replicas-engine 0.1.477 → 0.1.478

package/dist/src/index.js

@@ -3,7 +3,7 @@
 // src/index.ts
 import { serve } from "@hono/node-server";
 import { Hono as Hono2 } from "hono";
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 
 // ../shared/src/type-guards.ts
 function isRecord(value) {
@@ -582,7 +582,7 @@ var WORKSPACE_SIZES = ["small", "large"];
 var INVALID_WORKSPACE_SIZE_ERROR = `Invalid size: must be one of ${WORKSPACE_SIZES.join(", ")}`;
 
 // ../shared/src/e2b.ts
-var E2B_TEMPLATE_NAME = "replicas-sandbox-2026-07-22-v2";
+var E2B_TEMPLATE_NAME = "replicas-sandbox-2026-07-22-v3";
 
 // ../shared/src/runtime-env.ts
 function shellQuotePosix(value) {
@@ -644,10 +644,30 @@ function parsePosixEnvFile(content) {
 }
 
 // ../shared/src/git.ts
-function gitIdentityConfigCommands(identity) {
+function parseGitRemote(remoteUrl) {
+  const normalized = remoteUrl.trim().replace(/\/+$/, "").replace(/\.git$/, "");
+  try {
+    const parsed = new URL(normalized);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:" && parsed.protocol !== "ssh:") return null;
+    const path7 = parsed.pathname.replace(/^\/+/, "");
+    const host2 = parsed.protocol === "ssh:" ? parsed.hostname : parsed.host;
+    if (!host2 || !path7) return null;
+    return {
+      host: host2.toLowerCase(),
+      path: path7,
+      protocol: parsed.protocol === "http:" ? "http" : parsed.protocol === "https:" ? "https" : "ssh"
+    };
+  } catch {
+  }
+  const match = normalized.match(/^(?:[^@/\s]+@)?([^:/\s]+):(?:(?:\d+)\/)?(.+)$/);
+  if (!match) return null;
+  const [, host, path6] = match;
+  return host && path6 ? { host: host.toLowerCase(), path: path6, protocol: "ssh" } : null;
+}
+function gitIdentityConfigCommands(identity, scope = "global") {
   return [
-    ["config", "--global", "user.name", identity.name],
-    ["config", "--global", "user.email", identity.email]
+    ["config", `--${scope}`, "user.name", identity.name],
+    ["config", `--${scope}`, "user.email", identity.email]
   ];
 }
 
@@ -676,18 +696,6 @@ function isGitHubUrl(url) {
   if (!url) return false;
   return GITHUB_HOST_RE.test(url);
 }
-function stripCredentialsFromUrl(url) {
-  try {
-    const parsed = new URL(url);
-    if (parsed.username || parsed.password) {
-      parsed.username = "";
-      parsed.password = "";
-      return parsed.toString();
-    }
-  } catch {
-  }
-  return url;
-}
 
 // ../shared/src/urls.ts
 function decodePathSegments(segments) {
@@ -699,21 +707,6 @@ function decodePathSegments(segments) {
     }
   });
 }
-function normalizeRepositoryUrl(url, options = {}) {
-  if (!url) return null;
-  const stripped = stripCredentialsFromUrl(url).trim().replace(/\/+$/, "").replace(/\.git$/, "");
-  if (!stripped) return null;
-  try {
-    const parsed = new URL(stripped);
-    parsed.hash = "";
-    parsed.search = "";
-    parsed.pathname = parsed.pathname.replace(/\/+$/, "").replace(/\.git$/, "");
-    const normalized = `${parsed.origin}${parsed.pathname}`;
-    return options.lowercase ? normalized.toLowerCase() : normalized;
-  } catch {
-    return options.lowercase ? stripped.toLowerCase() : stripped;
-  }
-}
 
 // ../shared/src/slash-commands.ts
 function normalizeSlashCommandName(name) {
@@ -4992,502 +4985,98 @@ function removeCredentialFileLines(filePath, shouldRemove) {
   });
 }
 
-// src/utils/git-identity.ts
-async function updateGitIdentity(identity, tag) {
-  try {
-    const [nameArgs, emailArgs] = gitIdentityConfigCommands(identity);
-    await execFileAsync("git", nameArgs);
-    await execFileAsync("git", emailArgs);
-    console.log(`[${tag}] Updated git identity to ${identity.name} <${identity.email}>`);
-  } catch (error) {
-    console.error(`[${tag}] Failed to update git identity:`, error);
-  }
+// src/git/service.ts
+import { readdir, readFile as readFile3, stat } from "fs/promises";
+import { spawn } from "child_process";
+import { join as join5 } from "path";
+
+// src/utils/state.ts
+import { readFile as readFile2, mkdir as mkdir2 } from "fs/promises";
+import { existsSync } from "fs";
+import { join as join3 } from "path";
+import { homedir as homedir3 } from "os";
+
+// src/utils/type-guards.ts
+function isRecord4(value) {
+  return typeof value === "object" && value !== null;
 }
 
