@h-rig/bundle-default-lifecycle 0.0.6-alpha.157 → 0.0.6-alpha.159

package/dist/src/control-plane/hooks/inject-context.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env bun
+export {};

package/dist/src/control-plane/hooks/inject-context.js

@@ -0,0 +1,175 @@
+#!/usr/bin/env bun
+// @bun
+
+// packages/bundle-default-lifecycle/src/control-plane/hooks/inject-context.ts
+import { existsSync, readFileSync } from "fs";
+import { resolve } from "path";
+import { resolveProjectRoot } from "@rig/hook-kit";
+import { MEMORY, REPO_OPERATIONS_CAPABILITY, RUNTIME_INSTRUCTION } from "@rig/contracts";
+import { defineCapability as defineCapability2 } from "@rig/core/capability";
+import { loadCapabilityForRoot } from "@rig/core/capability-loaders";
+import { showProfile, showReviewProfile } from "@rig/core/profile-ops";
+
+// packages/bundle-default-lifecycle/src/control-plane/task-data.ts
+import { TASK_DATA_SERVICE_CAPABILITY } from "@rig/contracts";
+import { defineCapability } from "@rig/core/capability";
+import { requireInstalledCapability } from "@rig/core/capability-loaders";
+var TaskDataCap = defineCapability(TASK_DATA_SERVICE_CAPABILITY);
+function taskData() {
+  return requireInstalledCapability(TaskDataCap, "task-data capability unavailable: load @rig/task-sources-plugin (default bundle) before running the lifecycle.");
+}
+
+// packages/bundle-default-lifecycle/src/control-plane/hooks/inject-context.ts
+import { runCapture } from "@rig/core/exec";
+import { resolveHarnessPaths } from "@rig/core/harness-paths";
+import { loadRuntimeContextFromEnv } from "@rig/core/runtime-context";
+var RepoOperationsCap = defineCapability2(REPO_OPERATIONS_CAPABILITY);
+function defaultMemoryQuery(taskId, runtimeContext) {
+  const role = runtimeContext?.role?.trim();
+  const scopeTerms = (runtimeContext?.scopes ?? []).flatMap((scope) => scope.split("/").slice(-3)).map((term) => term.trim()).filter(Boolean);
+  const validationTerms = (runtimeContext?.validation ?? []).map((command) => command.split(/\s+/)[0]?.trim() ?? "").filter(Boolean);
+  const parts = [...new Set([role, ...scopeTerms, ...validationTerms].filter(Boolean))];
+  return parts.join(" ").trim() || taskId;
+}
+async function printSharedMemorySection(projectRoot, taskId) {
+  const runtimeContext = loadRuntimeContextFromEnv();
+  const memory = runtimeContext?.memory;
+  if (!memory?.hydratedPath || !existsSync(memory.hydratedPath)) {
+    return;
+  }
+  const memoryService = await loadCapabilityForRoot(projectRoot, defineCapability2(MEMORY));
+  if (!memoryService) {
+    return;
+  }
+  const db = await memoryService.openMemoryDb(memory.hydratedPath);
+  try {
+    const results = await memoryService.queryRelevantMemory(db, {
+      query: defaultMemoryQuery(taskId, runtimeContext),
+      limit: memory.retrieval.topK,
+      retrieval: memory.retrieval
+    });
+    if (results.length === 0) {
+      return;
+    }
+    console.log(`
+=== Shared Memory ===
+`);
+    console.log(memoryService.formatMemoryQueryResults(results));
+  } finally {
+    await db.close();
+  }
+}
+async function main() {
+  const projectRoot = resolveProjectRoot();
+  const taskId = taskData().currentTaskId(projectRoot);
+  if (!taskId) {
+    console.log("No active task in Rig session. Start a run with: rig run start-serial");
+    return;
+  }
+  console.log(`=== Task Assignment: ${taskId} ===
+`);
+  await taskData().taskInfo(projectRoot, taskId);
+  await printSharedMemorySection(projectRoot, taskId);
+  const depIds = taskData().taskDependencyIds(projectRoot, taskId);
+  if (depIds.length > 0) {
+    console.log(`
+=== Completed Dependency Artifacts ===
+`);
+    await taskData().taskDeps(projectRoot, taskId);
+  }
+  console.log(`
+=== Repo Pin Verification ===
+`);
+  const repoOperations = await loadCapabilityForRoot(projectRoot, RepoOperationsCap);
