replicas-engine 0.1.740 → 0.1.742

package/dist/src/asp-host-X2J4FDK2.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+import {
+  getCodexAspHost,
+  restartCodexAspHost,
+  restartCodexAspHostIfRunning
+} from "./chunk-K5IXJ5WS.js";
+import "./chunk-OGIXPGJ6.js";
+import "./chunk-6X53Z7IV.js";
+import "./chunk-2RB7SIP3.js";
+import "./chunk-RYGOTMEM.js";
+export {
+  getCodexAspHost,
+  restartCodexAspHost,
+  restartCodexAspHostIfRunning
+};

package/dist/src/{chunk-ZZRN6VSK.js → chunk-6X53Z7IV.js}

@@ -2,40 +2,7 @@
 import {
   HOOK_EXEC_MAX_BUFFER_BYTES,
   isVersionBelow
-} from "./chunk-YPAI4W4G.js";
-
-// src/utils/presigned-upload.ts
-import { createReadStream } from "fs";
-import { request as httpRequest } from "http";
-import { request as httpsRequest } from "https";
-async function putPresignedFile(urlValue, filePath, size, contentType) {
-  await new Promise((resolve, reject) => {
-    const url = new URL(urlValue);
-    const request = (url.protocol === "https:" ? httpsRequest : httpRequest)(url, {
-      method: "PUT",
-      headers: {
-        "content-length": String(size),
-        "content-type": contentType
-      }
-    }, (response) => {
-      response.setEncoding("utf8");
-      let body = "";
-      response.on("data", (chunk) => {
-        body += chunk;
-      });
-      response.on("end", () => {
-        const status = response.statusCode ?? 0;
-        if (status >= 200 && status < 300) resolve();
-        else reject(new Error(`upload failed: ${status} ${body}`));
-      });
-      response.on("error", reject);
-    });
-    request.on("error", reject);
-    const file = size > 0 ? createReadStream(filePath, { start: 0, end: size - 1 }) : createReadStream(filePath);
-    file.on("error", (error) => request.destroy(error));
-    file.pipe(request);
-  });
-}
+} from "./chunk-RYGOTMEM.js";
 
 // src/utils/codex-agent-env.ts
 function buildCodexAgentEnv(source = process.env) {
@@ -269,10 +236,10 @@ var DEFAULT_CODEX_ARGS = [
   "-c",
   "memories.generate_memories=false"
 ];
-var MIN_CODEX_CLI_VERSION = "0.144.6";
+var MIN_CODEX_CLI_VERSION = "0.153.3";
 var CODEX_UPGRADE_TIMEOUT_MS = 12e4;
 var codexCliVersionEnsured = null;
-var ENGINE_PACKAGE_VERSION = "0.1.740";
+var ENGINE_PACKAGE_VERSION = "0.1.742";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";
@@ -290,21 +257,37 @@ var AppServerProcess = class {
   invalidating = false;
   constructor(options) {
     this.binary = options.binary ?? DEFAULT_CODEX_BINARY;
-    const baseArgs = options.args ?? (options.env.REPLICAS_CODEX_AUTH_METHOD === "foundry" ? [
-      ...DEFAULT_CODEX_ARGS,
-      "-c",
-      `model=${JSON.stringify(options.env.CODEX_FOUNDRY_MODEL)}`,
-      "-c",
-      'model_provider="azure"',
-      "-c",
-      'model_providers.azure.name="Azure OpenAI"',
-      "-c",
-      `model_providers.azure.base_url=${JSON.stringify(options.env.CODEX_FOUNDRY_BASE_URL)}`,
-      "-c",
-      'model_providers.azure.env_key="AZURE_OPENAI_API_KEY"',
-      "-c",
-      'model_providers.azure.wire_api="responses"'
-    ] : DEFAULT_CODEX_ARGS);
+    let baseArgs = options.args ?? DEFAULT_CODEX_ARGS;
+    if (!options.args && options.env.REPLICAS_CODEX_AUTH_METHOD === "foundry") {
+      baseArgs = [
+        ...DEFAULT_CODEX_ARGS,
+        "-c",
+        `model=${JSON.stringify(options.env.CODEX_FOUNDRY_MODEL)}`,
+        "-c",
+        'model_provider="azure"',
+        "-c",
+        'model_providers.azure.name="Azure OpenAI"',
+        "-c",
+        `model_providers.azure.base_url=${JSON.stringify(options.env.CODEX_FOUNDRY_BASE_URL)}`,
