replicas-engine 0.1.673 → 0.1.676

package/dist/src/{chunk-5NBVP6A2.js → chunk-OLZ7JWCU.js}

@@ -1,20 +1,5 @@
 #!/usr/bin/env node
 
-// ../shared/src/result.ts
-function createSuccessResult(data) {
-  return { ok: true, data };
-}
-function createErrorResult(error) {
-  return {
-    ok: false,
-    error: {
-      message: error.message,
-      code: error.code,
-      details: error.details
-    }
-  };
-}
-
 // ../shared/src/agent.ts
 var AGENT = {
   CLAUDE: "claude",
@@ -67,113 +52,19 @@ function codexReasoningEffortForThinkingLevel(thinkingLevel) {
   return thinkingLevel ? CODEX_REASONING_EFFORT_BY_THINKING_LEVEL[thinkingLevel] : void 0;
 }
 
-// ../shared/src/analytics/types.ts
-import { z } from "zod";
-
-// ../shared/src/credentials/types.ts
-var CREDENTIAL_SCOPE = {
-  USER: "user",
-  ORG: "org"
-};
-var CREDENTIAL_SCOPES = Object.values(CREDENTIAL_SCOPE);
-var CREDENTIAL_SCOPE_PRIORITY = [CREDENTIAL_SCOPE.USER, CREDENTIAL_SCOPE.ORG];
-
-// ../shared/src/type-guards.ts
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-// ../shared/src/credentials/agents.ts
-var CREDENTIAL_METHOD = {
-  OAUTH: "oauth",
-  API_KEY: "api_key",
-  FOUNDRY: "foundry",
-  BEDROCK: "bedrock",
-  OPENCODE_GO: "opencode-go",
-  ASTER: "aster",
-  OPENROUTER: "openrouter",
-  AI_GATEWAY: "ai-gateway"
-};
-var CREDENTIAL_TYPE = {
-  CLAUDE_OAUTH: "claude",
-  ANTHROPIC_API_KEY: "claude_anthropic_api_key",
-  CLAUDE_FOUNDRY: "claude_foundry",
-  CLAUDE_BEDROCK: "claude_bedrock",
-  CODEX_OAUTH: "codex",
-  OPENAI_API_KEY: "openai_api_key",
-  CODEX_FOUNDRY: "codex_foundry",
-  CURSOR_API_KEY: "cursor_api_key",
-  OPENCODE_GO_API_KEY: "opencode_go_api_key",
-  ASTER_API_KEY: "aster_api_key",
-  OPENROUTER_API_KEY: "openrouter_api_key",
-  AI_GATEWAY_API_KEY: "ai_gateway_api_key"
-};
-var AGENT_CREDENTIAL_METHODS_IN_ORDER = {
-  [AGENT.CLAUDE]: [
-    { method: CREDENTIAL_METHOD.OAUTH, credentialType: CREDENTIAL_TYPE.CLAUDE_OAUTH },
-    { method: CREDENTIAL_METHOD.API_KEY, credentialType: CREDENTIAL_TYPE.ANTHROPIC_API_KEY },
-    { method: CREDENTIAL_METHOD.FOUNDRY, credentialType: CREDENTIAL_TYPE.CLAUDE_FOUNDRY },
-    { method: CREDENTIAL_METHOD.BEDROCK, credentialType: CREDENTIAL_TYPE.CLAUDE_BEDROCK }
-  ],
-  [AGENT.CODEX]: [
-    { method: CREDENTIAL_METHOD.OAUTH, credentialType: CREDENTIAL_TYPE.CODEX_OAUTH },
-    { method: CREDENTIAL_METHOD.API_KEY, credentialType: CREDENTIAL_TYPE.OPENAI_API_KEY },
-    { method: CREDENTIAL_METHOD.FOUNDRY, credentialType: CREDENTIAL_TYPE.CODEX_FOUNDRY }
-  ],
-  [AGENT.CURSOR]: [
-    { method: CREDENTIAL_METHOD.API_KEY, credentialType: CREDENTIAL_TYPE.CURSOR_API_KEY }
-  ],
-  [AGENT.DEEPSEEK]: [
-    { method: CREDENTIAL_METHOD.OPENROUTER, credentialType: CREDENTIAL_TYPE.OPENROUTER_API_KEY }
-  ],
-  [AGENT.FX]: [
-    { method: CREDENTIAL_METHOD.AI_GATEWAY, credentialType: CREDENTIAL_TYPE.AI_GATEWAY_API_KEY }
-  ],
-  [AGENT.KIMI]: [
-    { method: CREDENTIAL_METHOD.AI_GATEWAY, credentialType: CREDENTIAL_TYPE.AI_GATEWAY_API_KEY }
-  ],
-  [AGENT.OPENCODE]: [
-    { method: CREDENTIAL_METHOD.OPENCODE_GO, credentialType: CREDENTIAL_TYPE.OPENCODE_GO_API_KEY },
-    { method: CREDENTIAL_METHOD.ASTER, credentialType: CREDENTIAL_TYPE.ASTER_API_KEY },
-    { method: CREDENTIAL_METHOD.OPENROUTER, credentialType: CREDENTIAL_TYPE.OPENROUTER_API_KEY }
-  ],
-  [AGENT.PI]: [
-    { method: CREDENTIAL_METHOD.ASTER, credentialType: CREDENTIAL_TYPE.ASTER_API_KEY },
-    { method: CREDENTIAL_METHOD.OPENROUTER, credentialType: CREDENTIAL_TYPE.OPENROUTER_API_KEY }
-  ]
-};
-
-// ../shared/src/analytics/types.ts
-function isAgentChatActivityRecord(value) {
-  return isRecord(value) && typeof value.chatId === "string" && typeof value.provider === "string" && isValidAgentProvider(value.provider) && typeof value.model === "string" && (value.credentialMethod === void 0 || isAuthMethod(value.credentialMethod)) && (value.credentialScope === void 0 || isCredentialScope(value.credentialScope)) && value.credentialMethod === void 0 === (value.credentialScope === void 0) && (value.senderUserId === void 0 || typeof value.senderUserId === "string") && typeof value.occurredAt === "string";
-}
-var agentCredentialSnapshotSchema = z.object({
-  method: z.enum(CREDENTIAL_METHOD),
-  scope: z.enum(CREDENTIAL_SCOPE),
-  revision: z.string().optional()
-});
-function isAuthMethod(value) {
-  return typeof value === "string" && Object.values(CREDENTIAL_METHOD).some((method) => method === value);
-}
-function isCredentialScope(value) {
-  return typeof value === "string" && CREDENTIAL_SCOPES.some((scope) => scope === value);
-}
-function isAgentChatTurnActivityRecord(value) {
-  return isAgentChatActivityRecord(value) && typeof value.turnId === "string" && typeof value.seconds === "number" && Number.isFinite(value.seconds) && value.seconds >= 0;
-}
-function isAgentChatActivityCallRecord(value) {
-  return isAgentChatActivityRecord(value) && typeof value.callId === "string" && value.callId.length > 0;
-}
-function isNamedAgentChatActivityRecord(value, field) {
-  if (!isAgentChatActivityCallRecord(value)) return false;
-  const name = value[field];
-  return typeof name === "string" && name.length > 0;
-}
-function isAgentChatSkillActivityRecord(value) {
-  return isNamedAgentChatActivityRecord(value, "skillName");
+// ../shared/src/result.ts
+function createSuccessResult(data) {
+  return { ok: true, data };
 }
-function isAgentChatMcpActivityRecord(value) {
-  return isNamedAgentChatActivityRecord(value, "mcpName");
+function createErrorResult(error) {
+  return {
+    ok: false,
+    error: {
+      message: error.message,
+      code: error.code,
+      details: error.details
+    }
+  };
 }
 
