replicas-engine 0.1.595 → 0.1.597

package/dist/src/index.js

@@ -17,8 +17,8 @@ async function raceWithTimeout(promise, ms) {
   try {
     return await Promise.race([
       promise,
-      new Promise((resolve4) => {
-        timer = setTimeout(() => resolve4(TIMEOUT), ms);
+      new Promise((resolve5) => {
+        timer = setTimeout(() => resolve5(TIMEOUT), ms);
       })
     ]);
   } finally {
@@ -1327,7 +1327,7 @@ var DOCKER_ABILITY = {
 
 // ../shared/src/default-skills/replicas-agent/abilities/github.ts
 var SECTION3 = `### GitHub
-Use the pre-authenticated \`gh\` CLI for pull requests, issues, actions, and API calls.
+Use the pre-authenticated \`gh\` CLI for repository workflows and the workspace-scoped TypeScript SDK for GitHub API calls.
 
 **Reference:** \`references/GITHUB.md\`
 
@@ -1338,7 +1338,7 @@ Use this when:
 - You need to include images in PR descriptions`;
 var REFERENCE3 = `# GitHub Integration
 
-This guide covers how to interact with GitHub from within your Replicas workspace.
+This guide covers how to interact with GitHub from within your Replicas workspace. Prefer \`@replicas/sdk\` for API calls so batching and data processing stay in one TypeScript program. The \`gh\` CLI remains useful for ergonomic pull request and git-adjacent workflows.
 
 ## Prerequisites
 
@@ -1423,17 +1423,21 @@ gh run rerun RUN_ID --failed
 
 ### GitHub API (Advanced)
 
-For operations not covered by \`gh\` subcommands, use the API directly:
+For operations not covered by \`gh\` subcommands, use the scoped SDK. Pass only a relative GitHub API path:
 
-\`\`\`bash
-# GET request
-gh api repos/owner/repo/pulls/123/comments
+\`\`\`ts
+import { replicas } from '@replicas/sdk';
 
-# POST request
-gh api repos/owner/repo/issues/123/comments -f body="Comment text"
+const comments = await replicas.github.request('/repos/owner/repo/pulls/123/comments');
+await replicas.github.request('/repos/owner/repo/issues/123/comments', {
+  method: 'POST',
+  body: { body: 'Comment text' },
+});
 
-# GraphQL query
-gh api graphql -f query='{ repository(owner: "owner", name: "repo") { issues(first: 10) { nodes { title number } } } }'
+const result = await replicas.github.request('/graphql', {
+  method: 'POST',
+  body: { query: '{ viewer { login } }' },
+});
 \`\`\`
 
 ### Working with PR Reviews
@@ -1463,7 +1467,7 @@ GitHub does NOT have a public API for uploading images to PRs/issues. When you n
 `;
 var GITHUB_ABILITY = {
   label: "GitHub",
-  description: "Pre-authenticated `gh` CLI for PRs, issues, releases, and GraphQL.",
+  description: "GitHub workflows through gh and API calls through @replicas/sdk.",
   bullet: "- Interacting with GitHub (creating PRs, managing issues, using the API, etc.)",
   section: SECTION3,
   referenceFile: { name: "GITHUB.md", content: REFERENCE3 }
@@ -1471,124 +1475,61 @@ var GITHUB_ABILITY = {
 
 // ../shared/src/default-skills/replicas-agent/abilities/gitlab.ts
 var SECTION4 = `### GitLab
-Workspace repos hosted on GitLab use pre-configured git credentials \u2014 push, pull, and open merge requests with plain \`git\`.
+Use plain git for repository traffic and the workspace-scoped TypeScript SDK for GitLab API operations.
 
 **Reference:** \`references/GITLAB.md\`
 
 Use this when:
-- A repo's remote is on gitlab.com or a self-managed GitLab instance
-- You need to open or update a merge request`;
+- A repository remote is on gitlab.com or a self-managed GitLab instance
+- You need to open or update a merge request
+- You need GitLab issues, pipelines, comments, or other API data`;
 var REFERENCE4 = `# GitLab Integration
 
-This guide covers how to work with GitLab-hosted repositories from within your Replicas workspace.
-
-## Prerequisites
-
-Git credentials for the workspace's GitLab hosts are pre-configured in \`~/.git-credentials\` and refreshed automatically. Plain \`git fetch\` / \`git pull\` / \`git push\` over HTTPS work with no additional setup.
-
-- Never ask the user for a GitLab token or PAT \u2014 credentials are already wired. If a push fails with an authentication error, report it to the user instead of working around it.
-- A workspace can hold credentials for several GitLab hosts, and \`origin\` is whatever the repo says it is. Always select the token by the host you are about to call, as the snippets below do. Grabbing the first entry in \`~/.git-credentials\` can send one host's token to another.
-- There is no \`glab\` CLI in the workspace, and \`gh\` only works for GitHub remotes. Check a repo's host with \`git remote get-url origin\` before choosing the GitHub or GitLab workflow.
-
-### Reading the credential for a repo
+Git credentials are preconfigured for fetch, pull, and push. Use \`@replicas/sdk\` for API traffic; never inspect \`~/.git-credentials\`, request a token, or send a credential with curl.
 
-A workspace can hold tokens for several GitLab hosts, so always ask git for the
-credential belonging to the host you are about to call. Never grep
-\`~/.git-credentials\` yourself: taking the first line sends one instance's token to
-another, and interpolating a host into a grep pattern makes it a regular
-expression. \`git credential fill\` matches the host exactly and returns nothing
-when there is no credential for it:
+## Merge requests
 
-\`\`\`bash
-HOST=$(git remote get-url origin | sed -E 's#^[a-z]+://##; s#^[^@/]*@##; s#/.*##; s#:[^0-9].*##')
-TOKEN=$(printf 'protocol=https\\nhost=%s\\n\\n' "$HOST" | GIT_TERMINAL_PROMPT=0 git credential fill | sed -n 's/^password=//p')
-[ -n "$TOKEN" ] || { echo "no credential for $HOST"; exit 1; }
-\`\`\`
-
-Every recipe below repeats these two lines so each block runs on its own, and
-every one calls \`https://$HOST\`, so the token only ever reaches the host it
-belongs to. Run them inside the repo whose API you are calling. An empty
-\`$TOKEN\` means the workspace has no credential for that host. Report that rather
-than reaching for another one.
-
-## Merge Requests
-
-Create a merge request directly from a push using push options:
+Create a merge request directly from a push:
 
 \`\`\`bash
 git push -o merge_request.create -o merge_request.target=<default-branch> -o merge_request.title="Title" origin HEAD
 \`\`\`
 
-Useful options:
+Useful options are \`-o merge_request.draft\` and \`-o merge_request.remove_source_branch\`. GitLab prints the merge request URL.
 
-\`\`\`bash
--o merge_request.draft                  # open as draft
--o merge_request.remove_source_branch   # delete branch on merge
-\`\`\`
+## API requests
 
-GitLab prints the MR URL in the push output \u2014 include it in your reply to the user.
+Pass a relative path below \`/api/v4\`. Replicas selects the credential only from GitLab hosts attached to the workspace repositories.
 
-### Setting the description
+\`\`\`ts
+import { replicas } from '@replicas/sdk';
 
-Do **not** pass the description as a push option. Push option values are shell
-arguments on one line, so a real description \u2014 headings, lists, the Replicas
-footer HTML \u2014 gets mangled or truncated. Write the body to a file and PUT it as
-JSON instead, which preserves it exactly:
+const project = encodeURIComponent('group/project');
+const mergeRequests = await replicas.gitlab.request(
+  \`/projects/\${project}/merge_requests?state=opened\`,
+);
 
-\`\`\`bash
-HOST=$(git remote get-url origin | sed -E 's#^[a-z]+://##; s#^[^@/]*@##; s#/.*##; s#:[^0-9].*##')
-TOKEN=$(printf 'protocol=https\\nhost=%s\\n\\n' "$HOST" | GIT_TERMINAL_PROMPT=0 git credential fill | sed -n 's/^password=//p')
-PROJECT=$(python3 -c 'import urllib.parse; print(urllib.parse.quote("group/project", safe=""))')
-cat > /tmp/mr-body.md <<'EOF'
-## Summary
-...your full description, ending with the Replicas footer...
-EOF
-jq -Rs '{description: .}' /tmp/mr-body.md > /tmp/mr-body.json
-curl -sS --request PUT \\
-  --header "Authorization: Bearer $TOKEN" \\
-  --header "Content-Type: application/json" \\
-  --data @/tmp/mr-body.json \\
-  "https://$HOST/api/v4/projects/$PROJECT/merge_requests/<iid>"
+await replicas.gitlab.request(\`/projects/\${project}/issues/42/notes\`, {
+  method: 'POST',
+  body: { body: 'Update from Replicas' },
+});
 \`\`\`
 
