replicas-engine 0.1.667 → 0.1.671

package/README.md

@@ -80,14 +80,14 @@ From `monolith/src/lib/sandbox-helpers.ts` + `monolith/src/lib/workspaces.ts`, t
   - file: `~/.claude/.bedrock-credentials.json`
   - env: `CLAUDE_CODE_USE_BEDROCK=1`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_REGION`
 - Codex credentials (optional):
-  - file: `~/.codex/auth.json`
-  - format includes `tokens.id_token`, `tokens.access_token`, `tokens.refresh_token`, `tokens.account_id`
+  - OAuth access tokens are supplied through Codex ASP external authentication.
+  - Provisioning writes `~/.codex/auth.json` for older engines; current engines remove it before starting Codex.
 
 Token refresh managers may later overwrite credential files in place:
 
 - `~/.git-credentials`
 - `~/.claude/.credentials.json`
-- `~/.codex/auth.json`
+- `~/.codex/auth.json` (removed by current engines before Codex starts)
 - `~/.replicas/infisical-env.sh` and `~/workspaces/.infisical.json`
 
 Engine persistence locations:
@@ -119,7 +119,7 @@ Credential files expected/used by provider CLIs:
 - `~/.git-credentials` (git/gh auth)
 - `~/.claude/.credentials.json` (Claude OAuth auth)
 - `~/.claude/.bedrock-credentials.json` (Claude Bedrock config)
-- `~/.codex/auth.json` (Codex auth)
+- Codex OAuth uses ASP external authentication; the engine removes legacy `~/.codex/auth.json` files.
 
 ## What the engine sends upstream
 

package/dist/src/app-server-process-S2SD6PQE.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import {
+  AppServerProcess
+} from "./chunk-6GXXZQID.js";
+import "./chunk-6WY7NPCL.js";
+import "./chunk-4FTBKGMO.js";
+import "./chunk-TMERKNQV.js";
+export {
+  AppServerProcess
+};

