@h-rig/cli-surface-plugin 0.0.6-alpha.157 → 0.0.6-alpha.159

package/dist/src/commands/run.js

@@ -1,39 +1,665 @@
 // @bun
-var __require = import.meta.require;
-
 // packages/cli-surface-plugin/src/commands/run.ts
-import { TERMINAL_RUN_STATUSES } from "@rig/contracts";
-import {
-  listTasks,
-  normalizeTaskId,
-  readTaskTitle
-} from "@rig/core/task-io";
-import { removeRegistryRoom } from "@rig/runtime/control-plane/registry-room";
-import { isReadyTask, resolveStartTask, selectNextReadyTask } from "@rig/dependency-graph-plugin";
 import {
-  activeRunByTaskId,
-  assertNoActiveRunForTask,
-  deliverRemoteRunControl,
-  deliverRunControl,
-  getRun,
-  listRuns,
-  readSessionRunEntries,
-  resolveJoinTarget
-} from "@rig/run-worker/runs";
+  RUN_READ_MODEL,
+  TASK_IO_SERVICE_CAPABILITY,
+  TASK_SELECTION
+} from "@rig/contracts";
+import { defineCapability } from "@rig/core/capability";
+import { requireCapabilityForRoot } from "@rig/core/capability-loaders";
 
 // packages/cli-surface-plugin/src/runner.ts
-import { EventBus } from "@rig/runtime/control-plane/runtime/events";
-import { CliError as RuntimeCliError } from "@rig/runtime/control-plane/errors";
-import { evaluate, loadPolicy, resolveAction } from "@rig/runtime/control-plane/runtime/guard";
-import { buildBinary } from "@rig/runtime/control-plane/runtime/isolation";
+import { EventBus } from "@rig/core/runtime-events";
+import { CliError as RuntimeCliError } from "@rig/contracts";
+
+// packages/cli-surface-plugin/src/control-plane/guard.ts
+import { optimizeNextInvocation } from "bun:jsc";
+import { existsSync, readFileSync, statSync } from "fs";
+import { resolve } from "path";
 
+// packages/cli-surface-plugin/src/control-plane/scope.ts
+import { getScopeRules } from "@rig/core/scope-rules";
+var scopeRegexCache = new Map;
+function unique(values) {
+  return [...new Set(values)];
+}
+function normalizeRelativeScopePath(inputPath) {
+  let normalized = inputPath.replace(/^\.\//, "");
+  const rules = getScopeRules();
+  if (rules?.stripPrefixes) {
+    for (const prefix of rules.stripPrefixes) {
+      if (normalized.startsWith(prefix)) {
+        normalized = normalized.slice(prefix.length);
+      }
+    }
+  }
+  return normalized;
+}
+function normalizePathToScope(projectRoot, monorepoRoot, inputPath) {
+  let normalized = inputPath.replace(/^\.\//, "");
+  if (normalized.startsWith(projectRoot + "/")) {
+    normalized = normalized.slice(projectRoot.length + 1);
+  }
+  if (normalized.startsWith(monorepoRoot + "/")) {
+    normalized = normalized.slice(monorepoRoot.length + 1);
+  }
+  return normalizeRelativeScopePath(normalized);
+}
+function scopeGlobToRegex(glob) {
+  const cached = scopeRegexCache.get(glob);
+  if (cached) {
+    return cached;
+  }
+  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "__GLOBSTAR__").replace(/\*/g, "[^/]*").replace(/__GLOBSTAR__/g, ".*");
+  const compiled = new RegExp(`^${escaped}$`);
+  scopeRegexCache.set(glob, compiled);
+  return compiled;
+}
+function scopeMatches(path, scopes) {
+  const pathVariants = unique([path, normalizeRelativeScopePath(path)]);
+  for (const scope of scopes) {
+    const scopeVariants = unique([scope, normalizeRelativeScopePath(scope)]);
+    for (const candidatePath of pathVariants) {
+      for (const candidateScope of scopeVariants) {
+        if (candidatePath === candidateScope || scopeGlobToRegex(candidateScope).test(candidatePath)) {
+          return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+
+// packages/cli-surface-plugin/src/control-plane/guard.ts
+import {
+  POLICY_VERSION
+} from "@rig/contracts";
+var DEFAULT_SCOPE = {
+  fail_closed: true,
+  harness_paths_exempt: true,
+  runtime_paths_exempt: true
+};
+var DEFAULT_SANDBOX = {
+  mode: "enforce",
+  network: true,
+  read_deny: [],
+  write_allow_from_runtime: true
+};
+var DEFAULT_ISOLATION = {
+  default_mode: "worktree",
+  repo_symlink_fallback: false,
+  strict_provisioning: true,
+  fail_closed_on_provision_error: true
+};
+var DEFAULT_COMPLETION = {
+  derive_checks_from_scope: true,
+  checks: [],
+  typescript_config_probe: ["tsconfig.json"],
+  eslint_config_probe: [".eslintrc.js", ".eslintrc.json", "eslint.config.js"]
+};
+var DEFAULT_RUNTIME_IMAGE = {
+  deps: {
+    monorepo_install: false,
+    hp_next_install: false
+  },
+  plugins_require_binaries: true
+};
+var DEFAULT_RUNTIME_SNAPSHOT = {
+  enabled: true
+};
+function defaultPolicy() {
+  return {
+    version: POLICY_VERSION,
+    mode: "enforce",
+    scope: { ...DEFAULT_SCOPE },
+    rules: [],
+    sandbox: { ...DEFAULT_SANDBOX },
+    isolation: { ...DEFAULT_ISOLATION },
+    completion: { ...DEFAULT_COMPLETION },
+    runtime_image: {
+      deps: { ...DEFAULT_RUNTIME_IMAGE.deps },
+      plugins_require_binaries: DEFAULT_RUNTIME_IMAGE.plugins_require_binaries
+    },
+    runtime_snapshot: { ...DEFAULT_RUNTIME_SNAPSHOT }
+  };
+}
+var policyCache = null;
+var policyCachePath = null;
+var seededPolicyConfig = null;
+var compiledRegexCache = new Map;
+function loadPolicy(projectRoot) {
+  if (seededPolicyConfig) {
+    return seededPolicyConfig;
+  }
+  const configPath = resolve(projectRoot, "rig/policy/policy.json");
+  if (!existsSync(configPath)) {
+    return defaultPolicy();
+  }
+  let mtimeMs;
+  try {
+    mtimeMs = statSync(configPath).mtimeMs;
