@h-rig/bundle-default-lifecycle 0.0.6-alpha.157 → 0.0.6-alpha.159

package/dist/src/control-plane/hooks/task-runtime-start.js

@@ -0,0 +1,429 @@
+#!/usr/bin/env bun
+// @bun
+
+// packages/bundle-default-lifecycle/src/control-plane/hooks/task-runtime-start.ts
+import { existsSync as existsSync4 } from "fs";
+import { resolve as resolve2 } from "path";
+import { resolveProjectRoot } from "@rig/hook-kit";
+import { resolveRuntimeWorkspaceLayout } from "@rig/core/layout";
+
+// packages/bundle-default-lifecycle/src/control-plane/native/git-ops.ts
+import { existsSync as existsSync3, lstatSync, mkdirSync, readFileSync as readFileSync2, unlinkSync, writeFileSync } from "fs";
+import { dirname, isAbsolute, resolve } from "path";
+import { loadDotEnvSecrets, resolveRuntimeSecrets } from "@rig/core/baked-secrets";
+import { loadRuntimeContext, loadRuntimeContextFromEnv } from "@rig/core/runtime-context";
+
+// packages/bundle-default-lifecycle/src/control-plane/task-data.ts
+import { TASK_DATA_SERVICE_CAPABILITY } from "@rig/contracts";
+import { defineCapability } from "@rig/core/capability";
+import { requireInstalledCapability } from "@rig/core/capability-loaders";
+var TaskDataCap = defineCapability(TASK_DATA_SERVICE_CAPABILITY);
+function taskData() {
+  return requireInstalledCapability(TaskDataCap, "task-data capability unavailable: load @rig/task-sources-plugin (default bundle) before running the lifecycle.");
+}
+
+// packages/bundle-default-lifecycle/src/control-plane/native/git-ops.ts
+import { nowIso, runCapture as baseRunCapture } from "@rig/core/exec";
+import { resolveCheckoutRoot as resolveMonorepoRoot } from "@rig/core/checkout-root";
+import { getScopeRules } from "@rig/core/scope-rules";
+
+// packages/bundle-default-lifecycle/src/native/github-auth-env.ts
+import { existsSync, readFileSync } from "fs";
+function cleanToken(value) {
+  const trimmed = value?.trim() ?? "";
+  return trimmed.length > 0 ? trimmed : null;
+}
+function authStateToken(env = process.env) {
+  const file = env.RIG_GITHUB_AUTH_STATE_FILE?.trim();
+  if (!file || !existsSync(file))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync(file, "utf8"));
+    return cleanToken(typeof parsed.token === "string" ? parsed.token : undefined);
+  } catch {
+    return null;
+  }
+}
+
+// packages/bundle-default-lifecycle/src/control-plane/native/git-ops.ts
+import { safePathSegment } from "@rig/core/safe-identifiers";
+
+// packages/bundle-default-lifecycle/src/native/host-git.ts
+import { existsSync as existsSync2 } from "fs";
+function isRuntimeGatewayGitPath(candidate) {
+  return /\/\.rig\/bin\/git$/.test(candidate.replace(/\\/g, "/"));
+}
+function resolveHostGitBinary() {
+  const candidates = [
+    process.env.RIG_GIT_BIN?.trim() || "",
+    "/usr/bin/git",
+    "/opt/homebrew/bin/git",
+    "/usr/local/bin/git"
+  ];
+  const bunResolved = Bun.which("git");
+  if (bunResolved && !isRuntimeGatewayGitPath(bunResolved)) {
+    candidates.push(bunResolved);
+  }
+  for (const candidate of candidates) {
+    if (!candidate || isRuntimeGatewayGitPath(candidate)) {
+      continue;
+    }
+    if (existsSync2(candidate)) {
+      return candidate;
+    }
+  }
+  return "git";
+}
+
+// packages/bundle-default-lifecycle/src/control-plane/native/git-ops.ts
+var TASK_ARTIFACT_STAGE_FALLBACK = new Set([
+  "changed-files.txt",
+  "contract-changes.md",
+  "decision-log.md",
+  "git-state.txt",
+  "next-actions.md",
+  "pr-state.json",
+  "task-result.json",
