replicas-engine 0.1.740 → 0.1.741

package/dist/src/asp-host-KDEJGDMP.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+import {
+  getCodexAspHost,
+  restartCodexAspHost,
+  restartCodexAspHostIfRunning
+} from "./chunk-UUKFVYYJ.js";
+import "./chunk-TRGZSX4W.js";
+import "./chunk-ESGIWRVV.js";
+import "./chunk-2RB7SIP3.js";
+import "./chunk-Q6F7J5DH.js";
+export {
+  getCodexAspHost,
+  restartCodexAspHost,
+  restartCodexAspHostIfRunning
+};

package/dist/src/chunk-25CMFABL.js

@@ -0,0 +1,73 @@
+#!/usr/bin/env node
+import {
+  monolithRequest
+} from "./chunk-TRGZSX4W.js";
+import {
+  extractCommandProtectionCommandText,
+  findGitCommitSignals,
+  findPrMergeSignals
+} from "./chunk-Q6F7J5DH.js";
+
+// src/services/command-protection-service.ts
+var DEFAULT_COMMAND_PROTECTION_BLOCK_MESSAGE = "Blocked by Replicas command protection.";
+function asCommandProtectionResponse(value) {
+  if (typeof value !== "object" || value === null) return null;
+  const candidate = value;
+  return typeof candidate.allowed === "boolean" && typeof candidate.enabled === "boolean" ? candidate : null;
+}
+function failClosed(reason, matchedSignals) {
+  return {
+    allowed: false,
+    enabled: true,
+    reason,
+    matchedSignals
+  };
+}
+async function evaluateCommandProtection(request, signal) {
+  const matchedSignals = [...findGitCommitSignals(request), ...findPrMergeSignals(request)];
+  if (matchedSignals.length === 0) {
+    return { allowed: true, enabled: true };
+  }
+  let response;
+  try {
+    response = await monolithRequest("/v1/engine/command-protection/evaluate", {
+      body: request,
+      signal
+    });
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return failClosed(`Command protection failed closed: ${detail}`, matchedSignals);
+  }
+  if (!response.ok) {
+    const detail = await response.text().catch(() => "");
+    return failClosed(`Command protection failed closed: ${response.status} ${detail}`, matchedSignals);
+  }
+  let payload;
+  try {
+    payload = await response.json();
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return failClosed(`Command protection failed closed: ${detail}`, matchedSignals);
+  }
+  return asCommandProtectionResponse(payload) ?? failClosed("Command protection failed closed: invalid response from policy service", matchedSignals);
+}
+function extractToolCommand(input) {
+  return extractCommandProtectionCommandText({ toolInput: input }, { stringifyFallback: false });
+}
+function reportCommandProtectionBlock(options) {
+  const message = options.result.reason || DEFAULT_COMMAND_PROTECTION_BLOCK_MESSAGE;
+  console.warn(`[${options.managerName}] blocked ${options.action} by command protection: ${message}`);
+  options.recordHistoryEvent(options.eventType, {
+    type: "error",
+    message,
+    ...options.context,
+    command: options.command
+  }, options.historyFile);
+  return message;
+}
+
+export {
+  evaluateCommandProtection,
+  extractToolCommand,
+  reportCommandProtectionBlock
+};

package/dist/src/{chunk-7SUFESKA.js → chunk-6O6BPV7Q.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   mayCreatePullRequest
-} from "./chunk-YPAI4W4G.js";
+} from "./chunk-Q6F7J5DH.js";
 
 // src/services/post-tool-pr-notifier.ts
 async function notifyPostToolUse(toolName, toolInput) {

