replicas-engine 0.1.532 → 0.1.533

package/README.md

@@ -66,8 +66,8 @@ From `monolith/src/lib/sandbox-helpers.ts` + `monolith/src/lib/workspaces.ts`, t
 - Git identity (optional but expected for commits):
   - `git config --global user.name <bot-or-user-name>`
   - `git config --global user.email <bot-or-user-email>`
-- Git credential helper setup when GitHub token is available:
-  - `git config --global credential.helper store`
+- Managed Git credential helper setup when code-host tokens are available:
+  - `git config --global credential.helper ~/.git-credential-replicas`
   - `~/.git-credentials` with `https://x-access-token:<token>@github.com`
 - Repository materialization:
   - clone repositories into `/home/ubuntu/workspaces/<repo-name>`

package/dist/src/index.js

@@ -623,7 +623,7 @@ var WORKSPACE_SIZES = ["small", "large"];
 var INVALID_WORKSPACE_SIZE_ERROR = `Invalid size: must be one of ${WORKSPACE_SIZES.join(", ")}`;
 
 // ../shared/src/e2b.ts
-var E2B_TEMPLATE_NAME = "replicas-sandbox-2026-07-31-v3";
+var E2B_TEMPLATE_NAME = "replicas-sandbox-2026-07-31-v4";
 
 // ../shared/src/runtime-env.ts
 function shellQuotePosix(value) {
@@ -685,6 +685,15 @@ function parsePosixEnvFile(content) {
 }
 
 // ../shared/src/git.ts
+var GIT_CREDENTIAL_HELPER_FILENAME = ".git-credential-replicas";
+function buildGitCredentialHelperScript(credentialsPath) {
+  return `#!/bin/sh
+if [ "$1" = "get" ]; then
+  exec git credential-store --file=${shellQuotePosix(credentialsPath)} get
+fi
+exit 0
+`;
+}
 function parseGitRemote(remoteUrl) {
   const normalized = remoteUrl.trim().replace(/\/+$/, "").replace(/\.git$/, "");
   try {
@@ -5216,7 +5225,7 @@ var monolithService = new MonolithService();
 
 // src/utils/file.ts
 import { mkdir, readFile, rename, unlink, writeFile } from "fs/promises";
-import { dirname } from "path";
+import { dirname, join as join3 } from "path";
 
 // src/utils/async-lock.ts
 var AsyncLock = class {
@@ -5248,6 +5257,14 @@ async function writeSecureCredentialFile(filePath, content, options) {
   }
   await atomicWriteFile(filePath, content, { mode: 384 });
 }
+async function configureManagedGitCredentialHelper(homeDir) {
+  const credentialsPath = join3(homeDir, ".git-credentials");
+  const helperPath = join3(homeDir, GIT_CREDENTIAL_HELPER_FILENAME);
+  await atomicWriteFile(helperPath, buildGitCredentialHelperScript(credentialsPath), { mode: 448 });
+  await execFileAsync("git", ["config", "--global", "credential.helper", helperPath], {
+    env: { ...process.env, HOME: homeDir }
+  });
+}
 var credentialFileLock = new AsyncLock();
 function upsertCredentialFileLines(filePath, hosts, lines) {
   return credentialFileLock.run(async () => {
@@ -5277,12 +5294,12 @@ function removeCredentialFileLines(filePath, shouldRemove) {
 // src/git/service.ts
 import { readdir, readFile as readFile3, stat } from "fs/promises";
 import { spawn } from "child_process";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 
 // src/utils/state.ts
 import { readFile as readFile2, mkdir as mkdir2 } from "fs/promises";
 import { existsSync } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 import { homedir as homedir3 } from "os";
 
 // src/utils/type-guards.ts
@@ -5291,8 +5308,8 @@ function isRecord4(value) {
 }
 
 // src/utils/state.ts
-var STATE_DIR = join3(homedir3(), ".replicas");
-var STATE_FILE = join3(STATE_DIR, "engine-state.json");
+var STATE_DIR = join4(homedir3(), ".replicas");
+var STATE_FILE = join4(STATE_DIR, "engine-state.json");
 var DEFAULT_STATE = {
   repos: {}
 };
@@ -5390,7 +5407,7 @@ async function saveRepoState(repoName, state, fallbackState) {
 
 // src/git/commands.ts
 import { readFileSync as readFileSync2 } from "fs";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 async function runGitCommand(args, cwd, options = {}) {
   const { stdout } = await execFileAsync("git", args, {
     cwd,
@@ -5401,7 +5418,7 @@ async function runGitCommand(args, cwd, options = {}) {
 }
 function readRepoHeadBranch(repoPath) {
   try {
-    const contents = readFileSync2(join4(repoPath, ".git", "HEAD"), "utf-8").trim();
+    const contents = readFileSync2(join5(repoPath, ".git", "HEAD"), "utf-8").trim();
     const match = contents.match(/^ref:\s+refs\/heads\/(.+)$/);
     return match ? match[1] : null;
   } catch {
@@ -5463,13 +5480,13 @@ var GitService = class {
     const repos = [];
     let complete = true;
     for (const entry of entries) {
-      const fullPath = join5(root, entry);
+      const fullPath = join6(root, entry);
       try {
         const entryStat = await stat(fullPath);
         if (!entryStat.isDirectory()) {
           continue;
         }
-        const hasGit = Boolean(await this.safeStat(join5(fullPath, ".git")));
+        const hasGit = Boolean(await this.safeStat(join6(fullPath, ".git")));
         if (!hasGit) {
           continue;
         }
@@ -5660,7 +5677,7 @@ var GitService = class {
       let total = 0;
       for (const path6 of paths) {
         try {
-          const contents = await readFile3(join5(repoPath, path6));
+          const contents = await readFile3(join6(repoPath, path6));
           if (contents.length === 0 || contents.includes(0)) {
             continue;
           }
@@ -5843,7 +5860,7 @@ var GitService = class {
   }
   async getGitLabAccessToken(host) {
     try {
-      const credentials = await readFile3(join5(ENGINE_ENV.HOME_DIR, ".git-credentials"), "utf-8");
+      const credentials = await readFile3(join6(ENGINE_ENV.HOME_DIR, ".git-credentials"), "utf-8");
       for (const line of credentials.split("\n")) {
         const trimmed = line.trim();
         if (!trimmed) continue;
@@ -6349,7 +6366,7 @@ var infisicalTokenManager = new InfisicalTokenManager();
 // src/utils/logger.ts
 import { mkdir as mkdir3, writeFile as writeFile2 } from "fs/promises";
 import { homedir as homedir4 } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import { format } from "util";
 import { randomBytes } from "crypto";
 
