replicas-engine 0.1.576 → 0.1.578

package/README.md

@@ -125,7 +125,7 @@ Credential files expected/used by provider CLIs:
 The engine calls monolith with:
 
 - `Authorization: Bearer <REPLICAS_ENGINE_SECRET>`
-- `X-Workspace-Id: <WORKSPACE_ID>`
+- `X-Workspace-Id: <REPLICAS_WORKSPACE_ID>`
 
 Outgoing endpoints:
 

package/dist/src/index.js

@@ -725,6 +725,18 @@ var WORKSPACE_SIZES = ["small", "large"];
 var INVALID_WORKSPACE_SIZE_ERROR = `Invalid size: must be one of ${WORKSPACE_SIZES.join(", ")}`;
 
 // ../shared/src/runtime-env.ts
+var REPLICAS_RUNTIME_ENV_ALIASES = {
+  monolithUrl: ["REPLICAS_MONOLITH_URL", "MONOLITH_URL"],
+  workspaceId: ["REPLICAS_WORKSPACE_ID", "WORKSPACE_ID"],
+  linearSessionId: ["REPLICAS_LINEAR_SESSION_ID", "LINEAR_SESSION_ID"],
+  linearAccessToken: ["REPLICAS_LINEAR_ACCESS_TOKEN", "LINEAR_ACCESS_TOKEN"],
+  slackBotToken: ["REPLICAS_SLACK_BOT_TOKEN", "SLACK_BOT_TOKEN"],
+  slackChannelId: ["REPLICAS_SLACK_CHANNEL_ID", "SLACK_CHANNEL_ID"],
+  slackThreadTs: ["REPLICAS_SLACK_THREAD_TS", "SLACK_THREAD_TS"]
+};
+function readReplicasRuntimeEnv(readEnv2, [namespacedKey, legacyKey]) {
+  return readEnv2(namespacedKey) ?? readEnv2(legacyKey);
+}
 function shellQuotePosix(value) {
   return `'${value.split("'").join("'\\''")}'`;
 }
@@ -785,6 +797,7 @@ function parsePosixEnvFile(content) {
 
 // ../shared/src/git.ts
 var GIT_CREDENTIAL_HELPER_FILENAME = ".git-credential-replicas";
+var GITHUB_CREDENTIAL_REFRESH_PATH = "/git-credentials/github/refresh";
 var GITLAB_CREDENTIAL_REFRESH_PATH = "/git-credentials/gitlab/refresh";
 function buildGitCredentialHelperScript(credentialsPath) {
   return `#!/bin/sh
@@ -795,18 +808,24 @@ get_credential() {
 ' "$request" | git credential-store --file=${shellQuotePosix(credentialsPath)} get
 }
 
-refresh_gitlab_credential() {
+refresh_credential() {
+  case "$1" in
+    x-access-token) refresh_path=${GITHUB_CREDENTIAL_REFRESH_PATH} ;;
+    oauth2) refresh_path=${GITLAB_CREDENTIAL_REFRESH_PATH} ;;
+    *) return 1 ;;
+  esac
   [ -n "\${REPLICAS_ENGINE_SECRET:-}" ] || return 1
   command -v curl >/dev/null 2>&1 || return 1
-  curl --silent --fail --connect-timeout 1 --max-time 5     -X POST     -H "X-Replicas-Engine-Secret: $REPLICAS_ENGINE_SECRET"     "http://127.0.0.1:\${REPLICAS_ENGINE_PORT:-3737}${GITLAB_CREDENTIAL_REFRESH_PATH}"     >/dev/null 2>&1
+  curl --silent --fail --connect-timeout 1 --max-time 5     -X POST     -H "X-Replicas-Engine-Secret: $REPLICAS_ENGINE_SECRET"     "http://127.0.0.1:\${REPLICAS_ENGINE_PORT:-3737}$refresh_path"     >/dev/null 2>&1
 }
 
 if [ "$1" = "get" ]; then
   credential=$(get_credential)
-  if printf '%s
+  username=$(printf '%s
 %s
-' "$request" "$credential" | grep -q '^username=oauth2$'; then
-    if refresh_gitlab_credential; then
+' "$request" "$credential" | sed -n 's/^username=//p' | head -n 1)
+  if [ -n "$username" ]; then
+    if refresh_credential "$username"; then
       refreshed_credential=$(get_credential)
       if [ -n "$refreshed_credential" ]; then
         credential=$refreshed_credential
@@ -815,9 +834,10 @@ if [ "$1" = "get" ]; then
   fi
   printf '%s
 ' "$credential"
-elif [ "$1" = "erase" ] && printf '%s
-' "$request" | grep -q '^username=oauth2$'; then
-  refresh_gitlab_credential || true
+elif [ "$1" = "erase" ]; then
+  username=$(printf '%s
+' "$request" | sed -n 's/^username=//p' | head -n 1)
+  refresh_credential "$username" || true
 fi
 exit 0
 `;
@@ -1573,9 +1593,9 @@ The integration is configured at the org or user level by the Replicas admin. Fr
 Quick check that the integration is connected:
 
 \`\`\`bash
-curl -s -X GET "$MONOLITH_URL/v1/gdrive/credentials" \\
+curl -s -X GET "$REPLICAS_MONOLITH_URL/v1/gdrive/credentials" \\
   -H "Authorization: Bearer $REPLICAS_ENGINE_SECRET" \\
-  -H "X-Workspace-Id: $WORKSPACE_ID"
+  -H "X-Workspace-Id: $REPLICAS_WORKSPACE_ID"
 \`\`\`
 
