replicas-engine 0.1.673 → 0.1.676

package/dist/src/index.js

@@ -1,51 +1,8 @@
 #!/usr/bin/env node
 import {
   ACCOUNT_RATE_LIMITS_UPDATED_METHOD,
-  AGENT_MESSAGE_DELTA_METHOD,
-  COMMAND_EXECUTION_OUTPUT_DELTA_METHOD,
-  FILE_CHANGE_OUTPUT_DELTA_METHOD,
-  ITEM_COMPLETED_METHOD,
-  ITEM_STARTED_METHOD,
-  REASONING_SUMMARY_PART_ADDED_METHOD,
-  REASONING_SUMMARY_TEXT_DELTA_METHOD,
-  REASONING_TEXT_DELTA_METHOD,
-  THREAD_COMPACTED_METHOD,
-  THREAD_GOAL_CLEARED_METHOD,
-  THREAD_GOAL_UPDATED_METHOD,
-  THREAD_TOKEN_USAGE_UPDATED_METHOD,
-  TURN_COMPLETED_METHOD,
-  TURN_PLAN_UPDATED_METHOD,
-  TURN_STARTED_METHOD,
-  buildCodexAgentEnv,
-  dispatchAspNotification,
-  putPresignedFile,
-  recoverCompletedTurn
-} from "./chunk-XQW4B35Y.js";
-import {
-  AppServerProcess,
-  SUBPROCESS_MAX_BUFFER,
-  execAsync,
-  execFileAsync
-} from "./chunk-CKJJIOSE.js";
-import {
-  BaseRefreshManager,
-  CodexAspAuthMethodChangedError,
-  applyAuthEnvTransition,
-  codexTokenManager,
-  listCredentialFallbacks,
-  monolithRequest,
-  monolithService,
-  recordCredentialFallback,
-  recordExhaustedCredential
-} from "./chunk-A2ZICXOK.js";
-import {
-  ENGINE_ENV,
-  IS_WARMING_MODE,
-  isRecord as isRecord2,
-  setAgentCredentialSnapshot
-} from "./chunk-2CFOJHNH.js";
-import {
   AGENT,
+  AGENT_MESSAGE_DELTA_METHOD,
   AGENT_MODELS,
   AI_GATEWAY_BASE_URL,
   ASTER_BASE_URL,
@@ -54,6 +11,7 @@ import {
   ASTER_PROVIDER,
   AUTH_FALLBACK_EVENT_TYPE,
   AUTH_RETRY_STATUS_EVENT_TYPE,
+  AppServerProcess,
   CHAT_GOAL_EVENT_TYPE,
   CHAT_INTERRUPTED_EVENT_TYPE,
   CLAUDE_AUTH_ENV_KEYS,
@@ -70,7 +28,10 @@ import {
   CLAUDE_SONNET_5_BEDROCK_MODEL,
   CLAUDE_SONNET_5_MODEL,
   CODEX_ASP_TRANSCRIPT_UPDATED_EVENT_TYPE,
+  CODEX_AUTH_ENV_KEYS,
+  CODEX_AUTH_ENV_KEYS_BY_METHOD,
   CODEX_QUOTA_STATUS_EVENT_TYPE,
+  COMMAND_EXECUTION_OUTPUT_DELTA_METHOD,
   COMPACTION_STATUS_EVENT_TYPE,
   CONTEXT_USAGE_EVENT_TYPE,
   CURSOR_CONNECTION_STATUS_EVENT_TYPE,
@@ -90,11 +51,14 @@ import {
   ENGINE_HEALTH_MAX_WAIT_MS,
   ENGINE_HEALTH_WAIT_HEADER,
   ENGINE_HEALTH_WAIT_QUERY_PARAM,
+  FILE_CHANGE_OUTPUT_DELTA_METHOD,
   GITHUB_CREDENTIAL_REFRESH_PATH,
   GITLAB_CREDENTIAL_REFRESH_PATH,
   GIT_CREDENTIAL_HELPER_FILENAME,
   HOOK_EXEC_MAX_BUFFER_BYTES,
   IMAGE_MEDIA_TYPES,
+  ITEM_COMPLETED_METHOD,
+  ITEM_STARTED_METHOD,
   InFlightMap,
   MAX_CANVAS_FILE_BYTES,
   MAX_CANVAS_PREVIEW_BYTES,
@@ -103,18 +67,32 @@ import {
   MEMORY_ROOT,
   MEMORY_SUMMARY_FILENAME,
   MERGED_MESSAGE_SEPARATOR,
+  REASONING_SUMMARY_PART_ADDED_METHOD,
+  REASONING_SUMMARY_TEXT_DELTA_METHOD,
+  REASONING_TEXT_DELTA_METHOD,
   REPLICAS_CONFIG_FILENAMES,
+  REPLICAS_RUNTIME_ENV_ALIASES,
   SANDBOX_PATHS,
+  SUBPROCESS_MAX_BUFFER,
+  THREAD_COMPACTED_METHOD,
+  THREAD_GOAL_CLEARED_METHOD,
+  THREAD_GOAL_UPDATED_METHOD,
+  THREAD_TOKEN_USAGE_UPDATED_METHOD,
   TIMEOUT,
+  TURN_COMPLETED_METHOD,
+  TURN_PLAN_UPDATED_METHOD,
+  TURN_STARTED_METHOD,
   TaskAccumulator,
   USER_MESSAGE_ID_PAYLOAD_KEY,
   VALID_AGENT_PROVIDERS,
   VALID_RELAY_SUBAGENT_PROVIDERS,
   VALID_THINKING_LEVELS,
+  agentCredentialSnapshotSchema,
   applyCodexAspTranscriptDelta,
   areSameUserMessageEvents,
   areUserMessagesWithinMatchWindow,
   autoCompactThresholdField,
+  buildCodexAgentEnv,
   buildCodexTokenUsageContextUsagePayload,
   buildGitCredentialHelperScript,
   buildHookOutputPreview,
@@ -125,6 +103,7 @@ import {
   clampWarmHookTimeoutMs,
   classifyCanvasFilename,
   claudeAuthEnvFromResponse,
+  codexAuthEnvFromResponse,
   codexReasoningEffortForThinkingLevel,
   coerceBackgroundTaskPayload,
   coerceClaudeResultPayload,
@@ -138,6 +117,9 @@ import {
   decodePathSegments,
   detectAgentQuotaLimit,
   detectLanguageByPath,
+  dispatchAspNotification,
+  execAsync,
+  execFileAsync,
   extractCommandProtectionCommandText,
   extractErrorText,
   extractToolResultText,
@@ -193,17 +175,21 @@ import {
   parseGitRemote,
   parseLatestCodexAspTranscriptTurn,
   parseMcpToolName,
+  parsePosixEnvFile,
   parseReplicasConfigString,
   percentage,
+  putPresignedFile,
   raceWithTimeout,
   readJsonlPage,
+  readReplicasRuntimeEnv,
+  recoverCompletedTurn,
   renumberCodexAspTranscriptItems,
   resolveWarmHookConfig,
   sanitizeCanvasFilename,
   serializeCanvasContentResponse,
   shellQuotePosix,
   stripAgentDiagnosticErrors
-} from "./chunk-5NBVP6A2.js";
+} from "./chunk-OLZ7JWCU.js";
 
 // src/index.ts
 import { serve } from "@hono/node-server";
@@ -215,9 +201,373 @@ import { connect } from "net";
 // src/managers/github-token-manager.ts
 import path from "path";
 