+  const pins = repoOperations ? repoOperations.repoDiscover(projectRoot, taskId) : {};
+  if (Object.keys(pins).length === 0) {
+    console.log("(no explicit/discovered task pins)");
+  } else {
+    for (const [key, expected] of Object.entries(pins)) {
+      const repoPath = key.startsWith("/") ? key : resolve(projectRoot, key);
+      let current = "missing";
+      if (existsSync(resolve(repoPath, ".git"))) {
+        current = runCapture(["git", "-C", repoPath, "rev-parse", "HEAD"], projectRoot).stdout.trim() || "unknown";
+      }
+      console.log(`${current === expected ? "OK  " : "WARN"} ${key} expected ${expected} got ${current}`);
+    }
+  }
+  const failedPath = resolve(resolveHarnessPaths(projectRoot).stateDir, "failed_approaches.md");
+  if (existsSync(failedPath)) {
+    const lines = readFileSync(failedPath, "utf-8").split(/\r?\n/);
+    let printing = false;
+    const failureLines = [];
+    for (const line of lines) {
+      if (line.startsWith("## ")) {
+        if (printing) {
+          break;
+        }
+        printing = line.includes(taskId);
+      }
+      if (printing) {
+        failureLines.push(line);
+      }
+    }
+    if (failureLines.length > 0) {
+      console.log(`
+=== Failed Approaches ===
+`);
+      for (const line of failureLines) {
+        console.log(line);
+      }
+    }
+  }
+  console.log(`
+=== Agent Runtime ===
+`);
+  await showProfile(projectRoot, false);
+  console.log(`
+=== AI Review Profile ===
+`);
+  await showReviewProfile(projectRoot);
+  console.log(`
+=== Agent CLI ===
+`);
+  console.log("Run: rig-agent help");
+  console.log("");
+  console.log("Quick reference:");
+  console.log("  rig-agent info        \u2014 Your task, role, scope, deps");
+  console.log("  rig-agent scope       \u2014 Scope globs (--files to expand)");
+  console.log("  rig-agent deps        \u2014 Dependency decisions & next-actions");
+  console.log("  rig-agent project-root \u2014 Absolute task worktree root");
+  console.log("  rig-agent monorepo-root \u2014 Absolute monorepo root");
+  console.log("  rig-agent validate    \u2014 Run validation before completing");
+  console.log("  rig-agent verify      \u2014 Run verifier (local + optional AI review)");
+  console.log("");
+  console.log("File tool contract:");
+  const instructionService = await loadCapabilityForRoot(projectRoot, defineCapability2(RUNTIME_INSTRUCTION));
+  const runtimeProvider = instructionService?.normalizeProvider(process.env.RIG_RUNTIME_ADAPTER) ?? "pi";
+  for (const line of instructionService?.buildRuntimeContextLines(runtimeProvider) ?? []) {
+    console.log(`  ${line}`);
+  }
+  console.log(`
+=== Working Directory ===
+`);
+  const taskWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (!taskWorkspace) {
+    throw new Error("inject-context requires RIG_TASK_WORKSPACE to point at the active runtime workspace.");
+  }
+  console.log("IMPORTANT: Your working directory is the task worktree:");
+  console.log(`  ${taskWorkspace}`);
+  console.log("");
+  console.log(`Do not use absolute root paths under ${projectRoot}/repos.`);
+  console.log("");
+  console.log("Use the agent CLI from any directory:");
+  console.log("  rig-agent <command>");
+  console.log("Scope globs are monorepo-relative inside the monorepo worktree.");
+  console.log("");
+  console.log("Path discipline:");
+  console.log("  Use absolute paths for Read/Grep/Bash after any `cd` command.");
+  console.log("  The shell session preserves cwd across commands, so relative repos/... paths can drift.");
+  console.log(`  Project root: ${taskWorkspace}`);
+  console.log(`  Monorepo root: ${taskWorkspace}`);
+}
+main().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});

package/dist/src/control-plane/hooks/shared.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Shared utilities for individual hook entry points.
