replicas-engine 0.1.508 → 0.1.510

package/dist/src/index.js

@@ -611,7 +611,7 @@ var WORKSPACE_SIZES = ["small", "large"];
 var INVALID_WORKSPACE_SIZE_ERROR = `Invalid size: must be one of ${WORKSPACE_SIZES.join(", ")}`;
 
 // ../shared/src/e2b.ts
-var E2B_TEMPLATE_NAME = "replicas-sandbox-2026-07-26-v1";
+var E2B_TEMPLATE_NAME = "replicas-sandbox-2026-07-27-v1";
 
 // ../shared/src/runtime-env.ts
 function shellQuotePosix(value) {
@@ -727,6 +727,53 @@ function isGitHubUrl(url) {
 }
 
 // ../shared/src/urls.ts
+var PR_URL_REGEX = /github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)/;
+function parsePrUrl(url) {
+  const match = url.match(PR_URL_REGEX);
+  if (!match) return null;
+  const [, owner, repo, numberStr] = match;
+  const number = Number.parseInt(numberStr, 10);
+  if (!Number.isFinite(number)) return null;
+  return { owner, repo, number };
+}
+function parseCodeHostPrUrl(url) {
+  const github = parsePrUrl(url);
+  if (github) {
+    return {
+      ...github,
+      provider: "github",
+      host: "github.com",
+      repositoryPath: `${github.owner}/${github.repo}`,
+      repoUrl: `https://github.com/${github.owner}/${github.repo}`
+    };
+  }
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+  const segments = parsed.pathname.split("/").filter(Boolean);
+  const separatorIndex = segments.indexOf("-");
+  if (separatorIndex <= 0 || segments[separatorIndex + 1] !== "merge_requests") return null;
+  const number = Number.parseInt(segments[separatorIndex + 2] ?? "", 10);
+  if (!Number.isFinite(number)) return null;
+  const repositorySegments = decodePathSegments(segments.slice(0, separatorIndex));
+  const repo = repositorySegments[repositorySegments.length - 1];
+  const owner = repositorySegments[0];
+  if (!owner || !repo) return null;
+  const repositoryPath = repositorySegments.join("/");
+  return {
+    provider: "gitlab",
+    host: parsed.host.toLowerCase(),
+    owner,
+    repo,
+    number,
+    repositoryPath,
+    repoUrl: `${parsed.origin}/${repositoryPath}`
+  };
+}
 function decodePathSegments(segments) {
   return segments.map((segment) => {
     try {
@@ -1246,37 +1293,86 @@ This guide covers how to work with GitLab-hosted repositories from within your R
 Git credentials for the workspace's GitLab hosts are pre-configured in \`~/.git-credentials\` and refreshed automatically. Plain \`git fetch\` / \`git pull\` / \`git push\` over HTTPS work with no additional setup.
 
 - Never ask the user for a GitLab token or PAT \u2014 credentials are already wired. If a push fails with an authentication error, report it to the user instead of working around it.
+- A workspace can hold credentials for several GitLab hosts, and \`origin\` is whatever the repo says it is. Always select the token by the host you are about to call, as the snippets below do. Grabbing the first entry in \`~/.git-credentials\` can send one host's token to another.
 - There is no \`glab\` CLI in the workspace, and \`gh\` only works for GitHub remotes. Check a repo's host with \`git remote get-url origin\` before choosing the GitHub or GitLab workflow.
 
+### Reading the credential for a repo
+
+A workspace can hold tokens for several GitLab hosts, so always ask git for the
+credential belonging to the host you are about to call. Never grep
+\`~/.git-credentials\` yourself: taking the first line sends one instance's token to
+another, and interpolating a host into a grep pattern makes it a regular
+expression. \`git credential fill\` matches the host exactly and returns nothing
+when there is no credential for it:
+
+\`\`\`bash
+HOST=$(git remote get-url origin | sed -E 's#^[a-z]+://##; s#^[^@/]*@##; s#/.*##; s#:[^0-9].*##')
+TOKEN=$(printf 'protocol=https\\nhost=%s\\n\\n' "$HOST" | GIT_TERMINAL_PROMPT=0 git credential fill | sed -n 's/^password=//p')
+[ -n "$TOKEN" ] || { echo "no credential for $HOST"; exit 1; }
+\`\`\`
+
+Every recipe below repeats these two lines so each block runs on its own, and
+every one calls \`https://$HOST\`, so the token only ever reaches the host it
+belongs to. Run them inside the repo whose API you are calling. An empty
+\`$TOKEN\` means the workspace has no credential for that host. Report that rather
+than reaching for another one.
+
 ## Merge Requests
 