+        "-c",
+        'model_providers.azure.env_key="AZURE_OPENAI_API_KEY"',
+        "-c",
+        'model_providers.azure.wire_api="responses"'
+      ];
+    } else if (!options.args && options.env.REPLICAS_CODEX_AUTH_METHOD === "api_key" && options.env.CODEX_OPENAI_BASE_URL) {
+      baseArgs = [
+        ...DEFAULT_CODEX_ARGS,
+        "-c",
+        'model_provider="replicas_openai_compatible"',
+        "-c",
+        'model_providers.replicas_openai_compatible.name="OpenAI Compatible"',
+        "-c",
+        `model_providers.replicas_openai_compatible.base_url=${JSON.stringify(options.env.CODEX_OPENAI_BASE_URL)}`,
+        "-c",
+        'model_providers.replicas_openai_compatible.wire_api="responses"',
+        ...options.env.CODEX_OPENAI_AUTHORIZATION_HEADER ? ["-c", 'model_providers.replicas_openai_compatible.env_http_headers={ Authorization = "CODEX_OPENAI_AUTHORIZATION_HEADER" }'] : ["-c", 'model_providers.replicas_openai_compatible.env_key="OPENAI_API_KEY"']
+      ];
+    }
     this.args = [...baseArgs, ...(options.configOverrides ?? []).flatMap((override) => ["-c", override])];
     this.env = options.env;
     this.cwd = options.cwd;
@@ -467,7 +450,7 @@ var AppServerProcess = class {
       await client.request(ACCOUNT_LOGIN_START_METHOD, params2);
       return;
     }
-    if (this.env.REPLICAS_CODEX_AUTH_METHOD !== "api_key" || !this.env.OPENAI_API_KEY) return;
+    if (this.env.REPLICAS_CODEX_AUTH_METHOD !== "api_key" || this.env.CODEX_OPENAI_BASE_URL || !this.env.OPENAI_API_KEY) return;
     const params = {
       type: "apiKey",
       apiKey: this.env.OPENAI_API_KEY
@@ -489,69 +472,11 @@ var AppServerProcess = class {
   }
 };
 
-// src/managers/codex-asp/notification-dispatch.ts
-var TURN_STARTED_METHOD = "turn/started";
-var TURN_COMPLETED_METHOD = "turn/completed";
-var TURN_PLAN_UPDATED_METHOD = "turn/plan/updated";
-var THREAD_GOAL_UPDATED_METHOD = "thread/goal/updated";
-var THREAD_GOAL_CLEARED_METHOD = "thread/goal/cleared";
-var ITEM_STARTED_METHOD = "item/started";
-var ITEM_COMPLETED_METHOD = "item/completed";
-var AGENT_MESSAGE_DELTA_METHOD = "item/agentMessage/delta";
-var REASONING_SUMMARY_TEXT_DELTA_METHOD = "item/reasoning/summaryTextDelta";
-var REASONING_TEXT_DELTA_METHOD = "item/reasoning/textDelta";
-var REASONING_SUMMARY_PART_ADDED_METHOD = "item/reasoning/summaryPartAdded";
-var COMMAND_EXECUTION_OUTPUT_DELTA_METHOD = "item/commandExecution/outputDelta";
-var FILE_CHANGE_OUTPUT_DELTA_METHOD = "item/fileChange/outputDelta";
-var ACCOUNT_RATE_LIMITS_UPDATED_METHOD = "account/rateLimits/updated";
-var THREAD_TOKEN_USAGE_UPDATED_METHOD = "thread/tokenUsage/updated";
-var THREAD_COMPACTED_METHOD = "thread/compacted";
-var MODEL_REROUTED_METHOD = "model/rerouted";
-function dispatchAspNotification(notification, handlers) {
-  const handler = handlers[notification.method];
-  if (!handler) return;
-  handler(notification);
-}
-function recoverCompletedTurn(turn, completedItems, agentMessageDeltas) {
-  const items = turn.items.length > 0 ? [...turn.items] : [];
-  const itemIds = new Set(items.map((item) => item.id));
-  for (const item of completedItems) {
-    if (itemIds.has(item.id)) continue;
-    items.push(item);
-    itemIds.add(item.id);
-  }
-  for (const [itemId, text] of agentMessageDeltas) {
-    if (itemIds.has(itemId)) continue;
-    items.push({ type: "agentMessage", id: itemId, text, phase: null, memoryCitation: null });
-  }
-  return items.length > 0 ? { ...turn, items, itemsView: "full" } : turn;
-}
-
 export {
-  putPresignedFile,
   buildCodexAgentEnv,