package/dist/src/{chunk-ZZRN6VSK.js → chunk-ESGIWRVV.js}

@@ -2,40 +2,7 @@
 import {
   HOOK_EXEC_MAX_BUFFER_BYTES,
   isVersionBelow
-} from "./chunk-YPAI4W4G.js";
-
-// src/utils/presigned-upload.ts
-import { createReadStream } from "fs";
-import { request as httpRequest } from "http";
-import { request as httpsRequest } from "https";
-async function putPresignedFile(urlValue, filePath, size, contentType) {
-  await new Promise((resolve, reject) => {
-    const url = new URL(urlValue);
-    const request = (url.protocol === "https:" ? httpsRequest : httpRequest)(url, {
-      method: "PUT",
-      headers: {
-        "content-length": String(size),
-        "content-type": contentType
-      }
-    }, (response) => {
-      response.setEncoding("utf8");
-      let body = "";
-      response.on("data", (chunk) => {
-        body += chunk;
-      });
-      response.on("end", () => {
-        const status = response.statusCode ?? 0;
-        if (status >= 200 && status < 300) resolve();
-        else reject(new Error(`upload failed: ${status} ${body}`));
-      });
-      response.on("error", reject);
-    });
-    request.on("error", reject);
-    const file = size > 0 ? createReadStream(filePath, { start: 0, end: size - 1 }) : createReadStream(filePath);
-    file.on("error", (error) => request.destroy(error));
-    file.pipe(request);
-  });
-}
+} from "./chunk-Q6F7J5DH.js";
 
 // src/utils/codex-agent-env.ts
 function buildCodexAgentEnv(source = process.env) {
@@ -272,7 +239,7 @@ var DEFAULT_CODEX_ARGS = [
 var MIN_CODEX_CLI_VERSION = "0.144.6";
 var CODEX_UPGRADE_TIMEOUT_MS = 12e4;
 var codexCliVersionEnsured = null;
-var ENGINE_PACKAGE_VERSION = "0.1.740";
+var ENGINE_PACKAGE_VERSION = "0.1.741";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";
@@ -290,21 +257,37 @@ var AppServerProcess = class {
   invalidating = false;
   constructor(options) {
     this.binary = options.binary ?? DEFAULT_CODEX_BINARY;
-    const baseArgs = options.args ?? (options.env.REPLICAS_CODEX_AUTH_METHOD === "foundry" ? [
-      ...DEFAULT_CODEX_ARGS,
-      "-c",
-      `model=${JSON.stringify(options.env.CODEX_FOUNDRY_MODEL)}`,
-      "-c",
-      'model_provider="azure"',
-      "-c",
-      'model_providers.azure.name="Azure OpenAI"',
-      "-c",
-      `model_providers.azure.base_url=${JSON.stringify(options.env.CODEX_FOUNDRY_BASE_URL)}`,
-      "-c",
-      'model_providers.azure.env_key="AZURE_OPENAI_API_KEY"',
-      "-c",
-      'model_providers.azure.wire_api="responses"'
-    ] : DEFAULT_CODEX_ARGS);
+    let baseArgs = options.args ?? DEFAULT_CODEX_ARGS;
+    if (!options.args && options.env.REPLICAS_CODEX_AUTH_METHOD === "foundry") {
+      baseArgs = [
+        ...DEFAULT_CODEX_ARGS,
+        "-c",
+        `model=${JSON.stringify(options.env.CODEX_FOUNDRY_MODEL)}`,
+        "-c",
+        'model_provider="azure"',
+        "-c",
+        'model_providers.azure.name="Azure OpenAI"',
+        "-c",
+        `model_providers.azure.base_url=${JSON.stringify(options.env.CODEX_FOUNDRY_BASE_URL)}`,
+        "-c",
+        'model_providers.azure.env_key="AZURE_OPENAI_API_KEY"',
+        "-c",
+        'model_providers.azure.wire_api="responses"'
+      ];
+    } else if (!options.args && options.env.REPLICAS_CODEX_AUTH_METHOD === "api_key" && options.env.CODEX_OPENAI_BASE_URL) {
+      baseArgs = [
+        ...DEFAULT_CODEX_ARGS,
+        "-c",
+        'model_provider="replicas_openai_compatible"',
+        "-c",
+        'model_providers.replicas_openai_compatible.name="OpenAI Compatible"',
+        "-c",
+        `model_providers.replicas_openai_compatible.base_url=${JSON.stringify(options.env.CODEX_OPENAI_BASE_URL)}`,
+        "-c",
+        'model_providers.replicas_openai_compatible.wire_api="responses"',
+        ...options.env.CODEX_OPENAI_AUTHORIZATION_HEADER ? ["-c", 'model_providers.replicas_openai_compatible.env_http_headers={ Authorization = "CODEX_OPENAI_AUTHORIZATION_HEADER" }'] : ["-c", 'model_providers.replicas_openai_compatible.env_key="OPENAI_API_KEY"']
+      ];
+    }
     this.args = [...baseArgs, ...(options.configOverrides ?? []).flatMap((override) => ["-c", override])];
     this.env = options.env;
     this.cwd = options.cwd;
@@ -467,7 +450,7 @@ var AppServerProcess = class {
       await client.request(ACCOUNT_LOGIN_START_METHOD, params2);
       return;
     }
-    if (this.env.REPLICAS_CODEX_AUTH_METHOD !== "api_key" || !this.env.OPENAI_API_KEY) return;
+    if (this.env.REPLICAS_CODEX_AUTH_METHOD !== "api_key" || this.env.CODEX_OPENAI_BASE_URL || !this.env.OPENAI_API_KEY) return;
     const params = {
       type: "apiKey",
       apiKey: this.env.OPENAI_API_KEY
@@ -489,69 +472,11 @@ var AppServerProcess = class {
   }
 };
 