+ *
+ * All exports have been moved to @rig/hook-kit in Phase 5 Task 5.3.
+ * This file is now a thin re-export shim for backward compatibility.
+ * All existing `import { ... } from "./shared"` consumers continue to work.
+ *
+ * Direct consumers should migrate to `import { ... } from "@rig/hook-kit"`.
+ */
+export type { HookInput, ParsedHookInput } from "@rig/hook-kit";
+export { BAKED_PROJECT_ROOT, BAKED_TASK_ID, BAKED_STATE_DIR, BAKED_BUN_PATH, BAKED_TASK_CONFIG, BAKED_POLICY_CONTENT, BAKED_TASK_SCOPES, readHookInput, resolveProjectRoot, resolveTaskIdForHook, resolveTaskConfig, resolveTaskScopes, resolvePolicyContent, block, extractToolFilePaths, isTestFilePath, escapeRegExp, resolveBunCli, resolveBunCliInvocation, } from "@rig/hook-kit";

package/dist/src/control-plane/hooks/shared.js

@@ -0,0 +1,44 @@
+// @bun
+// packages/bundle-default-lifecycle/src/control-plane/hooks/shared.ts
+import {
+  BAKED_PROJECT_ROOT,
+  BAKED_TASK_ID,
+  BAKED_STATE_DIR,
+  BAKED_BUN_PATH,
+  BAKED_TASK_CONFIG,
+  BAKED_POLICY_CONTENT,
+  BAKED_TASK_SCOPES,
+  readHookInput,
+  resolveProjectRoot,
+  resolveTaskIdForHook,
+  resolveTaskConfig,
+  resolveTaskScopes,
+  resolvePolicyContent,
+  block,
+  extractToolFilePaths,
+  isTestFilePath,
+  escapeRegExp,
+  resolveBunCli,
+  resolveBunCliInvocation
+} from "@rig/hook-kit";
+export {
+  resolveTaskScopes,
+  resolveTaskIdForHook,
+  resolveTaskConfig,
+  resolveProjectRoot,
+  resolvePolicyContent,
+  resolveBunCliInvocation,
+  resolveBunCli,
+  readHookInput,
+  isTestFilePath,
+  extractToolFilePaths,
+  escapeRegExp,
+  block,
+  BAKED_TASK_SCOPES,
+  BAKED_TASK_ID,
+  BAKED_TASK_CONFIG,
+  BAKED_STATE_DIR,
+  BAKED_PROJECT_ROOT,
+  BAKED_POLICY_CONTENT,
+  BAKED_BUN_PATH
+};

package/dist/src/control-plane/hooks/submodule-branch.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env bun
+export {};

package/dist/src/control-plane/hooks/submodule-branch.js

@@ -0,0 +1,432 @@
+#!/usr/bin/env bun
+// @bun
+
+// packages/bundle-default-lifecycle/src/control-plane/hooks/task-runtime-start.ts
+import { existsSync as existsSync4 } from "fs";
+import { resolve as resolve2 } from "path";
+import { resolveProjectRoot } from "@rig/hook-kit";
+import { resolveRuntimeWorkspaceLayout } from "@rig/core/layout";
+
+// packages/bundle-default-lifecycle/src/control-plane/native/git-ops.ts
+import { existsSync as existsSync3, lstatSync, mkdirSync, readFileSync as readFileSync2, unlinkSync, writeFileSync } from "fs";
+import { dirname, isAbsolute, resolve } from "path";
+import { loadDotEnvSecrets, resolveRuntimeSecrets } from "@rig/core/baked-secrets";
+import { loadRuntimeContext, loadRuntimeContextFromEnv } from "@rig/core/runtime-context";
+
+// packages/bundle-default-lifecycle/src/control-plane/task-data.ts
+import { TASK_DATA_SERVICE_CAPABILITY } from "@rig/contracts";
+import { defineCapability } from "@rig/core/capability";
+import { requireInstalledCapability } from "@rig/core/capability-loaders";
+var TaskDataCap = defineCapability(TASK_DATA_SERVICE_CAPABILITY);
+function taskData() {
+  return requireInstalledCapability(TaskDataCap, "task-data capability unavailable: load @rig/task-sources-plugin (default bundle) before running the lifecycle.");
