replicas-engine 0.1.702 → 0.1.703

package/dist/src/chunk-RVDZXLBY.js

@@ -0,0 +1,287 @@
+#!/usr/bin/env node
+import {
+  REPLICAS_RUNTIME_ENV_ALIASES,
+  agentCredentialSnapshotSchema,
+  extractCommandProtectionCommandText,
+  findGitCommitSignals,
+  findPrMergeSignals,
+  isRecord,
+  isValidAgentProvider,
+  parsePosixEnvFile,
+  readReplicasRuntimeEnv
+} from "./chunk-LPJ6WYD4.js";
+
+// src/utils/type-guards.ts
+function isRecord2(value) {
+  return typeof value === "object" && value !== null;
+}
+
+// src/engine-env.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+
+// src/runtime-env-loader.ts
+import { readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+function loadRuntimeEnvFile() {
+  let content;
+  try {
+    content = readFileSync(join(homedir(), ".replicas", "runtime-env.sh"), "utf-8");
+  } catch {
+    return;
+  }
+  for (const [key, value] of Object.entries(parsePosixEnvFile(content))) {
+    process.env[key] = value;
+  }
+}
+
+// src/engine-env.ts
+var SANDBOX_IMAGE_VERSION_FILE = "/usr/local/lib/replicas-sandbox-image-version";
+function readEnv(name) {
+  const value = process.env[name]?.trim();
+  return value ? value : void 0;
+}
+function readSandboxImageVersion() {
+  const environmentVersion = readEnv("REPLICAS_SANDBOX_IMAGE_VERSION");
+  if (environmentVersion) return environmentVersion;
+  try {
+    return readFileSync2(SANDBOX_IMAGE_VERSION_FILE, "utf8").trim() || "development";
+  } catch {
+    return "development";
+  }
+}
+function parsePort(value) {
+  if (!value) {
+    return 3737;
+  }
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new Error("Invalid engine environment: REPLICAS_ENGINE_PORT must be a positive integer");
+  }
+  return parsed;
+}
+function requireDefined(value, name) {
+  if (value === void 0 || value === null) {
+    throw new Error(`Invalid engine environment: ${name} is required`);
+  }
+  return value;
+}
+function requireValidURL(value, name) {
+  try {
+    new URL(value);
+    return value;
+  } catch {
+    throw new Error(`Invalid engine environment: ${name} must be a valid URL`);
+  }
+}
+function parseClaudeAuthMethod(value) {
+  if (value === "oauth" || value === "api_key" || value === "bedrock" || value === "foundry") {
+    return value;
+  }
+  return void 0;
+}
+function parseCodexAuthMethod(value) {
+  if (value === "oauth" || value === "api_key" || value === "foundry") {
+    return value;
+  }
+  return void 0;
+}
+function parseAgentCredentialSnapshots(value) {
+  if (!value) return {};
+  try {
+    const parsed = JSON.parse(value);
+    if (!isRecord2(parsed)) return {};
+    const snapshots = {};
+    for (const [provider, snapshot] of Object.entries(parsed)) {
+      if (!isValidAgentProvider(provider)) continue;
+      const parsedSnapshot = agentCredentialSnapshotSchema.safeParse(snapshot);
+      if (parsedSnapshot.success) snapshots[provider] = parsedSnapshot.data;
+    }
+    return snapshots;
+  } catch {
+    return {};
+  }
+}
+var IS_WARMING_MODE = process.argv.includes("--warming");
+function loadEngineEnv() {
+  loadRuntimeEnvFile();
+  const HOME_DIR = homedir2();
+  const env = {
+    // Defined: always available
+    REPLICAS_ENGINE_SECRET: requireDefined(readEnv("REPLICAS_ENGINE_SECRET"), "REPLICAS_ENGINE_SECRET"),
+    REPLICAS_ENGINE_PORT: parsePort(readEnv("REPLICAS_ENGINE_PORT")),
+    REPLICAS_MONOLITH_URL: requireValidURL(
+      requireDefined(readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.monolithUrl), "REPLICAS_MONOLITH_URL"),
+      "REPLICAS_MONOLITH_URL"
+    ),
+    HOME_DIR,
