replicas-engine 0.1.630 → 0.1.631

package/dist/src/index.js

@@ -844,10 +844,17 @@ var EGRESS_TUNNEL_SERVICE = "replicas-egress.service";
 var EGRESS_TUNNEL_INTERFACE = "rpxtun0";
 var EGRESS_DNS_SERVERS = ["1.1.1.1", "8.8.8.8"];
 var EGRESS_PATHS = {
-  CONFIG_DIR: "/etc/replicas/egress",
-  /** Root-only (0600). Holds the customer's proxy password — never baked into the image. */
-  CONFIG_FILE: "/etc/replicas/egress/config.json",
-  RESOLV_BACKUP: "/etc/replicas/egress/resolv.conf.orig",
+  /**
+   * Under /run, which is tmpfs. The key therefore never touches disk and cannot
+   * be carried into a filesystem snapshot or a paused sandbox's disk image. It
+   * does not survive a reboot either, which is correct: the monolith rewrites
+   * it on every resume, so a revoked credential cannot come back with the
+   * workspace.
+   */
+  CONFIG_DIR: "/run/replicas-egress",
+  CONFIG_FILE: "/run/replicas-egress/config.json",
+  /** Persistent: this records the workspace's original resolver so the tunnel can put it back, and must outlive a reboot. */
+  RESOLV_BACKUP: "/var/lib/replicas-egress-resolv.conf.orig",
   UNIT_FILE: `/etc/systemd/system/${EGRESS_TUNNEL_SERVICE}`,
   UP_SCRIPT: "/usr/local/lib/replicas-egress-up",
   DOWN_SCRIPT: "/usr/local/lib/replicas-egress-down"
@@ -11066,7 +11073,7 @@ var DEFAULT_CODEX_ARGS = [
 var MIN_CODEX_CLI_VERSION = "0.144.6";
 var CODEX_UPGRADE_TIMEOUT_MS = 12e4;
 var codexCliVersionEnsured = null;
-var ENGINE_PACKAGE_VERSION = "0.1.630";
+var ENGINE_PACKAGE_VERSION = "0.1.631";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.630",
+  "version": "0.1.631",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",