replicas-engine 0.1.740 → 0.1.741

package/dist/src/index.js

@@ -1,19 +1,12 @@
 #!/usr/bin/env node
 import {
-  ENGINE_ENV,
-  IS_WARMING_MODE,
   evaluateCommandProtection,
   extractToolCommand,
-  monolithRequest,
-  monolithService,
-  reportCommandProtectionBlock,
-  setAgentCredentialSnapshot
-} from "./chunk-3Z7CQNGC.js";
+  reportCommandProtectionBlock
+} from "./chunk-25CMFABL.js";
 import {
   ACCOUNT_RATE_LIMITS_UPDATED_METHOD,
   AGENT_MESSAGE_DELTA_METHOD,
-  AppServerProcess,
-  AspClient,
   COMMAND_EXECUTION_OUTPUT_DELTA_METHOD,
   FILE_CHANGE_OUTPUT_DELTA_METHOD,
   ITEM_COMPLETED_METHOD,
@@ -22,7 +15,6 @@ import {
   REASONING_SUMMARY_PART_ADDED_METHOD,
   REASONING_SUMMARY_TEXT_DELTA_METHOD,
   REASONING_TEXT_DELTA_METHOD,
-  SUBPROCESS_MAX_BUFFER,
   THREAD_COMPACTED_METHOD,
   THREAD_GOAL_CLEARED_METHOD,
   THREAD_GOAL_UPDATED_METHOD,
@@ -30,13 +22,34 @@ import {
   TURN_COMPLETED_METHOD,
   TURN_PLAN_UPDATED_METHOD,
   TURN_STARTED_METHOD,
-  buildCodexAgentEnv,
   dispatchAspNotification,
-  execAsync,
-  execFileAsync,
   putPresignedFile,
   recoverCompletedTurn
-} from "./chunk-ZZRN6VSK.js";
+} from "./chunk-Z6P6S5HL.js";
+import {
+  BaseRefreshManager,
+  CodexAspAuthMethodChangedError,
+  applyAuthEnvTransition,
+  codexTokenManager,
+  getCodexAspHost,
+  listCredentialFallbacks,
+  recordCredentialFallback,
+  recordExhaustedCredential,
+  restartCodexAspHost
+} from "./chunk-UUKFVYYJ.js";
+import {
+  ENGINE_ENV,
+  IS_WARMING_MODE,
+  monolithRequest,
+  monolithService,
+  setAgentCredentialSnapshot
+} from "./chunk-TRGZSX4W.js";
+import {
+  AspClient,
+  SUBPROCESS_MAX_BUFFER,
+  execAsync,
+  execFileAsync
+} from "./chunk-ESGIWRVV.js";
 import {
   isRecord as isRecord2
 } from "./chunk-2RB7SIP3.js";
@@ -70,8 +83,6 @@ import {
   CLAUDE_SONNET_5_BEDROCK_MODEL,
   CLAUDE_SONNET_5_MODEL,
   CODEX_ASP_TRANSCRIPT_UPDATED_EVENT_TYPE,
-  CODEX_AUTH_ENV_KEYS,
-  CODEX_AUTH_ENV_KEYS_BY_METHOD,
   CODEX_QUOTA_STATUS_EVENT_TYPE,
   COMPACTION_STATUS_EVENT_TYPE,
   CONTEXT_USAGE_EVENT_TYPE,
@@ -132,7 +143,6 @@ import {
   clampWarmHookTimeoutMs,
   classifyCanvasFilename,
   claudeAuthEnvFromResponse,
-  codexAuthEnvFromResponse,
   codexReasoningEffortForThinkingLevel,
   coerceBackgroundTaskPayload,
   coerceChatForkInfo,
@@ -230,7 +240,7 @@ import {
   shellQuotePosix,
   stripAgentDiagnosticErrors,
   withTimeout
-} from "./chunk-YPAI4W4G.js";
+} from "./chunk-Q6F7J5DH.js";
 
 // src/index.ts
 import { serve } from "@hono/node-server";
@@ -242,168 +252,6 @@ import { connect } from "net";
 // src/managers/github-token-manager.ts
 import path from "path";
 
-// src/services/credential-fallbacks.ts
-var fallbacksByAgent = /* @__PURE__ */ new Map();
-var exhaustedByAgent = /* @__PURE__ */ new Map();
-function recordCredentialFallback(notice) {
-  fallbacksByAgent.set(notice.provider, notice);
-}
-function listCredentialFallbacks() {
-  return [...fallbacksByAgent.values()].filter((notice) => {
-    const live = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS[notice.provider];
-    if (!live) return false;
-    return notice.status === "switched" ? live.method === notice.candidateMethod && live.scope === notice.candidateScope : live.method === notice.exhaustedMethod && live.scope === notice.exhaustedScope;
-  });
-}
-function listExhaustedCredentials(provider) {
-  return [...exhaustedByAgent.get(provider)?.values() ?? []];
-}
-function recordExhaustedCredential(provider, credential) {
-  const spent = exhaustedByAgent.get(provider) ?? /* @__PURE__ */ new Map();
-  spent.set(`${credential.method}|${credential.scope}`, credential);
-  exhaustedByAgent.set(provider, spent);
-}
-
-// src/managers/base-refresh-manager.ts
-var BaseRefreshManager = class {
-  constructor(managerName, intervalMs = 15 * 60 * 1e3) {
