@h-rig/cli-surface-plugin 0.0.6-alpha.157 → 0.0.6-alpha.159

package/dist/src/control-plane/native/github-auth-env.d.ts

@@ -0,0 +1 @@
+export declare function authStateToken(env?: Record<string, string | undefined>): string | null;

package/dist/src/control-plane/native/github-auth-env.js

@@ -0,0 +1,21 @@
+// @bun
+// packages/cli-surface-plugin/src/control-plane/native/github-auth-env.ts
+import { existsSync, readFileSync } from "fs";
+function cleanToken(value) {
+  const trimmed = value?.trim() ?? "";
+  return trimmed.length > 0 ? trimmed : null;
+}
+function authStateToken(env = process.env) {
+  const file = env.RIG_GITHUB_AUTH_STATE_FILE?.trim();
+  if (!file || !existsSync(file))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync(file, "utf8"));
+    return cleanToken(typeof parsed.token === "string" ? parsed.token : undefined);
+  } catch {
+    return null;
+  }
+}
+export {
+  authStateToken
+};

package/dist/src/control-plane/native/host-git.d.ts

@@ -0,0 +1,4 @@
+export declare function resolveHostGitBinary(): string;
+export declare function resolveGithubCliBinary(options?: {
+    scanPath?: boolean;
+}): string;

package/dist/src/control-plane/native/host-git.js

@@ -0,0 +1,51 @@
+// @bun
+// packages/cli-surface-plugin/src/control-plane/native/host-git.ts
+import { existsSync } from "fs";
+import { resolve } from "path";
+function isRuntimeGatewayGitPath(candidate) {
+  return /\/\.rig\/bin\/git$/.test(candidate.replace(/\\/g, "/"));
+}
+function isRuntimeGatewayGhPath(candidate) {
+  return /\/\.rig\/bin\/gh$/.test(candidate.replace(/\\/g, "/"));
+}
+function resolveHostGitBinary() {
+  const candidates = [
+    process.env.RIG_GIT_BIN?.trim() || "",
+    "/usr/bin/git",
+    "/opt/homebrew/bin/git",
+    "/usr/local/bin/git"
+  ];
+  const bunResolved = Bun.which("git");
+  if (bunResolved && !isRuntimeGatewayGitPath(bunResolved))
+    candidates.push(bunResolved);
+  for (const candidate of candidates) {
+    if (candidate && !isRuntimeGatewayGitPath(candidate) && existsSync(candidate))
+      return candidate;
+  }
+  return "git";
+}
+function resolveGithubCliBinary(options = {}) {
+  const candidates = new Set;
+  const explicit = process.env.RIG_GH_BIN?.trim();
+  if (explicit)
+    candidates.add(explicit);
+  for (const candidate of ["/usr/bin/gh", "/opt/homebrew/bin/gh", "/usr/local/bin/gh"])
+    candidates.add(candidate);
+  if (options.scanPath) {
+    for (const entry of (process.env.PATH || "").split(":").map((value) => value.trim()).filter(Boolean)) {
+      candidates.add(resolve(entry, "gh"));
+    }
+  }
+  const bunResolved = Bun.which("gh");
+  if (bunResolved)
+    candidates.add(bunResolved);
+  for (const candidate of candidates) {
+    if (candidate && existsSync(candidate) && !isRuntimeGatewayGhPath(candidate))
+      return candidate;
+  }
+  return "";
+}
+export {
+  resolveHostGitBinary,
+  resolveGithubCliBinary
+};

package/dist/src/control-plane/priority-queue.d.ts

@@ -0,0 +1,22 @@
+import { type IsolationMode } from "@rig/contracts";
+import type { RunnerContext } from "@rig/core/runtime-runner-context";
+export type QueueRunResult = {
+    processed: number;
+    succeeded: number;
+    failed: number;
+    tasks: Array<{
+        taskId: string;
+        ok: boolean;
+        score: number;
+        unblockCount: number;
+        error?: string;
+    }>;
+};
+export declare function runPriorityQueue(context: RunnerContext, options: {
+    workers: number;
+    maxTasks: number;
+    action: "validate" | "verify" | "pipeline";
+    failFast: boolean;
+    isolation: "off" | IsolationMode;
+    reuseRuntime: boolean;
+}): Promise<QueueRunResult>;

