replicas-engine 0.1.759 → 0.1.761

package/dist/src/{asp-host-XMTAWU7K.js → asp-host-5GPDKD3D.js}

@@ -5,11 +5,11 @@ import {
   getCodexAspHost,
   restartCodexAspHost,
   restartCodexAspHostIfRunning
-} from "./chunk-JQHGDJE4.js";
-import "./chunk-WTNFZX53.js";
-import "./chunk-52SXO2DU.js";
+} from "./chunk-47DDGIVB.js";
+import "./chunk-VI2PM3UG.js";
+import "./chunk-PWF56YNB.js";
 import "./chunk-UZSNFLDQ.js";
-import "./chunk-24FE3TDH.js";
+import "./chunk-BU5GP3VV.js";
 import "./chunk-VEQXQN22.js";
 export {
   getCodexAspHost,

package/dist/src/{chunk-JQHGDJE4.js → chunk-47DDGIVB.js}

@@ -5,18 +5,18 @@ import {
   ENGINE_ENV,
   monolithRequest,
   setAgentCredentialSnapshot
-} from "./chunk-WTNFZX53.js";
+} from "./chunk-VI2PM3UG.js";
 import {
   AppServerProcess,
   buildCodexAgentEnv
-} from "./chunk-52SXO2DU.js";
+} from "./chunk-PWF56YNB.js";
 import {
   CODEX_AUTH_ENV_KEYS,
   CODEX_AUTH_ENV_KEYS_BY_METHOD,
   codexAuthEnvFromResponse,
   createErrorResult,
   createSuccessResult
-} from "./chunk-24FE3TDH.js";
+} from "./chunk-BU5GP3VV.js";
 
 // src/managers/codex-token-manager.ts
 import { promises as fs } from "fs";
@@ -232,7 +232,7 @@ var CodexTokenManager = class extends BaseRefreshManager {
     const data = await response.json();
     await this.applyCredentialsResponse(data);
     if (restartOnChange && CODEX_AUTH_ENV_KEYS.some((key, index) => process.env[key] !== previousEnv[index])) {
-      const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-XMTAWU7K.js");
+      const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-5GPDKD3D.js");
       await restartCodexAspHostIfRunning2();
     }
     if (data.scope) {

package/dist/src/{chunk-FTXE5FES.js → chunk-6M2VM5RC.js}

@@ -4,7 +4,7 @@ const require = __createRequire(import.meta.url);
 import {
   findCodeHostPullRequestUrls,
   mayCreatePullRequest
-} from "./chunk-24FE3TDH.js";
+} from "./chunk-BU5GP3VV.js";
 
 // src/services/post-tool-pr-notifier.ts
 async function notifyPostToolUse(toolName, toolInput, toolResult) {