package/dist/src/chunk-4FTBKGMO.js

@@ -0,0 +1,162 @@
+#!/usr/bin/env node
+import {
+  REPLICAS_RUNTIME_ENV_ALIASES,
+  agentCredentialSnapshotSchema,
+  isValidAgentProvider,
+  parsePosixEnvFile,
+  readReplicasRuntimeEnv
+} from "./chunk-TMERKNQV.js";
+
+// src/engine-env.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+
+// src/runtime-env-loader.ts
+import { readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+function loadRuntimeEnvFile() {
+  let content;
+  try {
+    content = readFileSync(join(homedir(), ".replicas", "runtime-env.sh"), "utf-8");
+  } catch {
+    return;
+  }
+  for (const [key, value] of Object.entries(parsePosixEnvFile(content))) {
+    process.env[key] = value;
+  }
+}
+
+// src/utils/type-guards.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+
+// src/engine-env.ts
+var SANDBOX_IMAGE_VERSION_FILE = "/usr/local/lib/replicas-sandbox-image-version";
+function readEnv(name) {
+  const value = process.env[name]?.trim();
+  return value ? value : void 0;
+}
+function readSandboxImageVersion() {
+  const environmentVersion = readEnv("REPLICAS_SANDBOX_IMAGE_VERSION");
+  if (environmentVersion) return environmentVersion;
+  try {
+    return readFileSync2(SANDBOX_IMAGE_VERSION_FILE, "utf8").trim() || "development";
+  } catch {
+    return "development";
+  }
+}
+function parsePort(value) {
+  if (!value) {
+    return 3737;
+  }
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new Error("Invalid engine environment: REPLICAS_ENGINE_PORT must be a positive integer");
+  }
+  return parsed;
+}
+function requireDefined(value, name) {
+  if (value === void 0 || value === null) {
+    throw new Error(`Invalid engine environment: ${name} is required`);
+  }
+  return value;
+}
+function requireValidURL(value, name) {
+  try {
+    new URL(value);
+    return value;
+  } catch {
+    throw new Error(`Invalid engine environment: ${name} must be a valid URL`);
+  }
+}
+function parseClaudeAuthMethod(value) {
+  if (value === "oauth" || value === "api_key" || value === "bedrock" || value === "foundry") {
+    return value;
+  }
+  return void 0;
+}
+function parseCodexAuthMethod(value) {
+  if (value === "oauth" || value === "api_key" || value === "foundry") {
+    return value;
+  }
+  return void 0;
+}
+function parseAgentCredentialSnapshots(value) {
+  if (!value) return {};
+  try {
+    const parsed = JSON.parse(value);
+    if (!isRecord(parsed)) return {};
+    const snapshots = {};
+    for (const [provider, snapshot] of Object.entries(parsed)) {
+      if (!isValidAgentProvider(provider)) continue;
+      const parsedSnapshot = agentCredentialSnapshotSchema.safeParse(snapshot);
+      if (parsedSnapshot.success) snapshots[provider] = parsedSnapshot.data;
+    }
+    return snapshots;
+  } catch {
+    return {};
+  }
+}
+var IS_WARMING_MODE = process.argv.includes("--warming");
+function loadEngineEnv() {
+  loadRuntimeEnvFile();
+  const HOME_DIR = homedir2();
+  const env = {
+    // Defined: always available
+    REPLICAS_ENGINE_SECRET: requireDefined(readEnv("REPLICAS_ENGINE_SECRET"), "REPLICAS_ENGINE_SECRET"),
+    REPLICAS_ENGINE_PORT: parsePort(readEnv("REPLICAS_ENGINE_PORT")),
+    REPLICAS_MONOLITH_URL: requireValidURL(
+      requireDefined(readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.monolithUrl), "REPLICAS_MONOLITH_URL"),
+      "REPLICAS_MONOLITH_URL"
+    ),
+    HOME_DIR,
+    WORKSPACE_ROOT: join2(HOME_DIR, "workspaces"),
+    REPLICAS_SANDBOX_IMAGE_VERSION: readSandboxImageVersion(),
+    // Runtime: may not be set during warming
+    REPLICAS_WORKSPACE_ID: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.workspaceId),
+    REPLICAS_LINEAR_SESSION_ID: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.linearSessionId),
+    REPLICAS_LINEAR_ACCESS_TOKEN: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.linearAccessToken),
+    REPLICAS_SLACK_BOT_TOKEN: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.slackBotToken),
+    REPLICAS_SLACK_CHANNEL_ID: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.slackChannelId),
+    REPLICAS_SLACK_THREAD_TS: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.slackThreadTs),
+    ANTHROPIC_API_KEY: readEnv("ANTHROPIC_API_KEY"),
+    OPENAI_API_KEY: readEnv("OPENAI_API_KEY"),
+    CURSOR_API_KEY: readEnv("CURSOR_API_KEY"),
+    AI_GATEWAY_API_KEY: readEnv("AI_GATEWAY_API_KEY"),
+    CLAUDE_CODE_USE_BEDROCK: readEnv("CLAUDE_CODE_USE_BEDROCK"),
+    AWS_ACCESS_KEY_ID: readEnv("AWS_ACCESS_KEY_ID"),
+    AWS_SECRET_ACCESS_KEY: readEnv("AWS_SECRET_ACCESS_KEY"),
+    AWS_REGION: readEnv("AWS_REGION"),
+    ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION: readEnv("ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION"),
+    REPLICAS_CLAUDE_AUTH_METHOD: parseClaudeAuthMethod(readEnv("REPLICAS_CLAUDE_AUTH_METHOD")),
+    REPLICAS_CODEX_AUTH_METHOD: parseCodexAuthMethod(readEnv("REPLICAS_CODEX_AUTH_METHOD")),
+    REPLICAS_AGENT_CREDENTIALS: parseAgentCredentialSnapshots(readEnv("REPLICAS_AGENT_CREDENTIALS")),
+    REPLICAS_ENV_SYSTEM_PROMPT: readEnv("REPLICAS_ENV_SYSTEM_PROMPT"),
+    REPLICAS_ENV_START_HOOK: readEnv("REPLICAS_ENV_START_HOOK"),
+    REPLICAS_DISABLE_AUTO_START_HOOKS: readEnv("REPLICAS_DISABLE_AUTO_START_HOOKS")?.toLowerCase() === "true",
+    REPLICAS_ENGINE_DEFER_INITIALIZATION: readEnv("REPLICAS_ENGINE_DEFER_INITIALIZATION")?.toLowerCase() === "true"
+  };
+  if (!IS_WARMING_MODE && !env.REPLICAS_WORKSPACE_ID) {
+    console.error("REPLICAS_WORKSPACE_ID is not set \u2014 this is required in normal (non-warming) mode");
+  }
+  return env;
+}
+var ENGINE_ENV = loadEngineEnv();
+function setAgentCredentialSnapshot(provider, snapshot) {
+  ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS = {
+    ...ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS,
+    [provider]: snapshot
+  };
+  process.env.REPLICAS_AGENT_CREDENTIALS = JSON.stringify(ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS);
+}
+
+export {
+  isRecord,
+  IS_WARMING_MODE,
+  loadEngineEnv,
+  ENGINE_ENV,
+  setAgentCredentialSnapshot
+};