@@ -6424,7 +6441,7 @@ var StreamWriter = class {
 };
 
 // src/utils/logger.ts
-var LOG_DIR = join6(homedir4(), ".replicas", "logs");
+var LOG_DIR = join7(homedir4(), ".replicas", "logs");
 var EngineLogger = class {
   _sessionId = null;
   patched = false;
@@ -6435,7 +6452,7 @@ var EngineLogger = class {
   async initialize() {
     await mkdir3(LOG_DIR, { recursive: true });
     this._sessionId = this.createSessionId();
-    const logPath = join6(LOG_DIR, `${this._sessionId}.log`);
+    const logPath = join7(LOG_DIR, `${this._sessionId}.log`);
     await writeFile2(logPath, `=== Replicas Engine Session ${this._sessionId} ===
 `, "utf-8");
     this.writer.open(logPath);
@@ -6482,7 +6499,7 @@ var engineLogger = new EngineLogger();
 // src/services/replicas-config-service.ts
 import { readFile as readFile6, appendFile, writeFile as writeFile4, mkdir as mkdir6 } from "fs/promises";
 import { existsSync as existsSync3 } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 import { homedir as homedir8 } from "os";
 import { spawn as spawn2 } from "child_process";
 
@@ -6490,21 +6507,21 @@ import { spawn as spawn2 } from "child_process";
 import { mkdir as mkdir4, readFile as readFile4 } from "fs/promises";
 import { existsSync as existsSync2 } from "fs";
 import { homedir as homedir6 } from "os";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 
 // src/managers/agent-auth-paths.ts
 import { homedir as homedir5 } from "os";
-import { join as join7 } from "path";
-var OPENCODE_AUTH_PATH = join7(homedir5(), ".local", "share", "opencode", "auth.json");
-var PI_AUTH_PATH = join7(homedir5(), ".pi", "agent", "auth.json");
+import { join as join8 } from "path";
+var OPENCODE_AUTH_PATH = join8(homedir5(), ".local", "share", "opencode", "auth.json");
+var PI_AUTH_PATH = join8(homedir5(), ".pi", "agent", "auth.json");
 
 // src/services/environment-details-service.ts
-var REPLICAS_DIR = join8(homedir6(), ".replicas");
-var DETAILS_FILE = join8(REPLICAS_DIR, "environment-details.json");
-var CLAUDE_CREDENTIALS_PATH = join8(homedir6(), ".claude", ".credentials.json");
-var CODEX_AUTH_PATH = join8(homedir6(), ".codex", "auth.json");
-var GH_HOSTS_PATH = join8(homedir6(), ".config", "gh", "hosts.yml");
-var GIT_CREDENTIALS_PATH = join8(homedir6(), ".git-credentials");
+var REPLICAS_DIR = join9(homedir6(), ".replicas");
+var DETAILS_FILE = join9(REPLICAS_DIR, "environment-details.json");
+var CLAUDE_CREDENTIALS_PATH = join9(homedir6(), ".claude", ".credentials.json");
+var CODEX_AUTH_PATH = join9(homedir6(), ".codex", "auth.json");
+var GH_HOSTS_PATH = join9(homedir6(), ".config", "gh", "hosts.yml");
+var GIT_CREDENTIALS_PATH = join9(homedir6(), ".git-credentials");
 function detectClaudeAuthMethod() {
   if (existsSync2(CLAUDE_CREDENTIALS_PATH)) {
     return "oauth";
@@ -6711,7 +6728,7 @@ var environmentDetailsService = new EnvironmentDetailsService();
 // src/services/start-hook-logs-service.ts
 import { mkdir as mkdir5, readFile as readFile5, writeFile as writeFile3, readdir as readdir2 } from "fs/promises";
 import { homedir as homedir7 } from "os";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 
 // src/services/hook-log-files.ts
 import { createHash } from "crypto";
@@ -6723,7 +6740,7 @@ function repoHookLogFilename(repoName) {
 }
 
 // src/services/start-hook-logs-service.ts
-var LOGS_DIR = join9(homedir7(), ".replicas", "start-hook-logs");
+var LOGS_DIR = join10(homedir7(), ".replicas", "start-hook-logs");
 function withPreview(stored) {
   const preview = buildHookOutputPreview(stored.output);
   return { ...stored, ...preview };
@@ -6761,7 +6778,7 @@ var StartHookLogsService = class {
     await this.ensureDir();
     const log = { hookType, hookName, repoName: hookName, ...entry };
     const filename = hookType === "environment" ? ENVIRONMENT_HOOK_LOG_FILENAME : repoHookLogFilename(hookName);
-    await writeFile3(join9(LOGS_DIR, filename), `${JSON.stringify(log, null, 2)}
+    await writeFile3(join10(LOGS_DIR, filename), `${JSON.stringify(log, null, 2)}
 `, "utf-8");
   }
   async saveEnvironmentLog(entry) {
@@ -6786,7 +6803,7 @@ var StartHookLogsService = class {
         continue;
       }
       try {
-        const raw = await readFile5(join9(LOGS_DIR, file), "utf-8");
+        const raw = await readFile5(join10(LOGS_DIR, file), "utf-8");
         const stored = normalizeStored(JSON.parse(raw));
         if (stored) {
           logs.push(withPreview(stored));
@@ -6805,7 +6822,7 @@ var StartHookLogsService = class {
   async getFullOutput(hookType, hookName) {
     const filename = hookType === "environment" ? ENVIRONMENT_HOOK_LOG_FILENAME : repoHookLogFilename(hookName);
     try {
-      const raw = await readFile5(join9(LOGS_DIR, filename), "utf-8");
+      const raw = await readFile5(join10(LOGS_DIR, filename), "utf-8");
       const stored = normalizeStored(JSON.parse(raw));
       if (!stored || stored.hookType !== hookType || stored.hookName !== hookName) {
         return null;
@@ -6822,7 +6839,7 @@ var StartHookLogsService = class {
 var startHookLogsService = new StartHookLogsService();
 