package/dist/src/control-plane/priority-queue.js

@@ -0,0 +1,212 @@
+// @bun
+// packages/cli-surface-plugin/src/control-plane/priority-queue.ts
+import { existsSync } from "fs";
+import { resolve } from "path";
+import { resolveRigLayout } from "@rig/core/layout";
+import { agentId } from "@rig/core/safe-identifiers";
+import {
+  ISOLATION_BACKEND,
+  TASK_DATA_SERVICE_CAPABILITY
+} from "@rig/contracts";
+import { defineCapability } from "@rig/core/capability";
+import { requireCapabilityForRoot, requireInstalledCapability } from "@rig/core/capability-loaders";
+var TaskDataCap = defineCapability(TASK_DATA_SERVICE_CAPABILITY);
+var taskData = () => requireInstalledCapability(TaskDataCap, "task-data capability unavailable: load @rig/task-sources-plugin (default bundle) before running the queue.");
+var IsolationBackendCap = defineCapability(ISOLATION_BACKEND);
+var requireIsolationBackend = (projectRoot) => requireCapabilityForRoot(projectRoot, IsolationBackendCap, `No ISOLATION_BACKEND capability is registered for project root "${projectRoot}". ` + "Install @rig/isolation-plugin (it ships in the default bundle) so runtime provisioning can resolve a backend.");
+async function runPriorityQueue(context, options) {
+  const trackerSnapshot = taskData().readSyncedTrackerState(context.projectRoot);
+  const rankedTasks = rankTasks(context.projectRoot, trackerSnapshot).slice(0, options.maxTasks);
+  const effectiveIsolation = context.dryRun ? "off" : options.isolation;
+  await context.emitEvent("queue.started", {
+    taskCount: rankedTasks.length,
+    workers: options.workers,
+    action: options.action,
+    isolation: effectiveIsolation,
+    reuseRuntime: options.reuseRuntime
+  });
+  const results = [];
+  let index = 0;
+  let halted = false;
+  async function workerLoop(workerId) {
+    let workerRuntime;
+    while (!halted) {
+      const currentIndex = index;
+      index += 1;
+      const task = rankedTasks[currentIndex];
+      if (!task) {
+        return;
+      }
+      await context.emitEvent("queue.task.started", {
+        workerId,
+        taskId: task.id,
+        score: task.score,
+        unblockCount: task.unblockCount,
+        action: options.action,
+        isolation: effectiveIsolation
+      });
+      try {
+        if (effectiveIsolation !== "off") {
+          if (!workerRuntime || !options.reuseRuntime || workerRuntime.taskId !== task.id) {
+            const runtimeId = options.reuseRuntime ? `queue-w${workerId}-${effectiveIsolation}` : agentId(`queue-${workerId}`);
+            const isolationBackend = await requireIsolationBackend(context.projectRoot);
+            workerRuntime = await isolationBackend.ensureAgentRuntime({
+              projectRoot: context.projectRoot,
+              id: runtimeId,
+              taskId: task.id,
+              mode: effectiveIsolation
+            });
+          }
+        }
+        let result;
+        if (options.action === "pipeline") {
+          result = await runTaskStep(context, task.id, "validate", effectiveIsolation, workerRuntime);
+          result = await runTaskStep(context, task.id, "verify", effectiveIsolation, workerRuntime);
+        } else {
+          result = await runTaskStep(context, task.id, options.action, effectiveIsolation, workerRuntime);
+        }
+        results.push({
+          taskId: task.id,
+          ok: result.exitCode === 0,
+          score: task.score,
+          unblockCount: task.unblockCount
+        });
+        await context.emitEvent("queue.task.finished", {
+          workerId,
+          taskId: task.id,
+          ok: result.exitCode === 0,
+          action: options.action,
+          exitCode: result.exitCode
+        });
+      } catch (error) {
+        results.push({
+          taskId: task.id,
+          ok: false,
+          score: task.score,
+          unblockCount: task.unblockCount,
+          error: `${error}`
+        });
+        await context.emitEvent("queue.task.finished", {
+          workerId,
+          taskId: task.id,
+          ok: false,
+          action: options.action,
+          error: `${error}`
+        });
+        if (options.failFast) {
+          halted = true;
+        }
+      } finally {}
+    }
+  }
+  const workerCount = Math.max(1, options.workers);
+  await Promise.all(Array.from({ length: workerCount }, (_, i) => workerLoop(i + 1)));