   AspClient,
   execAsync,
   execFileAsync,
   SUBPROCESS_MAX_BUFFER,
-  AppServerProcess,
-  TURN_STARTED_METHOD,
-  TURN_COMPLETED_METHOD,
-  TURN_PLAN_UPDATED_METHOD,
-  THREAD_GOAL_UPDATED_METHOD,
-  THREAD_GOAL_CLEARED_METHOD,
-  ITEM_STARTED_METHOD,
-  ITEM_COMPLETED_METHOD,
-  AGENT_MESSAGE_DELTA_METHOD,
-  REASONING_SUMMARY_TEXT_DELTA_METHOD,
-  REASONING_TEXT_DELTA_METHOD,
-  REASONING_SUMMARY_PART_ADDED_METHOD,
-  COMMAND_EXECUTION_OUTPUT_DELTA_METHOD,
-  FILE_CHANGE_OUTPUT_DELTA_METHOD,
-  ACCOUNT_RATE_LIMITS_UPDATED_METHOD,
-  THREAD_TOKEN_USAGE_UPDATED_METHOD,
-  THREAD_COMPACTED_METHOD,
-  MODEL_REROUTED_METHOD,
-  dispatchAspNotification,
-  recoverCompletedTurn
+  AppServerProcess
 };

package/dist/src/chunk-AKQ6IVUU.js

@@ -0,0 +1,73 @@
+#!/usr/bin/env node
+import {
+  monolithRequest
+} from "./chunk-OGIXPGJ6.js";
+import {
+  extractCommandProtectionCommandText,
+  findGitCommitSignals,
+  findPrMergeSignals
+} from "./chunk-RYGOTMEM.js";
+
+// src/services/command-protection-service.ts
+var DEFAULT_COMMAND_PROTECTION_BLOCK_MESSAGE = "Blocked by Replicas command protection.";
+function asCommandProtectionResponse(value) {
+  if (typeof value !== "object" || value === null) return null;
+  const candidate = value;
+  return typeof candidate.allowed === "boolean" && typeof candidate.enabled === "boolean" ? candidate : null;
+}
+function failClosed(reason, matchedSignals) {
+  return {
+    allowed: false,
+    enabled: true,
+    reason,
+    matchedSignals
+  };
+}
+async function evaluateCommandProtection(request, signal) {
+  const matchedSignals = [...findGitCommitSignals(request), ...findPrMergeSignals(request)];
+  if (matchedSignals.length === 0) {
+    return { allowed: true, enabled: true };
+  }
+  let response;
+  try {
+    response = await monolithRequest("/v1/engine/command-protection/evaluate", {
+      body: request,
+      signal
+    });
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return failClosed(`Command protection failed closed: ${detail}`, matchedSignals);
+  }
+  if (!response.ok) {
+    const detail = await response.text().catch(() => "");
+    return failClosed(`Command protection failed closed: ${response.status} ${detail}`, matchedSignals);
+  }
+  let payload;
+  try {
+    payload = await response.json();
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return failClosed(`Command protection failed closed: ${detail}`, matchedSignals);
+  }
+  return asCommandProtectionResponse(payload) ?? failClosed("Command protection failed closed: invalid response from policy service", matchedSignals);
+}
+function extractToolCommand(input) {
+  return extractCommandProtectionCommandText({ toolInput: input }, { stringifyFallback: false });
+}
+function reportCommandProtectionBlock(options) {
+  const message = options.result.reason || DEFAULT_COMMAND_PROTECTION_BLOCK_MESSAGE;
+  console.warn(`[${options.managerName}] blocked ${options.action} by command protection: ${message}`);
+  options.recordHistoryEvent(options.eventType, {
+    type: "error",
+    message,
+    ...options.context,
+    command: options.command
+  }, options.historyFile);
+  return message;
+}
+
+export {
+  evaluateCommandProtection,
+  extractToolCommand,
+  reportCommandProtectionBlock
+};

package/dist/src/chunk-K5IXJ5WS.js

@@ -0,0 +1,419 @@
+#!/usr/bin/env node
+import {
+  ENGINE_ENV,
+  monolithRequest,
+  setAgentCredentialSnapshot
+} from "./chunk-OGIXPGJ6.js";
+import {
+  AppServerProcess,
+  buildCodexAgentEnv
+} from "./chunk-6X53Z7IV.js";
+import {
+  CODEX_AUTH_ENV_KEYS,
+  CODEX_AUTH_ENV_KEYS_BY_METHOD,