 // src/services/replicas-config-service.ts
-var START_HOOKS_LOG = join10(homedir8(), ".replicas", "startHooks.log");
+var START_HOOKS_LOG = join11(homedir8(), ".replicas", "startHooks.log");
 var START_HOOKS_RUNNING_PROMPT = `IMPORTANT - Start Hooks Running:
 Start hooks are shell commands/scripts set by repository owners that run on workspace startup.
 These hooks are currently executing in the background. You can:
@@ -6833,7 +6850,7 @@ The start hooks may install dependencies, build projects, or perform other setup
 If your task depends on setup being complete, check the log file before proceeding.`;
 async function readReplicasConfigFromDir(dirPath) {
   for (const filename of REPLICAS_CONFIG_FILENAMES) {
-    const configPath = join10(dirPath, filename);
+    const configPath = join11(dirPath, filename);
     if (!existsSync3(configPath)) {
       continue;
     }
@@ -6903,7 +6920,7 @@ var ReplicasConfigService = class {
     const logLine = `[${timestamp}] ${message}
 `;
     try {
-      await mkdir6(join10(homedir8(), ".replicas"), { recursive: true });
+      await mkdir6(join11(homedir8(), ".replicas"), { recursive: true });
       await appendFile(START_HOOKS_LOG, logLine, "utf-8");
     } catch (error) {
       console.error("Failed to write to start hooks log:", error);
@@ -7038,7 +7055,7 @@ var ReplicasConfigService = class {
     this.hooksCompleted = false;
     this.hooksFailed = false;
     try {
-      await mkdir6(join10(homedir8(), ".replicas"), { recursive: true });
+      await mkdir6(join11(homedir8(), ".replicas"), { recursive: true });
       await writeFile4(
         START_HOOKS_LOG,
         `=== Start Hooks Execution Log ===
@@ -7234,10 +7251,10 @@ var replicasConfigService = new ReplicasConfigService();
 // src/services/event-service.ts
 import { mkdir as mkdir7 } from "fs/promises";
 import { homedir as homedir9 } from "os";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 import { randomUUID } from "crypto";
-var ENGINE_DIR = join11(homedir9(), ".replicas", "engine");
-var EVENTS_FILE = join11(ENGINE_DIR, "events.jsonl");
+var ENGINE_DIR = join12(homedir9(), ".replicas", "engine");
+var EVENTS_FILE = join12(ENGINE_DIR, "events.jsonl");
 var EventService = class {
   subscribers = /* @__PURE__ */ new Map();
   writer = new StreamWriter();
@@ -7272,8 +7289,8 @@ import { mkdir as mkdir8, readFile as readFile7 } from "fs/promises";
 import { existsSync as existsSync4 } from "fs";
 import { randomUUID as randomUUID2 } from "crypto";
 import { homedir as homedir10 } from "os";
-import { dirname as dirname2, join as join12 } from "path";
-var PREVIEW_PORTS_FILE = join12(homedir10(), ".replicas", "preview-ports.json");
+import { dirname as dirname2, join as join13 } from "path";
+var PREVIEW_PORTS_FILE = join13(homedir10(), ".replicas", "preview-ports.json");
 async function readPreviewsFile() {
   try {
     if (!existsSync4(PREVIEW_PORTS_FILE)) {
@@ -7386,7 +7403,7 @@ async function registerDesktopPreview() {
 import { existsSync as existsSync7 } from "fs";
 import { appendFile as appendFile3, copyFile, mkdir as mkdir14, readFile as readFile14, rename as rename2, rm as rm2 } from "fs/promises";
 import { homedir as homedir15 } from "os";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 
 // src/managers/claude-manager.ts
@@ -7394,7 +7411,7 @@ import {
   query
 } from "@anthropic-ai/claude-agent-sdk";
 import { randomUUID as randomUUID4 } from "crypto";
-import { dirname as dirname4, join as join15 } from "path";
+import { dirname as dirname4, join as join16 } from "path";
 import { mkdir as mkdir10 } from "fs/promises";
 import { homedir as homedir12 } from "os";
 
@@ -7783,7 +7800,7 @@ function extractPlanFromCodexAspNotification(notification) {
 import { randomUUID as randomUUID3 } from "crypto";
 import { mkdir as mkdir9, unlink as unlink2, writeFile as writeFile5 } from "fs/promises";
 import { homedir as homedir11 } from "os";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 function isImageMediaType(value) {
   return IMAGE_MEDIA_TYPES.includes(value);
 }
@@ -7883,14 +7900,14 @@ async function normalizeImages(images) {
   }
   return normalized;
 }
-async function saveNormalizedImagesToTempFiles(images, tempImageDir = join13(homedir11(), ".replicas", "codex", "temp-images")) {
+async function saveNormalizedImagesToTempFiles(images, tempImageDir = join14(homedir11(), ".replicas", "codex", "temp-images")) {
   await mkdir9(tempImageDir, { recursive: true });
   const tempPaths = [];
   try {
     for (const image of images) {
       const ext = image.source.media_type.split("/")[1] || "png";
       const filename = `img_${randomUUID3()}.${ext}`;
-      const filepath = join13(tempImageDir, filename);
+      const filepath = join14(tempImageDir, filename);
       await writeFile5(filepath, Buffer.from(image.source.data, "base64"));
       tempPaths.push(filepath);
     }
@@ -8475,7 +8492,7 @@ function reportCommandProtectionBlock(options) {
 