 // ../shared/src/sandbox.ts
@@ -340,63 +231,48 @@ function gitIdentityConfigCommands(identity, scope = "global") {
 }
 
 // ../shared/src/headless-agent.ts
-import { z as z2 } from "zod";
-var headlessAgentRequestBaseSchema = z2.object({
-  agent: z2.custom(
+import { z } from "zod";
+var headlessAgentRequestBaseSchema = z.object({
+  agent: z.custom(
     (value) => typeof value === "string" && isValidCodingAgentProvider(value)
   ),
-  model: z2.string().min(1),
-  prompt: z2.string(),
-  workingDirectory: z2.string().min(1),
-  timeoutSeconds: z2.number().int().min(1).max(1800).default(300)
+  model: z.string().min(1),
+  prompt: z.string(),
+  workingDirectory: z.string().min(1),
+  timeoutSeconds: z.number().int().min(1).max(1800).default(300),
+  codexOauthTokens: z.object({ accessToken: z.string(), accountId: z.string() }).optional()
 });
-var headlessAgentInputFileSchema = z2.object({
-  path: z2.string().min(1),
-  downloadUrl: z2.url()
+var headlessAgentInputFileSchema = z.object({
+  path: z.string().min(1),
+  downloadUrl: z.url()
 });
-var headlessAgentOutputFileSchema = z2.object({
-  path: z2.string().min(1),
-  uploadUrl: z2.url(),
-  contentType: z2.string().min(1),
-  minChars: z2.number().int().positive().optional(),
-  maxChars: z2.number().int().positive().optional()
+var headlessAgentOutputFileSchema = z.object({
+  path: z.string().min(1),
+  uploadUrl: z.url(),
+  contentType: z.string().min(1),
+  minChars: z.number().int().positive().optional(),
+  maxChars: z.number().int().positive().optional()
 });
-var headlessAgentRequestSchema = z2.discriminatedUnion("mode", [
+var headlessAgentRequestSchema = z.discriminatedUnion("mode", [
   headlessAgentRequestBaseSchema.extend({
-    mode: z2.literal("structured"),
-    outputSchema: z2.record(z2.string(), z2.json())
+    mode: z.literal("structured"),
+    outputSchema: z.record(z.string(), z.json())
   }),
   headlessAgentRequestBaseSchema.extend({
-    mode: z2.literal("filesystem"),
-    inputFiles: z2.array(headlessAgentInputFileSchema),
-    outputFiles: z2.array(headlessAgentOutputFileSchema),
-    sensitiveValues: z2.array(z2.string())
+    mode: z.literal("filesystem"),
+    inputFiles: z.array(headlessAgentInputFileSchema),
+    outputFiles: z.array(headlessAgentOutputFileSchema),
+    sensitiveValues: z.array(z.string())
   })
 ]);
-var headlessFilesystemAgentResultSchema = z2.object({
-  message: z2.string(),
-  files: z2.record(z2.string(), z2.object({
-    sha256: z2.string().regex(/^[a-f0-9]{64}$/),
-    sizeBytes: z2.number().int().nonnegative()
+var headlessFilesystemAgentResultSchema = z.object({
+  message: z.string(),
+  files: z.record(z.string(), z.object({
+    sha256: z.string().regex(/^[a-f0-9]{64}$/),
+    sizeBytes: z.number().int().nonnegative()
   }))
 });
 
-// ../shared/src/version.ts
-function compareVersions(v1, v2) {
-  const parts1 = v1.split(".").map(Number);
-  const parts2 = v2.split(".").map(Number);
-  for (let i = 0; i < Math.max(parts1.length, parts2.length); i++) {
-    const num1 = parts1[i] || 0;
-    const num2 = parts2[i] || 0;
-    if (num1 > num2) return 1;
-    if (num1 < num2) return -1;
-  }
-  return 0;
-}
-function isVersionBelow(version, minimum) {
-  return compareVersions(version, minimum) < 0;
-}
-
 // ../shared/src/engine/environment.ts
 var DESKTOP_STREAM_PORT = 6080;
 