+  } catch {
+    return defaultPolicy();
+  }
+  if (policyCache && policyCachePath === configPath && policyCache.mtimeMs === mtimeMs) {
+    return policyCache.config;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(configPath, "utf-8"));
+  } catch {
+    return defaultPolicy();
+  }
+  const config = mergeWithDefaults(parsed);
+  policyCache = { mtimeMs, config };
+  policyCachePath = configPath;
+  return config;
+}
+function mergeWithDefaults(parsed) {
+  const base = defaultPolicy();
+  if (typeof parsed.mode === "string" && isValidMode(parsed.mode)) {
+    base.mode = parsed.mode;
+  }
+  if (parsed.scope && typeof parsed.scope === "object" && !Array.isArray(parsed.scope)) {
+    const s = parsed.scope;
+    if (typeof s.fail_closed === "boolean")
+      base.scope.fail_closed = s.fail_closed;
+    if (typeof s.harness_paths_exempt === "boolean")
+      base.scope.harness_paths_exempt = s.harness_paths_exempt;
+    if (typeof s.runtime_paths_exempt === "boolean")
+      base.scope.runtime_paths_exempt = s.runtime_paths_exempt;
+  }
+  if (Array.isArray(parsed.rules)) {
+    base.rules = precompilePolicyRuleRegexes(parsed.rules.filter(isValidRule));
+  }
+  if (Array.isArray(parsed.deny) && base.rules.length === 0) {
+    base.rules = precompilePolicyRuleRegexes(migrateLegacyDeny(parsed.deny));
+  }
+  if (parsed.sandbox && typeof parsed.sandbox === "object" && !Array.isArray(parsed.sandbox)) {
+    const sb = parsed.sandbox;
+    if (typeof sb.mode === "string" && isValidMode(sb.mode))
+      base.sandbox.mode = sb.mode;
+    if (typeof sb.network === "boolean")
+      base.sandbox.network = sb.network;
+    if (Array.isArray(sb.read_deny))
+      base.sandbox.read_deny = sb.read_deny.filter((v) => typeof v === "string");
+    if (typeof sb.write_allow_from_runtime === "boolean")
+      base.sandbox.write_allow_from_runtime = sb.write_allow_from_runtime;
+  }
+  if (parsed.isolation && typeof parsed.isolation === "object" && !Array.isArray(parsed.isolation)) {
+    const iso = parsed.isolation;
+    if (iso.default_mode === "worktree")
+      base.isolation.default_mode = iso.default_mode;
+    if (typeof iso.repo_symlink_fallback === "boolean")
+      base.isolation.repo_symlink_fallback = iso.repo_symlink_fallback;
+    if (typeof iso.strict_provisioning === "boolean")
+      base.isolation.strict_provisioning = iso.strict_provisioning;
+    if (typeof iso.fail_closed_on_provision_error === "boolean")
+      base.isolation.fail_closed_on_provision_error = iso.fail_closed_on_provision_error;
+  }
+  if (parsed.completion && typeof parsed.completion === "object" && !Array.isArray(parsed.completion)) {
+    const comp = parsed.completion;
+    if (typeof comp.derive_checks_from_scope === "boolean")
+      base.completion.derive_checks_from_scope = comp.derive_checks_from_scope;
+    if (Array.isArray(comp.checks))
+      base.completion.checks = comp.checks.filter((v) => typeof v === "string");
+    if (Array.isArray(comp.typescript_config_probe))
+      base.completion.typescript_config_probe = comp.typescript_config_probe.filter((v) => typeof v === "string");
+    if (Array.isArray(comp.eslint_config_probe))
+      base.completion.eslint_config_probe = comp.eslint_config_probe.filter((v) => typeof v === "string");
+  }
+  if (parsed.runtime_image && typeof parsed.runtime_image === "object" && !Array.isArray(parsed.runtime_image)) {
+    const runtimeImage = parsed.runtime_image;
+    if (runtimeImage.deps && typeof runtimeImage.deps === "object" && !Array.isArray(runtimeImage.deps)) {
+      const deps = runtimeImage.deps;
+      if (typeof deps.monorepo_install === "boolean") {
+        base.runtime_image.deps.monorepo_install = deps.monorepo_install;
+      }
+      if (typeof deps.hp_next_install === "boolean") {
+        base.runtime_image.deps.hp_next_install = deps.hp_next_install;
+      }
+    }
+    if (typeof runtimeImage.plugins_require_binaries === "boolean") {
+      base.runtime_image.plugins_require_binaries = runtimeImage.plugins_require_binaries;
+    }
+  }
+  if (parsed.runtime_snapshot && typeof parsed.runtime_snapshot === "object" && !Array.isArray(parsed.runtime_snapshot)) {
+    const runtimeSnapshot = parsed.runtime_snapshot;
+    if (typeof runtimeSnapshot.enabled === "boolean") {
+      base.runtime_snapshot.enabled = runtimeSnapshot.enabled;
+    }
+  }
+  return base;
+}
+function isValidMode(value) {
+  return value === "off" || value === "observe" || value === "enforce";
+}
+function isValidRule(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const r = value;
+  return typeof r.id === "string" && typeof r.category === "string" && r.match != null && typeof r.match === "object";
+}
+function migrateLegacyDeny(deny) {
+  const rules = [];
+  for (const entry of deny) {
+    if (typeof entry.id !== "string")
+      continue;
+    const match = {};
+    if (typeof entry.pattern === "string")
+      match.pattern = entry.pattern;
+    if (typeof entry.regex === "string")
+      match.regex = entry.regex;
+    if (!match.pattern && !match.regex)
+      continue;
+    rules.push({
+      id: entry.id,
+      category: "command",
+      match,
+      action: "block",
+      ...typeof entry.description === "string" ? { description: entry.description } : {}
+    });
+  }