 // src/services/skill-registry-service.ts
 import { readFile as readFile8, readdir as readdir3, stat as stat2 } from "fs/promises";
-import { dirname as dirname3, isAbsolute, join as join14, relative, resolve } from "path";
+import { dirname as dirname3, isAbsolute, join as join15, relative, resolve } from "path";
 var REGISTRY_ROOT_DIR = ".replicas/skill-registries";
 var REGISTRY_MANIFEST = "manifest.json";
 async function getSkillRegistryInventory(homeDir) {
@@ -8536,10 +8553,10 @@ async function scanRegistry(registryDir) {
 }
 async function findSkillCollections(registryDir) {
   const candidateRoots = [
-    { source: "skills", root: join14(registryDir, "skills") },
-    { source: "agents", root: join14(registryDir, ".agents", "skills") },
-    { source: "codex", root: join14(registryDir, ".codex", "skills") },
-    { source: "claude", root: join14(registryDir, ".claude", "skills") }
+    { source: "skills", root: join15(registryDir, "skills") },
+    { source: "agents", root: join15(registryDir, ".agents", "skills") },
+    { source: "codex", root: join15(registryDir, ".codex", "skills") },
+    { source: "claude", root: join15(registryDir, ".claude", "skills") }
   ];
   const collections = [];
   for (const { source, root } of candidateRoots) {
@@ -8553,9 +8570,9 @@ async function findSkillCollections(registryDir) {
 async function findSkillDirsInRoot(root) {
   const skillDirs = [];
   for (const dirent of await safeReadDir(root)) {
-    const skillDir = join14(root, dirent.name);
+    const skillDir = join15(root, dirent.name);
     if (!await isDirectoryDirent(dirent, skillDir)) continue;
-    if (await fileExists(join14(skillDir, "SKILL.md"))) {
+    if (await fileExists(join15(skillDir, "SKILL.md"))) {
       skillDirs.push(skillDir);
     }
   }
@@ -8565,9 +8582,9 @@ async function findTopLevelSkills(registryDir) {
   const skills = [];
   for (const dirent of await safeReadDir(registryDir)) {
     if (dirent.name.startsWith(".") || dirent.name === "skills" || dirent.name === "plugins") continue;
-    const skillDir = join14(registryDir, dirent.name);
+    const skillDir = join15(registryDir, dirent.name);
     if (!await isDirectoryDirent(dirent, skillDir)) continue;
-    if (await fileExists(join14(skillDir, "SKILL.md"))) {
+    if (await fileExists(join15(skillDir, "SKILL.md"))) {
       skills.push({ source: "root", skillDir });
     }
   }
@@ -8578,10 +8595,10 @@ async function findClaudePluginRoots(registryDir) {
   async function walk(dir) {
     for (const dirent of await safeReadDir(dir)) {
       if (dirent.name === ".git") continue;
-      const child = join14(dir, dirent.name);
+      const child = join15(dir, dirent.name);
       if (!await isDirectoryDirent(dirent, child)) continue;
       if (dirent.name === ".claude-plugin") {
-        if (await fileExists(join14(child, "plugin.json"))) {
+        if (await fileExists(join15(child, "plugin.json"))) {
           roots.push(dirname3(child));
         }
         continue;
@@ -8593,7 +8610,7 @@ async function findClaudePluginRoots(registryDir) {
   return uniqueStrings(roots);
 }
 async function hasCodexMarketplace(registryDir) {
-  return await fileExists(join14(registryDir, ".agents", "plugins", "marketplace.json")) || await fileExists(join14(registryDir, ".codex", "plugins", "marketplace.json"));
+  return await fileExists(join15(registryDir, ".agents", "plugins", "marketplace.json")) || await fileExists(join15(registryDir, ".codex", "plugins", "marketplace.json"));
 }
 async function installCodexRegistryPlugins(client, inventory) {
   const cwds = inventory.codexMarketplaceCwds;
@@ -8643,10 +8660,10 @@ function isSkillRegistryEntry(value) {
   return "index" in value && typeof value.index === "number" && "name" in value && typeof value.name === "string" && "url" in value && typeof value.url === "string" && "checkoutPath" in value && typeof value.checkoutPath === "string";
 }
 function getRegistryRoot(homeDir) {
-  return join14(homeDir, REGISTRY_ROOT_DIR);
+  return join15(homeDir, REGISTRY_ROOT_DIR);
 }
 function getManifestPath(homeDir) {
-  return join14(getRegistryRoot(homeDir), REGISTRY_MANIFEST);
+  return join15(getRegistryRoot(homeDir), REGISTRY_MANIFEST);
 }
 function emptyInventory(registryRoot) {
   return {
@@ -8994,7 +9011,7 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
   authRetrying = false;
   constructor(options) {
     super(options);
-    this.historyFilePath = options.historyFilePath ?? join15(homedir12(), ".replicas", "claude", "history.jsonl");
+    this.historyFilePath = options.historyFilePath ?? join16(homedir12(), ".replicas", "claude", "history.jsonl");
     this.historyFile = new CodexHistoryFile(this.historyFilePath);
     this.systemPromptOverride = options.systemPromptOverride;
     this.toolsOverride = options.tools;
@@ -9944,7 +9961,7 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
 
 // src/managers/codex-asp/codex-asp-manager.ts
 import { readdir as readdir4 } from "fs/promises";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 
 // src/managers/codex-asp/app-server-process.ts
 import { spawn as spawn3 } from "child_process";
@@ -10145,7 +10162,7 @@ var DEFAULT_CODEX_ARGS = ["app-server", "--listen", "stdio://"];
 var MIN_CODEX_CLI_VERSION = "0.144.6";
 var CODEX_UPGRADE_TIMEOUT_MS = 12e4;
 var codexCliVersionEnsured = null;
-var ENGINE_PACKAGE_VERSION = "0.1.532";
+var ENGINE_PACKAGE_VERSION = "0.1.533";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";
@@ -11069,15 +11086,15 @@ var TranscriptUpdateCoalescer = class {
 