 - If \`hasCredentials\` is \`true\`: you're good to go.
@@ -1585,13 +1605,13 @@ Standard auth headers used by every call below:
 
 \`\`\`
 Authorization: Bearer $REPLICAS_ENGINE_SECRET
-X-Workspace-Id: $WORKSPACE_ID
+X-Workspace-Id: $REPLICAS_WORKSPACE_ID
 \`\`\`
 
 For brevity the examples below use a shell variable:
 
 \`\`\`bash
-GDRIVE_AUTH=(-H "Authorization: Bearer $REPLICAS_ENGINE_SECRET" -H "X-Workspace-Id: $WORKSPACE_ID")
+GDRIVE_AUTH=(-H "Authorization: Bearer $REPLICAS_ENGINE_SECRET" -H "X-Workspace-Id: $REPLICAS_WORKSPACE_ID")
 \`\`\`
 
 ## Important constraint: drive.file scope
@@ -1609,7 +1629,7 @@ If the user asks you to edit an existing doc that Replicas didn't create, tell t
 ### Create a new doc
 
 \`\`\`bash
-curl -s -X POST "$MONOLITH_URL/v1/gdrive/docs" "\${GDRIVE_AUTH[@]}" \\
+curl -s -X POST "$REPLICAS_MONOLITH_URL/v1/gdrive/docs" "\${GDRIVE_AUTH[@]}" \\
   -H "Content-Type: application/json" \\
   -d '{"title":"Meeting notes 2026-05-14"}'
 \`\`\`
@@ -1619,7 +1639,7 @@ Returns the full Doc object; grab \`.documentId\` for follow-up calls.
 ### Read a doc
 
 \`\`\`bash
-curl -s "$MONOLITH_URL/v1/gdrive/docs/$DOC_ID" "\${GDRIVE_AUTH[@]}"
+curl -s "$REPLICAS_MONOLITH_URL/v1/gdrive/docs/$DOC_ID" "\${GDRIVE_AUTH[@]}"
 \`\`\`
 
 Returns the full document structure \u2014 \`body.content\` is an ordered list of structural elements (paragraphs, tables, etc.) with character indexes you can target for edits.
@@ -1629,7 +1649,7 @@ Returns the full document structure \u2014 \`body.content\` is an ordered list o
 The Docs API edits use a list of [structural requests](https://developers.google.com/workspace/docs/api/reference/rest/v1/documents/request). Insert text, then style it; or insert tables, images, page breaks, etc.
 
 \`\`\`bash
-curl -s -X POST "$MONOLITH_URL/v1/gdrive/docs/$DOC_ID/batchUpdate" "\${GDRIVE_AUTH[@]}" \\
+curl -s -X POST "$REPLICAS_MONOLITH_URL/v1/gdrive/docs/$DOC_ID/batchUpdate" "\${GDRIVE_AUTH[@]}" \\
   -H "Content-Type: application/json" \\
   -d '{
     "requests": [
@@ -1656,7 +1676,7 @@ Edits are verbose but powerful. Prefer batching many requests into a single \`ba
 ### Create a new spreadsheet
 
 \`\`\`bash
-curl -s -X POST "$MONOLITH_URL/v1/gdrive/sheets" "\${GDRIVE_AUTH[@]}" \\
+curl -s -X POST "$REPLICAS_MONOLITH_URL/v1/gdrive/sheets" "\${GDRIVE_AUTH[@]}" \\
   -H "Content-Type: application/json" \\
   -d '{"title":"Q2 metrics"}'
 \`\`\`
@@ -1667,7 +1687,7 @@ Returns the full Spreadsheet object; grab \`.spreadsheetId\`.
 
 \`\`\`bash
 # Range is in A1 notation, e.g. "Sheet1!A1:C10"
-curl -s "$MONOLITH_URL/v1/gdrive/sheets/$SHEET_ID/values/$(printf %s 'Sheet1!A1:C10' | jq -sRr @uri)" \\
+curl -s "$REPLICAS_MONOLITH_URL/v1/gdrive/sheets/$SHEET_ID/values/$(printf %s 'Sheet1!A1:C10' | jq -sRr @uri)" \\
   "\${GDRIVE_AUTH[@]}"
 \`\`\`
 
@@ -1675,7 +1695,7 @@ curl -s "$MONOLITH_URL/v1/gdrive/sheets/$SHEET_ID/values/$(printf %s 'Sheet1!A1:
 
 \`\`\`bash
 curl -s -X PUT \\
-  "$MONOLITH_URL/v1/gdrive/sheets/$SHEET_ID/values/$(printf %s 'Sheet1!A1:B2' | jq -sRr @uri)?valueInputOption=USER_ENTERED" \\
+  "$REPLICAS_MONOLITH_URL/v1/gdrive/sheets/$SHEET_ID/values/$(printf %s 'Sheet1!A1:B2' | jq -sRr @uri)?valueInputOption=USER_ENTERED" \\
   "\${GDRIVE_AUTH[@]}" \\
   -H "Content-Type: application/json" \\
   -d '{
@@ -1693,7 +1713,7 @@ curl -s -X PUT \\
 ### Bulk operations (formatting, charts, new tabs, etc.)
 
