replicas-engine 0.1.976 → 0.1.977

package/dist/src/{asp-host-KBYF3XHV.js → asp-host-N276J7RL.js}

@@ -5,12 +5,12 @@ import {
   getCodexAspHost,
   restartCodexAspHost,
   restartCodexAspHostIfRunning
-} from "./chunk-ZOYKIW5D.js";
-import "./chunk-TCG5OMQH.js";
-import "./chunk-2HTVMGEW.js";
-import "./chunk-X5MYHFWW.js";
+} from "./chunk-7PG7CEM5.js";
+import "./chunk-RCD357QL.js";
+import "./chunk-56WQAG5I.js";
+import "./chunk-TMQGB4OW.js";
 import "./chunk-UZSNFLDQ.js";
-import "./chunk-NTM575B4.js";
+import "./chunk-LGWE7MSQ.js";
 import "./chunk-VEQXQN22.js";
 export {
   getCodexAspHost,

package/dist/src/{chunk-2HTVMGEW.js → chunk-56WQAG5I.js}

@@ -3,10 +3,10 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   execFileAsync
-} from "./chunk-X5MYHFWW.js";
+} from "./chunk-TMQGB4OW.js";
 import {
   isVersionBelow
-} from "./chunk-NTM575B4.js";
+} from "./chunk-LGWE7MSQ.js";
 
 // src/utils/codex-agent-env.ts
 function buildCodexAgentEnv(source = process.env) {
@@ -240,7 +240,7 @@ function getCodexModelProvider(method) {
   if (method === "foundry") return "azure";
   return method === "ollama" || method === "openai-compatible" ? "replicas_openai_compatible" : "openai";
 }
-var ENGINE_PACKAGE_VERSION = "0.1.976";
+var ENGINE_PACKAGE_VERSION = "0.1.977";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";

package/dist/src/{chunk-ZOYKIW5D.js → chunk-7PG7CEM5.js}

@@ -5,15 +5,15 @@ import {
   ENGINE_ENV,
   monolithRequest,
   setAgentCredentialSnapshot
-} from "./chunk-TCG5OMQH.js";
+} from "./chunk-RCD357QL.js";
 import {
   AppServerProcess,
   buildCodexAgentEnv
-} from "./chunk-2HTVMGEW.js";
+} from "./chunk-56WQAG5I.js";
 import {
   SUBPROCESS_MAX_BUFFER,
   execFileAsync
-} from "./chunk-X5MYHFWW.js";
+} from "./chunk-TMQGB4OW.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
@@ -27,7 +27,7 @@ import {
   listOpenAICompatibleModels,
   readOllamaAuthEnv,
   resolveOpenAICompatibleModelsUrl
-} from "./chunk-NTM575B4.js";
+} from "./chunk-LGWE7MSQ.js";
 
 // src/managers/codex-token-manager.ts
 import { promises as fs } from "fs";
@@ -260,7 +260,7 @@ var CodexTokenManager = class extends BaseRefreshManager {
     await this.applyCredentialUpdate(++this.credentialGeneration, async () => {
       await this.applyCredentialsResponse(data);
       setAgentCredentialSnapshot("codex", data);
-      const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-KBYF3XHV.js");
+      const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-N276J7RL.js");
       await restartCodexAspHostIfRunning2();
     });
     await this.start(true);
@@ -280,7 +280,7 @@ var CodexTokenManager = class extends BaseRefreshManager {
     await this.applyCredentialUpdate(generation, async () => {
       await this.applyCredentialsResponse(data);
       if (restartOnChange && CODEX_AUTH_ENV_KEYS.some((key, index) => process.env[key] !== previousEnv[index])) {
-        const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-KBYF3XHV.js");
+        const { restartCodexAspHostIfRunning: restartCodexAspHostIfRunning2 } = await import("./asp-host-N276J7RL.js");
         await restartCodexAspHostIfRunning2();
       }
       setAgentCredentialSnapshot("codex", data);

package/dist/src/{chunk-DTKUVZ6U.js → chunk-K2WA7ZYZ.js}

@@ -5,7 +5,7 @@ import {
   extractCommandProtectionCommandText,
   isRecord,
   parseCodeHostPrUrl
-} from "./chunk-NTM575B4.js";
+} from "./chunk-LGWE7MSQ.js";
 