+// src/engine-env.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+
+// src/runtime-env-loader.ts
+import { readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+function loadRuntimeEnvFile() {
+  let content;
+  try {
+    content = readFileSync(join(homedir(), ".replicas", "runtime-env.sh"), "utf-8");
+  } catch {
+    return;
+  }
+  for (const [key, value] of Object.entries(parsePosixEnvFile(content))) {
+    process.env[key] = value;
+  }
+}
+
+// src/utils/type-guards.ts
+function isRecord2(value) {
+  return typeof value === "object" && value !== null;
+}
+
+// src/engine-env.ts
+var SANDBOX_IMAGE_VERSION_FILE = "/usr/local/lib/replicas-sandbox-image-version";
+function readEnv(name) {
+  const value = process.env[name]?.trim();
+  return value ? value : void 0;
+}
+function readSandboxImageVersion() {
+  const environmentVersion = readEnv("REPLICAS_SANDBOX_IMAGE_VERSION");
+  if (environmentVersion) return environmentVersion;
+  try {
+    return readFileSync2(SANDBOX_IMAGE_VERSION_FILE, "utf8").trim() || "development";
+  } catch {
+    return "development";
+  }
+}
+function parsePort(value) {
+  if (!value) {
+    return 3737;
+  }
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new Error("Invalid engine environment: REPLICAS_ENGINE_PORT must be a positive integer");
+  }
+  return parsed;
+}
+function requireDefined(value, name) {
+  if (value === void 0 || value === null) {
+    throw new Error(`Invalid engine environment: ${name} is required`);
+  }
+  return value;
+}
+function requireValidURL(value, name) {
+  try {
+    new URL(value);
+    return value;
+  } catch {
+    throw new Error(`Invalid engine environment: ${name} must be a valid URL`);
+  }
+}
+function parseClaudeAuthMethod(value) {
+  if (value === "oauth" || value === "api_key" || value === "bedrock" || value === "foundry") {
+    return value;
+  }
+  return void 0;
+}
+function parseCodexAuthMethod(value) {
+  if (value === "oauth" || value === "api_key" || value === "foundry") {
+    return value;
+  }
+  return void 0;
+}
+function parseAgentCredentialSnapshots(value) {
+  if (!value) return {};
+  try {
+    const parsed = JSON.parse(value);
+    if (!isRecord2(parsed)) return {};
+    const snapshots = {};
+    for (const [provider, snapshot] of Object.entries(parsed)) {
+      if (!isValidAgentProvider(provider)) continue;
+      const parsedSnapshot = agentCredentialSnapshotSchema.safeParse(snapshot);
+      if (parsedSnapshot.success) snapshots[provider] = parsedSnapshot.data;
+    }
+    return snapshots;
+  } catch {
+    return {};
+  }
+}
+var IS_WARMING_MODE = process.argv.includes("--warming");
+function loadEngineEnv() {
+  loadRuntimeEnvFile();
+  const HOME_DIR = homedir2();
+  const env = {
+    // Defined: always available
+    REPLICAS_ENGINE_SECRET: requireDefined(readEnv("REPLICAS_ENGINE_SECRET"), "REPLICAS_ENGINE_SECRET"),
+    REPLICAS_ENGINE_PORT: parsePort(readEnv("REPLICAS_ENGINE_PORT")),
+    REPLICAS_MONOLITH_URL: requireValidURL(
+      requireDefined(readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.monolithUrl), "REPLICAS_MONOLITH_URL"),
+      "REPLICAS_MONOLITH_URL"
+    ),
+    HOME_DIR,
+    WORKSPACE_ROOT: join2(HOME_DIR, "workspaces"),
+    REPLICAS_SANDBOX_IMAGE_VERSION: readSandboxImageVersion(),
+    // Runtime: may not be set during warming
+    REPLICAS_WORKSPACE_ID: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.workspaceId),
+    REPLICAS_LINEAR_SESSION_ID: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.linearSessionId),
+    REPLICAS_LINEAR_ACCESS_TOKEN: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.linearAccessToken),
+    REPLICAS_SLACK_BOT_TOKEN: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.slackBotToken),
+    REPLICAS_SLACK_CHANNEL_ID: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.slackChannelId),
+    REPLICAS_SLACK_THREAD_TS: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.slackThreadTs),
+    ANTHROPIC_API_KEY: readEnv("ANTHROPIC_API_KEY"),
+    OPENAI_API_KEY: readEnv("OPENAI_API_KEY"),
+    CURSOR_API_KEY: readEnv("CURSOR_API_KEY"),
+    AI_GATEWAY_API_KEY: readEnv("AI_GATEWAY_API_KEY"),
+    CLAUDE_CODE_USE_BEDROCK: readEnv("CLAUDE_CODE_USE_BEDROCK"),
+    AWS_ACCESS_KEY_ID: readEnv("AWS_ACCESS_KEY_ID"),
+    AWS_SECRET_ACCESS_KEY: readEnv("AWS_SECRET_ACCESS_KEY"),
+    AWS_REGION: readEnv("AWS_REGION"),
+    ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION: readEnv("ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION"),
+    REPLICAS_CLAUDE_AUTH_METHOD: parseClaudeAuthMethod(readEnv("REPLICAS_CLAUDE_AUTH_METHOD")),
+    REPLICAS_CODEX_AUTH_METHOD: parseCodexAuthMethod(readEnv("REPLICAS_CODEX_AUTH_METHOD")),
+    REPLICAS_AGENT_CREDENTIALS: parseAgentCredentialSnapshots(readEnv("REPLICAS_AGENT_CREDENTIALS")),
+    REPLICAS_ENV_SYSTEM_PROMPT: readEnv("REPLICAS_ENV_SYSTEM_PROMPT"),
+    REPLICAS_ENV_START_HOOK: readEnv("REPLICAS_ENV_START_HOOK"),
+    REPLICAS_DISABLE_AUTO_START_HOOKS: readEnv("REPLICAS_DISABLE_AUTO_START_HOOKS")?.toLowerCase() === "true",
+    REPLICAS_ENGINE_DEFER_INITIALIZATION: readEnv("REPLICAS_ENGINE_DEFER_INITIALIZATION")?.toLowerCase() === "true"
+  };
+  if (!IS_WARMING_MODE && !env.REPLICAS_WORKSPACE_ID) {
+    console.error("REPLICAS_WORKSPACE_ID is not set \u2014 this is required in normal (non-warming) mode");
+  }
+  return env;
+}
+var ENGINE_ENV = loadEngineEnv();
+function setAgentCredentialSnapshot(provider, snapshot) {
+  ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS = {
+    ...ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS,
+    [provider]: snapshot
+  };
+  process.env.REPLICAS_AGENT_CREDENTIALS = JSON.stringify(ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS);
+}
+
+// src/services/credential-fallbacks.ts
+var fallbacksByAgent = /* @__PURE__ */ new Map();
+var exhaustedByAgent = /* @__PURE__ */ new Map();
+function recordCredentialFallback(notice) {
+  fallbacksByAgent.set(notice.provider, notice);
+}
+function listCredentialFallbacks() {
+  return [...fallbacksByAgent.values()].filter((notice) => {
+    const live = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS[notice.provider];
+    if (!live) return false;
+    return notice.status === "switched" ? live.method === notice.candidateMethod && live.scope === notice.candidateScope : live.method === notice.exhaustedMethod && live.scope === notice.exhaustedScope;
+  });
+}
+function listExhaustedCredentials(provider) {
+  return [...exhaustedByAgent.get(provider)?.values() ?? []];
+}
+function recordExhaustedCredential(provider, credential) {
+  const spent = exhaustedByAgent.get(provider) ?? /* @__PURE__ */ new Map();
+  spent.set(`${credential.method}|${credential.scope}`, credential);
+  exhaustedByAgent.set(provider, spent);
+}
+
+// src/managers/base-refresh-manager.ts
+var BaseRefreshManager = class {
+  constructor(managerName, intervalMs = 15 * 60 * 1e3) {
+    this.managerName = managerName;
+    this.intervalMs = intervalMs;
+    this.health = {
+      isRunning: false,
+      intervalMs: this.intervalMs,
+      lastAttemptAt: null,
+      lastSuccessAt: null,
+      lastErrorAt: null,
+      lastErrorMessage: null
+    };
+  }
+  managerName;
+  intervalMs;
+  intervalHandle = null;
+  health;
+  async start() {
+    if (this.intervalHandle) {
+      return;
+    }
+    const skipReason = this.getSkipReason();
+    if (skipReason) {
+      console.log(`[${this.managerName}] Skipping: ${skipReason}`);
+      return;
+    }
+    console.log(`[${this.managerName}] Starting token refresh service`);
+    this.health.isRunning = true;
+    const config = this.getRuntimeConfig();
+    if (config) {
+      this.health.lastAttemptAt = (/* @__PURE__ */ new Date()).toISOString();
+      for (let attempt = 1; attempt <= 3; attempt++) {
+        try {
+          await this.doRefresh(config);
+          this.health.lastSuccessAt = (/* @__PURE__ */ new Date()).toISOString();
+          this.health.lastErrorAt = null;
+          this.health.lastErrorMessage = null;
+          break;
+        } catch (error) {
+          const message = error instanceof Error ? error.message : "Unknown error";
+          this.health.lastErrorAt = (/* @__PURE__ */ new Date()).toISOString();
+          this.health.lastErrorMessage = message;
+          if (attempt < 3) {
+            console.warn(`[${this.managerName}] Initial refresh attempt ${attempt} failed, retrying in 2s...`);
+            await new Promise((resolve5) => setTimeout(resolve5, 2e3));
+          } else {
+            console.error(`[${this.managerName}] Initial refresh failed after 3 attempts:`, error);
+          }
+        }
+      }
+    }
+    this.scheduleNextRefresh();
+  }
+  async swapCredentials(params) {
+    if (!this.getRuntimeConfig()) {
+      return createErrorResult({ message: `${this.managerName} has no runtime config`, code: "not_configured" });
+    }
+    try {
+      console.log(`[${this.managerName}] Fetching fresh credentials from monolith (${params.failureKind})...`);
+      const excludeCredentials = listExhaustedCredentials(params.provider);
+      await params.refresh(excludeCredentials.length > 0 ? { excludeCredentials } : {});
+      if (params.isOauthNow()) {
+        this.start().catch((error) => {
+          console.error(`[${this.managerName}] Failed to restart OAuth refresh service after fallback:`, error);
+        });
+      }
+      return createSuccessResult();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`[${this.managerName}] Failed to fetch fresh credentials:`, error);
+      return createErrorResult({
+        message,
+        code: message.includes('"code":"no_credentials"') ? "no_credentials" : "refresh_failed"
+      });
+    }
+  }
+  stop() {
+    if (!this.intervalHandle) {
+      return;
+    }
+    clearTimeout(this.intervalHandle);
+    this.intervalHandle = null;
+    this.health.isRunning = false;
+    console.log(`[${this.managerName}] Stopped`);
+  }
+  getHealthStatus() {
+    return { ...this.health };
+  }
+  getSkipReason() {
+    return null;
+  }
+  getNextRefreshDelayMs() {
+    return this.intervalMs;
+  }
+  getRuntimeConfig() {
+    if (!ENGINE_ENV.REPLICAS_WORKSPACE_ID) {
+      return null;
+    }
+    return {
+      monolithUrl: ENGINE_ENV.REPLICAS_MONOLITH_URL,
+      workspaceId: ENGINE_ENV.REPLICAS_WORKSPACE_ID,
+      engineSecret: ENGINE_ENV.REPLICAS_ENGINE_SECRET
+    };
+  }
+  scheduleNextRefresh() {
+    const delayMs = this.getNextRefreshDelayMs();
+    this.health.intervalMs = delayMs;
+    this.intervalHandle = setTimeout(async () => {
+      await this.refreshOnce();
+      if (this.intervalHandle) this.scheduleNextRefresh();
+    }, delayMs);
+    console.log(`[${this.managerName}] Token refresh scheduled in ${Math.round(delayMs / 1e3)} seconds`);
+  }
+  async refreshOnce() {
+    if (this.getSkipReason()) {
+      return createSuccessResult();
+    }
+    const config = this.getRuntimeConfig();
+    if (!config) return createSuccessResult();
+    this.health.lastAttemptAt = (/* @__PURE__ */ new Date()).toISOString();
+    try {
+      await this.doRefresh(config);
+      this.health.lastSuccessAt = (/* @__PURE__ */ new Date()).toISOString();
+      this.health.lastErrorAt = null;
+      this.health.lastErrorMessage = null;
+      return createSuccessResult();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      this.health.lastErrorAt = (/* @__PURE__ */ new Date()).toISOString();
+      this.health.lastErrorMessage = message;
+      console.error(`[${this.managerName}] Failed to refresh credentials:`, error);
+      return createErrorResult({ message });
+    }
+  }
+};
+
+// src/services/monolith-service.ts
+async function monolithRequest(path6, init = {}) {
+  if (!ENGINE_ENV.REPLICAS_WORKSPACE_ID) {
+    throw new Error("REPLICAS_WORKSPACE_ID is not set; cannot call monolith");
+  }
+  const headers = {
+    Authorization: `Bearer ${ENGINE_ENV.REPLICAS_ENGINE_SECRET}`,
+    "X-Workspace-Id": ENGINE_ENV.REPLICAS_WORKSPACE_ID
+  };
+  if (!(init.body instanceof FormData)) headers["Content-Type"] = "application/json";
+  return fetch(`${ENGINE_ENV.REPLICAS_MONOLITH_URL}${path6}`, {
+    method: init.method ?? "POST",
+    headers,
+    body: init.body === void 0 ? void 0 : init.body instanceof FormData ? init.body : JSON.stringify(init.body),
+    signal: init.signal
+  });
+}
+var MonolithService = class {
+  async getRelaySubagentProviders() {
+    try {
+      const response = await monolithRequest("/v1/engine/relay-subagent-providers", { method: "GET" });
+      if (!response.ok) {
+        return null;
+      }
+      const body = await response.json();
+      return isRecord(body) && Array.isArray(body.providers) && body.providers.every((provider) => typeof provider === "string" && isValidAgentProvider(provider)) ? body.providers : null;
+    } catch {
+      return null;
+    }
+  }
+  async getOpenRouterModels() {
+    try {
+      const response = await monolithRequest("/v1/engine/openrouter-models", { method: "GET" });
+      if (!response.ok) {
+        return null;
+      }
+      const body = await response.json();
+      return isRecord(body) && Array.isArray(body.models) && body.models.every((model) => typeof model === "string") ? body.models : null;
+    } catch {
+      return null;
+    }
+  }
+  async sendEvent(event) {
+    if (!ENGINE_ENV.REPLICAS_WORKSPACE_ID) {
+      return;
+    }
+    try {
+      const response = await monolithRequest("/v1/engine/webhook", { body: event });
+      if (!response.ok) {
+        const errorText = await response.text();
+        console.error(`[MonolithService] Failed to send event: ${response.status} ${errorText}`);
+      }
+    } catch (error) {
+      console.error("[MonolithService] Failed to send event:", error);
+    }
+  }
+};
+var monolithService = new MonolithService();
+
 // src/utils/file.ts
 import { mkdir, readFile, rename, unlink, writeFile } from "fs/promises";
-import { dirname, join } from "path";
+import { dirname, join as join3 } from "path";
 
 // src/utils/async-lock.ts
 var AsyncLock = class {
@@ -233,11 +583,11 @@ var AsyncLock = class {
 };
 