-// src/managers/github-token-manager.ts
-var GitHubTokenManager = class extends BaseRefreshManager {
-  constructor() {
-    super("GitHubTokenManager");
-  }
-  async doRefresh(_config) {
-    console.log("[GitHubTokenManager] Refreshing GitHub token...");
-    const response = await monolithRequest("/v1/engine/github/refresh-token");
-    if (!response.ok) {
-      if (response.status === 403) {
-        await this.clearGitHubCredentials();
-      }
-      const errorText = await response.text();
-      throw new Error(`Token refresh failed: ${response.status} ${errorText}`);
-    }
-    const data = await response.json();
-    const ghToken = data.userToken?.token ?? data.token;
-    const ghUsername = data.userToken?.username ?? "x-access-token";
-    await this.updateGitCredentials(ghToken);
-    await this.updateGhHostsFile(ghToken, ghUsername);
-    if (data.gitIdentity) {
-      await updateGitIdentity(data.gitIdentity, "GitHubTokenManager");
-    }
-    if (data.userToken) {
-      console.log(`[GitHubTokenManager] Token refreshed with user token for PR attribution, user token expires at ${data.userToken.expiresAt}`);
-    } else {
-      console.log(`[GitHubTokenManager] Token refreshed successfully, expires at ${data.expiresAt}`);
-    }
-  }
-  async updateGitCredentials(token) {
-    const credentialsPath = path.join(ENGINE_ENV.HOME_DIR, ".git-credentials");
-    try {
-      await upsertCredentialFileLines(credentialsPath, ["github.com"], [
-        `https://x-access-token:${token}@github.com`
-      ]);
-      console.log(`[GitHubTokenManager] Updated ${credentialsPath}`);
-    } catch (error) {
-      console.error("[GitHubTokenManager] Failed to update git credentials:", error);
-    }
-  }
-  async updateGhHostsFile(token, username) {
-    const hostsPath = path.join(ENGINE_ENV.HOME_DIR, ".config", "gh", "hosts.yml");
-    const content = `github.com:
-    oauth_token: ${JSON.stringify(token)}
-    user: ${JSON.stringify(username)}
-    git_protocol: https
-`;
-    try {
-      await writeSecureCredentialFile(hostsPath, content, { ensureParentDir: true });
-      console.log(`[GitHubTokenManager] Updated ${hostsPath}`);
-    } catch (error) {
-      console.error("[GitHubTokenManager] Failed to update gh hosts file:", error);
-    }
-  }
-  async clearGitHubCredentials() {
-    const credentialsPath = path.join(ENGINE_ENV.HOME_DIR, ".git-credentials");
-    await removeCredentialFileLines(
-      credentialsPath,
-      (line) => line.endsWith("@github.com")
-    );
-  }
+// src/utils/state.ts
+var STATE_DIR = join3(homedir3(), ".replicas");
+var STATE_FILE = join3(STATE_DIR, "engine-state.json");
+var DEFAULT_STATE = {
+  repos: {}
 };
-var githubTokenManager = new GitHubTokenManager();
-
-// src/managers/gitlab-token-manager.ts
-import path2 from "path";
-var GitLabTokenManager = class extends BaseRefreshManager {
-  constructor() {
-    super("GitLabTokenManager");
+var stateWriteLock = new AsyncLock();
+async function updateEngineState(updater) {
+  await stateWriteLock.run(async () => {
+    await mkdir2(STATE_DIR, { recursive: true });
+    const currentState = await loadEngineState();
+    const nextState = updater(currentState);
+    await atomicWriteFile(STATE_FILE, JSON.stringify(nextState, null, 2));
+  });
+}
+function isEngineRepoDiff(value) {
+  return isRecord4(value) && typeof value.added === "number" && typeof value.removed === "number";
+}
+function coerceRepoState(value) {
+  if (!isRecord4(value)) {
+    return null;
   }
-  async doRefresh(_config) {
-    const response = await monolithRequest("/v1/engine/gitlab/refresh-token");
-    if (!response.ok) {
-      if (response.status === 403) {
-        await this.clearGitLabCredentials();
-      }
-      throw new Error(`Token refresh failed: ${response.status} ${await response.text()}`);
-    }
-    const data = await response.json();
-    if (!data.token) {
-      await this.clearGitLabCredentials(data.hosts);
-      console.log(`[GitLabTokenManager] No GitLab token to install: ${data.reason}`);
-      return;
-    }
-    const hosts = data.hosts.length > 0 ? data.hosts : ["gitlab.com"];
-    const credentialsPath = path2.join(ENGINE_ENV.HOME_DIR, ".git-credentials");
-    await upsertCredentialFileLines(
-      credentialsPath,
-      hosts,
-      hosts.map((host) => `https://oauth2:${data.token}@${host}`)
-    );
-    console.log(`[GitLabTokenManager] Updated ${credentialsPath} for ${hosts.join(", ")}`);
-    if (data.gitIdentity) {
-      await updateGitIdentity(data.gitIdentity, "GitLabTokenManager");
-    }
+  if (typeof value.name !== "string") return null;
+  if (typeof value.path !== "string") return null;
+  if (typeof value.defaultBranch !== "string") return null;
+  if (typeof value.currentBranch !== "string") return null;
+  if (!Array.isArray(value.prUrls)) return null;
+  const prUrls = [];
+  for (const entry of value.prUrls) {
+    if (typeof entry !== "string") return null;
+    if (!prUrls.includes(entry)) prUrls.push(entry);
   }
-  async clearGitLabCredentials(hosts = []) {
-    const credentialsPath = path2.join(ENGINE_ENV.HOME_DIR, ".git-credentials");
-    await removeCredentialFileLines(
-      credentialsPath,
-      (line) => line.startsWith("https://oauth2:") && (hosts.length === 0 || hosts.some((host) => line.endsWith(`@${host}`)))
-    );
+  if (!(value.gitDiff === null || isEngineRepoDiff(value.gitDiff))) return null;
+  if (typeof value.startHooksCompleted !== "boolean") return null;
+  return {
+    name: value.name,
+    path: value.path,
+    defaultBranch: value.defaultBranch,
+    currentBranch: value.currentBranch,
+    prUrls,
+    gitDiff: value.gitDiff,
+    startHooksCompleted: value.startHooksCompleted
+  };
+}
+function coerceEngineState(value) {
+  if (!isRecord4(value)) {
+    return {};
   }
-};
-var gitlabTokenManager = new GitLabTokenManager();
-
-// src/managers/claude-token-manager.ts
-import { promises as fs } from "fs";
-import path3 from "path";
-
-// src/managers/auth-env-transition.ts
-function applyAuthEnvTransition(params) {
-  const newOwned = new Set(params.authKeysByMethod[params.newMethod]);
-  const prevOwned = new Set(params.authKeysByMethod[params.prevMethod]);
-  for (const key of params.authKeys) {
-    const value = params.newEnvVars[key];
-    if (value !== void 0) {
-      for (const env of params.envs) {
-        env[key] = value;
-      }
-    } else if (prevOwned.has(key) && !newOwned.has(key)) {
-      for (const env of params.envs) {
-        delete env[key];
+  const partial = {};
+  if (isRecord4(value.repos)) {
+    const repos = {};
+    for (const [repoName, repoState] of Object.entries(value.repos)) {
+      const coerced = coerceRepoState(repoState);
+      if (coerced) {
+        repos[repoName] = coerced;
       }
     }
+    partial.repos = repos;
   }
+  return partial;
 }
-
-// src/managers/claude-token-manager.ts
-var ClaudeTokenManager = class extends BaseRefreshManager {
-  constructor() {
-    super("ClaudeTokenManager");
-  }
-  getSkipReason() {
-    const method = ENGINE_ENV.REPLICAS_CLAUDE_AUTH_METHOD;
-    if (method === "api_key" || method === "bedrock" || method === "foundry") {
-      return `auth method is ${method}`;
-    }
-    return null;
-  }
-  async doRefresh(_config) {
-    await this.refreshWithRequest();
-  }
-  async refreshWithRequest(request) {
-    console.log("[ClaudeTokenManager] Refreshing Claude credentials...");
-    const response = await monolithRequest("/v1/engine/claude/refresh-credentials", {
-      body: request
-    });
-    if (!response.ok) {
-      const errorText = await response.text();
-      throw new Error(`Credentials refresh failed: ${response.status} ${errorText}`);
+async function loadEngineState() {
+  try {
+    if (!existsSync(STATE_FILE)) {
+      return { ...DEFAULT_STATE };
     }
-    const data = await response.json();
-    await this.applyCredentialsResponse(data);
-    console.log(`[ClaudeTokenManager] Credentials refreshed (method=${data.type})`);
-  }
-  async fetchFreshCredentials(failureReason) {
-    const config = this.getRuntimeConfig();
-    if (!config) return false;
-    try {
-      console.log("[ClaudeTokenManager] Fetching fresh credentials from monolith after auth failure...");
-      const failedMethod = ENGINE_ENV.REPLICAS_CLAUDE_AUTH_METHOD;
-      await this.refreshWithRequest(failedMethod && failedMethod !== "none" ? {
-        failedMethod,
-        failureReason
-      } : void 0);
-      if (ENGINE_ENV.REPLICAS_CLAUDE_AUTH_METHOD === "oauth") {
-        this.start().catch((error) => {
-          console.error("[ClaudeTokenManager] Failed to restart OAuth refresh service after fallback:", error);
-        });
-      }
-      return true;
-    } catch (error) {
-      console.error("[ClaudeTokenManager] Failed to fetch fresh credentials:", error);
-      return false;
-    }
-  }
-  async applyCredentialsResponse(response) {
-    if (response.type === "oauth") {
-      await this.writeOauthCredentialsFile({
-        accessToken: response.accessToken,
-        refreshToken: response.refreshToken,
-        expiresAt: response.expiresAt,
-        scopes: response.scopes,
-        subscriptionType: response.subscriptionType
-      });
-    } else {
-      await this.removeOauthCredentialsFile();
-    }
-    const envVars = claudeAuthEnvFromResponse(response);
-    applyAuthEnvTransition({
-      prevMethod: ENGINE_ENV.REPLICAS_CLAUDE_AUTH_METHOD ?? "none",
-      newMethod: envVars.REPLICAS_CLAUDE_AUTH_METHOD ?? "none",
-      authKeys: CLAUDE_AUTH_ENV_KEYS,
-      authKeysByMethod: CLAUDE_AUTH_ENV_KEYS_BY_METHOD,
-      newEnvVars: envVars,
-      envs: [ENGINE_ENV, process.env]
-    });
-  }
-  async writeOauthCredentialsFile(credentials) {
-    const credentialsPath = path3.join(ENGINE_ENV.HOME_DIR, ".claude", ".credentials.json");
-    const claudeCliConfig = {
-      claudeAiOauth: {
-        accessToken: credentials.accessToken,
-        refreshToken: credentials.refreshToken,
-        expiresAt: new Date(credentials.expiresAt).getTime(),
-        scopes: credentials.scopes,
-        subscriptionType: credentials.subscriptionType
-      }
-    };
-    try {
-      await writeSecureCredentialFile(
-        credentialsPath,
-        JSON.stringify(claudeCliConfig, null, 2),
-        { ensureParentDir: true }
-      );
-      console.log(`[ClaudeTokenManager] Updated ${credentialsPath}`);
-    } catch (error) {
-      console.error("[ClaudeTokenManager] Failed to update credentials file:", error);
-    }
-  }
-  async removeOauthCredentialsFile() {
-    const credentialsPath = path3.join(ENGINE_ENV.HOME_DIR, ".claude", ".credentials.json");
-    try {
-      await fs.unlink(credentialsPath);
-    } catch {
-    }
-  }
-};
-var claudeTokenManager = new ClaudeTokenManager();
-
-// src/managers/codex-token-manager.ts
-import { promises as fs2 } from "fs";
-import path4 from "path";
-var CodexTokenManager = class extends BaseRefreshManager {
-  constructor() {
-    super("CodexTokenManager");
-  }
-  getSkipReason() {
-    if (ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "api_key" || ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "foundry") {
-      return `auth method is ${ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD}`;
-    }
-    if (!ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD && ENGINE_ENV.OPENAI_API_KEY) {
-      return "OPENAI_API_KEY is set";
-    }
-    return null;
-  }
-  async doRefresh(_config) {
-    await this.refreshWithRequest();
-  }
-  async refreshWithRequest(request) {
-    console.log("[CodexTokenManager] Refreshing Codex credentials...");
-    const response = await monolithRequest("/v1/engine/codex/refresh-credentials", {
-      body: request
-    });
-    if (!response.ok) {
-      const errorText = await response.text();
-      throw new Error(`Credentials refresh failed: ${response.status} ${errorText}`);
-    }
-    const data = await response.json();
-    await this.applyCredentialsResponse(data);
-    console.log(`[CodexTokenManager] Credentials refreshed (method=${data.type})`);
-  }
-  async fetchFreshCredentials(failureReason) {
-    const config = this.getRuntimeConfig();
-    if (!config) return false;
-    try {
-      console.log("[CodexTokenManager] Fetching fresh credentials from monolith after auth failure...");
-      const failedMethod = ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD;
-      await this.refreshWithRequest(failedMethod === "oauth" || failedMethod === "api_key" || failedMethod === "foundry" ? {
-        failedMethod,
-        failureReason
-      } : void 0);
-      if (ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "oauth") {
-        this.start().catch((error) => {
-          console.error("[CodexTokenManager] Failed to restart OAuth refresh service after fallback:", error);
-        });
-      }
-      return true;
-    } catch (error) {
-      console.error("[CodexTokenManager] Failed to fetch fresh credentials:", error);
-      return false;
-    }
-  }
-  async applyCredentialsResponse(response) {
-    if (response.type === "oauth") {
-      await this.writeOauthCredentialsFile(response);
-    } else {
-      await this.removeOauthCredentialsFile();
-    }
-    const envVars = codexAuthEnvFromResponse(response);
-    applyAuthEnvTransition({
-      prevMethod: ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD ?? "none",
-      newMethod: envVars.REPLICAS_CODEX_AUTH_METHOD ?? "none",
-      authKeys: CODEX_AUTH_ENV_KEYS,
-      authKeysByMethod: CODEX_AUTH_ENV_KEYS_BY_METHOD,
-      newEnvVars: envVars,
-      envs: [ENGINE_ENV, process.env]
-    });
-  }
-  async writeOauthCredentialsFile(credentials) {
-    const authPath = path4.join(ENGINE_ENV.HOME_DIR, ".codex", "auth.json");
-    const codexAuthConfig = {
-      OPENAI_API_KEY: null,
-      tokens: {
-        id_token: credentials.idToken,
-        access_token: credentials.accessToken,