package/dist/src/{chunk-24FE3TDH.js → chunk-BU5GP3VV.js}

@@ -161,6 +161,7 @@ var DEEPSEEK_V4_FLASH_MODEL = "deepseek/deepseek-v4-flash-0731";
 var DEFAULT_DEEPSEEK_MODEL = DEEPSEEK_V4_PRO_MODEL;
 var DEFAULT_FX_MODEL = "zai/glm-5.2";
 var DEFAULT_KIMI_MODEL = "moonshotai/kimi-k2.6";
+var MUSE_SPARK_1_3_MODEL = "muse-spark-1.3";
 var DEFAULT_MUSE_MODEL = "muse-spark-1.2";
 var DEFAULT_PI_MODEL = DEFAULT_OPENCODE_MODEL;
 var OPENROUTER_MODELS = [
@@ -172,6 +173,7 @@ var OPENROUTER_MODELS = [
   "minimax/minimax-m3",
   "xiaomi/mimo-v2.5-pro",
   "moonshotai/kimi-k2.6",
+  "meta/muse-spark-1.3",
   "google/gemini-3.8-flash"
 ];
 function prioritizeDeepseekModels(models) {
@@ -284,7 +286,7 @@ var AGENT_MODELS = {
   deepseek: prioritizeDeepseekModels(OPENROUTER_MODELS),
   fx: [DEFAULT_FX_MODEL],
   kimi: [DEFAULT_KIMI_MODEL],
-  muse: [DEFAULT_MUSE_MODEL],
+  muse: [MUSE_SPARK_1_3_MODEL, DEFAULT_MUSE_MODEL],
   opencode: [...OPENROUTER_MODELS, ...ASTER_MODELS],
   pi: [...OPENROUTER_MODELS, ...ASTER_MODELS],
   relay: [CLAUDE_FABLE_5_1_MODEL, CLAUDE_FABLE_5_MODEL, CLAUDE_OPUS_5_MODEL, CLAUDE_OPUS_4_8_MODEL, CLAUDE_SONNET_5_MODEL]
@@ -328,7 +330,9 @@ var MODEL_LABELS = {
   "minimax/minimax-m3": "MiniMax M3 via OpenRouter",
   "xiaomi/mimo-v2.5-pro": "MiMo V2.5 Pro via OpenRouter",
   "moonshotai/kimi-k2.6": "Kimi K2.6 via OpenRouter",
+  [MUSE_SPARK_1_3_MODEL]: "Muse Spark 1.3",
   [DEFAULT_MUSE_MODEL]: "Muse Spark 1.2",
+  "meta/muse-spark-1.3": "Muse Spark 1.3 via OpenRouter",
   "google/gemini-3.8-flash": "Gemini 3.8 Flash via OpenRouter",
   ...ASTER_MODEL_LABELS,
   "gpt-5.4": "GPT-5.4",
@@ -1050,6 +1054,13 @@ var SANDBOX_PATHS = {
 var WORKSPACE_SIZES = ["small", "large"];
 var INVALID_WORKSPACE_SIZE_ERROR = `Invalid size: must be one of ${WORKSPACE_SIZES.join(", ")}`;
 
+// ../shared/src/github/url.ts
+var GITHUB_HOST_RE = /(^|@|\/\/)github\.com[:/]/;
+function isGitHubUrl(url) {
+  if (!url) return false;
+  return GITHUB_HOST_RE.test(url);
+}
+
 // ../shared/src/runtime-env.ts
 var REPLICAS_RUNTIME_ENV_ALIASES = {
   monolithUrl: ["REPLICAS_MONOLITH_URL", "MONOLITH_URL"],
@@ -1125,13 +1136,45 @@ function parsePosixEnvFile(content) {
 var GIT_CREDENTIAL_HELPER_FILENAME = ".git-credential-replicas";
 var GITHUB_CREDENTIAL_REFRESH_PATH = "/git-credentials/github/refresh";
 var GITLAB_CREDENTIAL_REFRESH_PATH = "/git-credentials/gitlab/refresh";
+function githubOwnerTokens(access) {
+  const ownerTokens = /* @__PURE__ */ new Map();
+  for (const [repository, token] of Object.entries(access)) {
+    const owner = repository.split("/")[0];
+    if (!owner) continue;
+    const tokens = ownerTokens.get(owner) ?? /* @__PURE__ */ new Set();
+    tokens.add(token);
+    ownerTokens.set(owner, tokens);
+  }
+  return ownerTokens;
+}
+function githubCredentialLines(access) {
+  if (typeof access === "string") return [`https://x-access-token:${access}@github.com`];
+  const entries = Object.entries(access);
+  const ownerTokens = githubOwnerTokens(access);
+  return [...entries.flatMap(([repository, token]) => [
+    `https://x-access-token:${token}@github.com/${repository}`,
+    `https://x-access-token:${token}@github.com/${repository}.git`
+  ]), ...[...ownerTokens].flatMap(([owner, tokens]) => tokens.size === 1 ? [`https://x-access-token:${[...tokens][0]}@github.com/${owner}`] : [])];
+}
 function buildGitCredentialHelperScript(credentialsPath) {
   return `#!/bin/sh
 request=$(cat)
+if printf '%s
+' "$request" | grep -q '^host=github.com$'; then
+  request=$(printf '%s
+' "$request" | awk '/^path=/ { $0 = tolower($0) } { print }')
+fi
 
 get_credential() {
+  credential=$(printf '%s
+' "$request" | git credential-store --file=${shellQuotePosix(credentialsPath)} get)
+  if [ -z "$credential" ] && printf '%s
+' "$request" | grep -q '^host=github.com$'; then
+    credential=$(printf '%s
+' "$request" | sed 's|^path=\\([^/]*\\)/.*|path=\\1|' | git credential-store --file=${shellQuotePosix(credentialsPath)} get)
+  fi
   printf '%s
-' "$request" | git credential-store --file=${shellQuotePosix(credentialsPath)} get
+' "$credential"
 }
 
 refresh_credential() {
@@ -1659,13 +1702,6 @@ function skillNamesFromCommand(command) {
   })));
 }
 
