@h-rig/cli 0.0.6-alpha.0

package/dist/src/commands/init.js

@@ -0,0 +1,1254 @@
+// @bun
+var __require = import.meta.require;
+
+// packages/cli/src/commands/init.ts
+import { appendFileSync, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
+import { resolve as resolve5 } from "path";
+
+// packages/cli/src/runner.ts
+import { EventBus } from "@rig/runtime/control-plane/runtime/events";
+import { CliError } from "@rig/runtime/control-plane/errors";
+import { evaluate, loadPolicy, resolveAction } from "@rig/runtime/control-plane/runtime/guard";
+import { PluginManager } from "@rig/runtime/control-plane/runtime/plugins";
+import { loadRuntimeContextFromEnv } from "@rig/runtime/control-plane/runtime/context";
+import { buildBinary } from "@rig/runtime/control-plane/runtime/isolation";
+import { CliError as CliError2 } from "@rig/runtime/control-plane/errors";
+function takeFlag(args, flag) {
+  const rest = [];
+  let value = false;
+  for (const arg of args) {
+    if (arg === flag) {
+      value = true;
+      continue;
+    }
+    rest.push(arg);
+  }
+  return { value, rest };
+}
+function takeOption(args, option) {
+  const rest = [];
+  let value;
+  for (let index = 0;index < args.length; index += 1) {
+    const current = args[index];
+    if (current === option) {
+      const next = args[index + 1];
+      if (!next || next.startsWith("-")) {
+        throw new CliError(`Missing value for ${option}`);
+      }
+      value = next;
+      index += 1;
+      continue;
+    }
+    if (current !== undefined) {
+      rest.push(current);
+    }
+  }
+  return { value, rest };
+}
+
+// packages/cli/src/commands/init.ts
+import { buildRigInitConfigSource } from "@rig/core";
+
+// packages/cli/src/commands/_connection-state.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, resolve } from "path";
+function resolveGlobalConnectionsPath(env = process.env) {
+  const explicit = env.RIG_CONNECTIONS_FILE?.trim();
+  if (explicit)
+    return resolve(explicit);
+  const stateDir = env.RIG_GLOBAL_STATE_DIR?.trim();
+  if (stateDir)
+    return resolve(stateDir, "connections.json");
+  return resolve(homedir(), ".rig", "connections.json");
+}
+function resolveRepoConnectionPath(projectRoot) {
+  return resolve(projectRoot, ".rig", "state", "connection.json");
+}
+function readJsonFile(path) {
+  if (!existsSync(path))
+    return null;
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch (error) {
+    throw new CliError2(`Invalid Rig connection state at ${path}: ${error instanceof Error ? error.message : String(error)}`, 1);
+  }
+}
+function writeJsonFile(path, value) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(value, null, 2)}
+`, "utf8");
+}
+function normalizeConnection(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const record = value;
+  if (record.kind === "local")
+    return { kind: "local", mode: "auto" };
+  if (record.kind === "remote" && typeof record.baseUrl === "string" && record.baseUrl.trim()) {
+    const baseUrl = record.baseUrl.trim().replace(/\/+$/, "");
+    return { kind: "remote", baseUrl };
+  }
+  return null;
+}
+function readGlobalConnections(options = {}) {
+  const path = resolveGlobalConnectionsPath(options.env ?? process.env);
+  const payload = readJsonFile(path);
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return { connections: {} };
+  }
+  const rawConnections = payload.connections;
+  const connections = {};
+  if (rawConnections && typeof rawConnections === "object" && !Array.isArray(rawConnections)) {
+    for (const [alias, raw] of Object.entries(rawConnections)) {
+      const connection = normalizeConnection(raw);
+      if (connection)
+        connections[alias] = connection;
+    }
+  }
+  return { connections };
+}
+function writeGlobalConnections(state, options = {}) {
+  writeJsonFile(resolveGlobalConnectionsPath(options.env ?? process.env), state);
+}
+function upsertGlobalConnection(alias, connection, options = {}) {
+  const cleanAlias = alias.trim();
+  if (!cleanAlias)
+    throw new CliError2("Connection alias is required.", 1);
+  const state = readGlobalConnections(options);