+  codexAuthEnvFromResponse,
+  createErrorResult,
+  createSuccessResult
+} from "./chunk-RYGOTMEM.js";
+
+// src/managers/codex-token-manager.ts
+import { promises as fs } from "fs";
+import path from "path";
+
+// src/managers/auth-env-transition.ts
+function applyAuthEnvTransition(params) {
+  const newOwned = new Set(params.authKeysByMethod[params.newMethod]);
+  const prevOwned = new Set(params.authKeysByMethod[params.prevMethod]);
+  for (const key of params.authKeys) {
+    const value = params.newEnvVars[key];
+    if (value !== void 0) {
+      for (const env of params.envs) {
+        env[key] = value;
+      }
+    } else if (prevOwned.has(key) && !newOwned.has(key)) {
+      for (const env of params.envs) {
+        delete env[key];
+      }
+    }
+  }
+}
+
+// src/services/credential-fallbacks.ts
+var fallbacksByAgent = /* @__PURE__ */ new Map();
+var exhaustedByAgent = /* @__PURE__ */ new Map();
+function recordCredentialFallback(notice) {
+  fallbacksByAgent.set(notice.provider, notice);
+}
+function listCredentialFallbacks() {
+  return [...fallbacksByAgent.values()].filter((notice) => {
+    const live = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS[notice.provider];
+    if (!live) return false;
+    return notice.status === "switched" ? live.method === notice.candidateMethod && live.scope === notice.candidateScope : live.method === notice.exhaustedMethod && live.scope === notice.exhaustedScope;
+  });
+}
+function listExhaustedCredentials(provider) {
+  return [...exhaustedByAgent.get(provider)?.values() ?? []];
+}
+function recordExhaustedCredential(provider, credential) {
+  const spent = exhaustedByAgent.get(provider) ?? /* @__PURE__ */ new Map();
+  spent.set(`${credential.method}|${credential.scope}`, credential);
+  exhaustedByAgent.set(provider, spent);
+}
+
+// src/managers/base-refresh-manager.ts
+var BaseRefreshManager = class {
+  constructor(managerName, intervalMs = 15 * 60 * 1e3) {
+    this.managerName = managerName;
+    this.intervalMs = intervalMs;
+    this.health = {
+      isRunning: false,
+      intervalMs: this.intervalMs,
+      lastAttemptAt: null,
+      lastSuccessAt: null,
+      lastErrorAt: null,
+      lastErrorMessage: null
+    };
+  }
+  managerName;
+  intervalMs;
+  intervalHandle = null;
+  health;
+  async start() {
+    if (this.intervalHandle) {
+      return;
+    }
+    const skipReason = this.getSkipReason();
+    if (skipReason) {
+      console.log(`[${this.managerName}] Skipping: ${skipReason}`);
+      return;
+    }
+    console.log(`[${this.managerName}] Starting token refresh service`);
+    this.health.isRunning = true;
+    const config = this.getRuntimeConfig();
+    if (config) {
+      this.health.lastAttemptAt = (/* @__PURE__ */ new Date()).toISOString();
+      for (let attempt = 1; attempt <= 3; attempt++) {
+        try {
+          await this.doRefresh(config);
+          this.health.lastSuccessAt = (/* @__PURE__ */ new Date()).toISOString();
+          this.health.lastErrorAt = null;
+          this.health.lastErrorMessage = null;
+          break;
+        } catch (error) {
+          const message = error instanceof Error ? error.message : "Unknown error";
+          this.health.lastErrorAt = (/* @__PURE__ */ new Date()).toISOString();
+          this.health.lastErrorMessage = message;
+          if (attempt < 3) {
+            console.warn(`[${this.managerName}] Initial refresh attempt ${attempt} failed, retrying in 2s...`);
+            await new Promise((resolve) => setTimeout(resolve, 2e3));
+          } else {