+    WORKSPACE_ROOT: join2(HOME_DIR, "workspaces"),
+    REPLICAS_SANDBOX_IMAGE_VERSION: readSandboxImageVersion(),
+    // Runtime: may not be set during warming
+    REPLICAS_WORKSPACE_ID: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.workspaceId),
+    REPLICAS_LINEAR_SESSION_ID: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.linearSessionId),
+    REPLICAS_LINEAR_ACCESS_TOKEN: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.linearAccessToken),
+    REPLICAS_SLACK_BOT_TOKEN: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.slackBotToken),
+    REPLICAS_SLACK_CHANNEL_ID: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.slackChannelId),
+    REPLICAS_SLACK_THREAD_TS: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.slackThreadTs),
+    ANTHROPIC_API_KEY: readEnv("ANTHROPIC_API_KEY"),
+    OPENAI_API_KEY: readEnv("OPENAI_API_KEY"),
+    CURSOR_API_KEY: readEnv("CURSOR_API_KEY"),
+    AI_GATEWAY_API_KEY: readEnv("AI_GATEWAY_API_KEY"),
+    CLAUDE_CODE_USE_BEDROCK: readEnv("CLAUDE_CODE_USE_BEDROCK"),
+    AWS_ACCESS_KEY_ID: readEnv("AWS_ACCESS_KEY_ID"),
+    AWS_SECRET_ACCESS_KEY: readEnv("AWS_SECRET_ACCESS_KEY"),
+    AWS_REGION: readEnv("AWS_REGION"),
+    ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION: readEnv("ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION"),
+    REPLICAS_CLAUDE_AUTH_METHOD: parseClaudeAuthMethod(readEnv("REPLICAS_CLAUDE_AUTH_METHOD")),
+    REPLICAS_CODEX_AUTH_METHOD: parseCodexAuthMethod(readEnv("REPLICAS_CODEX_AUTH_METHOD")),
+    REPLICAS_AGENT_CREDENTIALS: parseAgentCredentialSnapshots(readEnv("REPLICAS_AGENT_CREDENTIALS")),
+    REPLICAS_ENV_SYSTEM_PROMPT: readEnv("REPLICAS_ENV_SYSTEM_PROMPT"),
+    REPLICAS_ENV_START_HOOK: readEnv("REPLICAS_ENV_START_HOOK"),
+    REPLICAS_DISABLE_AUTO_START_HOOKS: readEnv("REPLICAS_DISABLE_AUTO_START_HOOKS")?.toLowerCase() === "true",
+    REPLICAS_ENGINE_DEFER_INITIALIZATION: readEnv("REPLICAS_ENGINE_DEFER_INITIALIZATION")?.toLowerCase() === "true"
+  };
+  if (!IS_WARMING_MODE && !env.REPLICAS_WORKSPACE_ID) {
+    console.error("REPLICAS_WORKSPACE_ID is not set \u2014 this is required in normal (non-warming) mode");
+  }
+  return env;
+}
+var ENGINE_ENV = loadEngineEnv();
+function setAgentCredentialSnapshot(provider, snapshot) {
+  ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS = {
+    ...ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS,
+    [provider]: snapshot
+  };
+  process.env.REPLICAS_AGENT_CREDENTIALS = JSON.stringify(ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS);
+}
+
+// src/services/monolith-service.ts
+async function monolithRequest(path, init = {}) {
+  if (!ENGINE_ENV.REPLICAS_WORKSPACE_ID) {
+    throw new Error("REPLICAS_WORKSPACE_ID is not set; cannot call monolith");
+  }
+  const headers = {
+    Authorization: `Bearer ${ENGINE_ENV.REPLICAS_ENGINE_SECRET}`,
+    "X-Workspace-Id": ENGINE_ENV.REPLICAS_WORKSPACE_ID
+  };
+  if (!(init.body instanceof FormData)) headers["Content-Type"] = "application/json";
+  return fetch(`${ENGINE_ENV.REPLICAS_MONOLITH_URL}${path}`, {
+    method: init.method ?? "POST",
+    headers,
+    body: init.body === void 0 ? void 0 : init.body instanceof FormData ? init.body : JSON.stringify(init.body),
+    signal: init.signal
+  });
+}
+var MonolithService = class {
+  async getRelaySubagentProviders() {
+    try {
+      const response = await monolithRequest("/v1/engine/relay-subagent-providers", { method: "GET" });
+      if (!response.ok) {
+        return null;
+      }
+      const body = await response.json();