package/dist/src/chunk-6GXXZQID.js

@@ -0,0 +1,448 @@
+#!/usr/bin/env node
+import {
+  CodexAspAuthMethodChangedError
+} from "./chunk-6WY7NPCL.js";
+import {
+  HOOK_EXEC_MAX_BUFFER_BYTES,
+  isVersionBelow
+} from "./chunk-TMERKNQV.js";
+
+// src/managers/codex-asp/app-server-process.ts
+import { spawn } from "child_process";
+import { EventEmitter as EventEmitter2 } from "events";
+
+// src/managers/codex-asp/asp-client.ts
+import { EventEmitter } from "events";
+var DEFAULT_REQUEST_TIMEOUT_MS = 12e4;
+function hasOwn(record, key) {
+  return Object.prototype.hasOwnProperty.call(record, key);
+}
+var AspClient = class {
+  stdin;
+  stdout;
+  emitter = new EventEmitter();
+  pending = /* @__PURE__ */ new Map();
+  nextId = 1;
+  lineBuffer = "";
+  disposed = false;
+  get isDisposed() {
+    return this.disposed;
+  }
+  constructor(options) {
+    this.stdin = options.stdin;
+    this.stdout = options.stdout;
+    this.stdout.setEncoding("utf8");
+    this.stdout.on("data", this.handleStdoutData);
+    this.stdin.on("error", this.handleStdinError);
+  }
+  on(event, listener) {
+    this.emitter.on(event, listener);
+  }
+  off(event, listener) {
+    this.emitter.off(event, listener);
+  }
+  async request(method, params, opts) {
+    if (this.disposed) {
+      throw new Error(`Cannot send ${method}: ASP client disposed`);
+    }
+    const id = this.nextId;
+    this.nextId += 1;
+    const promise = new Promise((resolve, reject) => {
+      const timeoutMs = opts?.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+      const timer = timeoutMs > 0 ? setTimeout(() => {
+        this.pending.delete(id);
+        reject(new Error(`ASP request timed out for ${method}`));
+      }, timeoutMs) : null;
+      this.pending.set(id, { resolve, reject, method, timer });
+    });
+    this.write({ method, id, params });
+    return promise;
+  }
+  notify(method, params) {
+    if (this.disposed) {
+      return;
+    }
+    try {
+      this.write(params === void 0 ? { method } : { method, params });
+    } catch (error) {
+      console.warn(`[AspClient] Failed to send notification ${method}:`, error);
+    }
+  }
+  respond(id, result) {
+    if (this.disposed) {
+      return;
+    }
+    try {
+      this.write({ id, result });
+    } catch (error) {
+      console.warn(`[AspClient] Failed to send response ${String(id)}:`, error);
+    }
+  }
+  reject(id, code, message, data) {
+    if (this.disposed) {
+      return;
+    }
+    try {
+      this.write({
+        id,
+        error: {
+          code,
+          message,
+          ...data !== void 0 ? { data } : {}
+        }
+      });
+    } catch (error) {
+      console.warn(`[AspClient] Failed to send error response ${String(id)}:`, error);
+    }
+  }
+  dispose(reason = new Error("ASP client disposed")) {
+    if (this.disposed) {
+      return;
+    }
+    this.disposed = true;
+    this.stdout.off("data", this.handleStdoutData);
+    this.stdin.removeListener("error", this.handleStdinError);
+    for (const [id, pending] of this.pending) {
+      if (pending.timer) {
+        clearTimeout(pending.timer);
+      }
+      pending.reject(new Error(`${reason.message} while waiting for ${pending.method}`));
+      this.pending.delete(id);
+    }
+    this.lineBuffer = "";
+    this.emitter.emit("dispose", reason);
+    this.emitter.removeAllListeners();
+  }
+  handleStdoutData = (chunk) => {
+    this.lineBuffer += chunk.toString();
+    let newlineIndex = this.lineBuffer.indexOf("\n");
+    while (newlineIndex >= 0) {
+      const line = this.lineBuffer.slice(0, newlineIndex).trim();
+      this.lineBuffer = this.lineBuffer.slice(newlineIndex + 1);
