replicas-engine 0.1.834 → 0.1.836

package/dist/src/{asp-host-WR4AXITI.js → asp-host-N46SGKAS.js}

@@ -5,11 +5,11 @@ import {
   getCodexAspHost,
   restartCodexAspHost,
   restartCodexAspHostIfRunning
-} from "./chunk-32NJI2LJ.js";
-import "./chunk-4T7IB2IL.js";
-import "./chunk-RAXPRO4T.js";
+} from "./chunk-VX6UXEHB.js";
+import "./chunk-UGHIPDUS.js";
+import "./chunk-6LSFOGWT.js";
 import "./chunk-UZSNFLDQ.js";
-import "./chunk-YIBBAGHQ.js";
+import "./chunk-IBKIJUQW.js";
 import "./chunk-VEQXQN22.js";
 export {
   getCodexAspHost,

package/dist/src/{chunk-RAXPRO4T.js → chunk-6LSFOGWT.js}

@@ -4,7 +4,7 @@ const require = __createRequire(import.meta.url);
 import {
   HOOK_EXEC_MAX_BUFFER_BYTES,
   isVersionBelow
-} from "./chunk-YIBBAGHQ.js";
+} from "./chunk-IBKIJUQW.js";
 
 // src/utils/codex-agent-env.ts
 function buildCodexAgentEnv(source = process.env) {
@@ -241,7 +241,7 @@ var DEFAULT_CODEX_ARGS = [
 var MIN_CODEX_CLI_VERSION = "0.153.3";
 var CODEX_UPGRADE_TIMEOUT_MS = 12e4;
 var codexCliVersionEnsured = null;
-var ENGINE_PACKAGE_VERSION = "0.1.834";
+var ENGINE_PACKAGE_VERSION = "0.1.836";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";

package/dist/src/{chunk-YIBBAGHQ.js → chunk-IBKIJUQW.js}

@@ -2402,7 +2402,7 @@ gh pr review 123 --request-changes --body "Changes needed"
 
 ## Media in GitHub workflows
 
-Media delivery is owned by \`references/MEDIA.md\`. Read its GitHub section before adding screenshots, recordings, diagrams, or HTML reports to a pull request, issue, review comment, or commit; it covers the Replicas upload, GitHub's inline fallback, and the required **View in Replicas** link.
+Media delivery is owned by \`references/MEDIA.md\`. Read its GitHub section before adding screenshots, recordings, diagrams, or HTML reports to a pull request, issue, review comment, or commit; it covers public Forge embeds for images and recording previews, organization-only HTML links, and the required **View in Replicas** link.
 `;
 var GITHUB_ABILITY = {
   label: "GitHub",
@@ -2605,7 +2605,7 @@ Upload to Replicas in these cases \u2014 and **only** these cases:
 
 1. **Media you produce.** Any screenshot, screen recording, generated diagram, audio clip, or HTML page you create that the user might want to see. Upload before doing anything else with the file (analyzing, deleting, sending elsewhere). This applies even when you're also sending the file to Slack, Linear, GitHub, or GitLab.
 2. **Files the user explicitly asks you to upload.** If the user sends or points at a file (image, video, audio, HTML) and asks you to upload it, run \`replicas media upload\`. Otherwise leave it alone \u2014 files in the workspace the user did not ask about should not be auto-uploaded as media.
-3. **Anything you plan to share externally (Slack, Linear, GitHub, GitLab, etc.).** Upload to Replicas *in addition to* the platform's destination upload. Never as a replacement.
+3. **Anything you plan to share externally (Slack, Linear, GitHub, GitLab, etc.).** Upload to Replicas first, then follow the destination's delivery path below.
 
 If none of these apply, don't upload.
 
@@ -2615,9 +2615,9 @@ If none of these apply, don't upload.
 