 \`\`\`bash
-curl -s -X POST "$MONOLITH_URL/v1/gdrive/sheets/$SHEET_ID/batchUpdate" "\${GDRIVE_AUTH[@]}" \\
+curl -s -X POST "$REPLICAS_MONOLITH_URL/v1/gdrive/sheets/$SHEET_ID/batchUpdate" "\${GDRIVE_AUTH[@]}" \\
   -H "Content-Type: application/json" \\
   -d '{ "requests": [ { "addSheet": { "properties": { "title": "Raw data" } } } ] }'
 \`\`\`
@@ -1705,7 +1725,7 @@ curl -s -X POST "$MONOLITH_URL/v1/gdrive/sheets/$SHEET_ID/batchUpdate" "\${GDRIV
 ### Create a new form
 
 \`\`\`bash
-curl -s -X POST "$MONOLITH_URL/v1/gdrive/forms" "\${GDRIVE_AUTH[@]}" \\
+curl -s -X POST "$REPLICAS_MONOLITH_URL/v1/gdrive/forms" "\${GDRIVE_AUTH[@]}" \\
   -H "Content-Type: application/json" \\
   -d '{"title":"Customer feedback"}'
 \`\`\`
@@ -1717,7 +1737,7 @@ Returns the form. Grab \`.formId\`.
 The Forms API uses its own \`batchUpdate\`:
 
 \`\`\`bash
-curl -s -X POST "$MONOLITH_URL/v1/gdrive/forms/$FORM_ID/batchUpdate" "\${GDRIVE_AUTH[@]}" \\
+curl -s -X POST "$REPLICAS_MONOLITH_URL/v1/gdrive/forms/$FORM_ID/batchUpdate" "\${GDRIVE_AUTH[@]}" \\
   -H "Content-Type: application/json" \\
   -d '{
     "requests": [
@@ -1744,7 +1764,7 @@ See the [Forms API Request reference](https://developers.google.com/workspace/fo
 ### Read responses
 
 \`\`\`bash
-curl -s "$MONOLITH_URL/v1/gdrive/forms/$FORM_ID/responses" "\${GDRIVE_AUTH[@]}"
+curl -s "$REPLICAS_MONOLITH_URL/v1/gdrive/forms/$FORM_ID/responses" "\${GDRIVE_AUTH[@]}"
 \`\`\`
 
 Pagination: pass \`?pageToken=...&pageSize=...\` to walk through responses.
@@ -1754,7 +1774,7 @@ Pagination: pass \`?pageToken=...&pageSize=...\` to walk through responses.
 ### Share a file with a person
 
 \`\`\`bash
-curl -s -X POST "$MONOLITH_URL/v1/gdrive/files/$FILE_ID/permissions" "\${GDRIVE_AUTH[@]}" \\
+curl -s -X POST "$REPLICAS_MONOLITH_URL/v1/gdrive/files/$FILE_ID/permissions" "\${GDRIVE_AUTH[@]}" \\
   -H "Content-Type: application/json" \\
   -d '{
     "type": "user",
@@ -1769,7 +1789,7 @@ Roles: \`reader\`, \`commenter\`, \`writer\`. Types: \`user\`, \`group\`, \`doma
 ### Make a file viewable by anyone with the link
 
 \`\`\`bash
-curl -s -X POST "$MONOLITH_URL/v1/gdrive/files/$FILE_ID/permissions" "\${GDRIVE_AUTH[@]}" \\
+curl -s -X POST "$REPLICAS_MONOLITH_URL/v1/gdrive/files/$FILE_ID/permissions" "\${GDRIVE_AUTH[@]}" \\
   -H "Content-Type: application/json" \\
   -d '{ "type": "anyone", "role": "reader" }'
 \`\`\`
@@ -1777,13 +1797,13 @@ curl -s -X POST "$MONOLITH_URL/v1/gdrive/files/$FILE_ID/permissions" "\${GDRIVE_
 ### List existing permissions
 
 \`\`\`bash
-curl -s "$MONOLITH_URL/v1/gdrive/files/$FILE_ID/permissions" "\${GDRIVE_AUTH[@]}"
+curl -s "$REPLICAS_MONOLITH_URL/v1/gdrive/files/$FILE_ID/permissions" "\${GDRIVE_AUTH[@]}"
 \`\`\`
 
 ### Rename / move a file
 
 \`\`\`bash
-curl -s -X PATCH "$MONOLITH_URL/v1/gdrive/files/$FILE_ID" "\${GDRIVE_AUTH[@]}" \\
+curl -s -X PATCH "$REPLICAS_MONOLITH_URL/v1/gdrive/files/$FILE_ID" "\${GDRIVE_AUTH[@]}" \\
   -H "Content-Type: application/json" \\
   -d '{"name":"Final report.docx"}'
 \`\`\`
@@ -1793,7 +1813,7 @@ To move into a folder, also pass \`addParents\` and \`removeParents\` as query p
 ### Get file metadata
 
 \`\`\`bash
-curl -s "$MONOLITH_URL/v1/gdrive/files/$FILE_ID?fields=id,name,mimeType,webViewLink,parents,modifiedTime" \\
+curl -s "$REPLICAS_MONOLITH_URL/v1/gdrive/files/$FILE_ID?fields=id,name,mimeType,webViewLink,parents,modifiedTime" \\
   "\${GDRIVE_AUTH[@]}"
 \`\`\`
 
@@ -1802,13 +1822,13 @@ curl -s "$MONOLITH_URL/v1/gdrive/files/$FILE_ID?fields=id,name,mimeType,webViewL
 ### Delete a file
 
 \`\`\`bash
-curl -s -X DELETE "$MONOLITH_URL/v1/gdrive/files/$FILE_ID" "\${GDRIVE_AUTH[@]}"
+curl -s -X DELETE "$REPLICAS_MONOLITH_URL/v1/gdrive/files/$FILE_ID" "\${GDRIVE_AUTH[@]}"
 \`\`\`
 