-        refresh_token: credentials.refreshToken,
-        account_id: credentials.accountId
-      },
-      last_refresh: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    try {
-      await writeSecureCredentialFile(
-        authPath,
-        JSON.stringify(codexAuthConfig, null, 2),
-        { ensureParentDir: true }
-      );
-      console.log(`[CodexTokenManager] Updated ${authPath}`);
-    } catch (error) {
-      console.error("[CodexTokenManager] Failed to update credentials file:", error);
-    }
-  }
-  async removeOauthCredentialsFile() {
-    const authPath = path4.join(ENGINE_ENV.HOME_DIR, ".codex", "auth.json");
-    try {
-      await fs2.unlink(authPath);
-    } catch {
-    }
-  }
-};
-var codexTokenManager = new CodexTokenManager();
-
-// src/managers/infisical-token-manager.ts
-import { rm } from "fs/promises";
-import path5 from "path";
-var InfisicalTokenManager = class extends BaseRefreshManager {
-  constructor(request = monolithRequest, paths = {
-    homeDir: ENGINE_ENV.HOME_DIR,
-    workspaceRoot: ENGINE_ENV.WORKSPACE_ROOT
-  }, applyCredentials = applyInfisicalCredentials) {
-    super("InfisicalTokenManager", 5 * 60 * 1e3);
-    this.request = request;
-    this.paths = paths;
-    this.applyCredentials = applyCredentials;
-  }
-  request;
-  paths;
-  applyCredentials;
-  nextRefreshDelayMs = 5 * 60 * 1e3;
-  async doRefresh(_config) {
-    const response = await this.request("/v1/engine/infisical/refresh-token");
-    if (!response.ok) throw new Error(`Token refresh failed: ${response.status} ${await response.text()}`);
-    const data = await response.json();
-    await this.applyCredentials(data, this.paths);
-    const ttlMs = data.configured ? Date.parse(data.expiresAt) - Date.now() : Number.NaN;
-    this.nextRefreshDelayMs = Number.isFinite(ttlMs) ? Math.max(1e3, Math.min(5 * 60 * 1e3, Math.floor(ttlMs * 0.8))) : 5 * 60 * 1e3;
-  }
-  getNextRefreshDelayMs() {
-    return this.nextRefreshDelayMs;
-  }
-};
-async function applyInfisicalCredentials(data, paths) {
-  const credentialPath = path5.join(paths.homeDir, ".replicas", "infisical-env.sh");
-  const configPath = path5.join(paths.workspaceRoot, ".infisical.json");
-  if (!data.configured) {
-    delete process.env.INFISICAL_TOKEN;
-    delete process.env.INFISICAL_DOMAIN;
-    await Promise.all([rm(credentialPath, { force: true }), rm(configPath, { force: true })]);
-    return;
-  }
-  process.env.INFISICAL_TOKEN = data.token;
-  process.env.INFISICAL_DOMAIN = data.siteUrl;
-  await Promise.all([
-    writeSecureCredentialFile(credentialPath, [
-      `export INFISICAL_TOKEN=${shellQuotePosix(data.token)}`,
-      `export INFISICAL_DOMAIN=${shellQuotePosix(data.siteUrl)}`,
-      "export INFISICAL_DISABLE_UPDATE_CHECK=true",
-      ""
-    ].join("\n"), { ensureParentDir: true }),
-    writeSecureCredentialFile(configPath, `${JSON.stringify({
-      workspaceId: data.projectId,
-      defaultEnvironment: data.environment,
-      gitBranchToEnvironmentMapping: null,
-      domain: data.siteUrl
-    }, null, 2)}
-`, { ensureParentDir: true })
-  ]);
-}
-var infisicalTokenManager = new InfisicalTokenManager();
-
-// src/git/service.ts
-import { readdir, readFile as readFile3, stat } from "fs/promises";
-import { existsSync as existsSync2 } from "fs";
-import { spawn } from "child_process";
-import { join as join5 } from "path";
-
-// src/utils/state.ts
-import { readFile as readFile2, mkdir as mkdir2 } from "fs/promises";
-import { existsSync } from "fs";
-import { join as join3 } from "path";
-import { homedir as homedir3 } from "os";
-
-// src/utils/type-guards.ts
-function isRecord4(value) {
-  return typeof value === "object" && value !== null;
-}
-
-// src/utils/state.ts
-var STATE_DIR = join3(homedir3(), ".replicas");
-var STATE_FILE = join3(STATE_DIR, "engine-state.json");
-var DEFAULT_STATE = {
-  repos: {}
-};
-var stateWriteLock = new AsyncLock();
-async function updateEngineState(updater) {
-  await stateWriteLock.run(async () => {
-    await mkdir2(STATE_DIR, { recursive: true });
-    const currentState = await loadEngineState();
-    const nextState = updater(currentState);
-    await atomicWriteFile(STATE_FILE, JSON.stringify(nextState, null, 2));
-  });
-}
-function isEngineRepoDiff(value) {
-  return isRecord4(value) && typeof value.added === "number" && typeof value.removed === "number";
-}
-function coerceRepoState(value) {
-  if (!isRecord4(value)) {
-    return null;
-  }
-  if (typeof value.name !== "string") return null;
-  if (typeof value.path !== "string") return null;
-  if (typeof value.defaultBranch !== "string") return null;
-  if (typeof value.currentBranch !== "string") return null;
-  if (!Array.isArray(value.prUrls)) return null;
-  const prUrls = [];
-  for (const entry of value.prUrls) {
-    if (typeof entry !== "string") return null;
-    if (!prUrls.includes(entry)) prUrls.push(entry);
-  }
-  if (!(value.gitDiff === null || isEngineRepoDiff(value.gitDiff))) return null;
-  if (typeof value.startHooksCompleted !== "boolean") return null;
-  return {
-    name: value.name,
-    path: value.path,
-    defaultBranch: value.defaultBranch,
-    currentBranch: value.currentBranch,
-    prUrls,
-    gitDiff: value.gitDiff,
-    startHooksCompleted: value.startHooksCompleted
-  };
-}
-function coerceEngineState(value) {
-  if (!isRecord4(value)) {
-    return {};
-  }
-  const partial = {};
-  if (isRecord4(value.repos)) {
-    const repos = {};
-    for (const [repoName, repoState] of Object.entries(value.repos)) {
-      const coerced = coerceRepoState(repoState);
-      if (coerced) {
-        repos[repoName] = coerced;
-      }
-    }
-    partial.repos = repos;
-  }
-  return partial;
-}
-async function loadEngineState() {
-  try {
-    if (!existsSync(STATE_FILE)) {
-      return { ...DEFAULT_STATE };
-    }
-    const content = await readFile2(STATE_FILE, "utf-8");
-    const state = coerceEngineState(JSON.parse(content));
-    return {
-      ...DEFAULT_STATE,
-      ...state,
-      repos: state.repos ?? {}
-    };
-  } catch (error) {
-    console.error("[EngineState] Failed to load state, using defaults:", error);
-    return { ...DEFAULT_STATE };
+    const content = await readFile2(STATE_FILE, "utf-8");
+    const state = coerceEngineState(JSON.parse(content));
+    return {
+      ...DEFAULT_STATE,
+      ...state,
+      repos: state.repos ?? {}
+    };
+  } catch (error) {
+    console.error("[EngineState] Failed to load state, using defaults:", error);
+    return { ...DEFAULT_STATE };
   }
 }
 async function loadRepoState(repoName) {
@@ -5563,8 +5152,7 @@ function appendUniqueUrl(urls, url) {
 var GitService = class {
   defaultBranchCache = /* @__PURE__ */ new Map();
   cachedPrByRepo = /* @__PURE__ */ new Map();
-  // No invalidation on purpose — `git remote set-url` mid-session is rare and
-  // the worst case is PR/MR lookup stays skipped until the next engine restart.
+  // An 'unknown' result usually means the origin isn't wired up yet during provisioning, so caching it would permanently mask a remote added moments later.
   originInfoCache = /* @__PURE__ */ new Map();
   // Broadcaster + UI /repos requests fan in here every ~2s; one shared run.
   listReposInFlight = new InFlightMap();
@@ -5817,260 +5405,651 @@ var GitService = class {
       }
     });
   }
-  async getUntrackedAsDiff(repoPath) {
+  async getUntrackedAsDiff(repoPath) {
+    try {
+      return await this.getUntrackedDiff(repoPath);
+    } catch (error) {
+      console.error("Error building untracked diff:", error);
+      return "";
+    }
+  }
+  async getPullRequestUrl(repoName, repoPath, currentBranchArg, persistedRepoStateArg) {
+    try {
+      const currentBranch = currentBranchArg ?? await getCurrentBranch(repoPath);
+      if (!currentBranch) {
+        return { status: "not_found" };
+      }
+      const cachedPr = this.cachedPrByRepo.get(repoName);
+      if (cachedPr && cachedPr.currentBranch === currentBranch) {
+        return { status: "found", url: cachedPr.prUrl };
+      }
+      const persistedRepoState = persistedRepoStateArg ?? await loadRepoState(repoName);
+      this.cachedPrByRepo.delete(repoName);
+      const result = await this.lookupPrOnRemote(repoName, repoPath, currentBranch);
+      if (result.status === "found") {
+        this.cachedPrByRepo.set(repoName, { prUrl: result.url, currentBranch });
+        if (persistedRepoState && !persistedRepoState.prUrls.includes(result.url)) {
+          await saveRepoState(
+            repoName,
+            { prUrls: appendUniqueUrl(persistedRepoState.prUrls, result.url) },
+            persistedRepoState
+          );
+        }
+      }
+      return result;
+    } catch (error) {
+      console.error("Error checking for pull request:", error);
+      return { status: "error" };
+    }
+  }
+  async lookupPrOnRemote(repoName, repoPath, branch) {
+    const origin = await this.getOriginInfo(repoPath);
+    if (origin.provider === "unknown") {
+      return { status: "not_found" };
+    }
+    try {
+      const { stdout } = await execFileAsync("git", ["ls-remote", "--heads", "origin", branch], {
+        cwd: repoPath,
+        encoding: "utf-8",
+        maxBuffer: SUBPROCESS_MAX_BUFFER
+      });
+      if (!stdout.trim()) {
+        return { status: "not_found" };
+      }
+    } catch {
+      return { status: "error" };
+    }
+    if (origin.provider === "gitlab") {
+      return this.lookupGitLabMrOnRemote(repoName, origin.gitLab, branch);
+    }
+    try {
+      const { stdout } = await execFileAsync("gh", ["pr", "view", branch, "--json", "url", "--jq", ".url"], {
+        cwd: repoPath,
+        encoding: "utf-8",
+        maxBuffer: SUBPROCESS_MAX_BUFFER
+      });
+      const prInfo = stdout.trim();
+      return prInfo ? { status: "found", url: prInfo } : { status: "not_found" };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.warn(`[GitService] gh pr view ${branch} failed for ${repoName}: ${message}`);
+      return { status: "error" };
+    }
+  }
+  async lookupGitLabMrOnRemote(repoName, remote, branch) {
+    const token = await this.getGitLabAccessToken(remote.host);
+    if (!token) {
+      return { status: "not_found" };
+    }
+    const url = `${remote.instanceUrl}/api/v4/projects/${encodeURIComponent(remote.projectPath)}/merge_requests?source_branch=${encodeURIComponent(branch)}&order_by=updated_at`;
+    try {
+      const response = await fetch(url, {
+        headers: { Authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(1e4)
+      });
+      if (!response.ok) {
+        console.warn(`[GitService] GitLab MR lookup failed for ${repoName}: ${response.status}`);
+        return response.status === 404 ? { status: "not_found" } : { status: "error" };
+      }
+      const data = await response.json();
+      if (!Array.isArray(data)) return { status: "not_found" };
+      const branchMatches = data.filter((item) => isRecord4(item) && item.source_branch === branch);
+      const mergeRequest = branchMatches.find((item) => item.state === "opened") ?? branchMatches[0] ?? data[0];
+      if (!isRecord4(mergeRequest)) return { status: "not_found" };
+      const webUrl = mergeRequest.web_url;
+      if (typeof webUrl === "string" && webUrl.length > 0) return { status: "found", url: webUrl };
+      const iid = mergeRequest.iid;
+      return typeof iid === "number" ? { status: "found", url: `${remote.instanceUrl}/${remote.projectPath}/-/merge_requests/${iid}` } : { status: "not_found" };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.warn(`[GitService] GitLab MR lookup failed for ${repoName}: ${message}`);
+      return { status: "error" };
+    }
+  }
+  async resolveCodeHostProvider(repoPath) {
+    const origin = await this.getOriginInfo(repoPath);
+    return origin.provider === "unknown" ? void 0 : origin.provider;
+  }
+  async getRepositoryOriginHost(repoPath, refresh = false) {
+    if (refresh) this.originInfoCache.delete(repoPath);
+    const origin = await this.getOriginInfo(repoPath);
+    if (origin.provider === "github") return "github.com";
+    if (origin.provider === "gitlab") return origin.gitLab.host;
+    return null;
+  }
+  async getOriginInfo(repoPath) {
+    const cached = this.originInfoCache.get(repoPath);
+    if (cached !== void 0) {
+      return cached;
+    }
+    let info = { provider: "unknown" };
+    try {
+      const { stdout } = await execFileAsync("git", ["remote", "get-url", "origin"], {
+        cwd: repoPath,
+        encoding: "utf-8",
+        maxBuffer: SUBPROCESS_MAX_BUFFER
+      });
+      const originUrl = stdout.trim();
+      if (isGitHubUrl(originUrl)) {
+        info = { provider: "github" };
+      } else {
+        const gitLabRemote = this.parseGitLabRemote(originUrl);
+        if (gitLabRemote) info = { provider: "gitlab", gitLab: gitLabRemote };
+      }
+    } catch {
+      info = { provider: "unknown" };
+    }
+    if (info.provider !== "unknown") this.originInfoCache.set(repoPath, info);
+    return info;
+  }
+  parseGitLabRemote(remoteUrl) {
+    const parsed = parseGitRemote(remoteUrl);
+    if (!parsed) return null;
+    const projectPath = decodePathSegments(parsed.path.split("/").filter(Boolean)).join("/");
+    return {
+      host: parsed.host,
+      instanceUrl: `${parsed.protocol === "http" ? "http" : "https"}://${parsed.host}`,
+      projectPath
+    };
+  }
+  async getGitLabAccessToken(host) {
+    try {
+      const credentials = await readFile3(join5(ENGINE_ENV.HOME_DIR, ".git-credentials"), "utf-8");
+      for (const line of credentials.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed) continue;
+        try {
+          const parsed = new URL(trimmed);
+          if (parsed.protocol === "https:" && parsed.host.toLowerCase() === host && parsed.password) {
+            return decodeURIComponent(parsed.password);
+          }
+        } catch {
+        }
+      }
+    } catch {