+  return rules;
+}
+function precompilePolicyRuleRegexes(rules) {
+  return rules.map((rule) => {
+    const compiledRegex = rule.match.regex ? compileSafeRegex(rule.match.regex, `rules.${rule.id}.match.regex`, true) : undefined;
+    const compiledUnlessRegex = rule.unless?.regex ? compileSafeRegex(rule.unless.regex, `rules.${rule.id}.unless.regex`, true) : undefined;
+    return {
+      ...rule,
+      ...compiledRegex ? { compiledRegex } : {},
+      ...compiledUnlessRegex ? { compiledUnlessRegex } : {}
+    };
+  });
+}
+function getRegexUnsafeReason(pattern) {
+  if (pattern.length > 512) {
+    return "pattern exceeds max safe length (512 chars)";
+  }
+  if (/\\[1-9]/.test(pattern)) {
+    return "pattern uses backreferences";
+  }
+  if (/\((?:[^()\\]|\\.)*[+*](?:[^()\\]|\\.)*\)\s*[*+{]/.test(pattern)) {
+    return "pattern contains nested quantifiers";
+  }
+  if (/\((?:[^()\\]|\\.)*\.\\?[+*](?:[^()\\]|\\.)*\)\s*[*+{]/.test(pattern)) {
+    return "pattern contains nested broad quantifiers";
+  }
+  return null;
+}
+function compileSafeRegex(pattern, sourceLabel, logOnFailure) {
+  const cached = compiledRegexCache.get(pattern);
+  if (cached !== undefined) {
+    return cached ?? undefined;
+  }
+  const unsafeReason = getRegexUnsafeReason(pattern);
+  if (unsafeReason) {
+    if (logOnFailure) {
+      console.warn(`[policy] Skipping unsafe regex in ${sourceLabel}: ${unsafeReason}`);
+    }
+    compiledRegexCache.set(pattern, null);
+    return;
+  }
+  try {
+    const compiled = new RegExp(pattern);
+    compiledRegexCache.set(pattern, compiled);
+    return compiled;
+  } catch (error) {
+    if (logOnFailure) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.warn(`[policy] Skipping invalid regex in ${sourceLabel}: ${message}`);
+    }
+    compiledRegexCache.set(pattern, null);
+    return;
+  }
+}
+function matchRule(rule, input) {
+  const { match } = rule;
+  if (match.pattern && input.includes(match.pattern)) {
+    return true;
+  }
+  if (match.regex) {
+    const compiled = rule.compiledRegex || compileSafeRegex(match.regex, `rules.${rule.id}.match.regex`, false);
+    if (!compiled) {
+      return false;
+    }
+    try {
+      return compiled.test(input);
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function matchRuleUnless(rule, command, taskId) {
+  if (!rule.unless)
+    return false;
+  if (rule.unless.regex) {
+    const compiled = rule.compiledUnlessRegex || compileSafeRegex(rule.unless.regex, `rules.${rule.id}.unless.regex`, false);
+    if (!compiled) {
+      return false;
+    }
+    try {
+      if (compiled.test(command))
+        return true;
+    } catch {}
+  }
+  if (rule.unless.task_in && taskId) {
+    if (rule.unless.task_in.includes(taskId))
+      return true;
+  }
+  return false;
+}
+function resolveAction(mode, matched) {
+  if (matched.length === 0)
+    return "allow";
+  if (mode === "off")
+    return "allow";
+  if (mode === "observe")
+    return "warn";
+  return "block";
+}
+function resolveAbsolutePath(projectRoot, rawPath) {
+  if (rawPath.startsWith("/"))
+    return resolve(rawPath);
+  return resolve(projectRoot, rawPath);
+}
+function isHarnessPath(projectRoot, rawPath) {
+  const absPath = resolveAbsolutePath(projectRoot, rawPath);
+  const managedRoots = [
+    resolve(projectRoot, "rig"),
+    resolve(projectRoot, ".rig"),
+    resolve(projectRoot, "artifacts")
+  ];
+  return managedRoots.some((root) => absPath === root || absPath.startsWith(root + "/"));
+}
+function isRuntimePath(projectRoot, rawPath, taskWorkspace) {
+  const absPath = resolveAbsolutePath(projectRoot, rawPath);
+  if (taskWorkspace) {
+    const workspaceRigRoot = resolve(taskWorkspace, ".rig");
+    const workspaceArtifactsRoot = resolve(taskWorkspace, "artifacts");
+    if (absPath === workspaceRigRoot || absPath.startsWith(workspaceRigRoot + "/") || absPath === workspaceArtifactsRoot || absPath.startsWith(workspaceArtifactsRoot + "/")) {
+      return true;
+    }
+  }
+  const runtimeRoot = resolve(projectRoot, ".rig/runtime/agents");
+  return absPath === runtimeRoot || absPath.startsWith(runtimeRoot + "/");
+}
+function isTestFile(path) {
+  return /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(path) || /\/(__tests__|tests|test)\//.test(path);
+}
+function evaluate(context) {
+  const policy = loadPolicy(context.projectRoot);
+  switch (context.evaluation.type) {
+    case "tool-call":
+      return evaluateToolCall(policy, context);
+    case "command":
+      return evaluateCommand(policy, context);
+    case "content-write":
+      return evaluateContent(policy, context);
+    case "file-access":
+      return evaluateScope(policy, context, context.evaluation.file_path, context.evaluation.access);
+  }
+}
+function evaluateScope(policy, context, filePath, access) {
+  const allowed = () => ({
+    allowed: true,
+    matchedRules: [],
+    action: "allow",
+    failClosed: false
+  });
+  if (policy.scope.harness_paths_exempt && isHarnessPath(context.projectRoot, filePath)) {
+    return allowed();
+  }
+  if (policy.scope.runtime_paths_exempt && isRuntimePath(context.projectRoot, filePath, context.taskWorkspace)) {
+    return allowed();
+  }
+  if (!context.taskId) {
+    if (access === "write" && policy.scope.fail_closed) {
+      return {
+        allowed: false,
