replicas-engine 0.1.678 → 0.1.680

package/dist/src/{chunk-G2NKXO3H.js → chunk-3SEROT57.js}

@@ -1621,6 +1621,8 @@ replicas computer record stop
 replicas media upload /tmp/demo.mp4 --name "Demo recording"
 \`\`\`
 
+For any external destination, continue with the required delivery flow in \`MEDIA.md\`.
+
 ## Command reference
 
 ### \`replicas computer info\`
@@ -1755,7 +1757,7 @@ replicas computer record start /tmp/walkthrough.mp4
 replicas computer record stop
 replicas media upload /tmp/walkthrough.mp4 --name "Walkthrough recording"
 \`\`\`
-Then embed the printed \`![\u2026](\u2026)\` line in your chat reply. See \`MEDIA.md\`.
+Then embed the printed \`![\u2026](\u2026)\` line in your chat reply and follow \`MEDIA.md\` for any external destination.
 
 ## Failure modes
 
@@ -1955,16 +1957,9 @@ gh pr review 123 --approve
 gh pr review 123 --request-changes --body "Changes needed"
 \`\`\`
 
-## Image Uploads in PRs
+## Media in GitHub workflows
 
-GitHub does NOT have a public API for uploading images to PRs/issues. When you need to include images:
-- Do NOT use placeholder image URLs
-- Do NOT commit screenshots as files to the repository
-- Run \`replicas media upload <image> --name "<display name>" --share\` and put the printed \`Forge embed\` Markdown in the PR body or comment
-- For a self-contained HTML report, run \`replicas media upload <page.html> --name "<display name>" --access organization\` and put the printed \`Forge link\` Markdown in the PR body or comment. Organization members who are already signed in open it directly; others sign in and return to the page
-- For video, embed a shared poster image linked to the recording's **View in Replicas** URL; GitHub does not reliably render externally hosted video inline
-- Treat the public URL as an opt-in bearer capability; revoke it with \`replicas media revoke <media-id>\` only when the user asks or the media should stop rendering \u2014 revoking breaks embeds already posted on the PR
-- If you were triggered from Slack, also upload the image to the Slack thread so the user can see it directly
+Media delivery is owned by \`references/MEDIA.md\`. Read its GitHub section before adding screenshots, recordings, diagrams, or HTML reports to a pull request, issue, review comment, or commit; it covers the Replicas upload, GitHub's inline fallback, and the required **View in Replicas** link.
 `;
 var GITHUB_ABILITY = {
   label: "GitHub",
@@ -2026,7 +2021,7 @@ await replicas.gitlab.request('/projects/group%2Frepo/pipelines', {
 
 ## Descriptions and media
 
-API updates replace the entire merge request description, so always preserve the required Replicas footer and co-author trailers. For media, first run \`replicas media upload\` as documented in \`MEDIA.md\`; use GitLab's project uploads endpoint only when a native repository-protected embed is required.
+API updates replace the entire merge request description, so always preserve the required Replicas footer and co-author trailers. Media delivery is owned by \`references/MEDIA.md\`; read its GitLab section before adding media so the original bytes are uploaded to Replicas and GitLab and the dashboard link remains secondary.
 `;
 var GITLAB_ABILITY = {
   label: "GitLab",
@@ -2091,6 +2086,8 @@ await replicas.linear.graphql({
 \`\`\`
 
 Search with \`containsIgnoreCase: $query\` filters, for example on both \`title\` and \`description\`. Batch independent queries with \`Promise.all\` to save round trips.
+
+For screenshots, recordings, diagrams, or other media, read \`references/MEDIA.md\` before adding it to an issue or comment. It is the single source of truth for uploading the Replicas copy and the raw file to Linear; a dashboard link alone is not an inline attachment.
 `;
 var LINEAR_ABILITY = {
   label: "Linear",
@@ -2102,18 +2099,19 @@ var LINEAR_ABILITY = {
 
 // ../shared/src/default-skills/replicas-agent/abilities/media.ts
 var SECTION6 = `### Media
-Share screenshots, screen recordings, generated diagrams, audio clips, and self-contained HTML pages through Replicas and external messages.
+Deliver screenshots, screen recordings, generated diagrams, audio clips, and self-contained HTML pages to the Replicas dashboard and, when applicable, inline in the destination workflow.
 
 **Reference:** \`references/MEDIA.md\`
 
 Use this when:
+- You are about to run \`replicas media upload\`; this reference owns the complete Replicas-first, destination-second workflow
 - You produce a screenshot, recording, generated image, or audio clip the user should see
 - You produce a self-contained HTML report that should be linked from a pull request
 - You record video output (browser automation, screen capture) \u2014 including the recommended aspect ratio and FPS
-- You need to embed media in a Slack/Linear/GitHub message AND keep a referenceable copy in the Replicas dashboard`;
+- You need to embed media in a Slack/Linear/GitHub/GitLab message AND keep a referenceable copy in the Replicas dashboard`;
 var REFERENCE6 = `# Media (Screenshots, Recordings, Audio, HTML)
 
-This guide covers how to share screenshots, screen recordings, generated diagrams, audio clips, and self-contained HTML pages through Replicas and external surfaces (Slack, Linear, GitHub).
+This is the single source of truth for delivering screenshots, screen recordings, generated diagrams, audio clips, and self-contained HTML pages through Replicas and external surfaces (Slack, Linear, GitHub, GitLab).
 
 ## Prerequisites
 
@@ -2123,12 +2121,32 @@ The \`replicas\` CLI is pre-installed and authenticated in your workspace. No ad
 
 Upload to Replicas in these cases \u2014 and **only** these cases:
 
-1. **Media you produce.** Any screenshot, screen recording, generated diagram, or audio clip you create that the user might want to see. Upload before doing anything else with the file (analyzing, deleting, sending elsewhere). This applies even when you're also sending the file to Slack, Linear, GitHub, etc.
+1. **Media you produce.** Any screenshot, screen recording, generated diagram, audio clip, or HTML page you create that the user might want to see. Upload before doing anything else with the file (analyzing, deleting, sending elsewhere). This applies even when you're also sending the file to Slack, Linear, GitHub, or GitLab.
 2. **Files the user explicitly asks you to upload.** If the user sends or points at a file (image, video, audio, HTML) and asks you to upload it, run \`replicas media upload\`. Otherwise leave it alone \u2014 files in the workspace the user did not ask about should not be auto-uploaded as media.
-3. **Anything you plan to share externally (Slack, Linear, GitHub, etc.).** Upload to Replicas *in addition to* the platform's native upload. Never as a replacement.
+3. **Anything you plan to share externally (Slack, Linear, GitHub, GitLab, etc.).** Upload to Replicas *in addition to* the platform's destination upload. Never as a replacement.
 