+      if (line.length > 0) {
+        this.handleLine(line);
+      }
+      newlineIndex = this.lineBuffer.indexOf("\n");
+    }
+  };
+  handleStdinError = (error) => {
+    this.dispose(new Error(`ASP stdin error: ${error.message}`));
+  };
+  handleLine(line) {
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch (error) {
+      console.warn("[AspClient] Failed to parse ASP JSON line:", error);
+      return;
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      console.warn("[AspClient] Ignoring non-object ASP message");
+      return;
+    }
+    const message = parsed;
+    const hasRequestId = typeof message.id === "number" || typeof message.id === "string";
+    if (hasRequestId && (hasOwn(message, "result") || hasOwn(message, "error"))) {
+      this.handleResponse(message);
+      return;
+    }
+    if (hasRequestId && typeof message.method === "string") {
+      this.emitter.emit("serverRequest", message);
+      return;
+    }
+    if (!hasOwn(message, "id") && typeof message.method === "string") {
+      this.emitter.emit("notification", message);
+    }
+  }
+  handleResponse(message) {
+    if (typeof message.id !== "number") {
+      console.warn("[AspClient] Ignoring response with non-numeric request id");
+      return;
+    }
+    const pending = this.pending.get(message.id);
+    if (!pending) {
+      console.warn(`[AspClient] Ignoring response for unknown request id ${message.id}`);
+      return;
+    }
+    this.pending.delete(message.id);
+    if (pending.timer) {
+      clearTimeout(pending.timer);
+    }
+    if (hasOwn(message, "error")) {
+      pending.reject(this.createRpcError(pending.method, message.error));
+      return;
+    }
+    pending.resolve(message.result);
+  }
+  createRpcError(method, error) {
+    if (typeof error !== "object" || error === null || Array.isArray(error)) {
+      return new Error(`ASP request failed for ${method}`);
+    }
+    const rpcError = error;
+    const code = typeof rpcError.code === "number" ? ` ${rpcError.code}` : "";
+    const message = typeof rpcError.message === "string" ? rpcError.message : "Unknown ASP error";
+    const data = hasOwn(rpcError, "data") ? ` data=${JSON.stringify(rpcError.data)}` : "";
+    return new Error(`ASP request failed for ${method}:${code} ${message}${data}`);
+  }
+  write(message) {
+    try {
+      this.stdin.write(`${JSON.stringify(message)}
+`, (error) => {
+        if (error) {
+          this.dispose(new Error(`ASP write failed: ${error.message}`));
+        }
+      });
+    } catch (error) {
+      const writeError = error instanceof Error ? error : new Error("ASP write failed");
+      this.dispose(writeError);
+      throw writeError;
+    }
+  }
+};
+
+// src/utils/exec.ts
+import { exec, execFile } from "child_process";
+import { promisify } from "util";
+var execAsync = promisify(exec);
+var execFileAsync = promisify(execFile);
+var SUBPROCESS_MAX_BUFFER = HOOK_EXEC_MAX_BUFFER_BYTES;
+
+// src/managers/codex-asp/app-server-process.ts
+var DEFAULT_CODEX_BINARY = "codex";
+var DEFAULT_CODEX_ARGS = [
+  "app-server",
+  "--listen",
+  "stdio://",
+  "-c",
+  "features.memories=false",
+  "-c",
+  "memories.use_memories=false",
+  "-c",
+  "memories.generate_memories=false"
+];
+var MIN_CODEX_CLI_VERSION = "0.144.6";
+var CODEX_UPGRADE_TIMEOUT_MS = 12e4;
+var codexCliVersionEnsured = null;
+var ENGINE_PACKAGE_VERSION = "0.1.671";
+var INITIALIZE_METHOD = "initialize";
+var INITIALIZED_NOTIFICATION = "initialized";
+var ACCOUNT_LOGIN_START_METHOD = "account/login/start";
+var AppServerProcess = class {
+  binary;
+  args;
+  env;
+  cwd;