 ### List Replicas-created files
 
 \`\`\`bash
-curl -s "$MONOLITH_URL/v1/gdrive/files?pageSize=50" "\${GDRIVE_AUTH[@]}"
+curl -s "$REPLICAS_MONOLITH_URL/v1/gdrive/files?pageSize=50" "\${GDRIVE_AUTH[@]}"
 \`\`\`
 
 Pass \`?q=...\` to filter using [Drive API search syntax](https://developers.google.com/workspace/drive/api/guides/search-files). Only files the app created or was granted access to will appear.
@@ -1822,20 +1842,20 @@ Property identifiers must be URL-encoded as query parameters. URL-prefix propert
 ### List accessible properties
 
 \`\`\`bash
-curl -s "$MONOLITH_URL/v1/gdrive/search-console/sites" "\${GDRIVE_AUTH[@]}"
+curl -s "$REPLICAS_MONOLITH_URL/v1/gdrive/search-console/sites" "\${GDRIVE_AUTH[@]}"
 \`\`\`
 
 ### Get a property
 
 \`\`\`bash
 SITE_URL=$(printf %s 'sc-domain:example.com' | jq -sRr @uri)
-curl -s "$MONOLITH_URL/v1/gdrive/search-console/site?siteUrl=$SITE_URL" "\${GDRIVE_AUTH[@]}"
+curl -s "$REPLICAS_MONOLITH_URL/v1/gdrive/search-console/site?siteUrl=$SITE_URL" "\${GDRIVE_AUTH[@]}"
 \`\`\`
 
 ### Query search performance
 
 \`\`\`bash
-curl -s -X POST "$MONOLITH_URL/v1/gdrive/search-console/search-analytics/query?siteUrl=$SITE_URL" "\${GDRIVE_AUTH[@]}" \\
+curl -s -X POST "$REPLICAS_MONOLITH_URL/v1/gdrive/search-console/search-analytics/query?siteUrl=$SITE_URL" "\${GDRIVE_AUTH[@]}" \\
   -H "Content-Type: application/json" \\
   -d '{
     "startDate": "2026-06-01",
@@ -1850,7 +1870,7 @@ Results contain clicks, impressions, CTR, and average position. Use \`startRow\`
 ### List sitemaps
 
 \`\`\`bash
-curl -s "$MONOLITH_URL/v1/gdrive/search-console/sitemaps?siteUrl=$SITE_URL" "\${GDRIVE_AUTH[@]}"
+curl -s "$REPLICAS_MONOLITH_URL/v1/gdrive/search-console/sitemaps?siteUrl=$SITE_URL" "\${GDRIVE_AUTH[@]}"
 \`\`\`
 
 Pass a URL-encoded \`sitemapIndex\` query parameter to list sitemaps referenced by a sitemap index. To fetch one sitemap, call \`/v1/gdrive/search-console/sitemap\` with URL-encoded \`siteUrl\` and \`feedpath\` query parameters.
@@ -1858,7 +1878,7 @@ Pass a URL-encoded \`sitemapIndex\` query parameter to list sitemaps referenced
 ### Inspect an indexed URL
 
 \`\`\`bash
-curl -s -X POST "$MONOLITH_URL/v1/gdrive/search-console/url-inspection" "\${GDRIVE_AUTH[@]}" \\
+curl -s -X POST "$REPLICAS_MONOLITH_URL/v1/gdrive/search-console/url-inspection" "\${GDRIVE_AUTH[@]}" \\
   -H "Content-Type: application/json" \\
   -d '{
     "inspectionUrl": "https://example.com/page",
@@ -1929,7 +1949,7 @@ This guide covers how to interact with Linear from within your Replicas workspac
 Check that the workspace has the Replicas engine credentials needed to proxy Linear requests:
 
 \`\`\`bash
-test -n "$MONOLITH_URL" && test -n "$REPLICAS_ENGINE_SECRET" && test -n "$WORKSPACE_ID" && echo set
+test -n "$REPLICAS_MONOLITH_URL" && test -n "$REPLICAS_ENGINE_SECRET" && test -n "$REPLICAS_WORKSPACE_ID" && echo set
 \`\`\`
 
 - If **set**: Use the Replicas Linear proxy below. It refreshes Linear OAuth tokens for you.
@@ -1938,9 +1958,9 @@ test -n "$MONOLITH_URL" && test -n "$REPLICAS_ENGINE_SECRET" && test -n "$WORKSP
 Then verify Linear is connected:
 
 \`\`\`bash
-curl -fsS -X POST "$MONOLITH_URL/v1/engine/linear/refresh-token" \\
+curl -fsS -X POST "$REPLICAS_MONOLITH_URL/v1/engine/linear/refresh-token" \\
   -H "Authorization: Bearer $REPLICAS_ENGINE_SECRET" \\
-  -H "X-Workspace-Id: $WORKSPACE_ID" \\
+  -H "X-Workspace-Id: $REPLICAS_WORKSPACE_ID" \\
   -H "Content-Type: application/json" \\
   -d '{}' >/dev/null
 \`\`\`
@@ -1953,9 +1973,9 @@ Linear uses a GraphQL API. Always call it through Replicas so the access token s
 
 \`\`\`bash
 linear_graphql() {
-  curl -sS -X POST "$MONOLITH_URL/v1/engine/linear/graphql" \\
+  curl -sS -X POST "$REPLICAS_MONOLITH_URL/v1/engine/linear/graphql" \\
     -H "Authorization: Bearer $REPLICAS_ENGINE_SECRET" \\
-    -H "X-Workspace-Id: $WORKSPACE_ID" \\
+    -H "X-Workspace-Id: $REPLICAS_WORKSPACE_ID" \\
     -H "Content-Type: application/json" \\
     --data-binary @-
 }
@@ -2143,7 +2163,7 @@ LENGTH=$(stat -c%s "$FILE" 2>/dev/null || stat -f%z "$FILE")
 