+}
+
+// packages/bundle-default-lifecycle/src/control-plane/native/git-ops.ts
+import { nowIso, runCapture as baseRunCapture } from "@rig/core/exec";
+import { resolveCheckoutRoot as resolveMonorepoRoot } from "@rig/core/checkout-root";
+import { getScopeRules } from "@rig/core/scope-rules";
+
+// packages/bundle-default-lifecycle/src/native/github-auth-env.ts
+import { existsSync, readFileSync } from "fs";
+function cleanToken(value) {
+  const trimmed = value?.trim() ?? "";
+  return trimmed.length > 0 ? trimmed : null;
+}
+function authStateToken(env = process.env) {
+  const file = env.RIG_GITHUB_AUTH_STATE_FILE?.trim();
+  if (!file || !existsSync(file))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync(file, "utf8"));
+    return cleanToken(typeof parsed.token === "string" ? parsed.token : undefined);
+  } catch {
+    return null;
+  }
+}
+
+// packages/bundle-default-lifecycle/src/control-plane/native/git-ops.ts
+import { safePathSegment } from "@rig/core/safe-identifiers";
+
+// packages/bundle-default-lifecycle/src/native/host-git.ts
+import { existsSync as existsSync2 } from "fs";
+function isRuntimeGatewayGitPath(candidate) {
+  return /\/\.rig\/bin\/git$/.test(candidate.replace(/\\/g, "/"));
+}
+function resolveHostGitBinary() {
+  const candidates = [
+    process.env.RIG_GIT_BIN?.trim() || "",
+    "/usr/bin/git",
+    "/opt/homebrew/bin/git",
+    "/usr/local/bin/git"
+  ];
+  const bunResolved = Bun.which("git");
+  if (bunResolved && !isRuntimeGatewayGitPath(bunResolved)) {
+    candidates.push(bunResolved);
+  }
+  for (const candidate of candidates) {
+    if (!candidate || isRuntimeGatewayGitPath(candidate)) {
+      continue;
+    }
+    if (existsSync2(candidate)) {
+      return candidate;
+    }
+  }
+  return "git";
+}
+
+// packages/bundle-default-lifecycle/src/control-plane/native/git-ops.ts
+var TASK_ARTIFACT_STAGE_FALLBACK = new Set([
+  "changed-files.txt",
+  "contract-changes.md",
+  "decision-log.md",
+  "git-state.txt",
+  "next-actions.md",
+  "pr-state.json",
+  "task-result.json",
+  "validation-summary.json"
+]);
+function resolveOptionalMonorepoRoot(projectRoot) {
+  const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (runtimeWorkspace && existsSync3(resolve(runtimeWorkspace, ".git"))) {
+    return resolve(runtimeWorkspace);
+  }
+  try {
+    return resolveMonorepoRoot(projectRoot);
+  } catch {
+    return null;
+  }
+}
+function safeCurrentTaskId(projectRoot) {
+  try {
+    const taskId = taskData().currentTaskId(projectRoot);
+    return /^bd-[a-z0-9-]+$/.test(taskId) ? taskId : "";
+  } catch {
+    return "";
+  }
+}
+function gitCmd(projectRoot, repoRoot, ...args) {
+  return [resolveHostGitBinary(), "-C", repoRoot, ...args];
+}
+function gitSyncBranch(projectRoot, taskId, targetRepo = "monorepo") {
+  const resolvedTask = taskId || safeCurrentTaskId(projectRoot);
+  if (!resolvedTask) {
+    throw new Error("No task specified and no active task in session.");
+  }
+  const repoRoot = targetRepo === "monorepo" ? resolveOptionalMonorepoRoot(projectRoot) || resolveMonorepoRoot(projectRoot) : projectRoot;