+  const summary = {
+    processed: results.length,
+    succeeded: results.filter((item) => item.ok).length,
+    failed: results.filter((item) => !item.ok).length,
+    tasks: results
+  };
+  await context.emitEvent("queue.finished", {
+    processed: summary.processed,
+    succeeded: summary.succeeded,
+    failed: summary.failed
+  });
+  return summary;
+}
+async function runTaskStep(context, taskId, action, isolation, runtime) {
+  const localTaskCommand = resolveTaskCommand(context.projectRoot, action, taskId);
+  if (context.dryRun) {
+    const now = new Date().toISOString();
+    return {
+      command: localTaskCommand,
+      formattedCommand: localTaskCommand.join(" "),
+      exitCode: 0,
+      durationMs: 0,
+      startedAt: now,
+      finishedAt: now
+    };
+  }
+  if (isolation === "off") {
+    return context.runCommand(localTaskCommand);
+  }
+  if (!runtime) {
+    throw new Error(`Missing runtime for isolated queue action ${action} (${taskId})`);
+  }
+  const startedAt = new Date;
+  const isolatedTaskCommand = resolveTaskCommand(runtime.workspaceDir, action, taskId, context.projectRoot);
+  const isolationBackend = await requireIsolationBackend(context.projectRoot);
+  const result = await isolationBackend.runInAgentRuntime({
+    projectRoot: context.projectRoot,
+    runtime,
+    command: isolatedTaskCommand,
+    inheritStdio: context.outputMode === "text"
+  });
+  const finishedAt = new Date;
+  if (result.exitCode !== 0) {
+    throw new Error(`Isolated ${action} failed for ${taskId} in runtime ${runtime.id} with exit code ${result.exitCode}${result.stderr ? `
+${result.stderr.trim()}` : ""}`);
+  }
+  return {
+    command: isolatedTaskCommand,
+    formattedCommand: isolatedTaskCommand.join(" "),
+    exitCode: result.exitCode,
+    durationMs: finishedAt.getTime() - startedAt.getTime(),
+    startedAt: startedAt.toISOString(),
+    finishedAt: finishedAt.toISOString(),
+    ...result.stdout !== undefined ? { stdout: result.stdout } : {},
+    ...result.stderr !== undefined ? { stderr: result.stderr } : {}
+  };
+}
+function resolveTaskCommand(projectRoot, action, taskId, hostProjectRoot = projectRoot) {
+  try {
+    const compiledRig = resolve(resolveRigLayout(projectRoot).binDir, "rig");
+    if (existsSync(compiledRig)) {
+      return [compiledRig, "task", action, "--task", taskId];
+    }
+  } catch {}
+  return ["bun", "run", resolve(hostProjectRoot, "packages/cli/bin/rig.ts"), "task", action, "--task", taskId];
+}
+function rankTasks(projectRoot, snapshot) {
+  const readyTaskIds = taskData().listReadyTaskIdsFromTracker(snapshot);
+  let taskConfig = {};
+  const issues = snapshot.issues.filter((issue) => issue.issueType === "task");
+  try {
+    taskConfig = taskData().readTaskConfig(projectRoot);
+  } catch {
+    taskConfig = {};
+  }
+  const activeTasks = new Map(issues.filter((issue) => issue.status === "open" || issue.status === "ready").map((issue) => [issue.id, issue]));
+  const reverseDeps = new Map;
+  for (const issue of issues) {
+    if (issue.status !== "open" && issue.status !== "ready") {
+      continue;
+    }
+    for (const dep of issue.dependencies ?? []) {
+      if (dep.type !== "blocks" || !dep.dependsOnId) {
+        continue;
+      }
+      reverseDeps.set(dep.dependsOnId, (reverseDeps.get(dep.dependsOnId) || 0) + 1);
+    }
+  }
+  return readyTaskIds.map((id) => {
+    const issue = activeTasks.get(id);
+    const taskMeta = taskConfig[id];
+    const priority = issue?.priority ?? 3;
+    const unblockCount = reverseDeps.get(id) ?? 0;
+    const roleWeight = taskMeta?.role === "architect" ? 25 : taskMeta?.role === "extractor" ? 10 : 0;
+    const criticalityWeight = taskMeta?.criticality === "core" ? 20 : taskMeta?.criticality === "high" ? 10 : 0;
+    const validationWeight = taskMeta?.validation?.some((entry) => entry.includes("test-contract") || entry.includes("test-boundary")) ? 8 : 0;
+    const customWeight = taskMeta?.queue_weight ?? 0;
+    const score = unblockCount * 100 + (10 - priority) + roleWeight + criticalityWeight + validationWeight + customWeight;
+    return {
+      id,
+      priority,
+      unblockCount,
+      score
+    };
+  }).sort((a, b) => b.score - a.score || a.priority - b.priority || a.id.localeCompare(b.id));
+}
+export {
+  runPriorityQueue
+};