 # 1. Reserve an upload URL + file ID.
 RESERVE=$(curl -s -G "https://slack.com/api/files.getUploadURLExternal" \\
-  -H "Authorization: Bearer $REPLICAS_SLACK_BOT_TOKEN" \\
+  -H "Authorization: Bearer \${REPLICAS_SLACK_BOT_TOKEN:-$SLACK_BOT_TOKEN}" \\
   --data-urlencode "filename=$FILENAME" \\
   --data-urlencode "length=$LENGTH")
 UPLOAD_URL=$(echo "$RESERVE" | jq -r '.upload_url')
@@ -2158,7 +2178,7 @@ curl -s -X POST "$UPLOAD_URL" \\
 
 # 3. Complete the upload, sharing it into the channel/thread with the dashboard link.
 curl -s -X POST "https://slack.com/api/files.completeUploadExternal" \\
-  -H "Authorization: Bearer $REPLICAS_SLACK_BOT_TOKEN" \\
+  -H "Authorization: Bearer \${REPLICAS_SLACK_BOT_TOKEN:-$SLACK_BOT_TOKEN}" \\
   -H "Content-Type: application/json; charset=utf-8" \\
   -d "{
     \\"files\\": [{\\"id\\": \\"$FILE_ID\\", \\"title\\": \\"Screenshot\\"}],
@@ -2192,9 +2212,9 @@ ISSUE_UUID=...           # the Linear issue's UUID
 MEDIA_ID=...             # the media ID printed by \`replicas media upload\`
 
 linear_graphql() {
-  curl -sS -X POST "$MONOLITH_URL/v1/engine/linear/graphql" \\
+  curl -sS -X POST "$REPLICAS_MONOLITH_URL/v1/engine/linear/graphql" \\
     -H "Authorization: Bearer $REPLICAS_ENGINE_SECRET" \\
-    -H "X-Workspace-Id: $WORKSPACE_ID" \\
+    -H "X-Workspace-Id: $REPLICAS_WORKSPACE_ID" \\
     -H "Content-Type: application/json" \\
     --data-binary @-
 }
@@ -2225,7 +2245,7 @@ curl -s -X PUT "$UPLOAD_URL" \\
 
 # 3. Reference assetUrl inline in the comment body, alongside the dashboard link.
 BODY=$(printf '![screenshot](%s)\\n\\n[View in Replicas](https://tryreplicas.com/workspaces/%s?media=%s)' \\
-  "$ASSET_URL" "$WORKSPACE_ID" "$MEDIA_ID")
+  "$ASSET_URL" "$REPLICAS_WORKSPACE_ID" "$MEDIA_ID")
 
 jq -n \\
     --arg issueId "$ISSUE_UUID" \\
@@ -2669,10 +2689,10 @@ This guide covers how to interact with Slack from within your Replicas workspace
 
 ## Prerequisites
 
-Check if the \`REPLICAS_SLACK_BOT_TOKEN\` environment variable is set:
+Check if the namespaced or legacy Slack token environment variable is set:
 
 \`\`\`bash
-echo "\${REPLICAS_SLACK_BOT_TOKEN:+set}"
+if [ -n "\${REPLICAS_SLACK_BOT_TOKEN:-$SLACK_BOT_TOKEN}" ]; then echo set; fi
 \`\`\`
 
 - If **set**: Your workspace has Slack access. You can use the Slack Web API as described below.
@@ -2680,7 +2700,7 @@ echo "\${REPLICAS_SLACK_BOT_TOKEN:+set}"
 
 ## Using the Slack API
 
-All requests use the \`$REPLICAS_SLACK_BOT_TOKEN\` for authentication via the Slack Web API.
+All requests prefer \`$REPLICAS_SLACK_BOT_TOKEN\` and fall back to \`$SLACK_BOT_TOKEN\` for compatibility with older workspaces.
 
 ### Fetching a Thread from a Slack Link
 
@@ -2691,14 +2711,14 @@ If you encounter a Slack message link (e.g. \`https://team.slack.com/archives/C0
 
 \`\`\`bash
 curl -s "https://slack.com/api/conversations.replies?channel=CHANNEL_ID&ts=THREAD_TS" \\
-  -H "Authorization: Bearer $REPLICAS_SLACK_BOT_TOKEN"
+  -H "Authorization: Bearer \${REPLICAS_SLACK_BOT_TOKEN:-$SLACK_BOT_TOKEN}"
 \`\`\`
 
 ### Sending a Message
 
 \`\`\`bash
 curl -s -X POST "https://slack.com/api/chat.postMessage" \\
-  -H "Authorization: Bearer $REPLICAS_SLACK_BOT_TOKEN" \\
+  -H "Authorization: Bearer \${REPLICAS_SLACK_BOT_TOKEN:-$SLACK_BOT_TOKEN}" \\
   -H "Content-Type: application/json" \\
   -d '{
     "channel": "CHANNEL_ID",
@@ -2731,13 +2751,13 @@ replicas list
 replicas slack thread switch <workspace-id-or-name> --channel <channel-id> --thread-ts <thread-root-ts>
 \`\`\`
 
-The channel and thread flags default to \`SLACK_CHANNEL_ID\` and \`SLACK_THREAD_TS\` for a Slack-triggered workspace. Workspace-authenticated agents may target only their current workspace; switching to a different workspace requires running the command with user authentication outside agent mode. If that restriction applies, give the user the exact command to run rather than claiming the switch succeeded.
+The channel and thread flags default to \`REPLICAS_SLACK_CHANNEL_ID\` and \`REPLICAS_SLACK_THREAD_TS\` for a Slack-triggered workspace. Workspace-authenticated agents may target only their current workspace; switching to a different workspace requires running the command with user authentication outside agent mode. If that restriction applies, give the user the exact command to run rather than claiming the switch succeeded.
 