-    this.managerName = managerName;
-    this.intervalMs = intervalMs;
-    this.health = {
-      isRunning: false,
-      intervalMs: this.intervalMs,
-      lastAttemptAt: null,
-      lastSuccessAt: null,
-      lastErrorAt: null,
-      lastErrorMessage: null
-    };
-  }
-  managerName;
-  intervalMs;
-  intervalHandle = null;
-  health;
-  async start() {
-    if (this.intervalHandle) {
-      return;
-    }
-    const skipReason = this.getSkipReason();
-    if (skipReason) {
-      console.log(`[${this.managerName}] Skipping: ${skipReason}`);
-      return;
-    }
-    console.log(`[${this.managerName}] Starting token refresh service`);
-    this.health.isRunning = true;
-    const config = this.getRuntimeConfig();
-    if (config) {
-      this.health.lastAttemptAt = (/* @__PURE__ */ new Date()).toISOString();
-      for (let attempt = 1; attempt <= 3; attempt++) {
-        try {
-          await this.doRefresh(config);
-          this.health.lastSuccessAt = (/* @__PURE__ */ new Date()).toISOString();
-          this.health.lastErrorAt = null;
-          this.health.lastErrorMessage = null;
-          break;
-        } catch (error) {
-          const message = error instanceof Error ? error.message : "Unknown error";
-          this.health.lastErrorAt = (/* @__PURE__ */ new Date()).toISOString();
-          this.health.lastErrorMessage = message;
-          if (attempt < 3) {
-            console.warn(`[${this.managerName}] Initial refresh attempt ${attempt} failed, retrying in 2s...`);
-            await new Promise((resolve5) => setTimeout(resolve5, 2e3));
-          } else {
-            console.error(`[${this.managerName}] Initial refresh failed after 3 attempts:`, error);
-          }
-        }
-      }
-    }
-    this.scheduleNextRefresh();
-  }
-  async swapCredentials(params) {
-    if (!this.getRuntimeConfig()) {
-      return createErrorResult({ message: `${this.managerName} has no runtime config`, code: "not_configured" });
-    }
-    try {
-      console.log(`[${this.managerName}] Fetching fresh credentials from monolith (${params.failureKind})...`);
-      const excludeCredentials = listExhaustedCredentials(params.provider);
-      await params.refresh({
-        ...excludeCredentials.length > 0 ? { excludeCredentials } : {},
-        ...params.allowedMethods ? { allowedMethods: [...params.allowedMethods] } : {}
-      });
-      if (params.isOauthNow()) {
-        this.start().catch((error) => {
-          console.error(`[${this.managerName}] Failed to restart OAuth refresh service after fallback:`, error);
-        });
-      }
-      return createSuccessResult();
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      console.error(`[${this.managerName}] Failed to fetch fresh credentials:`, error);
-      return createErrorResult({
-        message,
-        code: message.includes('"code":"no_credentials"') ? "no_credentials" : "refresh_failed"
-      });
-    }
-  }
-  stop() {
-    if (!this.intervalHandle) {
-      return;
-    }
-    clearTimeout(this.intervalHandle);
-    this.intervalHandle = null;
-    this.health.isRunning = false;
-    console.log(`[${this.managerName}] Stopped`);
-  }
-  getHealthStatus() {
-    return { ...this.health };
-  }
-  getSkipReason() {
-    return null;
-  }
-  getNextRefreshDelayMs() {
-    return this.intervalMs;
-  }
-  getRuntimeConfig() {
-    if (!ENGINE_ENV.REPLICAS_WORKSPACE_ID) {
-      return null;
-    }
-    return {
-      monolithUrl: ENGINE_ENV.REPLICAS_MONOLITH_URL,
-      workspaceId: ENGINE_ENV.REPLICAS_WORKSPACE_ID,
-      engineSecret: ENGINE_ENV.REPLICAS_ENGINE_SECRET
-    };
-  }
-  scheduleNextRefresh() {
-    const delayMs = this.getNextRefreshDelayMs();
-    this.health.intervalMs = delayMs;
-    this.intervalHandle = setTimeout(async () => {
