replicas-engine 0.1.412 → 0.1.414

package/dist/src/index.js

@@ -481,7 +481,7 @@ var WORKSPACE_SIZES = ["small", "large"];
 var INVALID_WORKSPACE_SIZE_ERROR = `Invalid size: must be one of ${WORKSPACE_SIZES.join(", ")}`;
 
 // ../shared/src/e2b.ts
-var E2B_TEMPLATE_NAME = "replicas-sandbox-2026-07-09-v2";
+var E2B_TEMPLATE_NAME = "replicas-sandbox-2026-07-09-v3";
 
 // ../shared/src/runtime-env.ts
 function parsePosixEnvFile(content) {
@@ -1418,59 +1418,26 @@ var GOOGLE_ABILITY = {
 
 // ../shared/src/default-skills/replicas-agent/abilities/learnings.ts
 var SECTION6 = `### Learnings
-Curated, human-approved organization knowledge that helps you execute correctly \u2014 conventions, gotchas, environment facts, and past user corrections that the codebase alone can't tell you.
+Propose additions, updates, or deletions to curated organization knowledge.
 
-**Reference:** \`references/LEARNINGS.md\`
-
-Use this when:
-- You are starting a substantive task and have gathered enough context to write a meaningful query
-- A user corrects you about a durable fact, preference, or process worth keeping
-- You find an existing learning contradicted by the current code or docs`;
+**Reference:** \`references/LEARNINGS.md\``;
 var REFERENCE6 = `# Learnings
 
-Learnings are curated, human-approved knowledge entries your organization maintains: conventions, gotchas, environment facts, and process rules. Some entries always apply; contextual entries are retrieved by matching your query against their trigger descriptions.
-
-## Reading Learnings
-
-\`\`\`bash
-replicas learnings read --query "<enriched query>"
-\`\`\`
-
-**When to read:** once you've collected enough context to write a meaningful query \u2014 typically after your first look at the relevant code. Don't wait until you're deep into execution; learnings are most valuable before you commit to an approach.
-
-**Enrich the query.** Use codebase specifics (feature area, module/component names), not the raw user request. Triggers describe *situations*, so a query grounded in what the task actually touches matches far better.
-
-Example: the user asks "remove the PRs chart projections". After locating the chart you know it lives in the platform admin dashboard, so query:
-
-\`\`\`bash
-replicas learnings read --query "Remove the PRs chart in the platform admin dashboard"
-\`\`\`
-
-This matches a learning triggered on "UI/UX work on the admin panel" that the raw request would have missed.
-
-Output is a list of blocks \u2014 id, name, and content. Use the ids to propose updates or deletions.
-
-## Proposing changes
+Learnings are curated, human-approved knowledge entries your organization maintains: conventions, gotchas, environment facts, and process rules.
 
 All writes are proposals: a human reviews them in the dashboard, and nothing takes effect until approved.
 
-\`\`\`bash
-replicas learnings add --name "<short name>" --content "<the knowledge>" [--trigger "<when to surface it>"] [--always] [--global]
-replicas learnings update <id> [--name "..."] [--content "..."] [--trigger "..."] [--always true|false]
-replicas learnings delete <id>
-\`\`\`
-
-\`--always\` marks an entry as always-returned (no trigger needed); \`--global\` proposes org-wide scope instead of this workspace's environment.
+Use \`replicas learnings --help\` and subcommand help such as \`replicas learnings add --help\`, \`replicas learnings update --help\`, or \`replicas learnings delete --help\` for current command syntax.
 