 If none of these apply, don't upload.
 
+## Required delivery contract
+
+\`replicas media upload\` is always the first delivery action. When the current task has an external destination, every other delivery step follows only after that command succeeds. For every file:
+
+1. First, run \`replicas media upload\` with the original file. Do not begin any destination upload until the command succeeds. This creates the canonical dashboard copy and prints the authenticated chat embed plus a per-file dashboard link.
+2. Include the printed embed line in the Replicas chat reply, followed by the matching **View in Replicas** link. HTML uses its printed page link instead of an image embed.
+3. Identify every destination in the task and attempt to upload the same original bytes there. Use the destination's inline representation from the table below; do not replace the file with a Replicas link.
+4. Put the **View in Replicas** dashboard link next to the destination embed as a secondary link.
+5. Check each destination response. If a native upload is unavailable or fails, say so explicitly and keep the dashboard link; never claim that a link is an inline upload.
+
+| Destination | Required file delivery | Inline result |
+|---|---|---|
+| Replicas dashboard/chat | \`replicas media upload\` | Printed \`![\u2026](\u2026)\` line in chat |
+| Slack | \`files.getUploadURLExternal\` \u2192 raw-byte POST \u2192 \`files.completeUploadExternal\` | Uploaded file in the channel or thread |
+| Linear | \`fileUpload\` mutation \u2192 presigned upload \u2192 issue/comment mutation | Returned \`assetUrl\` in Markdown |
+| GitLab | Project \`/uploads\` endpoint with the original bytes | Returned GitLab Markdown |
+| GitHub | No supported attachment API; use a Replicas public forge share for the inline image or video poster | Printed Forge embed, linked to the recording when needed |
+
+The dashboard link is the subtitle and jump-back path. It is never a substitute for the destination upload.
+
 ## Uploading to Replicas
 
 \`\`\`bash
@@ -2185,7 +2203,7 @@ replicas media upload screenshot.png --name "Login page" --access public
 | \`https://api.tryreplicas.com/v1/media/<id>\` (inside \`![\u2026](\u2026)\`) | Authenticated API redirect to a presigned blob \u2014 requires the Replicas chat session | **Only** in the Replicas chat reply. Nowhere else. |
 | \`https://tryreplicas.com/organizations/<organization-id>/media/<media-id>\` | Organization-only page printed by \`--access organization\` | Pull requests and other places where every viewer belongs to the Replicas organization. |
 | \`https://api.tryreplicas.com/v1/media/public/<id>/<token>\` | Opt-in public bearer URL printed by \`--access public\` or \`--share\` | GitHub embeds for image, video, or audio media. |
-| \`https://tryreplicas.com/workspaces/<workspace-id>?media=<media-id>\` | Authenticated dashboard deep link that opens the media file in the workspace | Everywhere external \u2014 Slack, GitHub, Linear, PR bodies, comments, emails. |
+| \`https://tryreplicas.com/workspaces/<workspace-id>?media=<media-id>\` | Authenticated dashboard deep link that opens the media file in the workspace | Everywhere external: Slack, GitHub, GitLab, Linear, PR bodies, comments, emails. |
 
 ### NEVER link the API redirect URL outside the Replicas chat reply
 
@@ -2195,6 +2213,7 @@ This rule has no exceptions:
 - \u274C Never paste it in a Slack message \u2014 upload the actual bytes via the 3-step \`files.getUploadURLExternal\` \u2192 POST bytes \u2192 \`files.completeUploadExternal\` flow instead (see below).
 - \u274C Never paste it in a GitHub PR description, issue body, review comment, or commit message.
 - \u274C Never paste it in a Linear issue body or comment \u2014 upload via Linear's \`fileUpload\` mutation instead (see below).
+- \u274C Never paste it in a GitLab merge request or issue; upload the original bytes through GitLab's project upload endpoint instead (see below).
 - \u274C Never link to it from any external doc, email, or external chat.
 - \u274C Never include it as a "backup link" in case the dashboard link breaks \u2014 it will always break externally.
 
@@ -2218,16 +2237,16 @@ Include each markdown embed line **verbatim** where you want that file to render
 
 After (or alongside) the embeds, include a \`[View in Replicas](<deep-link>)\` hyperlink for each file using the per-file dashboard URL from the CLI. This lets the user open the specific item in the workspace.
 
-## On external platforms \u2014 upload natively AND link the dashboard
+## On external platforms: embed the file AND link the dashboard
 
-Sharing media externally is a **two-step requirement** for every file:
+After \`replicas media upload\` succeeds, external delivery has two required follow-up steps for every file:
 
-1. **Upload the raw bytes natively to that platform** so the recipient sees the media embedded inline in the message itself.
+1. **Upload the raw bytes through that platform's supported inline path** so the recipient sees the media embedded in the message itself.
 2. **Link the Replicas dashboard deep link** (\`?media=<id>\` form) so the user can jump straight to the file in the workspace.
 
-A link alone is not enough. A native upload alone is not enough. Do both.
+A link alone is not enough. An upload without the dashboard link is not enough. Do both.
 
-GitHub has no native upload API, so use an explicit Replicas public share for screenshots and recording previews. GitLab has a native upload API and should receive the original bytes.
+Slack, Linear, and GitLab receive the original bytes through their native upload APIs. GitHub has no supported attachment API, so use an explicit Replicas public share for screenshots and recording previews.
 
