replicas-engine 0.1.262 → 0.1.263

package/dist/src/index.js

@@ -286,7 +286,7 @@ var WORKSPACE_SIZES = ["small", "large"];
 var INVALID_WORKSPACE_SIZE_ERROR = `Invalid size: must be one of ${WORKSPACE_SIZES.join(", ")}`;
 
 // ../shared/src/e2b.ts
-var E2B_TEMPLATE_NAME = "replicas-sandbox-2026-06-04-v4";
+var E2B_TEMPLATE_NAME = "replicas-sandbox-2026-06-04-v5";
 
 // ../shared/src/runtime-env.ts
 function parsePosixEnvFile(content) {
@@ -2287,7 +2287,6 @@ var execFileAsync = promisify(execFile);
 var SUBPROCESS_MAX_BUFFER = HOOK_EXEC_MAX_BUFFER_BYTES;
 
 // src/managers/github-token-manager.ts
-import { promises as fs } from "fs";
 import path from "path";
 
 // src/engine-env.ts
@@ -2529,6 +2528,26 @@ var MonolithService = class {
 };
 var monolithService = new MonolithService();
 
+// src/utils/file.ts
+import { mkdir, rename, unlink, writeFile } from "fs/promises";
+import { dirname } from "path";
+async function atomicWriteFile(path4, data, options) {
+  const tmpFile = `${path4}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    await writeFile(tmpFile, data, { encoding: "utf-8", mode: options?.mode });
+    await rename(tmpFile, path4);
+  } catch (error) {
+    await unlink(tmpFile).catch(() => void 0);
+    throw error;
+  }
+}
+async function writeSecureCredentialFile(filePath, content, options) {
+  if (options?.ensureParentDir) {
+    await mkdir(dirname(filePath), { recursive: true, mode: 448 });
+  }
+  await atomicWriteFile(filePath, content, { mode: 384 });
+}
+
 // src/managers/github-token-manager.ts
 var GitHubTokenManager = class extends BaseRefreshManager {
   constructor() {
@@ -2544,8 +2563,9 @@ var GitHubTokenManager = class extends BaseRefreshManager {
     const data = await response.json();
     await this.updateGitCredentials(data.token);
     const ghToken = data.userToken?.token ?? data.token;
+    const ghUsername = data.userToken?.username ?? "x-access-token";
     ENGINE_ENV.GH_TOKEN = ghToken;
-    process.env.GH_TOKEN = ghToken;
+    await this.updateGhHostsFile(ghToken, ghUsername);
     if (data.userToken) {
       console.log(`[GitHubTokenManager] Token refreshed with user token for PR attribution, installation token expires at ${data.expiresAt}, user token expires at ${data.userToken.expiresAt}`);
     } else {
@@ -2553,22 +2573,35 @@ var GitHubTokenManager = class extends BaseRefreshManager {
     }
   }
   async updateGitCredentials(token) {
-    const workspaceHome = ENGINE_ENV.HOME_DIR;
-    const credentialsPath = path.join(workspaceHome, ".git-credentials");
+    const credentialsPath = path.join(ENGINE_ENV.HOME_DIR, ".git-credentials");
     const credentialsContent = `https://x-access-token:${token}@github.com
 `;
     try {
-      await fs.writeFile(credentialsPath, credentialsContent, { mode: 384 });
+      await writeSecureCredentialFile(credentialsPath, credentialsContent);
       console.log(`[GitHubTokenManager] Updated ${credentialsPath}`);
     } catch (error) {
       console.error("[GitHubTokenManager] Failed to update git credentials:", error);
     }
   }
+  async updateGhHostsFile(token, username) {
+    const hostsPath = path.join(ENGINE_ENV.HOME_DIR, ".config", "gh", "hosts.yml");
+    const content = `github.com:
+    oauth_token: ${JSON.stringify(token)}
+    user: ${JSON.stringify(username)}
+    git_protocol: https
+`;
+    try {
+      await writeSecureCredentialFile(hostsPath, content, { ensureParentDir: true });
+      console.log(`[GitHubTokenManager] Updated ${hostsPath}`);
+    } catch (error) {
+      console.error("[GitHubTokenManager] Failed to update gh hosts file:", error);
+    }
+  }
 };
 var githubTokenManager = new GitHubTokenManager();
 
 // src/managers/claude-token-manager.ts
-import { promises as fs2 } from "fs";
+import { promises as fs } from "fs";
 import path2 from "path";
 