@@ -417,6 +293,11 @@ var ASTER_MODEL_LABELS = {
   "gpt-oss-120b": "GPT-OSS 120B"
 };
 
+// ../shared/src/type-guards.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // ../shared/src/engine/types.ts
 var DEFAULT_CHAT_TITLES = {
   claude: "Claude Code",
@@ -712,6 +593,110 @@ function paginateEngineLogContent(input) {
   };
 }
 
+// ../shared/src/analytics/types.ts
+import { z as z2 } from "zod";
+
+// ../shared/src/credentials/types.ts
+var CREDENTIAL_SCOPE = {
+  USER: "user",
+  ORG: "org"
+};
+var CREDENTIAL_SCOPES = Object.values(CREDENTIAL_SCOPE);
+var CREDENTIAL_SCOPE_PRIORITY = [CREDENTIAL_SCOPE.USER, CREDENTIAL_SCOPE.ORG];
+
+// ../shared/src/credentials/agents.ts
+var CREDENTIAL_METHOD = {
+  OAUTH: "oauth",
+  API_KEY: "api_key",
+  FOUNDRY: "foundry",
+  BEDROCK: "bedrock",
+  OPENCODE_GO: "opencode-go",
+  ASTER: "aster",
+  OPENROUTER: "openrouter",
+  AI_GATEWAY: "ai-gateway"
+};
+var CREDENTIAL_TYPE = {
+  CLAUDE_OAUTH: "claude",
+  ANTHROPIC_API_KEY: "claude_anthropic_api_key",
+  CLAUDE_FOUNDRY: "claude_foundry",
+  CLAUDE_BEDROCK: "claude_bedrock",
+  CODEX_OAUTH: "codex",
+  OPENAI_API_KEY: "openai_api_key",
+  CODEX_FOUNDRY: "codex_foundry",
+  CURSOR_API_KEY: "cursor_api_key",
+  OPENCODE_GO_API_KEY: "opencode_go_api_key",
+  ASTER_API_KEY: "aster_api_key",
+  OPENROUTER_API_KEY: "openrouter_api_key",
+  AI_GATEWAY_API_KEY: "ai_gateway_api_key"
+};
+var AGENT_CREDENTIAL_METHODS_IN_ORDER = {
+  [AGENT.CLAUDE]: [
+    { method: CREDENTIAL_METHOD.OAUTH, credentialType: CREDENTIAL_TYPE.CLAUDE_OAUTH },
+    { method: CREDENTIAL_METHOD.API_KEY, credentialType: CREDENTIAL_TYPE.ANTHROPIC_API_KEY },
+    { method: CREDENTIAL_METHOD.FOUNDRY, credentialType: CREDENTIAL_TYPE.CLAUDE_FOUNDRY },
+    { method: CREDENTIAL_METHOD.BEDROCK, credentialType: CREDENTIAL_TYPE.CLAUDE_BEDROCK }
+  ],
+  [AGENT.CODEX]: [
+    { method: CREDENTIAL_METHOD.OAUTH, credentialType: CREDENTIAL_TYPE.CODEX_OAUTH },
+    { method: CREDENTIAL_METHOD.API_KEY, credentialType: CREDENTIAL_TYPE.OPENAI_API_KEY },
+    { method: CREDENTIAL_METHOD.FOUNDRY, credentialType: CREDENTIAL_TYPE.CODEX_FOUNDRY }
+  ],
+  [AGENT.CURSOR]: [
+    { method: CREDENTIAL_METHOD.API_KEY, credentialType: CREDENTIAL_TYPE.CURSOR_API_KEY }
+  ],
+  [AGENT.DEEPSEEK]: [
+    { method: CREDENTIAL_METHOD.OPENROUTER, credentialType: CREDENTIAL_TYPE.OPENROUTER_API_KEY }
+  ],
+  [AGENT.FX]: [
+    { method: CREDENTIAL_METHOD.AI_GATEWAY, credentialType: CREDENTIAL_TYPE.AI_GATEWAY_API_KEY }
+  ],
+  [AGENT.KIMI]: [
+    { method: CREDENTIAL_METHOD.AI_GATEWAY, credentialType: CREDENTIAL_TYPE.AI_GATEWAY_API_KEY }
+  ],
+  [AGENT.OPENCODE]: [
+    { method: CREDENTIAL_METHOD.OPENCODE_GO, credentialType: CREDENTIAL_TYPE.OPENCODE_GO_API_KEY },
+    { method: CREDENTIAL_METHOD.ASTER, credentialType: CREDENTIAL_TYPE.ASTER_API_KEY },
+    { method: CREDENTIAL_METHOD.OPENROUTER, credentialType: CREDENTIAL_TYPE.OPENROUTER_API_KEY }
+  ],
+  [AGENT.PI]: [
+    { method: CREDENTIAL_METHOD.ASTER, credentialType: CREDENTIAL_TYPE.ASTER_API_KEY },
+    { method: CREDENTIAL_METHOD.OPENROUTER, credentialType: CREDENTIAL_TYPE.OPENROUTER_API_KEY }
+  ]
+};
+
+// ../shared/src/analytics/types.ts
+function isAgentChatActivityRecord(value) {
+  return isRecord(value) && typeof value.chatId === "string" && typeof value.provider === "string" && isValidAgentProvider(value.provider) && typeof value.model === "string" && (value.credentialMethod === void 0 || isAuthMethod(value.credentialMethod)) && (value.credentialScope === void 0 || isCredentialScope(value.credentialScope)) && value.credentialMethod === void 0 === (value.credentialScope === void 0) && (value.senderUserId === void 0 || typeof value.senderUserId === "string") && typeof value.occurredAt === "string";
+}
+var agentCredentialSnapshotSchema = z2.object({
+  method: z2.enum(CREDENTIAL_METHOD),
+  scope: z2.enum(CREDENTIAL_SCOPE),
+  revision: z2.string().optional()
+});
+function isAuthMethod(value) {
+  return typeof value === "string" && Object.values(CREDENTIAL_METHOD).some((method) => method === value);
+}
+function isCredentialScope(value) {
+  return typeof value === "string" && CREDENTIAL_SCOPES.some((scope) => scope === value);
+}
+function isAgentChatTurnActivityRecord(value) {
+  return isAgentChatActivityRecord(value) && typeof value.turnId === "string" && typeof value.seconds === "number" && Number.isFinite(value.seconds) && value.seconds >= 0;
+}
+function isAgentChatActivityCallRecord(value) {
+  return isAgentChatActivityRecord(value) && typeof value.callId === "string" && value.callId.length > 0;
+}
+function isNamedAgentChatActivityRecord(value, field) {
+  if (!isAgentChatActivityCallRecord(value)) return false;
+  const name = value[field];
+  return typeof name === "string" && name.length > 0;
+}
+function isAgentChatSkillActivityRecord(value) {
+  return isNamedAgentChatActivityRecord(value, "skillName");
+}
+function isAgentChatMcpActivityRecord(value) {
+  return isNamedAgentChatActivityRecord(value, "mcpName");
+}
+
 // ../shared/src/event.ts
 var CLAUDE_PARTIAL_MESSAGE_EVENT_TYPE = "claude-partial-message";
 function coerceClaudePartialMessagePayload(payload) {
@@ -1006,37 +991,6 @@ function paginateChatHistory(full, params) {
   };
 }
 