+        matchedRules: [],
+        action: resolveAction(policy.mode, [{ id: "scope:no-task", category: "command", reason: "No active task; fail-closed for write operations" }]),
+        failClosed: true
+      };
+    }
+    return allowed();
+  }
+  const scopes = context.taskScopes || [];
+  if (scopes.length === 0) {
+    return allowed();
+  }
+  if (context.taskWorkspace && context.taskWorkspace !== context.projectRoot && filePath.startsWith("/")) {
+    const absPath = resolve(filePath);
+    if (!absPath.startsWith(context.taskWorkspace + "/") && !isHarnessPath(context.projectRoot, filePath)) {
+      const reason2 = `Absolute path '${filePath}' is outside task runtime boundary. Allowed root: ${context.taskWorkspace}`;
+      const matched2 = [{ id: "scope:workspace-boundary", category: "command", reason: reason2 }];
+      return {
+        allowed: policy.mode !== "enforce",
+        matchedRules: matched2,
+        action: resolveAction(policy.mode, matched2),
+        failClosed: false
+      };
+    }
+  }
+  const monorepoRoot = context.monorepoRoot || process.env.MONOREPO_ROOT?.trim() || context.taskWorkspace || context.projectRoot;
+  let normalizedPath = filePath;
+  if (context.taskWorkspace && context.taskWorkspace !== context.projectRoot && filePath.startsWith(context.taskWorkspace + "/")) {
+    normalizedPath = filePath.slice(context.taskWorkspace.length + 1);
+  }
+  normalizedPath = normalizePathToScope(context.projectRoot, monorepoRoot, normalizedPath);
+  if (scopeMatches(filePath, scopes) || scopeMatches(normalizedPath, scopes)) {
+    return allowed();
+  }
+  const reason = `File '${filePath}' (normalized: '${normalizedPath}') is outside scope of task ${context.taskId}`;
+  const matched = [{ id: "scope:out-of-scope", category: "command", reason }];
+  return {
+    allowed: policy.mode !== "enforce",
+    matchedRules: matched,
+    action: resolveAction(policy.mode, matched),
+    failClosed: false
+  };
+}
+function evaluateCommand(policy, context) {
+  const evaluation = context.evaluation;
+  if (evaluation.type !== "command") {
+    return { allowed: true, matchedRules: [], action: "allow", failClosed: false };
+  }
+  const command = evaluation.command;
+  const matchedRules = [];
+  for (const rule of policy.rules) {
+    if (rule.category !== "command")
+      continue;
+    if (!matchRule(rule, command))
+      continue;
+    if (matchRuleUnless(rule, command, context.taskId))
+      continue;
+    matchedRules.push({
+      id: rule.id,
+      category: rule.category,
+      ...rule.description !== undefined ? { description: rule.description } : {},
+      reason: rule.description || `Matched rule ${rule.id}`
+    });
+  }
+  const writeTarget = extractWriteTarget(command);
+  if (writeTarget && !/^\/dev\//.test(writeTarget) && !/^\/proc\//.test(writeTarget)) {
+    const scopeResult = evaluateScope(policy, context, writeTarget, "write");
+    if (!scopeResult.allowed || scopeResult.matchedRules.length > 0) {
+      matchedRules.push(...scopeResult.matchedRules);
+    }
+  }
+  const action = resolveAction(policy.mode, matchedRules);
+  return {
+    allowed: action !== "block",
+    matchedRules,
+    action,
+    failClosed: false
+  };
+}
+function extractWriteTarget(command) {
+  const redirect = command.match(/>>?\s+([^\s;|&]+)/);
+  if (redirect?.[1])
+    return redirect[1];
+  const tee = command.match(/tee\s+(-a\s+)?([^\s;|&]+)/);
+  if (tee?.[2])
+    return tee[2];
+  return "";
+}
+function evaluateContent(policy, context) {
+  const evaluation = context.evaluation;
+  if (evaluation.type !== "content-write") {
+    return { allowed: true, matchedRules: [], action: "allow", failClosed: false };
+  }
+  const { content, file_path } = evaluation;
+  const matchedRules = [];
+  const scopeResult = evaluateScope(policy, context, file_path, "write");
+  if (scopeResult.matchedRules.length > 0) {
+    matchedRules.push(...scopeResult.matchedRules);
+  }
+  for (const rule of policy.rules) {
+    if (rule.category !== "content" && rule.category !== "import" && rule.category !== "test-integrity")
+      continue;
+    if (rule.applies_to === "test-files" && !isTestFile(file_path))
+      continue;
+    if (!matchRule(rule, content))
+      continue;
+    if (matchRuleUnless(rule, content, context.taskId))
+      continue;
+    matchedRules.push({
+      id: rule.id,
+      category: rule.category,
+      ...rule.description !== undefined ? { description: rule.description } : {},
+      reason: rule.description || `Matched rule ${rule.id}`
+    });
+  }
+  const action = resolveAction(policy.mode, matchedRules);
+  return {
+    allowed: action !== "block",
+    matchedRules,
+    action,
+    failClosed: false
+  };
+}
+function evaluateToolCall(policy, context) {
+  const evaluation = context.evaluation;
+  if (evaluation.type !== "tool-call") {
+    return { allowed: true, matchedRules: [], action: "allow", failClosed: false };
+  }
+  const { tool_name, tool_input } = evaluation;
+  const allMatched = [];
+  const filePaths = extractFilePathsFromToolInput(tool_name, tool_input);
+  for (const fp of filePaths) {
+    const access = isWriteTool(tool_name) ? "write" : "read";
+    const scopeResult = evaluateScope(policy, context, fp, access);
+    if (scopeResult.matchedRules.length > 0) {