 // src/services/chat/history-paths.ts
 import { homedir as homedir13 } from "os";
-import { join as join16 } from "path";
-var ENGINE_DIR2 = join16(homedir13(), ".replicas", "engine");
-var CHATS_FILE = join16(ENGINE_DIR2, "chats.json");
-var CLAUDE_HISTORY_DIR = join16(ENGINE_DIR2, "claude-histories");
-var RELAY_HISTORY_DIR = join16(ENGINE_DIR2, "relay-histories");
-var CODEX_HISTORY_DIR = join16(ENGINE_DIR2, "codex-histories");
-var CURSOR_HISTORY_DIR = join16(ENGINE_DIR2, "cursor-histories");
-var OPENCODE_HISTORY_DIR = join16(ENGINE_DIR2, "opencode-histories");
-var PI_HISTORY_DIR = join16(ENGINE_DIR2, "pi-histories");
+import { join as join17 } from "path";
+var ENGINE_DIR2 = join17(homedir13(), ".replicas", "engine");
+var CHATS_FILE = join17(ENGINE_DIR2, "chats.json");
+var CLAUDE_HISTORY_DIR = join17(ENGINE_DIR2, "claude-histories");
+var RELAY_HISTORY_DIR = join17(ENGINE_DIR2, "relay-histories");
+var CODEX_HISTORY_DIR = join17(ENGINE_DIR2, "codex-histories");
+var CURSOR_HISTORY_DIR = join17(ENGINE_DIR2, "cursor-histories");
+var OPENCODE_HISTORY_DIR = join17(ENGINE_DIR2, "opencode-histories");
+var PI_HISTORY_DIR = join17(ENGINE_DIR2, "pi-histories");
 var HISTORY_DIR_BY_PROVIDER = {
   claude: CLAUDE_HISTORY_DIR,
   relay: RELAY_HISTORY_DIR,
@@ -11123,7 +11140,7 @@ async function readCodexAspThreadHistory(threadId) {
   }
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".jsonl")) continue;
-    const history = await new CodexHistoryFile(join17(CODEX_HISTORY_DIR, entry.name)).load();
+    const history = await new CodexHistoryFile(join18(CODEX_HISTORY_DIR, entry.name)).load();
     const transcript = history.transcriptsByThreadId.get(threadId);
     if (transcript) {
       return {
@@ -12350,7 +12367,7 @@ var CodexAspManager = class extends CodingAgentManager {
 
 // src/managers/cursor-manager.ts
 import { mkdir as mkdir11, readFile as readFile10, readdir as readdir5 } from "fs/promises";
-import { basename, dirname as dirname5, extname, join as join18 } from "path";
+import { basename, dirname as dirname5, extname, join as join19 } from "path";
 import { parse as parseYaml2 } from "yaml";
 import { Agent as CursorAgent } from "@cursor/sdk";
 var CURSOR_SLASH_COMMANDS_CACHE_MS = 3e4;
@@ -12409,7 +12426,7 @@ async function listCursorCommandsInDirectory(directory) {
     const name = basename(entry.name, ".md");
     let description;
     try {
-      description = extractCursorCommandDescription(await readFile10(join18(directory, entry.name), "utf8"));
+      description = extractCursorCommandDescription(await readFile10(join19(directory, entry.name), "utf8"));
     } catch (error) {
       console.warn("[CursorManager] Failed to read slash command file:", error);
     }
@@ -12431,7 +12448,7 @@ var CursorManager = class extends CodingAgentManager {
   slashCommandsRequest = null;
   constructor(options) {
     super(options);
-    this.historyFilePath = options.historyFilePath ?? join18(ENGINE_ENV.HOME_DIR, ".replicas", "cursor", "history.jsonl");
+    this.historyFilePath = options.historyFilePath ?? join19(ENGINE_ENV.HOME_DIR, ".replicas", "cursor", "history.jsonl");
     this.historyFile = new CodexHistoryFile(this.historyFilePath);
     this.initializeManager(this.processMessageInternal.bind(this));
   }
@@ -12482,7 +12499,7 @@ var CursorManager = class extends CodingAgentManager {
     this.slashCommandsRequest ??= (async () => {
       try {
         const repoDirectories = await getAgentAdditionalDirectories();
-        const commandDirectories = [this.workingDirectory, ...repoDirectories, ENGINE_ENV.HOME_DIR].map((directory) => join18(directory, ".cursor", "commands"));
+        const commandDirectories = [this.workingDirectory, ...repoDirectories, ENGINE_ENV.HOME_DIR].map((directory) => join19(directory, ".cursor", "commands"));
         const commands = mergeSlashCommands(
           ...await Promise.all(commandDirectories.map(listCursorCommandsInDirectory))
         );
@@ -12742,7 +12759,7 @@ ${request.message}` : request.message;
 // src/managers/opencode-manager.ts
 import { existsSync as existsSync6 } from "fs";
 import { mkdir as mkdir12, readFile as readFile11 } from "fs/promises";
-import { delimiter, dirname as dirname6, join as join19 } from "path";
+import { delimiter, dirname as dirname6, join as join20 } from "path";
 import { randomBytes as randomBytes2 } from "crypto";
 import { fileURLToPath } from "url";
 import { Agent } from "undici";
@@ -12770,7 +12787,7 @@ import {
   createOpencodeServer
 } from "@opencode-ai/sdk/v2";
 var OPENCODE_SHIM_DIR = dirname6(fileURLToPath(new URL("../../scripts/opencode", import.meta.url)));
-var OPENCODE_CONFIG_PATH = join19(ENGINE_ENV.HOME_DIR, ".config", "opencode", "opencode.json");
+var OPENCODE_CONFIG_PATH = join20(ENGINE_ENV.HOME_DIR, ".config", "opencode", "opencode.json");
 var OPENCODE_FETCH_DISPATCHER = new Agent({ headersTimeout: 0, bodyTimeout: 0 });
 var OPENCODE_SERVER_STARTUP_TIMEOUT_MS = 3e4;
 var OPENCODE_WORKSPACE_PERMISSION = {
@@ -13018,7 +13035,7 @@ var OpencodeManager = class extends CodingAgentManager {
   constructor(options) {
     super(options);
     this.sessionId = options.initialSessionId;
-    this.historyFilePath = options.historyFilePath ?? join19(ENGINE_ENV.HOME_DIR, ".replicas", "opencode", "history.jsonl");
+    this.historyFilePath = options.historyFilePath ?? join20(ENGINE_ENV.HOME_DIR, ".replicas", "opencode", "history.jsonl");
     this.historyFile = new CodexHistoryFile(this.historyFilePath);
     this.initializeManager(this.processMessageInternal.bind(this));
   }
@@ -13517,7 +13534,7 @@ var OpencodeManager = class extends CodingAgentManager {
 