+  chatgptAuthTokens;
+  refreshChatgptAuthTokens;
+  emitter = new EventEmitter2();
+  child = null;
+  client = null;
+  shuttingDown = false;
+  invalidating = false;
+  constructor(options) {
+    this.binary = options.binary ?? DEFAULT_CODEX_BINARY;
+    const baseArgs = options.args ?? (options.env.REPLICAS_CODEX_AUTH_METHOD === "foundry" ? [
+      ...DEFAULT_CODEX_ARGS,
+      "-c",
+      `model=${JSON.stringify(options.env.CODEX_FOUNDRY_MODEL)}`,
+      "-c",
+      'model_provider="azure"',
+      "-c",
+      'model_providers.azure.name="Azure OpenAI"',
+      "-c",
+      `model_providers.azure.base_url=${JSON.stringify(options.env.CODEX_FOUNDRY_BASE_URL)}`,
+      "-c",
+      'model_providers.azure.env_key="AZURE_OPENAI_API_KEY"',
+      "-c",
+      'model_providers.azure.wire_api="responses"'
+    ] : DEFAULT_CODEX_ARGS);
+    this.args = [...baseArgs, ...(options.configOverrides ?? []).flatMap((override) => ["-c", override])];
+    this.env = options.env;
+    this.cwd = options.cwd;
+    this.chatgptAuthTokens = options.chatgptAuthTokens;
+    this.refreshChatgptAuthTokens = options.refreshChatgptAuthTokens;
+  }
+  on(event, listener) {
+    this.emitter.on(event, listener);
+  }
+  async start() {
+    if (this.child && this.client) {
+      return { client: this.client };
+    }
+    this.shuttingDown = false;
+    this.invalidating = false;
+    await this.ensureMinCodexCliVersion();
+    const child = spawn(this.binary, this.args, {
+      cwd: this.cwd,
+      env: this.env,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    this.child = child;
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (chunk) => {
+      for (const line of chunk.toString().split("\n")) {
+        if (line.trim().length > 0) {
+          console.error(`[codex-app-server] ${line}`);
+        }
+      }
+    });
+    child.on("exit", (code, signal) => {
+      this.client?.dispose();
+      this.client = null;
+      this.child = null;
+      if (!this.shuttingDown) {
+        if (!this.invalidating) {
+          console.warn(`[AppServerProcess] codex app-server exited unexpectedly code=${code ?? "null"} signal=${signal ?? "null"}`);
+        }
+        this.emitter.emit("exit", code, signal);
+      }
+    });
+    const client = new AspClient({ stdin: child.stdin, stdout: child.stdout });
+    this.client = client;
+    client.on("serverRequest", (serverRequest) => {
+      if (serverRequest.method !== "account/chatgptAuthTokens/refresh") return;
+      if (!this.refreshChatgptAuthTokens) {
+        client.reject(serverRequest.id, -32603, "Codex OAuth refresh is not configured");
+        return;
+      }
+      void this.refreshChatgptAuthTokens(serverRequest.params).then((tokens) => {
+        client.respond(serverRequest.id, tokens);
+      }).catch((error) => {
+        if (error instanceof CodexAspAuthMethodChangedError) {
+          this.invalidating = true;
+          client.dispose(error);
+          if (!child.killed) child.kill("SIGTERM");
+          return;
+        }
+        client.reject(
+          serverRequest.id,
+          -32603,
+          error instanceof Error ? error.message : "Failed to refresh Codex OAuth credentials"
+        );
+      });
+    });
+    let cleanupEarlyFailureHandlers = () => {
+    };
+    const earlyFailure = new Promise((_resolve, reject) => {
+      const onError = (error) => {
+        reject(error);
+      };
+      const onExit = (code, signal) => {
+        reject(new Error(`codex app-server exited before initialize completed code=${code ?? "null"} signal=${signal ?? "null"}`));
+      };
+      child.once("error", onError);