+  "validation-summary.json"
+]);
+function resolveOptionalMonorepoRoot(projectRoot) {
+  const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (runtimeWorkspace && existsSync3(resolve(runtimeWorkspace, ".git"))) {
+    return resolve(runtimeWorkspace);
+  }
+  try {
+    return resolveMonorepoRoot(projectRoot);
+  } catch {
+    return null;
+  }
+}
+function safeCurrentTaskId(projectRoot) {
+  try {
+    const taskId = taskData().currentTaskId(projectRoot);
+    return /^bd-[a-z0-9-]+$/.test(taskId) ? taskId : "";
+  } catch {
+    return "";
+  }
+}
+function gitCmd(projectRoot, repoRoot, ...args) {
+  return [resolveHostGitBinary(), "-C", repoRoot, ...args];
+}
+function gitSyncBranch(projectRoot, taskId, targetRepo = "monorepo") {
+  const resolvedTask = taskId || safeCurrentTaskId(projectRoot);
+  if (!resolvedTask) {
+    throw new Error("No task specified and no active task in session.");
+  }
+  const repoRoot = targetRepo === "monorepo" ? resolveOptionalMonorepoRoot(projectRoot) || resolveMonorepoRoot(projectRoot) : projectRoot;
+  const repoLabel = targetRepo === "monorepo" ? "Monorepo" : "Project";
+  if (!existsSync3(resolve(repoRoot, ".git"))) {
+    throw new Error(`${repoLabel} repo not found at ${repoRoot}`);
+  }
+  const branchId = resolveTaskBranchId(projectRoot, resolvedTask);
+  const branchTarget = `rig/${branchId}`;
+  const current = branchName(projectRoot, repoRoot);
+  if (current === branchTarget) {
+    console.log(`${repoLabel} branch: already on ${branchTarget}`);
+    return;
+  }
+  const hasBranch = runCapture(gitCmd(projectRoot, repoRoot, "show-ref", "--verify", "--quiet", `refs/heads/${branchTarget}`), projectRoot).exitCode === 0;
+  const cmd = hasBranch && current === "HEAD" ? gitCmd(projectRoot, repoRoot, "checkout", "-B", branchTarget) : hasBranch ? gitCmd(projectRoot, repoRoot, "checkout", branchTarget) : gitCmd(projectRoot, repoRoot, "checkout", "-b", branchTarget);
+  const checkout = runCapture(cmd, projectRoot);
+  if (checkout.exitCode !== 0) {
+    throw new Error(`Failed to sync ${repoLabel.toLowerCase()} branch: ${checkout.stderr || checkout.stdout}`);
+  }
+  const action = hasBranch && current === "HEAD" ? "reset" : hasBranch ? "checked out" : "created";
+  console.log(`${repoLabel} branch: ${action} ${branchTarget}`);
+}
+function resolveTaskBranchId(projectRoot, taskId) {
+  if (/^bd-[a-z0-9-]+$/.test(taskId)) {
+    return taskId;
+  }
+  const normalizedTaskId = taskData().lookupTask(projectRoot, taskId);
+  if (normalizedTaskId) {
+    return normalizedTaskId;
+  }
+  const currentTask = taskData().currentTaskId(projectRoot);
+  if (currentTask && currentTask === taskId) {
+    return currentTask;
+  }
+  const runtimeIdFromEnv = (process.env.RIG_TASK_RUNTIME_ID || "").trim();
+  if (runtimeIdFromEnv.startsWith("task-") && runtimeIdFromEnv.length > "task-".length) {
+    return runtimeIdFromEnv.slice("task-".length);
+  }
+  try {
+    const runtimeIdFromContext = loadRuntimeContextFromEnv()?.runtimeId || "";
+    if (runtimeIdFromContext.startsWith("task-") && runtimeIdFromContext.length > "task-".length) {
+      return runtimeIdFromContext.slice("task-".length);
+    }
+  } catch {}
+  const artifactDir = taskData().artifactDirForId(projectRoot, taskId);
+  if (existsSync3(artifactDir)) {
+    return taskId;
+  }
+  throw new Error(`Unknown task id: ${taskId}`);
+}
+function branchName(projectRoot, repo) {
+  return runCapture(gitCmd(projectRoot, repo, "rev-parse", "--abbrev-ref", "HEAD"), projectRoot).stdout.trim();