+      allMatched.push(...scopeResult.matchedRules);
+    }
+  }
+  const content = extractContentFromToolInput(tool_input);
+  if (content) {
+    const filePath = filePaths[0] || "";
+    const contentContext = {
+      ...context,
+      evaluation: { type: "content-write", file_path: filePath, content }
+    };
+    const contentPolicy = loadPolicy(context.projectRoot);
+    for (const rule of contentPolicy.rules) {
+      if (rule.category !== "content" && rule.category !== "import" && rule.category !== "test-integrity")
+        continue;
+      if (rule.applies_to === "test-files" && !isTestFile(filePath))
+        continue;
+      if (!matchRule(rule, content))
+        continue;
+      if (matchRuleUnless(rule, content, context.taskId))
+        continue;
+      allMatched.push({
+        id: rule.id,
+        category: rule.category,
+        ...rule.description !== undefined ? { description: rule.description } : {},
+        reason: rule.description || `Matched rule ${rule.id}`
+      });
+    }
+  }
+  if (tool_name === "Bash") {
+    const command = String(tool_input.command || tool_input.cmd || "");
+    if (command) {
+      const cmdContext = {
+        ...context,
+        evaluation: { type: "command", command }
+      };
+      const cmdResult = evaluateCommand(policy, cmdContext);
+      if (cmdResult.matchedRules.length > 0) {
+        allMatched.push(...cmdResult.matchedRules);
+      }
+    }
+  }
+  const seen = new Set;
+  const deduplicated = [];
+  for (const rule of allMatched) {
+    if (!seen.has(rule.id)) {
+      seen.add(rule.id);
+      deduplicated.push(rule);
+    }
+  }
+  const action = resolveAction(policy.mode, deduplicated);
+  return {
+    allowed: action !== "block",
+    matchedRules: deduplicated,
+    action,
+    failClosed: false
+  };
+}
+function isWriteTool(toolName) {
+  return toolName === "Write" || toolName === "Edit" || toolName === "MultiEdit";
+}
+function extractFilePathsFromToolInput(toolName, input) {
+  const paths = [];
+  const add = (value) => {
+    if (typeof value === "string" && value.trim()) {
+      paths.push(value.trim());
+    }
+  };
+  if (toolName === "Read" || toolName === "Write" || toolName === "Edit" || toolName === "MultiEdit") {
+    add(input.file_path);
+    add(input.path);
+  } else if (toolName === "Glob") {
+    add(input.path);
+  } else if (toolName === "Grep") {
+    add(input.path);
+  } else {
+    add(input.file_path);
+    add(input.path);
+  }
+  return paths;
+}
+function extractContentFromToolInput(input) {
+  if (typeof input.content === "string")
+    return input.content;
+  if (typeof input.new_string === "string")
+    return input.new_string;
+  return "";
+}
+var guardHotPathPrimed = false;
+function primeGuardHotPaths() {
+  if (guardHotPathPrimed) {
+    return;
+  }
+  guardHotPathPrimed = true;
+  try {
+    optimizeNextInvocation(matchRule);
+    optimizeNextInvocation(evaluate);
+  } catch {}
+}
+primeGuardHotPaths();
+
+// packages/cli-surface-plugin/src/control-plane/agent-binary-build.ts
+import { runtimeProvisioningEnv } from "@rig/core/runtime-provisioning-env";
+
+// packages/cli-surface-plugin/src/runner.ts
 class CliError extends RuntimeCliError {
-  hint;
   constructor(message, exitCode = 1, options = {}) {
-    super(message, exitCode);
-    if (options.hint?.trim()) {
-      this.hint = options.hint.trim();
-    }
+    super(message, exitCode, options);
   }
 }
 function takeFlag(args, flag) {
@@ -76,8 +702,8 @@ Usage: ${usage}`);
 }
 
 // packages/cli-surface-plugin/src/kernel-dispatch.ts
+import { getProcessKernel } from "@rig/kernel-seed/boot-default";
 async function dispatchThroughKernel(input, options) {
-  const { getProcessKernel } = await import("@rig/kernel/boot-default");
   const kernel = getProcessKernel();
   if (!kernel) {
     throw new Error("Kernel not booted: cannot dispatch a run through the transport capability.");
@@ -88,10 +714,13 @@ async function dispatchThroughKernel(input, options) {
 
 // packages/cli-surface-plugin/src/commands/_cli-format.ts
 import pc from "picocolors";
-import { runStatusColorRole, runStatusText, statusColorRole } from "@rig/run-worker/runs";
 var dim = pc.dim;
 var faintBar = pc.dim("\u2502");
 var accent = pc.cyan;
+function numberField(record, key) {
+  const value = record[key];
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
 function truncate(value, width) {
   return value.length <= width ? value : `${value.slice(0, Math.max(0, width - 1))}\u2026`;
 }
@@ -113,6 +742,52 @@ function colorForRole(role) {
       return pc.dim;
   }
 }
+function normalizeStatus(status) {
+  const normalized = String(status ?? "").trim().toLowerCase().replace(/[\s_]+/g, "-");
+  return normalized === "waiting-input" ? "waiting-user-input" : normalized;
+}
+function statusColorRole(status) {
+  switch (normalizeStatus(status)) {
+    case "done":
+    case "completed":
+    case "ready":
+    case "healthy":
+    case "approved":
+    case "merged":
+      return "success";
+    case "needs-attention":
+    case "waiting-approval":
+    case "waiting-user-input":
+    case "blocked":
+    case "paused":
+      return "action-yellow";
+    case "running":
+    case "adopted":
+    case "preparing":
+    case "created":
+    case "queued":
+    case "starting":
+    case "pending":
