replicas-engine 0.1.437 → 0.1.439

package/dist/src/index.js

@@ -506,7 +506,7 @@ var WORKSPACE_SIZES = ["small", "large"];
 var INVALID_WORKSPACE_SIZE_ERROR = `Invalid size: must be one of ${WORKSPACE_SIZES.join(", ")}`;
 
 // ../shared/src/e2b.ts
-var E2B_TEMPLATE_NAME = "replicas-sandbox-2026-07-15-v2";
+var E2B_TEMPLATE_NAME = "replicas-sandbox-2026-07-15-v4";
 
 // ../shared/src/runtime-env.ts
 function shellQuotePosix(value) {
@@ -1113,7 +1113,9 @@ gh pr review 123 --request-changes --body "Changes needed"
 GitHub does NOT have a public API for uploading images to PRs/issues. When you need to include images:
 - Do NOT use placeholder image URLs
 - Do NOT commit screenshots as files to the repository
-- Use the \`replicas-agent\` skill to share the image
+- Run \`replicas media upload <image> --share\` and put the printed \`Forge embed\` Markdown in the PR body or comment
+- For video, embed a shared poster image linked to the recording's **View in Replicas** URL; GitHub does not reliably render externally hosted video inline
+- Treat the public URL as an opt-in bearer capability and revoke it with \`replicas media revoke <media-id>\` when appropriate
 - If you were triggered from Slack, also upload the image to the Slack thread so the user can see it directly
 `;
 var GITHUB_ABILITY = {
@@ -1173,6 +1175,23 @@ curl -s -H "Authorization: Bearer $TOKEN" "https://gitlab.com/api/v4/projects/<u
 \`\`\`
 
 Use the repo's own host in the API base URL for self-managed instances.
+
+## Inline media in merge requests
+
+GitLab provides a supported project Markdown uploads API. Upload media to Replicas first, then upload the same bytes natively so repository permissions protect the asset:
+
+\`\`\`bash
+FILE=/abs/path/to/screenshot.png
+PROJECT=$(python3 -c 'import urllib.parse; print(urllib.parse.quote("group/project", safe=""))')
+TOKEN=$(grep -m1 '://oauth2:' ~/.git-credentials | sed -E 's#https://oauth2:([^@]+)@.*#\\1#')
+UPLOAD=$(curl -sS --request POST \\
+  --header "Authorization: Bearer $TOKEN" \\
+  --form "file=@$FILE" \\
+  "https://gitlab.com/api/v4/projects/$PROJECT/uploads")
+echo "$UPLOAD" | jq -r .markdown
+\`\`\`
+
+Use the repository's own host for self-managed GitLab. Insert the returned \`markdown\` into the merge request description or comment and add the media's **View in Replicas** dashboard link. Images render inline; MP4, MOV, and WebM render as inline video players. Do not create a public Replicas forge share when this native upload succeeds.
 `;
 var GITLAB_ABILITY = {
   label: "GitLab",
@@ -1686,11 +1705,20 @@ For each file, the CLI prints two lines:
 
 Match each "View in Replicas" line to the embed line directly above it \u2014 that's the deep link for that file.
 
+Pass \`--share\` only when the media must render on an external forge:
+
+\`\`\`bash
+replicas media upload screenshot.png --share
+\`\`\`
+
+This prints an additional \`Forge embed\` Markdown line backed by an opt-in public bearer URL. Anyone with that unguessable URL can view the asset until it is rotated or revoked. Use \`replicas media share <media-id>\` to rotate it and \`replicas media revoke <media-id>\` to revoke it.
+
 ## The two URLs the CLI gives you \u2014 and where each one is allowed
 
 | URL | What it is | Where it's allowed |
 |---|---|---|
 | \`https://api.tryreplicas.com/v1/media/<id>\` (inside \`![\u2026](\u2026)\`) | Authenticated API redirect to a presigned blob \u2014 requires the Replicas chat session | **Only** in the Replicas chat reply. Nowhere else. |
+| \`https://api.tryreplicas.com/v1/media/public/<id>/<token>\` | Opt-in public bearer URL printed by \`--share\` | GitHub image embeds only. |
 | \`https://tryreplicas.com/workspaces/<workspace-id>?mode=media&media=<media-id>\` | Public dashboard deep link to the media tab, scrolled to that specific file | Everywhere external \u2014 Slack, GitHub, Linear, PR bodies, comments, emails. |
 
 ### NEVER link the API redirect URL outside the Replicas chat reply
@@ -1735,7 +1763,7 @@ Sharing media externally is a **two-step requirement** for every file:
 
 A link alone is not enough. A native upload alone is not enough. Do both.
 