 **Be very conservative:**
-- Propose \`add\` only for durable, org-useful facts: explicit user corrections, hard-won environment or process knowledge.
+- Propose \`add\` only for repeatable, org-useful facts likely to matter again: explicit user corrections, hard-won environment or process knowledge.
 - Never store task-specific details, anything derivable by reading the repo, or secrets/credentials.
-- Propose \`update\` or \`delete\` when a learning is contradicted by the current code or docs \u2014 flag outdated knowledge instead of silently ignoring it.
+- Propose \`update\` or \`delete\` when a learning is contradicted by the current code or docs, especially if the outdated guidance would affect future repeated work.
 - Write narrow triggers describing when the entry should surface (e.g. "UI/UX work on the admin panel"), not vague topics.`;
 var LEARNINGS_ABILITY = {
   label: "Learnings",
-  description: "Fetch curated org knowledge and propose new learnings for human review.",
-  bullet: "- Fetching organization Learnings (curated, human-approved knowledge) before executing, or proposing new ones",
+  description: "Propose changes to curated org knowledge for human review.",
+  bullet: "- Proposing changes to organization Learnings (curated, human-approved knowledge)",
   section: SECTION6,
   referenceFile: { name: "LEARNINGS.md", content: REFERENCE6 }
 };
@@ -2736,6 +2703,11 @@ function extractCommandProtectionCommandText(request, options = {}) {
     for (const key of COMMAND_PROTECTION_COMMAND_KEYS) {
       const value = input[key];
       if (typeof value === "string" && value.trim()) return value;
+      if (Array.isArray(value) && value.every((item) => typeof item === "string")) return value.join(" ");
+    }
+    if (isRecord(input.args)) {
+      const nested = extractCommandProtectionCommandText({ toolInput: input.args }, options);
+      if (nested) return nested;
     }
   }
   if (typeof input === "string") return input;
@@ -6541,6 +6513,7 @@ var LinearEventForwarder = class {
 };
 
 // src/services/command-protection-service.ts
+var DEFAULT_COMMAND_PROTECTION_BLOCK_MESSAGE = "Blocked by organization policy: agents may not merge pull requests.";
 function asCommandProtectionResponse(value) {
   if (typeof value !== "object" || value === null) return null;
   const candidate = value;
@@ -6585,6 +6558,17 @@ async function evaluateCommandProtection(request, signal) {
 function extractToolCommand(input) {
   return extractCommandProtectionCommandText({ toolInput: input }, { stringifyFallback: false });
 }
+function reportCommandProtectionBlock(options) {
+  const message = options.result.reason || DEFAULT_COMMAND_PROTECTION_BLOCK_MESSAGE;
+  console.warn(`[${options.managerName}] blocked ${options.action} by PR merge policy: ${message}`);
+  options.recordHistoryEvent(options.eventType, {
+    type: "error",
+    message,
+    ...options.context,
+    command: options.command
+  }, options.historyFile);
+  return message;
+}
 