+    case "in-progress":
+    case "active":
+    case "booting":
+    case "validating":
+    case "reviewing":
+    case "closing-out":
+      return "active-cyan";
+    case "failed":
+    case "error":
+    case "rejected":
+      return "failure";
+    case "stopped":
+    case "cancelled":
+    case "canceled":
+    case "stale":
+      return "muted";
+    default:
+      return "neutral";
+  }
+}
 function compactDate(value) {
   const parsed = Date.parse(value);
   if (!Number.isFinite(parsed))
@@ -137,10 +812,20 @@ function runTitleOf(run) {
   return firstString(run, ["title", "summary", "name"], taskIdOf(run) || "(untitled)");
 }
 function runLikeStatusText(run) {
-  return runStatusText(run);
+  const record = run;
+  const normalized = normalizeStatus(record.status);
+  return normalized || (record.live === true && record.stale !== true ? "starting" : "unknown");
 }
 function runLikeStatusColor(run) {
-  return colorForRole(runStatusColorRole(run));
+  const record = run;
+  const pendingApprovals = numberField(record, "pendingApprovals") ?? 0;
+  const pendingInputs = numberField(record, "pendingInputs") ?? 0;
+  const stallCount = numberField(record, "stallCount") ?? 0;
+  const status = runLikeStatusText(run);
+  if (status !== "completed" && status !== "failed" && status !== "stopped" && (status === "needs-attention" || pendingApprovals + pendingInputs > 0 || stallCount > 0)) {
+    return colorForRole("action-yellow");
+  }
+  return colorForRole(statusColorRole(status));
 }
 function printFormattedOutput(message) {
   console.log(message);
@@ -241,7 +926,10 @@ function formatRunSummaryLine(run) {
 }
 
 // packages/cli-surface-plugin/src/commands/run.ts
-var TERMINAL = new Set(TERMINAL_RUN_STATUSES);
+var RunReadModelCap = defineCapability(RUN_READ_MODEL);
+var TaskIoCap = defineCapability(TASK_IO_SERVICE_CAPABILITY);
+var TaskSelectionCap = defineCapability(TASK_SELECTION);
+var NOT_READY_TASK_STATUSES = { closed: true, done: true, completed: true, merged: true, blocked: true, "in-progress": true, running: true };
 var RUN_COMMANDS = new Set([
   "list",
   "status",
@@ -280,6 +968,31 @@ function parsePromptOverride(prompt, initialPrompt) {
   }
   return promptText || initialPromptText || null;
 }
+function normalizeTaskId(value) {
+  const trimmed = value?.trim();
+  if (!trimmed)
+    return;
+  return trimmed.startsWith("#") && /^#\d+$/.test(trimmed) ? trimmed.slice(1) : trimmed;
+}
+function readTaskTitle(task) {
+  if (!task)
+    return null;
+  for (const key of ["title", "summary", "name"]) {
+    const value = task[key];
+    if (typeof value === "string" && value.trim())
+      return value.trim();
+  }
+  return null;
+}
+async function loadTaskIo(projectRoot) {
+  return requireCapabilityForRoot(projectRoot, TaskIoCap, "No task-sources plugin provides task IO for this project root.");
+}
+async function loadRunReadModel(projectRoot) {
+  return requireCapabilityForRoot(projectRoot, RunReadModelCap, "No run-worker plugin provides run read model for this project root.");
+}
+async function loadTaskSelection(projectRoot) {
+  return requireCapabilityForRoot(projectRoot, TaskSelectionCap, "No dependency-graph plugin provides task selection for this project root.");
+}
 function parsePositiveLimit(value) {
   if (value === undefined)
     return;
@@ -325,12 +1038,78 @@ function requireRunId(value, usage) {
   }
   return value.trim();
 }
+function taskStatus(task) {
+  const value = task.status;
+  return typeof value === "string" ? value.trim().toLowerCase() : "";
+}
+function isReadyTask(task) {
+  const status = taskStatus(task);
+  return status.length === 0 || NOT_READY_TASK_STATUSES[status] !== true;
+}
+function selectNextReadyTaskLocal(tasks) {
+  return tasks.find(isReadyTask) ?? null;
+}
+async function selectNextReadyTaskForRun(projectRoot, deps) {
+  if (deps.listTasks)
+    return selectNextReadyTaskLocal(await deps.listTasks(projectRoot));
+  const selection = await (await loadTaskSelection(projectRoot)).selectNextReadyTask({ projectRoot });
+  return selection.selected;
+}
+async function readyTasksForRun(projectRoot, deps) {
+  if (deps.listTasks)
+    return (await deps.listTasks(projectRoot)).filter(isReadyTask);
+  const selection = await (await loadTaskSelection(projectRoot)).selectNextReadyTask({ projectRoot });
+  return selection.ready;
+}
+async function resolveStartTaskForRun(projectRoot, taskRef, next, deps) {
+  if (next) {
+    const task2 = await selectNextReadyTaskForRun(projectRoot, deps);
+    const taskId2 = normalizeTaskId(task2?.id);
+    if (!task2 || !taskId2)
+      throw new Error("No ready task found.");
+    return { taskId: taskId2, task: task2 };
+  }
+  const taskId = normalizeTaskId(taskRef);
+  if (!taskId)
+    throw new Error("Missing task id.");
+  const task = deps.listTasks ? (await deps.listTasks(projectRoot).catch(() => [])).find((candidate) => normalizeTaskId(candidate.id) === taskId) ?? null : await (await loadTaskIo(projectRoot)).getTask(projectRoot, taskId).catch(() => null);
+  return { taskId, task };
+}
+async function activeRunByTaskId(listRunsForRoot, readModel, projectRoot) {
+  const active = new Map;
+  for (const run of await listRunsForRoot(projectRoot)) {
+    const classification = readModel.classifyRun(run);