-      await this.refreshOnce();
-      if (this.intervalHandle) this.scheduleNextRefresh();
-    }, delayMs);
-    console.log(`[${this.managerName}] Token refresh scheduled in ${Math.round(delayMs / 1e3)} seconds`);
-  }
-  async refreshOnce() {
-    if (this.getSkipReason()) {
-      return createSuccessResult();
-    }
-    const config = this.getRuntimeConfig();
-    if (!config) return createSuccessResult();
-    this.health.lastAttemptAt = (/* @__PURE__ */ new Date()).toISOString();
-    try {
-      await this.doRefresh(config);
-      this.health.lastSuccessAt = (/* @__PURE__ */ new Date()).toISOString();
-      this.health.lastErrorAt = null;
-      this.health.lastErrorMessage = null;
-      return createSuccessResult();
-    } catch (error) {
-      const message = error instanceof Error ? error.message : "Unknown error";
-      this.health.lastErrorAt = (/* @__PURE__ */ new Date()).toISOString();
-      this.health.lastErrorMessage = message;
-      console.error(`[${this.managerName}] Failed to refresh credentials:`, error);
-      return createErrorResult({ message });
-    }
-  }
-};
-
 // src/utils/file.ts
 import { randomUUID } from "crypto";
 import { mkdir, readFile, rename, unlink, writeFile } from "fs/promises";
@@ -423,11 +271,11 @@ var AsyncLock = class {
 };
 
 // src/utils/file.ts
-async function atomicWriteFile(path6, data, options) {
-  const tmpFile = `${path6}.${process.pid}.${randomUUID()}.tmp`;
+async function atomicWriteFile(path5, data, options) {
+  const tmpFile = `${path5}.${process.pid}.${randomUUID()}.tmp`;
   try {
     await writeFile(tmpFile, data, { encoding: "utf-8", mode: options?.mode });
-    await rename(tmpFile, path6);
+    await rename(tmpFile, path5);
   } catch (error) {
     await unlink(tmpFile).catch(() => void 0);
     throw error;
@@ -850,9 +698,9 @@ var GitService = class {
     try {
       const paths = await this.listUntrackedPaths(repoPath);
       let total = 0;
-      for (const path6 of paths) {
+      for (const path5 of paths) {
         try {
-          const contents = await readFile3(join4(repoPath, path6));
+          const contents = await readFile3(join4(repoPath, path5));
           if (contents.length === 0 || contents.includes(0)) {
             continue;
           }
@@ -1108,9 +956,9 @@ var GitService = class {
     await saveRepoState(repo.name, state, state);
     return state;
   }
-  async safeStat(path6) {
+  async safeStat(path5) {
     try {
-      return await stat(path6);
+      return await stat(path5);
     } catch {
       return null;
     }
@@ -1261,26 +1109,6 @@ var gitlabTokenManager = new GitLabTokenManager();
 // src/managers/claude-token-manager.ts
 import { promises as fs } from "fs";
 import path3 from "path";
-
-// src/managers/auth-env-transition.ts
-function applyAuthEnvTransition(params) {
-  const newOwned = new Set(params.authKeysByMethod[params.newMethod]);
-  const prevOwned = new Set(params.authKeysByMethod[params.prevMethod]);
-  for (const key of params.authKeys) {
-    const value = params.newEnvVars[key];
-    if (value !== void 0) {
-      for (const env of params.envs) {
-        env[key] = value;
-      }
-    } else if (prevOwned.has(key) && !newOwned.has(key)) {
-      for (const env of params.envs) {
-        delete env[key];
-      }
-    }
-  }
-}
-
-// src/managers/claude-token-manager.ts
 var ClaudeTokenManager = class extends BaseRefreshManager {
   constructor() {
     super("ClaudeTokenManager");
@@ -1385,153 +1213,9 @@ var ClaudeTokenManager = class extends BaseRefreshManager {
 };
 var claudeTokenManager = new ClaudeTokenManager();
 
-// src/managers/codex-token-manager.ts
-import { promises as fs2 } from "fs";
-import path4 from "path";
-var CodexAspAuthMethodChangedError = class extends Error {