 // src/services/published-pull-request-urls.ts
 function publishedPullRequestUrls(result) {

package/dist/src/{chunk-NTM575B4.js → chunk-LGWE7MSQ.js}

@@ -823,6 +823,19 @@ var CREDENTIAL_TYPE = {
   MUSE_OAUTH: "muse_oauth",
   MUSE_API_KEY: "muse_api_key"
 };
+var ENVIRONMENT_AUTH_REQUIRED_KEYS = {
+  [AGENT.CLAUDE]: [
+    [CREDENTIAL_METHOD.BEDROCK, ["CLAUDE_CODE_USE_BEDROCK", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY"]],
+    [CREDENTIAL_METHOD.API_KEY, ["ANTHROPIC_API_KEY"]]
+  ],
+  [AGENT.CODEX]: [[CREDENTIAL_METHOD.API_KEY, ["OPENAI_API_KEY"]]]
+};
+function isEnvironmentKeySet(env, key) {
+  return !!env[key]?.trim();
+}
+function detectEnvironmentAuthMethod(agent, env) {
+  return ENVIRONMENT_AUTH_REQUIRED_KEYS[agent].find(([, keys]) => keys.every((key) => isEnvironmentKeySet(env, key)))?.[0];
+}
 var INFERENCE_PROVIDER_LABELS = {
   [CREDENTIAL_METHOD.OLLAMA]: "Ollama",
   [CREDENTIAL_METHOD.OPENCODE_GO]: "OpenCode Go",
@@ -8866,6 +8879,7 @@ function normalizeChatTranscriptMetadata(value) {
     relayBaseProvider,
     credential,
     credentialSource,
+    environmentAuthMethod,
     model,
     title,
     displayName,
@@ -8886,6 +8900,8 @@ function normalizeChatTranscriptMetadata(value) {
   const parsedCredential = agentCredentialSnapshotSchema.safeParse(credential);
   if (parsedCredential.success) metadata.credential = parsedCredential.data;
   if (credentialSource === "stored" || credentialSource === "environment") metadata.credentialSource = credentialSource;
+  const authMethod = Object.values(CREDENTIAL_METHOD).find((method) => method === environmentAuthMethod);
+  if (authMethod) metadata.environmentAuthMethod = authMethod;
   if (typeof model === "string") metadata.model = model;
   if (typeof title === "string") metadata.title = title;
   if (typeof displayName === "string") metadata.displayName = displayName;
@@ -8975,6 +8991,7 @@ export {
   getDefaultOllamaModel,
   listOllamaModels,
   CREDENTIAL_METHOD,
+  detectEnvironmentAuthMethod,
   AGENT_CREDENTIAL_METHODS_IN_ORDER,
   describeCredential,
   agentCredentialSnapshotSchema,
@@ -9172,6 +9189,7 @@ export {
   formatChatForkHandoffMessage,
   formatSideChatUpdateMessage,
   readJsonlPage,
+  normalizeChatTranscriptMetadata,
   parseChatTranscriptArtifact,
   readSseStream,
   parseFrontmatter,

package/dist/src/{chunk-TCG5OMQH.js → chunk-RCD357QL.js}

@@ -14,7 +14,7 @@ import {
   isValidAgentProvider,
   parsePosixEnvFile,
   readReplicasRuntimeEnv
-} from "./chunk-NTM575B4.js";
+} from "./chunk-LGWE7MSQ.js";
 
 // src/runtime-env-loader.ts
 import { readFileSync } from "fs";

package/dist/src/{chunk-X5MYHFWW.js → chunk-TMQGB4OW.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   HOOK_EXEC_MAX_BUFFER_BYTES
-} from "./chunk-NTM575B4.js";
+} from "./chunk-LGWE7MSQ.js";
 
 // src/utils/exec.ts
 import { exec, execFile } from "child_process";

package/dist/src/{chunk-OXFR4PCR.js → chunk-ZAPWSOKN.js}

@@ -3,18 +3,18 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   monolithRequest
-} from "./chunk-TCG5OMQH.js";
+} from "./chunk-RCD357QL.js";
 import {
   SUBPROCESS_MAX_BUFFER,
   execFileAsync
-} from "./chunk-X5MYHFWW.js";
+} from "./chunk-TMQGB4OW.js";
 import {
   extractCommandProtectionCommandText,
   findCommandProtectionGitLookups,
   findGitCommitSignals,
   findPrMergeSignals,
   parseCommandProtectionRequest
-} from "./chunk-NTM575B4.js";
+} from "./chunk-LGWE7MSQ.js";
 
 // src/services/command-protection-service.ts
 import { readFile, stat } from "fs/promises";

package/dist/src/command-protection-hook.js

@@ -3,13 +3,13 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   evaluateCommandProtection
-} from "./chunk-OXFR4PCR.js";
-import "./chunk-TCG5OMQH.js";
-import "./chunk-X5MYHFWW.js";
+} from "./chunk-ZAPWSOKN.js";
+import "./chunk-RCD357QL.js";
+import "./chunk-TMQGB4OW.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
-import "./chunk-NTM575B4.js";
+import "./chunk-LGWE7MSQ.js";
 import "./chunk-VEQXQN22.js";
 
