replicas-engine 0.1.421 → 0.1.423

package/README.md

@@ -87,6 +87,7 @@ Token refresh managers may later overwrite credential files in place:
 - `~/.git-credentials`
 - `~/.claude/.credentials.json`
 - `~/.codex/auth.json`
+- `~/.replicas/infisical-env.sh` and `~/workspaces/.infisical.json`
 
 Engine persistence locations:
 
@@ -131,3 +132,4 @@ Outgoing endpoints:
 - `POST /v1/engine/github/refresh-token`
 - `POST /v1/engine/claude/refresh-credentials`
 - `POST /v1/engine/codex/refresh-credentials`
+- `POST /v1/engine/infisical/refresh-token`

package/dist/src/index.js

@@ -508,9 +508,12 @@ var WORKSPACE_SIZES = ["small", "large"];
 var INVALID_WORKSPACE_SIZE_ERROR = `Invalid size: must be one of ${WORKSPACE_SIZES.join(", ")}`;
 
 // ../shared/src/e2b.ts
-var E2B_TEMPLATE_NAME = "replicas-sandbox-2026-07-10-v2";
+var E2B_TEMPLATE_NAME = "replicas-sandbox-2026-07-10-v4";
 
 // ../shared/src/runtime-env.ts
+function shellQuotePosix(value) {
+  return `'${value.split("'").join("'\\''")}'`;
+}
 function parsePosixEnvFile(content) {
   const result = {};
   let pos = 0;
@@ -1169,18 +1172,19 @@ var GITLAB_ABILITY = {
 };
 
 // ../shared/src/default-skills/replicas-agent/abilities/google.ts
-var SECTION5 = `### Google Workspace (Docs, Sheets, Forms, Drive)
-Create and edit Google Docs, Sheets, and Forms via the Replicas gateway. Files are owned by Replicas \u2014 the integration cannot access pre-existing Google content created outside of it.
+var SECTION5 = `### Google Workspace and Search Console
+Create and edit Google Docs, Sheets, and Forms, and read Google Search Console data via the Replicas gateway. Drive access is limited to files created by Replicas.
 
 **Reference:** \`references/GOOGLE.md\`
 
 Use this when:
 - You need to create or edit a Google Doc, Sheet, or Form
 - You need to share, rename, move, or delete a Replicas-created Google file
-- You need to read responses from a Replicas-created Google Form`;
-var REFERENCE5 = `# Google Workspace (Docs, Sheets, Forms, Drive)
+- You need to read responses from a Replicas-created Google Form
+- You need to list Search Console properties, query search performance, read sitemaps, or inspect an indexed URL`;
+var REFERENCE5 = `# Google Workspace and Search Console
 
-This guide covers how to create and edit Google Docs, Sheets, and Forms \u2014 plus do basic Drive file operations \u2014 from inside a Replicas workspace, using the monolith as a gateway to Google's APIs.
+This guide covers how to create and edit Google Docs, Sheets, and Forms, perform basic Drive file operations, and read Google Search Console data from inside a Replicas workspace using the monolith as a gateway to Google's APIs.
 
 ## Prerequisites
 
@@ -1429,6 +1433,62 @@ curl -s "$MONOLITH_URL/v1/gdrive/files?pageSize=50" "\${GDRIVE_AUTH[@]}"
 
 Pass \`?q=...\` to filter using [Drive API search syntax](https://developers.google.com/workspace/drive/api/guides/search-files). Only files the app created or was granted access to will appear.
 