 // src/managers/pi-manager.ts
 import { mkdir as mkdir13 } from "fs/promises";
-import { dirname as dirname7, join as join20 } from "path";
+import { dirname as dirname7, join as join21 } from "path";
 import {
   AuthStorage,
   createAgentSession,
@@ -13558,7 +13575,7 @@ var PiManager = class extends CodingAgentManager {
   providerId = "openrouter";
   constructor(options) {
     super(options);
-    this.historyFilePath = options.historyFilePath ?? join20(PI_HISTORY_DIR, `${Date.now()}.jsonl`);
+    this.historyFilePath = options.historyFilePath ?? join21(PI_HISTORY_DIR, `${Date.now()}.jsonl`);
     this.historyFile = new CodexHistoryFile(this.historyFilePath);
     this.initializeManager(this.processMessageInternal.bind(this));
   }
@@ -13664,7 +13681,7 @@ var PiManager = class extends CodingAgentManager {
     const sessionManager = this.initialSessionId ? SessionManager.open(this.initialSessionId, PI_HISTORY_DIR, this.workingDirectory) : SessionManager.create(this.workingDirectory, PI_HISTORY_DIR);
     const resourceLoader = new DefaultResourceLoader({
       cwd: this.workingDirectory,
-      agentDir: join20(ENGINE_ENV.HOME_DIR, ".pi", "agent"),
+      agentDir: join21(ENGINE_ENV.HOME_DIR, ".pi", "agent"),
       extensionFactories: [registerCommandProtection(this.workingDirectory)],
       appendSystemPrompt: [this.buildCombinedInstructions() ?? ""]
     });
@@ -14377,17 +14394,17 @@ var keepAliveService = new KeepAliveService();
 // src/services/canvas-service.ts
 import { readdir as readdir6, readFile as readFile12, stat as stat3 } from "fs/promises";
 import { homedir as homedir14 } from "os";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 var GLOBAL_CANVAS_DIRECTORIES = [
-  join21(homedir14(), ".claude", "plans"),
-  join21(process.env.XDG_DATA_HOME ?? join21(homedir14(), ".local", "share"), "opencode", "plans"),
-  join21(homedir14(), ".replicas", "canvas")
+  join22(homedir14(), ".claude", "plans"),
+  join22(process.env.XDG_DATA_HOME ?? join22(homedir14(), ".local", "share"), "opencode", "plans"),
+  join22(homedir14(), ".replicas", "canvas")
 ];
 async function canvasDirectories() {
   const repositories = await gitService.listRepositories().catch(() => []);
   return [
     ...GLOBAL_CANVAS_DIRECTORIES,
-    ...repositories.map((repository) => join21(repository.path, ".opencode", "plans"))
+    ...repositories.map((repository) => join22(repository.path, ".opencode", "plans"))
   ];
 }
 var CanvasService = class {
@@ -14407,7 +14424,7 @@ var CanvasService = class {
         const { kind } = classifyCanvasFilename(entry.name);
         let sizeBytes = 0;
         try {
-          const s = await stat3(join21(directory, entry.name));
+          const s = await stat3(join22(directory, entry.name));
           sizeBytes = s.size;
         } catch {
           continue;
@@ -14422,7 +14439,7 @@ var CanvasService = class {
     if (!safe) return null;
     const { kind, mimeType } = classifyCanvasFilename(safe);
     for (const directory of await canvasDirectories()) {
-      const filePath = join21(directory, safe);
+      const filePath = join22(directory, safe);
       let sizeBytes = 0;
       let updatedAt = "";
       try {
@@ -14562,13 +14579,13 @@ import { createReadStream } from "fs";
 import { readdir as readdir7, readFile as readFile13, stat as stat4 } from "fs/promises";
 import { request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
-import { basename as basename2, join as join23 } from "path";
+import { basename as basename2, join as join24 } from "path";
 
 // src/services/chat/chat-senders.ts
-import { join as join22 } from "path";
-var CHAT_SENDERS_DIR = join22(ENGINE_DIR2, "chat-senders");
+import { join as join23 } from "path";
+var CHAT_SENDERS_DIR = join23(ENGINE_DIR2, "chat-senders");
 function chatMessageSendersFilePath(chatId) {
-  return join22(CHAT_SENDERS_DIR, `${chatId}.jsonl`);
+  return join23(CHAT_SENDERS_DIR, `${chatId}.jsonl`);
 }
 function parseChatMessageSendersJsonl(content) {
   return content.split("\n").flatMap((line) => {
@@ -14584,9 +14601,9 @@ function parseChatMessageSendersJsonl(content) {
 
 // src/services/upload-chat-transcripts.ts
 var HISTORY_DIRS = [
-  join23(ENGINE_DIR2, "claude-histories"),
-  join23(ENGINE_DIR2, "relay-histories"),
-  join23(ENGINE_DIR2, "codex-histories")
+  join24(ENGINE_DIR2, "claude-histories"),
+  join24(ENGINE_DIR2, "relay-histories"),
+  join24(ENGINE_DIR2, "codex-histories")
 ];
 async function putTranscript(uploadUrl, filePath, size) {
   await new Promise((resolve4, reject) => {
@@ -14631,7 +14648,7 @@ async function flushAllChatTranscripts(chatsById = /* @__PURE__ */ new Map()) {
       if (!entry.endsWith(".jsonl")) continue;
       const chatId = basename2(entry, ".jsonl");
       tasks.push(
-        uploadChatTranscript(chatId, join23(dir, entry), chatsById.get(chatId)).then(() => {
+        uploadChatTranscript(chatId, join24(dir, entry), chatsById.get(chatId)).then(() => {
           flushed++;
         }).catch((err) => {
           failed++;
@@ -14718,7 +14735,7 @@ async function flushRepoState() {
 // src/services/upload-engine-logs.ts
 import { createReadStream as createReadStream2 } from "fs";
 import { readdir as readdir8, stat as stat5 } from "fs/promises";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 var MAX_ENGINE_LOG_FLUSH_SESSIONS = 10;
 var MAX_ENGINE_LOG_FLUSH_BYTES = 5 * 1024 * 1024;
 var ENGINE_LOG_FLUSH_TIMEOUT_MS = 2e4;
@@ -14747,7 +14764,7 @@ async function flushAllEngineLogs() {
   const candidates = (await Promise.all(filenames.slice(0, MAX_ENGINE_LOG_FLUSH_SESSIONS).map(async (filename) => {
     try {
       const sessionId = filename.slice(0, -".log".length);
-      const filePath = join24(LOG_DIR, filename);
+      const filePath = join25(LOG_DIR, filename);
       const fileStat = await runBeforeDeadline(() => stat5(filePath), deadline);
       if (!fileStat.isFile()) {
         skipped++;
@@ -14843,7 +14860,7 @@ async function uploadEngineLog(input, timeoutMs) {
 }
 