-  name = "CodexAspAuthMethodChangedError";
-};
-var CodexTokenManager = class extends BaseRefreshManager {
-  constructor() {
-    super("CodexTokenManager");
-  }
-  getSkipReason() {
-    if (ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "api_key" || ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "foundry") {
-      return `auth method is ${ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD}`;
-    }
-    if (!ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD && ENGINE_ENV.OPENAI_API_KEY) {
-      return "OPENAI_API_KEY is set";
-    }
-    return null;
-  }
-  async doRefresh(_config) {
-    await this.refreshWithRequest();
-  }
-  async refreshWithRequest(request) {
-    console.log("[CodexTokenManager] Refreshing Codex credentials...");
-    const response = await monolithRequest("/v1/engine/codex/refresh-credentials", {
-      body: request
-    });
-    if (!response.ok) {
-      const errorText = await response.text();
-      throw new Error(`Credentials refresh failed: ${response.status} ${errorText}`);
-    }
-    const data = await response.json();
-    await this.applyCredentialsResponse(data);
-    if (data.scope) {
-      setAgentCredentialSnapshot("codex", {
-        method: data.type,
-        scope: data.scope,
-        ...data.revision ? { revision: data.revision } : {}
-      });
-    }
-    console.log(`[CodexTokenManager] Credentials refreshed (method=${data.type})`);
-    return data;
-  }
-  async prepareAspOauthOptions() {
-    if (ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD !== "oauth") return {};
-    const response = await this.refreshWithRequest();
-    if (response.type !== "oauth") return {};
-    const login = this.buildAspOauthLogin(response);
-    let credential = login.credential;
-    return {
-      chatgptAuthTokens: login.tokens,
-      refreshChatgptAuthTokens: async (params) => {
-        const refreshed = await this.refreshAspOauthCredentials(
-          credential,
-          `Codex ASP requested an external token refresh (${params.reason})`
-        );
-        if (!refreshed.ok) {
-          if (refreshed.error.code === "method_changed") {
-            throw new CodexAspAuthMethodChangedError(refreshed.error.message);
-          }
-          throw new Error(refreshed.error.message);
-        }
-        credential = refreshed.data.credential;
-        return refreshed.data.tokens;
-      }
-    };
-  }
-  async refreshAspOauthCredentials(failedCredential, failureReason) {
-    try {
-      const response = await this.refreshWithRequest({
-        failedMethod: "oauth",
-        ...failedCredential?.method === "oauth" ? { failedCredential } : {},
-        failureKind: "rejected",
-        failureReason
-      });
-      if (response.type !== "oauth") {
-        return createErrorResult({
-          message: `${failureReason}; credentials changed to ${response.type}, so the app server must restart`,
-          code: "method_changed"
-        });
-      }
-      return createSuccessResult(this.buildAspOauthLogin(response));
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      return createErrorResult({
-        message,
-        code: message.includes('"code":"no_credentials"') ? "no_credentials" : "refresh_failed"
-      });
-    }
-  }
-  async fetchFreshCredentials(failureReason, failureKind = "rejected", failedCredential = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.codex, allowedMethods) {
-    const failedMethod = failedCredential?.method === "oauth" || failedCredential?.method === "api_key" || failedCredential?.method === "foundry" ? failedCredential.method : ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD;
-    return this.swapCredentials({
-      provider: "codex",
-      failureKind,
-      allowedMethods,