+  const repoLabel = targetRepo === "monorepo" ? "Monorepo" : "Project";
+  if (!existsSync3(resolve(repoRoot, ".git"))) {
+    throw new Error(`${repoLabel} repo not found at ${repoRoot}`);
+  }
+  const branchId = resolveTaskBranchId(projectRoot, resolvedTask);
+  const branchTarget = `rig/${branchId}`;
+  const current = branchName(projectRoot, repoRoot);
+  if (current === branchTarget) {
+    console.log(`${repoLabel} branch: already on ${branchTarget}`);
+    return;
+  }
+  const hasBranch = runCapture(gitCmd(projectRoot, repoRoot, "show-ref", "--verify", "--quiet", `refs/heads/${branchTarget}`), projectRoot).exitCode === 0;
+  const cmd = hasBranch && current === "HEAD" ? gitCmd(projectRoot, repoRoot, "checkout", "-B", branchTarget) : hasBranch ? gitCmd(projectRoot, repoRoot, "checkout", branchTarget) : gitCmd(projectRoot, repoRoot, "checkout", "-b", branchTarget);
+  const checkout = runCapture(cmd, projectRoot);
+  if (checkout.exitCode !== 0) {
+    throw new Error(`Failed to sync ${repoLabel.toLowerCase()} branch: ${checkout.stderr || checkout.stdout}`);
+  }
+  const action = hasBranch && current === "HEAD" ? "reset" : hasBranch ? "checked out" : "created";
+  console.log(`${repoLabel} branch: ${action} ${branchTarget}`);
+}
+function resolveTaskBranchId(projectRoot, taskId) {
+  if (/^bd-[a-z0-9-]+$/.test(taskId)) {
+    return taskId;
+  }
+  const normalizedTaskId = taskData().lookupTask(projectRoot, taskId);
+  if (normalizedTaskId) {
+    return normalizedTaskId;
+  }
+  const currentTask = taskData().currentTaskId(projectRoot);
+  if (currentTask && currentTask === taskId) {
+    return currentTask;
+  }
+  const runtimeIdFromEnv = (process.env.RIG_TASK_RUNTIME_ID || "").trim();
+  if (runtimeIdFromEnv.startsWith("task-") && runtimeIdFromEnv.length > "task-".length) {
+    return runtimeIdFromEnv.slice("task-".length);
+  }
+  try {
+    const runtimeIdFromContext = loadRuntimeContextFromEnv()?.runtimeId || "";
+    if (runtimeIdFromContext.startsWith("task-") && runtimeIdFromContext.length > "task-".length) {
+      return runtimeIdFromContext.slice("task-".length);
+    }
+  } catch {}
+  const artifactDir = taskData().artifactDirForId(projectRoot, taskId);
+  if (existsSync3(artifactDir)) {
+    return taskId;
+  }
+  throw new Error(`Unknown task id: ${taskId}`);
+}
+function branchName(projectRoot, repo) {
+  return runCapture(gitCmd(projectRoot, repo, "rev-parse", "--abbrev-ref", "HEAD"), projectRoot).stdout.trim();
+}
+function runCapture(command, cwd, projectRoot = cwd) {
+  return baseRunCapture(command, cwd, runtimeGitEnv(projectRoot));
+}
+function runtimeGitEnv(projectRoot) {
+  const { ctx, runtimeRoot } = resolveRuntimeMetadata(projectRoot);
+  const runtimeHome = runtimeRoot ? resolve(runtimeRoot, "home") : "";
+  const runtimeTmp = runtimeRoot ? resolve(runtimeRoot, "tmp") : "";
+  const runtimeCache = runtimeRoot ? resolve(runtimeRoot, "cache") : "";
+  const runtimeKnownHosts = runtimeHome ? resolve(runtimeHome, ".ssh", "known_hosts") : "";
+  const runtimeKey = runtimeHome ? resolve(runtimeHome, ".ssh", "rig-agent-key") : "";
+  const env = {};
+  if (ctx?.workspaceDir) {