-// ../shared/src/github/url.ts
-var GITHUB_HOST_RE = /(^|@|\/\/)github\.com[:/]/;
-function isGitHubUrl(url) {
-  if (!url) return false;
-  return GITHUB_HOST_RE.test(url);
-}
-
 // ../shared/src/urls.ts
 var HOME_PATH = "/home";
 var DASHBOARD_PATH = "/dashboard";
@@ -2052,6 +2088,8 @@ If authenticated, you can immediately use \`gh\` for all GitHub operations. No a
 
 The GitHub CLI (\`gh\`) is the recommended way to interact with GitHub. It handles authentication, pagination, and API formatting automatically.
 
+In a workspace spanning GitHub owners, run \`gh\` inside the target checkout or pass \`--repo owner/repo\`. For \`gh api graphql\`, set \`GH_REPO=owner/repo\`; SDK GraphQL requests use the \`repository\` option to select the account. Each request uses one account.
+
 ### Pull Requests
 
 \`\`\`bash
@@ -2133,6 +2171,7 @@ await replicas.github.request('/repos/owner/repo/issues/123/comments', {
 });
 
 const result = await replicas.github.request('/graphql', {
+  repository: 'owner/repo',
   method: 'POST',
   body: { query: '{ viewer { login } }' },
 });
@@ -2242,7 +2281,7 @@ var REFERENCE5 = `# Linear Integration
 
 Use \`@replicas/sdk\`; never request or handle a Linear OAuth token. Replicas refreshes the organization credential behind the gateway.
 
-In gateway-enabled workspaces, Linear credentials stay on the Replicas server and the workspace receives only connection metadata. Older workspaces can still carry a legacy token snapshot, but should use the gateway when the SDK is available. A missing Linear MCP server does not prevent SDK access.
+In all new workspaces, Linear credentials stay on the Replicas server and the workspace receives only connection metadata. Older workspaces can still carry a legacy token snapshot, but should use the gateway when the SDK is available. A missing Linear MCP server does not prevent SDK access.
 
 Download protected attachments with \`await replicas.linear.download(url)\`; this returns a \`Response\` without exposing the provider token.
 
@@ -2312,9 +2351,9 @@ Search with \`containsIgnoreCase: $query\` filters, for example on both \`title\
 If \`@replicas/sdk\` cannot be imported, use the same refresh-capable gateway with workspace authentication. Send the GraphQL JSON request on stdin:
 
 \`\`\`bash
-curl -sS --fail-with-body -X POST "$REPLICAS_MONOLITH_URL/v1/engine/linear/graphql" \\
+curl -sS --fail-with-body -X POST "\${REPLICAS_MONOLITH_URL:-$MONOLITH_URL}/v1/engine/linear/graphql" \\
   -H "Authorization: Bearer $REPLICAS_ENGINE_SECRET" \\
-  -H "X-Workspace-Id: $REPLICAS_WORKSPACE_ID" \\
+  -H "X-Workspace-Id: \${REPLICAS_WORKSPACE_ID:-$WORKSPACE_ID}" \\
   -H "Content-Type: application/json" \\
   --data-binary @-
 \`\`\`
@@ -3341,11 +3380,23 @@ const [messages, users] = await Promise.all([
 \`\`\`
 