-      refresh: async (exclusions) => {
-        await this.refreshWithRequest(
-          failedMethod === "oauth" || failedMethod === "api_key" || failedMethod === "foundry" ? {
-            failedMethod,
-            ...failedCredential?.method === failedMethod ? { failedCredential } : {},
-            failureReason,
-            failureKind,
-            ...exclusions
-          } : exclusions
-        );
-      },
-      isOauthNow: () => ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "oauth"
-    });
-  }
-  async applyCredentialsResponse(response) {
-    await this.removeOauthCredentialsFile();
-    const envVars = codexAuthEnvFromResponse(response);
-    applyAuthEnvTransition({
-      prevMethod: ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD ?? "none",
-      newMethod: envVars.REPLICAS_CODEX_AUTH_METHOD ?? "none",
-      authKeys: CODEX_AUTH_ENV_KEYS,
-      authKeysByMethod: CODEX_AUTH_ENV_KEYS_BY_METHOD,
-      newEnvVars: envVars,
-      envs: [ENGINE_ENV, process.env]
-    });
-  }
-  buildAspOauthLogin(response) {
-    const credential = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.codex;
-    return {
-      tokens: {
-        accessToken: response.accessToken,
-        chatgptAccountId: response.accountId,
-        chatgptPlanType: null
-      },
-      ...credential?.method === "oauth" ? { credential } : {}
-    };
-  }
-  async removeOauthCredentialsFile() {
-    const authPath = path4.join(ENGINE_ENV.HOME_DIR, ".codex", "auth.json");
-    try {
-      await fs2.unlink(authPath);
-    } catch (error) {
-      if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
-    }
-  }
-};
-var codexTokenManager = new CodexTokenManager();
-
 // src/managers/infisical-token-manager.ts
 import { rm } from "fs/promises";
-import path5 from "path";
+import path4 from "path";
 var InfisicalTokenManager = class extends BaseRefreshManager {
   constructor(request = monolithRequest, paths = {
     homeDir: ENGINE_ENV.HOME_DIR,
@@ -1559,8 +1243,8 @@ var InfisicalTokenManager = class extends BaseRefreshManager {
   }
 };
 async function applyInfisicalCredentials(data, paths) {
-  const credentialPath = path5.join(paths.homeDir, ".replicas", "infisical-env.sh");
-  const configPath = path5.join(paths.workspaceRoot, ".infisical.json");
+  const credentialPath = path4.join(paths.homeDir, ".replicas", "infisical-env.sh");
+  const configPath = path4.join(paths.workspaceRoot, ".infisical.json");
   if (!data.configured) {
     delete process.env.INFISICAL_TOKEN;
     delete process.env.INFISICAL_DOMAIN;
@@ -1602,8 +1286,8 @@ var StreamWriter = class {
   backpressured = false;
   droppedCount = 0;
   flushTimer = null;
-  open(path6, highWaterMark = DEFAULT_HIGH_WATER) {
-    this.stream = createWriteStream(path6, { flags: "a", highWaterMark });
+  open(path5, highWaterMark = DEFAULT_HIGH_WATER) {
+    this.stream = createWriteStream(path5, { flags: "a", highWaterMark });
     this.stream.on("error", () => {
       this.stream = null;
     });
@@ -3346,7 +3030,7 @@ async function saveNormalizedImagesToTempFiles(images, tempImageDir = join13(hom
   return tempPaths;
 }
 async function removeTempImageFiles(paths) {
-  await Promise.allSettled(paths.map((path6) => unlink2(path6)));
+  await Promise.allSettled(paths.map((path5) => unlink2(path5)));
 }
 
 // src/managers/coding-agent-manager.ts
@@ -4216,7 +3900,7 @@ async function getSkillRegistryInventory(homeDir) {
 async function buildClaudeRegistryConfig(homeDir) {
   const inventory = await getSkillRegistryInventory(homeDir);
   return {
-    plugins: inventory.claudePluginRoots.map((path6) => ({ type: "local", path: path6 })),
+    plugins: inventory.claudePluginRoots.map((path5) => ({ type: "local", path: path5 })),