-Use the same command to edit a description later. Editing replaces the whole
-body, so re-include the Replicas footer every time \u2014 it is how merge requests
-opened through Replicas are counted.
-
-## GitLab API (advanced)
-
-For operations with no git equivalent (commenting on MRs, reading pipelines), call the REST API with the workspace credential:
+When a workspace contains repositories from more than one GitLab host, pass the exact repository host:
 
-\`\`\`bash
-HOST=$(git remote get-url origin | sed -E 's#^[a-z]+://##; s#^[^@/]*@##; s#/.*##; s#:[^0-9].*##')
-TOKEN=$(printf 'protocol=https\\nhost=%s\\n\\n' "$HOST" | GIT_TERMINAL_PROMPT=0 git credential fill | sed -n 's/^password=//p')
-curl -s -H "Authorization: Bearer $TOKEN" "https://$HOST/api/v4/projects/<url-encoded-path>/merge_requests"
+\`\`\`ts
+await replicas.gitlab.request('/projects/group%2Frepo/pipelines', {
+  host: 'gitlab.example.com',
+});
 \`\`\`
 
-This works for gitlab.com and self-managed instances alike, because the base URL
-and the token both come from the repo's own host.
-
-## Inline media in merge requests
-
-GitLab provides a supported project Markdown uploads API. Upload media to Replicas first, then upload the same bytes natively so repository permissions protect the asset:
+## Descriptions and media
 
-\`\`\`bash
-FILE=/abs/path/to/screenshot.png
-HOST=$(git remote get-url origin | sed -E 's#^[a-z]+://##; s#^[^@/]*@##; s#/.*##; s#:[^0-9].*##')
-PROJECT=$(python3 -c 'import urllib.parse; print(urllib.parse.quote("group/project", safe=""))')
-TOKEN=$(printf 'protocol=https\\nhost=%s\\n\\n' "$HOST" | GIT_TERMINAL_PROMPT=0 git credential fill | sed -n 's/^password=//p')
-UPLOAD=$(curl -sS --request POST \\
-  --header "Authorization: Bearer $TOKEN" \\
-  --form "file=@$FILE" \\
-  "https://$HOST/api/v4/projects/$PROJECT/uploads")
-echo "$UPLOAD" | jq -r .markdown
-\`\`\`
-
-Insert the returned \`markdown\` into the merge request description or comment and add the media's **View in Replicas** dashboard link. Images render inline; MP4, MOV, and WebM render as inline video players. Do not create a public Replicas forge share when this native upload succeeds.
+API updates replace the entire merge request description, so always preserve the required Replicas footer and co-author trailers. For media, first run \`replicas media upload\` as documented in \`MEDIA.md\`; use GitLab's project uploads endpoint only when a native repository-protected embed is required.
 `;
 var GITLAB_ABILITY = {
   label: "GitLab",
-  description: "Pre-configured git credentials for GitLab repos; merge requests via push options.",
+  description: "Git for repository traffic and @replicas/sdk for the GitLab API.",
   bullet: "- Interacting with GitLab (pushing to GitLab repos, opening merge requests)",
   section: SECTION4,
   referenceFile: { name: "GITLAB.md", content: REFERENCE4 }
@@ -1596,332 +1537,67 @@ var GITLAB_ABILITY = {
 
 // ../shared/src/default-skills/replicas-agent/abilities/google.ts
 var SECTION5 = `### Google Workspace and Search Console
-Create and edit Google Docs, Sheets, and Forms, and read Google Search Console data via the Replicas gateway. Drive access is limited to files created by Replicas.
+Create and edit Docs, Sheets, and Forms, manage Replicas-created Drive files, and read Search Console through the workspace-scoped TypeScript SDK.
 
 **Reference:** \`references/GOOGLE.md\`
 
 Use this when:
 - You need to create or edit a Google Doc, Sheet, or Form
-- You need to share, rename, move, or delete a Replicas-created Google file
-- You need to read responses from a Replicas-created Google Form
-- You need to list Search Console properties, query search performance, read sitemaps, or inspect an indexed URL`;
+- You need to manage a file Replicas created
+- You need Google Search Console data`;
 var REFERENCE5 = `# Google Workspace and Search Console
 
-This guide covers how to create and edit Google Docs, Sheets, and Forms, perform basic Drive file operations, and read Google Search Console data from inside a Replicas workspace using the monolith as a gateway to Google's APIs.
-
-## Prerequisites
-
-The integration is configured at the org or user level by the Replicas admin. From inside a workspace you don't have a Google access token directly; instead you call the monolith's \`/v1/gdrive/*\` endpoints, authenticated with your workspace's engine secret. The monolith refreshes the org's (or user's) Google access token and proxies the call.
-
-Quick check that the integration is connected:
-
-\`\`\`bash
-curl -s -X GET "$REPLICAS_MONOLITH_URL/v1/gdrive/credentials" \\
-  -H "Authorization: Bearer $REPLICAS_ENGINE_SECRET" \\
-  -H "X-Workspace-Id: $REPLICAS_WORKSPACE_ID"
-\`\`\`
-
-- If \`hasCredentials\` is \`true\`: you're good to go.
-- If \`hasCredentials\` is \`false\`: Google has not been connected for this org. Ask the user to go to **Settings \u2192 Integrations \u2192 Google** in the [Replicas dashboard](https://replicas.dev) and connect a Google account. Do not attempt Google operations until it's connected.
-
-Standard auth headers used by every call below:
-
-\`\`\`
-Authorization: Bearer $REPLICAS_ENGINE_SECRET
-X-Workspace-Id: $REPLICAS_WORKSPACE_ID
-\`\`\`
-
-For brevity the examples below use a shell variable:
-
-\`\`\`bash
-GDRIVE_AUTH=(-H "Authorization: Bearer $REPLICAS_ENGINE_SECRET" -H "X-Workspace-Id: $REPLICAS_WORKSPACE_ID")
-\`\`\`
-
-## Important constraint: drive.file scope
-
-The integration uses the **sensitive-tier \`drive.file\` scope**. That means Replicas can only read and edit Google files **it created itself**. It **cannot**:
-
-- Read or edit a user's pre-existing Google Docs, Sheets, or Forms \u2014 even ones that were shared with the connected Google account.
-- List or search the user's broader Drive.
-- Touch any file that was not created via these gateway endpoints.
-
-If the user asks you to edit an existing doc that Replicas didn't create, tell them this constraint and offer to create a new doc that mirrors what they want.
-
-## Google Docs
-
-### Create a new doc
-
-\`\`\`bash
-curl -s -X POST "$REPLICAS_MONOLITH_URL/v1/gdrive/docs" "\${GDRIVE_AUTH[@]}" \\
-  -H "Content-Type: application/json" \\
-  -d '{"title":"Meeting notes 2026-05-14"}'
-\`\`\`
-
-Returns the full Doc object; grab \`.documentId\` for follow-up calls.
-
-### Read a doc
-
-\`\`\`bash
-curl -s "$REPLICAS_MONOLITH_URL/v1/gdrive/docs/$DOC_ID" "\${GDRIVE_AUTH[@]}"
-\`\`\`
-
-Returns the full document structure \u2014 \`body.content\` is an ordered list of structural elements (paragraphs, tables, etc.) with character indexes you can target for edits.
-
-### Edit a doc (batchUpdate)
-
-The Docs API edits use a list of [structural requests](https://developers.google.com/workspace/docs/api/reference/rest/v1/documents/request). Insert text, then style it; or insert tables, images, page breaks, etc.
-
-\`\`\`bash
-curl -s -X POST "$REPLICAS_MONOLITH_URL/v1/gdrive/docs/$DOC_ID/batchUpdate" "\${GDRIVE_AUTH[@]}" \\
-  -H "Content-Type: application/json" \\
-  -d '{
-    "requests": [
-      { "insertText": { "location": { "index": 1 }, "text": "Hello, world!\\n" } }
-    ]
-  }'
-\`\`\`
-
-Common request types:
-
-- \`insertText\` \u2014 insert plain text at a given index
-- \`deleteContentRange\` \u2014 delete a range
-- \`replaceAllText\` \u2014 find-and-replace
-- \`updateTextStyle\` \u2014 bold/italic/colors/fonts/sizes for a range
-- \`updateParagraphStyle\` \u2014 headings (\`HEADING_1\`..\`HEADING_6\`), alignment, spacing
-- \`createParagraphBullets\` \u2014 turn paragraphs into bulleted/numbered lists
-- \`insertTable\` \u2014 insert a table
-- \`insertInlineImage\` \u2014 insert an image from a URL
-
-Edits are verbose but powerful. Prefer batching many requests into a single \`batchUpdate\` call rather than making many round trips \u2014 it's faster and keeps the doc state consistent.
-
-## Google Sheets
-
-### Create a new spreadsheet
-
-\`\`\`bash
-curl -s -X POST "$REPLICAS_MONOLITH_URL/v1/gdrive/sheets" "\${GDRIVE_AUTH[@]}" \\
-  -H "Content-Type: application/json" \\
-  -d '{"title":"Q2 metrics"}'
-\`\`\`
-
-Returns the full Spreadsheet object; grab \`.spreadsheetId\`.
+Use \`@replicas/sdk\`; the workspace never receives Google OAuth credentials. Personal credentials are preferred for the workspace owner, then Replicas falls back to the organization connection.
 