 // src/services/skill-registry-service.ts
 import { readFile as readFile8, readdir as readdir3, stat as stat2 } from "fs/promises";
@@ -8232,7 +8216,7 @@ var AspClient = class {
 // src/managers/codex-asp/app-server-process.ts
 var DEFAULT_CODEX_BINARY = "codex";
 var DEFAULT_CODEX_ARGS = ["app-server", "--listen", "stdio://"];
-var ENGINE_PACKAGE_VERSION = "0.1.412";
+var ENGINE_PACKAGE_VERSION = "0.1.414";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";
@@ -10348,6 +10332,24 @@ function extractCursorCommandDescription(content) {
   }
   return void 0;
 }
+function cursorToolInputFromDelta(update) {
+  if (update.type !== "tool-call-started") return null;
+  const toolCall = update.toolCall;
+  return {
+    toolName: toolCall.type,
+    toolInput: toolCall,
+    command: extractToolCommand(toolCall),
+    toolUseId: update.callId
+  };
+}
+function cursorToolInputFromMessage(event) {
+  return {
+    toolName: event.name,
+    toolInput: event.args ?? {},
+    command: extractToolCommand(event.args),
+    toolUseId: event.call_id
+  };
+}
 async function listCursorCommandsInDirectory(directory) {
   let entries;
   try {
@@ -10373,6 +10375,8 @@ var CursorManager = class extends CodingAgentManager {
   agent = null;
   activeRun = null;
   activeModel = null;
+  blockedToolCallIds = /* @__PURE__ */ new Set();
+  pendingCursorBlockReason = null;
   historyFilePath;
   historyFile;
   slashCommandsCache = null;
@@ -10451,12 +10455,22 @@ var CursorManager = class extends CodingAgentManager {
       }, this.historyFile);
       const run = await agent.send(message, {
         model: { id: model },
-        mode: request.planMode ? "plan" : "agent"
+        mode: request.planMode ? "plan" : "agent",
+        onDelta: async (args) => {
+          await this.handleCursorToolCall(cursorToolInputFromDelta(args.update));
+        }
       });
       this.activeRun = run;
       this.activeModel = model;
+      if (this.pendingCursorBlockReason) {
+        await run.cancel();
+        throw new Error(this.pendingCursorBlockReason);
+      }
       for await (const event of run.stream()) {
         this.recordCursorEvent(event);
+        if (event.type === "tool_call" && event.status === "running") {
+          await this.handleCursorToolCall(cursorToolInputFromMessage(event));
+        }
         if (linearSessionId) {
           linearForwarder.sendEvent(convertCursorEvent(event, linearSessionId));
         }
@@ -10479,10 +10493,45 @@ var CursorManager = class extends CodingAgentManager {
     } finally {
       this.activeRun = null;
       this.activeModel = null;
+      this.blockedToolCallIds.clear();
+      this.pendingCursorBlockReason = null;
       await this.historyFile.flush();
       await this.onTurnComplete();
     }
   }
+  async handleCursorToolCall(toolCall) {
+    if (!ENGINE_ENV.REPLICAS_DISABLE_GH_PR_MERGE || !toolCall) return;
+    if (this.blockedToolCallIds.has(toolCall.toolUseId)) return;
+    const result = await evaluateCommandProtection({
+      provider: "cursor",
+      source: "cursor_tool_call",
+      toolName: toolCall.toolName,
+      toolInput: toolCall.toolInput,
+      command: toolCall.command,
+      cwd: this.workingDirectory,
+      toolUseId: toolCall.toolUseId
+    });
+    if (result.allowed) return;
+    this.blockedToolCallIds.add(toolCall.toolUseId);
+    const message = reportCommandProtectionBlock({
+      managerName: "CursorManager",
+      action: "tool call",
+      eventType: "cursor-command-protection.blocked",
+      result,
+      command: toolCall.command,
+      context: {
+        toolName: toolCall.toolName,
+        toolUseId: toolCall.toolUseId
+      },
+      historyFile: this.historyFile,
+      recordHistoryEvent: this.recordHistoryEvent.bind(this)
+    });
+    if (this.activeRun) {
+      await this.activeRun.cancel();
+      throw new Error(message);
+    }
+    this.pendingCursorBlockReason = message;
+  }
   async toCursorMessage(request) {
     if (!request.images || request.images.length === 0) {
       return request.message;
@@ -10578,7 +10627,23 @@ var OPENCODE_SHIM_DIR = dirname6(fileURLToPath(new URL("../../scripts/opencode",
 var OPENCODE_CONFIG_PATH = join18(ENGINE_ENV.HOME_DIR, ".config", "opencode", "opencode.json");
 var OPENCODE_FETCH_DISPATCHER = new Agent({ headersTimeout: 0, bodyTimeout: 0 });
 var OPENCODE_SERVER_STARTUP_TIMEOUT_MS = 3e4;
-var OPENCODE_WORKSPACE_PERMISSION = "allow";
+var OPENCODE_WORKSPACE_PERMISSION = {
+  read: "allow",
+  edit: "allow",
+  glob: "allow",
+  grep: "allow",
+  list: "allow",