+            console.error(`[${this.managerName}] Initial refresh failed after 3 attempts:`, error);
+          }
+        }
+      }
+    }
+    this.scheduleNextRefresh();
+  }
+  async swapCredentials(params) {
+    if (!this.getRuntimeConfig()) {
+      return createErrorResult({ message: `${this.managerName} has no runtime config`, code: "not_configured" });
+    }
+    try {
+      console.log(`[${this.managerName}] Fetching fresh credentials from monolith (${params.failureKind})...`);
+      const excludeCredentials = listExhaustedCredentials(params.provider);
+      await params.refresh({
+        ...excludeCredentials.length > 0 ? { excludeCredentials } : {},
+        ...params.allowedMethods ? { allowedMethods: [...params.allowedMethods] } : {}
+      });
+      if (params.isOauthNow()) {
+        this.start().catch((error) => {
+          console.error(`[${this.managerName}] Failed to restart OAuth refresh service after fallback:`, error);
+        });
+      }
+      return createSuccessResult();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`[${this.managerName}] Failed to fetch fresh credentials:`, error);
+      return createErrorResult({
+        message,
+        code: message.includes('"code":"no_credentials"') ? "no_credentials" : "refresh_failed"
+      });
+    }
+  }
+  stop() {
+    if (!this.intervalHandle) {
+      return;
+    }
+    clearTimeout(this.intervalHandle);
+    this.intervalHandle = null;
+    this.health.isRunning = false;
+    console.log(`[${this.managerName}] Stopped`);
+  }
+  getHealthStatus() {
+    return { ...this.health };
+  }
+  getSkipReason() {
+    return null;
+  }
+  getNextRefreshDelayMs() {
+    return this.intervalMs;
+  }
+  getRuntimeConfig() {
+    if (!ENGINE_ENV.REPLICAS_WORKSPACE_ID) {
+      return null;
+    }
+    return {
+      monolithUrl: ENGINE_ENV.REPLICAS_MONOLITH_URL,
+      workspaceId: ENGINE_ENV.REPLICAS_WORKSPACE_ID,
+      engineSecret: ENGINE_ENV.REPLICAS_ENGINE_SECRET
+    };
+  }
+  scheduleNextRefresh() {
+    const delayMs = this.getNextRefreshDelayMs();
+    this.health.intervalMs = delayMs;
+    this.intervalHandle = setTimeout(async () => {
+      await this.refreshOnce();
+      if (this.intervalHandle) this.scheduleNextRefresh();
+    }, delayMs);
+    console.log(`[${this.managerName}] Token refresh scheduled in ${Math.round(delayMs / 1e3)} seconds`);
+  }
+  async refreshOnce(force = false) {
+    if (!force && this.getSkipReason()) {
+      return createSuccessResult();
+    }
+    const config = this.getRuntimeConfig();
+    if (!config) return createSuccessResult();
+    this.health.lastAttemptAt = (/* @__PURE__ */ new Date()).toISOString();
+    try {
+      await this.doRefresh(config);
+      this.health.lastSuccessAt = (/* @__PURE__ */ new Date()).toISOString();
+      this.health.lastErrorAt = null;
+      this.health.lastErrorMessage = null;
+      return createSuccessResult();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      this.health.lastErrorAt = (/* @__PURE__ */ new Date()).toISOString();
+      this.health.lastErrorMessage = message;
+      console.error(`[${this.managerName}] Failed to refresh credentials:`, error);
+      return createErrorResult({ message });
+    }
+  }
+};
+
+// src/managers/codex-token-manager.ts
+var CodexAspAuthMethodChangedError = class extends Error {
+  name = "CodexAspAuthMethodChangedError";
+};
+var CodexTokenManager = class extends BaseRefreshManager {
+  constructor() {
+    super("CodexTokenManager");
+  }
+  getSkipReason() {
+    if (!ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD && ENGINE_ENV.OPENAI_API_KEY) {
