replicas-engine 0.1.422 → 0.1.424

package/README.md

@@ -87,6 +87,7 @@ Token refresh managers may later overwrite credential files in place:
 - `~/.git-credentials`
 - `~/.claude/.credentials.json`
 - `~/.codex/auth.json`
+- `~/.replicas/infisical-env.sh` and `~/workspaces/.infisical.json`
 
 Engine persistence locations:
 
@@ -131,3 +132,4 @@ Outgoing endpoints:
 - `POST /v1/engine/github/refresh-token`
 - `POST /v1/engine/claude/refresh-credentials`
 - `POST /v1/engine/codex/refresh-credentials`
+- `POST /v1/engine/infisical/refresh-token`

package/dist/src/index.js

@@ -508,9 +508,12 @@ var WORKSPACE_SIZES = ["small", "large"];
 var INVALID_WORKSPACE_SIZE_ERROR = `Invalid size: must be one of ${WORKSPACE_SIZES.join(", ")}`;
 
 // ../shared/src/e2b.ts
-var E2B_TEMPLATE_NAME = "replicas-sandbox-2026-07-10-v3";
+var E2B_TEMPLATE_NAME = "replicas-sandbox-2026-07-10-v5";
 
 // ../shared/src/runtime-env.ts
+function shellQuotePosix(value) {
+  return `'${value.split("'").join("'\\''")}'`;
+}
 function parsePosixEnvFile(content) {
   const result = {};
   let pos = 0;
@@ -3368,18 +3371,13 @@ var BaseRefreshManager = class {
         }
       }
     }
-    this.intervalHandle = setInterval(() => {
-      this.refreshOnce().catch((error) => {
-        console.error(`[${this.managerName}] Scheduled refresh failed:`, error);
-      });
-    }, this.intervalMs);
-    console.log(`[${this.managerName}] Token refresh scheduled every ${Math.round(this.intervalMs / 6e4)} minutes`);
+    this.scheduleNextRefresh();
   }
   stop() {
     if (!this.intervalHandle) {
       return;
     }
-    clearInterval(this.intervalHandle);
+    clearTimeout(this.intervalHandle);
     this.intervalHandle = null;
     this.health.isRunning = false;
     console.log(`[${this.managerName}] Stopped`);
@@ -3390,6 +3388,9 @@ var BaseRefreshManager = class {
   getSkipReason() {
     return null;
   }
+  getNextRefreshDelayMs() {
+    return this.intervalMs;
+  }
   getRuntimeConfig() {
     if (!ENGINE_ENV.WORKSPACE_ID) {
       return null;
@@ -3400,6 +3401,15 @@ var BaseRefreshManager = class {
       engineSecret: ENGINE_ENV.REPLICAS_ENGINE_SECRET
     };
   }
+  scheduleNextRefresh() {
+    const delayMs = this.getNextRefreshDelayMs();
+    this.health.intervalMs = delayMs;
+    this.intervalHandle = setTimeout(async () => {
+      await this.refreshOnce();
+      if (this.intervalHandle) this.scheduleNextRefresh();
+    }, delayMs);
+    console.log(`[${this.managerName}] Token refresh scheduled in ${Math.round(delayMs / 1e3)} seconds`);
+  }
   async refreshOnce() {
     if (this.getSkipReason()) {
       return;
@@ -3422,7 +3432,7 @@ var BaseRefreshManager = class {
 };
 
 // src/services/monolith-service.ts
-async function monolithRequest(path5, init = {}) {
+async function monolithRequest(path6, init = {}) {
   if (!ENGINE_ENV.WORKSPACE_ID) {
     throw new Error("WORKSPACE_ID is not set; cannot call monolith");
   }
@@ -3432,7 +3442,7 @@ async function monolithRequest(path5, init = {}) {
     "X-Workspace-Id": ENGINE_ENV.WORKSPACE_ID
   };
   if (!isFormData) headers["Content-Type"] = "application/json";
-  return fetch(`${ENGINE_ENV.MONOLITH_URL}${path5}`, {
+  return fetch(`${ENGINE_ENV.MONOLITH_URL}${path6}`, {
     method: init.method ?? "POST",
     headers,
     body: init.body === void 0 ? void 0 : isFormData ? init.body : JSON.stringify(init.body),
@@ -3475,11 +3485,11 @@ var AsyncLock = class {
 };
 