+      child.once("exit", onExit);
+      cleanupEarlyFailureHandlers = () => {
+        child.off("error", onError);
+        child.off("exit", onExit);
+      };
+    });
+    try {
+      const initializeParams = {
+        clientInfo: {
+          name: "replicas_engine",
+          title: "Replicas Engine",
+          version: ENGINE_PACKAGE_VERSION
+        },
+        capabilities: {
+          experimentalApi: true,
+          requestAttestation: false,
+          optOutNotificationMethods: null
+        }
+      };
+      await Promise.race([
+        client.request(INITIALIZE_METHOD, initializeParams),
+        earlyFailure
+      ]);
+      cleanupEarlyFailureHandlers();
+      client.notify(INITIALIZED_NOTIFICATION);
+      await this.loginWithConfiguredCredentials(client);
+      return { client };
+    } catch (error) {
+      cleanupEarlyFailureHandlers();
+      client.dispose();
+      await this.killAfterFailedStart();
+      throw error;
+    }
+  }
+  async stop() {
+    const child = this.child;
+    this.shuttingDown = true;
+    this.client?.dispose(new Error("ASP process stopped"));
+    this.client = null;
+    this.child = null;
+    if (!child || child.killed) {
+      return;
+    }
+    await new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        child.kill("SIGKILL");
+      }, 2e3);
+      child.once("exit", () => {
+        clearTimeout(timer);
+        resolve();
+      });
+      child.kill("SIGTERM");
+    });
+  }
+  ensureMinCodexCliVersion() {
+    codexCliVersionEnsured ??= this.runEnsureMinCodexCliVersion().catch((error) => {
+      codexCliVersionEnsured = null;
+      console.warn("[AppServerProcess] Failed to ensure minimum codex CLI version, continuing with installed binary:", error);
+    });
+    return codexCliVersionEnsured;
+  }
+  async runEnsureMinCodexCliVersion() {
+    const { stdout } = await execFileAsync(this.binary, ["--version"], { env: this.env });
+    const version = stdout.match(/(\d+\.\d+\.\d+)/)?.[1];
+    if (version && !isVersionBelow(version, MIN_CODEX_CLI_VERSION)) {
+      return;
+    }
+    console.warn(`[AppServerProcess] codex CLI ${version ?? "unknown"} is below ${MIN_CODEX_CLI_VERSION}; upgrading @openai/codex`);
+    await execFileAsync(
+      "npm",
+      ["install", "-g", "--no-audit", "--no-fund", `@openai/codex@${MIN_CODEX_CLI_VERSION}`],
+      { env: this.env, timeout: CODEX_UPGRADE_TIMEOUT_MS }
+    );
+    console.warn(`[AppServerProcess] upgraded codex CLI to ${MIN_CODEX_CLI_VERSION}`);
+  }
+  async loginWithConfiguredCredentials(client) {
+    if (this.env.REPLICAS_CODEX_AUTH_METHOD === "oauth") {
+      if (!this.chatgptAuthTokens) {
+        throw new Error("Codex OAuth credentials were not prepared before app-server startup");
+      }
+      const params2 = {
+        type: "chatgptAuthTokens",
+        ...this.chatgptAuthTokens
+      };
+      await client.request(ACCOUNT_LOGIN_START_METHOD, params2);
+      return;
+    }
+    if (this.env.REPLICAS_CODEX_AUTH_METHOD !== "api_key" || !this.env.OPENAI_API_KEY) return;
+    const params = {
+      type: "apiKey",
+      apiKey: this.env.OPENAI_API_KEY
+    };
+    await client.request(ACCOUNT_LOGIN_START_METHOD, params);
+  }
+  async killAfterFailedStart() {
+    const child = this.child;
+    this.child = null;
+    this.client = null;
+    if (!child || child.killed) {
+      return;
+    }
+    this.shuttingDown = true;
+    child.kill("SIGKILL");
+    await new Promise((resolve) => {
+      child.once("exit", () => resolve());
+    });
+  }
+};
+
+export {
+  execAsync,
+  execFileAsync,
+  SUBPROCESS_MAX_BUFFER,
+  AppServerProcess
+};