+    }
+    return null;
+  }
+  async resolveDefaultBranch(repoPath) {
+    const cached = this.defaultBranchCache.get(repoPath);
+    if (cached) {
+      return cached;
+    }
+    const fromSymbolicRef = await this.resolveDefaultBranchFromSymbolicRef(repoPath);
+    if (fromSymbolicRef) {
+      this.defaultBranchCache.set(repoPath, fromSymbolicRef);
+      return fromSymbolicRef;
+    }
+    return "main";
+  }
+  async resolveDefaultBranchFromSymbolicRef(repoPath) {
+    try {
+      const output = await runGitCommand(["symbolic-ref", "--short", "refs/remotes/origin/HEAD"], repoPath);
+      const match = output.match(/^origin\/(.+)$/);
+      return match ? match[1] : null;
+    } catch {
+      return null;
+    }
+  }
+  async refreshRepoMetadata(repo, currentBranch, startHooksCompleted, persistedState, observedBranches, includeDiffs = false) {
+    const prResult = await this.getPullRequestUrl(repo.name, repo.path, currentBranch, persistedState);
+    let prUrls = persistedState?.prUrls ?? [];
+    if (prResult.status === "found") {
+      prUrls = appendUniqueUrl(prUrls, prResult.url);
+    }
+    if (observedBranches) {
+      for (const branch of observedBranches) {
+        if (branch === currentBranch) continue;
+        const branchResult = await this.lookupPrOnRemote(repo.name, repo.path, branch);
+        if (branchResult.status === "found") {
+          prUrls = appendUniqueUrl(prUrls, branchResult.url);
+        }
+      }
+    }
+    const gitDiff = await this.getGitDiffStats(repo.path, repo.defaultBranch);
+    const fullDiff = includeDiffs && gitDiff ? await this.getFullGitDiff(repo.path, repo.defaultBranch) : null;
+    const state = {
+      name: repo.name,
+      path: repo.path,
+      defaultBranch: repo.defaultBranch,
+      currentBranch,
+      prUrls,
+      gitDiff: includeDiffs && gitDiff ? { ...gitDiff, ...fullDiff === null ? {} : { fullDiff } } : gitDiff,
+      startHooksCompleted,
+      provider: await this.resolveCodeHostProvider(repo.path)
+    };
+    await saveRepoState(repo.name, state, state);
+    return state;
+  }
+  async safeStat(path6) {
+    try {
+      return await stat(path6);
+    } catch {
+      return null;
+    }
+  }
+};
+var gitService = new GitService();
+
+// src/utils/git-identity.ts
+async function updateGitIdentity(identity, tag, hosts) {
+  if (!hosts) {
+    try {
+      const [nameArgs, emailArgs] = gitIdentityConfigCommands(identity);
+      await execFileAsync("git", nameArgs);
+      await execFileAsync("git", emailArgs);
+      console.log(`[${tag}] Updated global git identity to ${identity.name} <${identity.email}>`);
+    } catch (error) {
+      console.error(`[${tag}] Failed to update global git identity:`, error);
+    }
+    return;
+  }
+  const normalizedHosts = hosts.map((host) => host.toLowerCase());
+  const repositories = await gitService.listRepositories();
+  await Promise.all(repositories.map(async (repository) => {
+    try {
+      const host = await gitService.getRepositoryOriginHost(repository.path, true);
+      if (!host || !normalizedHosts.includes(host)) return;
+      const [nameArgs, emailArgs] = gitIdentityConfigCommands(identity, "local");
+      await execFileAsync("git", nameArgs, { cwd: repository.path });
+      await execFileAsync("git", emailArgs, { cwd: repository.path });
+      console.log(`[${tag}] Updated git identity for ${repository.path} to ${identity.name} <${identity.email}>`);
+    } catch (error) {
+      console.error(`[${tag}] Failed to update git identity for ${repository.path}:`, error);
+    }
+  }));
+}
+
+// src/managers/github-token-manager.ts
+var GitHubTokenManager = class extends BaseRefreshManager {
+  constructor() {
+    super("GitHubTokenManager");
+  }
+  async doRefresh(_config) {
+    console.log("[GitHubTokenManager] Refreshing GitHub token...");
+    const response = await monolithRequest("/v1/engine/github/refresh-token");
+    if (!response.ok) {
+      if (response.status === 403) {
+        await this.clearGitHubCredentials();
+      }
+      const errorText = await response.text();
+      throw new Error(`Token refresh failed: ${response.status} ${errorText}`);
+    }
+    const data = await response.json();
+    const ghToken = data.userToken?.token ?? data.token;
+    const ghUsername = data.userToken?.username ?? "x-access-token";
+    await this.updateGitCredentials(ghToken);
+    await this.updateGhHostsFile(ghToken, ghUsername);
+    if (data.gitIdentity) {
+      await updateGitIdentity(data.gitIdentity, "GitHubTokenManager", ["github.com"]);
+    }
+    if (data.userToken) {
+      console.log(`[GitHubTokenManager] Token refreshed with user token for PR attribution, user token expires at ${data.userToken.expiresAt}`);
+    } else {
+      console.log(`[GitHubTokenManager] Token refreshed successfully, expires at ${data.expiresAt}`);
+    }
+  }
+  async updateGitCredentials(token) {
+    const credentialsPath = path.join(ENGINE_ENV.HOME_DIR, ".git-credentials");
     try {
-      return await this.getUntrackedDiff(repoPath);
+      await upsertCredentialFileLines(credentialsPath, ["github.com"], [
+        `https://x-access-token:${token}@github.com`
+      ]);
+      console.log(`[GitHubTokenManager] Updated ${credentialsPath}`);
     } catch (error) {
-      console.error("Error building untracked diff:", error);
-      return "";
+      console.error("[GitHubTokenManager] Failed to update git credentials:", error);
     }
   }
-  async getPullRequestUrl(repoName, repoPath, currentBranchArg, persistedRepoStateArg) {
+  async updateGhHostsFile(token, username) {
+    const hostsPath = path.join(ENGINE_ENV.HOME_DIR, ".config", "gh", "hosts.yml");
+    const content = `github.com:
+    oauth_token: ${JSON.stringify(token)}
+    user: ${JSON.stringify(username)}
+    git_protocol: https
+`;
     try {
-      const currentBranch = currentBranchArg ?? await getCurrentBranch(repoPath);
-      if (!currentBranch) {
-        return { status: "not_found" };
-      }
-      const cachedPr = this.cachedPrByRepo.get(repoName);
-      if (cachedPr && cachedPr.currentBranch === currentBranch) {
-        return { status: "found", url: cachedPr.prUrl };
-      }
-      const persistedRepoState = persistedRepoStateArg ?? await loadRepoState(repoName);
-      this.cachedPrByRepo.delete(repoName);
-      const result = await this.lookupPrOnRemote(repoName, repoPath, currentBranch);
-      if (result.status === "found") {
-        this.cachedPrByRepo.set(repoName, { prUrl: result.url, currentBranch });
-        if (persistedRepoState && !persistedRepoState.prUrls.includes(result.url)) {
-          await saveRepoState(
-            repoName,
-            { prUrls: appendUniqueUrl(persistedRepoState.prUrls, result.url) },
-            persistedRepoState
-          );
-        }
-      }
-      return result;
+      await writeSecureCredentialFile(hostsPath, content, { ensureParentDir: true });
+      console.log(`[GitHubTokenManager] Updated ${hostsPath}`);
     } catch (error) {
-      console.error("Error checking for pull request:", error);
-      return { status: "error" };
+      console.error("[GitHubTokenManager] Failed to update gh hosts file:", error);
     }
   }
-  async lookupPrOnRemote(repoName, repoPath, branch) {
-    const origin = await this.getOriginInfo(repoPath);
-    if (origin.provider === "unknown") {
-      return { status: "not_found" };
-    }
-    try {
-      const { stdout } = await execFileAsync("git", ["ls-remote", "--heads", "origin", branch], {
-        cwd: repoPath,
-        encoding: "utf-8",
-        maxBuffer: SUBPROCESS_MAX_BUFFER
-      });
-      if (!stdout.trim()) {
-        return { status: "not_found" };
+  async clearGitHubCredentials() {
+    const credentialsPath = path.join(ENGINE_ENV.HOME_DIR, ".git-credentials");
+    await removeCredentialFileLines(
+      credentialsPath,
+      (line) => line.endsWith("@github.com")
+    );
+  }
+};
+var githubTokenManager = new GitHubTokenManager();
+
+// src/managers/gitlab-token-manager.ts
+import path2 from "path";
+var GitLabTokenManager = class extends BaseRefreshManager {
+  constructor() {
+    super("GitLabTokenManager");
+  }
+  async doRefresh(_config) {
+    const response = await monolithRequest("/v1/engine/gitlab/refresh-token");
+    if (!response.ok) {
+      if (response.status === 403) {
+        await this.clearGitLabCredentials();
       }
-    } catch {
-      return { status: "error" };
+      throw new Error(`Token refresh failed: ${response.status} ${await response.text()}`);
     }
-    if (origin.provider === "gitlab") {
-      return this.lookupGitLabMrOnRemote(repoName, origin.gitLab, branch);
+    const data = await response.json();
+    if (!data.token) {
+      await this.clearGitLabCredentials(data.hosts);
+      console.log(`[GitLabTokenManager] No GitLab token to install: ${data.reason}`);
+      return;
     }
-    try {
-      const { stdout } = await execFileAsync("gh", ["pr", "view", branch, "--json", "url", "--jq", ".url"], {
-        cwd: repoPath,
-        encoding: "utf-8",
-        maxBuffer: SUBPROCESS_MAX_BUFFER
-      });
-      const prInfo = stdout.trim();
-      return prInfo ? { status: "found", url: prInfo } : { status: "not_found" };
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      console.warn(`[GitService] gh pr view ${branch} failed for ${repoName}: ${message}`);
-      return { status: "error" };
+    const hosts = data.hosts.length > 0 ? data.hosts : ["gitlab.com"];
+    const credentialsPath = path2.join(ENGINE_ENV.HOME_DIR, ".git-credentials");
+    await upsertCredentialFileLines(
+      credentialsPath,
+      hosts,
+      hosts.map((host) => `https://oauth2:${data.token}@${host}`)
+    );
+    console.log(`[GitLabTokenManager] Updated ${credentialsPath} for ${hosts.join(", ")}`);
+    if (data.gitIdentity) {
+      await updateGitIdentity(data.gitIdentity, "GitLabTokenManager", hosts);
     }
   }
-  async lookupGitLabMrOnRemote(repoName, remote, branch) {
-    const token = await this.getGitLabAccessToken(remote.host);
-    if (!token) {
-      return { status: "not_found" };
-    }
-    const url = `${remote.instanceUrl}/api/v4/projects/${encodeURIComponent(remote.projectPath)}/merge_requests?source_branch=${encodeURIComponent(branch)}&order_by=updated_at`;
-    try {
-      const response = await fetch(url, {
-        headers: { Authorization: `Bearer ${token}` },
-        signal: AbortSignal.timeout(1e4)
-      });
-      if (!response.ok) {
-        console.warn(`[GitService] GitLab MR lookup failed for ${repoName}: ${response.status}`);
-        return response.status === 404 ? { status: "not_found" } : { status: "error" };
+  async clearGitLabCredentials(hosts = []) {
+    const credentialsPath = path2.join(ENGINE_ENV.HOME_DIR, ".git-credentials");
+    await removeCredentialFileLines(
+      credentialsPath,
+      (line) => line.startsWith("https://oauth2:") && (hosts.length === 0 || hosts.some((host) => line.endsWith(`@${host}`)))
+    );
+  }
+};
+var gitlabTokenManager = new GitLabTokenManager();
+
+// src/managers/claude-token-manager.ts
+import { promises as fs } from "fs";
+import path3 from "path";
+
+// src/managers/auth-env-transition.ts
+function applyAuthEnvTransition(params) {
+  const newOwned = new Set(params.authKeysByMethod[params.newMethod]);
+  const prevOwned = new Set(params.authKeysByMethod[params.prevMethod]);
+  for (const key of params.authKeys) {
+    const value = params.newEnvVars[key];
+    if (value !== void 0) {
+      for (const env of params.envs) {
+        env[key] = value;
+      }
+    } else if (prevOwned.has(key) && !newOwned.has(key)) {
+      for (const env of params.envs) {
+        delete env[key];
       }
-      const data = await response.json();
-      if (!Array.isArray(data)) return { status: "not_found" };
-      const branchMatches = data.filter((item) => isRecord4(item) && item.source_branch === branch);
-      const mergeRequest = branchMatches.find((item) => item.state === "opened") ?? branchMatches[0] ?? data[0];
-      if (!isRecord4(mergeRequest)) return { status: "not_found" };
-      const webUrl = mergeRequest.web_url;
-      if (typeof webUrl === "string" && webUrl.length > 0) return { status: "found", url: webUrl };
-      const iid = mergeRequest.iid;
-      return typeof iid === "number" ? { status: "found", url: `${remote.instanceUrl}/${remote.projectPath}/-/merge_requests/${iid}` } : { status: "not_found" };
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      console.warn(`[GitService] GitLab MR lookup failed for ${repoName}: ${message}`);
-      return { status: "error" };
     }
   }
-  async resolveCodeHostProvider(repoPath) {
-    const origin = await this.getOriginInfo(repoPath);
-    return origin.provider === "unknown" ? void 0 : origin.provider;
+}
+
+// src/managers/claude-token-manager.ts
+var ClaudeTokenManager = class extends BaseRefreshManager {
+  constructor() {
+    super("ClaudeTokenManager");
   }
-  async getOriginInfo(repoPath) {
-    const cached = this.originInfoCache.get(repoPath);
-    if (cached !== void 0) {
-      return cached;
+  getSkipReason() {
+    const method = ENGINE_ENV.REPLICAS_CLAUDE_AUTH_METHOD;
+    if (method === "api_key" || method === "bedrock" || method === "foundry") {
+      return `auth method is ${method}`;
     }
-    let info = { provider: "unknown" };
+    return null;
+  }
+  async doRefresh(_config) {
+    await this.refreshWithRequest();
+  }
+  async refreshWithRequest(request) {
+    console.log("[ClaudeTokenManager] Refreshing Claude credentials...");
+    const response = await monolithRequest("/v1/engine/claude/refresh-credentials", {
+      body: request
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new Error(`Credentials refresh failed: ${response.status} ${errorText}`);
+    }
+    const data = await response.json();
+    await this.applyCredentialsResponse(data);