+      return "OPENAI_API_KEY is set";
+    }
+    return null;
+  }
+  async doRefresh(_config) {
+    await this.refreshWithRequest(void 0, true);
+  }
+  async refreshWithRequest(request, restartOnChange = false) {
+    const previousEnv = CODEX_AUTH_ENV_KEYS.map((key) => process.env[key]);
+    console.log("[CodexTokenManager] Refreshing Codex credentials...");
+    const response = await monolithRequest("/v1/engine/codex/refresh-credentials", {
+      body: request
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new Error(`Credentials refresh failed: ${response.status} ${errorText}`);
+    }
+    const data = await response.json();
+    await this.applyCredentialsResponse(data);
+    if (restartOnChange && CODEX_AUTH_ENV_KEYS.some((key, index) => process.env[key] !== previousEnv[index])) {
+      const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-X2J4FDK2.js");
+      await restartCodexAspHostIfRunning2();
+    }
+    if (data.scope) {
+      setAgentCredentialSnapshot("codex", {
+        method: data.type,
+        scope: data.scope,
+        ...data.revision ? { revision: data.revision } : {}
+      });
+    }
+    console.log(`[CodexTokenManager] Credentials refreshed (method=${data.type})`);
+    return data;
+  }
+  async prepareAspOauthOptions() {
+    if (ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD !== "oauth") return {};
+    const response = await this.refreshWithRequest();
+    if (response.type !== "oauth") return {};
+    const login = this.buildAspOauthLogin(response);
+    let credential = login.credential;
+    return {
+      chatgptAuthTokens: login.tokens,
+      refreshChatgptAuthTokens: async (params) => {
+        const refreshed = await this.refreshAspOauthCredentials(
+          credential,
+          `Codex ASP requested an external token refresh (${params.reason})`
+        );
+        if (!refreshed.ok) {
+          if (refreshed.error.code === "method_changed") {
+            throw new CodexAspAuthMethodChangedError(refreshed.error.message);
+          }
+          throw new Error(refreshed.error.message);
+        }
+        credential = refreshed.data.credential;
+        return refreshed.data.tokens;
+      }
+    };
+  }
+  async refreshAspOauthCredentials(failedCredential, failureReason) {
+    try {
+      const response = await this.refreshWithRequest({
+        failedMethod: "oauth",
+        ...failedCredential?.method === "oauth" ? { failedCredential } : {},
+        failureKind: "rejected",
+        failureReason
+      });
+      if (response.type !== "oauth") {
+        return createErrorResult({
+          message: `${failureReason}; credentials changed to ${response.type}, so the app server must restart`,
+          code: "method_changed"
+        });
+      }
+      return createSuccessResult(this.buildAspOauthLogin(response));
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return createErrorResult({
+        message,
+        code: message.includes('"code":"no_credentials"') ? "no_credentials" : "refresh_failed"
+      });
+    }
+  }
+  async fetchFreshCredentials(failureReason, failureKind = "rejected", failedCredential = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.codex, allowedMethods) {
+    const failedMethod = failedCredential?.method === "oauth" || failedCredential?.method === "api_key" || failedCredential?.method === "foundry" ? failedCredential.method : ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD;
+    return this.swapCredentials({
+      provider: "codex",
+      failureKind,