-### Read a range of cells
-
-\`\`\`bash
-# Range is in A1 notation, e.g. "Sheet1!A1:C10"
-curl -s "$REPLICAS_MONOLITH_URL/v1/gdrive/sheets/$SHEET_ID/values/$(printf %s 'Sheet1!A1:C10' | jq -sRr @uri)" \\
-  "\${GDRIVE_AUTH[@]}"
-\`\`\`
-
-### Write a range of cells
-
-\`\`\`bash
-curl -s -X PUT \\
-  "$REPLICAS_MONOLITH_URL/v1/gdrive/sheets/$SHEET_ID/values/$(printf %s 'Sheet1!A1:B2' | jq -sRr @uri)?valueInputOption=USER_ENTERED" \\
-  "\${GDRIVE_AUTH[@]}" \\
-  -H "Content-Type: application/json" \\
-  -d '{
-    "range": "Sheet1!A1:B2",
-    "majorDimension": "ROWS",
-    "values": [
-      ["Name", "Revenue"],
-      ["Q1",   "=SUM(B3:B100)"]
-    ]
-  }'
-\`\`\`
-
-\`valueInputOption=USER_ENTERED\` makes formulas evaluate as if a human typed them. Use \`RAW\` to write literal strings.
-
-### Bulk operations (formatting, charts, new tabs, etc.)
-
-\`\`\`bash
-curl -s -X POST "$REPLICAS_MONOLITH_URL/v1/gdrive/sheets/$SHEET_ID/batchUpdate" "\${GDRIVE_AUTH[@]}" \\
-  -H "Content-Type: application/json" \\
-  -d '{ "requests": [ { "addSheet": { "properties": { "title": "Raw data" } } } ] }'
-\`\`\`
-
-\`batchUpdate\` accepts an array of [Sheets API requests](https://developers.google.com/workspace/sheets/api/reference/rest/v4/spreadsheets/request) \u2014 addSheet, updateSheetProperties, repeatCell, addChart, autoResizeDimensions, etc.
-
-## Google Forms
-
-### Create a new form
-
-\`\`\`bash
-curl -s -X POST "$REPLICAS_MONOLITH_URL/v1/gdrive/forms" "\${GDRIVE_AUTH[@]}" \\
-  -H "Content-Type: application/json" \\
-  -d '{"title":"Customer feedback"}'
-\`\`\`
-
-Returns the form. Grab \`.formId\`.
-
-### Add questions / edit form structure
-
-The Forms API uses its own \`batchUpdate\`:
-
-\`\`\`bash
-curl -s -X POST "$REPLICAS_MONOLITH_URL/v1/gdrive/forms/$FORM_ID/batchUpdate" "\${GDRIVE_AUTH[@]}" \\
-  -H "Content-Type: application/json" \\
-  -d '{
-    "requests": [
-      {
-        "createItem": {
-          "item": {
-            "title": "How likely are you to recommend us?",
-            "questionItem": {
-              "question": {
-                "required": true,
-                "scaleQuestion": { "low": 0, "high": 10, "lowLabel": "Not at all", "highLabel": "Very likely" }
-              }
-            }
-          },
-          "location": { "index": 0 }
-        }
-      }
-    ]
-  }'
-\`\`\`
-
-See the [Forms API Request reference](https://developers.google.com/workspace/forms/api/reference/rest/v1/forms/request) for all supported request types \u2014 text questions, multiple choice, checkboxes, scale, grid, date, time, file upload, section breaks, branching logic, quiz settings, etc.
-
-### Read responses
-
-\`\`\`bash
-curl -s "$REPLICAS_MONOLITH_URL/v1/gdrive/forms/$FORM_ID/responses" "\${GDRIVE_AUTH[@]}"
-\`\`\`
-
-Pagination: pass \`?pageToken=...&pageSize=...\` to walk through responses.
-
-## Drive operations (only on Replicas-created files)
-
-### Share a file with a person
-
-\`\`\`bash
-curl -s -X POST "$REPLICAS_MONOLITH_URL/v1/gdrive/files/$FILE_ID/permissions" "\${GDRIVE_AUTH[@]}" \\
-  -H "Content-Type: application/json" \\
-  -d '{
-    "type": "user",
-    "role": "writer",
-    "emailAddress": "alice@example.com",
-    "sendNotificationEmail": true
-  }'
-\`\`\`
-
-Roles: \`reader\`, \`commenter\`, \`writer\`. Types: \`user\`, \`group\`, \`domain\`, \`anyone\`.
-
-### Make a file viewable by anyone with the link
-
-\`\`\`bash
-curl -s -X POST "$REPLICAS_MONOLITH_URL/v1/gdrive/files/$FILE_ID/permissions" "\${GDRIVE_AUTH[@]}" \\
-  -H "Content-Type: application/json" \\
-  -d '{ "type": "anyone", "role": "reader" }'
-\`\`\`
-
-### List existing permissions
-
-\`\`\`bash
-curl -s "$REPLICAS_MONOLITH_URL/v1/gdrive/files/$FILE_ID/permissions" "\${GDRIVE_AUTH[@]}"
-\`\`\`
-
-### Rename / move a file
-
-\`\`\`bash
-curl -s -X PATCH "$REPLICAS_MONOLITH_URL/v1/gdrive/files/$FILE_ID" "\${GDRIVE_AUTH[@]}" \\
-  -H "Content-Type: application/json" \\
-  -d '{"name":"Final report.docx"}'
-\`\`\`
-
-To move into a folder, also pass \`addParents\` and \`removeParents\` as query parameters per [Drive API docs](https://developers.google.com/workspace/drive/api/reference/rest/v3/files/update).
-
-### Get file metadata
-
-\`\`\`bash
-curl -s "$REPLICAS_MONOLITH_URL/v1/gdrive/files/$FILE_ID?fields=id,name,mimeType,webViewLink,parents,modifiedTime" \\
-  "\${GDRIVE_AUTH[@]}"
-\`\`\`
-
-\`webViewLink\` is the human-shareable URL that opens in Google Docs/Sheets/Forms.
-
-### Delete a file
-
-\`\`\`bash
-curl -s -X DELETE "$REPLICAS_MONOLITH_URL/v1/gdrive/files/$FILE_ID" "\${GDRIVE_AUTH[@]}"
-\`\`\`
-
-### List Replicas-created files
+\`\`\`ts
+import { replicas } from '@replicas/sdk';
 
-\`\`\`bash
-curl -s "$REPLICAS_MONOLITH_URL/v1/gdrive/files?pageSize=50" "\${GDRIVE_AUTH[@]}"
+const { native } = await replicas.integrations.list();
+if (!native.google) throw new Error('Connect Google in Replicas integrations first.');
 \`\`\`
 
-Pass \`?q=...\` to filter using [Drive API search syntax](https://developers.google.com/workspace/drive/api/guides/search-files). Only files the app created or was granted access to will appear.
+Google Drive uses \`drive.file\`: Replicas can access only files it created, not pre-existing files in the account.
 