 1. First, run \`replicas media upload\` with the original file. Do not begin any destination upload until the command succeeds. This creates the canonical dashboard copy and prints a chat embed plus a per-file dashboard link. With public access, the printed Forge embed is the chat embed and is also safe to use on GitHub.
 2. Include the printed embed line in the Replicas chat reply, followed by the matching **View in Replicas** link. HTML uses its printed page link instead of an image embed.
-3. Identify every destination in the task and attempt to upload the same original bytes there. Use the destination's inline representation from the table below; do not replace the file with a Replicas link.
+3. Identify every destination in the task and use its inline representation from the table below. Slack, Linear, and GitLab require an upload of the same original bytes; GitHub uses the public Forge embed.
 4. Put the **View in Replicas** dashboard link next to the destination embed as a secondary link.
-5. Check each destination response. If a native upload is unavailable or fails, say so explicitly and keep the dashboard link; never claim that a link is an inline upload.
+5. Check each destination response. If its upload or Forge share fails, say so explicitly and keep the dashboard link; never claim that a dashboard link is an inline embed.
 
 | Destination | Required file delivery | Inline result |
 |---|---|---|
@@ -2625,9 +2625,9 @@ If none of these apply, don't upload.
 | Slack | \`files.getUploadURLExternal\` \u2192 raw-byte POST \u2192 \`files.completeUploadExternal\` | Uploaded file in the channel or thread |
 | Linear | \`fileUpload\` mutation \u2192 presigned upload \u2192 issue/comment mutation | Returned \`assetUrl\` in Markdown |
 | GitLab | Project \`/uploads\` endpoint with the original bytes | Returned GitLab Markdown |
-| GitHub | \`gh\` v2.99.0+ \`--attach\` for images and videos; use a Replicas public forge share as the fallback | Native GitHub attachment URL, or a Forge embed fallback |
+| GitHub | Replicas public Forge share for an image or recording poster | Printed Forge embed, linked to the recording when needed |
 
-The dashboard link is the subtitle and jump-back path. It is never a substitute for the destination upload.
+The dashboard link is the subtitle and jump-back path. It is never a substitute for the destination embed.
 
 ## Uploading to Replicas
 
@@ -2656,7 +2656,7 @@ Names are normalized to hyphen-case (spaces become hyphens, e.g. \`Login page\`
 For each media file, the CLI prints an embed line and a dashboard link:
 
 1. Default and organization access print \`Replicas chat embed: ![filename](<api-url>)\`; this authenticated URL renders inline in Replicas chat **only** \u2014 see below.
-2. Public access (\`--access public\` or \`--share\`) prints \`![filename](<public-url>)\` as the Forge embed instead. This is the public, stable bearer URL for GitHub fallback embeds when native \`--attach\` is unavailable and sharing is authorized.
+2. Public access (\`--access public\` or \`--share\`) prints \`![filename](<public-url>)\` as the Forge embed instead. This is the public, stable bearer URL to paste into GitHub when sharing is authorized.
 3. \`View in Replicas: <deep-link>\` is a per-file dashboard URL of the form \`https://app.replicas.dev/workspaces/<workspace-id>?media=<media-id>\` that opens directly to that specific file.
 
 Match each "View in Replicas" line to the embed line directly above it \u2014 that's the deep link for that file.
@@ -2685,7 +2685,7 @@ replicas media upload screenshot.png --name "Login page" --access public
 |---|---|---|
 | \`https://api.replicas.dev/v1/media/<id>\` (inside \`![\u2026](\u2026)\`) | Authenticated API redirect to a presigned blob \u2014 requires the Replicas chat session | **Only** in the Replicas chat reply. Nowhere else. |
 | \`https://replicas.dev/organizations/<organization-id>/media/<media-id>\` | Organization-only page printed by \`--access organization\` | Pull requests and other places where every viewer belongs to the Replicas organization. |
-| \`https://api.replicas.dev/v1/media/public/<id>/<token>\` | Opt-in public bearer URL printed by \`--access public\` or \`--share\` | The Replicas chat reply and GitHub fallback embeds, for image, video, or audio media. |
+| \`https://api.replicas.dev/v1/media/public/<id>/<token>\` | Opt-in public bearer URL printed by \`--access public\` or \`--share\` | The Replicas chat reply and GitHub embeds, for image, video, or audio media. |
 | \`https://app.replicas.dev/workspaces/<workspace-id>?media=<media-id>\` | Authenticated dashboard deep link that opens the media file in the workspace | Everywhere external: Slack, GitHub, GitLab, Linear, PR bodies, comments, emails. |
 
 ### NEVER link the API redirect URL outside the Replicas chat reply
@@ -2724,12 +2724,12 @@ After (or alongside) the embeds, include a \`[View in Replicas](<deep-link>)\` h
 
 After \`replicas media upload\` succeeds, external delivery has two required follow-up steps for every file:
 
-1. **Upload the raw bytes through that platform's supported inline path** so the recipient sees the media embedded in the message itself.
+1. **Use the destination's inline representation:** upload the raw bytes to Slack, Linear, or GitLab; embed a public Forge share on GitHub.
 2. **Link the Replicas dashboard deep link** (\`?media=<id>\` form) so the user can jump straight to the file in the workspace.
 