     enableAllSkills: inventory.claudePluginRoots.length > 0 || inventory.standaloneSkills.length > 0
   };
 }
@@ -4374,31 +4058,31 @@ function uniqueStandaloneSkills(skills) {
   }
   return unique;
 }
-async function safeReadDir(path6) {
+async function safeReadDir(path5) {
   try {
-    return await readdir3(path6, { withFileTypes: true });
+    return await readdir3(path5, { withFileTypes: true });
   } catch (error) {
     if (isNotFoundError(error)) return [];
     throw error;
   }
 }
-async function isDirectoryDirent(dirent, path6) {
+async function isDirectoryDirent(dirent, path5) {
   if (dirent.isDirectory()) return true;
   if (!dirent.isSymbolicLink()) return false;
-  return directoryExists(path6);
+  return directoryExists(path5);
 }
-async function directoryExists(path6) {
+async function directoryExists(path5) {
   try {
-    const pathStat = await stat2(path6);
+    const pathStat = await stat2(path5);
     return pathStat.isDirectory();
   } catch (error) {
     if (isNotFoundError(error)) return false;
     throw error;
   }
 }
-async function fileExists(path6) {
+async function fileExists(path5) {
   try {
-    const pathStat = await stat2(path6);
+    const pathStat = await stat2(path5);
     return pathStat.isFile();
   } catch (error) {
     if (isNotFoundError(error)) return false;
@@ -5880,57 +5564,6 @@ var ClaudeManager = class _ClaudeManager extends CodingAgentManager {
 import { readdir as readdir4 } from "fs/promises";
 import { join as join18 } from "path";
 
-// src/managers/codex-asp/asp-host.ts
-var hostPromise = null;
-var activeProcess = null;
-var restartPromise = null;
-async function getCodexAspHost() {
-  if (restartPromise) {
-    await restartPromise;
-  }
-  hostPromise ??= (async () => {
-    try {
-      const oauthOptions = await codexTokenManager.prepareAspOauthOptions();
-      const process2 = new AppServerProcess({
-        cwd: ENGINE_ENV.WORKSPACE_ROOT,
-        env: buildCodexAgentEnv(),
-        ...oauthOptions
-      });
-      const { client: client2 } = await process2.start();
-      activeProcess = process2;
-      process2.on("exit", () => {
-        if (activeProcess === process2) {
-          activeProcess = null;
-        }
-        hostPromise = null;
-      });
-      return { client: client2 };
-    } catch (error) {
-      hostPromise = null;
-      throw error;
-    }
-  })();
-  return hostPromise;
-}
-async function restartCodexAspHost() {
-  if (restartPromise) {
-    return restartPromise;
-  }
-  restartPromise = (async () => {
-    const process2 = activeProcess;
-    hostPromise = null;
-    activeProcess = null;
-    if (process2) {
-      await process2.stop();
-    }
-  })();
-  try {
-    await restartPromise;
-  } finally {
-    restartPromise = null;
-  }
-}
-
 // src/utils/codex-quota.ts
 function buildCodexRateLimitsSnapshot(fields) {
   if (fields.authMethod !== "oauth") return null;
@@ -6114,16 +5747,16 @@ function transcriptItemsForTurn(turn) {
   const otherItems = turn.items.filter((item) => item.type !== "userMessage");
   return [...userItems, ...otherItems];
 }
-function userImageForLocalPath(path6) {
-  const cached = localImageCache.get(path6);
+function userImageForLocalPath(path5) {
+  const cached = localImageCache.get(path5);
   if (cached) return cached;
-  if (!existsSync7(path6)) return null;
+  if (!existsSync7(path5)) return null;
   const image = {
     type: "image",
-    mediaType: inferMediaType(path6),
-    data: readFileSync3(path6).toString("base64")
+    mediaType: inferMediaType(path5),
+    data: readFileSync3(path5).toString("base64")
   };
-  if (image.data.length > 0) localImageCache.set(path6, image);
+  if (image.data.length > 0) localImageCache.set(path5, image);
   return image;
 }
 function userImagesForInput(input) {
@@ -6521,9 +6154,9 @@ async function buildTurnInput(request) {