package/dist/src/control-plane/rigfig.d.ts

@@ -0,0 +1,9 @@
+import type { ConfigDefaultsContext, RigPlugin } from "@rig/core/config";
+export declare function rigfigConfigPath(projectRoot: string): string;
+export declare function composeDeclarativeConfig(plugins: readonly RigPlugin[], context: ConfigDefaultsContext): Record<string, unknown>;
+export declare function writeRigfigConfig(projectRoot: string, config: Record<string, unknown>): string;
+export declare function composeAndWriteRigfig(projectRoot: string, options?: {
+    readonly repoSlug?: string;
+    readonly overlay?: Record<string, unknown>;
+}): string;
+export declare function configFileAlreadyExists(projectRoot: string): boolean;

package/dist/src/control-plane/rigfig.js

@@ -0,0 +1,70 @@
+// @bun
+// packages/cli-surface-plugin/src/control-plane/rigfig.ts
+import { existsSync, mkdirSync, writeFileSync } from "fs";
+import { resolve } from "path";
+import { stringify as stringifyToml } from "smol-toml";
+import { getStandardPluginsResolver } from "@rig/core/embedded-plugins";
+function rigfigConfigPath(projectRoot) {
+  return resolve(projectRoot, ".rig", "rigfig.toml");
+}
+function isPlainObject(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function deepMerge(base, overlay) {
+  const out = { ...base };
+  for (const [key, value] of Object.entries(overlay)) {
+    const previous = out[key];
+    out[key] = isPlainObject(previous) && isPlainObject(value) ? deepMerge(previous, value) : value;
+  }
+  return out;
+}
+function composeDeclarativeConfig(plugins, context) {
+  let merged = {};
+  for (const plugin of plugins) {
+    const fragment = plugin.contributes?.config?.defaults?.(context);
+    if (isPlainObject(fragment))
+      merged = deepMerge(merged, fragment);
+  }
+  return merged;
+}
+var HEADER = [
+  "# Declarative rig configuration \u2014 the happy path.",
+  "# Plain DATA, composed from the standard plugins' defaults. No top-level",
+  "# rig.config.ts and no @h-rig/* install: the global rig binary resolves",
+  "# plugins from its embedded standard collection. rig created this for you;",
+  "# edit it freely (each plugin owns the section it needs).",
+  "",
+  ""
+].join(`
+`);
+function writeRigfigConfig(projectRoot, config) {
+  mkdirSync(resolve(projectRoot, ".rig"), { recursive: true });
+  const path = rigfigConfigPath(projectRoot);
+  writeFileSync(path, `${HEADER}${stringifyToml(config)}
+`, "utf-8");
+  return path;
+}
+function composeAndWriteRigfig(projectRoot, options = {}) {
+  const resolver = getStandardPluginsResolver();
+  if (!resolver) {
+    throw new Error("Cannot write rig config: embedded standard plugins are not registered (seed wiring error).");
+  }
+  const context = options.repoSlug ? { projectRoot, repoSlug: options.repoSlug } : { projectRoot };
+  let composed = composeDeclarativeConfig(resolver(), context);
+  if (options.overlay) {
+    if (isPlainObject(options.overlay.taskSource) && "taskSource" in composed)
+      delete composed.taskSource;
+    composed = deepMerge(composed, options.overlay);
+  }
+  return writeRigfigConfig(projectRoot, composed);
+}
+function configFileAlreadyExists(projectRoot) {
+  return existsSync(resolve(projectRoot, "rig.config.ts")) || existsSync(resolve(projectRoot, "rig.config.mts")) || existsSync(resolve(projectRoot, "rig.config.json")) || existsSync(rigfigConfigPath(projectRoot));
+}
+export {
+  writeRigfigConfig,
+  rigfigConfigPath,
+  configFileAlreadyExists,
+  composeDeclarativeConfig,
+  composeAndWriteRigfig
+};