-// ../shared/src/routes/codex.ts
-var CODEX_AUTH_ENV_KEYS = [
-  "OPENAI_API_KEY",
-  "AZURE_OPENAI_API_KEY",
-  "CODEX_FOUNDRY_BASE_URL",
-  "CODEX_FOUNDRY_MODEL",
-  "REPLICAS_CODEX_AUTH_METHOD"
-];
-function codexAuthEnvFromResponse(response) {
-  switch (response.type) {
-    case "oauth":
-      return { REPLICAS_CODEX_AUTH_METHOD: "oauth" };
-    case "api_key":
-      return { OPENAI_API_KEY: response.apiKey, REPLICAS_CODEX_AUTH_METHOD: "api_key" };
-    case "foundry":
-      return {
-        AZURE_OPENAI_API_KEY: response.apiKey,
-        CODEX_FOUNDRY_BASE_URL: response.baseUrl,
-        CODEX_FOUNDRY_MODEL: response.model,
-        REPLICAS_CODEX_AUTH_METHOD: "foundry"
-      };
-  }
-}
-var CODEX_AUTH_ENV_KEYS_BY_METHOD = {
-  none: [],
-  oauth: ["REPLICAS_CODEX_AUTH_METHOD"],
-  api_key: ["OPENAI_API_KEY", "REPLICAS_CODEX_AUTH_METHOD"],
-  bedrock: [],
-  foundry: ["AZURE_OPENAI_API_KEY", "CODEX_FOUNDRY_BASE_URL", "CODEX_FOUNDRY_MODEL", "REPLICAS_CODEX_AUTH_METHOD"]
-};
-
 // ../shared/src/memory-safety.ts
 var SECRET_PATTERNS = [
   /sk-[A-Za-z0-9_-]{10,}/g,
@@ -1501,6 +1455,7 @@ var WEB_APP_PATHS = {
   "audit-logs": `${DASHBOARD_PATH}/audit-logs`,
   accountAgents: `${DASHBOARD_PATH}/account/agents`,
   accountProfile: `${DASHBOARD_PATH}/account/profile`,
+  accountConnections: `${DASHBOARD_PATH}/account/connections`,
   accountIntegrations: `${DASHBOARD_PATH}/account/integrations`,
   accountApiKeys: `${DASHBOARD_PATH}/account/api-keys`,
   accountPreferences: `${DASHBOARD_PATH}/account/preferences`,
@@ -2587,7 +2542,7 @@ const plugins = await replicas.plugins.list();
 const installed = plugins.filter((plugin) => plugin.connected);
 \`\`\`
 
-If a plugin is not connected, ask the user to install it under personal, environment, or organization Integrations in the Replicas dashboard. An organization install lands on Global and reaches every workspace; an environment install overrides Global for the workspaces built from it.
+If a plugin is not connected, ask the user to connect it under personal Connections or the relevant environment's Plugins tab. A connection on Global reaches every workspace unless a more specific environment overrides it.
 
 ## Search, inspect, execute
 
@@ -3354,11 +3309,58 @@ function isCodexAuthError(error) {
   return lower.includes("unauthorized") || lower.includes("authentication") || lower.includes("invalid api key") || lower.includes("incorrect api key") || lower.includes("api key") && lower.includes("invalid") || lower.includes("401") || lower.includes('codexerrorinfo="unauthorized"') || lower.includes("codexerrorinfo=unauthorized") || lower.includes("failed to refresh token") || lower.includes("your session has ended");
 }
 
+// ../shared/src/version.ts
+function compareVersions(v1, v2) {
+  const parts1 = v1.split(".").map(Number);
+  const parts2 = v2.split(".").map(Number);
+  for (let i = 0; i < Math.max(parts1.length, parts2.length); i++) {
+    const num1 = parts1[i] || 0;
+    const num2 = parts2[i] || 0;
+    if (num1 > num2) return 1;
+    if (num1 < num2) return -1;
+  }
+  return 0;
+}
+function isVersionBelow(version, minimum) {
+  return compareVersions(version, minimum) < 0;
+}
+
 // ../shared/src/engine/chat-tabs.ts
 function hasChatStarted(chat) {
   return chat.processing || Boolean(chat.awaitingInput) || Boolean(chat.goal) || Boolean(chat.lastMessageText) || chat.updatedAt > chat.createdAt;
 }
 