+## Google Search Console (read-only)
+
+Search Console access uses the \`webmasters.readonly\` scope. The connected Google account must have access to the requested property. If the account was connected before this scope was added, reconnect it in **Settings \u2192 Integrations \u2192 Google** first.
+
+Property identifiers must be URL-encoded as query parameters. URL-prefix properties include the trailing slash (for example, \`https://example.com/\`); Domain properties use \`sc-domain:example.com\`.
+
+### List accessible properties
+
+\`\`\`bash
+curl -s "$MONOLITH_URL/v1/gdrive/search-console/sites" "\${GDRIVE_AUTH[@]}"
+\`\`\`
+
+### Get a property
+
+\`\`\`bash
+SITE_URL=$(printf %s 'sc-domain:example.com' | jq -sRr @uri)
+curl -s "$MONOLITH_URL/v1/gdrive/search-console/site?siteUrl=$SITE_URL" "\${GDRIVE_AUTH[@]}"
+\`\`\`
+
+### Query search performance
+
+\`\`\`bash
+curl -s -X POST "$MONOLITH_URL/v1/gdrive/search-console/search-analytics/query?siteUrl=$SITE_URL" "\${GDRIVE_AUTH[@]}" \\
+  -H "Content-Type: application/json" \\
+  -d '{
+    "startDate": "2026-06-01",
+    "endDate": "2026-06-30",
+    "dimensions": ["query", "page"],
+    "rowLimit": 1000
+  }'
+\`\`\`
+
+Results contain clicks, impressions, CTR, and average position. Use \`startRow\` with \`rowLimit\` to paginate; Google returns at most 25,000 rows per request.
+
+### List sitemaps
+
+\`\`\`bash
+curl -s "$MONOLITH_URL/v1/gdrive/search-console/sitemaps?siteUrl=$SITE_URL" "\${GDRIVE_AUTH[@]}"
+\`\`\`
+
+Pass a URL-encoded \`sitemapIndex\` query parameter to list sitemaps referenced by a sitemap index. To fetch one sitemap, call \`/v1/gdrive/search-console/sitemap\` with URL-encoded \`siteUrl\` and \`feedpath\` query parameters.
+
+### Inspect an indexed URL
+
+\`\`\`bash
+curl -s -X POST "$MONOLITH_URL/v1/gdrive/search-console/url-inspection" "\${GDRIVE_AUTH[@]}" \\
+  -H "Content-Type: application/json" \\
+  -d '{
+    "inspectionUrl": "https://example.com/page",
+    "siteUrl": "sc-domain:example.com",
+    "languageCode": "en-US"
+  }'
+\`\`\`
+
+URL Inspection reports the version currently in Google's index; it does not run a live URL test.
+
 ## Tips
 