-## Google Search Console (read-only)
+## Docs
 
-Search Console access uses the \`webmasters.readonly\` scope. The connected Google account must have access to the requested property. If the account was connected before this scope was added, reconnect it in **Settings \u2192 Integrations \u2192 Google** first.
-
-Property identifiers must be URL-encoded as query parameters. URL-prefix properties include the trailing slash (for example, \`https://example.com/\`); Domain properties use \`sc-domain:example.com\`.
-
-### List accessible properties
-
-\`\`\`bash
-curl -s "$REPLICAS_MONOLITH_URL/v1/gdrive/search-console/sites" "\${GDRIVE_AUTH[@]}"
-\`\`\`
-
-### Get a property
-
-\`\`\`bash
-SITE_URL=$(printf %s 'sc-domain:example.com' | jq -sRr @uri)
-curl -s "$REPLICAS_MONOLITH_URL/v1/gdrive/search-console/site?siteUrl=$SITE_URL" "\${GDRIVE_AUTH[@]}"
-\`\`\`
-
-### Query search performance
-
-\`\`\`bash
-curl -s -X POST "$REPLICAS_MONOLITH_URL/v1/gdrive/search-console/search-analytics/query?siteUrl=$SITE_URL" "\${GDRIVE_AUTH[@]}" \\
-  -H "Content-Type: application/json" \\
-  -d '{
-    "startDate": "2026-06-01",
-    "endDate": "2026-06-30",
-    "dimensions": ["query", "page"],
-    "rowLimit": 1000
-  }'
+\`\`\`ts
+const doc = await replicas.google.request<{ documentId: string }>('docs', {
+  method: 'POST',
+  body: { title: 'Meeting notes' },
+});
+await replicas.google.request(\`docs/\${doc.documentId}/batchUpdate\`, {
+  method: 'POST',
+  body: { requests: [{ insertText: { location: { index: 1 }, text: 'Hello\\n' } }] },
+});
 \`\`\`
 
-Results contain clicks, impressions, CTR, and average position. Use \`startRow\` with \`rowLimit\` to paginate; Google returns at most 25,000 rows per request.
-
-### List sitemaps
+## Sheets
 
-\`\`\`bash
-curl -s "$REPLICAS_MONOLITH_URL/v1/gdrive/search-console/sitemaps?siteUrl=$SITE_URL" "\${GDRIVE_AUTH[@]}"
+\`\`\`ts
+const sheet = await replicas.google.request<{ spreadsheetId: string }>('sheets', {
+  method: 'POST',
+  body: { title: 'Q2 metrics' },
+});
+await replicas.google.request(
+  \`sheets/\${sheet.spreadsheetId}/values/\${encodeURIComponent('Sheet1!A1:B2')}?valueInputOption=USER_ENTERED\`,
+  { method: 'PUT', body: { values: [['Name', 'Revenue'], ['Q1', 100]] } },
+);
 \`\`\`
 
-Pass a URL-encoded \`sitemapIndex\` query parameter to list sitemaps referenced by a sitemap index. To fetch one sitemap, call \`/v1/gdrive/search-console/sitemap\` with URL-encoded \`siteUrl\` and \`feedpath\` query parameters.
-
-### Inspect an indexed URL
-
-\`\`\`bash
-curl -s -X POST "$REPLICAS_MONOLITH_URL/v1/gdrive/search-console/url-inspection" "\${GDRIVE_AUTH[@]}" \\
-  -H "Content-Type: application/json" \\
-  -d '{
-    "inspectionUrl": "https://example.com/page",
-    "siteUrl": "sc-domain:example.com",
-    "languageCode": "en-US"
-  }'
-\`\`\`
+## Forms, Drive, and Search Console
 
-URL Inspection reports the version currently in Google's index; it does not run a live URL test.
+The same method maps directly to the guarded \`/v1/gdrive/*\` routes:
 
-## Tips
+- \`forms\`, \`forms/:id\`, \`forms/:id/batchUpdate\`, \`forms/:id/responses\`
+- \`files\`, \`files/:id\`, \`files/:id/permissions\`
+- \`search-console/sites\`, \`search-console/search-analytics/query\`, \`search-console/sitemaps\`, \`search-console/url-inspection\`
 
-- **Always return the \`webViewLink\`** to the user when you create or edit a file so they can open it. Get it from \`/v1/gdrive/files/$FILE_ID?fields=webViewLink\` or from \`documents.documentId\` \u2192 \`https://docs.google.com/document/d/$ID/edit\`.
-- **Batch your edits.** A single \`batchUpdate\` with 20 requests beats 20 round-trips.
-- **Watch error responses.** A 412 from the gateway means the org has no Google credentials connected \u2014 tell the user to connect Google in the dashboard. Other 4xx responses come straight from Google and usually explain the issue clearly.
+Batch independent reads with \`Promise.all\`; use each API's batch-update endpoint for dependent writes.
 `;
 var GOOGLE_ABILITY = {
-  label: "Google",
-  description: "Use Google Workspace and read Search Console data via the Replicas gateway.",
-  bullet: "- Interacting with Google Workspace or Search Console (Docs, Sheets, Forms, Drive files, search performance, sitemaps, and URL inspection)",
+  label: "Google Workspace",
+  description: "Use Docs, Sheets, Forms, Drive, and Search Console through @replicas/sdk.",
+  bullet: "- Interacting with Google Workspace or Search Console",
   section: SECTION5,
   referenceFile: { name: "GOOGLE.md", content: REFERENCE5 }
 };
@@ -1955,102 +1631,63 @@ var LEARNINGS_ABILITY = {
 
 // ../shared/src/default-skills/replicas-agent/abilities/linear.ts
 var SECTION7 = `### Linear
-Fetch issues, update state, add comments, and search via the Linear GraphQL API.
+Fetch issues, update state, add comments, and search through the workspace-scoped TypeScript SDK.
 
 **Reference:** \`references/LINEAR.md\`
 
 Use this when:
 - You encounter a Linear issue link and need to understand the task
-- You need to update an issue's state (e.g. mark as done)
-- You need to comment on or search for Linear issues`;
+- You need to update an issue's state or add a comment
+- You need to search Linear issues`;
 var REFERENCE7 = `# Linear Integration
 
-This guide covers how to interact with Linear from within your Replicas workspace.
-
-## Prerequisites
-
-Check that the workspace has the Replicas engine credentials needed to proxy Linear requests:
-
-\`\`\`bash
-test -n "$REPLICAS_MONOLITH_URL" && test -n "$REPLICAS_ENGINE_SECRET" && test -n "$REPLICAS_WORKSPACE_ID" && echo set
-\`\`\`
-
-- If **set**: Use the Replicas Linear proxy below. It refreshes Linear OAuth tokens for you.
-- If **not set**: The workspace cannot authenticate to Replicas. Let the user know and do not attempt Linear operations.
-
-Then verify Linear is connected:
-
-\`\`\`bash
-curl -fsS -X POST "$REPLICAS_MONOLITH_URL/v1/engine/linear/refresh-token" \\
-  -H "Authorization: Bearer $REPLICAS_ENGINE_SECRET" \\
-  -H "X-Workspace-Id: $REPLICAS_WORKSPACE_ID" \\
-  -H "Content-Type: application/json" \\
-  -d '{}' >/dev/null
-\`\`\`
-
-If this fails because no Linear credential is connected, the user needs to connect Linear in the [Replicas dashboard](https://replicas.dev) under their organization's integration settings.
-
-## Using the Linear API
-
-Linear uses a GraphQL API. Always call it through Replicas so the access token stays fresh:
-
-\`\`\`bash
-linear_graphql() {
-  curl -sS -X POST "$REPLICAS_MONOLITH_URL/v1/engine/linear/graphql" \\
-    -H "Authorization: Bearer $REPLICAS_ENGINE_SECRET" \\
-    -H "X-Workspace-Id: $REPLICAS_WORKSPACE_ID" \\
-    -H "Content-Type: application/json" \\
-    --data-binary @-
-}
-\`\`\`
+Use \`@replicas/sdk\`; never request or handle a Linear OAuth token. Replicas refreshes the organization credential behind the gateway.
 
