replicas-engine 0.1.740 → 0.1.741

package/dist/src/chunk-UUKFVYYJ.js

@@ -0,0 +1,419 @@
+#!/usr/bin/env node
+import {
+  ENGINE_ENV,
+  monolithRequest,
+  setAgentCredentialSnapshot
+} from "./chunk-TRGZSX4W.js";
+import {
+  AppServerProcess,
+  buildCodexAgentEnv
+} from "./chunk-ESGIWRVV.js";
+import {
+  CODEX_AUTH_ENV_KEYS,
+  CODEX_AUTH_ENV_KEYS_BY_METHOD,
+  codexAuthEnvFromResponse,
+  createErrorResult,
+  createSuccessResult
+} from "./chunk-Q6F7J5DH.js";
+
+// src/managers/codex-token-manager.ts
+import { promises as fs } from "fs";
+import path from "path";
+
+// src/managers/auth-env-transition.ts
+function applyAuthEnvTransition(params) {
+  const newOwned = new Set(params.authKeysByMethod[params.newMethod]);
+  const prevOwned = new Set(params.authKeysByMethod[params.prevMethod]);
+  for (const key of params.authKeys) {
+    const value = params.newEnvVars[key];
+    if (value !== void 0) {
+      for (const env of params.envs) {
+        env[key] = value;
+      }
+    } else if (prevOwned.has(key) && !newOwned.has(key)) {
+      for (const env of params.envs) {
+        delete env[key];
+      }
+    }
+  }
+}
+
+// src/services/credential-fallbacks.ts
+var fallbacksByAgent = /* @__PURE__ */ new Map();
+var exhaustedByAgent = /* @__PURE__ */ new Map();
+function recordCredentialFallback(notice) {
+  fallbacksByAgent.set(notice.provider, notice);
+}
+function listCredentialFallbacks() {
+  return [...fallbacksByAgent.values()].filter((notice) => {
+    const live = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS[notice.provider];
+    if (!live) return false;
+    return notice.status === "switched" ? live.method === notice.candidateMethod && live.scope === notice.candidateScope : live.method === notice.exhaustedMethod && live.scope === notice.exhaustedScope;
+  });
+}
+function listExhaustedCredentials(provider) {
+  return [...exhaustedByAgent.get(provider)?.values() ?? []];
+}
+function recordExhaustedCredential(provider, credential) {
+  const spent = exhaustedByAgent.get(provider) ?? /* @__PURE__ */ new Map();
+  spent.set(`${credential.method}|${credential.scope}`, credential);
+  exhaustedByAgent.set(provider, spent);
+}
+
+// src/managers/base-refresh-manager.ts
+var BaseRefreshManager = class {
+  constructor(managerName, intervalMs = 15 * 60 * 1e3) {
+    this.managerName = managerName;
+    this.intervalMs = intervalMs;
+    this.health = {
+      isRunning: false,
+      intervalMs: this.intervalMs,
+      lastAttemptAt: null,
+      lastSuccessAt: null,
+      lastErrorAt: null,
+      lastErrorMessage: null
+    };
+  }
+  managerName;
+  intervalMs;
+  intervalHandle = null;
+  health;
+  async start() {
+    if (this.intervalHandle) {
+      return;
+    }
+    const skipReason = this.getSkipReason();
+    if (skipReason) {
+      console.log(`[${this.managerName}] Skipping: ${skipReason}`);
+      return;
+    }
+    console.log(`[${this.managerName}] Starting token refresh service`);
+    this.health.isRunning = true;
+    const config = this.getRuntimeConfig();
+    if (config) {
+      this.health.lastAttemptAt = (/* @__PURE__ */ new Date()).toISOString();
+      for (let attempt = 1; attempt <= 3; attempt++) {
+        try {
+          await this.doRefresh(config);
+          this.health.lastSuccessAt = (/* @__PURE__ */ new Date()).toISOString();
+          this.health.lastErrorAt = null;
+          this.health.lastErrorMessage = null;
+          break;
+        } catch (error) {
+          const message = error instanceof Error ? error.message : "Unknown error";
+          this.health.lastErrorAt = (/* @__PURE__ */ new Date()).toISOString();
+          this.health.lastErrorMessage = message;
+          if (attempt < 3) {
+            console.warn(`[${this.managerName}] Initial refresh attempt ${attempt} failed, retrying in 2s...`);
+            await new Promise((resolve) => setTimeout(resolve, 2e3));
+          } else {
+            console.error(`[${this.managerName}] Initial refresh failed after 3 attempts:`, error);
+          }
+        }
+      }
+    }
+    this.scheduleNextRefresh();
+  }
+  async swapCredentials(params) {
+    if (!this.getRuntimeConfig()) {
+      return createErrorResult({ message: `${this.managerName} has no runtime config`, code: "not_configured" });
+    }
+    try {
+      console.log(`[${this.managerName}] Fetching fresh credentials from monolith (${params.failureKind})...`);
+      const excludeCredentials = listExhaustedCredentials(params.provider);
+      await params.refresh({
+        ...excludeCredentials.length > 0 ? { excludeCredentials } : {},
+        ...params.allowedMethods ? { allowedMethods: [...params.allowedMethods] } : {}
+      });
+      if (params.isOauthNow()) {
+        this.start().catch((error) => {
+          console.error(`[${this.managerName}] Failed to restart OAuth refresh service after fallback:`, error);
+        });