+}
+function runCapture(command, cwd, projectRoot = cwd) {
+  return baseRunCapture(command, cwd, runtimeGitEnv(projectRoot));
+}
+function runtimeGitEnv(projectRoot) {
+  const { ctx, runtimeRoot } = resolveRuntimeMetadata(projectRoot);
+  const runtimeHome = runtimeRoot ? resolve(runtimeRoot, "home") : "";
+  const runtimeTmp = runtimeRoot ? resolve(runtimeRoot, "tmp") : "";
+  const runtimeCache = runtimeRoot ? resolve(runtimeRoot, "cache") : "";
+  const runtimeKnownHosts = runtimeHome ? resolve(runtimeHome, ".ssh", "known_hosts") : "";
+  const runtimeKey = runtimeHome ? resolve(runtimeHome, ".ssh", "rig-agent-key") : "";
+  const env = {};
+  if (ctx?.workspaceDir) {
+    env.PROJECT_RIG_ROOT = projectRoot;
+    env.RIG_TASK_WORKSPACE = ctx.workspaceDir;
+    env.MONOREPO_ROOT = ctx.workspaceDir;
+    env.MONOREPO_MAIN_ROOT = resolveMonorepoRoot(projectRoot);
+  } else if (projectRoot) {
+    env.PROJECT_RIG_ROOT = projectRoot;
+  }
+  if (runtimeRoot) {
+    env.RIG_RUNTIME_HOME = runtimeRoot;
+  }
+  if (runtimeHome && existsSync3(runtimeHome)) {
+    env.HOME = runtimeHome;
+    env.OPENSSL_CONF = ensureRuntimeOpenSslConfig(runtimeHome);
+  }
+  if (runtimeTmp && existsSync3(runtimeTmp)) {
+    env.TMPDIR = runtimeTmp;
+  }
+  if (runtimeCache && existsSync3(runtimeCache)) {
+    env.XDG_CACHE_HOME = runtimeCache;
+  }
+  const workspaceSecrets = loadDotEnvSecrets(ctx?.workspaceDir || projectRoot, process.env);
+  for (const [key, value] of Object.entries(resolveRuntimeSecrets(process.env, workspaceSecrets))) {
+    if (key === "GITHUB_SSH_KEY" || !value) {
+      continue;
+    }
+    env[key] = value;
+  }
+  const rigGithubToken = process.env.RIG_GITHUB_TOKEN?.trim() || authStateToken(process.env) || "";
+  if (rigGithubToken && !env.GITHUB_TOKEN && !env.GH_TOKEN) {
+    env.GITHUB_TOKEN = rigGithubToken;
+  }
+  if (!env.GITHUB_TOKEN && env.GH_TOKEN) {
+    env.GITHUB_TOKEN = env.GH_TOKEN;
+  }
+  if (!env.GH_TOKEN && env.GITHUB_TOKEN) {
+    env.GH_TOKEN = env.GITHUB_TOKEN;
+  }
+  if (!env.GREPTILE_GITHUB_TOKEN && env.GITHUB_TOKEN) {
+    env.GREPTILE_GITHUB_TOKEN = env.GITHUB_TOKEN;
+  }
+  const persistedSecrets = loadPersistedRuntimeSecrets(runtimeRoot);
+  for (const [key, value] of Object.entries(persistedSecrets)) {
+    if (!value)
+      continue;
+    if (!env[key]) {
+      env[key] = value;
+    }
+  }
+  if (!env.GITHUB_TOKEN && env.GH_TOKEN) {
+    env.GITHUB_TOKEN = env.GH_TOKEN;
+  }
+  if (!env.GH_TOKEN && env.GITHUB_TOKEN) {
+    env.GH_TOKEN = env.GITHUB_TOKEN;
+  }
+  const gitHubToken = env.GITHUB_TOKEN || env.GH_TOKEN || env.RIG_GITHUB_TOKEN || rigGithubToken;
+  if (gitHubToken) {
+    env.RIG_GITHUB_TOKEN = gitHubToken;
+    env.GITHUB_TOKEN = env.GITHUB_TOKEN || gitHubToken;
+    env.GH_TOKEN = env.GH_TOKEN || gitHubToken;
+    applyGitHubCredentialHelperEnv(env);
+  }
+  if (runtimeKnownHosts && existsSync3(runtimeKnownHosts)) {
+    const sshParts = [
+      "ssh",
+      `-o UserKnownHostsFile="${runtimeKnownHosts}"`,
+      "-o StrictHostKeyChecking=yes",
+      "-F /dev/null"
+    ];
+    if (runtimeKey && existsSync3(runtimeKey)) {
+      sshParts.splice(1, 0, `-i "${runtimeKey}"`, "-o IdentitiesOnly=yes");
+    }
+    env.GIT_SSH_COMMAND = sshParts.join(" ");
+  } else if (process.env.GIT_SSH_COMMAND?.trim()) {
+    env.GIT_SSH_COMMAND = process.env.GIT_SSH_COMMAND;
+  }
+  return Object.keys(env).length > 0 ? env : undefined;
+}
+function applyGitHubCredentialHelperEnv(env) {