 // src/utils/file.ts
-async function atomicWriteFile(path5, data, options) {
-  const tmpFile = `${path5}.${process.pid}.${Date.now()}.tmp`;
+async function atomicWriteFile(path6, data, options) {
+  const tmpFile = `${path6}.${process.pid}.${Date.now()}.tmp`;
   try {
     await writeFile(tmpFile, data, { encoding: "utf-8", mode: options?.mode });
-    await rename(tmpFile, path5);
+    await rename(tmpFile, path6);
   } catch (error) {
     await unlink(tmpFile).catch(() => void 0);
     throw error;
@@ -250,8 +600,8 @@ async function writeSecureCredentialFile(filePath, content, options) {
   await atomicWriteFile(filePath, content, { mode: 384 });
 }
 async function configureManagedGitCredentialHelper(homeDir) {
-  const credentialsPath = join(homeDir, ".git-credentials");
-  const helperPath = join(homeDir, GIT_CREDENTIAL_HELPER_FILENAME);
+  const credentialsPath = join3(homeDir, ".git-credentials");
+  const helperPath = join3(homeDir, GIT_CREDENTIAL_HELPER_FILENAME);
   await atomicWriteFile(helperPath, buildGitCredentialHelperScript(credentialsPath), { mode: 448 });
   await execFileAsync("git", ["config", "--global", "credential.helper", helperPath], {
     env: { ...process.env, HOME: homeDir }
@@ -286,15 +636,15 @@ function removeCredentialFileLines(filePath, shouldRemove) {
 // src/git/service.ts
 import { readdir, readFile as readFile3, stat } from "fs/promises";
 import { spawn } from "child_process";
-import { join as join4 } from "path";
+import { join as join6 } from "path";
 
 // src/utils/state.ts
 import { readFile as readFile2, mkdir as mkdir2 } from "fs/promises";
 import { existsSync } from "fs";
-import { join as join2 } from "path";
-import { homedir } from "os";
-var STATE_DIR = join2(homedir(), ".replicas");
-var STATE_FILE = join2(STATE_DIR, "engine-state.json");
+import { join as join4 } from "path";
+import { homedir as homedir3 } from "os";
+var STATE_DIR = join4(homedir3(), ".replicas");
+var STATE_FILE = join4(STATE_DIR, "engine-state.json");
 var DEFAULT_STATE = {
   repos: {}
 };
@@ -391,8 +741,8 @@ async function saveRepoState(repoName, state, fallbackState) {
 }
 
 // src/git/commands.ts
-import { readFileSync } from "fs";
-import { join as join3 } from "path";
+import { readFileSync as readFileSync3 } from "fs";
+import { join as join5 } from "path";
 async function runGitCommand(args, cwd, options = {}) {
   const { stdout } = await execFileAsync("git", args, {
     cwd,
@@ -403,7 +753,7 @@ async function runGitCommand(args, cwd, options = {}) {
 }
 function readRepoHeadBranch(repoPath) {
   try {
-    const contents = readFileSync(join3(repoPath, ".git", "HEAD"), "utf-8").trim();
+    const contents = readFileSync3(join5(repoPath, ".git", "HEAD"), "utf-8").trim();
     const match = contents.match(/^ref:\s+refs\/heads\/(.+)$/);
     return match ? match[1] : null;
   } catch {
@@ -465,13 +815,13 @@ var GitService = class {
     const repos = [];
     let complete = true;
     for (const entry of entries) {
-      const fullPath = join4(root, entry);
+      const fullPath = join6(root, entry);
       try {
         const entryStat = await stat(fullPath);
         if (!entryStat.isDirectory()) {
           continue;
         }
-        const hasGit = Boolean(await this.safeStat(join4(fullPath, ".git")));
+        const hasGit = Boolean(await this.safeStat(join6(fullPath, ".git")));
         if (!hasGit) {
           continue;
         }
@@ -660,9 +1010,9 @@ var GitService = class {
     try {
       const paths = await this.listUntrackedPaths(repoPath);
       let total = 0;
-      for (const path5 of paths) {
+      for (const path6 of paths) {
         try {
-          const contents = await readFile3(join4(repoPath, path5));
+          const contents = await readFile3(join6(repoPath, path6));
           if (contents.length === 0 || contents.includes(0)) {
             continue;
           }
@@ -850,7 +1200,7 @@ var GitService = class {
   }
   async getGitLabAccessToken(host) {
     try {
-      const credentials = await readFile3(join4(ENGINE_ENV.HOME_DIR, ".git-credentials"), "utf-8");
+      const credentials = await readFile3(join6(ENGINE_ENV.HOME_DIR, ".git-credentials"), "utf-8");
       for (const line of credentials.split("\n")) {
         const trimmed = line.trim();
         if (!trimmed) continue;
@@ -918,9 +1268,9 @@ var GitService = class {
     await saveRepoState(repo.name, state, state);
     return state;
   }
-  async safeStat(path5) {
+  async safeStat(path6) {
     try {
-      return await stat(path5);
+      return await stat(path6);
     } catch {
       return null;
     }
@@ -1071,6 +1421,26 @@ var gitlabTokenManager = new GitLabTokenManager();
 // src/managers/claude-token-manager.ts
 import { promises as fs } from "fs";
 import path3 from "path";
+
+// src/managers/auth-env-transition.ts
+function applyAuthEnvTransition(params) {
+  const newOwned = new Set(params.authKeysByMethod[params.newMethod]);
+  const prevOwned = new Set(params.authKeysByMethod[params.prevMethod]);
+  for (const key of params.authKeys) {
+    const value = params.newEnvVars[key];
+    if (value !== void 0) {
+      for (const env of params.envs) {
+        env[key] = value;
+      }
+    } else if (prevOwned.has(key) && !newOwned.has(key)) {
+      for (const env of params.envs) {
+        delete env[key];
+      }
+    }
+  }
+}
+
+// src/managers/claude-token-manager.ts
 var ClaudeTokenManager = class extends BaseRefreshManager {
   constructor() {
     super("ClaudeTokenManager");
@@ -1174,9 +1544,152 @@ var ClaudeTokenManager = class extends BaseRefreshManager {
 };
 var claudeTokenManager = new ClaudeTokenManager();
 
+// src/managers/codex-token-manager.ts
+import { promises as fs2 } from "fs";
+import path4 from "path";
+var CodexAspAuthMethodChangedError = class extends Error {
+  name = "CodexAspAuthMethodChangedError";
+};
+var CodexTokenManager = class extends BaseRefreshManager {
+  constructor() {
+    super("CodexTokenManager");
+  }
+  getSkipReason() {
+    if (ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "api_key" || ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "foundry") {
+      return `auth method is ${ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD}`;
+    }
+    if (!ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD && ENGINE_ENV.OPENAI_API_KEY) {
+      return "OPENAI_API_KEY is set";
+    }
+    return null;
+  }
+  async doRefresh(_config) {
+    await this.refreshWithRequest();
+  }
+  async refreshWithRequest(request) {
+    console.log("[CodexTokenManager] Refreshing Codex credentials...");
+    const response = await monolithRequest("/v1/engine/codex/refresh-credentials", {
+      body: request
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new Error(`Credentials refresh failed: ${response.status} ${errorText}`);
+    }
+    const data = await response.json();
+    await this.applyCredentialsResponse(data);
+    if (data.scope) {
+      setAgentCredentialSnapshot("codex", {
+        method: data.type,
+        scope: data.scope,
+        ...data.revision ? { revision: data.revision } : {}
+      });
+    }
+    console.log(`[CodexTokenManager] Credentials refreshed (method=${data.type})`);
+    return data;
+  }
+  async prepareAspOauthOptions() {
+    if (ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD !== "oauth") return {};
+    const response = await this.refreshWithRequest();
+    if (response.type !== "oauth") return {};
+    const login = this.buildAspOauthLogin(response);
+    let credential = login.credential;
+    return {
+      chatgptAuthTokens: login.tokens,
+      refreshChatgptAuthTokens: async (params) => {
+        const refreshed = await this.refreshAspOauthCredentials(
+          credential,
+          `Codex ASP requested an external token refresh (${params.reason})`
+        );
+        if (!refreshed.ok) {
+          if (refreshed.error.code === "method_changed") {
+            throw new CodexAspAuthMethodChangedError(refreshed.error.message);
+          }
+          throw new Error(refreshed.error.message);
+        }
+        credential = refreshed.data.credential;
+        return refreshed.data.tokens;
+      }
+    };
+  }
+  async refreshAspOauthCredentials(failedCredential, failureReason) {
+    try {
+      const response = await this.refreshWithRequest({
+        failedMethod: "oauth",
+        ...failedCredential?.method === "oauth" ? { failedCredential } : {},
+        failureKind: "rejected",
+        failureReason
+      });
+      if (response.type !== "oauth") {
+        return createErrorResult({
+          message: `${failureReason}; credentials changed to ${response.type}, so the app server must restart`,
+          code: "method_changed"
+        });
+      }
+      return createSuccessResult(this.buildAspOauthLogin(response));
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return createErrorResult({
+        message,
+        code: message.includes('"code":"no_credentials"') ? "no_credentials" : "refresh_failed"
+      });
+    }
+  }
+  async fetchFreshCredentials(failureReason, failureKind = "rejected", failedCredential = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.codex) {
+    const failedMethod = failedCredential?.method === "oauth" || failedCredential?.method === "api_key" || failedCredential?.method === "foundry" ? failedCredential.method : ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD;
+    return this.swapCredentials({
+      provider: "codex",
+      failureKind,
+      refresh: async (exclusions) => {
+        await this.refreshWithRequest(
+          failedMethod === "oauth" || failedMethod === "api_key" || failedMethod === "foundry" ? {
+            failedMethod,
+            ...failedCredential?.method === failedMethod ? { failedCredential } : {},
+            failureReason,
+            failureKind,
+            ...exclusions
+          } : exclusions
+        );
+      },
+      isOauthNow: () => ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "oauth"
+    });
+  }
+  async applyCredentialsResponse(response) {
+    await this.removeOauthCredentialsFile();
+    const envVars = codexAuthEnvFromResponse(response);
+    applyAuthEnvTransition({
+      prevMethod: ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD ?? "none",
+      newMethod: envVars.REPLICAS_CODEX_AUTH_METHOD ?? "none",
+      authKeys: CODEX_AUTH_ENV_KEYS,
+      authKeysByMethod: CODEX_AUTH_ENV_KEYS_BY_METHOD,
+      newEnvVars: envVars,
+      envs: [ENGINE_ENV, process.env]
+    });
+  }
+  buildAspOauthLogin(response) {
+    const credential = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.codex;
+    return {
+      tokens: {
+        accessToken: response.accessToken,
+        chatgptAccountId: response.accountId,
+        chatgptPlanType: null
+      },
+      ...credential?.method === "oauth" ? { credential } : {}
+    };
+  }
+  async removeOauthCredentialsFile() {
+    const authPath = path4.join(ENGINE_ENV.HOME_DIR, ".codex", "auth.json");
+    try {
+      await fs2.unlink(authPath);
+    } catch (error) {
+      if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
+    }
+  }
+};
+var codexTokenManager = new CodexTokenManager();
+
 // src/managers/infisical-token-manager.ts
 import { rm } from "fs/promises";
-import path4 from "path";
+import path5 from "path";
 var InfisicalTokenManager = class extends BaseRefreshManager {
   constructor(request = monolithRequest, paths = {
     homeDir: ENGINE_ENV.HOME_DIR,
@@ -1204,8 +1717,8 @@ var InfisicalTokenManager = class extends BaseRefreshManager {
   }
 };
 async function applyInfisicalCredentials(data, paths) {
-  const credentialPath = path4.join(paths.homeDir, ".replicas", "infisical-env.sh");
-  const configPath = path4.join(paths.workspaceRoot, ".infisical.json");
+  const credentialPath = path5.join(paths.homeDir, ".replicas", "infisical-env.sh");
+  const configPath = path5.join(paths.workspaceRoot, ".infisical.json");
   if (!data.configured) {
     delete process.env.INFISICAL_TOKEN;
     delete process.env.INFISICAL_DOMAIN;
@@ -1234,8 +1747,8 @@ var infisicalTokenManager = new InfisicalTokenManager();
 