+    console.log(`[ClaudeTokenManager] Credentials refreshed (method=${data.type})`);
+  }
+  async fetchFreshCredentials(failureReason) {
+    const config = this.getRuntimeConfig();
+    if (!config) return false;
     try {
-      const { stdout } = await execFileAsync("git", ["remote", "get-url", "origin"], {
-        cwd: repoPath,
-        encoding: "utf-8",
-        maxBuffer: SUBPROCESS_MAX_BUFFER
+      console.log("[ClaudeTokenManager] Fetching fresh credentials from monolith after auth failure...");
+      const failedMethod = ENGINE_ENV.REPLICAS_CLAUDE_AUTH_METHOD;
+      await this.refreshWithRequest(failedMethod && failedMethod !== "none" ? {
+        failedMethod,
+        failureReason
+      } : void 0);
+      if (ENGINE_ENV.REPLICAS_CLAUDE_AUTH_METHOD === "oauth") {
+        this.start().catch((error) => {
+          console.error("[ClaudeTokenManager] Failed to restart OAuth refresh service after fallback:", error);
+        });
+      }
+      return true;
+    } catch (error) {
+      console.error("[ClaudeTokenManager] Failed to fetch fresh credentials:", error);
+      return false;
+    }
+  }
+  async applyCredentialsResponse(response) {
+    if (response.type === "oauth") {
+      await this.writeOauthCredentialsFile({
+        accessToken: response.accessToken,
+        refreshToken: response.refreshToken,
+        expiresAt: response.expiresAt,
+        scopes: response.scopes,
+        subscriptionType: response.subscriptionType
       });
-      const originUrl = stdout.trim();
-      if (isGitHubUrl(originUrl)) {
-        info = { provider: "github" };
-      } else {
-        const gitLabRemote = this.parseGitLabRemote(originUrl);
-        if (gitLabRemote) info = { provider: "gitlab", gitLab: gitLabRemote };
+    } else {
+      await this.removeOauthCredentialsFile();
+    }
+    const envVars = claudeAuthEnvFromResponse(response);
+    applyAuthEnvTransition({
+      prevMethod: ENGINE_ENV.REPLICAS_CLAUDE_AUTH_METHOD ?? "none",
+      newMethod: envVars.REPLICAS_CLAUDE_AUTH_METHOD ?? "none",
+      authKeys: CLAUDE_AUTH_ENV_KEYS,
+      authKeysByMethod: CLAUDE_AUTH_ENV_KEYS_BY_METHOD,
+      newEnvVars: envVars,
+      envs: [ENGINE_ENV, process.env]
+    });
+  }
+  async writeOauthCredentialsFile(credentials) {
+    const credentialsPath = path3.join(ENGINE_ENV.HOME_DIR, ".claude", ".credentials.json");
+    const claudeCliConfig = {
+      claudeAiOauth: {
+        accessToken: credentials.accessToken,
+        refreshToken: credentials.refreshToken,
+        expiresAt: new Date(credentials.expiresAt).getTime(),
+        scopes: credentials.scopes,
+        subscriptionType: credentials.subscriptionType
       }
-    } catch {
-      info = { provider: "unknown" };
+    };
+    try {
+      await writeSecureCredentialFile(
+        credentialsPath,
+        JSON.stringify(claudeCliConfig, null, 2),
+        { ensureParentDir: true }
+      );
+      console.log(`[ClaudeTokenManager] Updated ${credentialsPath}`);
+    } catch (error) {
+      console.error("[ClaudeTokenManager] Failed to update credentials file:", error);
     }
-    this.originInfoCache.set(repoPath, info);
-    return info;
   }
-  parseGitLabRemote(remoteUrl) {
-    const sshUrl = remoteUrl.trim().replace(/\/+$/, "").replace(/\.git$/, "");
+  async removeOauthCredentialsFile() {
+    const credentialsPath = path3.join(ENGINE_ENV.HOME_DIR, ".claude", ".credentials.json");
     try {
-      const parsed = new URL(sshUrl);
-      if (parsed.protocol === "ssh:") {
-        const projectPath = decodePathSegments(parsed.pathname.split("/").filter(Boolean)).join("/");
-        if (!parsed.hostname || !projectPath) return null;
-        const host = parsed.hostname.toLowerCase();
-        return {
-          host,
-          instanceUrl: `https://${host}`,
-          projectPath
-        };
-      }
+      await fs.unlink(credentialsPath);
     } catch {
     }
-    const scpLike = sshUrl.match(/^git@([^:/]+):(?:(?:\d+)\/)?(.+)$/);
-    if (scpLike) {
-      const [, host, projectPath] = scpLike;
-      if (!host || !projectPath) return null;
-      const decodedProjectPath = decodePathSegments(projectPath.split("/").filter(Boolean)).join("/");
-      return {
-        host: host.toLowerCase(),
-        instanceUrl: `https://${host}`,
-        projectPath: decodedProjectPath
-      };
+  }
+};
+var claudeTokenManager = new ClaudeTokenManager();
+
+// src/managers/codex-token-manager.ts
+import { promises as fs2 } from "fs";
+import path4 from "path";
+var CodexTokenManager = class extends BaseRefreshManager {
+  constructor() {
+    super("CodexTokenManager");
+  }
+  getSkipReason() {
+    if (ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "api_key" || ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "foundry") {
+      return `auth method is ${ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD}`;
     }
-    const normalized = normalizeRepositoryUrl(remoteUrl);
-    if (!normalized) return null;
-    try {
-      const parsed = new URL(normalized);
-      if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
-      const projectPath = decodePathSegments(parsed.pathname.split("/").filter(Boolean)).join("/");
-      if (!projectPath) return null;
-      return {
-        host: parsed.host.toLowerCase(),
-        instanceUrl: parsed.origin,
-        projectPath
-      };
-    } catch {
+    if (!ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD && ENGINE_ENV.OPENAI_API_KEY) {
+      return "OPENAI_API_KEY is set";
     }
     return null;
   }
-  async getGitLabAccessToken(host) {
+  async doRefresh(_config) {
+    await this.refreshWithRequest();
+  }
+  async refreshWithRequest(request) {
+    console.log("[CodexTokenManager] Refreshing Codex credentials...");
+    const response = await monolithRequest("/v1/engine/codex/refresh-credentials", {
+      body: request
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new Error(`Credentials refresh failed: ${response.status} ${errorText}`);
+    }
+    const data = await response.json();
+    await this.applyCredentialsResponse(data);
+    console.log(`[CodexTokenManager] Credentials refreshed (method=${data.type})`);
+  }
+  async fetchFreshCredentials(failureReason) {
+    const config = this.getRuntimeConfig();
+    if (!config) return false;
     try {
-      const credentials = await readFile3(join5(ENGINE_ENV.HOME_DIR, ".git-credentials"), "utf-8");
-      for (const line of credentials.split("\n")) {
-        const trimmed = line.trim();
-        if (!trimmed) continue;
-        try {
-          const parsed = new URL(trimmed);
-          if (parsed.protocol === "https:" && parsed.host.toLowerCase() === host && parsed.password) {
-            return decodeURIComponent(parsed.password);
-          }
-        } catch {
-        }
+      console.log("[CodexTokenManager] Fetching fresh credentials from monolith after auth failure...");
+      const failedMethod = ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD;
+      await this.refreshWithRequest(failedMethod === "oauth" || failedMethod === "api_key" || failedMethod === "foundry" ? {
+        failedMethod,
+        failureReason
+      } : void 0);
+      if (ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "oauth") {
+        this.start().catch((error) => {
+          console.error("[CodexTokenManager] Failed to restart OAuth refresh service after fallback:", error);
+        });
       }
-    } catch {
+      return true;
+    } catch (error) {
+      console.error("[CodexTokenManager] Failed to fetch fresh credentials:", error);
+      return false;
     }
-    return null;
   }
-  async resolveDefaultBranch(repoPath) {
-    const cached = this.defaultBranchCache.get(repoPath);
-    if (cached) {
-      return cached;
+  async applyCredentialsResponse(response) {
+    if (response.type === "oauth") {
+      await this.writeOauthCredentialsFile(response);
+    } else {
+      await this.removeOauthCredentialsFile();
     }
-    const fromSymbolicRef = await this.resolveDefaultBranchFromSymbolicRef(repoPath);
-    if (fromSymbolicRef) {
-      this.defaultBranchCache.set(repoPath, fromSymbolicRef);
-      return fromSymbolicRef;
+    const envVars = codexAuthEnvFromResponse(response);
+    applyAuthEnvTransition({
+      prevMethod: ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD ?? "none",
+      newMethod: envVars.REPLICAS_CODEX_AUTH_METHOD ?? "none",
+      authKeys: CODEX_AUTH_ENV_KEYS,
+      authKeysByMethod: CODEX_AUTH_ENV_KEYS_BY_METHOD,
+      newEnvVars: envVars,
+      envs: [ENGINE_ENV, process.env]
+    });
+  }
+  async writeOauthCredentialsFile(credentials) {
+    const authPath = path4.join(ENGINE_ENV.HOME_DIR, ".codex", "auth.json");
+    const codexAuthConfig = {
+      OPENAI_API_KEY: null,
+      tokens: {
+        id_token: credentials.idToken,
+        access_token: credentials.accessToken,
+        refresh_token: credentials.refreshToken,
+        account_id: credentials.accountId
+      },
+      last_refresh: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    try {
+      await writeSecureCredentialFile(
+        authPath,
+        JSON.stringify(codexAuthConfig, null, 2),
+        { ensureParentDir: true }
+      );
+      console.log(`[CodexTokenManager] Updated ${authPath}`);
+    } catch (error) {
+      console.error("[CodexTokenManager] Failed to update credentials file:", error);
     }
-    return "main";
   }
-  async resolveDefaultBranchFromSymbolicRef(repoPath) {
+  async removeOauthCredentialsFile() {
+    const authPath = path4.join(ENGINE_ENV.HOME_DIR, ".codex", "auth.json");
     try {
-      const output = await runGitCommand(["symbolic-ref", "--short", "refs/remotes/origin/HEAD"], repoPath);
-      const match = output.match(/^origin\/(.+)$/);
-      return match ? match[1] : null;
+      await fs2.unlink(authPath);
     } catch {
-      return null;
     }
   }
-  async refreshRepoMetadata(repo, currentBranch, startHooksCompleted, persistedState, observedBranches, includeDiffs = false) {
-    const prResult = await this.getPullRequestUrl(repo.name, repo.path, currentBranch, persistedState);
-    let prUrls = persistedState?.prUrls ?? [];
-    if (prResult.status === "found") {
-      prUrls = appendUniqueUrl(prUrls, prResult.url);
-    }
-    if (observedBranches) {
-      for (const branch of observedBranches) {
-        if (branch === currentBranch) continue;
-        const branchResult = await this.lookupPrOnRemote(repo.name, repo.path, branch);
-        if (branchResult.status === "found") {
-          prUrls = appendUniqueUrl(prUrls, branchResult.url);
-        }
-      }
-    }
-    const gitDiff = await this.getGitDiffStats(repo.path, repo.defaultBranch);
-    const fullDiff = includeDiffs && gitDiff ? await this.getFullGitDiff(repo.path, repo.defaultBranch) : null;
-    const state = {
-      name: repo.name,
-      path: repo.path,
-      defaultBranch: repo.defaultBranch,
-      currentBranch,
-      prUrls,
-      gitDiff: includeDiffs && gitDiff ? { ...gitDiff, ...fullDiff === null ? {} : { fullDiff } } : gitDiff,
-      startHooksCompleted,
-      provider: await this.resolveCodeHostProvider(repo.path)
-    };
-    await saveRepoState(repo.name, state, state);
-    return state;
+};
+var codexTokenManager = new CodexTokenManager();
+
+// src/managers/infisical-token-manager.ts
+import { rm } from "fs/promises";
+import path5 from "path";
+var InfisicalTokenManager = class extends BaseRefreshManager {
+  constructor(request = monolithRequest, paths = {
+    homeDir: ENGINE_ENV.HOME_DIR,
+    workspaceRoot: ENGINE_ENV.WORKSPACE_ROOT
+  }, applyCredentials = applyInfisicalCredentials) {
+    super("InfisicalTokenManager", 5 * 60 * 1e3);
+    this.request = request;
+    this.paths = paths;
+    this.applyCredentials = applyCredentials;
   }
-  pathExists(path6) {
-    return existsSync2(path6);
+  request;
+  paths;
+  applyCredentials;
+  nextRefreshDelayMs = 5 * 60 * 1e3;
+  async doRefresh(_config) {
+    const response = await this.request("/v1/engine/infisical/refresh-token");
+    if (!response.ok) throw new Error(`Token refresh failed: ${response.status} ${await response.text()}`);
+    const data = await response.json();
+    await this.applyCredentials(data, this.paths);
+    const ttlMs = data.configured ? Date.parse(data.expiresAt) - Date.now() : Number.NaN;
+    this.nextRefreshDelayMs = Number.isFinite(ttlMs) ? Math.max(1e3, Math.min(5 * 60 * 1e3, Math.floor(ttlMs * 0.8))) : 5 * 60 * 1e3;
   }
-  async safeStat(path6) {
-    try {
-      return await stat(path6);
-    } catch {
-      return null;
-    }
+  getNextRefreshDelayMs() {
+    return this.nextRefreshDelayMs;
   }
 };
-var gitService = new GitService();
+async function applyInfisicalCredentials(data, paths) {
+  const credentialPath = path5.join(paths.homeDir, ".replicas", "infisical-env.sh");
+  const configPath = path5.join(paths.workspaceRoot, ".infisical.json");
+  if (!data.configured) {
+    delete process.env.INFISICAL_TOKEN;
+    delete process.env.INFISICAL_DOMAIN;
+    await Promise.all([rm(credentialPath, { force: true }), rm(configPath, { force: true })]);
+    return;
+  }
+  process.env.INFISICAL_TOKEN = data.token;
+  process.env.INFISICAL_DOMAIN = data.siteUrl;
+  await Promise.all([
+    writeSecureCredentialFile(credentialPath, [
+      `export INFISICAL_TOKEN=${shellQuotePosix(data.token)}`,
+      `export INFISICAL_DOMAIN=${shellQuotePosix(data.siteUrl)}`,
+      "export INFISICAL_DISABLE_UPDATE_CHECK=true",
+      ""
+    ].join("\n"), { ensureParentDir: true }),
+    writeSecureCredentialFile(configPath, `${JSON.stringify({
+      workspaceId: data.projectId,
+      defaultEnvironment: data.environment,
+      gitBranchToEnvironmentMapping: null,
+      domain: data.siteUrl
+    }, null, 2)}
+`, { ensureParentDir: true })
+  ]);
+}
+var infisicalTokenManager = new InfisicalTokenManager();
 