 Supported methods cover conversations, messages, search, users, reactions, and Slack's external file-upload flow. An unsupported method is rejected by Replicas before Slack is called.
+
+## Older workspaces without the SDK
+
+If \`@replicas/sdk\` cannot be imported, use the gateway with workspace authentication. Send JSON containing \`method\` and \`arguments\` on stdin, for example \`{"method":"conversations.list","arguments":{"limit":3,"types":"public_channel"}}\`:
+
+\`\`\`bash
+curl -sS --fail-with-body -X POST "\${REPLICAS_MONOLITH_URL:-$MONOLITH_URL}/v1/engine/slack/api" \\
+  -H "Authorization: Bearer $REPLICAS_ENGINE_SECRET" \\
+  -H "X-Workspace-Id: \${REPLICAS_WORKSPACE_ID:-$WORKSPACE_ID}" \\
+  -H "Content-Type: application/json" \\
+  --data-binary @-
+\`\`\`
 `;
 var SLACK_ABILITY = {
   label: "Slack",
   description: "Send messages, read threads, search, and transfer files through @replicas/sdk.",
-  bullet: "- Interacting with Slack (sending messages, reading threads, etc.)",
+  bullet: "- Interacting with Slack (listing channels, sending messages, reading threads, or searching): use replicas.slack.call from @replicas/sdk. Read references/SLACK.md; no Slack MCP server or provider token in the VM is required.",
   section: SECTION12,
   referenceFile: { name: "SLACK.md", content: REFERENCE12 }
 };
@@ -7530,6 +7581,7 @@ export {
   GIT_CREDENTIAL_HELPER_FILENAME,
   GITHUB_CREDENTIAL_REFRESH_PATH,
   GITLAB_CREDENTIAL_REFRESH_PATH,
+  githubCredentialLines,
   buildGitCredentialHelperScript,
   parseGitRemote,
   gitIdentityConfigCommands,

package/dist/src/{chunk-52SXO2DU.js → chunk-PWF56YNB.js}

@@ -4,7 +4,7 @@ const require = __createRequire(import.meta.url);
 import {
   HOOK_EXEC_MAX_BUFFER_BYTES,
   isVersionBelow
-} from "./chunk-24FE3TDH.js";
+} from "./chunk-BU5GP3VV.js";
 
 // src/utils/codex-agent-env.ts
 function buildCodexAgentEnv(source = process.env) {
@@ -241,7 +241,7 @@ var DEFAULT_CODEX_ARGS = [
 var MIN_CODEX_CLI_VERSION = "0.153.3";
 var CODEX_UPGRADE_TIMEOUT_MS = 12e4;
 var codexCliVersionEnsured = null;
-var ENGINE_PACKAGE_VERSION = "0.1.759";
+var ENGINE_PACKAGE_VERSION = "0.1.761";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";

package/dist/src/{chunk-WTNFZX53.js → chunk-VI2PM3UG.js}

@@ -15,7 +15,7 @@ import {
   isValidRelayBaseProvider,
   parsePosixEnvFile,
   readReplicasRuntimeEnv
-} from "./chunk-24FE3TDH.js";
+} from "./chunk-BU5GP3VV.js";
 
 // src/engine-env.ts
 import { readFileSync as readFileSync2 } from "fs";

package/dist/src/{chunk-2N4HGHFZ.js → chunk-VMTI7O6V.js}

@@ -3,12 +3,12 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   monolithRequest
-} from "./chunk-WTNFZX53.js";
+} from "./chunk-VI2PM3UG.js";
 import {
   extractCommandProtectionCommandText,
   findGitCommitSignals,
   findPrMergeSignals
-} from "./chunk-24FE3TDH.js";
+} from "./chunk-BU5GP3VV.js";
 
 // src/services/command-protection-service.ts
 var DEFAULT_COMMAND_PROTECTION_BLOCK_MESSAGE = "Blocked by Replicas command protection.";

package/dist/src/command-protection-hook.js

@@ -3,12 +3,12 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   evaluateCommandProtection
-} from "./chunk-2N4HGHFZ.js";
-import "./chunk-WTNFZX53.js";
+} from "./chunk-VMTI7O6V.js";
+import "./chunk-VI2PM3UG.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
-import "./chunk-24FE3TDH.js";
+import "./chunk-BU5GP3VV.js";
 import "./chunk-VEQXQN22.js";
 