 // src/utils/logger.ts
 import { mkdir as mkdir3, writeFile as writeFile2 } from "fs/promises";
-import { homedir as homedir2 } from "os";
-import { join as join5 } from "path";
+import { homedir as homedir4 } from "os";
+import { join as join7 } from "path";
 import { format } from "util";
 import { randomBytes } from "crypto";
 
@@ -1247,8 +1760,8 @@ var StreamWriter = class {
   backpressured = false;
   droppedCount = 0;
   flushTimer = null;
-  open(path5, highWaterMark = DEFAULT_HIGH_WATER) {
-    this.stream = createWriteStream(path5, { flags: "a", highWaterMark });
+  open(path6, highWaterMark = DEFAULT_HIGH_WATER) {
+    this.stream = createWriteStream(path6, { flags: "a", highWaterMark });
     this.stream.on("error", () => {
       this.stream = null;
     });
@@ -1310,7 +1823,7 @@ var StreamWriter = class {
 };
 
 // src/utils/logger.ts
-var LOG_DIR = join5(homedir2(), ".replicas", "logs");
+var LOG_DIR = join7(homedir4(), ".replicas", "logs");
 var EngineLogger = class {
   _sessionId = null;
   patched = false;
@@ -1321,7 +1834,7 @@ var EngineLogger = class {
   async initialize() {
     await mkdir3(LOG_DIR, { recursive: true });
     this._sessionId = this.createSessionId();
-    const logPath = join5(LOG_DIR, `${this._sessionId}.log`);
+    const logPath = join7(LOG_DIR, `${this._sessionId}.log`);
     await writeFile2(logPath, `=== Replicas Engine Session ${this._sessionId} ===
 `, "utf-8");
     this.writer.open(logPath);
@@ -1368,32 +1881,32 @@ var engineLogger = new EngineLogger();
 // src/services/replicas-config-service.ts
 import { readFile as readFile6, appendFile, writeFile as writeFile4, mkdir as mkdir6 } from "fs/promises";
 import { existsSync as existsSync3 } from "fs";
-import { join as join9 } from "path";
-import { homedir as homedir6 } from "os";
+import { join as join11 } from "path";
+import { homedir as homedir8 } from "os";
 import { spawn as spawn2 } from "child_process";
 
 // src/services/environment-details-service.ts
 import { mkdir as mkdir4, readFile as readFile4 } from "fs/promises";
 import { existsSync as existsSync2 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join7 } from "path";
+import { homedir as homedir6 } from "os";
+import { join as join9 } from "path";
 
 // src/managers/agent-auth-paths.ts
-import { homedir as homedir3 } from "os";
-import { join as join6 } from "path";
-var OPENCODE_AUTH_PATH = join6(homedir3(), ".local", "share", "opencode", "auth.json");
-var PI_AUTH_PATH = join6(homedir3(), ".pi", "agent", "auth.json");
-var DEEPSEEK_AUTH_PATH = join6(homedir3(), ".replicas", "deepseek-auth.json");
+import { homedir as homedir5 } from "os";
+import { join as join8 } from "path";
+var OPENCODE_AUTH_PATH = join8(homedir5(), ".local", "share", "opencode", "auth.json");
+var PI_AUTH_PATH = join8(homedir5(), ".pi", "agent", "auth.json");
+var DEEPSEEK_AUTH_PATH = join8(homedir5(), ".replicas", "deepseek-auth.json");
 
 // src/managers/deepseek-auth.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { z } from "zod";
 var authSchema = z.object({
   openrouter: z.object({ type: z.literal("api"), key: z.string().min(1) })
 });
 function getDeepseekApiKey() {
   try {
-    const parsed = authSchema.safeParse(JSON.parse(readFileSync2(DEEPSEEK_AUTH_PATH, "utf8")));
+    const parsed = authSchema.safeParse(JSON.parse(readFileSync4(DEEPSEEK_AUTH_PATH, "utf8")));
     return parsed.success ? parsed.data.openrouter.key : null;
   } catch {
     return null;
@@ -1406,11 +1919,11 @@ function detectCodexAuthMethod() {
 }
 
 // src/services/environment-details-service.ts
-var REPLICAS_DIR = join7(homedir4(), ".replicas");
-var DETAILS_FILE = join7(REPLICAS_DIR, "environment-details.json");
-var CLAUDE_CREDENTIALS_PATH = join7(homedir4(), ".claude", ".credentials.json");
-var GH_HOSTS_PATH = join7(homedir4(), ".config", "gh", "hosts.yml");
-var GIT_CREDENTIALS_PATH = join7(homedir4(), ".git-credentials");
+var REPLICAS_DIR = join9(homedir6(), ".replicas");
+var DETAILS_FILE = join9(REPLICAS_DIR, "environment-details.json");
+var CLAUDE_CREDENTIALS_PATH = join9(homedir6(), ".claude", ".credentials.json");
+var GH_HOSTS_PATH = join9(homedir6(), ".config", "gh", "hosts.yml");
+var GIT_CREDENTIALS_PATH = join9(homedir6(), ".git-credentials");
 function detectClaudeAuthMethod() {
   if (existsSync2(CLAUDE_CREDENTIALS_PATH)) {
     return "oauth";
@@ -1622,8 +2135,8 @@ var environmentDetailsService = new EnvironmentDetailsService();
 
 // src/services/start-hook-logs-service.ts
 import { mkdir as mkdir5, readFile as readFile5, writeFile as writeFile3, readdir as readdir2 } from "fs/promises";
-import { homedir as homedir5 } from "os";
-import { join as join8 } from "path";
+import { homedir as homedir7 } from "os";
+import { join as join10 } from "path";
 
 // src/services/hook-log-files.ts
 import { createHash } from "crypto";
@@ -1635,7 +2148,7 @@ function repoHookLogFilename(repoName) {
 }
 
 // src/services/start-hook-logs-service.ts
-var LOGS_DIR = join8(homedir5(), ".replicas", "start-hook-logs");
+var LOGS_DIR = join10(homedir7(), ".replicas", "start-hook-logs");
 function withPreview(stored) {
   const preview = buildHookOutputPreview(stored.output);
   return { ...stored, ...preview };
@@ -1673,7 +2186,7 @@ var StartHookLogsService = class {
     await this.ensureDir();
     const log = { hookType, hookName, repoName: hookName, ...entry };
     const filename = hookType === "environment" ? ENVIRONMENT_HOOK_LOG_FILENAME : repoHookLogFilename(hookName);
-    await writeFile3(join8(LOGS_DIR, filename), `${JSON.stringify(log, null, 2)}
+    await writeFile3(join10(LOGS_DIR, filename), `${JSON.stringify(log, null, 2)}
 `, "utf-8");
   }
   async saveEnvironmentLog(entry) {
@@ -1698,7 +2211,7 @@ var StartHookLogsService = class {
         continue;
       }
       try {
-        const raw = await readFile5(join8(LOGS_DIR, file), "utf-8");
+        const raw = await readFile5(join10(LOGS_DIR, file), "utf-8");
         const stored = normalizeStored(JSON.parse(raw));
         if (stored) {
           logs.push(withPreview(stored));
@@ -1717,7 +2230,7 @@ var StartHookLogsService = class {
   async getFullOutput(hookType, hookName) {
     const filename = hookType === "environment" ? ENVIRONMENT_HOOK_LOG_FILENAME : repoHookLogFilename(hookName);
     try {
-      const raw = await readFile5(join8(LOGS_DIR, filename), "utf-8");
+      const raw = await readFile5(join10(LOGS_DIR, filename), "utf-8");
       const stored = normalizeStored(JSON.parse(raw));
       if (!stored || stored.hookType !== hookType || stored.hookName !== hookName) {
         return null;
@@ -1734,7 +2247,7 @@ var StartHookLogsService = class {
 var startHookLogsService = new StartHookLogsService();
 
 // src/services/replicas-config-service.ts
-var START_HOOKS_LOG = join9(homedir6(), ".replicas", "startHooks.log");
+var START_HOOKS_LOG = join11(homedir8(), ".replicas", "startHooks.log");
 var START_HOOKS_RUNNING_PROMPT = `IMPORTANT - Start Hooks Running:
 Start hooks are shell commands/scripts set by repository owners that run on workspace startup.
 These hooks are currently executing in the background. You can:
@@ -1745,7 +2258,7 @@ The start hooks may install dependencies, build projects, or perform other setup
 If your task depends on setup being complete, check the log file before proceeding.`;
 async function readReplicasConfigFromDir(dirPath) {
   for (const filename of REPLICAS_CONFIG_FILENAMES) {
-    const configPath = join9(dirPath, filename);
+    const configPath = join11(dirPath, filename);
     if (!existsSync3(configPath)) {
       continue;
     }
@@ -1815,7 +2328,7 @@ var ReplicasConfigService = class {
     const logLine = `[${timestamp}] ${message}
 `;
     try {
-      await mkdir6(join9(homedir6(), ".replicas"), { recursive: true });
+      await mkdir6(join11(homedir8(), ".replicas"), { recursive: true });
       await appendFile(START_HOOKS_LOG, logLine, "utf-8");
     } catch (error) {
       console.error("Failed to write to start hooks log:", error);
@@ -1827,7 +2340,7 @@ var ReplicasConfigService = class {
       command: params.content,
       label: "env start hook",
       repoName: "environment",
-      cwd: homedir6(),
+      cwd: homedir8(),
       timeout: params.timeoutMs ?? DEFAULT_START_HOOK_TIMEOUT_MS,
       onOutputChunk: params.onOutputChunk
     });
@@ -1950,7 +2463,7 @@ var ReplicasConfigService = class {
     this.hooksCompleted = false;
     this.hooksFailed = false;
     try {
-      await mkdir6(join9(homedir6(), ".replicas"), { recursive: true });
+      await mkdir6(join11(homedir8(), ".replicas"), { recursive: true });
       await writeFile4(
         START_HOOKS_LOG,
         `=== Start Hooks Execution Log ===
@@ -2145,11 +2658,11 @@ var replicasConfigService = new ReplicasConfigService();
 
 // src/services/event-service.ts
 import { mkdir as mkdir7 } from "fs/promises";
-import { homedir as homedir7 } from "os";
-import { join as join10 } from "path";
+import { homedir as homedir9 } from "os";
+import { join as join12 } from "path";
 import { randomUUID } from "crypto";
-var ENGINE_DIR = join10(homedir7(), ".replicas", "engine");
-var EVENTS_FILE = join10(ENGINE_DIR, "events.jsonl");
+var ENGINE_DIR = join12(homedir9(), ".replicas", "engine");
+var EVENTS_FILE = join12(ENGINE_DIR, "events.jsonl");
 var EventService = class {
   subscribers = /* @__PURE__ */ new Map();
   writer = new StreamWriter();
@@ -2183,9 +2696,9 @@ var eventService = new EventService();
 import { mkdir as mkdir8, readFile as readFile7 } from "fs/promises";
 import { existsSync as existsSync4 } from "fs";
 import { randomUUID as randomUUID2 } from "crypto";
-import { homedir as homedir8 } from "os";
-import { dirname as dirname2, join as join11 } from "path";
-var PREVIEW_PORTS_FILE = join11(homedir8(), ".replicas", "preview-ports.json");
+import { homedir as homedir10 } from "os";
+import { dirname as dirname2, join as join13 } from "path";
+var PREVIEW_PORTS_FILE = join13(homedir10(), ".replicas", "preview-ports.json");
 async function readPreviewsFile() {
   try {
     if (!existsSync4(PREVIEW_PORTS_FILE)) {
@@ -2297,7 +2810,7 @@ async function registerDesktopPreview() {
 // src/services/chat/chat-service.ts
 import { existsSync as existsSync8 } from "fs";
 import { appendFile as appendFile4, copyFile, mkdir as mkdir17, readFile as readFile17, rename as rename3, rm as rm2 } from "fs/promises";
-import { join as join27 } from "path";
+import { join as join29 } from "path";
 import { randomUUID as randomUUID8 } from "crypto";
 