 // src/utils/file.ts
-async function atomicWriteFile(path5, data, options) {
-  const tmpFile = `${path5}.${process.pid}.${Date.now()}.tmp`;
+async function atomicWriteFile(path6, data, options) {
+  const tmpFile = `${path6}.${process.pid}.${Date.now()}.tmp`;
   try {
     await writeFile(tmpFile, data, { encoding: "utf-8", mode: options?.mode });
-    await rename(tmpFile, path5);
+    await rename(tmpFile, path6);
   } catch (error) {
     await unlink(tmpFile).catch(() => void 0);
     throw error;
@@ -3862,6 +3872,64 @@ var CodexTokenManager = class extends BaseRefreshManager {
 };
 var codexTokenManager = new CodexTokenManager();
 
+// src/managers/infisical-token-manager.ts
+import { rm } from "fs/promises";
+import path5 from "path";
+var InfisicalTokenManager = class extends BaseRefreshManager {
+  constructor(request = monolithRequest, paths = {
+    homeDir: ENGINE_ENV.HOME_DIR,
+    workspaceRoot: ENGINE_ENV.WORKSPACE_ROOT
+  }, applyCredentials = applyInfisicalCredentials) {
+    super("InfisicalTokenManager", 5 * 60 * 1e3);
+    this.request = request;
+    this.paths = paths;
+    this.applyCredentials = applyCredentials;
+  }
+  request;
+  paths;
+  applyCredentials;
+  nextRefreshDelayMs = 5 * 60 * 1e3;
+  async doRefresh(_config) {
+    const response = await this.request("/v1/engine/infisical/refresh-token");
+    if (!response.ok) throw new Error(`Token refresh failed: ${response.status} ${await response.text()}`);
+    const data = await response.json();
+    await this.applyCredentials(data, this.paths);
+    const ttlMs = data.configured ? Date.parse(data.expiresAt) - Date.now() : Number.NaN;
+    this.nextRefreshDelayMs = Number.isFinite(ttlMs) ? Math.max(1e3, Math.min(5 * 60 * 1e3, Math.floor(ttlMs * 0.8))) : 5 * 60 * 1e3;
+  }
+  getNextRefreshDelayMs() {
+    return this.nextRefreshDelayMs;
+  }
+};
+async function applyInfisicalCredentials(data, paths) {
+  const credentialPath = path5.join(paths.homeDir, ".replicas", "infisical-env.sh");
+  const configPath = path5.join(paths.workspaceRoot, ".infisical.json");
+  if (!data.configured) {
+    delete process.env.INFISICAL_TOKEN;
+    delete process.env.INFISICAL_DOMAIN;
+    await Promise.all([rm(credentialPath, { force: true }), rm(configPath, { force: true })]);
+    return;
+  }
+  process.env.INFISICAL_TOKEN = data.token;
+  process.env.INFISICAL_DOMAIN = data.siteUrl;
+  await Promise.all([
+    writeSecureCredentialFile(credentialPath, [
+      `export INFISICAL_TOKEN=${shellQuotePosix(data.token)}`,
+      `export INFISICAL_DOMAIN=${shellQuotePosix(data.siteUrl)}`,
+      "export INFISICAL_DISABLE_UPDATE_CHECK=true",
+      ""
+    ].join("\n"), { ensureParentDir: true }),
+    writeSecureCredentialFile(configPath, `${JSON.stringify({
+      workspaceId: data.projectId,
+      defaultEnvironment: data.environment,
+      gitBranchToEnvironmentMapping: null,
+      domain: data.siteUrl
+    }, null, 2)}
+`, { ensureParentDir: true })
+  ]);
+}
+var infisicalTokenManager = new InfisicalTokenManager();
+
 // src/git/service.ts
 import { readdir, readFile as readFile3, stat } from "fs/promises";
 import { existsSync as existsSync2, unlinkSync } from "fs";
@@ -4323,9 +4391,9 @@ var GitService = class {
     try {
       const paths = await this.listUntrackedPaths(repoPath);
       let total = 0;
-      for (const path5 of paths) {
+      for (const path6 of paths) {
         try {
-          const contents = await readFile3(join5(repoPath, path5));
+          const contents = await readFile3(join5(repoPath, path6));
           if (contents.length === 0 || contents.includes(0)) {
             continue;
           }
@@ -4613,12 +4681,12 @@ var GitService = class {
     await saveRepoState(repo.name, state, state);
     return state;
   }
-  pathExists(path5) {
-    return existsSync2(path5);
+  pathExists(path6) {
+    return existsSync2(path6);
   }
-  async safeStat(path5) {
+  async safeStat(path6) {
     try {
-      return await stat(path5);
+      return await stat(path6);
     } catch {
       return null;
     }
@@ -4641,8 +4709,8 @@ var StreamWriter = class {
   backpressured = false;
   droppedCount = 0;
   flushTimer = null;
-  open(path5, highWaterMark = DEFAULT_HIGH_WATER) {
-    this.stream = createWriteStream(path5, { flags: "a", highWaterMark });
+  open(path6, highWaterMark = DEFAULT_HIGH_WATER) {
+    this.stream = createWriteStream(path6, { flags: "a", highWaterMark });
     this.stream.on("error", () => {
       this.stream = null;
     });
@@ -5635,7 +5703,7 @@ async function registerDesktopPreview() {
 