+// ../shared/src/routes/codex.ts
+var CODEX_AUTH_ENV_KEYS = [
+  "OPENAI_API_KEY",
+  "AZURE_OPENAI_API_KEY",
+  "CODEX_FOUNDRY_BASE_URL",
+  "CODEX_FOUNDRY_MODEL",
+  "REPLICAS_CODEX_AUTH_METHOD"
+];
+function codexAuthEnvFromResponse(response) {
+  switch (response.type) {
+    case "oauth":
+      return { REPLICAS_CODEX_AUTH_METHOD: "oauth" };
+    case "api_key":
+      return { OPENAI_API_KEY: response.apiKey, REPLICAS_CODEX_AUTH_METHOD: "api_key" };
+    case "foundry":
+      return {
+        AZURE_OPENAI_API_KEY: response.apiKey,
+        CODEX_FOUNDRY_BASE_URL: response.baseUrl,
+        CODEX_FOUNDRY_MODEL: response.model,
+        REPLICAS_CODEX_AUTH_METHOD: "foundry"
+      };
+  }
+}
+var CODEX_AUTH_ENV_KEYS_BY_METHOD = {
+  none: [],
+  oauth: ["REPLICAS_CODEX_AUTH_METHOD"],
+  api_key: ["OPENAI_API_KEY", "REPLICAS_CODEX_AUTH_METHOD"],
+  bedrock: [],
+  foundry: ["AZURE_OPENAI_API_KEY", "CODEX_FOUNDRY_BASE_URL", "CODEX_FOUNDRY_MODEL", "REPLICAS_CODEX_AUTH_METHOD"]
+};
+
 // ../shared/src/routes/claude.ts
 var CLAUDE_AUTH_ENV_KEYS = [
   "ANTHROPIC_API_KEY",
@@ -6132,6 +6134,523 @@ function isSkillRegistryManifest(value) {
   );
 }
 