-A link alone is not enough. An upload without the dashboard link is not enough. Do both.
+A dashboard link alone is not enough. An embed without the dashboard link is not enough. Do both.
 
-Slack, Linear, and GitLab receive the original bytes through their native upload APIs. GitHub image and video attachments use \`gh --attach\` when the installed CLI and host support it; use an explicit Replicas public share only as the fallback.
+Slack, Linear, and GitLab receive the original bytes through their native upload APIs. GitHub uses a Replicas public Forge share for screenshots and recording previews.
 
 ### Slack \u2014 embed natively via the 3-step external file upload flow
 
@@ -2830,44 +2830,28 @@ The same flow works for issue bodies (use \`issueCreate\` / \`issueUpdate\` with
 
 Never paste the \`api.replicas.dev/v1/media/<id>\` URL into a Linear body or comment \u2014 it will render as a broken image to anyone outside your Replicas chat.
 
-### GitHub: native image and video attachments
+### GitHub: inline images and recording previews via Forge
 
-GitHub CLI v2.99.0+ supports a repeatable \`--attach\` flag on \`gh pr create\`, \`gh pr edit\`, and \`gh pr comment\` for GitHub.com and GitHub Enterprise Cloud. It uploads local images and videos to GitHub and writes the resulting attachment URL into the PR body or comment; it requires push access to the repository. GitHub Enterprise Server and unsupported media kinds are not covered by this path. See [GitHub's attachment guide](https://docs.github.com/en/github-cli/github-cli/attaching-files-with-github-cli).
+Replicas authenticates GitHub with GitHub App tokens, which native GitHub CLI attachment uploads do not support. Do not use \`gh --attach\` for media. Use a public Forge share for images in PR descriptions, issues, and comments.
 
-Check \`gh --version\` before choosing the delivery path. On a supported host with v2.99.0 or later:
+Create a public share only for a public repository or after explicit consent to publish media from a private repository. If sharing is not authorized, keep the media private and include its **View in Replicas** link, explaining that inline GitHub images require a public share.
 
-1. Run \`replicas media upload\` with the original file first, without \`--share\`. Keep the matching **View in Replicas** dashboard link for the PR.
-2. Put each local file path in the Markdown body where the attachment should appear, and place its dashboard link next to it.
-3. Pass the same original path once with \`--attach\`. GitHub CLI rewrites a matching local reference in place, preserving its alt text; an unreferenced attachment is appended to the body.
-
-\`\`\`markdown
-Before the change:
-
-![Before state](/tmp/before.png)
-[View in Replicas](https://app.replicas.dev/workspaces/<workspace-id>?media=<before-media-id>)
-\`\`\`
+1. Upload the image with public access. This creates both the Replicas dashboard copy and the Forge share:
 
 \`\`\`bash
-gh pr create \\
-  --title "Describe the change" \\
-  --body-file /tmp/pr-body.md \\
-  --attach /tmp/before.png
-
-gh pr edit 456 --body-file /tmp/pr-body.md --attach /tmp/after.png
-gh pr comment 456 --body-file /tmp/comment.md --attach /tmp/result.mp4
+replicas media upload /tmp/screenshot.png --name "PR screenshot" --access public
 \`\`\`
 
-Repeat \`--attach\` for multiple files, up to 50 per command. For an appended image, add alt text after the path with \`#\`, for example \`--attach './error.png#Error state'\`. To render a video as a player, its local Markdown reference must be the only content in its paragraph. Do not paste a Replicas authenticated API URL into the body, and do not emulate GitHub's undocumented browser upload endpoint.
-
-### GitHub attachment fallback
-
-If \`--attach\` is unavailable, the target is GitHub Enterprise Server, the file is not an image or video, or the native upload fails, keep the Replicas dashboard link and report the limitation. For an inline screenshot or video poster, create a Replicas public forge share only for a public repository or after explicit consent to publish media from a private repository, then use the printed \`Forge embed\` Markdown:
+2. Copy the printed \`![filename](<public-url>)\` Forge embed into the body file, followed by the matching **View in Replicas** link. Use the printed public URL verbatim; never use a local file path, the authenticated API URL, or an expiring storage URL.
+3. Create or update the PR using the body file:
 