+    if (!run.taskId || !run.live || run.stale || classification.isTerminal || classification.status === "needs-attention" || classification.status === "needs_attention")
+      continue;
+    active.set(run.taskId, run);
+  }
+  return active;
+}
+async function assertNoActiveRunForTask(listRunsForRoot, readModel, projectRoot, taskId) {
+  const active = await activeRunByTaskId(listRunsForRoot, readModel, projectRoot);
+  if (active.has(taskId))
+    throw new CliError(`Task ${taskId} already has an active run.`, 2, { hint: "Use --force to dispatch another run anyway." });
+}
+async function deliverRunControl(projectRoot, run, control, deps) {
+  if (deps.deliverControl)
+    return deps.deliverControl(projectRoot, run.runId, control);
+  const result = await (await loadRunReadModel(projectRoot)).deliverControl({ projectRoot, runId: run.runId, control });
+  if (!result.delivered)
+    throw new CliError(result.detail ?? `Run ${run.runId} did not accept ${control.kind}.`, 2);
+}
+async function removeRegistryRoom(projectRoot, runId) {
+  const result = await (await loadRunReadModel(projectRoot)).removeRunRegistryEntry({ projectRoot, runId });
+  return result.removed;
+}
 async function executeRun(context, args, deps = {}) {
-  const listRunRecords = deps.listRuns ?? ((root) => listRuns(root));
-  const getRunRecord = deps.getRun ?? ((root, id) => getRun(root, id));
-  const joinTarget = deps.resolveJoin ?? ((root, id) => resolveJoinTarget(root, id));
+  const listRunRecords = deps.listRuns ?? (async (root) => (await loadRunReadModel(root)).listRuns({ projectRoot: root }));
+  const getRunRecord = deps.getRun ?? (async (root, id) => (await loadRunReadModel(root)).getRun({ projectRoot: root, selector: { id, kind: "any" } }));
+  const joinTarget = deps.resolveJoin ?? (async (root, id) => {
+    const target = await (await loadRunReadModel(root)).resolveControlTarget({ projectRoot: root, runId: id, purpose: "attach" });
+    return target?.joinLink ? { joinLink: target.joinLink, stale: target.stale } : null;
+  });
   const dispatch = deps.dispatch ?? ((input) => dispatchThroughKernel(input));
-  const listTaskRecords = deps.listTasks ?? ((root) => listTasks(root));
+  const runReadModel = () => loadRunReadModel(context.projectRoot);
   const [command = "status", ...rest] = normalizeRunArgs(args);
   const text = context.outputMode === "text";
   switch (command) {
@@ -344,8 +1123,9 @@ async function executeRun(context, args, deps = {}) {
     case "status": {
       requireNoExtraArgs(rest, "rig run status");
       const runs = await listRunRecords(context.projectRoot);
-      const activeRuns = runs.filter((run) => !TERMINAL.has(run.status)).map(toRunLike);
-      const recentRuns = runs.filter((run) => TERMINAL.has(run.status)).map(toRunLike);
+      const readModel = await runReadModel();
+      const activeRuns = runs.filter((run) => !readModel.classifyRun(run).isTerminal).map(toRunLike);
+      const recentRuns = runs.filter((run) => readModel.classifyRun(run).isTerminal).map(toRunLike);
       if (text)
         printFormattedOutput(formatRunStatus({ activeRuns, recentRuns, runs: [...activeRuns, ...recentRuns] }));
       return { ok: true, group: "run", command, details: { activeRuns, recentRuns } };
@@ -368,14 +1148,14 @@ async function executeRun(context, args, deps = {}) {
       pending = initialPromptResult.rest;
       const taskRef = pending[0]?.startsWith("-") ? undefined : pending[0];
       requireNoExtraArgs(taskRef ? pending.slice(1) : pending, "rig run [start] [#<issue>|<task-id>|--next|--task <id>] [--title <t>] [--model <m>] [--prompt <p>|--initial-prompt <p>] [--force]");
-      const { taskId, task } = await resolveStartTask({ projectRoot: context.projectRoot, taskId: taskResult.value ?? taskRef, next: nextResult.value, listTasks: listTaskRecords });
+      const { taskId, task } = await resolveStartTaskForRun(context.projectRoot, taskResult.value ?? taskRef, nextResult.value, deps);
       const title = titleResult.value ?? readTaskTitle(task);
       const model = modelResult.value?.trim() || null;
       const prompt = parsePromptOverride(promptResult.value, initialPromptResult.value);
       if (context.dryRun)
         return { ok: true, group: "run", command, details: { taskId, title: title ?? null, model, prompt, dryRun: true } };
       if (!forceResult.value)
-        await assertNoActiveRunForTask(listRunRecords, context.projectRoot, taskId);
+        await assertNoActiveRunForTask(listRunRecords, await runReadModel(), context.projectRoot, taskId);
       const submitted = await dispatch({ projectRoot: context.projectRoot, taskId, title, force: forceResult.value, model, prompt });
       printText(context, `${formatSubmittedRun({ runId: submitted.runId, taskId, title })}
 
@@ -387,10 +1167,10 @@ Next: rig run attach ${submitted.runId}`);
       const limitResult = takeOption(forceResult.rest, "--limit");
       requireNoExtraArgs(limitResult.rest, "rig run start-parallel [--limit <n>] [--force]");
       const limit = parsePositiveLimit(limitResult.value);
-      let readyTasks = (await listTaskRecords(context.projectRoot)).filter(isReadyTask);
+      let readyTasks = [...await readyTasksForRun(context.projectRoot, deps)];
       let skipped = 0;
       if (!forceResult.value) {
-        const active = await activeRunByTaskId(listRunRecords, context.projectRoot);