 ### Slack \u2014 embed natively via the 3-step external file upload flow
 
@@ -2358,7 +2377,7 @@ GitHub does not reliably render arbitrary external videos as inline players. For
 [![Demo recording](<public-poster-url>)](<recording-dashboard-url>)
 \`\`\`
 
-Public forge shares are bearer capabilities. For private repositories, create one only when the user asked for inline PR media. Revoke with \`replicas media revoke <media-id>\` **only** when the user asks or the media should intentionally stop rendering \u2014 never as routine post-task cleanup, since revoking breaks every embed already posted on the PR.
+Public forge shares are unauthenticated bearer capabilities. For private repositories, create one only when the user explicitly asked for inline PR media. Without that consent, keep the media private in Replicas and report that GitHub has no supported attachment API; do not publish a bearer share or pretend the dashboard link is an embed. Revoke with \`replicas media revoke <media-id>\` **only** when the user asks or the media should intentionally stop rendering; never as routine post-task cleanup, since revoking breaks every embed already posted on the PR.
 
 For a self-contained HTML report, upload it with \`--access organization\` and put the printed \`Forge link\` Markdown in the PR body or comment. GitHub cannot render the page inline, so use the normal link rather than image syntax. HTML pages cannot be shared publicly.
 
@@ -2366,7 +2385,7 @@ Do **not** commit screenshots to the repo, use placeholder URLs, expose the auth
 
 ### GitLab: native inline screenshots and videos
 
-GitLab supports native project Markdown uploads. Always upload the media to Replicas first, then POST the same original file to the repository's \`/projects/:id/uploads\` API using the workspace GitLab credential. Insert the returned \`markdown\` value into the merge request body or comment and include the Replicas dashboard link. Image uploads render inline; MP4, MOV, and WebM uploads render as inline video players.
+GitLab supports native project Markdown uploads. For a GitLab destination, always upload the media to Replicas first, then POST the same original file to the repository's \`/projects/:id/uploads\` API using the workspace GitLab credential. Insert the returned \`markdown\` value into the merge request body or comment and include the Replicas dashboard link. Image uploads render inline; MP4, MOV, and WebM uploads render as inline video players.
 
 Do not use a Replicas public forge share for GitLab when the native project upload succeeds; native uploads preserve project access controls.
 
@@ -2415,7 +2434,7 @@ replicas media upload chart-a.svg chart-b.svg --name "Latency chart" --name "Err
 `;
 var MEDIA_ABILITY = {
   label: "Media",
-  description: "Share screenshots, recordings, generated images, audio clips, and HTML pages.",
+  description: "Deliver media to Replicas and destination workflows with inline uploads.",
   bullet: "- Producing or showing the user any media \u2014 screenshots, screen recordings, generated images or diagrams, audio clips, or HTML recap pages \u2014 including in your Replicas chat reply, PR descriptions/comments, and other external platforms",
   section: SECTION6,
   referenceFile: { name: "MEDIA.md", content: REFERENCE6 }
@@ -2518,16 +2537,13 @@ Discover and execute installed marketplace tools through the workspace-scoped Ty
 **Reference:** \`references/PLUGINS.md\`
 
 Use this when:
-- The user asks for CRM data from Attio
-- The user asks to manage Calendly events, invitees, or scheduling links
-- The user asks to read or change Google Ads, Docs, Drive, Search Console, or Sheets data
-- The user asks for ClickHouse analytics or PostHog product data
+- The user asks to work with an installed productivity, data, engineering, or business plugin
+- The user asks to discover which external services are connected
 - The user asks to create or control an E2B sandbox
 - The user asks to invoke a connected Modal function
 - The user asks to query or update a connected turbopuffer namespace
 - The user asks for PlanetScale organizations, databases, branches, or Insights data
-- The user asks to analyze text with Pangram
-- The user asks for Stripe customers, payments, invoices, subscriptions, or balances`;
+- The user asks to analyze text with Pangram`;
 var REFERENCE8 = `# Plugins
 
 Plugins are TypeScript libraries, not MCP servers. Import \`@replicas/sdk\`; Replicas authenticates the workspace and selects the owner\u2019s personal connection first, then the most specific environment the workspace inherits from, then Global. Provider credentials, sessions, and project keys are never exposed.
@@ -2700,7 +2716,7 @@ In agent mode the CLI hides commands that don't make sense for in-workspace agen
 | \`replicas automation ...\` | Manage automations (cron + GitHub/GitLab event triggers) |
 | \`replicas preview ...\` | Register / list preview URLs (covered in \`PREVIEWS.md\`) |
 | \`replicas service ...\` | Run long-lived services detached so they survive workspace sleep/wake (see below) |
-| \`replicas media ...\` | Upload screenshots, videos, audio (covered in \`MEDIA.md\`) |
+| \`replicas media ...\` | Upload media to the dashboard and follow \`MEDIA.md\` for destination embedding |
 | \`replicas slack thread ...\` | Attach or switch Slack thread routing (covered in \`SLACK.md\`) |
 
 \`replicas <command> --help\` is always the source of truth for flags.
@@ -2994,6 +3010,8 @@ await replicas.slack.call('chat.postMessage', {
 
 Only the announcing message gets the button \u2014 follow-ups about a pull request already linked in the thread keep the link in the text and drop the \`blocks\`. Use "View MR" for GitLab. With several links, give each button a unique \`action_id\` and name its repository in the label ("View PR \xB7 web").
 
+For screenshots, recordings, diagrams, or other media, read \`references/MEDIA.md\` before posting. It is the single source of truth for uploading the Replicas copy and the raw file to Slack; a dashboard link in \`text\` is not an inline attachment.
+
 Attach every new top-level conversation so future replies route to this workspace. For a reply in another thread, attach its root \`thread_ts\`, not the reply timestamp. Do not attach the originating thread again.
 