 // src/managers/auth-env-transition.ts
@@ -2661,9 +2694,7 @@ var ClaudeTokenManager = class extends BaseRefreshManager {
     });
   }
   async writeOauthCredentialsFile(credentials) {
-    const workspaceHome = ENGINE_ENV.HOME_DIR;
-    const claudeDir = path2.join(workspaceHome, ".claude");
-    const credentialsPath = path2.join(claudeDir, ".credentials.json");
+    const credentialsPath = path2.join(ENGINE_ENV.HOME_DIR, ".claude", ".credentials.json");
     const claudeCliConfig = {
       claudeAiOauth: {
         accessToken: credentials.accessToken,
@@ -2674,8 +2705,11 @@ var ClaudeTokenManager = class extends BaseRefreshManager {
       }
     };
     try {
-      await fs2.mkdir(claudeDir, { recursive: true, mode: 448 });
-      await fs2.writeFile(credentialsPath, JSON.stringify(claudeCliConfig, null, 2), { mode: 384 });
+      await writeSecureCredentialFile(
+        credentialsPath,
+        JSON.stringify(claudeCliConfig, null, 2),
+        { ensureParentDir: true }
+      );
       console.log(`[ClaudeTokenManager] Updated ${credentialsPath}`);
     } catch (error) {
       console.error("[ClaudeTokenManager] Failed to update credentials file:", error);
@@ -2684,7 +2718,7 @@ var ClaudeTokenManager = class extends BaseRefreshManager {
   async removeOauthCredentialsFile() {
     const credentialsPath = path2.join(ENGINE_ENV.HOME_DIR, ".claude", ".credentials.json");
     try {
-      await fs2.unlink(credentialsPath);
+      await fs.unlink(credentialsPath);
     } catch {
     }
   }
@@ -2692,7 +2726,7 @@ var ClaudeTokenManager = class extends BaseRefreshManager {
 var claudeTokenManager = new ClaudeTokenManager();
 
 // src/managers/codex-token-manager.ts
-import { promises as fs3 } from "fs";
+import { promises as fs2 } from "fs";
 import path3 from "path";
 var CodexTokenManager = class extends BaseRefreshManager {
   constructor() {
@@ -2761,9 +2795,7 @@ var CodexTokenManager = class extends BaseRefreshManager {
     });
   }
   async writeOauthCredentialsFile(credentials) {
-    const workspaceHome = ENGINE_ENV.HOME_DIR;
-    const codexDir = path3.join(workspaceHome, ".codex");
-    const authPath = path3.join(codexDir, "auth.json");
+    const authPath = path3.join(ENGINE_ENV.HOME_DIR, ".codex", "auth.json");
     const codexAuthConfig = {
       OPENAI_API_KEY: null,
       tokens: {
@@ -2775,8 +2807,11 @@ var CodexTokenManager = class extends BaseRefreshManager {
       last_refresh: (/* @__PURE__ */ new Date()).toISOString()
     };
     try {
-      await fs3.mkdir(codexDir, { recursive: true, mode: 448 });
-      await fs3.writeFile(authPath, JSON.stringify(codexAuthConfig, null, 2), { mode: 384 });
+      await writeSecureCredentialFile(
+        authPath,
+        JSON.stringify(codexAuthConfig, null, 2),
+        { ensureParentDir: true }
+      );
       console.log(`[CodexTokenManager] Updated ${authPath}`);
     } catch (error) {
       console.error("[CodexTokenManager] Failed to update credentials file:", error);
@@ -2785,7 +2820,7 @@ var CodexTokenManager = class extends BaseRefreshManager {
   async removeOauthCredentialsFile() {
     const authPath = path3.join(ENGINE_ENV.HOME_DIR, ".codex", "auth.json");
     try {
-      await fs3.unlink(authPath);
+      await fs2.unlink(authPath);
     } catch {
     }
   }
@@ -2799,24 +2834,11 @@ import { spawn } from "child_process";
 import { join as join5 } from "path";
 
 // src/utils/state.ts
-import { readFile, mkdir } from "fs/promises";
+import { readFile, mkdir as mkdir2 } from "fs/promises";
 import { existsSync } from "fs";
 import { join as join3 } from "path";
 import { homedir as homedir3 } from "os";
 