package/dist/src/control-plane/scope.d.ts

@@ -0,0 +1,3 @@
+export declare function normalizePathToScope(projectRoot: string, monorepoRoot: string, inputPath: string): string;
+export declare function scopeGlobToRegex(glob: string): RegExp;
+export declare function scopeMatches(path: string, scopes: string[]): boolean;

package/dist/src/control-plane/scope.js

@@ -0,0 +1,58 @@
+// @bun
+// packages/cli-surface-plugin/src/control-plane/scope.ts
+import { getScopeRules } from "@rig/core/scope-rules";
+var scopeRegexCache = new Map;
+function unique(values) {
+  return [...new Set(values)];
+}
+function normalizeRelativeScopePath(inputPath) {
+  let normalized = inputPath.replace(/^\.\//, "");
+  const rules = getScopeRules();
+  if (rules?.stripPrefixes) {
+    for (const prefix of rules.stripPrefixes) {
+      if (normalized.startsWith(prefix)) {
+        normalized = normalized.slice(prefix.length);
+      }
+    }
+  }
+  return normalized;
+}
+function normalizePathToScope(projectRoot, monorepoRoot, inputPath) {
+  let normalized = inputPath.replace(/^\.\//, "");
+  if (normalized.startsWith(projectRoot + "/")) {
+    normalized = normalized.slice(projectRoot.length + 1);
+  }
+  if (normalized.startsWith(monorepoRoot + "/")) {
+    normalized = normalized.slice(monorepoRoot.length + 1);
+  }
+  return normalizeRelativeScopePath(normalized);
+}
+function scopeGlobToRegex(glob) {
+  const cached = scopeRegexCache.get(glob);
+  if (cached) {
+    return cached;
+  }
+  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "__GLOBSTAR__").replace(/\*/g, "[^/]*").replace(/__GLOBSTAR__/g, ".*");
+  const compiled = new RegExp(`^${escaped}$`);
+  scopeRegexCache.set(glob, compiled);
+  return compiled;
+}
+function scopeMatches(path, scopes) {
+  const pathVariants = unique([path, normalizeRelativeScopePath(path)]);
+  for (const scope of scopes) {
+    const scopeVariants = unique([scope, normalizeRelativeScopePath(scope)]);
+    for (const candidatePath of pathVariants) {
+      for (const candidateScope of scopeVariants) {
+        if (candidatePath === candidateScope || scopeGlobToRegex(candidateScope).test(candidatePath)) {
+          return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+export {
+  scopeMatches,
+  scopeGlobToRegex,
+  normalizePathToScope
+};

package/dist/src/control-plane/setup-status.d.ts

@@ -0,0 +1,44 @@
+import { spawnSync } from "node:child_process";
+import { type GitHubAuthStatus } from "@rig/github-lib";
+export type RigConfigStatus = {
+    readonly exists: boolean;
+    readonly valid: boolean;
+    readonly path: string;
+    readonly slug: string | null;
+    readonly reason?: string;
+};
+export type RigStateStatus = {
+    readonly valid: boolean;
+    readonly selected: string | null;
+    readonly project: string | null;
+    readonly reason?: string;
+};
+export type RigAuthValidation = {
+    readonly ok: boolean;
+    readonly source: "stored-token" | "gh" | "missing";
+    readonly login?: string | null;
+    readonly detail: string;
+    readonly status?: GitHubAuthStatus;
+};
+export type RigSetupStatus = {
+    readonly configured: boolean;
+    readonly projectRoot: string;
+    readonly slug: string | null;
+    readonly config: RigConfigStatus;
+    readonly state: RigStateStatus;
+    readonly auth: RigAuthValidation;
+    readonly reasons: readonly string[];
+};
+type RigSetupDeps = {
+    readonly spawn?: typeof spawnSync;
+};
+export declare function parseRepoSlug(value: string): {
+    owner: string;
+    repo: string;
+    slug: string;
+};
+export declare function detectStartupStatus(input: {
+    projectRoot: string;
+    deps?: RigSetupDeps | undefined;
+}): Promise<RigSetupStatus>;
+export {};