 // src/services/chat/chat-service.ts
 import { existsSync as existsSync7 } from "fs";
-import { appendFile as appendFile3, copyFile, mkdir as mkdir13, readFile as readFile14, rename as rename2, rm } from "fs/promises";
+import { appendFile as appendFile3, copyFile, mkdir as mkdir13, readFile as readFile14, rename as rename2, rm as rm2 } from "fs/promises";
 import { homedir as homedir15 } from "os";
 import { join as join21 } from "path";
 import { randomUUID as randomUUID5 } from "crypto";
@@ -6152,7 +6220,7 @@ async function saveNormalizedImagesToTempFiles(images, tempImageDir = join12(hom
   return tempPaths;
 }
 async function removeTempImageFiles(paths) {
-  await Promise.allSettled(paths.map((path5) => unlink2(path5)));
+  await Promise.allSettled(paths.map((path6) => unlink2(path6)));
 }
 
 // src/services/message-queue-service.ts
@@ -6734,7 +6802,7 @@ async function getSkillRegistryInventory(homeDir) {
 async function buildClaudeRegistryConfig(homeDir) {
   const inventory = await getSkillRegistryInventory(homeDir);
   return {
-    plugins: inventory.claudePluginRoots.map((path5) => ({ type: "local", path: path5 })),
+    plugins: inventory.claudePluginRoots.map((path6) => ({ type: "local", path: path6 })),
     enableAllSkills: inventory.claudePluginRoots.length > 0 || inventory.standaloneSkills.length > 0
   };
 }
@@ -6900,31 +6968,31 @@ function uniqueStandaloneSkills(skills) {
   }
   return unique;
 }
-async function safeReadDir(path5) {
+async function safeReadDir(path6) {
   try {
-    return await readdir3(path5, { withFileTypes: true });
+    return await readdir3(path6, { withFileTypes: true });
   } catch (error) {
     if (isNotFoundError(error)) return [];
     throw error;
   }
 }
-async function isDirectoryDirent(dirent, path5) {
+async function isDirectoryDirent(dirent, path6) {
   if (dirent.isDirectory()) return true;
   if (!dirent.isSymbolicLink()) return false;
-  return directoryExists(path5);
+  return directoryExists(path6);
 }
-async function directoryExists(path5) {
+async function directoryExists(path6) {
   try {
-    const pathStat = await stat2(path5);
+    const pathStat = await stat2(path6);
     return pathStat.isDirectory();
   } catch (error) {
     if (isNotFoundError(error)) return false;
     throw error;
   }
 }
-async function fileExists(path5) {
+async function fileExists(path6) {
   try {
-    const pathStat = await stat2(path5);
+    const pathStat = await stat2(path6);
     return pathStat.isFile();
   } catch (error) {
     if (isNotFoundError(error)) return false;
@@ -8348,7 +8416,7 @@ var DEFAULT_CODEX_ARGS = ["app-server", "--listen", "stdio://"];
 var MIN_CODEX_CLI_VERSION = "0.144.0";
 var CODEX_UPGRADE_TIMEOUT_MS = 12e4;
 var codexCliVersionEnsured = null;
-var ENGINE_PACKAGE_VERSION = "0.1.422";
+var ENGINE_PACKAGE_VERSION = "0.1.424";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";
@@ -8705,16 +8773,16 @@ function transcriptItemsForTurn(turn) {
   const otherItems = turn.items.filter((item) => item.type !== "userMessage");
   return [...userItems, ...otherItems];
 }
-function userImageForLocalPath(path5) {
-  const cached = localImageCache.get(path5);
+function userImageForLocalPath(path6) {
+  const cached = localImageCache.get(path6);
   if (cached) return cached;
-  if (!existsSync6(path5)) return null;
+  if (!existsSync6(path6)) return null;
   const image = {
     type: "image",
-    mediaType: inferMediaType(path5),
-    data: readFileSync3(path5).toString("base64")