 // src/managers/claude-manager.ts
@@ -2305,9 +2818,9 @@ import {
   query
 } from "@anthropic-ai/claude-agent-sdk";
 import { randomUUID as randomUUID4 } from "crypto";
-import { dirname as dirname4, join as join15 } from "path";
+import { dirname as dirname4, join as join17 } from "path";
 import { mkdir as mkdir10 } from "fs/promises";
-import { homedir as homedir10 } from "os";
+import { homedir as homedir12 } from "os";
 
 // src/utils/linear-converter.ts
 function linearThoughtToResponse(thought) {
@@ -2692,8 +3205,8 @@ function extractPlanFromCodexAspNotification(notification) {
 // src/utils/image-utils.ts
 import { randomUUID as randomUUID3 } from "crypto";
 import { mkdir as mkdir9, unlink as unlink2, writeFile as writeFile5 } from "fs/promises";
-import { homedir as homedir9 } from "os";
-import { join as join12 } from "path";
+import { homedir as homedir11 } from "os";
+import { join as join14 } from "path";
 function isImageMediaType(value) {
   return IMAGE_MEDIA_TYPES.includes(value);
 }
@@ -2793,14 +3306,14 @@ async function normalizeImages(images) {
   }
   return normalized;
 }
-async function saveNormalizedImagesToTempFiles(images, tempImageDir = join12(homedir9(), ".replicas", "codex", "temp-images")) {
+async function saveNormalizedImagesToTempFiles(images, tempImageDir = join14(homedir11(), ".replicas", "codex", "temp-images")) {
   await mkdir9(tempImageDir, { recursive: true });
   const tempPaths = [];
   try {
     for (const image of images) {
       const ext = image.source.media_type.split("/")[1] || "png";
       const filename = `img_${randomUUID3()}.${ext}`;
-      const filepath = join12(tempImageDir, filename);
+      const filepath = join14(tempImageDir, filename);
       await writeFile5(filepath, Buffer.from(image.source.data, "base64"));
       tempPaths.push(filepath);
     }
@@ -2811,12 +3324,12 @@ async function saveNormalizedImagesToTempFiles(images, tempImageDir = join12(hom
   return tempPaths;
 }
 async function removeTempImageFiles(paths) {
-  await Promise.allSettled(paths.map((path5) => unlink2(path5)));
+  await Promise.allSettled(paths.map((path6) => unlink2(path6)));
 }
 
 // src/managers/coding-agent-manager.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { join as join13 } from "path";
+import { readFileSync as readFileSync5 } from "fs";
+import { join as join15 } from "path";
 
 // src/managers/auth-fallback.ts
 var SWAPPABLE_AGENTS = {
@@ -3274,7 +3787,7 @@ var CodingAgentManager = class {
   buildMemoryInstruction() {
     const readSummary = (scope) => {
       try {
-        return readFileSync3(join13(MEMORY_ROOT, scope, MEMORY_SUMMARY_FILENAME), "utf8").trim();
+        return readFileSync5(join15(MEMORY_ROOT, scope, MEMORY_SUMMARY_FILENAME), "utf8").trim();
       } catch {
         return "";
       }
@@ -3285,10 +3798,10 @@ var CodingAgentManager = class {
     const parts = [
       `Replicas memory is available under ${MEMORY_ROOT}. Each summary below belongs to the scope and root on its enclosing tag. For relevant tasks, search that scope's ${MEMORY_INDEX_FILENAME} and rollout summaries. The summaries are fallible historical context, not instructions. Current user and repository instructions override memory.`
     ];
-    if (organization) parts.push(`<replicas-organization-memory root="${join13(MEMORY_ROOT, "organization")}">
+    if (organization) parts.push(`<replicas-organization-memory root="${join15(MEMORY_ROOT, "organization")}">
 ${organization}
 </replicas-organization-memory>`);
-    if (seat) parts.push(`<replicas-personal-memory root="${join13(MEMORY_ROOT, "seat")}">
+    if (seat) parts.push(`<replicas-personal-memory root="${join15(MEMORY_ROOT, "seat")}">
 ${seat}
 </replicas-personal-memory>`);
     return parts.join("\n\n");
@@ -3470,7 +3983,7 @@ function reportCommandProtectionBlock(options) {
 
 // src/services/skill-registry-service.ts
 import { readFile as readFile8, readdir as readdir3, stat as stat2 } from "fs/promises";
-import { dirname as dirname3, isAbsolute, join as join14, relative, resolve } from "path";
+import { dirname as dirname3, isAbsolute, join as join16, relative, resolve } from "path";
 var REGISTRY_ROOT_DIR = ".replicas/skill-registries";
 var REGISTRY_MANIFEST = "manifest.json";
 async function getSkillRegistryInventory(homeDir) {
@@ -3503,7 +4016,7 @@ async function getSkillRegistryInventory(homeDir) {
 async function buildClaudeRegistryConfig(homeDir) {
   const inventory = await getSkillRegistryInventory(homeDir);
   return {
-    plugins: inventory.claudePluginRoots.map((path5) => ({ type: "local", path: path5 })),
+    plugins: inventory.claudePluginRoots.map((path6) => ({ type: "local", path: path6 })),
     enableAllSkills: inventory.claudePluginRoots.length > 0 || inventory.standaloneSkills.length > 0
   };
 }
@@ -3531,10 +4044,10 @@ async function scanRegistry(registryDir) {
 }
 async function findSkillCollections(registryDir) {
   const candidateRoots = [
-    { source: "skills", root: join14(registryDir, "skills") },
-    { source: "agents", root: join14(registryDir, ".agents", "skills") },
-    { source: "codex", root: join14(registryDir, ".codex", "skills") },
-    { source: "claude", root: join14(registryDir, ".claude", "skills") }
+    { source: "skills", root: join16(registryDir, "skills") },
+    { source: "agents", root: join16(registryDir, ".agents", "skills") },
+    { source: "codex", root: join16(registryDir, ".codex", "skills") },
+    { source: "claude", root: join16(registryDir, ".claude", "skills") }
   ];
   const collections = [];
   for (const { source, root } of candidateRoots) {
@@ -3548,9 +4061,9 @@ async function findSkillCollections(registryDir) {
 async function findSkillDirsInRoot(root) {
   const skillDirs = [];
   for (const dirent of await safeReadDir(root)) {
-    const skillDir = join14(root, dirent.name);
+    const skillDir = join16(root, dirent.name);
     if (!await isDirectoryDirent(dirent, skillDir)) continue;
-    if (await fileExists(join14(skillDir, "SKILL.md"))) {
+    if (await fileExists(join16(skillDir, "SKILL.md"))) {
       skillDirs.push(skillDir);
     }
   }
@@ -3560,9 +4073,9 @@ async function findTopLevelSkills(registryDir) {
   const skills = [];
   for (const dirent of await safeReadDir(registryDir)) {
     if (dirent.name.startsWith(".") || dirent.name === "skills" || dirent.name === "plugins") continue;
-    const skillDir = join14(registryDir, dirent.name);
+    const skillDir = join16(registryDir, dirent.name);
     if (!await isDirectoryDirent(dirent, skillDir)) continue;
-    if (await fileExists(join14(skillDir, "SKILL.md"))) {
+    if (await fileExists(join16(skillDir, "SKILL.md"))) {
       skills.push({ source: "root", skillDir });
     }
   }
@@ -3573,10 +4086,10 @@ async function findClaudePluginRoots(registryDir) {
   async function walk(dir) {
     for (const dirent of await safeReadDir(dir)) {
       if (dirent.name === ".git") continue;
-      const child = join14(dir, dirent.name);
+      const child = join16(dir, dirent.name);
       if (!await isDirectoryDirent(dirent, child)) continue;
       if (dirent.name === ".claude-plugin") {
-        if (await fileExists(join14(child, "plugin.json"))) {
+        if (await fileExists(join16(child, "plugin.json"))) {
           roots.push(dirname3(child));
         }
         continue;
@@ -3588,7 +4101,7 @@ async function findClaudePluginRoots(registryDir) {
   return uniqueStrings(roots);
 }
 async function hasCodexMarketplace(registryDir) {
-  return await fileExists(join14(registryDir, ".agents", "plugins", "marketplace.json")) || await fileExists(join14(registryDir, ".codex", "plugins", "marketplace.json"));
+  return await fileExists(join16(registryDir, ".agents", "plugins", "marketplace.json")) || await fileExists(join16(registryDir, ".codex", "plugins", "marketplace.json"));
 }
 async function installCodexRegistryPlugins(client2, inventory) {
   const cwds = inventory.codexMarketplaceCwds;
@@ -3630,10 +4143,10 @@ async function readManifest(homeDir) {
   }
 }
 function getRegistryRoot(homeDir) {
-  return join14(homeDir, REGISTRY_ROOT_DIR);
+  return join16(homeDir, REGISTRY_ROOT_DIR);
 }
 function getManifestPath(homeDir) {
-  return join14(getRegistryRoot(homeDir), REGISTRY_MANIFEST);
+  return join16(getRegistryRoot(homeDir), REGISTRY_MANIFEST);
 }
 function emptyInventory(registryRoot) {
   return {
@@ -3661,31 +4174,31 @@ function uniqueStandaloneSkills(skills) {
   }
   return unique;
 }
-async function safeReadDir(path5) {
+async function safeReadDir(path6) {
   try {
-    return await readdir3(path5, { withFileTypes: true });
+    return await readdir3(path6, { withFileTypes: true });
   } catch (error) {
     if (isNotFoundError(error)) return [];
     throw error;
   }
 }
-async function isDirectoryDirent(dirent, path5) {
+async function isDirectoryDirent(dirent, path6) {
   if (dirent.isDirectory()) return true;
   if (!dirent.isSymbolicLink()) return false;
-  return directoryExists(path5);
+  return directoryExists(path6);
 }
-async function directoryExists(path5) {
+async function directoryExists(path6) {
   try {
-    const pathStat = await stat2(path5);
+    const pathStat = await stat2(path6);
     return pathStat.isDirectory();
   } catch (error) {
     if (isNotFoundError(error)) return false;
     throw error;
   }
 }
-async function fileExists(path5) {
+async function fileExists(path6) {
   try {
-    const pathStat = await stat2(path5);
+    const pathStat = await stat2(path6);
     return pathStat.isFile();
   } catch (error) {
     if (isNotFoundError(error)) return false;
@@ -4080,7 +4593,7 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
   authRetrying = false;
   constructor(options) {
     super({ ...options, provider: AGENT.CLAUDE });
-    this.historyFilePath = options.historyFilePath ?? join15(homedir10(), ".replicas", "claude", "history.jsonl");
+    this.historyFilePath = options.historyFilePath ?? join17(homedir12(), ".replicas", "claude", "history.jsonl");
     this.historyFile = new CodexHistoryFile(this.historyFilePath);
     this.systemPromptOverride = options.systemPromptOverride;
     this.toolsOverride = options.tools;
@@ -5134,7 +5647,7 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
 
 // src/managers/codex-asp/codex-asp-manager.ts
 import { readdir as readdir4 } from "fs/promises";
-import { join as join17 } from "path";
+import { join as join19 } from "path";
 
 // src/managers/codex-asp/asp-host.ts
 var hostPromise = null;
@@ -5249,7 +5762,7 @@ var CodexQuotaStatusTracker = class {
 };
 