 ### Searching Messages
 
 \`\`\`bash
 curl -s "https://slack.com/api/search.messages?query=YOUR_SEARCH_QUERY" \\
-  -H "Authorization: Bearer $REPLICAS_SLACK_BOT_TOKEN"
+  -H "Authorization: Bearer \${REPLICAS_SLACK_BOT_TOKEN:-$SLACK_BOT_TOKEN}"
 \`\`\`
 
 ### Uploading Files
@@ -2751,7 +2771,7 @@ LENGTH=$(stat -c%s "$FILE" 2>/dev/null || stat -f%z "$FILE")
 
 # 1. Reserve an upload URL + file ID.
 RESERVE=$(curl -s -G "https://slack.com/api/files.getUploadURLExternal" \\
-  -H "Authorization: Bearer $REPLICAS_SLACK_BOT_TOKEN" \\
+  -H "Authorization: Bearer \${REPLICAS_SLACK_BOT_TOKEN:-$SLACK_BOT_TOKEN}" \\
   --data-urlencode "filename=$FILENAME" \\
   --data-urlencode "length=$LENGTH")
 UPLOAD_URL=$(echo "$RESERVE" | jq -r '.upload_url')
@@ -2766,7 +2786,7 @@ curl -s -X POST "$UPLOAD_URL" \\
 
 # 3. Complete the upload and share into a channel (and optionally a thread).
 curl -s -X POST "https://slack.com/api/files.completeUploadExternal" \\
-  -H "Authorization: Bearer $REPLICAS_SLACK_BOT_TOKEN" \\
+  -H "Authorization: Bearer \${REPLICAS_SLACK_BOT_TOKEN:-$SLACK_BOT_TOKEN}" \\
   -H "Content-Type: application/json; charset=utf-8" \\
   -d "{
     \\"files\\": [{\\"id\\": \\"$FILE_ID\\", \\"title\\": \\"File title\\"}],
@@ -5659,17 +5679,20 @@ function loadEngineEnv() {
     // Defined: always available
     REPLICAS_ENGINE_SECRET: requireDefined(readEnv("REPLICAS_ENGINE_SECRET"), "REPLICAS_ENGINE_SECRET"),
     REPLICAS_ENGINE_PORT: parsePort(readEnv("REPLICAS_ENGINE_PORT")),
-    MONOLITH_URL: requireValidURL(requireDefined(readEnv("MONOLITH_URL"), "MONOLITH_URL"), "MONOLITH_URL"),
+    REPLICAS_MONOLITH_URL: requireValidURL(
+      requireDefined(readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.monolithUrl), "REPLICAS_MONOLITH_URL"),
+      "REPLICAS_MONOLITH_URL"
+    ),
     HOME_DIR,
     WORKSPACE_ROOT: join2(HOME_DIR, "workspaces"),
     REPLICAS_SANDBOX_IMAGE_VERSION: readEnv("REPLICAS_SANDBOX_IMAGE_VERSION") ?? "development",
     // Runtime: may not be set during warming
-    WORKSPACE_ID: readEnv("WORKSPACE_ID"),
-    LINEAR_SESSION_ID: readEnv("LINEAR_SESSION_ID"),
-    LINEAR_ACCESS_TOKEN: readEnv("LINEAR_ACCESS_TOKEN"),
-    REPLICAS_SLACK_BOT_TOKEN: readEnv("REPLICAS_SLACK_BOT_TOKEN"),
-    SLACK_CHANNEL_ID: readEnv("SLACK_CHANNEL_ID"),
-    SLACK_THREAD_TS: readEnv("SLACK_THREAD_TS"),
+    REPLICAS_WORKSPACE_ID: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.workspaceId),
+    REPLICAS_LINEAR_SESSION_ID: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.linearSessionId),
+    REPLICAS_LINEAR_ACCESS_TOKEN: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.linearAccessToken),
+    REPLICAS_SLACK_BOT_TOKEN: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.slackBotToken),
+    REPLICAS_SLACK_CHANNEL_ID: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.slackChannelId),
+    REPLICAS_SLACK_THREAD_TS: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.slackThreadTs),
     ANTHROPIC_API_KEY: readEnv("ANTHROPIC_API_KEY"),
     OPENAI_API_KEY: readEnv("OPENAI_API_KEY"),
     CURSOR_API_KEY: readEnv("CURSOR_API_KEY"),
@@ -5686,8 +5709,8 @@ function loadEngineEnv() {
     REPLICAS_DISABLE_AUTO_START_HOOKS: readEnv("REPLICAS_DISABLE_AUTO_START_HOOKS")?.toLowerCase() === "true",
     REPLICAS_ENGINE_DEFER_INITIALIZATION: readEnv("REPLICAS_ENGINE_DEFER_INITIALIZATION")?.toLowerCase() === "true"
   };
-  if (!IS_WARMING_MODE && !env.WORKSPACE_ID) {
-    console.error("WORKSPACE_ID is not set \u2014 this is required in normal (non-warming) mode");
+  if (!IS_WARMING_MODE && !env.REPLICAS_WORKSPACE_ID) {
+    console.error("REPLICAS_WORKSPACE_ID is not set \u2014 this is required in normal (non-warming) mode");
   }
   return env;
 }
@@ -5773,12 +5796,12 @@ var BaseRefreshManager = class {
     return this.intervalMs;
   }
   getRuntimeConfig() {
-    if (!ENGINE_ENV.WORKSPACE_ID) {
+    if (!ENGINE_ENV.REPLICAS_WORKSPACE_ID) {
       return null;
     }
     return {
-      monolithUrl: ENGINE_ENV.MONOLITH_URL,
-      workspaceId: ENGINE_ENV.WORKSPACE_ID,
+      monolithUrl: ENGINE_ENV.REPLICAS_MONOLITH_URL,
+      workspaceId: ENGINE_ENV.REPLICAS_WORKSPACE_ID,
       engineSecret: ENGINE_ENV.REPLICAS_ENGINE_SECRET
     };
   }
@@ -5816,16 +5839,16 @@ var BaseRefreshManager = class {
 