 Create a merge request directly from a push using push options:
 
 \`\`\`bash
-git push -o merge_request.create -o merge_request.target=<default-branch> origin HEAD
+git push -o merge_request.create -o merge_request.target=<default-branch> -o merge_request.title="Title" origin HEAD
 \`\`\`
 
 Useful options:
 
 \`\`\`bash
--o merge_request.title="Title"
--o merge_request.description="Description"
 -o merge_request.draft                  # open as draft
 -o merge_request.remove_source_branch   # delete branch on merge
 \`\`\`
 
 GitLab prints the MR URL in the push output \u2014 include it in your reply to the user.
 
+### Setting the description
+
+Do **not** pass the description as a push option. Push option values are shell
+arguments on one line, so a real description \u2014 headings, lists, the Replicas
+footer HTML \u2014 gets mangled or truncated. Write the body to a file and PUT it as
+JSON instead, which preserves it exactly:
+
+\`\`\`bash
+HOST=$(git remote get-url origin | sed -E 's#^[a-z]+://##; s#^[^@/]*@##; s#/.*##; s#:[^0-9].*##')
+TOKEN=$(printf 'protocol=https\\nhost=%s\\n\\n' "$HOST" | GIT_TERMINAL_PROMPT=0 git credential fill | sed -n 's/^password=//p')
+PROJECT=$(python3 -c 'import urllib.parse; print(urllib.parse.quote("group/project", safe=""))')
+cat > /tmp/mr-body.md <<'EOF'
+## Summary
+...your full description, ending with the Replicas footer...
+EOF
+jq -Rs '{description: .}' /tmp/mr-body.md > /tmp/mr-body.json
+curl -sS --request PUT \\
+  --header "Authorization: Bearer $TOKEN" \\
+  --header "Content-Type: application/json" \\
+  --data @/tmp/mr-body.json \\
+  "https://$HOST/api/v4/projects/$PROJECT/merge_requests/<iid>"
+\`\`\`
+
+Use the same command to edit a description later. Editing replaces the whole
+body, so re-include the Replicas footer every time \u2014 it is how merge requests
+opened through Replicas are counted.
+
 ## GitLab API (advanced)
 
 For operations with no git equivalent (commenting on MRs, reading pipelines), call the REST API with the workspace credential:
 
 \`\`\`bash
-TOKEN=$(grep -m1 '://oauth2:' ~/.git-credentials | sed -E 's#https://oauth2:([^@]+)@.*#\\1#')
-curl -s -H "Authorization: Bearer $TOKEN" "https://gitlab.com/api/v4/projects/<url-encoded-path>/merge_requests"
+HOST=$(git remote get-url origin | sed -E 's#^[a-z]+://##; s#^[^@/]*@##; s#/.*##; s#:[^0-9].*##')
+TOKEN=$(printf 'protocol=https\\nhost=%s\\n\\n' "$HOST" | GIT_TERMINAL_PROMPT=0 git credential fill | sed -n 's/^password=//p')
+curl -s -H "Authorization: Bearer $TOKEN" "https://$HOST/api/v4/projects/<url-encoded-path>/merge_requests"
 \`\`\`
 
-Use the repo's own host in the API base URL for self-managed instances.
+This works for gitlab.com and self-managed instances alike, because the base URL
+and the token both come from the repo's own host.
 