 // src/services/chat/chat-service.ts
-var CODEX_AUTH_PATH2 = join25(homedir15(), ".codex", "auth.json");
+var CODEX_AUTH_PATH2 = join26(homedir15(), ".codex", "auth.json");
 var CHATS_BACKUP_FILE = `${CHATS_FILE}.bak`;
 function isCodexAvailable() {
   return existsSync7(CODEX_AUTH_PATH2) || Boolean(ENGINE_ENV.OPENAI_API_KEY);
@@ -15310,7 +15327,7 @@ var ChatService = class {
     return descendants;
   }
   async deleteHistoryFile(persisted) {
-    await rm2(join25(HISTORY_DIR_BY_PROVIDER[persisted.provider], `${persisted.id}.jsonl`), { force: true });
+    await rm2(join26(HISTORY_DIR_BY_PROVIDER[persisted.provider], `${persisted.id}.jsonl`), { force: true });
     await rm2(chatMessageSendersFilePath(persisted.id), { force: true });
   }
   async getChatHistory(chatId, page = {}) {
@@ -15386,7 +15403,7 @@ var ChatService = class {
     if (persisted.provider === "claude") {
       provider = new ClaudeManager({
         workingDirectory: this.workingDirectory,
-        historyFilePath: join25(CLAUDE_HISTORY_DIR, `${persisted.id}.jsonl`),
+        historyFilePath: join26(CLAUDE_HISTORY_DIR, `${persisted.id}.jsonl`),
         initialSessionId: persisted.providerSessionId,
         onSaveSessionId: saveSession,
         onTurnComplete: onProviderTurnComplete,
@@ -15395,7 +15412,7 @@ var ChatService = class {
     } else if (persisted.provider === "relay") {
       provider = new RelayManager({
         workingDirectory: this.workingDirectory,
-        historyFilePath: join25(RELAY_HISTORY_DIR, `${persisted.id}.jsonl`),
+        historyFilePath: join26(RELAY_HISTORY_DIR, `${persisted.id}.jsonl`),
         initialSessionId: persisted.providerSessionId,
         onSaveSessionId: saveSession,
         onTurnComplete: onProviderTurnComplete,
@@ -15409,7 +15426,7 @@ var ChatService = class {
     } else if (persisted.provider === "cursor") {
       provider = new CursorManager({
         workingDirectory: this.workingDirectory,
-        historyFilePath: join25(CURSOR_HISTORY_DIR, `${persisted.id}.jsonl`),
+        historyFilePath: join26(CURSOR_HISTORY_DIR, `${persisted.id}.jsonl`),
         initialSessionId: persisted.providerSessionId,
         onSaveSessionId: saveSession,
         onTurnComplete: onProviderTurnComplete,
@@ -15418,7 +15435,7 @@ var ChatService = class {
     } else if (persisted.provider === "opencode") {
       provider = new OpencodeManager({
         workingDirectory: this.workingDirectory,
-        historyFilePath: join25(OPENCODE_HISTORY_DIR, `${persisted.id}.jsonl`),
+        historyFilePath: join26(OPENCODE_HISTORY_DIR, `${persisted.id}.jsonl`),
         initialSessionId: persisted.providerSessionId,
         onSaveSessionId: saveSession,
         onTurnComplete: onProviderTurnComplete,
@@ -15427,7 +15444,7 @@ var ChatService = class {
     } else if (persisted.provider === "pi") {
       provider = new PiManager({
         workingDirectory: this.workingDirectory,
-        historyFilePath: join25(PI_HISTORY_DIR, `${persisted.id}.jsonl`),
+        historyFilePath: join26(PI_HISTORY_DIR, `${persisted.id}.jsonl`),
         initialSessionId: persisted.providerSessionId,
         onSaveSessionId: saveSession,
         onTurnComplete: onProviderTurnComplete,
@@ -15436,7 +15453,7 @@ var ChatService = class {
     } else {
       provider = new CodexAspManager({
         workingDirectory: this.workingDirectory,
-        historyFilePath: join25(CODEX_HISTORY_DIR, `${persisted.id}.jsonl`),
+        historyFilePath: join26(CODEX_HISTORY_DIR, `${persisted.id}.jsonl`),
         initialSessionId: persisted.providerSessionId,
         onSaveSessionId: saveSession,
         onTurnComplete: onProviderTurnComplete,
@@ -15586,7 +15603,7 @@ var ChatService = class {
     });
     uploadChatTranscript(
       chatId,
-      join25(HISTORY_DIR_BY_PROVIDER[chat.persisted.provider], `${chatId}.jsonl`),
+      join26(HISTORY_DIR_BY_PROVIDER[chat.persisted.provider], `${chatId}.jsonl`),
       this.toSummary(chat)
     ).catch((err) => {
       console.error("[ChatService] Failed to upload chat transcript:", { chatId, err });
@@ -15722,7 +15739,7 @@ var ChatService = class {
 // src/services/repo-file-service.ts
 import { execFile as execFile2 } from "child_process";
 import { readFile as readFile15, realpath, stat as stat6 } from "fs/promises";
-import { join as join26, resolve as resolve2, extname as extname2 } from "path";
+import { join as join27, resolve as resolve2, extname as extname2 } from "path";
 var CACHE_TTL_MS = 3e4;
 var SEARCH_TIMEOUT_MS = 15e3;
 var MAX_CONTENT_BYTES = 256 * 1024;
@@ -15882,7 +15899,7 @@ var RepoFileService = class {
     const repo = repos.find((r) => r.name === repoName);
     if (!repo) return null;
     try {
-      const fullPath = await realpath(resolve2(join26(repo.path, filePath)));
+      const fullPath = await realpath(resolve2(join27(repo.path, filePath)));
       const repoRoot = await realpath(repo.path);
       const repoPrefix = repoRoot.endsWith("/") ? repoRoot : repoRoot + "/";
       if (!fullPath.startsWith(repoPrefix) && fullPath !== repoRoot) return null;
@@ -15990,20 +16007,20 @@ var RepoFileService = class {
 import { Hono } from "hono";
 import { z as z7 } from "zod";
 import { readdir as readdir10, stat as stat7, readFile as readFile18 } from "fs/promises";
-import { join as join29, resolve as resolve3 } from "path";
+import { join as join30, resolve as resolve3 } from "path";
 