 // src/services/monolith-service.ts
 async function monolithRequest(path6, init = {}) {
-  if (!ENGINE_ENV.WORKSPACE_ID) {
-    throw new Error("WORKSPACE_ID is not set; cannot call monolith");
+  if (!ENGINE_ENV.REPLICAS_WORKSPACE_ID) {
+    throw new Error("REPLICAS_WORKSPACE_ID is not set; cannot call monolith");
   }
   const isFormData = init.body instanceof FormData;
   const headers = {
     Authorization: `Bearer ${ENGINE_ENV.REPLICAS_ENGINE_SECRET}`,
-    "X-Workspace-Id": ENGINE_ENV.WORKSPACE_ID
+    "X-Workspace-Id": ENGINE_ENV.REPLICAS_WORKSPACE_ID
   };
   if (!isFormData) headers["Content-Type"] = "application/json";
-  return fetch(`${ENGINE_ENV.MONOLITH_URL}${path6}`, {
+  return fetch(`${ENGINE_ENV.REPLICAS_MONOLITH_URL}${path6}`, {
     method: init.method ?? "POST",
     headers,
     body: init.body === void 0 ? void 0 : isFormData ? init.body : JSON.stringify(init.body),
@@ -5858,7 +5881,7 @@ var MonolithService = class {
     }
   }
   async sendEvent(event) {
-    if (!ENGINE_ENV.WORKSPACE_ID) {
+    if (!ENGINE_ENV.REPLICAS_WORKSPACE_ID) {
       return;
     }
     try {
@@ -7303,7 +7326,9 @@ var EnvironmentDetailsService = class {
     details.githubCredentialsConfigured = ghConfigured;
     details.gitlabAccessConfigured = gitlabAccessConfigured;
     details.gitlabCredentialsConfigured = gitlabAccessConfigured;
-    details.linearAccessConfigured = Boolean(ENGINE_ENV.LINEAR_SESSION_ID || ENGINE_ENV.LINEAR_ACCESS_TOKEN);
+    details.linearAccessConfigured = Boolean(
+      ENGINE_ENV.REPLICAS_LINEAR_SESSION_ID || ENGINE_ENV.REPLICAS_LINEAR_ACCESS_TOKEN
+    );
     details.slackAccessConfigured = Boolean(ENGINE_ENV.REPLICAS_SLACK_BOT_TOKEN);
     const freshRepos = repositories.map((repo) => ({
       repositoryName: repo.name,
@@ -8030,7 +8055,7 @@ async function attemptRegistration() {
   }
 }
 async function registerDesktopPreview() {
-  if (IS_WARMING_MODE || !ENGINE_ENV.WORKSPACE_ID) {
+  if (IS_WARMING_MODE || !ENGINE_ENV.REPLICAS_WORKSPACE_ID) {
     return;
   }
   const deadline = Date.now() + REGISTRATION_TIMEOUT_MS;
@@ -8472,13 +8497,13 @@ async function getLinearAccessToken() {
     const response = await monolithRequest("/v1/engine/linear/refresh-token");
     if (!response.ok) {
       console.warn(`[ImageUtils] Failed to refresh Linear token: ${response.status} ${await response.text()}`);
-      return ENGINE_ENV.LINEAR_ACCESS_TOKEN;
+      return ENGINE_ENV.REPLICAS_LINEAR_ACCESS_TOKEN;
     }
     const data = await response.json();
     return data.token;
   } catch (error) {
     console.warn("[ImageUtils] Failed to refresh Linear token:", error);
-    return ENGINE_ENV.LINEAR_ACCESS_TOKEN;
+    return ENGINE_ENV.REPLICAS_LINEAR_ACCESS_TOKEN;
   }
 }
 function isLinearUploadUrl(url) {
@@ -8905,7 +8930,7 @@ var CodingAgentManager = class {
     };
   }
   emitInterruptedQueueEvent(queue) {
-    const linearSessionId = ENGINE_ENV.LINEAR_SESSION_ID;
+    const linearSessionId = ENGINE_ENV.REPLICAS_LINEAR_SESSION_ID;
     if (!linearSessionId || queue.length === 0) {
       return;
     }
@@ -10247,7 +10272,7 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
     this.activeSessionSignature = signature;
     this.activeSessionModel = claudeCodeModel;
     this.activeSessionPermissionMode = resolvedPermissionMode;
-    this.sessionLinearForwarder = new LinearEventForwarder(ENGINE_ENV.LINEAR_SESSION_ID);
+    this.sessionLinearForwarder = new LinearEventForwarder(ENGINE_ENV.REPLICAS_LINEAR_SESSION_ID);
     this.activeBackgroundTasks.clear();
     this.clearBackgroundContinuationTimer();
     resetClaudeSessionActivity(this.sessionActivity);
@@ -10261,7 +10286,7 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
     });
   }
   async runSessionLoop(response) {
-    const linearSessionId = ENGINE_ENV.LINEAR_SESSION_ID;
+    const linearSessionId = ENGINE_ENV.REPLICAS_LINEAR_SESSION_ID;
     const iterator = response[Symbol.asyncIterator]();
     let loopError = null;
     let suppressLinearResponseFlush = false;
@@ -10854,7 +10879,7 @@ var DEFAULT_CODEX_ARGS = ["app-server", "--listen", "stdio://"];
 var MIN_CODEX_CLI_VERSION = "0.144.6";