+// src/utils/presigned-upload.ts
+import { createReadStream } from "fs";
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+async function putPresignedFile(urlValue, filePath, size, contentType) {
+  await new Promise((resolve, reject) => {
+    const url = new URL(urlValue);
+    const request = (url.protocol === "https:" ? httpsRequest : httpRequest)(url, {
+      method: "PUT",
+      headers: {
+        "content-length": String(size),
+        "content-type": contentType
+      }
+    }, (response) => {
+      response.setEncoding("utf8");
+      let body = "";
+      response.on("data", (chunk) => {
+        body += chunk;
+      });
+      response.on("end", () => {
+        const status = response.statusCode ?? 0;
+        if (status >= 200 && status < 300) resolve();
+        else reject(new Error(`upload failed: ${status} ${body}`));
+      });
+      response.on("error", reject);
+    });
+    request.on("error", reject);
+    const file = size > 0 ? createReadStream(filePath, { start: 0, end: size - 1 }) : createReadStream(filePath);
+    file.on("error", (error) => request.destroy(error));
+    file.pipe(request);
+  });
+}
+
+// src/utils/codex-agent-env.ts
+function buildCodexAgentEnv(source = process.env) {
+  const env = Object.fromEntries(
+    Object.entries(source).filter((entry) => typeof entry[1] === "string")
+  );
+  if (env.REPLICAS_CODEX_AUTH_METHOD === "oauth" || env.REPLICAS_CODEX_AUTH_METHOD === "foundry") {
+    delete env.OPENAI_API_KEY;
+  }
+  delete env.GH_TOKEN;
+  delete env.GITHUB_TOKEN;
+  delete env.GH_CONFIG_DIR;
+  return env;
+}
+
+// src/utils/exec.ts
+import { exec, execFile } from "child_process";
+import { promisify } from "util";
+var execAsync = promisify(exec);
+var execFileAsync = promisify(execFile);
+var SUBPROCESS_MAX_BUFFER = HOOK_EXEC_MAX_BUFFER_BYTES;
+
+// src/managers/codex-asp/app-server-process.ts
+import { spawn } from "child_process";
+import { EventEmitter as EventEmitter2 } from "events";
+
+// src/managers/codex-asp/asp-client.ts
+import { EventEmitter } from "events";
+var DEFAULT_REQUEST_TIMEOUT_MS = 12e4;
+function hasOwn(record, key) {
+  return Object.prototype.hasOwnProperty.call(record, key);
+}
+var AspClient = class {
+  stdin;
+  stdout;
+  emitter = new EventEmitter();
+  pending = /* @__PURE__ */ new Map();
+  nextId = 1;
+  lineBuffer = "";
+  disposed = false;
+  get isDisposed() {
+    return this.disposed;
+  }
+  constructor(options) {
+    this.stdin = options.stdin;
+    this.stdout = options.stdout;
+    this.stdout.setEncoding("utf8");
+    this.stdout.on("data", this.handleStdoutData);
+    this.stdin.on("error", this.handleStdinError);
+  }
+  on(event, listener) {
+    this.emitter.on(event, listener);
+  }
+  off(event, listener) {
+    this.emitter.off(event, listener);
+  }
+  async request(method, params, opts) {
+    if (this.disposed) {
+      throw new Error(`Cannot send ${method}: ASP client disposed`);
+    }
+    const id = this.nextId;
+    this.nextId += 1;
+    const promise = new Promise((resolve, reject) => {
+      const timeoutMs = opts?.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+      const timer = timeoutMs > 0 ? setTimeout(() => {
+        this.pending.delete(id);
+        reject(new Error(`ASP request timed out for ${method}`));
+      }, timeoutMs) : null;
+      this.pending.set(id, { resolve, reject, method, timer });
+    });
+    this.write({ method, id, params });
+    return promise;
+  }
+  notify(method, params) {
+    if (this.disposed) {
+      return;
+    }
+    try {
+      this.write(params === void 0 ? { method } : { method, params });
+    } catch (error) {
+      console.warn(`[AspClient] Failed to send notification ${method}:`, error);
+    }
+  }
+  respond(id, result) {
+    if (this.disposed) {
+      return;
+    }
+    try {
+      this.write({ id, result });
+    } catch (error) {
+      console.warn(`[AspClient] Failed to send response ${String(id)}:`, error);
+    }
+  }
+  reject(id, code, message, data) {
+    if (this.disposed) {
+      return;
+    }
+    try {
+      this.write({
+        id,
+        error: {
+          code,
+          message,
+          ...data !== void 0 ? { data } : {}
+        }
+      });
+    } catch (error) {
+      console.warn(`[AspClient] Failed to send error response ${String(id)}:`, error);
+    }
+  }
+  dispose(reason = new Error("ASP client disposed")) {
+    if (this.disposed) {
+      return;
+    }
+    this.disposed = true;
+    this.stdout.off("data", this.handleStdoutData);
+    this.stdin.removeListener("error", this.handleStdinError);
+    for (const [id, pending] of this.pending) {
+      if (pending.timer) {
+        clearTimeout(pending.timer);
+      }
+      pending.reject(new Error(`${reason.message} while waiting for ${pending.method}`));
+      this.pending.delete(id);
+    }
+    this.lineBuffer = "";
+    this.emitter.emit("dispose", reason);
+    this.emitter.removeAllListeners();
+  }
+  handleStdoutData = (chunk) => {
+    this.lineBuffer += chunk.toString();
+    let newlineIndex = this.lineBuffer.indexOf("\n");
+    while (newlineIndex >= 0) {
+      const line = this.lineBuffer.slice(0, newlineIndex).trim();
+      this.lineBuffer = this.lineBuffer.slice(newlineIndex + 1);
+      if (line.length > 0) {
+        this.handleLine(line);
+      }
+      newlineIndex = this.lineBuffer.indexOf("\n");
+    }
+  };
+  handleStdinError = (error) => {
+    this.dispose(new Error(`ASP stdin error: ${error.message}`));
+  };
+  handleLine(line) {
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch (error) {
+      console.warn("[AspClient] Failed to parse ASP JSON line:", error);
+      return;
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      console.warn("[AspClient] Ignoring non-object ASP message");
+      return;
+    }
+    const message = parsed;
+    const hasRequestId = typeof message.id === "number" || typeof message.id === "string";
+    if (hasRequestId && (hasOwn(message, "result") || hasOwn(message, "error"))) {
+      this.handleResponse(message);
+      return;
+    }
+    if (hasRequestId && typeof message.method === "string") {
+      this.emitter.emit("serverRequest", message);
+      return;
+    }