 - **Always return the \`webViewLink\`** to the user when you create or edit a file so they can open it. Get it from \`/v1/gdrive/files/$FILE_ID?fields=webViewLink\` or from \`documents.documentId\` \u2192 \`https://docs.google.com/document/d/$ID/edit\`.
@@ -1436,9 +1496,9 @@ Pass \`?q=...\` to filter using [Drive API search syntax](https://developers.goo
 - **Watch error responses.** A 412 from the gateway means the org has no Google credentials connected \u2014 tell the user to connect Google in the dashboard. Other 4xx responses come straight from Google and usually explain the issue clearly.
 `;
 var GOOGLE_ABILITY = {
-  label: "Google Workspace",
-  description: "Create / edit Docs, Sheets, Forms, and Drive files via the Replicas gateway.",
-  bullet: "- Interacting with Google Workspace (creating and editing Docs, Sheets, and Forms, sharing files, reading form responses, etc.)",
+  label: "Google",
+  description: "Use Google Workspace and read Search Console data via the Replicas gateway.",
+  bullet: "- Interacting with Google Workspace or Search Console (Docs, Sheets, Forms, Drive files, search performance, sitemaps, and URL inspection)",
   section: SECTION5,
   referenceFile: { name: "GOOGLE.md", content: REFERENCE5 }
 };
@@ -3311,18 +3371,13 @@ var BaseRefreshManager = class {
         }
       }
     }
-    this.intervalHandle = setInterval(() => {
-      this.refreshOnce().catch((error) => {
-        console.error(`[${this.managerName}] Scheduled refresh failed:`, error);
-      });
-    }, this.intervalMs);
-    console.log(`[${this.managerName}] Token refresh scheduled every ${Math.round(this.intervalMs / 6e4)} minutes`);
+    this.scheduleNextRefresh();
   }
   stop() {
     if (!this.intervalHandle) {
       return;
     }
-    clearInterval(this.intervalHandle);
+    clearTimeout(this.intervalHandle);
     this.intervalHandle = null;
     this.health.isRunning = false;
     console.log(`[${this.managerName}] Stopped`);
@@ -3333,6 +3388,9 @@ var BaseRefreshManager = class {
   getSkipReason() {
     return null;
   }
+  getNextRefreshDelayMs() {
+    return this.intervalMs;
+  }
   getRuntimeConfig() {
     if (!ENGINE_ENV.WORKSPACE_ID) {
       return null;
@@ -3343,6 +3401,15 @@ var BaseRefreshManager = class {
       engineSecret: ENGINE_ENV.REPLICAS_ENGINE_SECRET
     };
   }
+  scheduleNextRefresh() {
+    const delayMs = this.getNextRefreshDelayMs();
+    this.health.intervalMs = delayMs;
+    this.intervalHandle = setTimeout(async () => {
+      await this.refreshOnce();
+      if (this.intervalHandle) this.scheduleNextRefresh();
+    }, delayMs);
+    console.log(`[${this.managerName}] Token refresh scheduled in ${Math.round(delayMs / 1e3)} seconds`);
+  }
   async refreshOnce() {
     if (this.getSkipReason()) {
       return;
@@ -3365,7 +3432,7 @@ var BaseRefreshManager = class {
 };
 
 // src/services/monolith-service.ts
-async function monolithRequest(path5, init = {}) {
+async function monolithRequest(path6, init = {}) {
   if (!ENGINE_ENV.WORKSPACE_ID) {
     throw new Error("WORKSPACE_ID is not set; cannot call monolith");
   }
@@ -3375,7 +3442,7 @@ async function monolithRequest(path5, init = {}) {
     "X-Workspace-Id": ENGINE_ENV.WORKSPACE_ID
   };
   if (!isFormData) headers["Content-Type"] = "application/json";
-  return fetch(`${ENGINE_ENV.MONOLITH_URL}${path5}`, {
+  return fetch(`${ENGINE_ENV.MONOLITH_URL}${path6}`, {
     method: init.method ?? "POST",
     headers,
     body: init.body === void 0 ? void 0 : isFormData ? init.body : JSON.stringify(init.body),
@@ -3418,11 +3485,11 @@ var AsyncLock = class {
 };
 
 // src/utils/file.ts
-async function atomicWriteFile(path5, data, options) {
-  const tmpFile = `${path5}.${process.pid}.${Date.now()}.tmp`;
+async function atomicWriteFile(path6, data, options) {
+  const tmpFile = `${path6}.${process.pid}.${Date.now()}.tmp`;
   try {
     await writeFile(tmpFile, data, { encoding: "utf-8", mode: options?.mode });
-    await rename(tmpFile, path5);
+    await rename(tmpFile, path6);
   } catch (error) {
     await unlink(tmpFile).catch(() => void 0);
     throw error;
@@ -3805,6 +3872,64 @@ var CodexTokenManager = class extends BaseRefreshManager {
 };
 var codexTokenManager = new CodexTokenManager();
 