 // src/managers/codex-asp/mappers.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
 var localImageCache = /* @__PURE__ */ new Map();
 var DEFAULT_MODEL = DEFAULT_CODEX_MODEL;
 var THREAD_START_METHOD = "thread/start";
@@ -5371,16 +5884,16 @@ function transcriptItemsForTurn(turn) {
   const otherItems = turn.items.filter((item) => item.type !== "userMessage");
   return [...userItems, ...otherItems];
 }
-function userImageForLocalPath(path5) {
-  const cached = localImageCache.get(path5);
+function userImageForLocalPath(path6) {
+  const cached = localImageCache.get(path6);
   if (cached) return cached;
-  if (!existsSync5(path5)) return null;
+  if (!existsSync5(path6)) return null;
   const image = {
     type: "image",
-    mediaType: inferMediaType(path5),
-    data: readFileSync4(path5).toString("base64")
+    mediaType: inferMediaType(path6),
+    data: readFileSync6(path6).toString("base64")
   };
-  if (image.data.length > 0) localImageCache.set(path5, image);
+  if (image.data.length > 0) localImageCache.set(path6, image);
   return image;
 }
 function userImagesForInput(input) {
@@ -5778,9 +6291,9 @@ async function buildTurnInput(request) {
   }
   const normalizedImages = await normalizeImages(request.images);
   const tempImagePaths = await saveNormalizedImagesToTempFiles(normalizedImages);
-  input.push(...tempImagePaths.map((path5) => ({
+  input.push(...tempImagePaths.map((path6) => ({
     type: "localImage",
-    path: path5
+    path: path6
   })));
   return { input, tempImagePaths };
 }
@@ -5869,19 +6382,19 @@ var TranscriptUpdateCoalescer = class {
 };
 
 // src/services/chat/history-paths.ts
-import { homedir as homedir11 } from "os";
-import { join as join16 } from "path";
-var ENGINE_DIR2 = join16(homedir11(), ".replicas", "engine");
-var CHATS_FILE = join16(ENGINE_DIR2, "chats.json");
-var CLAUDE_HISTORY_DIR = join16(ENGINE_DIR2, "claude-histories");
-var RELAY_HISTORY_DIR = join16(ENGINE_DIR2, "relay-histories");
-var CODEX_HISTORY_DIR = join16(ENGINE_DIR2, "codex-histories");
-var CURSOR_HISTORY_DIR = join16(ENGINE_DIR2, "cursor-histories");
-var OPENCODE_HISTORY_DIR = join16(ENGINE_DIR2, "opencode-histories");
-var PI_HISTORY_DIR = join16(ENGINE_DIR2, "pi-histories");
-var DEEPSEEK_HISTORY_DIR = join16(ENGINE_DIR2, "deepseek-histories");
-var FX_HISTORY_DIR = join16(ENGINE_DIR2, "fx-histories");
-var KIMI_HISTORY_DIR = join16(ENGINE_DIR2, "kimi-histories");
+import { homedir as homedir13 } from "os";
+import { join as join18 } from "path";
+var ENGINE_DIR2 = join18(homedir13(), ".replicas", "engine");
+var CHATS_FILE = join18(ENGINE_DIR2, "chats.json");
+var CLAUDE_HISTORY_DIR = join18(ENGINE_DIR2, "claude-histories");
+var RELAY_HISTORY_DIR = join18(ENGINE_DIR2, "relay-histories");
+var CODEX_HISTORY_DIR = join18(ENGINE_DIR2, "codex-histories");
+var CURSOR_HISTORY_DIR = join18(ENGINE_DIR2, "cursor-histories");
+var OPENCODE_HISTORY_DIR = join18(ENGINE_DIR2, "opencode-histories");
+var PI_HISTORY_DIR = join18(ENGINE_DIR2, "pi-histories");
+var DEEPSEEK_HISTORY_DIR = join18(ENGINE_DIR2, "deepseek-histories");
+var FX_HISTORY_DIR = join18(ENGINE_DIR2, "fx-histories");
+var KIMI_HISTORY_DIR = join18(ENGINE_DIR2, "kimi-histories");
 var HISTORY_DIR_BY_PROVIDER = {
   claude: CLAUDE_HISTORY_DIR,
   relay: RELAY_HISTORY_DIR,
@@ -5940,7 +6453,7 @@ async function readCodexAspThreadHistory(threadId) {
   }
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".jsonl") || entry.name.endsWith(".pages.jsonl")) continue;
-    const history = await new CodexHistoryFile(join17(CODEX_HISTORY_DIR, entry.name)).load();
+    const history = await new CodexHistoryFile(join19(CODEX_HISTORY_DIR, entry.name)).load();
     const transcript = history.transcriptsByThreadId.get(threadId);
     if (transcript) {
       return {
@@ -7291,7 +7804,7 @@ var CodexAspManager = class extends CodingAgentManager {
 
 // src/managers/cursor-manager.ts
 import { mkdir as mkdir11, readFile as readFile10, readdir as readdir5 } from "fs/promises";
-import { basename, dirname as dirname5, extname, join as join18 } from "path";
+import { basename, dirname as dirname5, extname, join as join20 } from "path";
 import { parse as parseYaml } from "yaml";
 import { Agent as CursorAgent } from "@cursor/sdk";
 var CURSOR_SLASH_COMMANDS_CACHE_MS = 3e4;
@@ -7364,7 +7877,7 @@ async function listCursorCommandsInDirectory(directory) {
     const name = basename(entry.name, ".md");
     let description;
     try {
-      description = extractCursorCommandDescription(await readFile10(join18(directory, entry.name), "utf8"));
+      description = extractCursorCommandDescription(await readFile10(join20(directory, entry.name), "utf8"));
     } catch (error) {
       console.warn("[CursorManager] Failed to read slash command file:", error);
     }
@@ -7388,7 +7901,7 @@ var CursorManager = class extends CodingAgentManager {
   slashCommandsRequest = null;
   constructor(options) {
     super(options);
-    this.historyFilePath = options.historyFilePath ?? join18(ENGINE_ENV.HOME_DIR, ".replicas", "cursor", "history.jsonl");
+    this.historyFilePath = options.historyFilePath ?? join20(ENGINE_ENV.HOME_DIR, ".replicas", "cursor", "history.jsonl");
     this.historyFile = new CodexHistoryFile(this.historyFilePath);
     this.initializeManager(this.processMessageInternal.bind(this));
   }
@@ -7462,7 +7975,7 @@ var CursorManager = class extends CodingAgentManager {
     this.slashCommandsRequest ??= (async () => {
       try {
         const repoDirectories = await getAgentAdditionalDirectories();
-        const commandDirectories = [this.workingDirectory, ...repoDirectories, ENGINE_ENV.HOME_DIR].map((directory) => join18(directory, ".cursor", "commands"));
+        const commandDirectories = [this.workingDirectory, ...repoDirectories, ENGINE_ENV.HOME_DIR].map((directory) => join20(directory, ".cursor", "commands"));
         const commands = mergeSlashCommands(
           ...await Promise.all(commandDirectories.map(listCursorCommandsInDirectory))
         );
@@ -7780,7 +8293,7 @@ ${instructions}
 import { spawn as spawn3 } from "child_process";
 import { randomUUID as randomUUID5 } from "crypto";
 import { createRequire } from "module";
-import { dirname as dirname6, join as join19 } from "path";
+import { dirname as dirname6, join as join21 } from "path";
 import { fileURLToPath } from "url";
 import { existsSync as existsSync6 } from "fs";
 import { mkdir as mkdir12 } from "fs/promises";
@@ -7795,11 +8308,11 @@ var questionSelectionSchema = z2.record(z2.string(), z2.object({
   custom: z2.string().optional()
 }));
 var require2 = createRequire(import.meta.url);
-var DSH_BIN = join19(dirname6(require2.resolve("@deepseek-ai/dsh/package.json")), "lib", "bin.js");
+var DSH_BIN = join21(dirname6(require2.resolve("@deepseek-ai/dsh/package.json")), "lib", "bin.js");
 var MANAGER_DIR = dirname6(fileURLToPath(import.meta.url));
 var DSH_PATCH = [
-  join19(MANAGER_DIR, "..", "..", "scripts", "deepseek", "replicas.cordis.patch.yml"),
-  join19(MANAGER_DIR, "..", "..", "..", "scripts", "deepseek", "replicas.cordis.patch.yml")
+  join21(MANAGER_DIR, "..", "..", "scripts", "deepseek", "replicas.cordis.patch.yml"),
+  join21(MANAGER_DIR, "..", "..", "..", "scripts", "deepseek", "replicas.cordis.patch.yml")
 ].find(existsSync6) ?? "";
 var DeepseekApiClient = class extends AbstractApiClient {
   constructor(baseUrl) {
@@ -7839,8 +8352,8 @@ var DeepseekApiClient = class extends AbstractApiClient {
     if (!execution.success) throw new Error(`DeepSeek Harness did not recognize ${line}.`);
     if (execution.data.result.kind === "error") throw new Error(execution.data.result.text ?? `DeepSeek Harness rejected ${line}.`);
   }
-  async *readWebSocket(path5, signal, schema, onOpen) {
-    const url = new URL(path5, this.baseUrl);
+  async *readWebSocket(path6, signal, schema, onOpen) {
+    const url = new URL(path6, this.baseUrl);
     url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
     const socket = new WebSocket(url);
     const inbox = [];
@@ -7913,7 +8426,7 @@ var DeepseekManager = class extends CodingAgentManager {
   constructor(options) {
     super(options);
     this.sessionId = options.initialSessionId ? sessionIdSchema.parse(options.initialSessionId) : null;
-    this.historyFilePath = options.historyFilePath ?? join19(ENGINE_ENV.HOME_DIR, ".replicas", "deepseek", "history.jsonl");
+    this.historyFilePath = options.historyFilePath ?? join21(ENGINE_ENV.HOME_DIR, ".replicas", "deepseek", "history.jsonl");
     this.historyFile = new CodexHistoryFile(this.historyFilePath);
     this.initializeManager(this.processMessageInternal.bind(this));
   }
@@ -8000,7 +8513,7 @@ var DeepseekManager = class extends CodingAgentManager {
         ...process.env,
         DEEPSEEK_API_KEY: apiKey,
         DEEPSEEK_BASE_URL: "https://openrouter.ai/api/v1",
-        DSH_HOME: join19(ENGINE_ENV.HOME_DIR, ".replicas", "deepseek"),
+        DSH_HOME: join21(ENGINE_ENV.HOME_DIR, ".replicas", "deepseek"),
         DSH_PERMISSION_MODE: "danger-full-access",
         DSH_TELEMETRY_DISABLED: "true"
       },
@@ -8710,7 +9223,7 @@ var KimiManager = class extends AcpManager {
 // src/managers/opencode-manager.ts
 import { existsSync as existsSync7 } from "fs";
 import { mkdir as mkdir14, readFile as readFile13 } from "fs/promises";
-import { delimiter, dirname as dirname8, join as join20 } from "path";
+import { delimiter, dirname as dirname8, join as join22 } from "path";
 import { randomBytes as randomBytes2 } from "crypto";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { Agent } from "undici";
@@ -8757,7 +9270,7 @@ async function getAllowedOpenRouterModels() {
 