 \`\`\`bash
-replicas media upload /tmp/screenshot.png --name "PR screenshot" --share
+gh pr create --title "Describe the change" --body-file /tmp/pr-body.md
+gh pr edit 456 --body-file /tmp/pr-body.md
+gh pr comment 456 --body-file /tmp/comment.md
 \`\`\`
 
-For a fallback recording preview, upload the MP4 normally, generate a poster with \`ffmpeg -i /tmp/demo.mp4 -frames:v 1 /tmp/demo-poster.png\`, share the poster, and link its embed to the recording's **View in Replicas** URL:
+GitHub does not reliably render external videos as inline players. For a recording preview, upload the MP4 normally, generate a poster with \`ffmpeg -i /tmp/demo.mp4 -frames:v 1 /tmp/demo-poster.png\`, upload the poster with \`--access public\`, and link its Forge embed to the recording's **View in Replicas** URL:
 
 \`\`\`markdown
 [![Demo recording](<public-poster-url>)](<recording-dashboard-url>)

package/dist/src/{chunk-4T7IB2IL.js → chunk-UGHIPDUS.js}

@@ -15,7 +15,7 @@ import {
   isValidRelayBaseProvider,
   parsePosixEnvFile,
   readReplicasRuntimeEnv
-} from "./chunk-YIBBAGHQ.js";
+} from "./chunk-IBKIJUQW.js";
 
 // src/engine-env.ts
 import { readFileSync as readFileSync2 } from "fs";

package/dist/src/{chunk-MYD5ZGCU.js → chunk-UXJA4LPH.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   shouldRefreshPullRequests
-} from "./chunk-YIBBAGHQ.js";
+} from "./chunk-IBKIJUQW.js";
 
 // src/services/post-tool-pr-notifier.ts
 async function notifyPostToolUse(toolName, toolInput) {

package/dist/src/{chunk-32NJI2LJ.js → chunk-VX6UXEHB.js}

@@ -5,13 +5,13 @@ import {
   ENGINE_ENV,
   monolithRequest,
   setAgentCredentialSnapshot
-} from "./chunk-4T7IB2IL.js";
+} from "./chunk-UGHIPDUS.js";
 import {
   AppServerProcess,
   SUBPROCESS_MAX_BUFFER,
   buildCodexAgentEnv,
   execFileAsync
-} from "./chunk-RAXPRO4T.js";
+} from "./chunk-6LSFOGWT.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
@@ -23,7 +23,7 @@ import {
   createSuccessResult,
   listOpenAICompatibleModels,
   resolveOpenAICompatibleModelsUrl
-} from "./chunk-YIBBAGHQ.js";
+} from "./chunk-IBKIJUQW.js";
 
 // src/managers/codex-token-manager.ts
 import { promises as fs } from "fs";
@@ -238,7 +238,7 @@ var CodexTokenManager = class extends BaseRefreshManager {
     const data = await response.json();
     await this.applyCredentialsResponse(data);
     if (restartOnChange && CODEX_AUTH_ENV_KEYS.some((key, index) => process.env[key] !== previousEnv[index])) {
-      const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-WR4AXITI.js");
+      const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-N46SGKAS.js");
       await restartCodexAspHostIfRunning2();
     }
     if (data.scope) {

package/dist/src/{chunk-NGAPGKWO.js → chunk-YD737SZV.js}

@@ -3,12 +3,12 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   monolithRequest
-} from "./chunk-4T7IB2IL.js";
+} from "./chunk-UGHIPDUS.js";
 import {
   extractCommandProtectionCommandText,
   findGitCommitSignals,
   findPrMergeSignals
-} from "./chunk-YIBBAGHQ.js";
+} from "./chunk-IBKIJUQW.js";
 