+    env.PROJECT_RIG_ROOT = projectRoot;
+    env.RIG_TASK_WORKSPACE = ctx.workspaceDir;
+    env.MONOREPO_ROOT = ctx.workspaceDir;
+    env.MONOREPO_MAIN_ROOT = resolveMonorepoRoot(projectRoot);
+  } else if (projectRoot) {
+    env.PROJECT_RIG_ROOT = projectRoot;
+  }
+  if (runtimeRoot) {
+    env.RIG_RUNTIME_HOME = runtimeRoot;
+  }
+  if (runtimeHome && existsSync3(runtimeHome)) {
+    env.HOME = runtimeHome;
+    env.OPENSSL_CONF = ensureRuntimeOpenSslConfig(runtimeHome);
+  }
+  if (runtimeTmp && existsSync3(runtimeTmp)) {
+    env.TMPDIR = runtimeTmp;
+  }
+  if (runtimeCache && existsSync3(runtimeCache)) {
+    env.XDG_CACHE_HOME = runtimeCache;
+  }
+  const workspaceSecrets = loadDotEnvSecrets(ctx?.workspaceDir || projectRoot, process.env);
+  for (const [key, value] of Object.entries(resolveRuntimeSecrets(process.env, workspaceSecrets))) {
+    if (key === "GITHUB_SSH_KEY" || !value) {
+      continue;
+    }
+    env[key] = value;
+  }
+  const rigGithubToken = process.env.RIG_GITHUB_TOKEN?.trim() || authStateToken(process.env) || "";
+  if (rigGithubToken && !env.GITHUB_TOKEN && !env.GH_TOKEN) {
+    env.GITHUB_TOKEN = rigGithubToken;
+  }
+  if (!env.GITHUB_TOKEN && env.GH_TOKEN) {
+    env.GITHUB_TOKEN = env.GH_TOKEN;
+  }
+  if (!env.GH_TOKEN && env.GITHUB_TOKEN) {
+    env.GH_TOKEN = env.GITHUB_TOKEN;
+  }
+  if (!env.GREPTILE_GITHUB_TOKEN && env.GITHUB_TOKEN) {
+    env.GREPTILE_GITHUB_TOKEN = env.GITHUB_TOKEN;
+  }
+  const persistedSecrets = loadPersistedRuntimeSecrets(runtimeRoot);
+  for (const [key, value] of Object.entries(persistedSecrets)) {
+    if (!value)
+      continue;
+    if (!env[key]) {
+      env[key] = value;
+    }
+  }
+  if (!env.GITHUB_TOKEN && env.GH_TOKEN) {
+    env.GITHUB_TOKEN = env.GH_TOKEN;
+  }
+  if (!env.GH_TOKEN && env.GITHUB_TOKEN) {
+    env.GH_TOKEN = env.GITHUB_TOKEN;
+  }
+  const gitHubToken = env.GITHUB_TOKEN || env.GH_TOKEN || env.RIG_GITHUB_TOKEN || rigGithubToken;
+  if (gitHubToken) {
+    env.RIG_GITHUB_TOKEN = gitHubToken;
+    env.GITHUB_TOKEN = env.GITHUB_TOKEN || gitHubToken;
+    env.GH_TOKEN = env.GH_TOKEN || gitHubToken;
+    applyGitHubCredentialHelperEnv(env);
+  }
+  if (runtimeKnownHosts && existsSync3(runtimeKnownHosts)) {
+    const sshParts = [
+      "ssh",
+      `-o UserKnownHostsFile="${runtimeKnownHosts}"`,
+      "-o StrictHostKeyChecking=yes",
+      "-F /dev/null"
+    ];
+    if (runtimeKey && existsSync3(runtimeKey)) {
+      sshParts.splice(1, 0, `-i "${runtimeKey}"`, "-o IdentitiesOnly=yes");
+    }
+    env.GIT_SSH_COMMAND = sshParts.join(" ");
+  } else if (process.env.GIT_SSH_COMMAND?.trim()) {
+    env.GIT_SSH_COMMAND = process.env.GIT_SSH_COMMAND;
+  }
+  return Object.keys(env).length > 0 ? env : undefined;
+}
+function applyGitHubCredentialHelperEnv(env) {
+  env.GIT_TERMINAL_PROMPT = "0";
+  env.GIT_CONFIG_COUNT = "2";
+  env.GIT_CONFIG_KEY_0 = "credential.helper";
+  env.GIT_CONFIG_VALUE_0 = "";
+  env.GIT_CONFIG_KEY_1 = "credential.helper";
+  env.GIT_CONFIG_VALUE_1 = '!f() { test "$1" = get || exit 0; token="${GITHUB_TOKEN:-${GH_TOKEN:-${RIG_GITHUB_TOKEN:-}}}"; test -n "$token" || exit 0; echo username=x-access-token; echo password="$token"; }; f';