-// src/managers/codex-asp/notification-dispatch.ts
-var TURN_STARTED_METHOD = "turn/started";
-var TURN_COMPLETED_METHOD = "turn/completed";
-var TURN_PLAN_UPDATED_METHOD = "turn/plan/updated";
-var THREAD_GOAL_UPDATED_METHOD = "thread/goal/updated";
-var THREAD_GOAL_CLEARED_METHOD = "thread/goal/cleared";
-var ITEM_STARTED_METHOD = "item/started";
-var ITEM_COMPLETED_METHOD = "item/completed";
-var AGENT_MESSAGE_DELTA_METHOD = "item/agentMessage/delta";
-var REASONING_SUMMARY_TEXT_DELTA_METHOD = "item/reasoning/summaryTextDelta";
-var REASONING_TEXT_DELTA_METHOD = "item/reasoning/textDelta";
-var REASONING_SUMMARY_PART_ADDED_METHOD = "item/reasoning/summaryPartAdded";
-var COMMAND_EXECUTION_OUTPUT_DELTA_METHOD = "item/commandExecution/outputDelta";
-var FILE_CHANGE_OUTPUT_DELTA_METHOD = "item/fileChange/outputDelta";
-var ACCOUNT_RATE_LIMITS_UPDATED_METHOD = "account/rateLimits/updated";
-var THREAD_TOKEN_USAGE_UPDATED_METHOD = "thread/tokenUsage/updated";
-var THREAD_COMPACTED_METHOD = "thread/compacted";
-var MODEL_REROUTED_METHOD = "model/rerouted";
-function dispatchAspNotification(notification, handlers) {
-  const handler = handlers[notification.method];
-  if (!handler) return;
-  handler(notification);
-}
-function recoverCompletedTurn(turn, completedItems, agentMessageDeltas) {
-  const items = turn.items.length > 0 ? [...turn.items] : [];
-  const itemIds = new Set(items.map((item) => item.id));
-  for (const item of completedItems) {
-    if (itemIds.has(item.id)) continue;
-    items.push(item);
-    itemIds.add(item.id);
-  }
-  for (const [itemId, text] of agentMessageDeltas) {
-    if (itemIds.has(itemId)) continue;
-    items.push({ type: "agentMessage", id: itemId, text, phase: null, memoryCitation: null });
-  }
-  return items.length > 0 ? { ...turn, items, itemsView: "full" } : turn;
-}
-
 export {
-  putPresignedFile,
   buildCodexAgentEnv,
   AspClient,
   execAsync,
   execFileAsync,
   SUBPROCESS_MAX_BUFFER,
-  AppServerProcess,
-  TURN_STARTED_METHOD,
-  TURN_COMPLETED_METHOD,
-  TURN_PLAN_UPDATED_METHOD,
-  THREAD_GOAL_UPDATED_METHOD,
-  THREAD_GOAL_CLEARED_METHOD,
-  ITEM_STARTED_METHOD,
-  ITEM_COMPLETED_METHOD,
-  AGENT_MESSAGE_DELTA_METHOD,
-  REASONING_SUMMARY_TEXT_DELTA_METHOD,
-  REASONING_TEXT_DELTA_METHOD,
-  REASONING_SUMMARY_PART_ADDED_METHOD,
-  COMMAND_EXECUTION_OUTPUT_DELTA_METHOD,
-  FILE_CHANGE_OUTPUT_DELTA_METHOD,
-  ACCOUNT_RATE_LIMITS_UPDATED_METHOD,
-  THREAD_TOKEN_USAGE_UPDATED_METHOD,
-  THREAD_COMPACTED_METHOD,
-  MODEL_REROUTED_METHOD,
-  dispatchAspNotification,
-  recoverCompletedTurn
+  AppServerProcess
 };