-### Fetching an Issue
+## Check access
 
-If you encounter a Linear issue link (e.g. \`https://linear.app/team/issue/ENG-123\`), the identifier is the last path segment (\`ENG-123\`).
-
-\`\`\`bash
-jq -n --arg identifier "ENG-123" '{
-  query: "query($identifier: String!) { issue(id: $identifier) { id identifier title description state { name } assignee { name } parent { identifier title description } } }",
-  variables: { identifier: $identifier }
-}' | linear_graphql
-\`\`\`
-
-### Updating Issue State
+\`\`\`ts
+import { replicas } from '@replicas/sdk';
 
-\`\`\`bash
-jq -n --arg issueId "ISSUE_UUID" --arg stateId "STATE_UUID" '{
-  query: "mutation($issueId: String!, $stateId: String!) { issueUpdate(id: $issueId, input: { stateId: $stateId }) { success issue { identifier state { name } } } }",
-  variables: { issueId: $issueId, stateId: $stateId }
-}' | linear_graphql
+const { native } = await replicas.integrations.list();
+if (!native.linear) throw new Error('Connect Linear in Replicas organization integrations first.');
 \`\`\`
 
-To find available states, query: \`query { workflowStates { nodes { id name } } }\`
-
-### Adding a Comment
+## Fetch an issue
 
-\`\`\`bash
-jq -n --arg issueId "ISSUE_UUID" --arg body "Your comment here" '{
-  query: "mutation($issueId: String!, $body: String!) { commentCreate(input: { issueId: $issueId, body: $body }) { success comment { id } } }",
-  variables: { issueId: $issueId, body: $body }
-}' | linear_graphql
+\`\`\`ts
+const issue = await replicas.linear.graphql({
+  query: \`query($identifier: String!) {
+    issue(id: $identifier) {
+      id identifier title description state { id name } assignee { name }
+      parent { identifier title description }
+    }
+  }\`,
+  variables: { identifier: 'ENG-123' },
+});
 \`\`\`
 
-### Searching Issues
+## Update and comment in one script
 
-\`\`\`bash
-jq -n --arg query "search terms" '{
-  query: "query($query: String!) { issues(filter: { or: [{ title: { containsIgnoreCase: $query } }, { description: { containsIgnoreCase: $query } }] }, first: 10) { nodes { identifier title state { name } } } }",
-  variables: { query: $query }
-}' | linear_graphql
+\`\`\`ts
+await replicas.linear.graphql({
+  query: \`mutation($issueId: String!, $stateId: String!) {
+    issueUpdate(id: $issueId, input: { stateId: $stateId }) { success }
+  }\`,
+  variables: { issueId, stateId },
+});
+await replicas.linear.graphql({
+  query: \`mutation($issueId: String!, $body: String!) {
+    commentCreate(input: { issueId: $issueId, body: $body }) { success comment { id } }
+  }\`,
+  variables: { issueId, body: 'Implemented in PR #123.' },
+});
 \`\`\`
 
-### Other Operations
-
-The Linear GraphQL API supports creating issues, managing projects, labels, cycles, and more. For the full schema and documentation, see: https://developers.linear.app/docs/graphql/working-with-the-graphql-api
+Search with \`containsIgnoreCase: $query\` filters, for example on both \`title\` and \`description\`. Batch independent queries with \`Promise.all\` to save round trips.
 `;
 var LINEAR_ABILITY = {
   label: "Linear",
-  description: "Fetch issues, post comments, update states via the Linear GraphQL API.",
+  description: "Fetch issues, comment, and update state through @replicas/sdk.",
   bullet: "- Interacting with Linear (fetching issues, updating state, commenting, etc.)",
   section: SECTION7,
   referenceFile: { name: "LINEAR.md", content: REFERENCE7 }
@@ -2467,8 +2104,80 @@ var PREVIEWS_ABILITY = {
   referenceFile: { name: "PREVIEWS.md", content: REFERENCE9 }
 };
 
+// ../shared/src/default-skills/replicas-agent/abilities/plugins.ts
+var SECTION10 = `### Plugins
+Discover and execute installed marketplace tools through the workspace-scoped TypeScript SDK.
+
+**Reference:** \`references/PLUGINS.md\`
+
+Use this when:
+- The user asks for CRM data from Attio
+- The user asks for Google Ads, Docs, Drive, Search Console, or Sheets data
+- The user asks for ClickHouse analytics or PostHog product data
+- The user asks for Stripe customers, payments, invoices, subscriptions, or balances`;
+var REFERENCE10 = `# Plugins
+
+Plugins are TypeScript libraries, not MCP servers. Import \`@replicas/sdk\`; Replicas authenticates the workspace and selects only the owner\u2019s personal connection or the organization fallback. Composio credentials, sessions, and project keys are never exposed.
+
+The initial plugin library is read-only. Tool discovery and execution both reject tools that are not tagged read-only.
+
+## Discover installed plugins
+
+\`\`\`ts
+import { replicas } from '@replicas/sdk';
+
+const plugins = await replicas.plugins.list();
+const installed = plugins.filter((plugin) => plugin.connected);
+\`\`\`
+
+If a plugin is not connected, ask the user to install it under personal or organization Integrations in the Replicas dashboard.
+
+## Search, inspect, execute
+
+\`\`\`ts
+const search = await replicas.plugins.search({
+  plugin: 'stripe',
+  query: 'list recent successful payments with customer details',
+});
+
+const [tool] = search.tools;
+if (!tool) throw new Error('No matching read-only tool found');
+
+const { data } = await replicas.plugins.execute({
+  plugin: 'stripe',
+  tool: tool.slug,
+  arguments: { limit: 25 },
+});
+\`\`\`
+
+Use \`replicas.plugins.describe({ plugin, tools: [slug] })\` when search returned a partial schema or before constructing unfamiliar arguments.
+
+## Batch work
+
+Keep dependent operations in one TypeScript file and batch independent calls:
+
+\`\`\`ts
+const results = await Promise.all(customerIds.map((customer) =>
+  replicas.plugins.execute({
+    plugin: 'stripe',
+    tool: 'STRIPE_RETRIEVE_CUSTOMER',
+    arguments: { customer },
+  }),
+));
+\`\`\`
+
+Never attempt to import Composio, create a session, manage a connection, or call a provider with raw credentials. Those operations are intentionally unavailable inside the workspace.
+`;
+var PLUGINS_ABILITY = {
+  label: "Plugins",
+  description: "Use installed marketplace tools through @replicas/sdk.",
+  bullet: "- Interacting with installed marketplace plugins through TypeScript",
+  section: SECTION10,
+  referenceFile: { name: "PLUGINS.md", content: REFERENCE10 }
+};
+
 // ../shared/src/default-skills/replicas-agent/abilities/replicas.ts
-var SECTION10 = `### Replicas (in-workspace CLI)
+var SECTION11 = `### Replicas (in-workspace CLI)
 Take action *with* Replicas itself \u2014 manage automations, environments (variables, files), repos, and \`replicas.json\` config \u2014 using the pre-installed, pre-authenticated \`replicas\` CLI.
 
 **Reference:** \`references/REPLICAS.md\`
@@ -2479,7 +2188,7 @@ Use this when:
 - The user asks "what envs / repos / automations do I have?"
 - The user asks you to scaffold a \`replicas.json\` / \`replicas.yaml\` in a repo
 - You need to run a long-lived service (dev server, daemon) \u2014 always use \`replicas service start\` so it survives workspace sleep/wake`;
-var REFERENCE10 = `# Replicas (in-workspace CLI)
+var REFERENCE11 = `# Replicas (in-workspace CLI)
 
 This guide covers how to take action *with* Replicas itself from inside a Replicas workspace \u2014 managing automations, environments (and their variables/files), repos, previews, and the user's \`replicas.json\` config \u2014 using the pre-installed \`replicas\` CLI.
 
@@ -2706,149 +2415,107 @@ var REPLICAS_ABILITY = {
   description: "Teach the agent about Replicas itself \u2014 automations, environments, the in-workspace CLI.",
   // No bullet — help_instructions covers the `replicas` CLI surface in detail.
   bullet: "",
-  section: SECTION10,
-  referenceFile: { name: "REPLICAS.md", content: REFERENCE10 },
+  section: SECTION11,
+  referenceFile: { name: "REPLICAS.md", content: REFERENCE11 },
   locked: true
 };
 
-// ../shared/src/default-skills/replicas-agent/abilities/slack.ts
-var SECTION11 = `### Slack
-Send messages, read threads, search conversations, and upload files via the Slack Web API.
+// ../shared/src/default-skills/replicas-agent/abilities/sentry.ts
+var SECTION12 = `### Sentry
+Read issues and project data through the workspace-scoped TypeScript SDK.
 
-**Reference:** \`references/SLACK.md\`
+**Reference:** \`references/SENTRY.md\`
 
 Use this when:
-- You need to send a message to a Slack channel or thread
-- You need to read or fetch a Slack conversation
-- You encounter a Slack message link and need to retrieve its content
-- The task asks you to notify, update, or communicate via Slack`;
-var REFERENCE11 = `# Slack Integration
+- You need to inspect Sentry projects or issues
+- A user asks for error-monitoring context outside a webhook-triggered task`;
+var REFERENCE12 = `# Sentry Integration
 
-This guide covers how to interact with Slack from within your Replicas workspace.
+Use \`@replicas/sdk\`; never request or read a Sentry token. Sentry access is organization-scoped and read-only.
 