-// src/utils/file.ts
-import { rename, unlink, writeFile } from "fs/promises";
-async function atomicWriteFile(path4, data) {
-  const tmpFile = `${path4}.${process.pid}.${Date.now()}.tmp`;
-  try {
-    await writeFile(tmpFile, data, "utf-8");
-    await rename(tmpFile, path4);
-  } catch (error) {
-    await unlink(tmpFile).catch(() => void 0);
-    throw error;
-  }
-}
-
 // src/utils/type-guards.ts
 function isRecord4(value) {
   return typeof value === "object" && value !== null;
@@ -2836,7 +2858,7 @@ function enqueueStateWrite(operation) {
 }
 async function updateEngineState(updater) {
   await enqueueStateWrite(async () => {
-    await mkdir(STATE_DIR, { recursive: true });
+    await mkdir2(STATE_DIR, { recursive: true });
     const currentState = await loadEngineState();
     const nextState = updater(currentState);
     await atomicWriteFile(STATE_FILE, JSON.stringify(nextState, null, 2));
@@ -3466,7 +3488,7 @@ var GitService = class {
 var gitService = new GitService();
 
 // src/utils/logger.ts
-import { appendFile, mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
+import { appendFile, mkdir as mkdir3, writeFile as writeFile2 } from "fs/promises";
 import { homedir as homedir4 } from "os";
 import { join as join6 } from "path";
 import { format } from "util";
@@ -3481,7 +3503,7 @@ var EngineLogger = class {
     return this._sessionId;
   }
   async initialize() {
-    await mkdir2(LOG_DIR, { recursive: true });
+    await mkdir3(LOG_DIR, { recursive: true });
     this._sessionId = this.createSessionId();
     this.filePath = join6(LOG_DIR, `${this._sessionId}.log`);
     await writeFile2(this.filePath, `=== Replicas Engine Session ${this._sessionId} ===
@@ -3534,14 +3556,14 @@ var EngineLogger = class {
 var engineLogger = new EngineLogger();
 
 // src/services/replicas-config-service.ts
-import { readFile as readFile5, appendFile as appendFile2, writeFile as writeFile4, mkdir as mkdir5 } from "fs/promises";
+import { readFile as readFile5, appendFile as appendFile2, writeFile as writeFile4, mkdir as mkdir6 } from "fs/promises";
 import { existsSync as existsSync4 } from "fs";
 import { join as join9 } from "path";
 import { homedir as homedir7 } from "os";
 import { spawn as spawn2 } from "child_process";
 
 // src/services/environment-details-service.ts
-import { mkdir as mkdir3, readFile as readFile3 } from "fs/promises";
+import { mkdir as mkdir4, readFile as readFile3 } from "fs/promises";
 import { existsSync as existsSync3 } from "fs";
 import { homedir as homedir5 } from "os";
 import { join as join7 } from "path";
@@ -3625,7 +3647,7 @@ async function readDetails() {
   }
 }
 async function writeDetails(details) {
-  await mkdir3(REPLICAS_DIR, { recursive: true });
+  await mkdir4(REPLICAS_DIR, { recursive: true });
   await atomicWriteFile(DETAILS_FILE, `${JSON.stringify(details, null, 2)}
 `);
 }
@@ -3711,7 +3733,7 @@ var EnvironmentDetailsService = class {
 var environmentDetailsService = new EnvironmentDetailsService();
 
 // src/services/start-hook-logs-service.ts
-import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile3, readdir as readdir2 } from "fs/promises";
+import { mkdir as mkdir5, readFile as readFile4, writeFile as writeFile3, readdir as readdir2 } from "fs/promises";
 import { homedir as homedir6 } from "os";
 import { join as join8 } from "path";
 
@@ -3757,7 +3779,7 @@ function normalizeStored(raw) {
 }
 var StartHookLogsService = class {
   async ensureDir() {
-    await mkdir4(LOGS_DIR, { recursive: true });
+    await mkdir5(LOGS_DIR, { recursive: true });
   }
   async saveLog(hookType, hookName, entry) {
     await this.ensureDir();
@@ -3905,7 +3927,7 @@ var ReplicasConfigService = class {
     const logLine = `[${timestamp}] ${message}
 `;
     try {
-      await mkdir5(join9(homedir7(), ".replicas"), { recursive: true });
+      await mkdir6(join9(homedir7(), ".replicas"), { recursive: true });
       await appendFile2(START_HOOKS_LOG, logLine, "utf-8");
     } catch (error) {
       console.error("Failed to write to start hooks log:", error);
@@ -4040,7 +4062,7 @@ var ReplicasConfigService = class {
     this.hooksCompleted = false;
     this.hooksFailed = false;
     try {
-      await mkdir5(join9(homedir7(), ".replicas"), { recursive: true });
+      await mkdir6(join9(homedir7(), ".replicas"), { recursive: true });
       await writeFile4(
         START_HOOKS_LOG,
         `=== Start Hooks Execution Log ===
@@ -4234,7 +4256,7 @@ ${startHookConfig.commands.join("\n")}`;
 var replicasConfigService = new ReplicasConfigService();
 
