceId,
         "Content-Type": "application/json"
-      }
+      },
+      ...request ? { body: JSON.stringify(request) } : {}
     });
     if (!response.ok) {
       const errorText = await response.text();
       throw new Error(`Credentials refresh failed: ${response.status} ${errorText}`);
     }
     const data = await response.json();
-    await this.updateCodexCredentials(data);
-    console.log(`[CodexTokenManager] Credentials refreshed successfully, expires at ${data.expiresAt}`);
+    await this.applyCredentialsResponse(data);
+    console.log(`[CodexTokenManager] Credentials refreshed (method=${data.type})`);
   }
-  async updateCodexCredentials(credentials) {
+  async fetchFreshCredentials(failureReason) {
+    const config = this.getRuntimeConfig();
+    if (!config) return false;
+    try {
+      console.log("[CodexTokenManager] Fetching fresh credentials from monolith after auth failure...");
+      const failedMethod = ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD;
+      await this.refreshWithRequest(config, failedMethod === "oauth" || failedMethod === "api_key" ? {
+        failedMethod,
+        failureReason
+      } : void 0);
+      if (ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "oauth") {
+        this.start().catch((error) => {
+          console.error("[CodexTokenManager] Failed to restart OAuth refresh service after fallback:", error);
+        });
+      }
+      return true;
+    } catch (error) {
+      console.error("[CodexTokenManager] Failed to fetch fresh credentials:", error);
+      return false;
+    }
+  }
+  async applyCredentialsResponse(response) {
+    if (response.type === "oauth") {
+      await this.writeOauthCredentialsFile(response);
+    } else {
+      await this.removeOauthCredentialsFile();
+    }
+    const envVars = codexAuthEnvFromResponse(response);
+    for (const key of CODEX_AUTH_ENV_KEYS) {
+      switch (key) {
+        case "REPLICAS_CODEX_AUTH_METHOD":
+          ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD = envVars.REPLICAS_CODEX_AUTH_METHOD;
+          break;
+        case "OPENAI_API_KEY":
+          ENGINE_ENV.OPENAI_API_KEY = envVars.OPENAI_API_KEY;
+          break;
+      }
+      const value = envVars[key];
+      if (value !== void 0) {
+        process.env[key] = value;
+      } else {
+        delete process.env[key];
+      }
+    }
+  }
+  async writeOauthCredentialsFile(credentials) {
     const workspaceHome = ENGINE_ENV.HOME_DIR;
     const codexDir = path3.join(workspaceHome, ".codex");
     const authPath = path3.join(codexDir, "auth.json");
@@ -829,6 +974,13 @@ var CodexTokenManager = class extends BaseRefreshManager {
       console.error("[CodexTokenManager] Failed to update credentials file:", error);
     }
   }
+  async removeOauthCredentialsFile() {
+    const authPath = path3.join(ENGINE_ENV.HOME_DIR, ".codex", "auth.json");
+    try {
+      await fs3.unlink(authPath);
+    } catch {
+    }
+  }
 };
 var codexTokenManager = new CodexTokenManager();
 
@@ -3244,7 +3396,7 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
     } catch (error) {
       if (_ClaudeManager.isAuthError(error)) {
         console.warn("[ClaudeManager] Auth failure detected, refreshing credentials and retrying...", error);
-        const refreshed = await claudeTokenManager.fetchFreshCredentials();
+        const refreshed = await claudeTokenManager.fetchFreshCredentials(error instanceof Error ? error.message : String(error));
         if (refreshed) {
           await this.executeQuery(request);
           return;
@@ -3555,7 +3707,7 @@ function extractRateLimitsSnapshot(parsed) {
   }
   return { state, balance, rateLimitResetType, planType };
 }
-var CodexManager = class extends CodingAgentManager {
+var CodexManager = class _CodexManager extends CodingAgentManager {
   codex;
   currentThreadId = null;
   currentThread = null;
@@ -3571,13 +3723,20 @@ var CodexManager = class extends CodingAgentManager {
   quotaBlocked = false;
   constructor(options) {
     super(options);
+    this.codex = this.createCodexClient();
+    this.tempImageDir = join13(homedir11(), ".replicas", "codex", "temp-images");
+    this.initializeManager(this.processMessageInternal.bind(this));
+  }
+  createCodexClient() {
     const codexApiKey = resolveCodexApiKey();
-    this.codex = new Codex({
+    return new Codex({
       env: buildCodexAgentEnv(),
       ...codexApiKey ? { apiKey: codexApiKey } : {}
     });
-    this.tempImageDir = join13(homedir11(), ".replicas", "codex", "temp-images");
-    this.initializeManager(this.processMessageInternal.bind(this));
+  }
+  resetCodexClient() {
+    this.codex = this.createCodexClient();
+    this.currentThread = null;
   }
   async initialize() {
     if (this.initialSessionId) {
@@ -3706,10 +3865,22 @@ var CodexManager = class extends CodingAgentManager {
     }
     return tempPaths;
   }
-  /**
-   * Internal method that actually processes the message
-   */
   async processMessageInternal(request) {
+    try {
+      await this.executeCodexTurn(request);
+    } catch (error) {
+      if (_CodexManager.isAuthError(error)) {
+        const refreshed = await codexTokenManager.fetchFreshCredentials(error instanceof Error ? error.message : String(error));
+        if (refreshed) {
+          this.resetCodexClient();
+          await this.executeCodexTurn(request);
+          return;
+        }
+      }
+      throw error;
+    }
+  }
+  async executeCodexTurn(request) {
     if (this.quotaBlocked && this.latestQuotaSnapshot) {
       await this.flushQuotaSnapshotFromCurrentSession();
       if (this.quotaBlocked && this.latestQuotaSnapshot) {
@@ -3839,6 +4010,11 @@ var CodexManager = class extends CodingAgentManager {
       this.activeAbortController = null;
     }
   }
+  static isAuthError(error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    const lower = msg.toLowerCase();
+    return lower.includes("unauthorized") || lower.includes("authentication") || lower.includes("invalid api key") || lower.includes("incorrect api key") || lower.includes("api key") && lower.includes("invalid") || lower.includes("login") || lower.includes("401");
+  }
   async getHistory() {
     if (!this.currentThreadId) {
       return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.206",
+  "version": "0.1.208",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",