-The one exception is GitHub, which has no public image upload API \u2014 there, the dashboard link is the only option (see below).
+GitHub has no native upload API, so use an explicit Replicas public share for screenshots and recording previews. GitLab has a native upload API and should receive the original bytes.
 
 ### Slack \u2014 embed natively via the 3-step external file upload flow
 
@@ -1847,20 +1875,34 @@ The same flow works for issue bodies (use \`issueCreate\` / \`issueUpdate\` with
 
 Never paste the \`api.tryreplicas.com/v1/media/<id>\` URL into a Linear body or comment \u2014 it will render as a broken image to anyone outside your Replicas chat.
 
-### GitHub \u2014 link the dashboard deep link (no public upload API exists)
+### GitHub: inline screenshots and recording previews
+
+GitHub has **no public API** for uploading attachments to PRs or issues. Its web UI uses an undocumented internal endpoint that API clients must not emulate. For screenshots, explicitly create a forge share and put the printed \`Forge embed\` Markdown directly in the PR body or comment, followed by the dashboard link:
+
+\`\`\`bash
+replicas media upload /tmp/screenshot.png --share
+\`\`\`
+
+GitHub does not reliably render arbitrary external videos as inline players. For a recording:
 
-GitHub has **no public API** for uploading images to PRs or issues. Their web UI uses an undocumented internal endpoint that's not available to API clients. So for GitHub specifically, the only correct way to share media is the dashboard deep link, rendered as a markdown hyperlink:
+1. Upload the MP4 normally so it remains available in Replicas.
+2. Generate a poster image from the recording: \`ffmpeg -i /tmp/demo.mp4 -frames:v 1 /tmp/demo-poster.png\`.
+3. Upload the poster with \`--share\`.
+4. Wrap the poster embed in a link to the recording's **View in Replicas** URL.
 
 \`\`\`markdown
-[View in Replicas](https://tryreplicas.com/workspaces/<workspace-id>?mode=media&media=<media-id>)
+[![Demo recording](<public-poster-url>)](<recording-dashboard-url>)
 \`\`\`
 
-Do **not**:
-- Commit screenshots as files to the repo as a workaround.
-- Use placeholder image URLs.
-- Embed the \`api.tryreplicas.com/v1/media/<id>\` URL in markdown \u2014 it renders as a broken image for every viewer.
+Public forge shares are bearer capabilities. For private repositories, create one only when the user asked for inline PR media, and revoke it with \`replicas media revoke <media-id>\` when it should stop resolving.
+
+Do **not** commit screenshots to the repo, use placeholder URLs, expose the authenticated \`/v1/media/<id>\` URL, or automate GitHub's undocumented browser upload flow.
+
+### GitLab: native inline screenshots and videos
+
+GitLab supports native project Markdown uploads. Always upload the media to Replicas first, then POST the same original file to the repository's \`/projects/:id/uploads\` API using the workspace GitLab credential. Insert the returned \`markdown\` value into the merge request body or comment and include the Replicas dashboard link. Image uploads render inline; MP4, MOV, and WebM uploads render as inline video players.
 
-This applies to PR descriptions, PR review comments, issue bodies, issue comments, and commit messages.
+Do not use a Replicas public forge share for GitLab when the native project upload succeeds; native uploads preserve project access controls.
 
 ## Recording defaults
 
@@ -1900,6 +1942,7 @@ replicas media upload chart-a.svg chart-b.svg --kind image
 
 - \`--kind <image|video|audio>\` \u2014 override auto-detection
 - \`--session-id <id>\` \u2014 associate the upload with a specific session
+- \`--share\`: create a revocable public bearer URL for a forge image embed
 `;
 var MEDIA_ABILITY = {
   label: "Media",
@@ -8520,7 +8563,7 @@ var DEFAULT_CODEX_ARGS = ["app-server", "--listen", "stdio://"];
 var MIN_CODEX_CLI_VERSION = "0.144.0";
 var CODEX_UPGRADE_TIMEOUT_MS = 12e4;
 var codexCliVersionEnsured = null;
-var ENGINE_PACKAGE_VERSION = "0.1.437";
+var ENGINE_PACKAGE_VERSION = "0.1.439";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.437",
+  "version": "0.1.439",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",