-## Prerequisites
+\`\`\`ts
+import { replicas } from '@replicas/sdk';
 
-Check if the namespaced or legacy Slack token environment variable is set:
+const { native } = await replicas.integrations.list();
+if (!native.sentry) throw new Error('Connect Sentry in Replicas organization integrations first.');
 
-\`\`\`bash
-if [ -n "\${REPLICAS_SLACK_BOT_TOKEN:-$SLACK_BOT_TOKEN}" ]; then echo set; fi
+const issues = await replicas.sentry.request('/organizations/acme/issues/?query=is:unresolved');
 \`\`\`
 
-- If **set**: Your workspace has Slack access. You can use the Slack Web API as described below.
-- If **not set**: Slack has not been configured for this workspace. The user needs to connect Slack in the [Replicas dashboard](https://replicas.dev) under their organization's integration settings. Let the user know and do not attempt Slack operations.
-
-## Using the Slack API
-
-All requests prefer \`$REPLICAS_SLACK_BOT_TOKEN\` and fall back to \`$SLACK_BOT_TOKEN\` for compatibility with older workspaces.
-
-### Fetching a Thread from a Slack Link
-
-If you encounter a Slack message link (e.g. \`https://team.slack.com/archives/C0123ABC/p1234567890123456\`), extract the channel ID and thread timestamp:
-
-- **Channel ID**: The segment after \`/archives/\` (e.g. \`C0123ABC\`)
-- **Thread TS**: The \`p\` value with a dot inserted before the last 6 digits (e.g. \`p1234567890123456\` -> \`1234567890.123456\`)
+Pass only a relative Sentry API path. The Replicas gateway selects the connected organization credential and rejects writes, absolute URLs, oversized responses, and long-running requests.
+`;
+var SENTRY_ABILITY = {
+  label: "Sentry",
+  description: "Read Sentry projects and issues through @replicas/sdk.",
+  bullet: "- Interacting with Sentry (reading projects, issues, and error context)",
+  section: SECTION12,
+  referenceFile: { name: "SENTRY.md", content: REFERENCE12 }
+};
 
-\`\`\`bash
-curl -s "https://slack.com/api/conversations.replies?channel=CHANNEL_ID&ts=THREAD_TS" \\
-  -H "Authorization: Bearer \${REPLICAS_SLACK_BOT_TOKEN:-$SLACK_BOT_TOKEN}"
-\`\`\`
+// ../shared/src/default-skills/replicas-agent/abilities/slack.ts
+var SECTION13 = `### Slack
+Send messages, read threads, search conversations, and upload files through the workspace-scoped TypeScript SDK.
 
-### Sending a Message
+**Reference:** \`references/SLACK.md\`
 
-\`\`\`bash
-curl -s -X POST "https://slack.com/api/chat.postMessage" \\
-  -H "Authorization: Bearer \${REPLICAS_SLACK_BOT_TOKEN:-$SLACK_BOT_TOKEN}" \\
-  -H "Content-Type: application/json" \\
-  -d '{
-    "channel": "CHANNEL_ID",
-    "text": "Your message here",
-    "thread_ts": "OPTIONAL_THREAD_TS"
-  }'
-\`\`\`
+Use this when:
+- You need to send a message to a Slack channel or thread
+- You need to read or search Slack conversations
+- You encounter a Slack message link and need its full thread`;
+var REFERENCE13 = `# Slack Integration
 
-Omit \`thread_ts\` to post a new message to the channel. Include it to reply in a thread.
+Use \`@replicas/sdk\`; never read or send a Slack token directly. The SDK calls Replicas, which selects only this workspace's organization connection.
 
-#### Attach every new conversation
+## Check access
 
-Whenever you send a Slack message outside the thread that already routes to the current workspace, immediately attach the destination thread so future replies are delivered to this workspace:
+\`\`\`ts
+import { replicas } from '@replicas/sdk';
 
-\`\`\`bash
-replicas slack thread attach --channel <channel-id> --thread-ts <thread-root-ts>
+const { native } = await replicas.integrations.list();
+if (!native.slack) throw new Error('Connect Slack in Replicas organization integrations first.');
 \`\`\`
 
-- For a new top-level message or DM, use the \`channel\` and \`ts\` from the successful \`chat.postMessage\` response. That message's \`ts\` is the new thread root.
-- For a reply in another existing thread, use its root \`thread_ts\`, not the reply's \`ts\`.
-- Do not attach the originating thread again when it already routes to the current workspace.
-- Treat sending and attaching as one operation: check that both API calls succeed, and report an attachment failure instead of implying future replies will reach you.
-
-#### Switch a thread to an existing workspace
+## Read a thread
 
-When the user wants a Slack thread to continue in a particular existing workspace, resolve the target and switch the thread:
+For a link such as \`https://team.slack.com/archives/C0123ABC/p1234567890123456\`, the channel is \`C0123ABC\` and the timestamp is \`1234567890.123456\`.
 
-\`\`\`bash
-replicas list
-replicas slack thread switch <workspace-id-or-name> --channel <channel-id> --thread-ts <thread-root-ts>
+\`\`\`ts
+const thread = await replicas.slack.call('conversations.replies', {
+  channel: 'C0123ABC',
+  ts: '1234567890.123456',
+  limit: 200,
+});
 \`\`\`
 
-The channel and thread flags default to \`REPLICAS_SLACK_CHANNEL_ID\` and \`REPLICAS_SLACK_THREAD_TS\` for a Slack-triggered workspace. Workspace-authenticated agents may target only their current workspace; switching to a different workspace requires running the command with user authentication outside agent mode. If that restriction applies, give the user the exact command to run rather than claiming the switch succeeded.
-
-### Searching Messages
+## Send and attach a message
 
-\`\`\`bash
-curl -s "https://slack.com/api/search.messages?query=YOUR_SEARCH_QUERY" \\
-  -H "Authorization: Bearer \${REPLICAS_SLACK_BOT_TOKEN:-$SLACK_BOT_TOKEN}"
+\`\`\`ts
+const message = await replicas.slack.call<{ channel: string; ts: string }>('chat.postMessage', {
+  channel: 'C0123ABC',
+  text: 'Update from Replicas',
+});
+await replicas.slack.attachThread({ channel: message.channel, threadTs: message.ts });
 \`\`\`
 
-### Uploading Files
-
-Slack deprecated \`files.upload\`; the raw HTTP replacement is a 3-step flow. (\`files.uploadV2\` is **only** an SDK convenience wrapper and is NOT a real Web API HTTP endpoint \u2014 \`POST https://slack.com/api/files.uploadV2\` returns \`unknown_method\`.)
-
-\`\`\`bash
-FILE=/path/to/file
-FILENAME=$(basename "$FILE")
-LENGTH=$(stat -c%s "$FILE" 2>/dev/null || stat -f%z "$FILE")
+Attach every new top-level conversation so future replies route to this workspace. For a reply in another thread, attach its root \`thread_ts\`, not the reply timestamp. Do not attach the originating thread again.
 
-# 1. Reserve an upload URL + file ID.
-RESERVE=$(curl -s -G "https://slack.com/api/files.getUploadURLExternal" \\
-  -H "Authorization: Bearer \${REPLICAS_SLACK_BOT_TOKEN:-$SLACK_BOT_TOKEN}" \\
-  --data-urlencode "filename=$FILENAME" \\
-  --data-urlencode "length=$LENGTH")
-UPLOAD_URL=$(echo "$RESERVE" | jq -r '.upload_url')
-FILE_ID=$(echo "$RESERVE" | jq -r '.file_id')
-
-# 2. POST the raw bytes to the reserved URL.
-#    Do not use -F / multipart here \u2014 the presigned URL expects the bytes
-#    directly in the request body.
-curl -s -X POST "$UPLOAD_URL" \\
-  -H "Content-Type: application/octet-stream" \\
-  --data-binary @"$FILE"
+## Search and batch
 
-# 3. Complete the upload and share into a channel (and optionally a thread).
-curl -s -X POST "https://slack.com/api/files.completeUploadExternal" \\
-  -H "Authorization: Bearer \${REPLICAS_SLACK_BOT_TOKEN:-$SLACK_BOT_TOKEN}" \\
-  -H "Content-Type: application/json; charset=utf-8" \\
-  -d "{
-    \\"files\\": [{\\"id\\": \\"$FILE_ID\\", \\"title\\": \\"File title\\"}],
-    \\"channel_id\\": \\"CHANNEL_ID\\",
-    \\"thread_ts\\": \\"OPTIONAL_THREAD_TS\\",
-    \\"initial_comment\\": \\"Optional message body\\"
-  }"
+\`\`\`ts
+const [messages, users] = await Promise.all([
+  replicas.slack.call('search.messages', { query: 'launch status' }),
+  replicas.slack.call('users.list', { limit: 200 }),
+]);
 \`\`\`
 