 // src/services/command-protection-service.ts
 var DEFAULT_COMMAND_PROTECTION_BLOCK_MESSAGE = "Blocked by Replicas command protection.";

package/dist/src/command-protection-hook.js

@@ -3,12 +3,12 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   evaluateCommandProtection
-} from "./chunk-NGAPGKWO.js";
-import "./chunk-4T7IB2IL.js";
+} from "./chunk-YD737SZV.js";
+import "./chunk-UGHIPDUS.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
-import "./chunk-YIBBAGHQ.js";
+import "./chunk-IBKIJUQW.js";
 import "./chunk-VEQXQN22.js";
 
 // src/command-protection-hook.ts

package/dist/src/deepseek-command-protection-plugin.js

@@ -3,13 +3,13 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   evaluateCommandProtection
-} from "./chunk-NGAPGKWO.js";
+} from "./chunk-YD737SZV.js";
 import {
   notifyPostToolUse
-} from "./chunk-MYD5ZGCU.js";
-import "./chunk-4T7IB2IL.js";
+} from "./chunk-UXJA4LPH.js";
+import "./chunk-UGHIPDUS.js";
 import "./chunk-UZSNFLDQ.js";
-import "./chunk-YIBBAGHQ.js";
+import "./chunk-IBKIJUQW.js";
 import "./chunk-VEQXQN22.js";
 
 // src/deepseek-command-protection-plugin.ts

package/dist/src/headless-agent.js

@@ -8,12 +8,12 @@ import {
 import {
   AppServerProcess,
   buildCodexAgentEnv
-} from "./chunk-RAXPRO4T.js";
+} from "./chunk-6LSFOGWT.js";
 import {
   AGENT,
   getMemoryOutputSafetyViolation,
   headlessAgentRequestSchema
-} from "./chunk-YIBBAGHQ.js";
+} from "./chunk-IBKIJUQW.js";
 import "./chunk-VEQXQN22.js";
 
 // src/headless-agent.ts

package/dist/src/index.js

@@ -91,7 +91,7 @@ import {
   evaluateCommandProtection,
   extractToolCommand,
   reportCommandProtectionBlock
-} from "./chunk-NGAPGKWO.js";
+} from "./chunk-YD737SZV.js";
 import {
   ACCOUNT_RATE_LIMITS_UPDATED_METHOD,
   AGENT_MESSAGE_DELTA_METHOD,
@@ -131,20 +131,20 @@ import {
   recordCredentialFallback,
   recordExhaustedCredential,
   restartCodexAspHost
-} from "./chunk-32NJI2LJ.js";
+} from "./chunk-VX6UXEHB.js";
 import {
   ENGINE_ENV,
   IS_WARMING_MODE,
   monolithRequest,
   monolithService,
   setAgentCredentialSnapshot
-} from "./chunk-4T7IB2IL.js";
+} from "./chunk-UGHIPDUS.js";
 import {
   AspClient,
   SUBPROCESS_MAX_BUFFER,
   execAsync,
   execFileAsync
-} from "./chunk-RAXPRO4T.js";
+} from "./chunk-6LSFOGWT.js";
 import {
   isRecord as isRecord2
 } from "./chunk-UZSNFLDQ.js";
@@ -352,7 +352,7 @@ import {
   spawnRelaySubagentRequestSchema,
   stripAgentDiagnosticErrors,
   withTimeout
-} from "./chunk-YIBBAGHQ.js";
+} from "./chunk-IBKIJUQW.js";
 import {
   __commonJS,
   __export,

package/dist/src/post-tool-pr-hook.js

@@ -3,11 +3,11 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   notifyPostToolUse
-} from "./chunk-MYD5ZGCU.js";
+} from "./chunk-UXJA4LPH.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
-import "./chunk-YIBBAGHQ.js";
+import "./chunk-IBKIJUQW.js";
 import "./chunk-VEQXQN22.js";
 
 // src/post-tool-pr-hook.ts

package/dist/src/relay-mcp.js

@@ -7,7 +7,7 @@ import {
 import {
   messageRelaySubagentRequestSchema,
   spawnRelaySubagentRequestSchema
-} from "./chunk-YIBBAGHQ.js";
+} from "./chunk-IBKIJUQW.js";
 import "./chunk-VEQXQN22.js";
 
 // src/relay-mcp.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.834",
+  "version": "0.1.836",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",