   }
   const normalizedImages = await normalizeImages(request.images);
   const tempImagePaths = await saveNormalizedImagesToTempFiles(normalizedImages);
-  input.push(...tempImagePaths.map((path6) => ({
+  input.push(...tempImagePaths.map((path5) => ({
     type: "localImage",
-    path: path6
+    path: path5
   })));
   return { input, tempImagePaths };
 }
@@ -8113,12 +7746,12 @@ var postToolHookPath = [
   join19(moduleDirectory, "post-tool-pr-hook.js"),
   join19(moduleDirectory, "..", "post-tool-pr-hook.ts")
 ].find(existsSync8);
-function shellCommand(path6, provider) {
-  if (!path6) throw new Error("Replicas hook executable is missing.");
+function shellCommand(path5, provider) {
+  if (!path5) throw new Error("Replicas hook executable is missing.");
   const args = [
     process.execPath,
-    ...path6.endsWith(".ts") && basename(process.execPath) !== "bun" ? ["--import", "tsx"] : [],
-    path6,
+    ...path5.endsWith(".ts") && basename(process.execPath) !== "bun" ? ["--import", "tsx"] : [],
+    path5,
     ...provider ? [provider] : []
   ];
   return args.map((value) => `'${value.replaceAll("'", "'\\''")}'`).join(" ");
@@ -8132,10 +7765,10 @@ function getPostToolPrHookPath() {
   return postToolHookPath;
 }
 async function ensureCursorCommandProtectionHook() {
-  const path6 = join19(ENGINE_ENV.HOME_DIR, ".cursor", "hooks.json");
+  const path5 = join19(ENGINE_ENV.HOME_DIR, ".cursor", "hooks.json");
   let config = {};
   try {
-    const parsed = JSON.parse(await readFile10(path6, "utf8"));
+    const parsed = JSON.parse(await readFile10(path5, "utf8"));
     if (!isRecord2(parsed)) throw new Error("Invalid Cursor hooks configuration.");
     config = parsed;
   } catch (error) {
@@ -8152,17 +7785,17 @@ async function ensureCursorCommandProtectionHook() {
     ...existingPost.filter((entry) => !isRecord2(entry) || typeof entry.command !== "string" || !entry.command.includes("post-tool-pr-hook")),
     { command: shellCommand(postToolHookPath) }
   ];
-  await mkdir11(dirname5(path6), { recursive: true });
-  await writeFile6(path6, `${JSON.stringify({ ...config, version: 1, hooks }, null, 2)}
+  await mkdir11(dirname5(path5), { recursive: true });
+  await writeFile6(path5, `${JSON.stringify({ ...config, version: 1, hooks }, null, 2)}
 `, "utf8");
 }
 async function ensureKimiCommandProtectionHook() {
-  const path6 = join19(ENGINE_ENV.HOME_DIR, ".kimi-code", "config.toml");
+  const path5 = join19(ENGINE_ENV.HOME_DIR, ".kimi-code", "config.toml");
   const start = "# Replicas command protection hook";
   const end = "# End Replicas command protection hook";
   let config = "";
   try {
-    config = await readFile10(path6, "utf8");
+    config = await readFile10(path5, "utf8");
   } catch (error) {
     if (!(error && typeof error === "object" && "code" in error && error.code === "ENOENT")) throw error;
   }
@@ -8181,8 +7814,8 @@ ${end}`;
   const markerEnd = config.indexOf(end, markerStart + start.length);
   config = markerStart >= 0 && markerEnd >= 0 ? `${config.slice(0, markerStart)}${block}${config.slice(markerEnd + end.length)}` : `${config.trimEnd()}${config.trim() ? "\n\n" : ""}${block}
 `;
-  await mkdir11(dirname5(path6), { recursive: true });
-  await writeFile6(path6, config, "utf8");
+  await mkdir11(dirname5(path5), { recursive: true });
+  await writeFile6(path5, config, "utf8");
 }
 
 // src/managers/cursor-manager.ts
@@ -8682,8 +8315,8 @@ var DeepseekApiClient = class extends AbstractApiClient {
     if (!execution.success) throw new Error(`DeepSeek Harness did not recognize ${line}.`);
     if (execution.data.result.kind === "error") throw new Error(execution.data.result.text ?? `DeepSeek Harness rejected ${line}.`);
   }
-  async *readWebSocket(path6, signal, schema, onOpen) {