 // src/managers/opencode-manager.ts
 var OPENCODE_SHIM_DIR = dirname8(fileURLToPath2(new URL("../../scripts/opencode", import.meta.url)));
-var OPENCODE_CONFIG_PATH = join20(ENGINE_ENV.HOME_DIR, ".config", "opencode", "opencode.json");
+var OPENCODE_CONFIG_PATH = join22(ENGINE_ENV.HOME_DIR, ".config", "opencode", "opencode.json");
 var OPENCODE_FETCH_DISPATCHER = new Agent({ headersTimeout: 0, bodyTimeout: 0 });
 var OPENCODE_SERVER_STARTUP_TIMEOUT_MS = 3e4;
 var OPENCODE_WORKSPACE_PERMISSION = {
@@ -9007,7 +9520,7 @@ var OpencodeManager = class extends CodingAgentManager {
   constructor(options) {
     super(options);
     this.sessionId = options.initialSessionId;
-    this.historyFilePath = options.historyFilePath ?? join20(ENGINE_ENV.HOME_DIR, ".replicas", "opencode", "history.jsonl");
+    this.historyFilePath = options.historyFilePath ?? join22(ENGINE_ENV.HOME_DIR, ".replicas", "opencode", "history.jsonl");
     this.historyFile = new CodexHistoryFile(this.historyFilePath);
     this.initializeManager(this.processMessageInternal.bind(this));
   }
@@ -9517,7 +10030,7 @@ var OpencodeManager = class extends CodingAgentManager {
 
 // src/managers/pi-manager.ts
 import { mkdir as mkdir15 } from "fs/promises";
-import { dirname as dirname9, join as join21 } from "path";
+import { dirname as dirname9, join as join23 } from "path";
 import {
   AuthStorage,
   createAgentSession,
@@ -9600,7 +10113,7 @@ var PiManager = class extends CodingAgentManager {
   providerApiKey = null;
   constructor(options) {
     super(options);
-    this.historyFilePath = options.historyFilePath ?? join21(PI_HISTORY_DIR, `${Date.now()}.jsonl`);
+    this.historyFilePath = options.historyFilePath ?? join23(PI_HISTORY_DIR, `${Date.now()}.jsonl`);
     this.historyFile = new CodexHistoryFile(this.historyFilePath);
     this.initializeManager(this.processMessageInternal.bind(this));
   }
@@ -9700,7 +10213,7 @@ var PiManager = class extends CodingAgentManager {
     const sessionManager = this.initialSessionId ? SessionManager.open(this.initialSessionId, PI_HISTORY_DIR, this.workingDirectory) : SessionManager.create(this.workingDirectory, PI_HISTORY_DIR);
     const resourceLoader = new DefaultResourceLoader({
       cwd: this.workingDirectory,
-      agentDir: join21(ENGINE_ENV.HOME_DIR, ".pi", "agent"),
+      agentDir: join23(ENGINE_ENV.HOME_DIR, ".pi", "agent"),
       extensionFactories: [registerCommandProtection(
         this.workingDirectory,
         this.historyFile,
@@ -9800,9 +10313,9 @@ function extractTextBlocks(content, textBlockType, separator = "\n") {
   const texts = content.map((block) => block && typeof block === "object" && "type" in block && block.type === textBlockType && "text" in block && typeof block.text === "string" ? block.text : "").filter(Boolean);
   return texts.length > 0 ? texts.join(separator) : null;
 }
-async function engineFetch(path5, options) {
+async function engineFetch(path6, options) {
   const baseUrl = `http://localhost:${ENGINE_ENV.REPLICAS_ENGINE_PORT}`;
-  return fetch(`${baseUrl}${path5}`, {
+  return fetch(`${baseUrl}${path6}`, {
     ...options,
     headers: {
       "Content-Type": "application/json",
@@ -10422,7 +10935,7 @@ import {
   rename as rename2,
   unlink as unlink3
 } from "fs/promises";
-import { join as join22 } from "path";
+import { join as join24 } from "path";
 import { randomUUID as randomUUID7 } from "crypto";
 
 // src/analytics/agent/activity/skill-mcp-call-extractor.ts
@@ -10473,7 +10986,7 @@ var AgentChatActivityBuffer = class {
       options.storageName,
       ...options.legacyStorageNames ?? []
     ];
-    this.liveFile = join22(ENGINE_DIR2, `${options.storageName}.jsonl`);
+    this.liveFile = join24(ENGINE_DIR2, `${options.storageName}.jsonl`);
     this.segmentFilePatterns = this.storageNames.map(
       (storageName) => new RegExp(`^${storageName}\\.(\\d+)\\.jsonl$`)
     );
@@ -10532,8 +11045,8 @@ var AgentChatActivityBuffer = class {
       await Promise.allSettled([...this.pendingAppends]);
     for (const storageName of this.storageNames) {
       await rename2(
-        join22(ENGINE_DIR2, `${storageName}.jsonl`),
-        join22(ENGINE_DIR2, `${storageName}.${Date.now()}.jsonl`)
+        join24(ENGINE_DIR2, `${storageName}.jsonl`),
+        join24(ENGINE_DIR2, `${storageName}.${Date.now()}.jsonl`)
       ).catch(() => {
       });
     }
@@ -10544,7 +11057,7 @@ var AgentChatActivityBuffer = class {
       if (!this.segmentFilePatterns.some((pattern) => pattern.test(entry)))
         continue;
       try {
-        await this.uploadSegment(join22(ENGINE_DIR2, entry));
+        await this.uploadSegment(join24(ENGINE_DIR2, entry));
         flushed++;
       } catch (error) {
         failed++;
@@ -10576,7 +11089,7 @@ var AgentChatActivityBuffer = class {
       ) && entry.endsWith(UPLOADED_SUFFIX)
     ).sort();
     for (const entry of uploaded.slice(0, -MAX_UPLOADED_SEGMENTS)) {
-      await unlink3(join22(ENGINE_DIR2, entry)).catch(() => {
+      await unlink3(join24(ENGINE_DIR2, entry)).catch(() => {
       });
     }
     return { flushed, failed };
@@ -10808,18 +11321,18 @@ var keepAliveService = new KeepAliveService();
 
 // src/services/canvas-service.ts
 import { readdir as readdir7, readFile as readFile15, stat as stat3 } from "fs/promises";
-import { homedir as homedir12 } from "os";
-import { join as join23 } from "path";
+import { homedir as homedir14 } from "os";
+import { join as join25 } from "path";
 var GLOBAL_CANVAS_DIRECTORIES = [
-  join23(homedir12(), ".claude", "plans"),
-  join23(process.env.XDG_DATA_HOME ?? join23(homedir12(), ".local", "share"), "opencode", "plans"),
-  join23(homedir12(), ".replicas", "canvas")
+  join25(homedir14(), ".claude", "plans"),
+  join25(process.env.XDG_DATA_HOME ?? join25(homedir14(), ".local", "share"), "opencode", "plans"),
+  join25(homedir14(), ".replicas", "canvas")
 ];
 async function canvasDirectories() {
   const repositories = await gitService.listRepositories().catch(() => []);
   return [
     ...GLOBAL_CANVAS_DIRECTORIES,
-    ...repositories.map((repository) => join23(repository.path, ".opencode", "plans"))
+    ...repositories.map((repository) => join25(repository.path, ".opencode", "plans"))
   ];
 }
 var CanvasService = class {
@@ -10843,7 +11356,7 @@ var CanvasService = class {
         for (const entry of entries) {
           if (entry.name.startsWith(".")) continue;
           const filename = current.relativePath ? `${current.relativePath}/${entry.name}` : entry.name;
-          const filePath = join23(current.directory, entry.name);
+          const filePath = join25(current.directory, entry.name);
           if (entry.isDirectory()) {
             pending.push({ directory: filePath, relativePath: filename });
             continue;
@@ -10868,7 +11381,7 @@ var CanvasService = class {
     if (!safe) return null;
     const { kind, mimeType } = classifyCanvasFilename(safe);
     for (const directory of await this.directories()) {
-      const filePath = join23(directory, safe);
+      const filePath = join25(directory, safe);
       let sizeBytes = 0;
       let updatedAt = "";
       try {
@@ -11040,13 +11553,13 @@ async function reconcileCanvasItems(filenames) {
 import { createReadStream } from "fs";
 import { createHash as createHash2 } from "crypto";
 import { readFile as readFile16, readdir as readdir8, stat as stat4 } from "fs/promises";
-import { basename as basename2, join as join25 } from "path";
+import { basename as basename2, join as join27 } from "path";
 
 // src/services/chat/chat-senders.ts
-import { join as join24 } from "path";
-var CHAT_SENDERS_DIR = join24(ENGINE_DIR2, "chat-senders");
+import { join as join26 } from "path";
+var CHAT_SENDERS_DIR = join26(ENGINE_DIR2, "chat-senders");
 function chatMessageSendersFilePath(chatId) {
-  return join24(CHAT_SENDERS_DIR, `${chatId}.jsonl`);
+  return join26(CHAT_SENDERS_DIR, `${chatId}.jsonl`);
 }
 function parseChatMessageSendersJsonl(content) {
   return content.split("\n").flatMap((line) => {
@@ -11062,9 +11575,9 @@ function parseChatMessageSendersJsonl(content) {
 