+      }
+      return createSuccessResult();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`[${this.managerName}] Failed to fetch fresh credentials:`, error);
+      return createErrorResult({
+        message,
+        code: message.includes('"code":"no_credentials"') ? "no_credentials" : "refresh_failed"
+      });
+    }
+  }
+  stop() {
+    if (!this.intervalHandle) {
+      return;
+    }
+    clearTimeout(this.intervalHandle);
+    this.intervalHandle = null;
+    this.health.isRunning = false;
+    console.log(`[${this.managerName}] Stopped`);
+  }
+  getHealthStatus() {
+    return { ...this.health };
+  }
+  getSkipReason() {
+    return null;
+  }
+  getNextRefreshDelayMs() {
+    return this.intervalMs;
+  }
+  getRuntimeConfig() {
+    if (!ENGINE_ENV.REPLICAS_WORKSPACE_ID) {
+      return null;
+    }
+    return {
+      monolithUrl: ENGINE_ENV.REPLICAS_MONOLITH_URL,
+      workspaceId: ENGINE_ENV.REPLICAS_WORKSPACE_ID,
+      engineSecret: ENGINE_ENV.REPLICAS_ENGINE_SECRET
+    };
+  }
+  scheduleNextRefresh() {
+    const delayMs = this.getNextRefreshDelayMs();
+    this.health.intervalMs = delayMs;
+    this.intervalHandle = setTimeout(async () => {
+      await this.refreshOnce();
+      if (this.intervalHandle) this.scheduleNextRefresh();
+    }, delayMs);
+    console.log(`[${this.managerName}] Token refresh scheduled in ${Math.round(delayMs / 1e3)} seconds`);
+  }
+  async refreshOnce(force = false) {
+    if (!force && this.getSkipReason()) {
+      return createSuccessResult();
+    }
+    const config = this.getRuntimeConfig();
+    if (!config) return createSuccessResult();
+    this.health.lastAttemptAt = (/* @__PURE__ */ new Date()).toISOString();
+    try {
+      await this.doRefresh(config);
+      this.health.lastSuccessAt = (/* @__PURE__ */ new Date()).toISOString();
+      this.health.lastErrorAt = null;
+      this.health.lastErrorMessage = null;
+      return createSuccessResult();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      this.health.lastErrorAt = (/* @__PURE__ */ new Date()).toISOString();
+      this.health.lastErrorMessage = message;
+      console.error(`[${this.managerName}] Failed to refresh credentials:`, error);
+      return createErrorResult({ message });
+    }
+  }
+};
+
+// src/managers/codex-token-manager.ts
+var CodexAspAuthMethodChangedError = class extends Error {
+  name = "CodexAspAuthMethodChangedError";
+};
+var CodexTokenManager = class extends BaseRefreshManager {
+  constructor() {
+    super("CodexTokenManager");
+  }
+  getSkipReason() {
+    if (!ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD && ENGINE_ENV.OPENAI_API_KEY) {
+      return "OPENAI_API_KEY is set";
+    }
+    return null;
+  }
+  async doRefresh(_config) {
+    await this.refreshWithRequest(void 0, true);
+  }
+  async refreshWithRequest(request, restartOnChange = false) {
+    const previousEnv = CODEX_AUTH_ENV_KEYS.map((key) => process.env[key]);
+    console.log("[CodexTokenManager] Refreshing Codex credentials...");
+    const response = await monolithRequest("/v1/engine/codex/refresh-credentials", {
+      body: request
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new Error(`Credentials refresh failed: ${response.status} ${errorText}`);
+    }
+    const data = await response.json();
+    await this.applyCredentialsResponse(data);
+    if (restartOnChange && CODEX_AUTH_ENV_KEYS.some((key, index) => process.env[key] !== previousEnv[index])) {
+      const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-KDEJGDMP.js");
+      await restartCodexAspHostIfRunning2();
+    }
+    if (data.scope) {
+      setAgentCredentialSnapshot("codex", {
+        method: data.type,
+        scope: data.scope,
+        ...data.revision ? { revision: data.revision } : {}
+      });
+    }
+    console.log(`[CodexTokenManager] Credentials refreshed (method=${data.type})`);
+    return data;
+  }
+  async prepareAspOauthOptions() {
+    if (ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD !== "oauth") return {};
+    const response = await this.refreshWithRequest();
+    if (response.type !== "oauth") return {};
+    const login = this.buildAspOauthLogin(response);
+    let credential = login.credential;
+    return {
+      chatgptAuthTokens: login.tokens,
+      refreshChatgptAuthTokens: async (params) => {
+        const refreshed = await this.refreshAspOauthCredentials(
+          credential,
+          `Codex ASP requested an external token refresh (${params.reason})`
+        );
+        if (!refreshed.ok) {
+          if (refreshed.error.code === "method_changed") {
+            throw new CodexAspAuthMethodChangedError(refreshed.error.message);
+          }
+          throw new Error(refreshed.error.message);
+        }
+        credential = refreshed.data.credential;
+        return refreshed.data.tokens;
+      }
+    };
+  }