+    if (!hasOwn(message, "id") && typeof message.method === "string") {
+      this.emitter.emit("notification", message);
+    }
+  }
+  handleResponse(message) {
+    if (typeof message.id !== "number") {
+      console.warn("[AspClient] Ignoring response with non-numeric request id");
+      return;
+    }
+    const pending = this.pending.get(message.id);
+    if (!pending) {
+      console.warn(`[AspClient] Ignoring response for unknown request id ${message.id}`);
+      return;
+    }
+    this.pending.delete(message.id);
+    if (pending.timer) {
+      clearTimeout(pending.timer);
+    }
+    if (hasOwn(message, "error")) {
+      pending.reject(this.createRpcError(pending.method, message.error));
+      return;
+    }
+    pending.resolve(message.result);
+  }
+  createRpcError(method, error) {
+    if (typeof error !== "object" || error === null || Array.isArray(error)) {
+      return new Error(`ASP request failed for ${method}`);
+    }
+    const rpcError = error;
+    const code = typeof rpcError.code === "number" ? ` ${rpcError.code}` : "";
+    const message = typeof rpcError.message === "string" ? rpcError.message : "Unknown ASP error";
+    const data = hasOwn(rpcError, "data") ? ` data=${JSON.stringify(rpcError.data)}` : "";
+    return new Error(`ASP request failed for ${method}:${code} ${message}${data}`);
+  }
+  write(message) {
+    try {
+      this.stdin.write(`${JSON.stringify(message)}
+`, (error) => {
+        if (error) {
+          this.dispose(new Error(`ASP write failed: ${error.message}`));
+        }
+      });
+    } catch (error) {
+      const writeError = error instanceof Error ? error : new Error("ASP write failed");
+      this.dispose(writeError);
+      throw writeError;
+    }
+  }
+};
+
+// src/managers/codex-asp/app-server-process.ts
+var DEFAULT_CODEX_BINARY = "codex";
+var DEFAULT_CODEX_ARGS = [
+  "app-server",
+  "--listen",
+  "stdio://",
+  "-c",
+  "features.memories=false",
+  "-c",
+  "memories.use_memories=false",
+  "-c",
+  "memories.generate_memories=false"
+];
+var MIN_CODEX_CLI_VERSION = "0.144.6";
+var CODEX_UPGRADE_TIMEOUT_MS = 12e4;
+var codexCliVersionEnsured = null;
+var ENGINE_PACKAGE_VERSION = "0.1.676";
+var INITIALIZE_METHOD = "initialize";
+var INITIALIZED_NOTIFICATION = "initialized";
+var ACCOUNT_LOGIN_START_METHOD = "account/login/start";
+var AppServerProcess = class {
+  binary;
+  args;
+  env;
+  cwd;
+  chatgptAuthTokens;
+  refreshChatgptAuthTokens;
+  emitter = new EventEmitter2();
+  child = null;
+  client = null;
+  shuttingDown = false;
+  invalidating = false;
+  constructor(options) {
+    this.binary = options.binary ?? DEFAULT_CODEX_BINARY;
+    const baseArgs = options.args ?? (options.env.REPLICAS_CODEX_AUTH_METHOD === "foundry" ? [
+      ...DEFAULT_CODEX_ARGS,
+      "-c",
+      `model=${JSON.stringify(options.env.CODEX_FOUNDRY_MODEL)}`,
+      "-c",
+      'model_provider="azure"',
+      "-c",
+      'model_providers.azure.name="Azure OpenAI"',
+      "-c",
+      `model_providers.azure.base_url=${JSON.stringify(options.env.CODEX_FOUNDRY_BASE_URL)}`,
+      "-c",
+      'model_providers.azure.env_key="AZURE_OPENAI_API_KEY"',
+      "-c",
+      'model_providers.azure.wire_api="responses"'
+    ] : DEFAULT_CODEX_ARGS);
+    this.args = [...baseArgs, ...(options.configOverrides ?? []).flatMap((override) => ["-c", override])];
+    this.env = options.env;
+    this.cwd = options.cwd;
+    this.chatgptAuthTokens = options.chatgptAuthTokens;
+    this.refreshChatgptAuthTokens = options.refreshChatgptAuthTokens;
+  }
+  on(event, listener) {
+    this.emitter.on(event, listener);
+  }
+  async start() {
+    if (this.child && this.client) {
+      return { client: this.client };
+    }
+    this.shuttingDown = false;
+    this.invalidating = false;
+    await this.ensureMinCodexCliVersion();
+    const child = spawn(this.binary, this.args, {
+      cwd: this.cwd,
+      env: this.env,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    this.child = child;
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (chunk) => {
+      for (const line of chunk.toString().split("\n")) {
+        if (line.trim().length > 0) {
+          console.error(`[codex-app-server] ${line}`);
+        }
+      }
+    });
+    child.on("exit", (code, signal) => {
+      this.client?.dispose();
+      this.client = null;
+      this.child = null;
+      if (!this.shuttingDown) {
+        if (!this.invalidating) {
+          console.warn(`[AppServerProcess] codex app-server exited unexpectedly code=${code ?? "null"} signal=${signal ?? "null"}`);
+        }
+        this.emitter.emit("exit", code, signal);
+      }
+    });
+    const client = new AspClient({ stdin: child.stdin, stdout: child.stdout });
+    this.client = client;
+    client.on("serverRequest", (serverRequest) => {
+      if (serverRequest.method !== "account/chatgptAuthTokens/refresh") return;
+      if (!this.refreshChatgptAuthTokens) {
+        client.reject(serverRequest.id, -32603, "Codex OAuth refresh is not configured");
+        return;
+      }
+      void this.refreshChatgptAuthTokens(serverRequest.params).then((tokens) => {
+        client.respond(serverRequest.id, tokens);
+      }).catch((error) => {
+        if (error instanceof Error && error.name === "CodexAspAuthMethodChangedError") {
+          this.invalidating = true;
+          client.dispose(error);
+          if (!child.killed) child.kill("SIGTERM");
+          return;
+        }
+        client.reject(
+          serverRequest.id,
+          -32603,
+          error instanceof Error ? error.message : "Failed to refresh Codex OAuth credentials"
+        );
+      });
+    });
+    let cleanupEarlyFailureHandlers = () => {
+    };
+    const earlyFailure = new Promise((_resolve, reject) => {
+      const onError = (error) => {
+        reject(error);
+      };
+      const onExit = (code, signal) => {
+        reject(new Error(`codex app-server exited before initialize completed code=${code ?? "null"} signal=${signal ?? "null"}`));
+      };
+      child.once("error", onError);
+      child.once("exit", onExit);
+      cleanupEarlyFailureHandlers = () => {
+        child.off("error", onError);
+        child.off("exit", onExit);
+      };
+    });
+    try {