 // src/services/event-service.ts
-import { appendFile as appendFile3, mkdir as mkdir6 } from "fs/promises";
+import { appendFile as appendFile3, mkdir as mkdir7 } from "fs/promises";
 import { homedir as homedir8 } from "os";
 import { join as join10 } from "path";
 import { randomUUID } from "crypto";
@@ -4244,7 +4266,7 @@ var EventService = class {
   subscribers = /* @__PURE__ */ new Map();
   writeChain = Promise.resolve();
   async initialize() {
-    await mkdir6(ENGINE_DIR, { recursive: true });
+    await mkdir7(ENGINE_DIR, { recursive: true });
   }
   subscribe(subscriber) {
     const id = randomUUID();
@@ -4274,11 +4296,11 @@ var EventService = class {
 var eventService = new EventService();
 
 // src/services/preview-service.ts
-import { mkdir as mkdir7, readFile as readFile6 } from "fs/promises";
+import { mkdir as mkdir8, readFile as readFile6 } from "fs/promises";
 import { existsSync as existsSync5 } from "fs";
 import { randomUUID as randomUUID2 } from "crypto";
 import { homedir as homedir9 } from "os";
-import { dirname, join as join11 } from "path";
+import { dirname as dirname2, join as join11 } from "path";
 var PREVIEW_PORTS_FILE = join11(homedir9(), ".replicas", "preview-ports.json");
 async function readPreviewsFile() {
   try {
@@ -4292,8 +4314,8 @@ async function readPreviewsFile() {
   }
 }
 async function writePreviewsFile(data) {
-  const dir = dirname(PREVIEW_PORTS_FILE);
-  await mkdir7(dir, { recursive: true });
+  const dir = dirname2(PREVIEW_PORTS_FILE);
+  await mkdir8(dir, { recursive: true });
   await atomicWriteFile(PREVIEW_PORTS_FILE, `${JSON.stringify(data, null, 2)}
 `);
 }
@@ -4390,7 +4412,7 @@ async function registerDesktopPreview() {
 
 // src/services/chat/chat-service.ts
 import { existsSync as existsSync8 } from "fs";
-import { appendFile as appendFile5, copyFile, mkdir as mkdir11, readFile as readFile9, rename as rename2, rm } from "fs/promises";
+import { appendFile as appendFile5, copyFile, mkdir as mkdir12, readFile as readFile9, rename as rename2, rm } from "fs/promises";
 import { homedir as homedir13 } from "os";
 import { join as join15 } from "path";
 import { randomUUID as randomUUID5 } from "crypto";
@@ -4401,7 +4423,7 @@ import {
 } from "@anthropic-ai/claude-agent-sdk";
 import { randomUUID as randomUUID4 } from "crypto";
 import { join as join13 } from "path";
-import { mkdir as mkdir9, appendFile as appendFile4 } from "fs/promises";
+import { mkdir as mkdir10, appendFile as appendFile4 } from "fs/promises";
 import { homedir as homedir11 } from "os";
 
 // src/utils/jsonl-reader.ts
@@ -4907,7 +4929,7 @@ function extractPlanFromCodexAspNotification(notification) {
 