 // src/command-protection-hook.ts

package/dist/src/headless-agent.js

@@ -7,12 +7,12 @@ import {
 import {
   AppServerProcess,
   buildCodexAgentEnv
-} from "./chunk-2HTVMGEW.js";
-import "./chunk-X5MYHFWW.js";
+} from "./chunk-56WQAG5I.js";
+import "./chunk-TMQGB4OW.js";
 import {
   AGENT,
   headlessAgentRequestSchema
-} from "./chunk-NTM575B4.js";
+} from "./chunk-LGWE7MSQ.js";
 import "./chunk-VEQXQN22.js";
 
 // src/headless-agent.ts

package/dist/src/index.js

@@ -32,7 +32,7 @@ import {
   reportCommandProtectionBlock,
   resolveDiffBase,
   runGitCommand
-} from "./chunk-OXFR4PCR.js";
+} from "./chunk-ZAPWSOKN.js";
 import {
   ACCOUNT_RATE_LIMITS_UPDATED_METHOD,
   AGENT_MESSAGE_DELTA_METHOD,
@@ -57,7 +57,7 @@ import {
 } from "./chunk-P73LGPQO.js";
 import {
   publishedPullRequestUrls
-} from "./chunk-DTKUVZ6U.js";
+} from "./chunk-K2WA7ZYZ.js";
 import {
   BaseRefreshManager,
   CodexAspAuthMethodChangedError,
@@ -72,7 +72,7 @@ import {
   refreshDelayMs,
   restartCodexAspHost,
   routineRefreshExclusions
-} from "./chunk-ZOYKIW5D.js";
+} from "./chunk-7PG7CEM5.js";
 import {
   ENGINE_ENV,
   monolithRequest,
@@ -80,16 +80,16 @@ import {
   readRuntimeEnvFile,
   reloadEngineEnv,
   setAgentCredentialSnapshot
-} from "./chunk-TCG5OMQH.js";
+} from "./chunk-RCD357QL.js";
 import {
   AspClient,
   getCodexModelProvider
-} from "./chunk-2HTVMGEW.js";
+} from "./chunk-56WQAG5I.js";
 import {
   SUBPROCESS_MAX_BUFFER,
   execAsync,
   execFileAsync
-} from "./chunk-X5MYHFWW.js";
+} from "./chunk-TMQGB4OW.js";
 import {
   isRecord as isRecord2
 } from "./chunk-UZSNFLDQ.js";
@@ -215,6 +215,7 @@ import {
   describeCredential,
   describeQuotaLimit,
   detectAgentQuotaLimit,
+  detectEnvironmentAuthMethod,
   detectLanguageByPath,
   excludeQueuedAcceptedEvents,
   extractErrorText,
@@ -271,6 +272,7 @@ import {
   mergeSlashCommands,
   messageSubagentRequestSchema,
   normalizeAutoCompactThreshold,
+  normalizeChatTranscriptMetadata,
   normalizeClaudeModel,
   normalizeCodexAspTranscriptStatus,
   normalizeContentBlocks,
@@ -310,7 +312,7 @@ import {
   workspaceCredentialProviderSchema,
   workspaceTokenRequestSchema,
   workspaceTokenResponseSchema
-} from "./chunk-NTM575B4.js";
+} from "./chunk-LGWE7MSQ.js";
 import {
   cloneMcpConfig,
   ensureCompatibilityImports,
@@ -10004,7 +10006,7 @@ var MUSE_AUTH_PATH = join5(homedir3(), ".config", "muse", "auth.json");
 
 // src/managers/codex-auth.ts
 function detectCodexAuthMethod() {
-  return ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD ?? (ENGINE_ENV.OPENAI_API_KEY ? "api_key" : "none");
+  return ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD ?? detectEnvironmentAuthMethod(AGENT.CODEX, process.env) ?? "none";
 }
 