package/dist/src/control-plane/setup-status.js

@@ -0,0 +1,164 @@
+// @bun
+// packages/cli-surface-plugin/src/control-plane/setup-status.ts
+import { spawnSync } from "child_process";
+import { existsSync, readFileSync } from "fs";
+import { resolve as resolve2 } from "path";
+import { createGitHubAuthStore, resolveGitHubAuthStatus } from "@rig/github-lib";
+
+// packages/cli-surface-plugin/src/control-plane/rigfig.ts
+import { resolve } from "path";
+import { stringify as stringifyToml } from "smol-toml";
+import { getStandardPluginsResolver } from "@rig/core/embedded-plugins";
+function rigfigConfigPath(projectRoot) {
+  return resolve(projectRoot, ".rig", "rigfig.toml");
+}
+var HEADER = [
+  "# Declarative rig configuration \u2014 the happy path.",
+  "# Plain DATA, composed from the standard plugins' defaults. No top-level",
+  "# rig.config.ts and no @h-rig/* install: the global rig binary resolves",
+  "# plugins from its embedded standard collection. rig created this for you;",
+  "# edit it freely (each plugin owns the section it needs).",
+  "",
+  ""
+].join(`
+`);
+
+// packages/cli-surface-plugin/src/control-plane/setup-status.ts
+function cleanString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+function runSyncCommand(command, input = {}) {
+  const executable = command[0];
+  if (!executable)
+    throw new Error("command is required");
+  return (input.spawn ?? spawnSync)(executable, [...command.slice(1)], {
+    cwd: input.cwd,
+    encoding: "utf8",
+    timeout: input.timeoutMs ?? 1e4,
+    env: input.env ?? process.env
+  });
+}
+function parseRepoSlug(value) {
+  const match = value.trim().match(/^([^/\s]+)\/([^/\s]+)$/);
+  if (!match)
+    throw new Error(`Invalid GitHub repo slug "${value}". Expected owner/repo.`);
+  return { owner: match[1], repo: match[2], slug: `${match[1]}/${match[2]}` };
+}
+function parseRepoSlugFromRemote(remoteUrl) {
+  const trimmed = remoteUrl.trim();
+  const match = trimmed.match(/github\.com[:/]([^/\s]+)\/([^/\s.]+)(?:\.git)?$/i);
+  return match ? `${match[1]}/${match[2]}` : null;
+}
+function detectOriginRepoSlug(projectRoot, deps = {}) {
+  const result = runSyncCommand(["git", "-C", projectRoot, "remote", "get-url", "origin"], { timeoutMs: 5000, spawn: deps.spawn });
+  if (result.status !== 0 || result.error)
+    return null;
+  return parseRepoSlugFromRemote(result.stdout.trim());
+}
+function readJsonRecord(path) {
+  if (!existsSync(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf-8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function readRigConfigStatus(projectRoot) {
+  const path = rigfigConfigPath(projectRoot);
+  if (!existsSync(path))
+    return { exists: false, valid: false, path, slug: null, reason: "missing .rig/rigfig.toml" };
+  try {
+    const source = readFileSync(path, "utf-8");
+    const owner = source.match(/^\s*owner\s*=\s*["']([^"']+)["']/m)?.[1] ?? null;
+    const repoValues = [...source.matchAll(/^\s*repo\s*=\s*["']([^"']+)["']/gm)].map((match) => match[1]).filter(Boolean);
+    const taskRepo = repoValues.find((value) => !value.includes("/")) ?? null;
+    const projectRepo = repoValues.find((value) => value.includes("/")) ?? null;
+    const githubIssues = /^\s*kind\s*=\s*["']github-issues["']/m.test(source);
+    const slug = owner && taskRepo ? `${owner}/${taskRepo}` : projectRepo;
+    if (!githubIssues || !slug)
+      return { exists: true, valid: false, path, slug: slug ?? null, reason: ".rig/rigfig.toml is not a GitHub Issues Rig config" };
+    parseRepoSlug(slug);
+    return { exists: true, valid: true, path, slug };
+  } catch (error) {
+    return { exists: true, valid: false, path, slug: null, reason: error instanceof Error ? error.message : String(error) };
+  }
+}
+function connectionStatePath(projectRoot) {
+  return resolve2(projectRoot, ".rig", "state", "connection.json");
+}
+function readRigConnectionStatus(projectRoot) {
+  const stateDir = resolve2(projectRoot, ".rig", "state");
+  if (!existsSync(stateDir))
+    return { valid: false, selected: null, project: null, reason: "missing .rig/state" };
+  const connection = readJsonRecord(connectionStatePath(projectRoot));