 // src/services/warm-hooks-service.ts
 import { spawn as spawn4 } from "child_process";
 import { readFile as readFile17 } from "fs/promises";
 import { existsSync as existsSync8 } from "fs";
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 
 // src/services/warm-hook-logs-service.ts
 import { mkdir as mkdir15, readFile as readFile16, writeFile as writeFile6, readdir as readdir9, appendFile as appendFile4, unlink as unlink3 } from "fs/promises";
 import { homedir as homedir16 } from "os";
-import { join as join27 } from "path";
-var LOGS_DIR2 = join27(homedir16(), ".replicas", "warm-hook-logs");
-var CURRENT_RUN_LOG = join27(LOGS_DIR2, "current-run.log");
+import { join as join28 } from "path";
+var LOGS_DIR2 = join28(homedir16(), ".replicas", "warm-hook-logs");
+var CURRENT_RUN_LOG = join28(LOGS_DIR2, "current-run.log");
 var GLOBAL_FILENAME = "global.json";
 function withPreview2(stored) {
   const preview = buildHookOutputPreview(stored.output);
@@ -16020,7 +16037,7 @@ var WarmHookLogsService = class {
       hookName: "organization",
       ...entry
     };
-    await writeFile6(join27(LOGS_DIR2, GLOBAL_FILENAME), `${JSON.stringify(log, null, 2)}
+    await writeFile6(join28(LOGS_DIR2, GLOBAL_FILENAME), `${JSON.stringify(log, null, 2)}
 `, "utf-8");
   }
   async saveEnvironmentHookLog(entry) {
@@ -16030,7 +16047,7 @@ var WarmHookLogsService = class {
       hookName: "environment",
       ...entry
     };
-    await writeFile6(join27(LOGS_DIR2, ENVIRONMENT_HOOK_LOG_FILENAME), `${JSON.stringify(log, null, 2)}
+    await writeFile6(join28(LOGS_DIR2, ENVIRONMENT_HOOK_LOG_FILENAME), `${JSON.stringify(log, null, 2)}
 `, "utf-8");
   }
   async saveRepoHookLog(repoName, entry) {
@@ -16040,7 +16057,7 @@ var WarmHookLogsService = class {
       hookName: repoName,
       ...entry
     };
-    await writeFile6(join27(LOGS_DIR2, repoHookLogFilename(repoName)), `${JSON.stringify(log, null, 2)}
+    await writeFile6(join28(LOGS_DIR2, repoHookLogFilename(repoName)), `${JSON.stringify(log, null, 2)}
 `, "utf-8");
   }
   async getAllLogs() {
@@ -16059,7 +16076,7 @@ var WarmHookLogsService = class {
         continue;
       }
       try {
-        const raw = await readFile16(join27(LOGS_DIR2, file), "utf-8");
+        const raw = await readFile16(join28(LOGS_DIR2, file), "utf-8");
         const stored = JSON.parse(raw);
         logs.push(withPreview2(stored));
       } catch {
@@ -16097,7 +16114,7 @@ var WarmHookLogsService = class {
   async getFullOutput(hookType, hookName) {
     const filename = hookType === "global" ? GLOBAL_FILENAME : hookType === "environment" ? ENVIRONMENT_HOOK_LOG_FILENAME : repoHookLogFilename(hookName);
     try {
-      const raw = await readFile16(join27(LOGS_DIR2, filename), "utf-8");
+      const raw = await readFile16(join28(LOGS_DIR2, filename), "utf-8");
       const stored = JSON.parse(raw);
       if (stored.hookType !== hookType || stored.hookName !== hookName) {
         return null;
@@ -16116,7 +16133,7 @@ var warmHookLogsService = new WarmHookLogsService();
 // src/services/warm-hooks-service.ts
 async function readRepoWarmHook(repoPath) {
   for (const filename of REPLICAS_CONFIG_FILENAMES) {
-    const configPath = join28(repoPath, filename);
+    const configPath = join29(repoPath, filename);
     if (!existsSync8(configPath)) {
       continue;
     }
@@ -17378,7 +17395,7 @@ data: ${JSON.stringify("Terminal session not found")}
       const logFiles = files.filter((f) => f.endsWith(".log"));
       const sessions = await Promise.all(
         logFiles.map(async (filename) => {
-          const filePath = join29(LOG_DIR, filename);
+          const filePath = join30(LOG_DIR, filename);
           const fileStat = await stat7(filePath);
           const sessionId = filename.replace(/\.log$/, "");
           return {
@@ -17763,6 +17780,10 @@ serve(
     await timeStartupStep("chat_initialize", () => chatService.initialize());
     await timeStartupStep("preview_initialize", () => previewService.initialize());
     if (!IS_WARMING_MODE) {
+      await timeStartupStep(
+        "git_credential_helper_initialize",
+        () => configureManagedGitCredentialHelper(ENGINE_ENV.HOME_DIR)
+      );
       await timeStartupStep("github_token_initialize", () => githubTokenManager.start());
     }
     engineReady = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.532",
+  "version": "0.1.533",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",