-    const url = new URL(path6, this.baseUrl);
+  async *readWebSocket(path5, signal, schema, onOpen) {
+    const url = new URL(path5, this.baseUrl);
     url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
     const socket = new WebSocket(url);
     const inbox = [];
@@ -10970,9 +10603,9 @@ function extractTextBlocks(content, textBlockType, separator = "\n") {
   const texts = content.map((block) => block && typeof block === "object" && "type" in block && block.type === textBlockType && "text" in block && typeof block.text === "string" ? block.text : "").filter(Boolean);
   return texts.length > 0 ? texts.join(separator) : null;
 }
-async function engineFetch(path6, options) {
+async function engineFetch(path5, options) {
   const baseUrl = `http://localhost:${ENGINE_ENV.REPLICAS_ENGINE_PORT}`;
-  return fetch(`${baseUrl}${path6}`, {
+  return fetch(`${baseUrl}${path5}`, {
     ...options,
     headers: {
       "Content-Type": "application/json",
@@ -13105,10 +12738,10 @@ function unansweredRequest(blocks) {
   const answered = blocks.slice(lastUser + 1).some((block) => block.startsWith("## Agent"));
   return answered ? null : lastUserBlockText(blocks);
 }
-async function readHistoryTail(path6, maxBytes) {
+async function readHistoryTail(path5, maxBytes) {
   let handle;
   try {
-    handle = await open2(path6, "r");
+    handle = await open2(path5, "r");
   } catch (error) {
     if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return { content: "", truncated: false };
     throw error;
@@ -13745,7 +13378,7 @@ var ChatService = class {
       historyPath,
       `${historyPath}.pages.jsonl`,
       `${historyPath}.pages.index.json`
-    ].map((path6) => rm3(path6, { force: true })));
+    ].map((path5) => rm3(path5, { force: true })));
     await rm3(chatMessageSendersFilePath(persisted.id), { force: true });
     await rm3(join30(FORKS_DIR, persisted.id), { recursive: true, force: true });
   }
@@ -15665,11 +15298,11 @@ function createV1Routes(deps) {
   });
   app2.get("/repo-files/content", async (c) => {
     const repoName = c.req.query("repoName");
-    const path6 = c.req.query("path");
-    if (!repoName || !path6) {
+    const path5 = c.req.query("path");
+    if (!repoName || !path5) {
       return c.json(jsonError("repoName and path are required"), 400);
     }
-    const result = await deps.repoFileService.readFile(repoName, path6);
+    const result = await deps.repoFileService.readFile(repoName, path5);
     if (!result) {
       return c.json(jsonError("File not found"), 404);
     }
@@ -15677,12 +15310,12 @@ function createV1Routes(deps) {
   });
   app2.put("/repo-files/content", async (c) => {
     const repoName = c.req.query("repoName");
-    const path6 = c.req.query("path");
-    if (!repoName || !path6) {
+    const path5 = c.req.query("path");
+    if (!repoName || !path5) {
       return c.json(jsonError("repoName and path are required"), 400);
     }
     const body = updateTextFileSchema(MAX_REPO_FILE_CONTENT_BYTES).parse(await c.req.json());
-    const result = await deps.repoFileService.updateFile(repoName, path6, body.content, body.expectedRevision);
+    const result = await deps.repoFileService.updateFile(repoName, path5, body.content, body.expectedRevision);
     if (!result) return c.json(jsonError("File is not editable"), 400);
     return c.json(result);
   });
@@ -15821,7 +15454,7 @@ data: ${JSON.stringify("Terminal session not found")}
   });
   app2.post("/codex/refresh-now", async (c) => {
     try {
-      const result = await codexTokenManager.refreshOnce();
+      const result = await codexTokenManager.refreshOnce(true);
       if (!result.ok) {
         return c.json(
           jsonError("Failed to refresh Codex credentials", result.error.message),