 var CODEX_UPGRADE_TIMEOUT_MS = 12e4;
 var codexCliVersionEnsured = null;
-var ENGINE_PACKAGE_VERSION = "0.1.576";
+var ENGINE_PACKAGE_VERSION = "0.1.578";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";
@@ -12321,7 +12346,7 @@ var CodexAspManager = class extends CodingAgentManager {
     let goalContinuationTimer = null;
     const completedItems = [];
     const agentMessageDeltas = /* @__PURE__ */ new Map();
-    const linearSessionId = ENGINE_ENV.LINEAR_SESSION_ID;
+    const linearSessionId = ENGINE_ENV.REPLICAS_LINEAR_SESSION_ID;
     const model = request.model ?? DEFAULT_MODEL;
     let tempImagePaths = [];
     const linearForwarder = new LinearEventForwarder(linearSessionId);
@@ -13274,7 +13299,7 @@ var CursorManager = class extends CodingAgentManager {
     const aborted = new Promise((resolve4) => {
       this.abortActiveTurn = () => resolve4(TURN_ABORTED);
     });
-    const linearSessionId = ENGINE_ENV.LINEAR_SESSION_ID;
+    const linearSessionId = ENGINE_ENV.REPLICAS_LINEAR_SESSION_ID;
     const linearForwarder = new LinearEventForwarder(linearSessionId);
     try {
       const includeInstructions = !this.initialSessionId && !this.instructionsDelivered;
@@ -13973,7 +13998,7 @@ var OpencodeManager = class extends CodingAgentManager {
   async processMessageInternal(request) {
     const provider = await getOpencodeProvider();
     const controller = new AbortController();
-    const linearSessionId = ENGINE_ENV.LINEAR_SESSION_ID;
+    const linearSessionId = ENGINE_ENV.REPLICAS_LINEAR_SESSION_ID;
     const linearForwarder = new LinearEventForwarder(linearSessionId);
     this.activeAbortController = controller;
     this.activeLinearForwarder = linearForwarder;
@@ -14272,7 +14297,7 @@ var OpencodeManager = class extends CodingAgentManager {
     return false;
   }
   forwardOpencodePartToLinear(part) {
-    const linearSessionId = ENGINE_ENV.LINEAR_SESSION_ID;
+    const linearSessionId = ENGINE_ENV.REPLICAS_LINEAR_SESSION_ID;
     if (!linearSessionId || !this.activeLinearForwarder) return;
     const event = convertOpencodePart(part, linearSessionId);
     if (!event) return;
@@ -15406,7 +15431,7 @@ var KeepAliveService = class _KeepAliveService {
     await this.ping();
   }
   async ping() {
-    if (!ENGINE_ENV.MONOLITH_URL || !ENGINE_ENV.REPLICAS_ENGINE_SECRET || !ENGINE_ENV.WORKSPACE_ID) {
+    if (!ENGINE_ENV.REPLICAS_MONOLITH_URL || !ENGINE_ENV.REPLICAS_ENGINE_SECRET || !ENGINE_ENV.REPLICAS_WORKSPACE_ID) {
       return;
     }
     try {
@@ -16741,7 +16766,7 @@ var ChatService = class {
       gitlabTokenManager.refreshOnce().catch(() => {
       })
     ]);
-    const linearSessionId = ENGINE_ENV.LINEAR_SESSION_ID;
+    const linearSessionId = ENGINE_ENV.REPLICAS_LINEAR_SESSION_ID;
     const observedBranches = chat.observedBranchesByRepo;
     chat.observedBranchesByRepo = /* @__PURE__ */ new Map();
     const errors = chat.persisted.parentChatId === null ? chat.lastTurnErrors : null;
@@ -18505,7 +18530,7 @@ var HeartbeatService = class _HeartbeatService {
   static HEARTBEAT_INTERVAL_MS = 15e3;
   static REQUEST_TIMEOUT_MS = 5e3;
   start(bootTimeMs2) {
-    if (IS_WARMING_MODE || !ENGINE_ENV.WORKSPACE_ID || this.interval) return;
+    if (IS_WARMING_MODE || !ENGINE_ENV.REPLICAS_WORKSPACE_ID || this.interval) return;
     this.bootTimeMs = bootTimeMs2;
     void this.ping();
     this.interval = setInterval(() => {
@@ -18689,6 +18714,16 @@ app.get("/token-refresh/health", async (c) => {
     infisical: infisicalTokenManager.getHealthStatus()
   });
 });
+app.post(GITHUB_CREDENTIAL_REFRESH_PATH, async (c) => {
+  const result = await githubTokenManager.refreshOnce();
+  if (!result.ok) {
+    return c.json({
+      error: "Failed to refresh GitHub credentials",
+      details: result.error.message
+    }, 502);
+  }
+  return c.body(null, 204);
+});
 app.post(GITLAB_CREDENTIAL_REFRESH_PATH, async (c) => {
   const result = await gitlabTokenManager.refreshOnce();
   if (!result.ok) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.576",
+  "version": "0.1.578",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",