+// src/managers/infisical-token-manager.ts
+import { rm } from "fs/promises";
+import path5 from "path";
+var InfisicalTokenManager = class extends BaseRefreshManager {
+  constructor(request = monolithRequest, paths = {
+    homeDir: ENGINE_ENV.HOME_DIR,
+    workspaceRoot: ENGINE_ENV.WORKSPACE_ROOT
+  }, applyCredentials = applyInfisicalCredentials) {
+    super("InfisicalTokenManager", 5 * 60 * 1e3);
+    this.request = request;
+    this.paths = paths;
+    this.applyCredentials = applyCredentials;
+  }
+  request;
+  paths;
+  applyCredentials;
+  nextRefreshDelayMs = 5 * 60 * 1e3;
+  async doRefresh(_config) {
+    const response = await this.request("/v1/engine/infisical/refresh-token");
+    if (!response.ok) throw new Error(`Token refresh failed: ${response.status} ${await response.text()}`);
+    const data = await response.json();
+    await this.applyCredentials(data, this.paths);
+    const ttlMs = data.configured ? Date.parse(data.expiresAt) - Date.now() : Number.NaN;
+    this.nextRefreshDelayMs = Number.isFinite(ttlMs) ? Math.max(1e3, Math.min(5 * 60 * 1e3, Math.floor(ttlMs * 0.8))) : 5 * 60 * 1e3;
+  }
+  getNextRefreshDelayMs() {
+    return this.nextRefreshDelayMs;
+  }
+};
+async function applyInfisicalCredentials(data, paths) {
+  const credentialPath = path5.join(paths.homeDir, ".replicas", "infisical-env.sh");
+  const configPath = path5.join(paths.workspaceRoot, ".infisical.json");
+  if (!data.configured) {
+    delete process.env.INFISICAL_TOKEN;
+    delete process.env.INFISICAL_DOMAIN;
+    await Promise.all([rm(credentialPath, { force: true }), rm(configPath, { force: true })]);
+    return;
+  }
+  process.env.INFISICAL_TOKEN = data.token;
+  process.env.INFISICAL_DOMAIN = data.siteUrl;
+  await Promise.all([
+    writeSecureCredentialFile(credentialPath, [
+      `export INFISICAL_TOKEN=${shellQuotePosix(data.token)}`,
+      `export INFISICAL_DOMAIN=${shellQuotePosix(data.siteUrl)}`,
+      "export INFISICAL_DISABLE_UPDATE_CHECK=true",
+      ""
+    ].join("\n"), { ensureParentDir: true }),
+    writeSecureCredentialFile(configPath, `${JSON.stringify({
+      workspaceId: data.projectId,
+      defaultEnvironment: data.environment,
+      gitBranchToEnvironmentMapping: null,
+      domain: data.siteUrl
+    }, null, 2)}
+`, { ensureParentDir: true })
+  ]);
+}
+var infisicalTokenManager = new InfisicalTokenManager();
+
 // src/git/service.ts
 import { readdir, readFile as readFile3, stat } from "fs/promises";
 import { existsSync as existsSync2, unlinkSync } from "fs";
@@ -4266,9 +4391,9 @@ var GitService = class {
     try {
       const paths = await this.listUntrackedPaths(repoPath);
       let total = 0;
-      for (const path5 of paths) {
+      for (const path6 of paths) {
         try {
-          const contents = await readFile3(join5(repoPath, path5));
+          const contents = await readFile3(join5(repoPath, path6));
           if (contents.length === 0 || contents.includes(0)) {
             continue;
           }
@@ -4556,12 +4681,12 @@ var GitService = class {
     await saveRepoState(repo.name, state, state);
     return state;
   }
-  pathExists(path5) {
-    return existsSync2(path5);
+  pathExists(path6) {
+    return existsSync2(path6);
   }
-  async safeStat(path5) {
+  async safeStat(path6) {
     try {
-      return await stat(path5);
+      return await stat(path6);
     } catch {
       return null;
     }
@@ -4584,8 +4709,8 @@ var StreamWriter = class {
   backpressured = false;
   droppedCount = 0;
   flushTimer = null;
-  open(path5, highWaterMark = DEFAULT_HIGH_WATER) {
-    this.stream = createWriteStream(path5, { flags: "a", highWaterMark });
+  open(path6, highWaterMark = DEFAULT_HIGH_WATER) {
+    this.stream = createWriteStream(path6, { flags: "a", highWaterMark });
     this.stream.on("error", () => {
       this.stream = null;
     });
@@ -5578,7 +5703,7 @@ async function registerDesktopPreview() {
 