 ## Inline media in merge requests
 
@@ -1284,16 +1380,17 @@ GitLab provides a supported project Markdown uploads API. Upload media to Replic
 
 \`\`\`bash
 FILE=/abs/path/to/screenshot.png
+HOST=$(git remote get-url origin | sed -E 's#^[a-z]+://##; s#^[^@/]*@##; s#/.*##; s#:[^0-9].*##')
 PROJECT=$(python3 -c 'import urllib.parse; print(urllib.parse.quote("group/project", safe=""))')
-TOKEN=$(grep -m1 '://oauth2:' ~/.git-credentials | sed -E 's#https://oauth2:([^@]+)@.*#\\1#')
+TOKEN=$(printf 'protocol=https\\nhost=%s\\n\\n' "$HOST" | GIT_TERMINAL_PROMPT=0 git credential fill | sed -n 's/^password=//p')
 UPLOAD=$(curl -sS --request POST \\
   --header "Authorization: Bearer $TOKEN" \\
   --form "file=@$FILE" \\
-  "https://gitlab.com/api/v4/projects/$PROJECT/uploads")
+  "https://$HOST/api/v4/projects/$PROJECT/uploads")
 echo "$UPLOAD" | jq -r .markdown
 \`\`\`
 
-Use the repository's own host for self-managed GitLab. Insert the returned \`markdown\` into the merge request description or comment and add the media's **View in Replicas** dashboard link. Images render inline; MP4, MOV, and WebM render as inline video players. Do not create a public Replicas forge share when this native upload succeeds.
+Insert the returned \`markdown\` into the merge request description or comment and add the media's **View in Replicas** dashboard link. Images render inline; MP4, MOV, and WebM render as inline video players. Do not create a public Replicas forge share when this native upload succeeds.
 `;
 var GITLAB_ABILITY = {
   label: "GitLab",
@@ -5794,6 +5891,11 @@ var GitHubTokenManager = class extends BaseRefreshManager {
   constructor() {
     super("GitHubTokenManager");
   }
+  async refreshCredentials() {
+    const config = this.getRuntimeConfig();
+    if (!config) throw new Error("GitHub credential refresh is not configured");
+    await this.doRefresh(config);
+  }
   async doRefresh(_config) {
     console.log("[GitHubTokenManager] Refreshing GitHub token...");
     const response = await monolithRequest("/v1/engine/github/refresh-token");
@@ -9979,7 +10081,7 @@ var DEFAULT_CODEX_ARGS = ["app-server", "--listen", "stdio://"];
 var MIN_CODEX_CLI_VERSION = "0.144.6";
 var CODEX_UPGRADE_TIMEOUT_MS = 12e4;
 var codexCliVersionEnsured = null;
-var ENGINE_PACKAGE_VERSION = "0.1.508";
+var ENGINE_PACKAGE_VERSION = "0.1.510";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";
@@ -16229,6 +16331,9 @@ var writeTerminalSessionSchema = z7.object({
   generation: z7.number().int().nonnegative(),
   sequence: z7.number().int().nonnegative()
 });
+var mergePullRequestSchema = z7.object({
+  prUrl: z7.string().url()
+});
 var sendMessageSchema = z7.object({
   messageId: z7.string().min(1).optional(),
   submittedAt: z7.string().datetime().optional(),
@@ -16635,6 +16740,32 @@ function createV1Routes(deps) {
     }
     return c.json(result);
   });
+  app2.post("/pull-requests/merge", async (c) => {
+    const body = mergePullRequestSchema.parse(await c.req.json());
+    const parsed = parseCodeHostPrUrl(body.prUrl);
+    if (parsed?.provider !== "github") {
+      return c.json(jsonError("Only GitHub pull requests are supported"), 400);
+    }
+    const repository = (await gitService.listRepositories()).find(
+      (repo) => repo.name.toLowerCase() === parsed.repo.toLowerCase()
+    );
+    if (!repository) {
+      return c.json(jsonError("Pull request repository is not available in this workspace"), 404);
+    }
+    try {
+      await githubTokenManager.refreshCredentials();
+      await execFileAsync("gh", ["pr", "merge", body.prUrl, "--squash"], {
+        cwd: repository.path,
+        encoding: "utf-8",
+        timeout: 12e4,
+        maxBuffer: SUBPROCESS_MAX_BUFFER
+      });
+      return c.json({ success: true });
+    } catch (error) {
+      const detail = error && typeof error === "object" && "stderr" in error && typeof error.stderr === "string" ? error.stderr.trim() : error instanceof Error ? error.message : "GitHub CLI merge failed";
+      return c.json(jsonError("Failed to merge pull request", detail), 409);
+    }
+  });
   app2.get("/terminal/sessions", (c) => {
     return c.json({ sessions: terminalService.list() });
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.508",
+  "version": "0.1.510",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",