+  if (!connection)
+    return { valid: false, selected: null, project: null, reason: "missing or invalid .rig/state/connection.json" };
+  const selected = cleanString(connection.selected);
+  const project = cleanString(connection.project);
+  if (!selected)
+    return { valid: false, selected: null, project, reason: "connection.json is missing selected placement" };
+  if (!project)
+    return { valid: false, selected, project: null, reason: "connection.json is missing project slug" };
+  try {
+    parseRepoSlug(project);
+  } catch (error) {
+    return { valid: false, selected, project, reason: error instanceof Error ? error.message : String(error) };
+  }
+  return { valid: true, selected, project };
+}
+function detectGhAuth(projectRoot, slug, deps = {}) {
+  const user = runSyncCommand(["gh", "api", "user", "--jq", ".login"], { cwd: projectRoot, timeoutMs: 5000, spawn: deps.spawn });
+  if (user.status !== 0 || user.error || !user.stdout.trim())
+    return null;
+  const repo = runSyncCommand(["gh", "repo", "view", slug, "--json", "nameWithOwner", "--jq", ".nameWithOwner"], { cwd: projectRoot, timeoutMs: 5000, spawn: deps.spawn });
+  if (repo.status !== 0 || repo.error)
+    return { ok: false, source: "gh", login: user.stdout.trim(), detail: (repo.stderr || repo.stdout || "gh cannot access the selected repository").trim() };
+  return { ok: true, source: "gh", login: user.stdout.trim(), detail: "gh CLI authentication can access the selected repository" };
+}
+async function validateGitHubAuth(projectRoot, slug, deps = {}) {
+  if (!slug)
+    return { ok: false, source: "missing", detail: "GitHub repo slug is unknown" };
+  const status = resolveGitHubAuthStatus({ projectRoot, oauthConfigured: Boolean(process.env.RIG_GITHUB_OAUTH_CLIENT_ID?.trim()) });
+  if (status.signedIn) {
+    const store = createGitHubAuthStore(projectRoot);
+    if (!status.selectedRepo) {
+      store.saveSelectedRepo(slug);
+      return { ok: true, source: "stored-token", login: status.login, detail: "stored Rig GitHub token selected for this repo", status: store.status({ oauthConfigured: status.oauthConfigured }) };
+    }
+    if (status.selectedRepo !== slug)
+      return { ok: false, source: "stored-token", login: status.login, detail: `stored GitHub token is scoped to ${status.selectedRepo}, not ${slug}`, status };
+    return { ok: true, source: "stored-token", login: status.login, detail: "stored Rig GitHub token is present", status };
+  }
+  const gh = detectGhAuth(projectRoot, slug, deps);
+  if (gh)
+    return gh;
+  return { ok: false, source: "missing", detail: "Sign in with `gh auth login`, choose Setup \u2192 GitHub auth, or paste a token." };
+}
+async function detectStartupStatus(input) {
+  const projectRoot = input.projectRoot;
+  const config = readRigConfigStatus(projectRoot);
+  const state = readRigConnectionStatus(projectRoot);
+  const detectedSlug = detectOriginRepoSlug(projectRoot, input.deps);
+  const slug = config.slug ?? state.project ?? detectedSlug;
+  const reasons = [];
+  if (!detectedSlug)
+    reasons.push("git origin does not point at a GitHub owner/repo remote");
+  if (!config.exists || !config.valid)
+    reasons.push(config.reason ?? "rig.config.ts is invalid");
+  if (!state.valid)
+    reasons.push(state.reason ?? ".rig/state/connection.json is invalid");
+  if (config.slug && state.project && config.slug !== state.project)
+    reasons.push(`rig.config.ts repo ${config.slug} does not match connection project ${state.project}`);
+  if (slug && detectedSlug && slug !== detectedSlug)
+    reasons.push(`configured repo ${slug} does not match git origin ${detectedSlug}`);
+  const auth = await validateGitHubAuth(projectRoot, slug, input.deps);
+  if (!auth.ok)
+    reasons.push(auth.detail);
+  return { configured: reasons.length === 0, projectRoot, slug, config, state, auth, reasons };
+}
+export {
+  parseRepoSlug,
+  detectStartupStatus
+};

package/dist/src/control-plane/task-data.d.ts

@@ -0,0 +1,2 @@
+import { type TaskDataService } from "@rig/contracts";
+export declare function taskData(): TaskDataService;