 // src/services/chat/chat-service.ts
 import { existsSync as existsSync7 } from "fs";
-import { appendFile as appendFile3, copyFile, mkdir as mkdir13, readFile as readFile14, rename as rename2, rm } from "fs/promises";
+import { appendFile as appendFile3, copyFile, mkdir as mkdir13, readFile as readFile14, rename as rename2, rm as rm2 } from "fs/promises";
 import { homedir as homedir15 } from "os";
 import { join as join21 } from "path";
 import { randomUUID as randomUUID5 } from "crypto";
@@ -6095,7 +6220,7 @@ async function saveNormalizedImagesToTempFiles(images, tempImageDir = join12(hom
   return tempPaths;
 }
 async function removeTempImageFiles(paths) {
-  await Promise.allSettled(paths.map((path5) => unlink2(path5)));
+  await Promise.allSettled(paths.map((path6) => unlink2(path6)));
 }
 
 // src/services/message-queue-service.ts
@@ -6677,7 +6802,7 @@ async function getSkillRegistryInventory(homeDir) {
 async function buildClaudeRegistryConfig(homeDir) {
   const inventory = await getSkillRegistryInventory(homeDir);
   return {
-    plugins: inventory.claudePluginRoots.map((path5) => ({ type: "local", path: path5 })),
+    plugins: inventory.claudePluginRoots.map((path6) => ({ type: "local", path: path6 })),
     enableAllSkills: inventory.claudePluginRoots.length > 0 || inventory.standaloneSkills.length > 0
   };
 }
@@ -6843,31 +6968,31 @@ function uniqueStandaloneSkills(skills) {
   }
   return unique;
 }
-async function safeReadDir(path5) {
+async function safeReadDir(path6) {
   try {
-    return await readdir3(path5, { withFileTypes: true });
+    return await readdir3(path6, { withFileTypes: true });
   } catch (error) {
     if (isNotFoundError(error)) return [];
     throw error;
   }
 }
-async function isDirectoryDirent(dirent, path5) {
+async function isDirectoryDirent(dirent, path6) {
   if (dirent.isDirectory()) return true;
   if (!dirent.isSymbolicLink()) return false;
-  return directoryExists(path5);
+  return directoryExists(path6);
 }
-async function directoryExists(path5) {
+async function directoryExists(path6) {
   try {
-    const pathStat = await stat2(path5);
+    const pathStat = await stat2(path6);
     return pathStat.isDirectory();
   } catch (error) {
     if (isNotFoundError(error)) return false;
     throw error;
   }
 }
-async function fileExists(path5) {
+async function fileExists(path6) {
   try {
-    const pathStat = await stat2(path5);
+    const pathStat = await stat2(path6);
     return pathStat.isFile();
   } catch (error) {
     if (isNotFoundError(error)) return false;
@@ -8291,7 +8416,7 @@ var DEFAULT_CODEX_ARGS = ["app-server", "--listen", "stdio://"];
 var MIN_CODEX_CLI_VERSION = "0.144.0";
 var CODEX_UPGRADE_TIMEOUT_MS = 12e4;
 var codexCliVersionEnsured = null;
-var ENGINE_PACKAGE_VERSION = "0.1.421";
+var ENGINE_PACKAGE_VERSION = "0.1.423";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";
@@ -8648,16 +8773,16 @@ function transcriptItemsForTurn(turn) {
   const otherItems = turn.items.filter((item) => item.type !== "userMessage");
   return [...userItems, ...otherItems];
 }
-function userImageForLocalPath(path5) {
-  const cached = localImageCache.get(path5);
+function userImageForLocalPath(path6) {
+  const cached = localImageCache.get(path6);
   if (cached) return cached;
-  if (!existsSync6(path5)) return null;
+  if (!existsSync6(path6)) return null;
   const image = {
     type: "image",
-    mediaType: inferMediaType(path5),
-    data: readFileSync3(path5).toString("base64")