-Omit \`thread_ts\` and/or \`initial_comment\` if you don't need them.
-
-### Other Operations
-
-You can list channels, read channel history, add reactions, and perform any other operation supported by the Slack Web API using the same authentication pattern.
-
-For full API documentation, see: https://docs.slack.dev/apis/web-api/
+Supported methods cover conversations, messages, search, users, reactions, and Slack's external file-upload flow. An unsupported method is rejected by Replicas before Slack is called.
 `;
 var SLACK_ABILITY = {
   label: "Slack",
-  description: "Send messages, read threads, search conversations, upload files.",
+  description: "Send messages, read threads, and search through @replicas/sdk.",
   bullet: "- Interacting with Slack (sending messages, reading threads, etc.)",
-  section: SECTION11,
-  referenceFile: { name: "SLACK.md", content: REFERENCE11 }
+  section: SECTION13,
+  referenceFile: { name: "SLACK.md", content: REFERENCE13 }
 };
 
 // ../shared/src/default-skills/replicas-agent/registry.ts
@@ -2862,7 +2529,9 @@ var REPLICAS_AGENT_ABILITY_REGISTRY = {
   learnings: LEARNINGS_ABILITY,
   linear: LINEAR_ABILITY,
   media: MEDIA_ABILITY,
+  plugins: PLUGINS_ABILITY,
   previews: PREVIEWS_ABILITY,
+  sentry: SENTRY_ABILITY,
   slack: SLACK_ABILITY
 };
 var REPLICAS_AGENT_ABILITIES = Object.keys(
@@ -5832,7 +5501,7 @@ var BaseRefreshManager = class {
           this.health.lastErrorMessage = message;
           if (attempt < 3) {
             console.warn(`[${this.managerName}] Initial refresh attempt ${attempt} failed, retrying in 2s...`);
-            await new Promise((resolve4) => setTimeout(resolve4, 2e3));
+            await new Promise((resolve5) => setTimeout(resolve5, 2e3));
           } else {
             console.error(`[${this.managerName}] Initial refresh failed after 3 attempts:`, error);
           }
@@ -6371,7 +6040,7 @@ var GitService = class {
     }
   }
   readUntrackedDiff(repoPath, paths) {
-    return new Promise((resolve4) => {
+    return new Promise((resolve5) => {
       const child = spawn("git", ["diff", "--", ...paths], {
         cwd: repoPath,
         stdio: ["ignore", "pipe", "pipe"]
@@ -6392,12 +6061,12 @@ var GitService = class {
       });
       child.stderr.on("data", () => {
       });
-      child.on("error", () => resolve4(""));
+      child.on("error", () => resolve5(""));
       child.on("close", (code) => {
         if (code === 0 || code === 1 || truncated) {
-          resolve4(Buffer.concat(chunks).toString("utf-8"));
+          resolve5(Buffer.concat(chunks).toString("utf-8"));
         } else {
-          resolve4("");
+          resolve5("");
         }
       });
     });
@@ -7134,9 +6803,9 @@ var StreamWriter = class {
     return true;
   }
   flush(signal) {
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       if (!this.stream) {
-        resolve4();
+        resolve5();
         return;
       }
       if (this.flushTimer) {
@@ -7153,7 +6822,7 @@ var StreamWriter = class {
       s.write("", (error) => {
         signal?.removeEventListener("abort", onAbort);
         if (error) reject(error);
-        else resolve4();
+        else resolve5();
       });
     });
   }
@@ -7691,7 +7360,7 @@ var ReplicasConfigService = class {
     await this.logToFile(`[${params.repoName}] --- Running: ${params.label} ---`);
     emit(`$ ${params.label}
 `);
-    return new Promise((resolve4) => {
+    return new Promise((resolve5) => {
       const proc = spawn2("bash", ["-lc", params.command], {
         cwd: params.cwd,
         env: process.env,
@@ -7702,7 +7371,7 @@ var ReplicasConfigService = class {
       const finish = (result) => {
         if (settled) return;
         settled = true;
-        resolve4(result);
+        resolve5(result);
       };
       const timer = setTimeout(() => {
         timedOut = true;
@@ -8128,7 +7797,7 @@ async function registerDesktopPreview() {
     if (await attemptRegistration()) {
       return;
     }
-    await new Promise((resolve4) => setTimeout(resolve4, RETRY_DELAY_MS));
+    await new Promise((resolve5) => setTimeout(resolve5, RETRY_DELAY_MS));
   }
   console.error(
     `[DesktopPreview] Gave up registering port ${DESKTOP_STREAM_PORT} after ${REGISTRATION_TIMEOUT_MS}ms`
@@ -9669,8 +9338,8 @@ var PromptStream = class {
         if (this.closed) {
           return Promise.resolve({ value: void 0, done: true });
         }
-        return new Promise((resolve4) => {
-          this.waiters.push(resolve4);
+        return new Promise((resolve5) => {
+          this.waiters.push(resolve5);
         });
       }
     };
@@ -10050,14 +9719,14 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
       const requestId = randomUUID4();
       const toolUseId = options.toolUseID;
       const { options: requestOptions, questions: requestQuestions } = handler.getRequest(input);
-      const result = await new Promise((resolve4) => {
+      const result = await new Promise((resolve5) => {
         this.pendingToolInputs.set(requestId, {
           requestId,
           toolUseId,
           toolName,
           input,
           handler,
-          resolve: resolve4
+          resolve: resolve5
         });
         const onAbort = () => {
           const pending = this.pendingToolInputs.get(requestId);
@@ -10162,7 +9831,7 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
               error
             );
             await this.tearDownSession();
-            await new Promise((resolve4) => setTimeout(resolve4, delayMs));
+            await new Promise((resolve5) => setTimeout(resolve5, delayMs));
             currentRequest = { ...request, message: CLAUDE_MIDTURN_CONTINUE_PROMPT, images: [] };
             attempt++;
             continue;
@@ -10175,7 +9844,7 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
               error
             );
             await this.tearDownSession();
-            await new Promise((resolve4) => setTimeout(resolve4, delayMs));
+            await new Promise((resolve5) => setTimeout(resolve5, delayMs));
             attempt++;
             continue;
           }
@@ -10321,8 +9990,8 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
       this.pendingInterrupt = false;
       return;
     }
-    await new Promise((resolve4, reject) => {
-      this.pendingTurn = { resolve: resolve4, reject, sawActivity: false };
+    await new Promise((resolve5, reject) => {
+      this.pendingTurn = { resolve: resolve5, reject, sawActivity: false };
       promptStream.push(userMessage);
     });
   }
@@ -10909,13 +10578,13 @@ var AspClient = class {
     }
     const id = this.nextId;
     this.nextId += 1;
-    const promise = new Promise((resolve4, reject) => {
+    const promise = new Promise((resolve5, reject) => {
       const timeoutMs = opts?.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
       const timer = timeoutMs > 0 ? setTimeout(() => {
         this.pending.delete(id);
         reject(new Error(`ASP request timed out for ${method}`));
       }, timeoutMs) : null;
-      this.pending.set(id, { resolve: resolve4, reject, method, timer });
+      this.pending.set(id, { resolve: resolve5, reject, method, timer });
     });
     this.write({ method, id, params });
     return promise;
@@ -11068,7 +10737,7 @@ var DEFAULT_CODEX_ARGS = ["app-server", "--listen", "stdio://"];
 var MIN_CODEX_CLI_VERSION = "0.144.6";
 var CODEX_UPGRADE_TIMEOUT_MS = 12e4;
 var codexCliVersionEnsured = null;
-var ENGINE_PACKAGE_VERSION = "0.1.595";
+var ENGINE_PACKAGE_VERSION = "0.1.597";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";
@@ -11188,13 +10857,13 @@ var AppServerProcess = class {
     if (!child || child.killed) {
       return;
     }
-    await new Promise((resolve4) => {
+    await new Promise((resolve5) => {
       const timer = setTimeout(() => {
         child.kill("SIGKILL");
       }, 2e3);
       child.once("exit", () => {
         clearTimeout(timer);
-        resolve4();
+        resolve5();
       });
       child.kill("SIGTERM");
     });
@@ -11239,8 +10908,8 @@ var AppServerProcess = class {
     }
     this.shuttingDown = true;
     child.kill("SIGKILL");
-    await new Promise((resolve4) => {
-      child.once("exit", () => resolve4());
+    await new Promise((resolve5) => {
+      child.once("exit", () => resolve5());
     });
   }
 };
@@ -12520,8 +12189,8 @@ var CodexAspManager = class extends CodingAgentManager {
   }
   async observeTurn(host, threadId, request, startTurn, options = {}) {
     let resolveCompleted;
-    const completed = new Promise((resolve4) => {
-      resolveCompleted = resolve4;
+    const completed = new Promise((resolve5) => {
+      resolveCompleted = resolve5;
     });
     let rejectDisposed = () => {
     };
@@ -13487,8 +13156,8 @@ var CursorManager = class extends CodingAgentManager {
   }
   async processMessageInternal(request) {
     let run = null;
-    const aborted = new Promise((resolve4) => {
-      this.abortActiveTurn = () => resolve4(TURN_ABORTED);
+    const aborted = new Promise((resolve5) => {
+      this.abortActiveTurn = () => resolve5(TURN_ABORTED);
     });
     const linearSessionId = ENGINE_ENV.REPLICAS_LINEAR_SESSION_ID;
     const linearForwarder = new LinearEventForwarder(linearSessionId);
@@ -14129,8 +13798,8 @@ var OpencodeManager = class extends CodingAgentManager {
     this.configuredModels = this.providerId === OPENCODE_GO_PROVIDER ? /* @__PURE__ */ new Set() : new Set(getConfiguredOpencodeModels(model, providerId));
     const eventController = new AbortController();
     this.eventAbortController = eventController;
-    this.eventSubscriptionReady = new Promise((resolve4) => {
-      this.resolveEventSubscriptionReady = resolve4;
+    this.eventSubscriptionReady = new Promise((resolve5) => {
+      this.resolveEventSubscriptionReady = resolve5;
     });
     this.subscribeToEvents(client, eventController).catch((error) => {
       this.resolveEventSubscriptionReady?.();
@@ -14140,7 +13809,7 @@ var OpencodeManager = class extends CodingAgentManager {
     });
     await Promise.race([
       this.eventSubscriptionReady,
-      new Promise((resolve4) => setTimeout(resolve4, 2e3))
+      new Promise((resolve5) => setTimeout(resolve5, 2e3))
     ]);
     return client;
   }
@@ -15762,7 +15431,7 @@ function isReconcileCanvasItemsResponse(value) {
 }
 async function withCanvasUploadSlot(operation) {
   if (activeCanvasUploads >= MAX_CONCURRENT_CANVAS_UPLOADS) {
-    await new Promise((resolve4) => pendingCanvasUploads.push(resolve4));
+    await new Promise((resolve5) => pendingCanvasUploads.push(resolve5));
   } else {
     activeCanvasUploads++;
   }
@@ -15897,7 +15566,7 @@ var HISTORY_DIRS = [
   join25(ENGINE_DIR2, "codex-histories")
 ];
 async function putTranscript(uploadUrl, filePath, size) {
-  await new Promise((resolve4, reject) => {
+  await new Promise((resolve5, reject) => {
     const url = new URL(uploadUrl);
     const request = (url.protocol === "https:" ? httpsRequest : httpRequest)(url, {
       method: "PUT",
@@ -15913,7 +15582,7 @@ async function putTranscript(uploadUrl, filePath, size) {
       });
       response.on("end", () => {
         const status = response.statusCode ?? 0;
-        if (status >= 200 && status < 300) resolve4();
+        if (status >= 200 && status < 300) resolve5();
         else reject(new Error(`upload failed: ${status} ${body}`));
       });
       response.on("error", reject);
@@ -16120,13 +15789,13 @@ function runBeforeDeadline(operation, deadline) {
   const timeoutMs = deadline - Date.now();
   if (timeoutMs <= 0) return Promise.reject(new DOMException("engine log flush deadline exceeded", "TimeoutError"));
   const signal = AbortSignal.timeout(timeoutMs);
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const onAbort = () => reject(signal.reason);
     signal.addEventListener("abort", onAbort, { once: true });
     operation(signal).then(
       (value) => {
         signal.removeEventListener("abort", onAbort);
-        resolve4(value);
+        resolve5(value);
       },
       (error) => {
         signal.removeEventListener("abort", onAbort);
@@ -17155,7 +16824,7 @@ function scoreMatch(query2, filePath) {
   return 0;
 }
 function execGitAsync(args, cwd, timeoutMs) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const child = execFile2("git", args, {
       cwd,
       encoding: "utf-8",
@@ -17165,7 +16834,7 @@ function execGitAsync(args, cwd, timeoutMs) {
       if (error) {
         reject(error);
       } else {
-        resolve4(stdout);
+        resolve5(stdout);
       }
     });
     child.stdin?.end();
@@ -17557,7 +17226,7 @@ async function executeHookScriptStreaming(params) {
   let bufferExceeded = false;
   params.onChunk(`$ ${params.label}
 `);
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const proc = spawn4("bash", ["-lc", params.content], {
       cwd: params.cwd,
       env: process.env,
@@ -17590,7 +17259,7 @@ async function executeHookScriptStreaming(params) {
     proc.on("close", (code) => {
       clearTimeout(timer);
       const output = [`$ ${params.label}`, ...outputParts].join("");
-      resolve4({
+      resolve5({
         exitCode: bufferExceeded ? 1 : code ?? 1,
         output,
         timedOut: killed && !bufferExceeded
@@ -17600,7 +17269,7 @@ async function executeHookScriptStreaming(params) {
       clearTimeout(timer);
       const output = [`$ ${params.label}
 `, ...outputParts, err.message].join("");
-      resolve4({
+      resolve5({
         exitCode: 1,
         output,
         timedOut: false
@@ -18873,14 +18542,30 @@ var HeartbeatService = class _HeartbeatService {
 };
 var heartbeatService = new HeartbeatService();
 