+  bash: "ask",
+  task: "allow",
+  external_directory: "allow",
+  todowrite: "allow",
+  question: "allow",
+  webfetch: "allow",
+  websearch: "allow",
+  lsp: "allow",
+  doom_loop: "allow",
+  skill: "allow"
+};
 var OPENCODE_SLASH_COMMANDS_CACHE_MS = 3e4;
 var OPENCODE_VARIANT_CANDIDATES_BY_THINKING_LEVEL = {
   low: ["low"],
@@ -10710,6 +10775,27 @@ function opencodeErrorPayload(error) {
 function opencodeFetch(input, init) {
   return fetch(input, { ...init, dispatcher: OPENCODE_FETCH_DISPATCHER });
 }
+function parseOpencodeToolInputText(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { command: text };
+  }
+}
+function opencodePermissionCommand(payload, toolInput) {
+  const toolCommand = extractToolCommand(toolInput);
+  if (toolCommand) return toolCommand;
+  const payloadCommand = extractToolCommand(payload);
+  if (payloadCommand) return payloadCommand;
+  const resources = Array.isArray(payload.resources) ? payload.resources.filter((item) => typeof item === "string") : [];
+  if (resources.length > 0) return resources.join(" ");
+  const metadata = isRecord4(payload.metadata) ? payload.metadata : null;
+  for (const key of ["command", "cmd", "pattern", "resource"]) {
+    const value = metadata?.[key];
+    if (typeof value === "string" && value.trim()) return value;
+  }
+  return null;
+}
 var OpencodeManager = class extends CodingAgentManager {
   client = null;
   server = null;
@@ -10727,6 +10813,11 @@ var OpencodeManager = class extends CodingAgentManager {
   activeLinearForwarder = null;
   forwardedLinearPartKeys = /* @__PURE__ */ new Set();
   modelVariants = /* @__PURE__ */ new Map();
+  handledPermissionRequestIds = /* @__PURE__ */ new Set();
+  pendingPermissionRequestIds = /* @__PURE__ */ new Set();
+  handledToolCallIds = /* @__PURE__ */ new Set();
+  pendingToolCallIds = /* @__PURE__ */ new Set();
+  opencodeToolInputs = /* @__PURE__ */ new Map();
   slashCommandsCache = null;
   slashCommandsRequest = null;
   constructor(options) {
@@ -10931,6 +11022,11 @@ var OpencodeManager = class extends CodingAgentManager {
       this.activeAbortController = null;
       this.activeLinearForwarder = null;
       this.forwardedLinearPartKeys.clear();
+      this.handledPermissionRequestIds.clear();
+      this.pendingPermissionRequestIds.clear();
+      this.handledToolCallIds.clear();
+      this.pendingToolCallIds.clear();
+      this.opencodeToolInputs.clear();
       await this.historyFile.flush();
       await this.onTurnComplete();
     }
@@ -10968,12 +11064,141 @@ var OpencodeManager = class extends CodingAgentManager {
     if (typeof partSessionID === "string" && this.sessionId && partSessionID !== this.sessionId) return;
     if (event.type === "message.part.updated" && isOpencodePart(part)) {
       if (this.shouldRecordOpencodePart(part)) this.recordOpencodePart(part);
+      this.handleOpencodePartProtection(part).catch((error) => {
+        console.error("[OpencodeManager] Failed to evaluate Opencode tool part:", error);
+      });
       return;
     }
     if (event.type === "message.updated") this.recordOpencodeMessageRole(payload);
+    if (event.type === "session.next.tool.input.ended") {
+      const callId = typeof payload.callID === "string" ? payload.callID : void 0;
+      if (callId && typeof payload.text === "string") {
+        this.opencodeToolInputs.set(callId, parseOpencodeToolInputText(payload.text));
+      }
+    }
+    if (event.type === "permission.v2.asked" || event.type === "permission.asked") {
+      this.respondToOpencodePermission(event.type, payload).catch((error) => {
+        console.error("[OpencodeManager] Failed to respond to Opencode permission:", error);
+      });
+    }
+    if (event.type === "session.next.tool.called") {
+      this.handleOpencodeToolCallProtection(payload).catch((error) => {
+        console.error("[OpencodeManager] Failed to evaluate Opencode tool call:", error);
+      });
+    }
     if (this.recordOpencodeNextPart(event.type, payload)) return;
     this.recordHistoryEvent(`opencode-${event.type}`, payload, this.historyFile);
   }
+  async respondToOpencodePermission(type, payload) {
+    if (!this.client) return;
+    const requestId = typeof payload.id === "string" ? payload.id : void 0;
+    const sessionId = typeof payload.sessionID === "string" ? payload.sessionID : this.sessionId ?? void 0;
+    if (!requestId || !sessionId || this.handledPermissionRequestIds.has(requestId) || this.pendingPermissionRequestIds.has(requestId)) return;
+    this.pendingPermissionRequestIds.add(requestId);
+    try {