+  async refreshAspOauthCredentials(failedCredential, failureReason) {
+    try {
+      const response = await this.refreshWithRequest({
+        failedMethod: "oauth",
+        ...failedCredential?.method === "oauth" ? { failedCredential } : {},
+        failureKind: "rejected",
+        failureReason
+      });
+      if (response.type !== "oauth") {
+        return createErrorResult({
+          message: `${failureReason}; credentials changed to ${response.type}, so the app server must restart`,
+          code: "method_changed"
+        });
+      }
+      return createSuccessResult(this.buildAspOauthLogin(response));
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return createErrorResult({
+        message,
+        code: message.includes('"code":"no_credentials"') ? "no_credentials" : "refresh_failed"
+      });
+    }
+  }
+  async fetchFreshCredentials(failureReason, failureKind = "rejected", failedCredential = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.codex, allowedMethods) {
+    const failedMethod = failedCredential?.method === "oauth" || failedCredential?.method === "api_key" || failedCredential?.method === "foundry" ? failedCredential.method : ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD;
+    return this.swapCredentials({
+      provider: "codex",
+      failureKind,
+      allowedMethods,
+      refresh: async (exclusions) => {
+        await this.refreshWithRequest(
+          failedMethod === "oauth" || failedMethod === "api_key" || failedMethod === "foundry" ? {
+            failedMethod,
+            ...failedCredential?.method === failedMethod ? { failedCredential } : {},
+            failureReason,
+            failureKind,
+            ...exclusions
+          } : exclusions
+        );
+      },
+      isOauthNow: () => ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "oauth"
+    });
+  }
+  async applyCredentialsResponse(response) {
+    await this.removeOauthCredentialsFile();
+    const envVars = codexAuthEnvFromResponse(response);
+    applyAuthEnvTransition({
+      prevMethod: ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD ?? "none",
+      newMethod: envVars.REPLICAS_CODEX_AUTH_METHOD ?? "none",
+      authKeys: CODEX_AUTH_ENV_KEYS,
+      authKeysByMethod: CODEX_AUTH_ENV_KEYS_BY_METHOD,
+      newEnvVars: envVars,
+      envs: [ENGINE_ENV, process.env]
+    });
+    if (response.type === "api_key") {
+      for (const key of CODEX_AUTH_ENV_KEYS_BY_METHOD.api_key) {
+        if (envVars[key] !== void 0) continue;
+        delete ENGINE_ENV[key];
+        delete process.env[key];
+      }
+    }
+  }
+  buildAspOauthLogin(response) {
+    const credential = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.codex;
+    return {
+      tokens: {
+        accessToken: response.accessToken,
+        chatgptAccountId: response.accountId,
+        chatgptPlanType: null
+      },
+      ...credential?.method === "oauth" ? { credential } : {}
+    };
+  }
+  async removeOauthCredentialsFile() {
+    const authPath = path.join(ENGINE_ENV.HOME_DIR, ".codex", "auth.json");
+    try {
+      await fs.unlink(authPath);
+    } catch (error) {
+      if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
+    }
+  }
+};
+var codexTokenManager = new CodexTokenManager();
+
+// src/managers/codex-asp/asp-host.ts
+var hostPromise = null;
+var activeProcess = null;
+var restartPromise = null;
+async function getCodexAspHost() {
+  if (restartPromise) {
+    await restartPromise;
+  }
+  hostPromise ??= (async () => {
+    try {
+      const oauthOptions = await codexTokenManager.prepareAspOauthOptions();
+      const process2 = new AppServerProcess({
+        cwd: ENGINE_ENV.WORKSPACE_ROOT,
+        env: buildCodexAgentEnv(),
+        ...oauthOptions
+      });
+      const { client } = await process2.start();
+      activeProcess = process2;
+      process2.on("exit", () => {
+        if (activeProcess === process2) {
+          activeProcess = null;
+        }
+        hostPromise = null;
+      });
+      return { client };
+    } catch (error) {
+      hostPromise = null;
+      throw error;
+    }
+  })();
+  return hostPromise;
+}
+async function restartCodexAspHost() {
+  if (restartPromise) {
+    return restartPromise;
+  }
+  restartPromise = (async () => {
+    const process2 = activeProcess;
+    hostPromise = null;
+    activeProcess = null;
+    if (process2) {
+      await process2.stop();
+    }
+  })();
+  try {
+    await restartPromise;
+  } finally {
+    restartPromise = null;
+  }
+}
+async function restartCodexAspHostIfRunning() {
+  if (activeProcess) await restartCodexAspHost();
+}
+
+export {
+  recordCredentialFallback,
+  listCredentialFallbacks,
+  recordExhaustedCredential,
+  BaseRefreshManager,
+  applyAuthEnvTransition,
+  getCodexAspHost,
+  restartCodexAspHost,
+  restartCodexAspHostIfRunning,
+  CodexAspAuthMethodChangedError,
+  codexTokenManager
+};