+        const active = await activeRunByTaskId(listRunRecords, await runReadModel(), context.projectRoot);
         const before = readyTasks.length;
         readyTasks = readyTasks.filter((task) => {
           const id = normalizeTaskId(task.id);
@@ -429,7 +1209,7 @@ Next: rig run attach ${submitted.runId}`);
     case "start-serial": {
       const force = takeFlag(rest, "--force");
       requireNoExtraArgs(force.rest, "rig run start-serial [--force]");
-      const task = selectNextReadyTask(await listTaskRecords(context.projectRoot));
+      const task = await selectNextReadyTaskForRun(context.projectRoot, deps);
       const taskId = normalizeTaskId(task?.id);
       if (!task || !taskId)
         throw new CliError("No ready task found.", 1, { hint: "Run `rig task list` to inspect available tasks." });
@@ -437,7 +1217,7 @@ Next: rig run attach ${submitted.runId}`);
       if (context.dryRun)
         return { ok: true, group: "run", command, details: { taskId, title: title ?? null, dryRun: true, serialStepOnly: true } };
       if (!force.value)
-        await assertNoActiveRunForTask(listRunRecords, context.projectRoot, taskId);
+        await assertNoActiveRunForTask(listRunRecords, await runReadModel(), context.projectRoot, taskId);
       const submitted = await dispatch({ projectRoot: context.projectRoot, taskId, title });
       printText(context, `${formatSubmittedRun({ runId: submitted.runId, taskId, title })}
 
@@ -469,7 +1249,7 @@ Next: rig run attach ${submitted.runId}`);
       const record = await getRunRecord(context.projectRoot, runId);
       if (!record)
         throw new CliError(`Run not found: ${runId}`, 2, { hint: "Run `rig run list` to see runs." });
-      const entries = readSessionRunEntries(record.sessionPath).filter((entry) => typeof entry.customType === "string" && entry.customType.startsWith("rig.run."));
+      const entries = ((await (await runReadModel()).getRunDetails({ projectRoot: context.projectRoot, selector: { id: record.runId, kind: "run-id" } }))?.sessionEntries ?? []).filter((entry) => typeof entry.customType === "string" && entry.customType.startsWith("rig.run."));
       if (text) {
         printFormattedOutput(formatRunCard(toRunLike(record)));
         if (entries.length === 0) {
@@ -527,7 +1307,7 @@ Next: rig run attach ${submitted.runId}`);
       const record = await getRunRecord(context.projectRoot, runId);
       if (!record)
         throw new CliError(`Run not found: ${runId}`, 2, { hint: "Run `rig run list` to see runs." });
-      await deliverRunControl(context.projectRoot, record, { kind: "steer", message: messageText }, { deliverRemote: deps.deliverRemote ?? deliverRemoteRunControl });
+      await deliverRunControl(context.projectRoot, record, { kind: "steer", message: messageText }, deps);
       if (text)
         printFormattedOutput(`Steered run ${record.runId}.`);
       return { ok: true, group: "run", command, details: { runId: record.runId, steered: true } };
@@ -541,7 +1321,7 @@ Next: rig run attach ${submitted.runId}`);
       const record = await getRunRecord(context.projectRoot, runId);
       if (!record)
         throw new CliError(`Run not found: ${runId}`, 2, { hint: "Run `rig run list` to see runs." });
-      await deliverRunControl(context.projectRoot, record, { kind: "stop", reason: reasonOpt.value ?? "operator requested stop" }, { deliverRemote: deps.deliverRemote ?? deliverRemoteRunControl });
+      await deliverRunControl(context.projectRoot, record, { kind: "stop", reason: reasonOpt.value ?? "operator requested stop" }, deps);
       if (text)
         printFormattedOutput(`Requested stop for run ${record.runId}.`);
       return { ok: true, group: "run", command, details: { runId: record.runId, stopRequested: true } };
@@ -558,7 +1338,7 @@ Next: rig run attach ${submitted.runId}`);
         throw new CliError(`Run ${runId} is not live; only a running run can be paused.`, 2, { hint: `Re-dispatch it instead: rig run restart ${runId}` });
       if (context.dryRun)
         return { ok: true, group: "run", command, details: { runId: record.runId, dryRun: true } };
-      await deliverRunControl(context.projectRoot, record, { kind: "pause" }, { deliverRemote: deps.deliverRemote ?? deliverRemoteRunControl });
+      await deliverRunControl(context.projectRoot, record, { kind: "pause" }, deps);
       if (text)
         printFormattedOutput(`Requested pause for run ${record.runId}. Resume it with \`rig run resume ${record.runId}\`.`);
       return { ok: true, group: "run", command, details: { runId: record.runId, pauseRequested: true } };
@@ -574,7 +1354,7 @@ Next: rig run attach ${submitted.runId}`);
       if (record.live && !record.stale) {
         if (context.dryRun)
           return { ok: true, group: "run", command, details: { runId: record.runId, dryRun: true } };
-        await deliverRunControl(context.projectRoot, record, { kind: "resume" }, { deliverRemote: deps.deliverRemote ?? deliverRemoteRunControl });
+        await deliverRunControl(context.projectRoot, record, { kind: "resume" }, deps);
         if (text)
           printFormattedOutput(`Requested resume for run ${record.runId}.`);
         return { ok: true, group: "run", command, details: { runId: record.runId, resumeRequested: true } };