 // src/command-protection-hook.ts

package/dist/src/deepseek-command-protection-plugin.js

@@ -3,13 +3,13 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   evaluateCommandProtection
-} from "./chunk-2N4HGHFZ.js";
+} from "./chunk-VMTI7O6V.js";
 import {
   notifyPostToolUse
-} from "./chunk-FTXE5FES.js";
-import "./chunk-WTNFZX53.js";
+} from "./chunk-6M2VM5RC.js";
+import "./chunk-VI2PM3UG.js";
 import "./chunk-UZSNFLDQ.js";
-import "./chunk-24FE3TDH.js";
+import "./chunk-BU5GP3VV.js";
 import "./chunk-VEQXQN22.js";
 
 // src/deepseek-command-protection-plugin.ts

package/dist/src/headless-agent.js

@@ -8,12 +8,12 @@ import {
 import {
   AppServerProcess,
   buildCodexAgentEnv
-} from "./chunk-52SXO2DU.js";
+} from "./chunk-PWF56YNB.js";
 import {
   AGENT,
   getMemoryOutputSafetyViolation,
   headlessAgentRequestSchema
-} from "./chunk-24FE3TDH.js";
+} from "./chunk-BU5GP3VV.js";
 import "./chunk-VEQXQN22.js";
 
 // src/headless-agent.ts

package/dist/src/index.js

@@ -91,7 +91,7 @@ import {
   evaluateCommandProtection,
   extractToolCommand,
   reportCommandProtectionBlock
-} from "./chunk-2N4HGHFZ.js";
+} from "./chunk-VMTI7O6V.js";
 import {
   ACCOUNT_RATE_LIMITS_UPDATED_METHOD,
   AGENT_MESSAGE_DELTA_METHOD,
@@ -124,20 +124,20 @@ import {
   recordCredentialFallback,
   recordExhaustedCredential,
   restartCodexAspHost
-} from "./chunk-JQHGDJE4.js";
+} from "./chunk-47DDGIVB.js";
 import {
   ENGINE_ENV,
   IS_WARMING_MODE,
   monolithRequest,
   monolithService,
   setAgentCredentialSnapshot
-} from "./chunk-WTNFZX53.js";
+} from "./chunk-VI2PM3UG.js";
 import {
   AspClient,
   SUBPROCESS_MAX_BUFFER,
   execAsync,
   execFileAsync
-} from "./chunk-52SXO2DU.js";
+} from "./chunk-PWF56YNB.js";
 import {
   isRecord as isRecord2
 } from "./chunk-UZSNFLDQ.js";
@@ -271,6 +271,7 @@ import {
   getUserMessage,
   getUserMessageId,
   gitIdentityConfigCommands,
+  githubCredentialLines,
   hasChatStarted,
   imageContentToUserMessageImages,
   isAgentBackendEvent,
@@ -331,7 +332,7 @@ import {
   spawnRelaySubagentRequestSchema,
   stripAgentDiagnosticErrors,
   withTimeout
-} from "./chunk-24FE3TDH.js";
+} from "./chunk-BU5GP3VV.js";
 import {
   __commonJS,
   __export,
@@ -8572,6 +8573,9 @@ async function configureManagedGitCredentialHelper(homeDir) {
   await execFileAsync("git", ["config", "--global", "credential.helper", helperPath], {
     env: { ...process.env, HOME: homeDir }
   });
+  await execFileAsync("git", ["config", "--global", "credential.https://github.com.useHttpPath", "true"], {
+    env: { ...process.env, HOME: homeDir }
+  });
 }
 var credentialFileLock = new AsyncLock();
 function upsertCredentialFileLines(filePath, hosts, lines) {