+      const initializeParams = {
+        clientInfo: {
+          name: "replicas_engine",
+          title: "Replicas Engine",
+          version: ENGINE_PACKAGE_VERSION
+        },
+        capabilities: {
+          experimentalApi: true,
+          requestAttestation: false,
+          optOutNotificationMethods: null
+        }
+      };
+      await Promise.race([
+        client.request(INITIALIZE_METHOD, initializeParams),
+        earlyFailure
+      ]);
+      cleanupEarlyFailureHandlers();
+      client.notify(INITIALIZED_NOTIFICATION);
+      await this.loginWithConfiguredCredentials(client);
+      return { client };
+    } catch (error) {
+      cleanupEarlyFailureHandlers();
+      client.dispose();
+      await this.killAfterFailedStart();
+      throw error;
+    }
+  }
+  async stop() {
+    const child = this.child;
+    this.shuttingDown = true;
+    this.client?.dispose(new Error("ASP process stopped"));
+    this.client = null;
+    this.child = null;
+    if (!child || child.killed) {
+      return;
+    }
+    await new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        child.kill("SIGKILL");
+      }, 2e3);
+      child.once("exit", () => {
+        clearTimeout(timer);
+        resolve();
+      });
+      child.kill("SIGTERM");
+    });
+  }
+  ensureMinCodexCliVersion() {
+    codexCliVersionEnsured ??= this.runEnsureMinCodexCliVersion().catch((error) => {
+      codexCliVersionEnsured = null;
+      console.warn("[AppServerProcess] Failed to ensure minimum codex CLI version, continuing with installed binary:", error);
+    });
+    return codexCliVersionEnsured;
+  }
+  async runEnsureMinCodexCliVersion() {
+    const { stdout } = await execFileAsync(this.binary, ["--version"], { env: this.env });
+    const version = stdout.match(/(\d+\.\d+\.\d+)/)?.[1];
+    if (version && !isVersionBelow(version, MIN_CODEX_CLI_VERSION)) {
+      return;
+    }
+    console.warn(`[AppServerProcess] codex CLI ${version ?? "unknown"} is below ${MIN_CODEX_CLI_VERSION}; upgrading @openai/codex`);
+    await execFileAsync(
+      "npm",
+      ["install", "-g", "--no-audit", "--no-fund", `@openai/codex@${MIN_CODEX_CLI_VERSION}`],
+      { env: this.env, timeout: CODEX_UPGRADE_TIMEOUT_MS }
+    );
+    console.warn(`[AppServerProcess] upgraded codex CLI to ${MIN_CODEX_CLI_VERSION}`);
+  }
+  async loginWithConfiguredCredentials(client) {
+    if (this.env.REPLICAS_CODEX_AUTH_METHOD === "oauth") {
+      if (!this.chatgptAuthTokens) {
+        throw new Error("Codex OAuth credentials were not prepared before app-server startup");
+      }
+      const params2 = {
+        type: "chatgptAuthTokens",
+        ...this.chatgptAuthTokens
+      };
+      await client.request(ACCOUNT_LOGIN_START_METHOD, params2);
+      return;
+    }
+    if (this.env.REPLICAS_CODEX_AUTH_METHOD !== "api_key" || !this.env.OPENAI_API_KEY) return;
+    const params = {
+      type: "apiKey",
+      apiKey: this.env.OPENAI_API_KEY
+    };
+    await client.request(ACCOUNT_LOGIN_START_METHOD, params);
+  }
+  async killAfterFailedStart() {
+    const child = this.child;
+    this.child = null;
+    this.client = null;
+    if (!child || child.killed) {
+      return;
+    }
+    this.shuttingDown = true;
+    child.kill("SIGKILL");
+    await new Promise((resolve) => {
+      child.once("exit", () => resolve());
+    });
+  }
+};
+
+// src/managers/codex-asp/notification-dispatch.ts
+var TURN_STARTED_METHOD = "turn/started";
+var TURN_COMPLETED_METHOD = "turn/completed";
+var TURN_PLAN_UPDATED_METHOD = "turn/plan/updated";
+var THREAD_GOAL_UPDATED_METHOD = "thread/goal/updated";
+var THREAD_GOAL_CLEARED_METHOD = "thread/goal/cleared";
+var ITEM_STARTED_METHOD = "item/started";
+var ITEM_COMPLETED_METHOD = "item/completed";
+var AGENT_MESSAGE_DELTA_METHOD = "item/agentMessage/delta";
+var REASONING_SUMMARY_TEXT_DELTA_METHOD = "item/reasoning/summaryTextDelta";
+var REASONING_TEXT_DELTA_METHOD = "item/reasoning/textDelta";
+var REASONING_SUMMARY_PART_ADDED_METHOD = "item/reasoning/summaryPartAdded";
+var COMMAND_EXECUTION_OUTPUT_DELTA_METHOD = "item/commandExecution/outputDelta";
+var FILE_CHANGE_OUTPUT_DELTA_METHOD = "item/fileChange/outputDelta";
+var ACCOUNT_RATE_LIMITS_UPDATED_METHOD = "account/rateLimits/updated";
+var THREAD_TOKEN_USAGE_UPDATED_METHOD = "thread/tokenUsage/updated";
+var THREAD_COMPACTED_METHOD = "thread/compacted";
+function dispatchAspNotification(notification, handlers) {
+  const handler = handlers[notification.method];
+  if (!handler) return;
+  handler(notification);
+}
+function recoverCompletedTurn(turn, completedItems, agentMessageDeltas) {
+  const items = turn.items.length > 0 ? [...turn.items] : [];
+  const itemIds = new Set(items.map((item) => item.id));
+  for (const item of completedItems) {
+    if (itemIds.has(item.id)) continue;
+    items.push(item);
+    itemIds.add(item.id);
+  }
+  for (const [itemId, text] of agentMessageDeltas) {
+    if (itemIds.has(itemId)) continue;
+    items.push({ type: "agentMessage", id: itemId, text, phase: null, memoryCitation: null });
+  }
+  return items.length > 0 ? { ...turn, items, itemsView: "full" } : turn;
+}
+
 export {
   isRecord,
   TIMEOUT,
@@ -6238,7 +6757,6 @@ export {
   isTransientErrorText,
   isClaudeAuthErrorText,
   isCodexAuthError,
-  isVersionBelow,
   hasChatStarted,
   DESKTOP_STREAM_PORT,
   MERGED_MESSAGE_SEPARATOR,
@@ -6300,5 +6818,29 @@ export {
   MEMORY_SUMMARY_FILENAME,
   MEMORY_INDEX_FILENAME,
   getMemoryOutputSafetyViolation,
-  isSkillRegistryManifest
+  isSkillRegistryManifest,
+  putPresignedFile,
+  buildCodexAgentEnv,
+  execAsync,
+  execFileAsync,
+  SUBPROCESS_MAX_BUFFER,
+  AppServerProcess,
+  TURN_STARTED_METHOD,
+  TURN_COMPLETED_METHOD,
+  TURN_PLAN_UPDATED_METHOD,
+  THREAD_GOAL_UPDATED_METHOD,
+  THREAD_GOAL_CLEARED_METHOD,
+  ITEM_STARTED_METHOD,
+  ITEM_COMPLETED_METHOD,
+  AGENT_MESSAGE_DELTA_METHOD,
+  REASONING_SUMMARY_TEXT_DELTA_METHOD,
+  REASONING_TEXT_DELTA_METHOD,
+  REASONING_SUMMARY_PART_ADDED_METHOD,
+  COMMAND_EXECUTION_OUTPUT_DELTA_METHOD,
+  FILE_CHANGE_OUTPUT_DELTA_METHOD,
+  ACCOUNT_RATE_LIMITS_UPDATED_METHOD,
+  THREAD_TOKEN_USAGE_UPDATED_METHOD,
+  THREAD_COMPACTED_METHOD,
+  dispatchAspNotification,
+  recoverCompletedTurn
 };