 ## Search and batch
@@ -3514,6 +3532,282 @@ function findGitCommitSignals(request) {
   return findGitCommitCommands(command).length > 0 ? ["git-commit"] : [];
 }
 
+// ../shared/src/routes/plugin-catalog.ts
+var EXPLICIT_PLUGIN_CATALOG = [
+  {
+    id: "attio",
+    backend: "composio",
+    toolkit: "attio",
+    authType: "oauth",
+    category: "business",
+    name: "Attio",
+    description: "Manage CRM records, people, companies, lists, and notes."
+  },
+  {
+    id: "calendly",
+    backend: "composio",
+    toolkit: "calendly",
+    authType: "oauth",
+    category: "productivity",
+    name: "Calendly",
+    description: "Manage event types, scheduled events, invitees, and scheduling links."
+  },
+  {
+    id: "clickhouse",
+    backend: "composio",
+    toolkit: "clickhouse",
+    authType: "basic",
+    category: "data",
+    name: "ClickHouse",
+    description: "Manage databases, tables, schemas, and queries."
+  },
+  {
+    id: "cloudflare",
+    backend: "composio",
+    toolkit: "cloudflare_api_key",
+    authType: "api_key",
+    category: "data",
+    name: "Cloudflare",
+    description: "Manage zones, DNS records, analytics, and security settings."
+  },
+  {
+    id: "e2b",
+    toolkit: "e2b",
+    backend: "native",
+    authType: "api_key",
+    category: "data",
+    name: "E2B",
+    description: "Create secure cloud sandboxes and run commands in them."
+  },
+  {
+    id: "gmail",
+    backend: "composio",
+    toolkit: "gmail",
+    authType: "oauth",
+    category: "productivity",
+    name: "Gmail",
+    description: "Manage messages, threads, attachments, labels, and mailbox settings."
+  },
+  {
+    id: "googleads",
+    backend: "composio",
+    toolkit: "googleads",
+    authType: "oauth",
+    category: "data",
+    name: "Google Ads",
+    description: "Manage campaigns, customers, accounts, and reporting data."
+  },
+  {
+    id: "googledocs",
+    backend: "composio",
+    toolkit: "googledocs",
+    authType: "oauth",
+    category: "productivity",
+    name: "Google Docs",
+    description: "Manage documents, structure, comments, and exported content."
+  },
+  {
+    id: "googledrive",
+    backend: "composio",
+    toolkit: "googledrive",
+    authType: "oauth",
+    category: "productivity",
+    name: "Google Drive",
+    description: "Manage files, folders, metadata, permissions, and shared drives."
+  },
+  {
+    id: "googlesearch",
+    backend: "composio",
+    toolkit: "google_search_console",
+    authType: "oauth",
+    category: "data",
+    name: "Google Search",
+    description: "Manage Search Console performance, indexing, sites, and sitemaps."
+  },
+  {
+    id: "googlesheets",
+    backend: "composio",
+    toolkit: "googlesheets",
+    authType: "oauth",
+    category: "productivity",
+    name: "Google Sheets",
+    description: "Manage spreadsheets, worksheets, ranges, tables, and charts."
+  },
+  {
+    id: "linkedin",
+    backend: "composio",
+    toolkit: "linkedin",
+    authType: "oauth",
+    category: "business",
+    name: "LinkedIn",
+    description: "Manage profiles, organizations, posts, and professional activity."
+  },
+  {
+    id: "modal",
+    backend: "native",
+    toolkit: "modal",
+    authType: "basic",
+    category: "data",
+    name: "Modal",
+    description: "Invoke deployed functions through Modal compute."
+  },
+  {
+    id: "posthog",
+    backend: "composio",
+    toolkit: "posthog",
+    authType: "api_key",
+    category: "data",
+    name: "PostHog",
+    description: "Manage projects, events, insights, dashboards, flags, and recordings."
+  },
+  {
+    id: "planetscale",
+    toolkit: "planetscale",
+    backend: "native",
+    authType: "oauth",
+    category: "data",
+    name: "PlanetScale",
+    description: "Manage organizations, databases, branches, deploy requests, and Insights."
+  },
+  {
+    id: "stripe",
+    backend: "composio",
+    toolkit: "stripe",
+    authType: "oauth",
+    category: "business",
+    name: "Stripe",
+    description: "Manage customers, payments, invoices, subscriptions, and balances."
+  },
+  {
+    id: "pangram",
+    backend: "native",
+    toolkit: "pangram",
+    authType: "api_key",
+    category: "data",
+    name: "Pangram",
+    description: "Analyze text for AI generation and plagiarism signals."
+  },
+  {
+    id: "vercel",
+    backend: "composio",
+    toolkit: "vercel",
+    authType: "api_key",
+    category: "data",
+    name: "Vercel",
+    description: "Manage projects, deployments, logs, domains, and infrastructure."
+  },
+  {
+    id: "turbopuffer",
+    backend: "native",
+    toolkit: "turbopuffer",
+    authType: "api_key",
+    category: "data",
+    name: "turbopuffer",
+    description: "Query and manage turbopuffer namespaces."
+  }
+];
+var HOSTED_COMPOSIO_PLUGIN_DEFINITIONS = [
+  ["notion", "notion", "OAUTH2", true, "productivity", "Notion"],
+  ["jira", "jira", "OAUTH2", true, "productivity", "Jira"],
+  ["confluence", "confluence", "OAUTH2", true, "productivity", "Confluence"],
+  ["googlecalendar", "googlecalendar", "OAUTH2", true, "productivity", "Google Calendar"],
+  ["microsoftteams", "microsoft_teams", "OAUTH2", true, "productivity", "Microsoft Teams"],
+  ["outlook", "outlook", "OAUTH2", true, "productivity", "Outlook"],
+  ["bitbucket", "bitbucket", "OAUTH2", true, "data", "Bitbucket"],
+  ["datadog", "datadog", "API_KEY", false, "data", "Datadog"],
+  ["pagerduty", "pagerduty", "OAUTH2", true, "data", "PagerDuty"],
+  ["intercom", "intercom", "OAUTH2", true, "business", "Intercom"],