+  env.GIT_TERMINAL_PROMPT = "0";
+  env.GIT_CONFIG_COUNT = "2";
+  env.GIT_CONFIG_KEY_0 = "credential.helper";
+  env.GIT_CONFIG_VALUE_0 = "";
+  env.GIT_CONFIG_KEY_1 = "credential.helper";
+  env.GIT_CONFIG_VALUE_1 = '!f() { test "$1" = get || exit 0; token="${GITHUB_TOKEN:-${GH_TOKEN:-${RIG_GITHUB_TOKEN:-}}}"; test -n "$token" || exit 0; echo username=x-access-token; echo password="$token"; }; f';
+}
+function loadPersistedRuntimeSecrets(runtimeRoot) {
+  if (!runtimeRoot) {
+    return {};
+  }
+  const path = resolve(runtimeRoot, "runtime-secrets.json");
+  if (!existsSync3(path)) {
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf-8"));
+    const allowed = new Set(["GITHUB_TOKEN", "GH_TOKEN", "RIG_GITHUB_TOKEN"]);
+    const entries = Object.entries(parsed).filter((entry) => typeof entry[1] === "string" && allowed.has(entry[0]));
+    return Object.fromEntries(entries);
+  } catch {
+    return {};
+  }
+}
+function ensureRuntimeOpenSslConfig(runtimeHome) {
+  const sslDir = resolve(runtimeHome, ".ssl");
+  const sslConfig = resolve(sslDir, "openssl.cnf");
+  if (!existsSync3(sslDir)) {
+    mkdirSync(sslDir, { recursive: true });
+  }
+  if (!existsSync3(sslConfig)) {
+    writeFileSync(sslConfig, `# Rig runtime OpenSSL config placeholder
+`);
+  }
+  return sslConfig;
+}
+function resolveRuntimeMetadata(projectRoot) {
+  const contextFile = process.env.RIG_RUNTIME_CONTEXT_FILE?.trim();
+  const runtimeHome = process.env.RIG_RUNTIME_HOME?.trim();
+  let ctx = loadRuntimeContextFromEnv();
+  if (runtimeHome) {
+    return {
+      ctx,
+      runtimeRoot: runtimeHome
+    };
+  }
+  if (contextFile) {
+    return {
+      ctx,
+      runtimeRoot: dirname(resolve(contextFile))
+    };
+  }
+  const inferredContextFile = findRuntimeContextFile(projectRoot);
+  if (existsSync3(inferredContextFile)) {
+    try {
+      ctx = loadRuntimeContext(inferredContextFile);
+    } catch {}
+    return {
+      ctx,
+      runtimeRoot: dirname(inferredContextFile)
+    };
+  }
+  return { ctx, runtimeRoot: "" };
+}
+function findRuntimeContextFile(startPath) {
+  let current = resolve(startPath);
+  while (true) {
+    const candidate = resolve(current, "runtime-context.json");
+    if (existsSync3(candidate)) {
+      return candidate;
+    }
+    const parent = dirname(current);
+    if (parent === current) {
+      return "";
+    }
+    current = parent;
+  }
+}
+
+// packages/bundle-default-lifecycle/src/control-plane/hooks/task-runtime-start.ts
+import { taskRuntimeId } from "@rig/core/safe-identifiers";
+import { ISOLATION_BACKEND, REPO_OPERATIONS_CAPABILITY } from "@rig/contracts";
+import { defineCapability as defineCapability2 } from "@rig/core/capability";
+import { requireCapabilityForRoot } from "@rig/core/capability-loaders";
+import { loadRuntimeContextFromEnv as loadRuntimeContextFromEnv2 } from "@rig/core/runtime-context";
+var RepoOperationsCap = defineCapability2(REPO_OPERATIONS_CAPABILITY);
+function resolveTaskRuntimeMode(raw) {
+  if (raw === "off" || raw === "worktree") {
+    return raw;
+  }
+  return "worktree";
+}
+function resolveActiveRuntimeId(taskId) {
+  const runtimeIdFromEnv = (process.env.RIG_TASK_RUNTIME_ID || "").trim();
+  if (runtimeIdFromEnv) {
+    return runtimeIdFromEnv;
+  }
+  try {
+    const runtimeIdFromContext = loadRuntimeContextFromEnv2()?.runtimeId?.trim();
+    if (runtimeIdFromContext) {
+      return runtimeIdFromContext;
+    }
+  } catch {}
+  return taskRuntimeId(taskId);