@@ -8582,7 +8586,7 @@ function upsertCredentialFileLines(filePath, hosts, lines) {
     } catch {
       existing = [];
     }
-    const kept = existing.filter((line) => !hosts.some((host) => line.endsWith(`@${host}`)));
+    const kept = existing.filter((line) => !hosts.some((host) => line.endsWith(`@${host}`) || line.includes(`@${host}/`)));
     await writeSecureCredentialFile(filePath, [...lines, ...kept, ""].join("\n"));
   });
 }
@@ -9296,7 +9300,7 @@ var GitHubTokenManager = class extends BaseRefreshManager {
     const data = await response.json();
     const ghToken = data.userToken?.token ?? data.token;
     const ghUsername = data.userToken?.username ?? "x-access-token";
-    await this.updateGitCredentials(ghToken);
+    await this.updateGitCredentials(data.repositoryTokens ?? ghToken);
     await this.updateGhHostsFile(ghToken, ghUsername);
     if (data.gitIdentity) {
       await updateGitIdentity(data.gitIdentity, "GitHubTokenManager", ["github.com"]);
@@ -9310,9 +9314,7 @@ var GitHubTokenManager = class extends BaseRefreshManager {
   async updateGitCredentials(token) {
     const credentialsPath = path.join(ENGINE_ENV.HOME_DIR, ".git-credentials");
     try {
-      await upsertCredentialFileLines(credentialsPath, ["github.com"], [
-        `https://x-access-token:${token}@github.com`
-      ]);
+      await upsertCredentialFileLines(credentialsPath, ["github.com"], githubCredentialLines(token));
       console.log(`[GitHubTokenManager] Updated ${credentialsPath}`);
     } catch (error) {
       console.error("[GitHubTokenManager] Failed to update git credentials:", error);
@@ -9320,11 +9322,11 @@ var GitHubTokenManager = class extends BaseRefreshManager {
   }
   async updateGhHostsFile(token, username) {
     const hostsPath = path.join(ENGINE_ENV.HOME_DIR, ".config", "gh", "hosts.yml");
-    const content = `github.com:
+    const content = token ? `github.com:
     oauth_token: ${JSON.stringify(token)}
     user: ${JSON.stringify(username)}
     git_protocol: https
-`;
+` : "";
     try {
       await writeSecureCredentialFile(hostsPath, content, { ensureParentDir: true });
       console.log(`[GitHubTokenManager] Updated ${hostsPath}`);
@@ -9336,8 +9338,9 @@ var GitHubTokenManager = class extends BaseRefreshManager {
     const credentialsPath = path.join(ENGINE_ENV.HOME_DIR, ".git-credentials");
     await removeCredentialFileLines(
       credentialsPath,
-      (line) => line.endsWith("@github.com")
+      (line) => /^https:\/\/[^/]+@github\.com(?:\/|$)/.test(line)
     );
+    await this.updateGhHostsFile("", "x-access-token");
   }
 };
 var githubTokenManager = new GitHubTokenManager();