+  ["zendesk", "zendesk", "OAUTH2", true, "business", "Zendesk"],
+  ["hubspot", "hubspot", "OAUTH2", true, "business", "HubSpot"],
+  ["supabase", "supabase", "OAUTH2", true, "data", "Supabase"],
+  ["figma", "figma", "OAUTH2", true, "productivity", "Figma"],
+  ["launchdarkly", "launch_darkly", "API_KEY", false, "data", "LaunchDarkly"],
+  ["asana", "asana", "OAUTH2", true, "productivity", "Asana"],
+  ["clickup", "clickup", "OAUTH2", true, "productivity", "ClickUp"],
+  ["trello", "trello", "OAUTH1", true, "productivity", "Trello"],
+  ["todoist", "todoist", "OAUTH2", true, "productivity", "Todoist"],
+  ["airtable", "airtable", "OAUTH2", true, "productivity", "Airtable"],
+  ["coda", "coda", "API_KEY", false, "productivity", "Coda"],
+  ["miro", "miro", "OAUTH2", true, "productivity", "Miro"],
+  ["sharepoint", "share_point", "OAUTH2", true, "productivity", "SharePoint"],
+  ["onedrive", "one_drive", "OAUTH2", true, "productivity", "OneDrive"],
+  ["googleslides", "googleslides", "OAUTH2", true, "productivity", "Google Slides"],
+  ["googlemeet", "googlemeet", "OAUTH2", true, "productivity", "Google Meet"],
+  ["googletasks", "googletasks", "OAUTH2", true, "productivity", "Google Tasks"],
+  ["dropbox", "dropbox", "OAUTH2", true, "productivity", "Dropbox"],
+  ["box", "box", "OAUTH2", true, "productivity", "Box"],
+  ["discord", "discord", "OAUTH2", true, "productivity", "Discord"],
+  ["discordbot", "discordbot", "OAUTH2", true, "productivity", "Discord Bot"],
+  ["zoom", "zoom", "OAUTH2", true, "productivity", "Zoom"],
+  ["googlechat", "google_chat", "OAUTH2", false, "productivity", "Google Chat"],
+  ["newrelic", "new_relic", "API_KEY", false, "data", "New Relic"],
+  ["betterstack", "better_stack", "API_KEY", false, "data", "Better Stack"],
+  ["incidentio", "incident_io", "API_KEY", false, "data", "incident.io"],
+  ["grafana", "grafana", "BEARER_TOKEN", false, "data", "Grafana"],
+  ["honeycomb", "honeycomb_mcp", "DCR_OAUTH", false, "data", "Honeycomb MCP"],
+  ["bugsnag", "bugsnag", "API_KEY", false, "data", "Bugsnag"],
+  ["circleci", "circleci", "API_KEY", false, "data", "CircleCI"],
+  ["buildkite", "buildkite", "API_KEY", false, "data", "Buildkite"],
+  ["dockerhub", "docker_hub", "API_KEY", false, "data", "Docker Hub"],
+  ["digitalocean", "digital_ocean", "OAUTH2", true, "data", "DigitalOcean"],
+  ["railway", "railway", "API_KEY", false, "data", "Railway"],
+  ["render", "render", "API_KEY", false, "data", "Render"],
+  ["firebase", "firebase", "API_KEY", false, "data", "Firebase"],
+  ["cloudinary", "cloudinary", "API_KEY", false, "data", "Cloudinary"],
+  ["configcat", "configcat", "API_KEY", false, "data", "ConfigCat"],
+  ["googleanalytics", "google_analytics", "OAUTH2", true, "data", "Google Analytics"],
+  ["googlebigquery", "googlebigquery", "OAUTH2", true, "data", "Google BigQuery"],
+  ["amplitude", "amplitude", "API_KEY", false, "data", "Amplitude"],
+  ["mixpanel", "mixpanel", "BASIC", false, "data", "Mixpanel"],
+  ["segment", "segment", "API_KEY", false, "data", "Segment"],
+  ["databricks", "databricks", "API_KEY", false, "data", "Databricks"],
+  ["snowflake", "snowflake", "OAUTH2", false, "data", "Snowflake"],
+  ["algolia", "algolia", "API_KEY", false, "data", "Algolia"],
+  ["elasticsearch", "elasticsearch", "API_KEY", false, "data", "Elasticsearch"],
+  ["salesforce", "salesforce", "OAUTH2", true, "business", "Salesforce"],
+  ["pipedrive", "pipedrive", "API_KEY", false, "business", "Pipedrive"],
+  ["close", "close", "API_KEY", false, "business", "Close"],
+  ["apollo", "apollo", "API_KEY", false, "business", "Apollo"],
+  ["gong", "gong", "OAUTH2", true, "business", "Gong"],
+  ["freshdesk", "freshdesk", "API_KEY", false, "business", "Freshdesk"],
+  ["helpscout", "help_scout", "OAUTH2", false, "business", "Help Scout"],
+  ["servicenow", "servicenow", "BASIC", false, "business", "ServiceNow"],
+  ["mailchimp", "mailchimp", "OAUTH2", true, "business", "Mailchimp"],
+  ["customerio", "customerio", "API_KEY", false, "business", "Customer.io"],
+  ["klaviyo", "klaviyo", "API_KEY", false, "business", "Klaviyo"],
+  ["shopify", "shopify", "API_KEY", false, "business", "Shopify"],
+  ["quickbooks", "quickbooks", "OAUTH2", true, "business", "QuickBooks"],
+  ["xero", "xero", "OAUTH2", false, "business", "Xero"],
+  ["brex", "brex", "API_KEY", false, "business", "Brex"],
+  ["buffer", "buffer", "OAUTH2", false, "business", "Buffer"],
+  ["canva", "canva", "OAUTH2", true, "productivity", "Canva"],
+  ["webflow", "webflow", "API_KEY", false, "business", "Webflow"],
+  ["firecrawl", "firecrawl", "API_KEY", false, "data", "Firecrawl"],
+  ["browserbase", "browserbase_tool", "API_KEY", false, "data", "Browserbase"],
+  ["exa", "exa", "API_KEY", false, "data", "Exa"],
+  ["youtube", "youtube", "OAUTH2", true, "business", "YouTube"],
+  ["twitter", "twitter", "OAUTH2", false, "business", "Twitter/X"],
+  ["instagram", "instagram", "OAUTH2", true, "business", "Instagram"],
+  ["facebook", "facebook", "OAUTH2", true, "business", "Facebook"]
+];
+var HOSTED_COMPOSIO_PLUGINS = HOSTED_COMPOSIO_PLUGIN_DEFINITIONS.map(
+  ([id, toolkit, authScheme, managedAuth, category, name]) => ({
+    id,
+    backend: "composio",
+    toolkit,
+    authType: "hosted",
+    authScheme,
+    managedAuth,
+    category,
+    name,
+    description: `Use ${name} tools from workspace agents.`
+  })
+);
+var PLUGIN_CATALOG = [
+  ...EXPLICIT_PLUGIN_CATALOG,
+  ...HOSTED_COMPOSIO_PLUGINS
+];
+
 // ../shared/src/routes/user.ts
 var PROFILE_AVATAR_MAX_SIZE_BYTES = 5 * 1024 * 1024;
 