 // src/services/upload-chat-transcripts.ts
 var HISTORY_DIRS = [
-  join25(ENGINE_DIR2, "claude-histories"),
-  join25(ENGINE_DIR2, "relay-histories"),
-  join25(ENGINE_DIR2, "codex-histories")
+  join27(ENGINE_DIR2, "claude-histories"),
+  join27(ENGINE_DIR2, "relay-histories"),
+  join27(ENGINE_DIR2, "codex-histories")
 ];
 async function flushAllChatTranscripts(chatsById = /* @__PURE__ */ new Map(), capture) {
   let flushed = 0;
@@ -11082,7 +11595,7 @@ async function flushAllChatTranscripts(chatsById = /* @__PURE__ */ new Map(), ca
       if (!entry.endsWith(".jsonl")) continue;
       const chatId = basename2(entry, ".jsonl");
       tasks.push(
-        uploadChatTranscript(chatId, join25(dir, entry), chatsById.get(chatId), capture).then((artifact) => {
+        uploadChatTranscript(chatId, join27(dir, entry), chatsById.get(chatId), capture).then((artifact) => {
           flushed++;
           if (artifact && capture) revisions.push(artifact);
         }).catch((err) => {
@@ -11200,7 +11713,7 @@ async function flushRepoState() {
 // src/services/upload-engine-logs.ts
 import { createReadStream as createReadStream2 } from "fs";
 import { readdir as readdir9, stat as stat5 } from "fs/promises";
-import { join as join26 } from "path";
+import { join as join28 } from "path";
 var MAX_ENGINE_LOG_FLUSH_SESSIONS = 10;
 var MAX_ENGINE_LOG_FLUSH_BYTES = 5 * 1024 * 1024;
 var ENGINE_LOG_FLUSH_TIMEOUT_MS = 2e4;
@@ -11229,7 +11742,7 @@ async function flushAllEngineLogs() {
   const candidates = (await Promise.all(filenames.slice(0, MAX_ENGINE_LOG_FLUSH_SESSIONS).map(async (filename) => {
     try {
       const sessionId = filename.slice(0, -".log".length);
-      const filePath = join26(LOG_DIR, filename);
+      const filePath = join28(LOG_DIR, filename);
       const fileStat = await runBeforeDeadline(() => stat5(filePath), deadline);
       if (!fileStat.isFile()) {
         skipped++;
@@ -11850,12 +12363,12 @@ var ChatService = class {
     return descendants;
   }
   async deleteHistoryFile(persisted) {
-    const historyPath = join27(HISTORY_DIR_BY_PROVIDER[persisted.provider], `${persisted.id}.jsonl`);
+    const historyPath = join29(HISTORY_DIR_BY_PROVIDER[persisted.provider], `${persisted.id}.jsonl`);
     await Promise.all([
       historyPath,
       `${historyPath}.pages.jsonl`,
       `${historyPath}.pages.index.json`
-    ].map((path5) => rm2(path5, { force: true })));
+    ].map((path6) => rm2(path6, { force: true })));
     await rm2(chatMessageSendersFilePath(persisted.id), { force: true });
   }
   async getChatHistory(chatId, page = {}) {
@@ -11973,7 +12486,7 @@ var ChatService = class {
     if (persisted.provider === "claude") {
       provider = new ClaudeManager({
         workingDirectory: this.workingDirectory,
-        historyFilePath: join27(CLAUDE_HISTORY_DIR, `${persisted.id}.jsonl`),
+        historyFilePath: join29(CLAUDE_HISTORY_DIR, `${persisted.id}.jsonl`),
         initialSessionId: persisted.providerSessionId,
         onSaveSessionId: saveSession,
         onTurnComplete: onProviderTurnComplete,
@@ -11992,7 +12505,7 @@ var ChatService = class {
       });
       provider = new RelayManager({
         workingDirectory: this.workingDirectory,
-        historyFilePath: join27(RELAY_HISTORY_DIR, `${persisted.id}.jsonl`),
+        historyFilePath: join29(RELAY_HISTORY_DIR, `${persisted.id}.jsonl`),
         initialSessionId: persisted.providerSessionId,
         onSaveSessionId: saveSession,
         onTurnComplete: onProviderTurnComplete,
@@ -12005,7 +12518,7 @@ var ChatService = class {
     } else if (persisted.provider === "cursor") {
       provider = new CursorManager({
         workingDirectory: this.workingDirectory,
-        historyFilePath: join27(CURSOR_HISTORY_DIR, `${persisted.id}.jsonl`),
+        historyFilePath: join29(CURSOR_HISTORY_DIR, `${persisted.id}.jsonl`),
         initialSessionId: persisted.providerSessionId,
         onSaveSessionId: saveSession,
         onTurnComplete: onProviderTurnComplete,
@@ -12015,7 +12528,7 @@ var ChatService = class {
     } else if (persisted.provider === "deepseek") {
       provider = new DeepseekManager({
         workingDirectory: this.workingDirectory,
-        historyFilePath: join27(DEEPSEEK_HISTORY_DIR, `${persisted.id}.jsonl`),
+        historyFilePath: join29(DEEPSEEK_HISTORY_DIR, `${persisted.id}.jsonl`),
         initialSessionId: persisted.providerSessionId,
         onSaveSessionId: saveSession,
         onTurnComplete: onProviderTurnComplete,
@@ -12025,7 +12538,7 @@ var ChatService = class {
     } else if (persisted.provider === "fx") {
       provider = new FxManager({
         workingDirectory: this.workingDirectory,
-        historyFilePath: join27(FX_HISTORY_DIR, `${persisted.id}.jsonl`),
+        historyFilePath: join29(FX_HISTORY_DIR, `${persisted.id}.jsonl`),
         initialSessionId: persisted.providerSessionId,
         onSaveSessionId: saveSession,
         onTurnComplete: onProviderTurnComplete,
@@ -12035,7 +12548,7 @@ var ChatService = class {
     } else if (persisted.provider === "kimi") {
       provider = new KimiManager({
         workingDirectory: this.workingDirectory,
-        historyFilePath: join27(KIMI_HISTORY_DIR, `${persisted.id}.jsonl`),
+        historyFilePath: join29(KIMI_HISTORY_DIR, `${persisted.id}.jsonl`),
         initialSessionId: persisted.providerSessionId,
         onSaveSessionId: saveSession,
         onTurnComplete: onProviderTurnComplete,
@@ -12045,7 +12558,7 @@ var ChatService = class {
     } else if (persisted.provider === "opencode") {
       provider = new OpencodeManager({
         workingDirectory: this.workingDirectory,
-        historyFilePath: join27(OPENCODE_HISTORY_DIR, `${persisted.id}.jsonl`),
+        historyFilePath: join29(OPENCODE_HISTORY_DIR, `${persisted.id}.jsonl`),
         initialSessionId: persisted.providerSessionId,
         onSaveSessionId: saveSession,
         onTurnComplete: onProviderTurnComplete,
@@ -12055,7 +12568,7 @@ var ChatService = class {
     } else if (persisted.provider === "pi") {
       provider = new PiManager({
         workingDirectory: this.workingDirectory,
-        historyFilePath: join27(PI_HISTORY_DIR, `${persisted.id}.jsonl`),
+        historyFilePath: join29(PI_HISTORY_DIR, `${persisted.id}.jsonl`),
         initialSessionId: persisted.providerSessionId,
         onSaveSessionId: saveSession,
         onTurnComplete: onProviderTurnComplete,
@@ -12065,7 +12578,7 @@ var ChatService = class {
     } else {
       provider = new CodexAspManager({
         workingDirectory: this.workingDirectory,
-        historyFilePath: join27(CODEX_HISTORY_DIR, `${persisted.id}.jsonl`),
+        historyFilePath: join29(CODEX_HISTORY_DIR, `${persisted.id}.jsonl`),
         initialSessionId: persisted.providerSessionId,
         onSaveSessionId: saveSession,
         onTurnComplete: onProviderTurnComplete,
@@ -12231,7 +12744,7 @@ var ChatService = class {
     });
     uploadChatTranscript(
       chatId,
-      join27(HISTORY_DIR_BY_PROVIDER[chat.persisted.provider], `${chatId}.jsonl`),
+      join29(HISTORY_DIR_BY_PROVIDER[chat.persisted.provider], `${chatId}.jsonl`),
       this.toSummary(chat)
     ).catch((err) => {
       console.error("[ChatService] Failed to upload chat transcript:", { chatId, err });
@@ -12369,7 +12882,7 @@ var ChatService = class {
 // src/services/repo-file-service.ts
 import { execFile } from "child_process";
 import { readFile as readFile18, realpath, stat as stat6 } from "fs/promises";
-import { join as join28, resolve as resolve2, extname as extname2 } from "path";
+import { join as join30, resolve as resolve2, extname as extname2 } from "path";
 var CACHE_TTL_MS = 3e4;
 var SEARCH_TIMEOUT_MS = 15e3;
 var MAX_CONTENT_BYTES = 256 * 1024;
@@ -12521,7 +13034,7 @@ var RepoFileService = class {
     const repo = repos.find((r) => r.name === repoName);
     if (!repo) return null;
     try {
-      const fullPath = await realpath(resolve2(join28(repo.path, filePath)));
+      const fullPath = await realpath(resolve2(join30(repo.path, filePath)));
       const repoRoot = await realpath(repo.path);
       const repoPrefix = repoRoot.endsWith("/") ? repoRoot : repoRoot + "/";
       if (!fullPath.startsWith(repoPrefix) && fullPath !== repoRoot) return null;
@@ -12656,20 +13169,20 @@ var RepoFileService = class {
 import { Hono } from "hono";
 import { z as z6 } from "zod";
 import { readdir as readdir11, stat as stat7, readFile as readFile21 } from "fs/promises";
-import { join as join31, resolve as resolve3 } from "path";
+import { join as join33, resolve as resolve3 } from "path";
 
 // src/services/warm-hooks-service.ts
 import { spawn as spawn6 } from "child_process";
 import { readFile as readFile20 } from "fs/promises";
 import { existsSync as existsSync9 } from "fs";
-import { join as join30 } from "path";
+import { join as join32 } from "path";
 
 // src/services/warm-hook-logs-service.ts
 import { mkdir as mkdir18, readFile as readFile19, writeFile as writeFile7, readdir as readdir10, appendFile as appendFile5, unlink as unlink4 } from "fs/promises";
-import { homedir as homedir13 } from "os";
-import { join as join29 } from "path";
-var LOGS_DIR2 = join29(homedir13(), ".replicas", "warm-hook-logs");
-var CURRENT_RUN_LOG = join29(LOGS_DIR2, "current-run.log");
+import { homedir as homedir15 } from "os";
+import { join as join31 } from "path";
+var LOGS_DIR2 = join31(homedir15(), ".replicas", "warm-hook-logs");
+var CURRENT_RUN_LOG = join31(LOGS_DIR2, "current-run.log");
 var GLOBAL_FILENAME = "global.json";
 function withPreview2(stored) {
   const preview = buildHookOutputPreview(stored.output);
@@ -12686,7 +13199,7 @@ var WarmHookLogsService = class {
       hookName: "organization",
       ...entry
     };
-    await writeFile7(join29(LOGS_DIR2, GLOBAL_FILENAME), `${JSON.stringify(log, null, 2)}
+    await writeFile7(join31(LOGS_DIR2, GLOBAL_FILENAME), `${JSON.stringify(log, null, 2)}
 `, "utf-8");
   }
   async saveEnvironmentHookLog(entry) {
@@ -12696,7 +13209,7 @@ var WarmHookLogsService = class {
       hookName: "environment",
       ...entry
     };
-    await writeFile7(join29(LOGS_DIR2, ENVIRONMENT_HOOK_LOG_FILENAME), `${JSON.stringify(log, null, 2)}
+    await writeFile7(join31(LOGS_DIR2, ENVIRONMENT_HOOK_LOG_FILENAME), `${JSON.stringify(log, null, 2)}
 `, "utf-8");
   }
   async saveRepoHookLog(repoName, entry) {
@@ -12706,7 +13219,7 @@ var WarmHookLogsService = class {
       hookName: repoName,
       ...entry
     };
-    await writeFile7(join29(LOGS_DIR2, repoHookLogFilename(repoName)), `${JSON.stringify(log, null, 2)}
+    await writeFile7(join31(LOGS_DIR2, repoHookLogFilename(repoName)), `${JSON.stringify(log, null, 2)}
 `, "utf-8");
   }
   async getAllLogs() {
@@ -12725,7 +13238,7 @@ var WarmHookLogsService = class {
         continue;
       }
       try {
-        const raw = await readFile19(join29(LOGS_DIR2, file), "utf-8");
+        const raw = await readFile19(join31(LOGS_DIR2, file), "utf-8");
         const stored = JSON.parse(raw);
         logs.push(withPreview2(stored));
       } catch {
@@ -12763,7 +13276,7 @@ var WarmHookLogsService = class {
   async getFullOutput(hookType, hookName) {
     const filename = hookType === "global" ? GLOBAL_FILENAME : hookType === "environment" ? ENVIRONMENT_HOOK_LOG_FILENAME : repoHookLogFilename(hookName);
     try {
-      const raw = await readFile19(join29(LOGS_DIR2, filename), "utf-8");
+      const raw = await readFile19(join31(LOGS_DIR2, filename), "utf-8");
       const stored = JSON.parse(raw);
       if (stored.hookType !== hookType || stored.hookName !== hookName) {
         return null;
@@ -12782,7 +13295,7 @@ var warmHookLogsService = new WarmHookLogsService();
 // src/services/warm-hooks-service.ts
 async function readRepoWarmHook(repoPath) {
   for (const filename of REPLICAS_CONFIG_FILENAMES) {
-    const configPath = join30(repoPath, filename);
+    const configPath = join32(repoPath, filename);
     if (!existsSync9(configPath)) {
       continue;
     }
@@ -13594,11 +14107,11 @@ function createV1Routes(deps) {
   });
   app2.get("/repo-files/content", async (c) => {
     const repoName = c.req.query("repoName");
-    const path5 = c.req.query("path");
-    if (!repoName || !path5) {
+    const path6 = c.req.query("path");
+    if (!repoName || !path6) {
       return c.json(jsonError("repoName and path are required"), 400);
     }
-    const result = await deps.repoFileService.readFile(repoName, path5);
+    const result = await deps.repoFileService.readFile(repoName, path6);
     if (!result) {
       return c.json(jsonError("File not found"), 404);
     }
@@ -14037,7 +14550,7 @@ data: ${JSON.stringify("Terminal session not found")}
       const logFiles = files.filter((f) => f.endsWith(".log"));
       const sessions = await Promise.all(
         logFiles.map(async (filename) => {
-          const filePath = join31(LOG_DIR, filename);
+          const filePath = join33(LOG_DIR, filename);
           const fileStat = await stat7(filePath);
           const sessionId = filename.replace(/\.log$/, "");
           return {