+      const source = isRecord4(payload.source) ? payload.source : null;
+      const callId = typeof source?.callID === "string" ? source.callID : isRecord4(payload.tool) && typeof payload.tool.callID === "string" ? payload.tool.callID : void 0;
+      const toolInput = callId ? this.opencodeToolInputs.get(callId) ?? payload : payload;
+      const command = opencodePermissionCommand(payload, toolInput);
+      const result = ENGINE_ENV.REPLICAS_DISABLE_GH_PR_MERGE ? await evaluateCommandProtection({
+        provider: "opencode",
+        source: "opencode_permission_request",
+        toolName: typeof payload.action === "string" ? payload.action : typeof payload.permission === "string" ? payload.permission : "permission",
+        toolInput,
+        command,
+        cwd: this.workingDirectory,
+        toolUseId: requestId
+      }) : { allowed: true, enabled: false };
+      const reply = result.allowed ? "once" : "reject";
+      const message = result.allowed ? void 0 : reportCommandProtectionBlock({
+        managerName: "OpencodeManager",
+        action: "permission",
+        eventType: "opencode-command-protection.blocked",
+        result,
+        command,
+        context: {
+          requestId
+        },
+        historyFile: this.historyFile,
+        recordHistoryEvent: this.recordHistoryEvent.bind(this)
+      });
+      if (type === "permission.v2.asked") {
+        await this.client.v2.session.permission.reply({
+          sessionID: sessionId,
+          requestID: requestId,
+          reply,
+          ...message ? { message } : {}
+        }, { throwOnError: true });
+      } else {
+        await this.client.permission.reply({
+          requestID: requestId,
+          directory: this.workingDirectory,
+          reply,
+          ...message ? { message } : {}
+        }, { throwOnError: true });
+      }
+      this.handledPermissionRequestIds.add(requestId);
+    } finally {
+      this.pendingPermissionRequestIds.delete(requestId);
+    }
+  }
+  async handleOpencodeToolCallProtection(payload) {
+    const callId = typeof payload.callID === "string" ? payload.callID : void 0;
+    if (!callId || this.handledToolCallIds.has(callId)) return;
+    const toolName = typeof payload.tool === "string" ? payload.tool : "tool";
+    const input = isRecord4(payload.input) ? payload.input : {};
+    this.opencodeToolInputs.set(callId, input);
+    const command = extractToolCommand(input);
+    await this.evaluateOpencodeToolProtection(toolName, input, command, callId);
+  }
+  async handleOpencodePartProtection(part) {
+    if (part.type !== "tool") return;
+    const state = part.state;
+    if (state.status !== "running" && state.status !== "pending") return;
+    await this.evaluateOpencodeToolProtection(part.tool, state.input, extractToolCommand(state.input), part.id);
+  }
+  async evaluateOpencodeToolProtection(toolName, toolInput, command, toolUseId) {
+    if (!ENGINE_ENV.REPLICAS_DISABLE_GH_PR_MERGE || this.handledToolCallIds.has(toolUseId) || this.pendingToolCallIds.has(toolUseId)) return;
+    this.pendingToolCallIds.add(toolUseId);
+    try {
+      const result = await evaluateCommandProtection({
+        provider: "opencode",
+        source: "opencode_tool_call",
+        toolName,
+        toolInput,
+        command,
+        cwd: this.workingDirectory,
+        toolUseId
+      });
+      if (result.allowed) {
+        this.handledToolCallIds.add(toolUseId);
+        return;
+      }
+      const message = reportCommandProtectionBlock({
+        managerName: "OpencodeManager",
+        action: "tool call",
+        eventType: "opencode-command-protection.blocked",
+        result,
+        command,
+        context: {
+          toolName,
+          toolUseId
+        },
+        historyFile: this.historyFile,
+        recordHistoryEvent: this.recordHistoryEvent.bind(this)
+      });
+      this.activeAbortController?.abort();
+      if (this.client && this.sessionId) {
+        await this.client.session.abort(
+          { sessionID: this.sessionId, directory: this.workingDirectory },
+          { throwOnError: true }
+        );
+      }
+      this.handledToolCallIds.add(toolUseId);
+    } finally {
+      this.pendingToolCallIds.delete(toolUseId);
+    }
+  }
   recordOpencodeMessageRole(payload) {
     const info = isRecord4(payload.info) ? payload.info : null;
     const id = typeof info?.id === "string" ? info.id : void 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.412",
+  "version": "0.1.414",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",