+// src/services/workspace-sdk-service.ts
+import { cp, mkdir as mkdir17 } from "fs/promises";
+import { dirname as dirname8, resolve as resolve4 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+async function installWorkspaceSdk() {
+  const source = resolve4(dirname8(fileURLToPath2(import.meta.url)), "../../workspace-sdk");
+  const targets = [
+    resolve4(ENGINE_ENV.HOME_DIR, "node_modules/@replicas/sdk"),
+    "/tmp/node_modules/@replicas/sdk"
+  ];
+  await Promise.all(targets.map(async (target) => {
+    await mkdir17(target, { recursive: true });
+    await cp(source, target, { recursive: true, force: true });
+  }));
+}
+
 // src/index.ts
 var startupStartedAt = performance.now();
 var startupTimings = {};
 var ENGINE_INIT_GATE_TIMEOUT_MS = 35 * 60 * 1e3;
 var resolveEngineReady = () => {
 };
-var engineReadyPromise = new Promise((resolve4) => {
-  resolveEngineReady = resolve4;
+var engineReadyPromise = new Promise((resolve5) => {
+  resolveEngineReady = resolve5;
 });
 async function timeStartupStep(name, fn) {
   const startedAt = performance.now();
@@ -18900,7 +18585,7 @@ async function waitForInitializationGate() {
     if (Date.now() >= deadline) {
       throw new Error("Timed out waiting for deferred engine initialization gate");
     }
-    await new Promise((resolve4) => setTimeout(resolve4, 25));
+    await new Promise((resolve5) => setTimeout(resolve5, 25));
   }
 }
 await timeStartupStep("engine_logger_initialize", () => engineLogger.initialize());
@@ -18932,11 +18617,11 @@ async function checkActiveSSHSessions() {
   }
 }
 function checkDesktopReady() {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const socket = connect({ host: "127.0.0.1", port: DESKTOP_STREAM_PORT });
     const done = (ready) => {
       socket.destroy();
-      resolve4(ready);
+      resolve5(ready);
     };
     socket.once("connect", () => done(true));
     socket.once("error", () => done(false));
@@ -18968,7 +18653,7 @@ app.get("/health", async (c) => {
   if (!engineReady && waitMs > 0) {
     await Promise.race([
       engineReadyPromise,
-      new Promise((resolve4) => setTimeout(resolve4, waitMs))
+      new Promise((resolve5) => setTimeout(resolve5, waitMs))
     ]);
   }
   c.header(ENGINE_HEALTH_WAIT_HEADER, "1");
@@ -19168,6 +18853,7 @@ serve(
       console.log(`Replicas Engine running on port ${info.port}`);
     }
     await timeStartupStep("wait_for_initialization_gate", waitForInitializationGate);
+    await timeStartupStep("workspace_sdk_install", installWorkspaceSdk);
     if (!IS_WARMING_MODE) {
       await timeStartupStep("replicas_config_initialize", () => replicasConfigService.initialize());
     }