 // src/utils/logger.ts
 import { mkdir as mkdir3, writeFile as writeFile2 } from "fs/promises";
@@ -6195,14 +6174,14 @@ var engineLogger = new EngineLogger();
 
 // src/services/replicas-config-service.ts
 import { readFile as readFile6, appendFile, writeFile as writeFile4, mkdir as mkdir6 } from "fs/promises";
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync3 } from "fs";
 import { join as join9 } from "path";
 import { homedir as homedir7 } from "os";
 import { spawn as spawn2 } from "child_process";
 
 // src/services/environment-details-service.ts
 import { mkdir as mkdir4, readFile as readFile4 } from "fs/promises";
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync2 } from "fs";
 import { homedir as homedir5 } from "os";
 import { join as join7 } from "path";
 var REPLICAS_DIR = join7(homedir5(), ".replicas");
@@ -6213,7 +6192,7 @@ var OPENCODE_AUTH_PATH = join7(homedir5(), ".local", "share", "opencode", "auth.
 var GH_HOSTS_PATH = join7(homedir5(), ".config", "gh", "hosts.yml");
 var GIT_CREDENTIALS_PATH = join7(homedir5(), ".git-credentials");
 function detectClaudeAuthMethod() {
-  if (existsSync3(CLAUDE_CREDENTIALS_PATH)) {
+  if (existsSync2(CLAUDE_CREDENTIALS_PATH)) {
     return "oauth";
   }
   if (ENGINE_ENV.REPLICAS_CLAUDE_AUTH_METHOD === "foundry") {
@@ -6228,7 +6207,7 @@ function detectClaudeAuthMethod() {
   return "none";
 }
 function detectCodexAuthMethod() {
-  if (existsSync3(CODEX_AUTH_PATH)) {
+  if (existsSync2(CODEX_AUTH_PATH)) {
     return "oauth";
   }
   if (ENGINE_ENV.OPENAI_API_KEY) {
@@ -6241,7 +6220,7 @@ function detectCursorAuthMethod() {
   return ENGINE_ENV.CURSOR_API_KEY ? "api_key" : "none";
 }
 function detectOpencodeAuthMethod() {
-  return existsSync3(OPENCODE_AUTH_PATH) || ENGINE_ENV.OPENROUTER_API_KEY ? "api_key" : "none";
+  return existsSync2(OPENCODE_AUTH_PATH) || ENGINE_ENV.OPENROUTER_API_KEY ? "api_key" : "none";
 }
 function detectPiAuthMethod() {
   return ENGINE_ENV.OPENROUTER_API_KEY ? "api_key" : "none";
@@ -6309,7 +6288,7 @@ function createDefaultDetails() {
 }
 async function readDetails() {
   try {
-    if (!existsSync3(DETAILS_FILE)) {
+    if (!existsSync2(DETAILS_FILE)) {
       return createDefaultDetails();
     }
     const raw = await readFile4(DETAILS_FILE, "utf-8");
@@ -6341,7 +6320,7 @@ var EnvironmentDetailsService = class {
     details.opencodeAuthMethod = detectOpencodeAuthMethod();
     details.piAuthMethod = detectPiAuthMethod();
     details.gitIdentityConfigured = gitIdentityConfigured;
-    const ghConfigured = existsSync3(GH_HOSTS_PATH);
+    const ghConfigured = existsSync2(GH_HOSTS_PATH);
     details.githubAccessConfigured = ghConfigured;
     details.githubCredentialsConfigured = ghConfigured;
     details.gitlabAccessConfigured = gitlabAccessConfigured;
@@ -6540,7 +6519,7 @@ If your task depends on setup being complete, check the log file before proceedi
 async function readReplicasConfigFromDir(dirPath) {
   for (const filename of REPLICAS_CONFIG_FILENAMES) {
     const configPath = join9(dirPath, filename);
-    if (!existsSync4(configPath)) {
+    if (!existsSync3(configPath)) {
       continue;
     }
     const data = await readFile6(configPath, "utf-8");
@@ -6975,14 +6954,14 @@ var eventService = new EventService();
 