package/dist/src/{chunk-YPAI4W4G.js → chunk-Q6F7J5DH.js}

@@ -539,6 +539,21 @@ function getCredentialMethodLabel(agent, method) {
   }
 }
 
+// ../shared/src/result.ts
+function createSuccessResult(data) {
+  return { ok: true, data };
+}
+function createErrorResult(error) {
+  return {
+    ok: false,
+    error: {
+      message: error.message,
+      code: error.code,
+      details: error.details
+    }
+  };
+}
+
 // ../shared/src/analytics/types.ts
 function hasAgentChatActivityFields(value) {
   return isRecord(value) && typeof value.chatId === "string" && typeof value.model === "string" && (value.credentialMethod === void 0 || isAuthMethod(value.credentialMethod)) && (value.credentialScope === void 0 || isCredentialScope(value.credentialScope)) && value.credentialMethod === void 0 === (value.credentialScope === void 0) && (value.senderUserId === void 0 || typeof value.senderUserId === "string") && typeof value.occurredAt === "string";
@@ -977,21 +992,6 @@ function getMemoryOutputSafetyViolation(value, secrets, maxChars) {
   return null;
 }
 
-// ../shared/src/result.ts
-function createSuccessResult(data) {
-  return { ok: true, data };
-}
-function createErrorResult(error) {
-  return {
-    ok: false,
-    error: {
-      message: error.message,
-      code: error.code,
-      details: error.details
-    }
-  };
-}
-
 // ../shared/src/sandbox.ts
 var SANDBOX_LIFECYCLE = {
   AUTO_STOP_MINUTES: 60,
@@ -6354,6 +6354,8 @@ function hasChatStarted(chat) {
 // ../shared/src/routes/codex.ts
 var CODEX_AUTH_ENV_KEYS = [
   "OPENAI_API_KEY",
+  "CODEX_OPENAI_BASE_URL",
+  "CODEX_OPENAI_AUTHORIZATION_HEADER",
   "AZURE_OPENAI_API_KEY",
   "CODEX_FOUNDRY_BASE_URL",
   "CODEX_FOUNDRY_MODEL",
@@ -6364,7 +6366,12 @@ function codexAuthEnvFromResponse(response) {
     case "oauth":
       return { REPLICAS_CODEX_AUTH_METHOD: "oauth" };
     case "api_key":
-      return { OPENAI_API_KEY: response.apiKey, REPLICAS_CODEX_AUTH_METHOD: "api_key" };
+      return {
+        ...response.apiKey && !response.authorizationHeader ? { OPENAI_API_KEY: response.apiKey } : {},
+        ...response.baseUrl ? { CODEX_OPENAI_BASE_URL: response.baseUrl } : {},
+        ...response.authorizationHeader ? { CODEX_OPENAI_AUTHORIZATION_HEADER: response.authorizationHeader } : {},
+        REPLICAS_CODEX_AUTH_METHOD: "api_key"
+      };
     case "foundry":
       return {
         AZURE_OPENAI_API_KEY: response.apiKey,
@@ -6377,7 +6384,12 @@ function codexAuthEnvFromResponse(response) {
 var CODEX_AUTH_ENV_KEYS_BY_METHOD = {
   none: [],
   oauth: ["REPLICAS_CODEX_AUTH_METHOD"],
-  api_key: ["OPENAI_API_KEY", "REPLICAS_CODEX_AUTH_METHOD"],
+  api_key: [
+    "OPENAI_API_KEY",
+    "CODEX_OPENAI_BASE_URL",
+    "CODEX_OPENAI_AUTHORIZATION_HEADER",
+    "REPLICAS_CODEX_AUTH_METHOD"
+  ],
   bedrock: [],
   foundry: ["AZURE_OPENAI_API_KEY", "CODEX_FOUNDRY_BASE_URL", "CODEX_FOUNDRY_MODEL", "REPLICAS_CODEX_AUTH_METHOD"]
 };