+    mediaType: inferMediaType(path6),
+    data: readFileSync3(path6).toString("base64")
   };
-  if (image.data.length > 0) localImageCache.set(path5, image);
+  if (image.data.length > 0) localImageCache.set(path6, image);
   return image;
 }
 function userImagesForInput(input) {
@@ -9031,9 +9156,9 @@ async function buildTurnInput(request) {
   }
   const normalizedImages = await normalizeImages(request.images);
   const tempImagePaths = await saveNormalizedImagesToTempFiles(normalizedImages);
-  input.push(...tempImagePaths.map((path5) => ({
+  input.push(...tempImagePaths.map((path6) => ({
     type: "localImage",
-    path: path5
+    path: path6
   })));
   return { input, tempImagePaths };
 }
@@ -11477,9 +11602,9 @@ function extractTextBlocks(content, textBlockType, separator = "\n") {
   const texts = content.map((block) => block && typeof block === "object" && "type" in block && block.type === textBlockType && "text" in block && typeof block.text === "string" ? block.text : "").filter(Boolean);
   return texts.length > 0 ? texts.join(separator) : null;
 }
-async function engineFetch(path5, options) {
+async function engineFetch(path6, options) {
   const baseUrl = `http://localhost:${ENGINE_ENV.REPLICAS_ENGINE_PORT}`;
-  return fetch(`${baseUrl}${path5}`, {
+  return fetch(`${baseUrl}${path6}`, {
     ...options,
     headers: {
       "Content-Type": "application/json",
@@ -12755,8 +12880,8 @@ var ChatService = class {
     return descendants;
   }
   async deleteHistoryFile(persisted) {
-    await rm(join21(HISTORY_DIR_BY_PROVIDER[persisted.provider], `${persisted.id}.jsonl`), { force: true });
-    await rm(this.senderFilePath(persisted.id), { force: true });
+    await rm2(join21(HISTORY_DIR_BY_PROVIDER[persisted.provider], `${persisted.id}.jsonl`), { force: true });
+    await rm2(this.senderFilePath(persisted.id), { force: true });
   }
   async getChatHistory(chatId, page = {}) {
     const chat = this.requireChat(chatId);
@@ -14155,11 +14280,11 @@ function createV1Routes(deps) {
   });
   app2.get("/repo-files/content", async (c) => {
     const repoName = c.req.query("repoName");
-    const path5 = c.req.query("path");
-    if (!repoName || !path5) {
+    const path6 = c.req.query("path");
+    if (!repoName || !path6) {
       return c.json(jsonError("repoName and path are required"), 400);
     }
-    const result = await deps.repoFileService.readFile(repoName, path5);
+    const result = await deps.repoFileService.readFile(repoName, path6);
     if (!result) {
       return c.json(jsonError("File not found"), 404);
     }
@@ -14748,7 +14873,8 @@ app.get("/token-refresh/health", async (c) => {
     github: githubTokenManager.getHealthStatus(),
     gitlab: gitlabTokenManager.getHealthStatus(),
     claude: claudeTokenManager.getHealthStatus(),
-    codex: codexTokenManager.getHealthStatus()
+    codex: codexTokenManager.getHealthStatus(),
+    infisical: infisicalTokenManager.getHealthStatus()
   });
 });
 var repoFileService = new RepoFileService(gitService);
@@ -14897,6 +15023,7 @@ serve(
       await gitlabTokenManager.start();
       await claudeTokenManager.start();
       await codexTokenManager.start();
+      await infisicalTokenManager.start();
     }
     const repos = await gitService.listRepos();
     await eventService.publish({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.421",
+  "version": "0.1.423",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",