+}
+function resolveActiveWorkspaceDir() {
+  const workspaceDirFromEnv = (process.env.RIG_TASK_WORKSPACE || "").trim();
+  if (workspaceDirFromEnv) {
+    return workspaceDirFromEnv;
+  }
+  try {
+    const workspaceDirFromContext = loadRuntimeContextFromEnv2()?.workspaceDir?.trim();
+    if (workspaceDirFromContext) {
+      return workspaceDirFromContext;
+    }
+  } catch {}
+  return "";
+}
+function isProvisionedRuntimeWorkspace(workspaceDir) {
+  if (!workspaceDir) {
+    return false;
+  }
+  const layout = resolveRuntimeWorkspaceLayout(workspaceDir);
+  return existsSync4(resolve2(workspaceDir, ".git")) && existsSync4(resolve2(layout.binDir, "rig-agent")) && existsSync4(resolve2(layout.binDir, "hooks", "scope-guard")) && existsSync4(resolve2(layout.sessionDir, "session.json"));
+}
+async function main() {
+  const projectRoot = resolveProjectRoot();
+  const taskId = taskData().currentTaskId(projectRoot);
+  if (!taskId) {
+    return;
+  }
+  const runtimeId = resolveActiveRuntimeId(taskId);
+  const canonicalRuntimeId = taskRuntimeId(taskId);
+  const workspaceDir = resolveActiveWorkspaceDir();
+  if (runtimeId === canonicalRuntimeId) {
+    if (isProvisionedRuntimeWorkspace(workspaceDir)) {
+      console.log(`Task runtime already provisioned (${runtimeId}); skipping in-session reprovision.`);
+      console.log(`Task runtime ready (worktree): ${workspaceDir}`);
+      return;
+    }
+    gitSyncBranch(projectRoot, taskId);
+    const repoOperations = await requireCapabilityForRoot(projectRoot, RepoOperationsCap, `No REPO_OPERATIONS capability is registered for project root "${projectRoot}". ` + "Install @rig/repos-plugin (it ships in the default bundle) so task repo pins can be refreshed.");
+    repoOperations.repoEnsure(projectRoot, taskId);
+  } else {
+    console.log(`Task runtime already provisioned (${runtimeId}); skipping canonical branch sync.`);
+    console.log(`Task runtime already provisioned (${runtimeId}); skipping repo pin refresh.`);
+    if (isProvisionedRuntimeWorkspace(workspaceDir)) {
+      console.log(`Task runtime ready (worktree): ${workspaceDir}`);
+      return;
+    }
+  }
+  const mode = resolveTaskRuntimeMode(process.env.RIG_TASK_RUNTIME_MODE);
+  if (mode !== "off") {
+    const isolationBackend = await requireCapabilityForRoot(projectRoot, defineCapability2(ISOLATION_BACKEND), `No ISOLATION_BACKEND capability is registered for project root "${projectRoot}". ` + "Install @rig/isolation-plugin (it ships in the default bundle) so runtime provisioning can resolve a backend.");
+    const runtime = await isolationBackend.ensureAgentRuntime({
+      projectRoot,
+      id: runtimeId,
+      taskId,
+      mode
+    });
+    console.log(`Task runtime ready (${mode}): ${runtime.workspaceDir}`);
+  }
+}
+if (import.meta.main || process.env.RIG_HOOK_ROLE === "task-runtime-start") {
+  main().catch((error) => {
+    console.error(error);
+    process.exit(1);
+  });
+}
+export {
+  main
+};

package/dist/src/control-plane/materialize-task-config.d.ts

@@ -0,0 +1,29 @@
+/**
+ * materialize-task-config.ts
+ *
+ * Compatibility/export helper from the declarative plugin-host (rig.config →
+ * task source) to the legacy disk-backed `.rig/task-config.json` format.
+ *
+ * Normal runtime dispatch/provision reads TaskRecord values directly from the
+ * configured task source and must not call this helper. Keep it available for
+ * old migration/export flows that intentionally need a legacy task-config file.