package/dist/src/{chunk-3Z7CQNGC.js → chunk-TRGZSX4W.js}

@@ -7,15 +7,12 @@ import {
   agentCredentialSnapshotSchema,
   createErrorResult,
   createSuccessResult,
-  extractCommandProtectionCommandText,
   fallbackPlanResponseSchema,
-  findGitCommitSignals,
-  findPrMergeSignals,
   isRecord,
   isValidAgentProvider,
   parsePosixEnvFile,
   readReplicasRuntimeEnv
-} from "./chunk-YPAI4W4G.js";
+} from "./chunk-Q6F7J5DH.js";
 
 // src/engine-env.ts
 import { readFileSync as readFileSync2 } from "fs";
@@ -129,6 +126,8 @@ function loadEngineEnv() {
     REPLICAS_SLACK_THREAD_TS: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.slackThreadTs),
     ANTHROPIC_API_KEY: readEnv("ANTHROPIC_API_KEY"),
     OPENAI_API_KEY: readEnv("OPENAI_API_KEY"),
+    CODEX_OPENAI_BASE_URL: readEnv("CODEX_OPENAI_BASE_URL"),
+    CODEX_OPENAI_AUTHORIZATION_HEADER: readEnv("CODEX_OPENAI_AUTHORIZATION_HEADER"),
     CURSOR_API_KEY: readEnv("CURSOR_API_KEY"),
     AI_GATEWAY_API_KEY: readEnv("AI_GATEWAY_API_KEY"),
     CLAUDE_CODE_USE_BEDROCK: readEnv("CLAUDE_CODE_USE_BEDROCK"),
@@ -232,71 +231,10 @@ var MonolithService = class {
 };
 var monolithService = new MonolithService();
 
-// src/services/command-protection-service.ts
-var DEFAULT_COMMAND_PROTECTION_BLOCK_MESSAGE = "Blocked by Replicas command protection.";
-function asCommandProtectionResponse(value) {
-  if (typeof value !== "object" || value === null) return null;
-  const candidate = value;
-  return typeof candidate.allowed === "boolean" && typeof candidate.enabled === "boolean" ? candidate : null;
-}
-function failClosed(reason, matchedSignals) {
-  return {
-    allowed: false,
-    enabled: true,
-    reason,
-    matchedSignals
-  };
-}
-async function evaluateCommandProtection(request, signal) {
-  const matchedSignals = [...findGitCommitSignals(request), ...findPrMergeSignals(request)];
-  if (matchedSignals.length === 0) {
-    return { allowed: true, enabled: true };
-  }
-  let response;
-  try {
-    response = await monolithRequest("/v1/engine/command-protection/evaluate", {
-      body: request,
-      signal
-    });
-  } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
-    return failClosed(`Command protection failed closed: ${detail}`, matchedSignals);
-  }
-  if (!response.ok) {
-    const detail = await response.text().catch(() => "");
-    return failClosed(`Command protection failed closed: ${response.status} ${detail}`, matchedSignals);
-  }
-  let payload;
-  try {
-    payload = await response.json();
-  } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
-    return failClosed(`Command protection failed closed: ${detail}`, matchedSignals);
-  }
-  return asCommandProtectionResponse(payload) ?? failClosed("Command protection failed closed: invalid response from policy service", matchedSignals);
-}
-function extractToolCommand(input) {
-  return extractCommandProtectionCommandText({ toolInput: input }, { stringifyFallback: false });
-}
-function reportCommandProtectionBlock(options) {
-  const message = options.result.reason || DEFAULT_COMMAND_PROTECTION_BLOCK_MESSAGE;
-  console.warn(`[${options.managerName}] blocked ${options.action} by command protection: ${message}`);
-  options.recordHistoryEvent(options.eventType, {
-    type: "error",
-    message,
-    ...options.context,
-    command: options.command
-  }, options.historyFile);
-  return message;
-}
-
 export {
   IS_WARMING_MODE,
   ENGINE_ENV,
   setAgentCredentialSnapshot,
   monolithRequest,
-  monolithService,
-  evaluateCommandProtection,
-  extractToolCommand,
-  reportCommandProtectionBlock
+  monolithService
 };