+      return isRecord(body) && Array.isArray(body.providers) && body.providers.every((provider) => typeof provider === "string" && isValidAgentProvider(provider)) ? body.providers : null;
+    } catch {
+      return null;
+    }
+  }
+  async getOpenRouterModels() {
+    try {
+      const response = await monolithRequest("/v1/engine/openrouter-models", { method: "GET" });
+      if (!response.ok) {
+        return null;
+      }
+      const body = await response.json();
+      return isRecord(body) && Array.isArray(body.models) && body.models.every((model) => typeof model === "string") ? body.models : null;
+    } catch {
+      return null;
+    }
+  }
+  async sendEvent(event) {
+    if (!ENGINE_ENV.REPLICAS_WORKSPACE_ID) {
+      return;
+    }
+    try {
+      const response = await monolithRequest("/v1/engine/webhook", { body: event });
+      if (!response.ok) {
+        const errorText = await response.text();
+        console.error(`[MonolithService] Failed to send event: ${response.status} ${errorText}`);
+      }
+    } catch (error) {
+      console.error("[MonolithService] Failed to send event:", error);
+    }
+  }
+};
+var monolithService = new MonolithService();
+
+// src/services/command-protection-service.ts
+var DEFAULT_COMMAND_PROTECTION_BLOCK_MESSAGE = "Blocked by Replicas command protection.";
+function asCommandProtectionResponse(value) {
+  if (typeof value !== "object" || value === null) return null;
+  const candidate = value;
+  return typeof candidate.allowed === "boolean" && typeof candidate.enabled === "boolean" ? candidate : null;
+}
+function failClosed(reason, matchedSignals) {
+  return {
+    allowed: false,
+    enabled: true,
+    reason,
+    matchedSignals
+  };
+}
+async function evaluateCommandProtection(request, signal) {
+  const matchedSignals = [...findGitCommitSignals(request), ...findPrMergeSignals(request)];
+  if (matchedSignals.length === 0) {
+    return { allowed: true, enabled: true };
+  }
+  let response;
+  try {
+    response = await monolithRequest("/v1/engine/command-protection/evaluate", {
+      body: request,
+      signal
+    });
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return failClosed(`Command protection failed closed: ${detail}`, matchedSignals);
+  }
+  if (!response.ok) {
+    const detail = await response.text().catch(() => "");
+    return failClosed(`Command protection failed closed: ${response.status} ${detail}`, matchedSignals);
+  }
+  let payload;
+  try {
+    payload = await response.json();
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return failClosed(`Command protection failed closed: ${detail}`, matchedSignals);
+  }
+  return asCommandProtectionResponse(payload) ?? failClosed("Command protection failed closed: invalid response from policy service", matchedSignals);
+}
+function extractToolCommand(input) {
+  return extractCommandProtectionCommandText({ toolInput: input }, { stringifyFallback: false });
+}
+function reportCommandProtectionBlock(options) {
+  const message = options.result.reason || DEFAULT_COMMAND_PROTECTION_BLOCK_MESSAGE;
+  console.warn(`[${options.managerName}] blocked ${options.action} by command protection: ${message}`);
+  options.recordHistoryEvent(options.eventType, {
+    type: "error",
+    message,
+    ...options.context,
+    command: options.command
+  }, options.historyFile);
+  return message;
+}
+
+export {
+  isRecord2 as isRecord,
+  IS_WARMING_MODE,
+  ENGINE_ENV,
+  setAgentCredentialSnapshot,
+  monolithRequest,
+  monolithService,
+  evaluateCommandProtection,
+  extractToolCommand,
+  reportCommandProtectionBlock
+};