@@ -6404,7 +6698,7 @@ var DEFAULT_CODEX_ARGS = [
 var MIN_CODEX_CLI_VERSION = "0.144.6";
 var CODEX_UPGRADE_TIMEOUT_MS = 12e4;
 var codexCliVersionEnsured = null;
-var ENGINE_PACKAGE_VERSION = "0.1.678";
+var ENGINE_PACKAGE_VERSION = "0.1.680";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";

package/dist/src/headless-agent.js

@@ -7,7 +7,7 @@ import {
   headlessAgentRequestSchema,
   putPresignedFile,
   recoverCompletedTurn
-} from "./chunk-G2NKXO3H.js";
+} from "./chunk-3SEROT57.js";
 
 // src/headless-agent.ts
 import { createHash } from "crypto";

package/dist/src/index.js

@@ -190,7 +190,7 @@ import {
   serializeCanvasContentResponse,
   shellQuotePosix,
   stripAgentDiagnosticErrors
-} from "./chunk-G2NKXO3H.js";
+} from "./chunk-3SEROT57.js";
 
 // src/index.ts
 import { serve } from "@hono/node-server";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.678",
+  "version": "0.1.680",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",

package/workspace-sdk/shared/routes/plugin-catalog.d.ts

@@ -0,0 +1,166 @@
+// Generated from shared/src by generate-workspace-sdk-types.mjs; do not edit.
+export declare const HOSTED_PLUGIN_AUTH_SCHEMES: readonly ["API_KEY", "BASIC", "BEARER_TOKEN", "DCR_OAUTH", "OAUTH1", "OAUTH2"];
+export type HostedPluginAuthScheme = (typeof HOSTED_PLUGIN_AUTH_SCHEMES)[number];
+export declare const PLUGIN_CATALOG: readonly [{
+    readonly id: "attio";
+    readonly backend: "composio";
+    readonly toolkit: "attio";
+    readonly authType: "oauth";
+    readonly category: "business";
+    readonly name: "Attio";
+    readonly description: "Manage CRM records, people, companies, lists, and notes.";
+}, {
+    readonly id: "calendly";
+    readonly backend: "composio";
+    readonly toolkit: "calendly";
+    readonly authType: "oauth";
+    readonly category: "productivity";
+    readonly name: "Calendly";
+    readonly description: "Manage event types, scheduled events, invitees, and scheduling links.";
+}, {
+    readonly id: "clickhouse";
+    readonly backend: "composio";
+    readonly toolkit: "clickhouse";
+    readonly authType: "basic";
+    readonly category: "data";
+    readonly name: "ClickHouse";
+    readonly description: "Manage databases, tables, schemas, and queries.";
+}, {
+    readonly id: "cloudflare";
+    readonly backend: "composio";
+    readonly toolkit: "cloudflare_api_key";
+    readonly authType: "api_key";
+    readonly category: "data";
+    readonly name: "Cloudflare";
+    readonly description: "Manage zones, DNS records, analytics, and security settings.";
+}, {
+    readonly id: "e2b";
+    readonly toolkit: "e2b";
+    readonly backend: "native";
+    readonly authType: "api_key";
+    readonly category: "data";
+    readonly name: "E2B";
+    readonly description: "Create secure cloud sandboxes and run commands in them.";
+}, {
+    readonly id: "gmail";
+    readonly backend: "composio";
+    readonly toolkit: "gmail";
+    readonly authType: "oauth";
+    readonly category: "productivity";
+    readonly name: "Gmail";
+    readonly description: "Manage messages, threads, attachments, labels, and mailbox settings.";
+}, {
+    readonly id: "googleads";
+    readonly backend: "composio";
+    readonly toolkit: "googleads";
+    readonly authType: "oauth";
+    readonly category: "data";
+    readonly name: "Google Ads";
+    readonly description: "Manage campaigns, customers, accounts, and reporting data.";
+}, {
+    readonly id: "googledocs";
+    readonly backend: "composio";
+    readonly toolkit: "googledocs";
+    readonly authType: "oauth";
+    readonly category: "productivity";
+    readonly name: "Google Docs";
+    readonly description: "Manage documents, structure, comments, and exported content.";
+}, {
+    readonly id: "googledrive";
+    readonly backend: "composio";
+    readonly toolkit: "googledrive";
+    readonly authType: "oauth";
+    readonly category: "productivity";
+    readonly name: "Google Drive";
+    readonly description: "Manage files, folders, metadata, permissions, and shared drives.";
+}, {
+    readonly id: "googlesearch";
+    readonly backend: "composio";
+    readonly toolkit: "google_search_console";
+    readonly authType: "oauth";
+    readonly category: "data";
+    readonly name: "Google Search";
+    readonly description: "Manage Search Console performance, indexing, sites, and sitemaps.";
+}, {
+    readonly id: "googlesheets";
+    readonly backend: "composio";
+    readonly toolkit: "googlesheets";
+    readonly authType: "oauth";
+    readonly category: "productivity";
+    readonly name: "Google Sheets";
+    readonly description: "Manage spreadsheets, worksheets, ranges, tables, and charts.";
+}, {
+    readonly id: "linkedin";
+    readonly backend: "composio";
+    readonly toolkit: "linkedin";
+    readonly authType: "oauth";
+    readonly category: "business";
+    readonly name: "LinkedIn";
+    readonly description: "Manage profiles, organizations, posts, and professional activity.";
+}, {
+    readonly id: "modal";
+    readonly backend: "native";
+    readonly toolkit: "modal";
+    readonly authType: "basic";
+    readonly category: "data";
+    readonly name: "Modal";
+    readonly description: "Invoke deployed functions through Modal compute.";
+}, {
+    readonly id: "posthog";