+      allowedMethods,
+      refresh: async (exclusions) => {
+        await this.refreshWithRequest(
+          failedMethod === "oauth" || failedMethod === "api_key" || failedMethod === "foundry" ? {
+            failedMethod,
+            ...failedCredential?.method === failedMethod ? { failedCredential } : {},
+            failureReason,
+            failureKind,
+            ...exclusions
+          } : exclusions
+        );
+      },
+      isOauthNow: () => ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "oauth"
+    });
+  }
+  async applyCredentialsResponse(response) {
+    await this.removeOauthCredentialsFile();
+    const envVars = codexAuthEnvFromResponse(response);
+    applyAuthEnvTransition({
+      prevMethod: ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD ?? "none",
+      newMethod: envVars.REPLICAS_CODEX_AUTH_METHOD ?? "none",
+      authKeys: CODEX_AUTH_ENV_KEYS,
+      authKeysByMethod: CODEX_AUTH_ENV_KEYS_BY_METHOD,
+      newEnvVars: envVars,
+      envs: [ENGINE_ENV, process.env]
+    });
+    if (response.type === "api_key") {
+      for (const key of CODEX_AUTH_ENV_KEYS_BY_METHOD.api_key) {
+        if (envVars[key] !== void 0) continue;
+        delete ENGINE_ENV[key];
+        delete process.env[key];
+      }
+    }
+  }
+  buildAspOauthLogin(response) {
+    const credential = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.codex;
+    return {
+      tokens: {
+        accessToken: response.accessToken,
+        chatgptAccountId: response.accountId,
+        chatgptPlanType: null
+      },
+      ...credential?.method === "oauth" ? { credential } : {}
+    };
+  }
+  async removeOauthCredentialsFile() {
+    const authPath = path.join(ENGINE_ENV.HOME_DIR, ".codex", "auth.json");
+    try {
+      await fs.unlink(authPath);
+    } catch (error) {
+      if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
+    }
+  }
+};
+var codexTokenManager = new CodexTokenManager();
+
+// src/managers/codex-asp/asp-host.ts
+var hostPromise = null;
+var activeProcess = null;
+var restartPromise = null;
+async function getCodexAspHost() {
+  if (restartPromise) {
+    await restartPromise;
+  }
+  hostPromise ??= (async () => {
+    try {
+      const oauthOptions = await codexTokenManager.prepareAspOauthOptions();
+      const process2 = new AppServerProcess({
+        cwd: ENGINE_ENV.WORKSPACE_ROOT,
+        env: buildCodexAgentEnv(),
+        ...oauthOptions
+      });
+      const { client } = await process2.start();
+      activeProcess = process2;
+      process2.on("exit", () => {
+        if (activeProcess === process2) {
+          activeProcess = null;
+        }
+        hostPromise = null;
+      });
+      return { client };
+    } catch (error) {
+      hostPromise = null;
+      throw error;
+    }
+  })();
+  return hostPromise;
+}
+async function restartCodexAspHost() {
+  if (restartPromise) {
+    return restartPromise;
+  }
+  restartPromise = (async () => {
+    const process2 = activeProcess;
+    hostPromise = null;
+    activeProcess = null;
+    if (process2) {
+      await process2.stop();
+    }
+  })();
+  try {
+    await restartPromise;
+  } finally {
+    restartPromise = null;
+  }
+}
+async function restartCodexAspHostIfRunning() {
+  if (activeProcess) await restartCodexAspHost();
+}
+
+export {
+  recordCredentialFallback,
+  listCredentialFallbacks,
+  recordExhaustedCredential,
+  BaseRefreshManager,
+  applyAuthEnvTransition,
+  getCodexAspHost,
+  restartCodexAspHost,
+  restartCodexAspHostIfRunning,
+  CodexAspAuthMethodChangedError,
+  codexTokenManager
+};