+ *
+ * Operator-authored entries (auto_synced !== true) are preserved as-is so
+ * hand-edits on disk win over source-derived defaults.
+ */
+export interface MaterializeResult {
+    /** Absolute path to .rig/task-config.json that was written. */
+    configPath: string;
+    /** Number of source-derived entries merged in (existing or new). */
+    syncedCount: number;
+}
+/**
+ * Materialize plugin-host tasks into `.rig/task-config.json` for explicit
+ * compatibility/export use.
+ *
+ * @returns The result on success, or `null` when no rig.config is present, no
+ *          task source is registered, or the source returned no tasks. Callers
+ *          must treat `null` as "nothing exported" rather than as part of the
+ *          normal dispatch path.
+ */
+export declare function materializePluginHostTaskConfig(projectRoot: string): Promise<MaterializeResult | null>;

package/dist/src/control-plane/materialize-task-config.js

@@ -0,0 +1,95 @@
+// @bun
+var __require = import.meta.require;
+
+// packages/bundle-default-lifecycle/src/control-plane/materialize-task-config.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { dirname, resolve } from "path";
+async function materializePluginHostTaskConfig(projectRoot) {
+  const hasConfig = existsSync(resolve(projectRoot, "rig.config.ts")) || existsSync(resolve(projectRoot, "rig.config.json"));
+  if (!hasConfig)
+    return null;
+  const { buildPluginHostContext } = await import("@rig/core/plugin-host-context");
+  let ctx;
+  try {
+    ctx = await buildPluginHostContext(projectRoot);
+  } catch (err) {
+    console.warn(`[materialize-task-config] plugin host build failed (treating as legacy path): ${err instanceof Error ? err.message : String(err)}`);
+    return null;
+  }
+  if (!ctx)
+    return null;
+  const sources = ctx.taskSourceRegistry.list();
+  if (sources.length === 0)
+    return null;
+  const source = sources[0];
+  const tasks = await source.list();
+  if (tasks.length === 0)
+    return null;
+  const configPath = resolve(projectRoot, ".rig", "task-config.json");
+  const existing = existsSync(configPath) ? safeJsonRead(configPath) : {};
+  const merged = { ...existing };
+  let syncedCount = 0;
+  for (const task of tasks) {
+    const t = task;
+    const id = typeof t.id === "string" ? t.id.trim() : "";
+    if (!id)
+      continue;
+    const existingEntry = merged[id];
+    const existingIsOperatorEdit = existingEntry !== undefined && typeof existingEntry === "object" && existingEntry !== null && existingEntry.auto_synced !== true;
+    if (existingIsOperatorEdit) {
+      continue;
+    }
+    merged[id] = synthesizeEntry(t, ctx.config.taskSource);
+    syncedCount += 1;
+  }
+  mkdirSync(dirname(configPath), { recursive: true });
+  writeFileSync(configPath, `${JSON.stringify(merged, null, 2)}
+`, "utf-8");
+  return { configPath, syncedCount };
+}
+function synthesizeEntry(t, taskSource) {
+  const role = typeof t.role === "string" ? t.role : undefined;
+  const scope = Array.isArray(t.scope) ? t.scope.filter((s) => typeof s === "string") : [];
+  const validation = Array.isArray(t.validators) ? t.validators.filter((v) => typeof v === "string") : Array.isArray(t.validation) ? t.validation.filter((v) => typeof v === "string") : [];
+  const description = typeof t.description === "string" ? t.description : typeof t.body === "string" ? t.body : undefined;
+  const acceptance = typeof t.acceptanceCriteria === "string" ? t.acceptanceCriteria : undefined;
+  const title = typeof t.title === "string" ? t.title : undefined;
+  const status = typeof t.status === "string" ? t.status : undefined;
+  const sourceIssueId = typeof t.sourceIssueId === "string" ? t.sourceIssueId : taskSource.kind === "github-issues" && taskSource.owner && taskSource.repo ? `${taskSource.owner}/${taskSource.repo}#${String(t.id)}` : undefined;
+  return {
+    auto_synced: true,
+    _rig: {
+      taskSource: materializedTaskSource(taskSource),
+      ...sourceIssueId ? { sourceIssueId } : {}
+    },
+    ...title ? { title } : {},
+    ...status ? { status } : {},
+    ...sourceIssueId ? { sourceIssueId } : {},
+    ...role ? { role } : {},