+    readonly backend: "composio";
+    readonly toolkit: "posthog";
+    readonly authType: "api_key";
+    readonly category: "data";
+    readonly name: "PostHog";
+    readonly description: "Manage projects, events, insights, dashboards, flags, and recordings.";
+}, {
+    readonly id: "planetscale";
+    readonly toolkit: "planetscale";
+    readonly backend: "native";
+    readonly authType: "oauth";
+    readonly category: "data";
+    readonly name: "PlanetScale";
+    readonly description: "Manage organizations, databases, branches, deploy requests, and Insights.";
+}, {
+    readonly id: "stripe";
+    readonly backend: "composio";
+    readonly toolkit: "stripe";
+    readonly authType: "oauth";
+    readonly category: "business";
+    readonly name: "Stripe";
+    readonly description: "Manage customers, payments, invoices, subscriptions, and balances.";
+}, {
+    readonly id: "pangram";
+    readonly backend: "native";
+    readonly toolkit: "pangram";
+    readonly authType: "api_key";
+    readonly category: "data";
+    readonly name: "Pangram";
+    readonly description: "Analyze text for AI generation and plagiarism signals.";
+}, {
+    readonly id: "vercel";
+    readonly backend: "composio";
+    readonly toolkit: "vercel";
+    readonly authType: "api_key";
+    readonly category: "data";
+    readonly name: "Vercel";
+    readonly description: "Manage projects, deployments, logs, domains, and infrastructure.";
+}, {
+    readonly id: "turbopuffer";
+    readonly backend: "native";
+    readonly toolkit: "turbopuffer";
+    readonly authType: "api_key";
+    readonly category: "data";
+    readonly name: "turbopuffer";
+    readonly description: "Query and manage turbopuffer namespaces.";
+}, ...{
+    id: "close" | "notion" | "jira" | "confluence" | "googlecalendar" | "microsoftteams" | "outlook" | "bitbucket" | "datadog" | "pagerduty" | "intercom" | "zendesk" | "hubspot" | "supabase" | "figma" | "launchdarkly" | "asana" | "clickup" | "trello" | "todoist" | "airtable" | "coda" | "miro" | "sharepoint" | "onedrive" | "googleslides" | "googlemeet" | "googletasks" | "dropbox" | "box" | "discord" | "discordbot" | "zoom" | "googlechat" | "newrelic" | "betterstack" | "incidentio" | "grafana" | "honeycomb" | "bugsnag" | "circleci" | "buildkite" | "dockerhub" | "digitalocean" | "railway" | "render" | "firebase" | "cloudinary" | "configcat" | "googleanalytics" | "googlebigquery" | "amplitude" | "mixpanel" | "segment" | "databricks" | "snowflake" | "algolia" | "elasticsearch" | "salesforce" | "pipedrive" | "apollo" | "gong" | "freshdesk" | "helpscout" | "servicenow" | "mailchimp" | "customerio" | "klaviyo" | "shopify" | "quickbooks" | "xero" | "brex" | "buffer" | "canva" | "webflow" | "firecrawl" | "browserbase" | "exa" | "youtube" | "twitter" | "instagram" | "facebook";
+    backend: "composio";
+    toolkit: "close" | "notion" | "jira" | "confluence" | "googlecalendar" | "microsoft_teams" | "outlook" | "bitbucket" | "datadog" | "pagerduty" | "intercom" | "zendesk" | "hubspot" | "supabase" | "figma" | "launch_darkly" | "asana" | "clickup" | "trello" | "todoist" | "airtable" | "coda" | "miro" | "share_point" | "one_drive" | "googleslides" | "googlemeet" | "googletasks" | "dropbox" | "box" | "discord" | "discordbot" | "zoom" | "google_chat" | "new_relic" | "better_stack" | "incident_io" | "grafana" | "honeycomb_mcp" | "bugsnag" | "circleci" | "buildkite" | "docker_hub" | "digital_ocean" | "railway" | "render" | "firebase" | "cloudinary" | "configcat" | "google_analytics" | "googlebigquery" | "amplitude" | "mixpanel" | "segment" | "databricks" | "snowflake" | "algolia" | "elasticsearch" | "salesforce" | "pipedrive" | "apollo" | "gong" | "freshdesk" | "help_scout" | "servicenow" | "mailchimp" | "customerio" | "klaviyo" | "shopify" | "quickbooks" | "xero" | "brex" | "buffer" | "canva" | "webflow" | "firecrawl" | "browserbase_tool" | "exa" | "youtube" | "twitter" | "instagram" | "facebook";
+    authType: "hosted";
+    authScheme: "API_KEY" | "BASIC" | "BEARER_TOKEN" | "DCR_OAUTH" | "OAUTH1" | "OAUTH2";
+    managedAuth: boolean;
+    category: "data" | "productivity" | "business";
+    name: "Notion" | "Jira" | "Confluence" | "Google Calendar" | "Microsoft Teams" | "Outlook" | "Bitbucket" | "Datadog" | "PagerDuty" | "Intercom" | "Zendesk" | "HubSpot" | "Supabase" | "Figma" | "LaunchDarkly" | "Asana" | "ClickUp" | "Trello" | "Todoist" | "Airtable" | "Coda" | "Miro" | "SharePoint" | "OneDrive" | "Google Slides" | "Google Meet" | "Google Tasks" | "Dropbox" | "Box" | "Discord" | "Discord Bot" | "Zoom" | "Google Chat" | "New Relic" | "Better Stack" | "incident.io" | "Grafana" | "Honeycomb MCP" | "Bugsnag" | "CircleCI" | "Buildkite" | "Docker Hub" | "DigitalOcean" | "Railway" | "Render" | "Firebase" | "Cloudinary" | "ConfigCat" | "Google Analytics" | "Google BigQuery" | "Amplitude" | "Mixpanel" | "Segment" | "Databricks" | "Snowflake" | "Algolia" | "Elasticsearch" | "Salesforce" | "Pipedrive" | "Close" | "Apollo" | "Gong" | "Freshdesk" | "Help Scout" | "ServiceNow" | "Mailchimp" | "Customer.io" | "Klaviyo" | "Shopify" | "QuickBooks" | "Xero" | "Brex" | "Buffer" | "Canva" | "Webflow" | "Firecrawl" | "Browserbase" | "Exa" | "YouTube" | "Twitter/X" | "Instagram" | "Facebook";
+    description: string;
+}[]];