+    mediaType: inferMediaType(path6),
+    data: readFileSync3(path6).toString("base64")
   };
-  if (image.data.length > 0) localImageCache.set(path5, image);
+  if (image.data.length > 0) localImageCache.set(path6, image);
   return image;
 }
 function userImagesForInput(input) {
@@ -9088,9 +9156,9 @@ async function buildTurnInput(request) {
   }
   const normalizedImages = await normalizeImages(request.images);
   const tempImagePaths = await saveNormalizedImagesToTempFiles(normalizedImages);
-  input.push(...tempImagePaths.map((path5) => ({
+  input.push(...tempImagePaths.map((path6) => ({
     type: "localImage",
-    path: path5
+    path: path6
   })));
   return { input, tempImagePaths };
 }
@@ -11534,9 +11602,9 @@ function extractTextBlocks(content, textBlockType, separator = "\n") {
   const texts = content.map((block) => block && typeof block === "object" && "type" in block && block.type === textBlockType && "text" in block && typeof block.text === "string" ? block.text : "").filter(Boolean);
   return texts.length > 0 ? texts.join(separator) : null;
 }
-async function engineFetch(path5, options) {
+async function engineFetch(path6, options) {
   const baseUrl = `http://localhost:${ENGINE_ENV.REPLICAS_ENGINE_PORT}`;
-  return fetch(`${baseUrl}${path5}`, {
+  return fetch(`${baseUrl}${path6}`, {
     ...options,
     headers: {
       "Content-Type": "application/json",
@@ -12812,8 +12880,8 @@ var ChatService = class {
     return descendants;
   }
   async deleteHistoryFile(persisted) {
-    await rm(join21(HISTORY_DIR_BY_PROVIDER[persisted.provider], `${persisted.id}.jsonl`), { force: true });
-    await rm(this.senderFilePath(persisted.id), { force: true });
+    await rm2(join21(HISTORY_DIR_BY_PROVIDER[persisted.provider], `${persisted.id}.jsonl`), { force: true });
+    await rm2(this.senderFilePath(persisted.id), { force: true });
   }
   async getChatHistory(chatId, page = {}) {
     const chat = this.requireChat(chatId);
@@ -14212,11 +14280,11 @@ function createV1Routes(deps) {
   });
   app2.get("/repo-files/content", async (c) => {
     const repoName = c.req.query("repoName");
-    const path5 = c.req.query("path");
-    if (!repoName || !path5) {
+    const path6 = c.req.query("path");
+    if (!repoName || !path6) {
       return c.json(jsonError("repoName and path are required"), 400);
     }
-    const result = await deps.repoFileService.readFile(repoName, path5);
+    const result = await deps.repoFileService.readFile(repoName, path6);
     if (!result) {
       return c.json(jsonError("File not found"), 404);
     }
@@ -14805,7 +14873,8 @@ app.get("/token-refresh/health", async (c) => {
     github: githubTokenManager.getHealthStatus(),
     gitlab: gitlabTokenManager.getHealthStatus(),
     claude: claudeTokenManager.getHealthStatus(),
-    codex: codexTokenManager.getHealthStatus()
+    codex: codexTokenManager.getHealthStatus(),
+    infisical: infisicalTokenManager.getHealthStatus()
   });
 });
 var repoFileService = new RepoFileService(gitService);
@@ -14954,6 +15023,7 @@ serve(
       await gitlabTokenManager.start();
       await claudeTokenManager.start();
       await codexTokenManager.start();
+      await infisicalTokenManager.start();
     }
     const repos = await gitService.listRepos();
     await eventService.publish({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.422",
+  "version": "0.1.424",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",