+}
+function loadPersistedRuntimeSecrets(runtimeRoot) {
+  if (!runtimeRoot) {
+    return {};
+  }
+  const path = resolve(runtimeRoot, "runtime-secrets.json");
+  if (!existsSync3(path)) {
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf-8"));
+    const allowed = new Set(["GITHUB_TOKEN", "GH_TOKEN", "RIG_GITHUB_TOKEN"]);
+    const entries = Object.entries(parsed).filter((entry) => typeof entry[1] === "string" && allowed.has(entry[0]));
+    return Object.fromEntries(entries);
+  } catch {
+    return {};
+  }
+}
+function ensureRuntimeOpenSslConfig(runtimeHome) {
+  const sslDir = resolve(runtimeHome, ".ssl");
+  const sslConfig = resolve(sslDir, "openssl.cnf");
+  if (!existsSync3(sslDir)) {
+    mkdirSync(sslDir, { recursive: true });
+  }
+  if (!existsSync3(sslConfig)) {
+    writeFileSync(sslConfig, `# Rig runtime OpenSSL config placeholder
+`);
+  }
+  return sslConfig;
+}
+function resolveRuntimeMetadata(projectRoot) {
+  const contextFile = process.env.RIG_RUNTIME_CONTEXT_FILE?.trim();
+  const runtimeHome = process.env.RIG_RUNTIME_HOME?.trim();
+  let ctx = loadRuntimeContextFromEnv();
+  if (runtimeHome) {
+    return {
+      ctx,
+      runtimeRoot: runtimeHome
+    };
+  }
+  if (contextFile) {
+    return {
+      ctx,
+      runtimeRoot: dirname(resolve(contextFile))
+    };
+  }
+  const inferredContextFile = findRuntimeContextFile(projectRoot);
+  if (existsSync3(inferredContextFile)) {
+    try {
+      ctx = loadRuntimeContext(inferredContextFile);
+    } catch {}
+    return {
+      ctx,
+      runtimeRoot: dirname(inferredContextFile)
+    };
+  }
+  return { ctx, runtimeRoot: "" };
+}
+function findRuntimeContextFile(startPath) {
+  let current = resolve(startPath);
+  while (true) {
+    const candidate = resolve(current, "runtime-context.json");
+    if (existsSync3(candidate)) {
+      return candidate;
+    }
+    const parent = dirname(current);
+    if (parent === current) {
+      return "";
+    }
+    current = parent;
+  }
+}
+
+// packages/bundle-default-lifecycle/src/control-plane/hooks/task-runtime-start.ts
+import { taskRuntimeId } from "@rig/core/safe-identifiers";
+import { ISOLATION_BACKEND, REPO_OPERATIONS_CAPABILITY } from "@rig/contracts";
+import { defineCapability as defineCapability2 } from "@rig/core/capability";
+import { requireCapabilityForRoot } from "@rig/core/capability-loaders";
+import { loadRuntimeContextFromEnv as loadRuntimeContextFromEnv2 } from "@rig/core/runtime-context";
+var RepoOperationsCap = defineCapability2(REPO_OPERATIONS_CAPABILITY);
+function resolveTaskRuntimeMode(raw) {
+  if (raw === "off" || raw === "worktree") {
+    return raw;
+  }
+  return "worktree";
+}
+function resolveActiveRuntimeId(taskId) {
+  const runtimeIdFromEnv = (process.env.RIG_TASK_RUNTIME_ID || "").trim();
+  if (runtimeIdFromEnv) {
+    return runtimeIdFromEnv;
+  }
+  try {
+    const runtimeIdFromContext = loadRuntimeContextFromEnv2()?.runtimeId?.trim();
+    if (runtimeIdFromContext) {
+      return runtimeIdFromContext;
+    }
+  } catch {}
+  return taskRuntimeId(taskId);
+}
+function resolveActiveWorkspaceDir() {