 // src/utils/image-utils.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { mkdir as mkdir8, unlink as unlink2, writeFile as writeFile5 } from "fs/promises";
+import { mkdir as mkdir9, unlink as unlink2, writeFile as writeFile5 } from "fs/promises";
 import { homedir as homedir10 } from "os";
 import { join as join12 } from "path";
 function isImageMediaType(value) {
@@ -4988,7 +5010,7 @@ async function normalizeImages(images) {
   return normalized;
 }
 async function saveNormalizedImagesToTempFiles(images, tempImageDir = join12(homedir10(), ".replicas", "codex", "temp-images")) {
-  await mkdir8(tempImageDir, { recursive: true });
+  await mkdir9(tempImageDir, { recursive: true });
   const tempPaths = [];
   try {
     for (const image of images) {
@@ -5320,6 +5342,9 @@ function buildClaudeAgentEnv(overrides) {
   if (shouldStripAnthropicApiKey()) {
     env.ANTHROPIC_API_KEY = void 0;
   }
+  env.GH_TOKEN = void 0;
+  env.GITHUB_TOKEN = void 0;
+  env.GH_CONFIG_DIR = void 0;
   env.CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD = "1";
   return env;
 }
@@ -5333,6 +5358,9 @@ function buildCodexAgentEnv() {
   if (shouldStripOpenAIApiKey()) {
     delete env.OPENAI_API_KEY;
   }
+  delete env.GH_TOKEN;
+  delete env.GITHUB_TOKEN;
+  delete env.GH_CONFIG_DIR;
   return env;
 }
 function resolveCodexApiKey() {
@@ -6139,7 +6167,7 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
   }
   async initialize() {
     const historyDir = join13(homedir11(), ".replicas", "claude");
-    await mkdir9(historyDir, { recursive: true });
+    await mkdir10(historyDir, { recursive: true });
     if (this.initialSessionId) {
       this.sessionId = this.initialSessionId;
       console.log(`[ClaudeManager] Restored session ID from persisted state: ${this.sessionId}`);
@@ -6373,7 +6401,7 @@ var AspClient = class {
 // src/managers/codex-asp/app-server-process.ts
 var DEFAULT_CODEX_BINARY = "codex";
 var DEFAULT_CODEX_ARGS = ["app-server", "--listen", "stdio://"];
-var ENGINE_PACKAGE_VERSION = "0.1.262";
+var ENGINE_PACKAGE_VERSION = "0.1.263";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";
@@ -7993,7 +8021,7 @@ var CodexAspManager = class extends CodingAgentManager {
 
 // src/managers/codex-manager.ts
 import { Codex } from "@openai/codex-sdk";
-import { readdir as readdir3, stat as stat2, writeFile as writeFile6, mkdir as mkdir10, readFile as readFile8 } from "fs/promises";
+import { readdir as readdir3, stat as stat2, writeFile as writeFile6, mkdir as mkdir11, readFile as readFile8 } from "fs/promises";
 import { existsSync as existsSync7 } from "fs";
 import { join as join14 } from "path";
 import { homedir as homedir12 } from "os";
@@ -8077,7 +8105,7 @@ var CodexManager = class extends CodingAgentManager {
   async updateCodexConfig(developerInstructions) {
     try {
       const codexDir = join14(homedir12(), ".codex");
-      await mkdir10(codexDir, { recursive: true });
+      await mkdir11(codexDir, { recursive: true });
       let config = {};
       if (existsSync7(CODEX_CONFIG_PATH)) {
         try {
@@ -9096,10 +9124,10 @@ var ChatService = class {
   chats = /* @__PURE__ */ new Map();
   writeChain = Promise.resolve();
   async initialize() {
-    await mkdir11(ENGINE_DIR2, { recursive: true });
-    await mkdir11(CLAUDE_HISTORY_DIR, { recursive: true });
-    await mkdir11(RELAY_HISTORY_DIR, { recursive: true });
-    await mkdir11(CHAT_SENDERS_DIR, { recursive: true });
+    await mkdir12(ENGINE_DIR2, { recursive: true });
+    await mkdir12(CLAUDE_HISTORY_DIR, { recursive: true });
+    await mkdir12(RELAY_HISTORY_DIR, { recursive: true });
+    await mkdir12(CHAT_SENDERS_DIR, { recursive: true });
     const persisted = await this.loadChats();
     for (const chat of persisted) {
       const runtime = this.createRuntimeChat(chat);
@@ -10018,7 +10046,7 @@ import { existsSync as existsSync9 } from "fs";
 import { join as join19 } from "path";
 
 // src/services/warm-hook-logs-service.ts
-import { mkdir as mkdir12, readFile as readFile12, writeFile as writeFile7, readdir as readdir5, appendFile as appendFile6, unlink as unlink3 } from "fs/promises";
+import { mkdir as mkdir13, readFile as readFile12, writeFile as writeFile7, readdir as readdir5, appendFile as appendFile6, unlink as unlink3 } from "fs/promises";
 import { homedir as homedir15 } from "os";
 import { join as join18 } from "path";
 var LOGS_DIR2 = join18(homedir15(), ".replicas", "warm-hook-logs");
@@ -10030,7 +10058,7 @@ function withPreview2(stored) {
 }
 var WarmHookLogsService = class {
   async ensureDir() {
-    await mkdir12(LOGS_DIR2, { recursive: true });
+    await mkdir13(LOGS_DIR2, { recursive: true });
   }
   async saveGlobalHookLog(entry) {
     await this.ensureDir();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.262",
+  "version": "0.1.263",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",