 // src/services/preview-service.ts
 import { mkdir as mkdir8, readFile as readFile7 } from "fs/promises";
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { randomUUID as randomUUID2 } from "crypto";
 import { homedir as homedir9 } from "os";
 import { dirname as dirname2, join as join11 } from "path";
 var PREVIEW_PORTS_FILE = join11(homedir9(), ".replicas", "preview-ports.json");
 async function readPreviewsFile() {
   try {
-    if (!existsSync5(PREVIEW_PORTS_FILE)) {
+    if (!existsSync4(PREVIEW_PORTS_FILE)) {
       return { previews: [] };
     }
     const raw = await readFile7(PREVIEW_PORTS_FILE, "utf-8");
@@ -7089,7 +7068,7 @@ async function registerDesktopPreview() {
 }
 
 // src/services/chat/chat-service.ts
-import { existsSync as existsSync8 } from "fs";
+import { existsSync as existsSync7 } from "fs";
 import { appendFile as appendFile3, copyFile, mkdir as mkdir14, readFile as readFile14, rename as rename2, rm as rm2 } from "fs/promises";
 import { homedir as homedir15 } from "os";
 import { join as join22 } from "path";
@@ -9811,7 +9790,7 @@ var DEFAULT_CODEX_ARGS = ["app-server", "--listen", "stdio://"];
 var MIN_CODEX_CLI_VERSION = "0.144.6";
 var CODEX_UPGRADE_TIMEOUT_MS = 12e4;
 var codexCliVersionEnsured = null;
-var ENGINE_PACKAGE_VERSION = "0.1.477";
+var ENGINE_PACKAGE_VERSION = "0.1.478";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";
@@ -10096,7 +10075,7 @@ var CodexQuotaStatusTracker = class {
 };
 