package/dist/src/chunk-Z6P6S5HL.js

@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+
+// src/utils/presigned-upload.ts
+import { createReadStream } from "fs";
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+async function putPresignedFile(urlValue, filePath, size, contentType) {
+  await new Promise((resolve, reject) => {
+    const url = new URL(urlValue);
+    const request = (url.protocol === "https:" ? httpsRequest : httpRequest)(url, {
+      method: "PUT",
+      headers: {
+        "content-length": String(size),
+        "content-type": contentType
+      }
+    }, (response) => {
+      response.setEncoding("utf8");
+      let body = "";
+      response.on("data", (chunk) => {
+        body += chunk;
+      });
+      response.on("end", () => {
+        const status = response.statusCode ?? 0;
+        if (status >= 200 && status < 300) resolve();
+        else reject(new Error(`upload failed: ${status} ${body}`));
+      });
+      response.on("error", reject);
+    });
+    request.on("error", reject);
+    const file = size > 0 ? createReadStream(filePath, { start: 0, end: size - 1 }) : createReadStream(filePath);
+    file.on("error", (error) => request.destroy(error));
+    file.pipe(request);
+  });
+}
+
+// src/managers/codex-asp/notification-dispatch.ts
+var TURN_STARTED_METHOD = "turn/started";
+var TURN_COMPLETED_METHOD = "turn/completed";
+var TURN_PLAN_UPDATED_METHOD = "turn/plan/updated";
+var THREAD_GOAL_UPDATED_METHOD = "thread/goal/updated";
+var THREAD_GOAL_CLEARED_METHOD = "thread/goal/cleared";
+var ITEM_STARTED_METHOD = "item/started";
+var ITEM_COMPLETED_METHOD = "item/completed";
+var AGENT_MESSAGE_DELTA_METHOD = "item/agentMessage/delta";
+var REASONING_SUMMARY_TEXT_DELTA_METHOD = "item/reasoning/summaryTextDelta";
+var REASONING_TEXT_DELTA_METHOD = "item/reasoning/textDelta";
+var REASONING_SUMMARY_PART_ADDED_METHOD = "item/reasoning/summaryPartAdded";
+var COMMAND_EXECUTION_OUTPUT_DELTA_METHOD = "item/commandExecution/outputDelta";
+var FILE_CHANGE_OUTPUT_DELTA_METHOD = "item/fileChange/outputDelta";
+var ACCOUNT_RATE_LIMITS_UPDATED_METHOD = "account/rateLimits/updated";
+var THREAD_TOKEN_USAGE_UPDATED_METHOD = "thread/tokenUsage/updated";
+var THREAD_COMPACTED_METHOD = "thread/compacted";
+var MODEL_REROUTED_METHOD = "model/rerouted";
+function dispatchAspNotification(notification, handlers) {
+  const handler = handlers[notification.method];
+  if (!handler) return;
+  handler(notification);
+}
+function recoverCompletedTurn(turn, completedItems, agentMessageDeltas) {
+  const items = turn.items.length > 0 ? [...turn.items] : [];