package/dist/src/post-tool-pr-hook.js

@@ -3,11 +3,11 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   notifyPostToolUse
-} from "./chunk-FTXE5FES.js";
+} from "./chunk-6M2VM5RC.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
-import "./chunk-24FE3TDH.js";
+import "./chunk-BU5GP3VV.js";
 import "./chunk-VEQXQN22.js";
 
 // src/post-tool-pr-hook.ts

package/dist/src/relay-mcp.js

@@ -4,7 +4,7 @@ const require = __createRequire(import.meta.url);
 import {
   messageRelaySubagentRequestSchema,
   spawnRelaySubagentRequestSchema
-} from "./chunk-24FE3TDH.js";
+} from "./chunk-BU5GP3VV.js";
 import "./chunk-VEQXQN22.js";
 
 // src/relay-mcp.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.759",
+  "version": "0.1.761",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",
@@ -19,7 +19,8 @@
     "scripts/opencode-command-protection-plugin.ts",
     "scripts/deepseek",
     "scripts/engine-watchdog.sh",
-    "scripts/lockmem.c"
+    "scripts/lockmem.c",
+    "scripts/gh.cjs"
   ],
   "scripts": {
     "dev": "tsx watch --conditions=development src/index.ts",

package/scripts/gh.cjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+const { spawnSync } = require('node:child_process');
+
+const args = process.argv.slice(2);
+const env = { ...process.env };
+const hostnameIndex = args.indexOf('--hostname');
+const hostname =
+  hostnameIndex >= 0
+    ? args[hostnameIndex + 1]
+    : args.find((arg) => arg.startsWith('--hostname='))?.slice(11);
+const needsCredentials =
+  !['version', 'help', 'completion'].includes(args[0]) &&
+  !args.some((arg) => ['--version', '--help', '-h'].includes(arg));
+if (
+  needsCredentials &&
+  !env.GH_TOKEN &&
+  !env.GITHUB_TOKEN &&
+  (!hostname || hostname === 'github.com') &&
+  (!env.GH_HOST || env.GH_HOST === 'github.com')
+) {
+  let repository;
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === '-R' || args[i] === '--repo') repository = args[++i];
+    else if (args[i].startsWith('--repo=')) repository = args[i].slice(7);
+    else if (args[i].startsWith('-R')) repository = args[i].slice(2);
+  }
+  const endpointRepository =
+    args[0] === 'api'
+      ? args
+          .slice(1)
+          .map((arg) => arg.match(/^\/?repos\/([^/]+\/[^/?]+)(?:[/?]|$)/)?.[1])
+          .find(Boolean)
+      : args[2]?.match(/^https:\/\/github\.com\/([^/]+\/[^/?]+)(?:[/?]|$)/)?.[1];
+  const positionalRepository = args[0] === 'repo' && args[1] === 'clone' ? args[2] : undefined;
+  repository =
+    (endpointRepository?.includes('{') ? undefined : endpointRepository) ||
+    repository ||
+    positionalRepository ||
+    env.GH_REPO;
+  if (!repository) {
+    const remote = spawnSync('git', ['remote', 'get-url', 'origin'], { encoding: 'utf8' });
+    if (remote.status === 0) repository = remote.stdout.trim();
+  }
+  const slug = repository
+    ?.replace(
+      /^(?:https:\/\/github\.com\/|ssh:\/\/git@github\.com\/|git@github\.com:|github\.com\/)/,
+      '',
+    )
+    .replace(/\/$/, '')
+    .replace(/\.git$/, '')
+    .toLowerCase();
+  if (slug) {
+    const credential = spawnSync('git', ['credential', 'fill'], {
+      encoding: 'utf8',
+      input: `protocol=https\nhost=github.com\npath=${slug}.git\n\n`,
+    });
+    if (credential.status === 0) env.GH_TOKEN = credential.stdout.match(/^password=(.*)$/m)?.[1];
+  }
+  if (!env.GH_TOKEN && !(args[0] === 'auth' && args[1] === 'status' && !repository)) {
+    process.stderr.write(
+      'Select a repository in this workspace: run gh inside its checkout, use --repo OWNER/REPO, or set GH_REPO=OWNER/REPO.\n',
+    );
+    process.exit(1);
+  }
+}
+const child = spawnSync('/usr/bin/gh', args, { env, stdio: 'inherit' });
+if (child.error) {
+  process.stderr.write(`${child.error.message}\n`);
+  process.exit(1);
+}
+if (child.signal) process.kill(process.pid, child.signal);
+else process.exit(child.status ?? 1);

package/workspace-sdk/index.js

@@ -107,7 +107,7 @@ const slack = {
   }),
 };
 
-const github = providerClient('/v1/engine/github/api');
+const github = providerClient('/v1/engine/github/api', (options) => ({ repository: options.repository }));
 
 const gitlab = providerClient('/v1/engine/gitlab/api', (options) => ({ host: options.host }));
 

package/workspace-sdk/index.test.ts

@@ -107,6 +107,8 @@ describe('@replicas/sdk', () => {
     process.env.REPLICAS_ENGINE_SECRET = 'engine-secret';
     process.env.REPLICAS_WORKSPACE_ID = 'workspace-1';
     try {
+      await replicas.github.request('/graphql', { repository: 'frontend/web', method: 'POST', body: { query: '{ viewer { login } }' } });
+      expect(observed?.body).toEqual({ path: '/graphql', repository: 'frontend/web', method: 'POST', body: { query: '{ viewer { login } }' } });
       await replicas.github.request('/user');
       expect(observed).toEqual({
         path: '/v1/engine/github/api',

package/workspace-sdk/shared/workspace-sdk.d.ts

@@ -40,7 +40,9 @@ export interface ReplicasSdk {
         }>;
     };
     github: {
-        request<T = unknown>(path: string, options?: ProviderRequestOptions): Promise<T>;
+        request<T = unknown>(path: string, options?: ProviderRequestOptions & {
+            repository?: string;
+        }): Promise<T>;
     };
     gitlab: {
         request<T = unknown>(path: string, options?: ProviderRequestOptions & {