+  const workspaceDirFromEnv = (process.env.RIG_TASK_WORKSPACE || "").trim();
+  if (workspaceDirFromEnv) {
+    return workspaceDirFromEnv;
+  }
+  try {
+    const workspaceDirFromContext = loadRuntimeContextFromEnv2()?.workspaceDir?.trim();
+    if (workspaceDirFromContext) {
+      return workspaceDirFromContext;
+    }
+  } catch {}
+  return "";
+}
+function isProvisionedRuntimeWorkspace(workspaceDir) {
+  if (!workspaceDir) {
+    return false;
+  }
+  const layout = resolveRuntimeWorkspaceLayout(workspaceDir);
+  return existsSync4(resolve2(workspaceDir, ".git")) && existsSync4(resolve2(layout.binDir, "rig-agent")) && existsSync4(resolve2(layout.binDir, "hooks", "scope-guard")) && existsSync4(resolve2(layout.sessionDir, "session.json"));
+}
+async function main() {
+  const projectRoot = resolveProjectRoot();
+  const taskId = taskData().currentTaskId(projectRoot);
+  if (!taskId) {
+    return;
+  }
+  const runtimeId = resolveActiveRuntimeId(taskId);
+  const canonicalRuntimeId = taskRuntimeId(taskId);
+  const workspaceDir = resolveActiveWorkspaceDir();
+  if (runtimeId === canonicalRuntimeId) {
+    if (isProvisionedRuntimeWorkspace(workspaceDir)) {
+      console.log(`Task runtime already provisioned (${runtimeId}); skipping in-session reprovision.`);
+      console.log(`Task runtime ready (worktree): ${workspaceDir}`);
+      return;
+    }
+    gitSyncBranch(projectRoot, taskId);
+    const repoOperations = await requireCapabilityForRoot(projectRoot, RepoOperationsCap, `No REPO_OPERATIONS capability is registered for project root "${projectRoot}". ` + "Install @rig/repos-plugin (it ships in the default bundle) so task repo pins can be refreshed.");
+    repoOperations.repoEnsure(projectRoot, taskId);
+  } else {
+    console.log(`Task runtime already provisioned (${runtimeId}); skipping canonical branch sync.`);
+    console.log(`Task runtime already provisioned (${runtimeId}); skipping repo pin refresh.`);
+    if (isProvisionedRuntimeWorkspace(workspaceDir)) {
+      console.log(`Task runtime ready (worktree): ${workspaceDir}`);
+      return;
+    }
+  }
+  const mode = resolveTaskRuntimeMode(process.env.RIG_TASK_RUNTIME_MODE);
+  if (mode !== "off") {
+    const isolationBackend = await requireCapabilityForRoot(projectRoot, defineCapability2(ISOLATION_BACKEND), `No ISOLATION_BACKEND capability is registered for project root "${projectRoot}". ` + "Install @rig/isolation-plugin (it ships in the default bundle) so runtime provisioning can resolve a backend.");
+    const runtime = await isolationBackend.ensureAgentRuntime({
+      projectRoot,
+      id: runtimeId,
+      taskId,
+      mode
+    });
+    console.log(`Task runtime ready (${mode}): ${runtime.workspaceDir}`);
+  }
+}
+if (process.env.RIG_HOOK_ROLE === "task-runtime-start") {
+  main().catch((error) => {
+    console.error(error);
+    process.exit(1);
+  });
+}
+
+// packages/bundle-default-lifecycle/src/control-plane/hooks/submodule-branch.ts
+main().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});

package/dist/src/control-plane/hooks/task-runtime-start.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env bun
+export declare function main(): Promise<void>;