 // src/managers/agent-auth-detection.ts
@@ -10017,13 +10019,7 @@ function detectClaudeAuthMethod() {
   if (ENGINE_ENV.REPLICAS_CLAUDE_AUTH_METHOD === "foundry") {
     return "foundry";
   }
-  if (ENGINE_ENV.CLAUDE_CODE_USE_BEDROCK && ENGINE_ENV.AWS_ACCESS_KEY_ID && ENGINE_ENV.AWS_SECRET_ACCESS_KEY) {
-    return "bedrock";
-  }
-  if (ENGINE_ENV.ANTHROPIC_API_KEY) {
-    return "api_key";
-  }
-  return "none";
+  return detectEnvironmentAuthMethod(AGENT.CLAUDE, process.env) ?? "none";
 }
 function detectAgentAuthMethod(provider) {
   if (OLLAMA_AGENTS.some((agent) => agent === provider && readOllamaAuthEnv(agent, process.env))) return "ollama";
@@ -60211,6 +60207,17 @@ var ALWAYS_UPLOAD_HISTORY_DIRS = /* @__PURE__ */ new Set([
   HISTORY_DIR_BY_PROVIDER.claude,
   HISTORY_DIR_BY_PROVIDER.codex
 ]);
+function currentTranscriptAuth(provider) {
+  const credential = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS[provider];
+  if (credential) return { credential, credentialSource: "stored" };
+  const method = detectAgentAuthMethod(provider);
+  return method === "none" ? {} : { credentialSource: "environment", environmentAuthMethod: method };
+}
+function normalizeTranscriptAuth(value) {
+  if (!isRecord(value)) return void 0;
+  const { credential, credentialSource, environmentAuthMethod } = normalizeChatTranscriptMetadata(value);
+  return { credential, credentialSource, environmentAuthMethod };
+}
 function shouldFlushChatTranscript(historyDir, chat, chatsById) {
   return ALWAYS_UPLOAD_HISTORY_DIRS.has(historyDir) || Boolean(chat?.parentChatId && chatsById.has(chat.parentChatId));
 }
@@ -60259,12 +60266,10 @@ function uploadChatTranscript(chatId, filePath, chat, capture) {
 async function uploadChatTranscriptNow(chatId, filePath, chat, capture) {
   const { size } = await stat5(filePath);
   if (size === 0) return null;
-  const credential = chat && ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS[chat.provider];
   const metadata = chat ? {
     provider: chat.provider,
-    credential,
-    // Without a stored credential the agent can only have run on environment-variable auth.
-    credentialSource: credential ? "stored" : detectAgentAuthMethod(chat.provider) === "none" ? void 0 : "environment",
+    // Chats with no turn since this engine version fall back to the auth live at upload.
+    ...chat.transcriptAuth ?? currentTranscriptAuth(chat.provider),
     model: chat.model,
     title: chat.title,
     displayName: chat.displayName,
@@ -60627,6 +60632,7 @@ function normalizePersistedChat(chat) {
     fork: coerceChatForkInfo(chat.fork),
     pendingForkHandoff: chat.pendingForkHandoff === true,
     ...chat.chatCredential === "workspace" || agentCredentialSnapshotSchema.safeParse(chat.chatCredential).success ? { chatCredential: chat.chatCredential } : {},
+    transcriptAuth: normalizeTranscriptAuth(chat.transcriptAuth),
     removedMessageIds: Array.isArray(chat.removedMessageIds) ? chat.removedMessageIds.filter((id) => typeof id === "string").slice(-MAX_REMOVED_MESSAGE_IDS) : [],
     acceptedSendResponses: isRecord2(chat.acceptedSendResponses) ? Object.fromEntries(Object.entries(chat.acceptedSendResponses).filter((entry) => {
       const response = entry[1];
@@ -61471,7 +61477,7 @@ var ChatService = class {
     return count;
   }
   toTranscriptSource(chat) {
-    return { ...this.toSummary(chat), removedMessageIds: chat.persisted.removedMessageIds };
+    return { ...this.toSummary(chat), removedMessageIds: chat.persisted.removedMessageIds, transcriptAuth: chat.persisted.transcriptAuth };
   }
   uploadChatTranscript(chat) {
     const chatId = chat.persisted.id;
@@ -61703,6 +61709,11 @@ var ChatService = class {
     );
     chat.acceptedUserEvents.set(message.id, acceptedEvent);
     this.activateTurn(chat, message.id);
+    const transcriptAuth = currentTranscriptAuth(chat.persisted.provider);
+    if (JSON.stringify(chat.persisted.transcriptAuth) !== JSON.stringify(transcriptAuth)) {
+      chat.persisted.transcriptAuth = transcriptAuth;
+      await this.persistAllChats();
+    }
     await this.publish({
       type: "chat.turn.started",
       payload: {

package/dist/src/post-tool-pr-hook.js

@@ -3,13 +3,13 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   publishedPullRequestUrls
-} from "./chunk-DTKUVZ6U.js";
+} from "./chunk-K2WA7ZYZ.js";
 import {
   isRecord
 } from "./chunk-UZSNFLDQ.js";
 import {
   shouldRefreshPullRequests
-} from "./chunk-NTM575B4.js";
+} from "./chunk-LGWE7MSQ.js";
 import "./chunk-VEQXQN22.js";
 
 // src/services/post-tool-pr-notifier.ts

package/dist/src/subagent-mcp.js

@@ -9,7 +9,7 @@ import {
   spawnSubagentRequestSchema,
   subagentResponseSchema,
   waitSubagentRequestSchema
-} from "./chunk-NTM575B4.js";
+} from "./chunk-LGWE7MSQ.js";
 import "./chunk-VEQXQN22.js";
 
 // src/subagent-mcp.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.976",
+  "version": "0.1.977",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",