package/workspace-sdk/shared/routes/plugins.d.ts

@@ -1,158 +1,7 @@
 // Generated from shared/src by generate-workspace-sdk-types.mjs; do not edit.
 import type { WorkspaceNativeIntegrationStatus } from './integrations';
-export declare const PLUGIN_CATALOG: readonly [{
-    readonly id: "attio";
-    readonly backend: "composio";
-    readonly toolkit: "attio";
-    readonly authType: "oauth";
-    readonly category: "business";
-    readonly name: "Attio";
-    readonly description: "Manage CRM records, people, companies, lists, and notes.";
-}, {
-    readonly id: "calendly";
-    readonly backend: "composio";
-    readonly toolkit: "calendly";
-    readonly authType: "oauth";
-    readonly category: "productivity";
-    readonly name: "Calendly";
-    readonly description: "Manage event types, scheduled events, invitees, and scheduling links.";
-}, {
-    readonly id: "clickhouse";
-    readonly backend: "composio";
-    readonly toolkit: "clickhouse";
-    readonly authType: "basic";
-    readonly category: "data";
-    readonly name: "ClickHouse";
-    readonly description: "Manage databases, tables, schemas, and queries.";
-}, {
-    readonly id: "cloudflare";
-    readonly backend: "composio";
-    readonly toolkit: "cloudflare_api_key";
-    readonly authType: "api_key";
-    readonly category: "data";
-    readonly name: "Cloudflare";
-    readonly description: "Manage zones, DNS records, analytics, and security settings.";
-}, {
-    readonly id: "e2b";
-    readonly toolkit: "e2b";
-    readonly backend: "native";
-    readonly authType: "api_key";
-    readonly category: "data";
-    readonly name: "E2B";
-    readonly description: "Create secure cloud sandboxes and run commands in them.";
-}, {
-    readonly id: "gmail";
-    readonly backend: "composio";
-    readonly toolkit: "gmail";
-    readonly authType: "oauth";
-    readonly category: "productivity";
-    readonly name: "Gmail";
-    readonly description: "Manage messages, threads, attachments, labels, and mailbox settings.";
-}, {
-    readonly id: "googleads";
-    readonly backend: "composio";
-    readonly toolkit: "googleads";
-    readonly authType: "oauth";
-    readonly category: "data";
-    readonly name: "Google Ads";
-    readonly description: "Manage campaigns, customers, accounts, and reporting data.";
-}, {
-    readonly id: "googledocs";
-    readonly backend: "composio";
-    readonly toolkit: "googledocs";
-    readonly authType: "oauth";
-    readonly category: "productivity";
-    readonly name: "Google Docs";
-    readonly description: "Manage documents, structure, comments, and exported content.";
-}, {
-    readonly id: "googledrive";
-    readonly backend: "composio";
-    readonly toolkit: "googledrive";
-    readonly authType: "oauth";
-    readonly category: "productivity";
-    readonly name: "Google Drive";
-    readonly description: "Manage files, folders, metadata, permissions, and shared drives.";
-}, {
-    readonly id: "googlesearch";
-    readonly backend: "composio";
-    readonly toolkit: "google_search_console";
-    readonly authType: "oauth";
-    readonly category: "data";
-    readonly name: "Google Search";
-    readonly description: "Manage Search Console performance, indexing, sites, and sitemaps.";
-}, {
-    readonly id: "googlesheets";
-    readonly backend: "composio";
-    readonly toolkit: "googlesheets";
-    readonly authType: "oauth";
-    readonly category: "productivity";
-    readonly name: "Google Sheets";
-    readonly description: "Manage spreadsheets, worksheets, ranges, tables, and charts.";
-}, {
-    readonly id: "linkedin";
-    readonly backend: "composio";
-    readonly toolkit: "linkedin";
-    readonly authType: "oauth";
-    readonly category: "business";
-    readonly name: "LinkedIn";
-    readonly description: "Manage profiles, organizations, posts, and professional activity.";
-}, {
-    readonly id: "modal";
-    readonly backend: "native";
-    readonly toolkit: "modal";
-    readonly authType: "basic";
-    readonly category: "data";
-    readonly name: "Modal";
-    readonly description: "Invoke deployed functions through Modal compute.";
-}, {
-    readonly id: "posthog";
-    readonly backend: "composio";
-    readonly toolkit: "posthog";
-    readonly authType: "api_key";
-    readonly category: "data";
-    readonly name: "PostHog";
-    readonly description: "Manage projects, events, insights, dashboards, flags, and recordings.";
-}, {
-    readonly id: "planetscale";
-    readonly toolkit: "planetscale";
-    readonly backend: "native";
-    readonly authType: "oauth";
-    readonly category: "data";
-    readonly name: "PlanetScale";
-    readonly description: "Manage organizations, databases, branches, deploy requests, and Insights.";
-}, {
-    readonly id: "stripe";
-    readonly backend: "composio";
-    readonly toolkit: "stripe";
-    readonly authType: "oauth";
-    readonly category: "business";
-    readonly name: "Stripe";
-    readonly description: "Manage customers, payments, invoices, subscriptions, and balances.";
-}, {
-    readonly id: "pangram";
-    readonly backend: "native";
-    readonly toolkit: "pangram";
-    readonly authType: "api_key";
-    readonly category: "data";
-    readonly name: "Pangram";
-    readonly description: "Analyze text for AI generation and plagiarism signals.";
-}, {
-    readonly id: "vercel";
-    readonly backend: "composio";
-    readonly toolkit: "vercel";
-    readonly authType: "api_key";
-    readonly category: "data";
-    readonly name: "Vercel";
-    readonly description: "Manage projects, deployments, logs, domains, and infrastructure.";
-}, {
-    readonly id: "turbopuffer";
-    readonly backend: "native";
-    readonly toolkit: "turbopuffer";
-    readonly authType: "api_key";
-    readonly category: "data";
-    readonly name: "turbopuffer";
-    readonly description: "Query and manage turbopuffer namespaces.";
-}];
+import { PLUGIN_CATALOG, type HostedPluginAuthScheme } from './plugin-catalog';
+export { PLUGIN_CATALOG } from './plugin-catalog';
 export type PluginId = (typeof PLUGIN_CATALOG)[number]['id'];
 export type PluginBackend = (typeof PLUGIN_CATALOG)[number]['backend'];
 export type NativePluginId = Extract<(typeof PLUGIN_CATALOG)[number], {
@@ -171,6 +20,8 @@ export interface PluginCatalogItem {
     backend: PluginBackend;
     toolkit: string;
     authType: PluginAuthType;
+    authScheme?: HostedPluginAuthScheme;
+    managedAuth?: boolean;
     category: PluginCategory;
     name: string;
     description: string;