 // src/managers/codex-asp/mappers.ts
-import { existsSync as existsSync6, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
 var localImageCache = /* @__PURE__ */ new Map();
 var DEFAULT_MODEL = DEFAULT_CODEX_MODEL;
 var THREAD_START_METHOD = "thread/start";
@@ -10193,7 +10172,7 @@ function transcriptItemsForTurn(turn) {
 function userImageForLocalPath(path6) {
   const cached = localImageCache.get(path6);
   if (cached) return cached;
-  if (!existsSync6(path6)) return null;
+  if (!existsSync5(path6)) return null;
   const image = {
     type: "image",
     mediaType: inferMediaType(path6),
@@ -12344,7 +12323,7 @@ ${request.message}` : request.message;
 };
 
 // src/managers/opencode-manager.ts
-import { existsSync as existsSync7 } from "fs";
+import { existsSync as existsSync6 } from "fs";
 import { mkdir as mkdir12, readFile as readFile11 } from "fs/promises";
 import { delimiter, dirname as dirname6, join as join18 } from "path";
 import { randomBytes as randomBytes2 } from "crypto";
@@ -12392,7 +12371,7 @@ var opencodeAuthSchema = z4.record(z4.string(), z4.object({
   key: z4.string().optional()
 }));
 async function hasOpenCodeGoCredentials() {
-  if (!existsSync7(OPENCODE_AUTH_PATH2)) return false;
+  if (!existsSync6(OPENCODE_AUTH_PATH2)) return false;
   try {
     const auth = opencodeAuthSchema.safeParse(JSON.parse(await readFile11(OPENCODE_AUTH_PATH2, "utf8")));
     return auth.success && auth.data[OPENCODE_GO_PROVIDER]?.type === "api" && Boolean(auth.data[OPENCODE_GO_PROVIDER]?.key);
@@ -14183,10 +14162,10 @@ function isChatMessageSender(value) {
   return typeof value.senderUserId === "string" && typeof value.senderEmail === "string" && typeof value.recordedAt === "string";
 }
 function isCodexAvailable() {
-  return existsSync8(CODEX_AUTH_PATH2) || Boolean(ENGINE_ENV.OPENAI_API_KEY);
+  return existsSync7(CODEX_AUTH_PATH2) || Boolean(ENGINE_ENV.OPENAI_API_KEY);
 }
 function isOpencodeAvailable() {
-  return existsSync8(OPENCODE_AUTH_PATH3) || Boolean(ENGINE_ENV.OPENROUTER_API_KEY);
+  return existsSync7(OPENCODE_AUTH_PATH3) || Boolean(ENGINE_ENV.OPENROUTER_API_KEY);
 }
 function isPiAvailable() {
   return Boolean(ENGINE_ENV.OPENROUTER_API_KEY);
@@ -15332,7 +15311,7 @@ import { join as join26, resolve as resolve3 } from "path";
 // src/services/warm-hooks-service.ts
 import { spawn as spawn4 } from "child_process";
 import { readFile as readFile17 } from "fs/promises";
-import { existsSync as existsSync9 } from "fs";
+import { existsSync as existsSync8 } from "fs";
 import { join as join25 } from "path";
 
 // src/services/warm-hook-logs-service.ts
@@ -15454,7 +15433,7 @@ var warmHookLogsService = new WarmHookLogsService();
 async function readRepoWarmHook(repoPath) {
   for (const filename of REPLICAS_CONFIG_FILENAMES) {
     const configPath = join25(repoPath, filename);
-    if (!existsSync9(configPath)) {
+    if (!existsSync8(configPath)) {
       continue;
     }
     try {
@@ -15715,7 +15694,7 @@ ${combinedScript}` : combinedScript;
 
 // src/services/terminal-service.ts
 import { randomUUID as randomUUID6 } from "crypto";
-import { existsSync as existsSync10 } from "fs";
+import { existsSync as existsSync9 } from "fs";
 import { spawn as spawn5 } from "node-pty";
 var MAX_REPLAY_CHARS = 1024 * 1024;
 var MAX_TERMINAL_SESSIONS = 8;
@@ -15734,7 +15713,7 @@ var TerminalService = class {
       });
     }
     const id = randomUUID6();
-    const shell = process.env.SHELL && existsSync10(process.env.SHELL) ? process.env.SHELL : "/bin/bash";
+    const shell = process.env.SHELL && existsSync9(process.env.SHELL) ? process.env.SHELL : "/bin/bash";
     const pty = spawn5(shell, ["-l"], {
       name: "xterm-256color",
       cols,
@@ -16809,7 +16788,7 @@ async function timeStartupStep(name, fn) {
 async function waitForInitializationGate() {
   if (!ENGINE_ENV.REPLICAS_ENGINE_DEFER_INITIALIZATION) return;
   const deadline = Date.now() + ENGINE_INIT_GATE_TIMEOUT_MS;
-  while (!existsSync11(SANDBOX_PATHS.ENGINE_INIT_GATE)) {
+  while (!existsSync10(SANDBOX_PATHS.ENGINE_INIT_GATE)) {
     if (Date.now() >= deadline) {
       throw new Error("Timed out waiting for deferred engine initialization gate");
     }