+  const itemIds = new Set(items.map((item) => item.id));
+  for (const item of completedItems) {
+    if (itemIds.has(item.id)) continue;
+    items.push(item);
+    itemIds.add(item.id);
+  }
+  for (const [itemId, text] of agentMessageDeltas) {
+    if (itemIds.has(itemId)) continue;
+    items.push({ type: "agentMessage", id: itemId, text, phase: null, memoryCitation: null });
+  }
+  return items.length > 0 ? { ...turn, items, itemsView: "full" } : turn;
+}
+
+export {
+  putPresignedFile,
+  TURN_STARTED_METHOD,
+  TURN_COMPLETED_METHOD,
+  TURN_PLAN_UPDATED_METHOD,
+  THREAD_GOAL_UPDATED_METHOD,
+  THREAD_GOAL_CLEARED_METHOD,
+  ITEM_STARTED_METHOD,
+  ITEM_COMPLETED_METHOD,
+  AGENT_MESSAGE_DELTA_METHOD,
+  REASONING_SUMMARY_TEXT_DELTA_METHOD,
+  REASONING_TEXT_DELTA_METHOD,
+  REASONING_SUMMARY_PART_ADDED_METHOD,
+  COMMAND_EXECUTION_OUTPUT_DELTA_METHOD,
+  FILE_CHANGE_OUTPUT_DELTA_METHOD,
+  ACCOUNT_RATE_LIMITS_UPDATED_METHOD,
+  THREAD_TOKEN_USAGE_UPDATED_METHOD,
+  THREAD_COMPACTED_METHOD,
+  MODEL_REROUTED_METHOD,
+  dispatchAspNotification,
+  recoverCompletedTurn
+};

package/dist/src/command-protection-hook.js

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import {
   evaluateCommandProtection
-} from "./chunk-3Z7CQNGC.js";
+} from "./chunk-25CMFABL.js";
+import "./chunk-TRGZSX4W.js";
 import {
   isRecord
 } from "./chunk-2RB7SIP3.js";
-import "./chunk-YPAI4W4G.js";
+import "./chunk-Q6F7J5DH.js";
 
 // src/command-protection-hook.ts
 var provider = process.argv[2];

package/dist/src/deepseek-command-protection-plugin.js

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 import {
   evaluateCommandProtection
-} from "./chunk-3Z7CQNGC.js";
+} from "./chunk-25CMFABL.js";
 import {
   notifyPostToolUse
-} from "./chunk-7SUFESKA.js";
+} from "./chunk-6O6BPV7Q.js";
+import "./chunk-TRGZSX4W.js";
 import "./chunk-2RB7SIP3.js";
-import "./chunk-YPAI4W4G.js";
+import "./chunk-Q6F7J5DH.js";
 
 // src/deepseek-command-protection-plugin.ts
 function replicasCommandProtection(context) {

package/dist/src/headless-agent.js

@@ -1,15 +1,17 @@
 #!/usr/bin/env node
 import {
-  AppServerProcess,
-  buildCodexAgentEnv,
   putPresignedFile,
   recoverCompletedTurn
-} from "./chunk-ZZRN6VSK.js";
+} from "./chunk-Z6P6S5HL.js";
+import {
+  AppServerProcess,
+  buildCodexAgentEnv
+} from "./chunk-ESGIWRVV.js";
 import {
   AGENT,
   getMemoryOutputSafetyViolation,
   headlessAgentRequestSchema
-} from "./chunk-YPAI4W4G.js";
+} from "./chunk-Q6F7J5DH.js";
 
 // src/headless-agent.ts
 import { createHash } from "crypto";