+    scope,
+    validation,
+    ...description ? { description } : {},
+    ...acceptance ? { acceptance_criteria: acceptance } : {}
+  };
+}
+function materializedTaskSource(taskSource) {
+  return {
+    kind: taskSource.kind,
+    ...taskSource.path ? { path: taskSource.path } : {},
+    ...taskSource.owner ? { owner: taskSource.owner } : {},
+    ...taskSource.repo ? { repo: taskSource.repo } : {},
+    ...taskSource.labels ? { labels: taskSource.labels } : {},
+    ...taskSource.state ? { state: taskSource.state } : {}
+  };
+}
+function safeJsonRead(path) {
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf-8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+export {
+  materializePluginHostTaskConfig
+};

package/dist/src/control-plane/native/git-ops.d.ts

@@ -0,0 +1,67 @@
+export declare function shouldScopeGitCommit(args: string[], hasTaskContext: boolean): boolean;
+export declare function gitStatus(projectRoot: string, taskId?: string): void;
+export declare function gitChanged(projectRoot: string, taskId: string | undefined, scoped: boolean): string[];
+export declare function gitPreflight(projectRoot: string, taskId: string | undefined, strict: boolean): boolean;
+export declare function gitSyncBranch(projectRoot: string, taskId?: string, targetRepo?: "monorepo" | "project"): void;
+export declare function gitCommit(options: {
+    projectRoot: string;
+    taskId?: string;
+    target: "monorepo" | "project" | "both";
+    message?: string;
+    allowEmpty: boolean;
+    scoped?: boolean;
+}): void;
+export declare function gitSnapshot(projectRoot: string, taskId?: string, outputPath?: string): string;
+type ReviewerSource = "flag" | "task-config" | "changed-files" | "env";
+export type GitOpenPrOptions = {
+    projectRoot: string;
+    taskId?: string;
+    target?: "monorepo" | "project";
+    reviewer?: string;
+    base?: string;
+    title?: string;
+    body?: string;
+    draft?: boolean;
+};
+export type GitOpenPrResult = {
+    url: string;
+    reviewer?: string;
+    reviewerSource?: ReviewerSource;
+    target: "monorepo" | "project";
+    repoLabel: string;
+    branch: string;
+    base: string;
+};
+export type GitMergePrOptions = {
+    projectRoot: string;
+    pr: GitOpenPrResult;
+    method?: "squash" | "merge" | "rebase";
+    deleteBranch?: boolean;
+    /** Raw 40-char head SHA the merge must match (derived upstream by the lifecycle gate). */
+    matchHeadCommit: string;
+};
+export type GitMergePrResult = {
+    status: "already-merged" | "merged";
+    url: string;
+};
+export declare function gitOpenPr(options: GitOpenPrOptions): GitOpenPrResult;
+export declare function resolveTaskBranchRef(projectRoot: string, taskId: string): string;
+export declare function gitMergePr(options: GitMergePrOptions): GitMergePrResult;
+export declare function readPrMetadata(projectRoot: string, taskId: string): GitOpenPrResult[];
+declare function readChangedFilesManifest(projectRoot: string, taskId: string): string[];
+declare function refreshChangedFilesManifest(projectRoot: string, taskId: string): string;
+declare function buildStageAddArgs(repoRoot: string, files: string[], scoped: boolean): string[] | null;
+declare function resolveScopedStageFilesForRepo(projectRoot: string, repoRoot: string, taskId: string | undefined, files: string[]): string[];
+declare function resolveScopedFilesForRepo(projectRoot: string, repoRoot: string, files: string[]): string[];
+declare function resolveChangedTaskArtifactFiles(projectRoot: string, repoRoot: string, taskId: string): string[];
+declare function stageExcludePathspecs(repoRoot: string): string[];
+export declare const __testOnly: {
+    buildStageAddArgs: typeof buildStageAddArgs;
+    refreshChangedFilesManifest: typeof refreshChangedFilesManifest;
+    readChangedFilesManifest: typeof readChangedFilesManifest;
+    resolveChangedTaskArtifactFiles: typeof resolveChangedTaskArtifactFiles;
+    resolveScopedStageFilesForRepo: typeof resolveScopedStageFilesForRepo;
+    resolveScopedFilesForRepo: typeof resolveScopedFilesForRepo;
+    stageExcludePathspecs: typeof stageExcludePathspecs;
+};
+export {};