+  state.connections[cleanAlias] = connection;
+  writeGlobalConnections(state, options);
+  return state;
+}
+function readRepoConnection(projectRoot) {
+  const payload = readJsonFile(resolveRepoConnectionPath(projectRoot));
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return null;
+  const record = payload;
+  const selected = typeof record.selected === "string" ? record.selected.trim() : "";
+  if (!selected)
+    return null;
+  return {
+    selected,
+    project: typeof record.project === "string" ? record.project : undefined,
+    linkedAt: typeof record.linkedAt === "string" ? record.linkedAt : undefined
+  };
+}
+function writeRepoConnection(projectRoot, state) {
+  writeJsonFile(resolveRepoConnectionPath(projectRoot), state);
+}
+function resolveSelectedConnection(projectRoot, options = {}) {
+  const repo = readRepoConnection(projectRoot);
+  if (!repo)
+    return null;
+  if (repo.selected === "local")
+    return { alias: "local", connection: { kind: "local", mode: "auto" } };
+  const global = readGlobalConnections(options);
+  const connection = global.connections[repo.selected];
+  if (!connection) {
+    throw new CliError2(`Selected Rig connection "${repo.selected}" was not found. Run \`rig connect list\` or \`rig connect use local\`.`, 1);
+  }
+  return { alias: repo.selected, connection };
+}
+
+// packages/cli/src/commands/_server-client.ts
+import { spawnSync } from "child_process";
+import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
+var cachedGitHubBearerToken;
+function cleanToken(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : null;
+}
+function setGitHubBearerTokenForCurrentProcess(token) {
+  cachedGitHubBearerToken = cleanToken(token ?? undefined);
+}
+function readGitHubBearerTokenForRemote() {
+  if (cachedGitHubBearerToken !== undefined)
+    return cachedGitHubBearerToken;
+  const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
+  if (envToken) {
+    cachedGitHubBearerToken = envToken;
+    return cachedGitHubBearerToken;
+  }
+  const result = spawnSync("gh", ["auth", "token"], {
+    encoding: "utf8",
+    timeout: 5000,
+    stdio: ["ignore", "pipe", "ignore"]
+  });
+  cachedGitHubBearerToken = result.status === 0 ? cleanToken(result.stdout) : null;
+  return cachedGitHubBearerToken;
+}
+async function ensureServerForCli(projectRoot) {
+  try {
+    const selected = resolveSelectedConnection(projectRoot);
+    if (selected?.connection.kind === "remote") {
+      return {
+        baseUrl: selected.connection.baseUrl,
+        authToken: readGitHubBearerTokenForRemote(),
+        connectionKind: "remote"
+      };
+    }
+    const connection = await ensureLocalRigServerConnection(projectRoot);
+    return {
+      baseUrl: connection.baseUrl,
+      authToken: connection.authToken,
+      connectionKind: "local"
+    };
+  } catch (error) {
+    if (error instanceof Error) {
+      throw new CliError2(error.message, 1);
+    }
+    throw error;
+  }
+}
+function mergeHeaders(headers, authToken) {
+  const merged = new Headers(headers);
+  if (authToken) {
+    merged.set("authorization", `Bearer ${authToken}`);
+  }
+  return merged;
+}
+function diagnosticMessage(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return null;
+  const record = payload;
+  const diagnostics = Array.isArray(record.diagnostics) ? record.diagnostics : [];
+  const messages = diagnostics.flatMap((entry) => {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry))
+      return [];
+    const diagnostic = entry;
+    const kind = typeof diagnostic.kind === "string" ? diagnostic.kind : "task-source";
+    const message = typeof diagnostic.message === "string" ? diagnostic.message : null;
+    return message ? [`${kind}: ${message}`] : [];
+  });
+  return messages.length > 0 ? messages.join("; ") : null;
+}
+async function requestServerJson(context, pathname, init = {}) {
+  const server = await ensureServerForCli(context.projectRoot);
+  const response = await fetch(`${server.baseUrl}${pathname}`, {
+    ...init,
+    headers: mergeHeaders(init.headers, server.authToken)
+  });
+  const text = await response.text();
+  const payload = text.trim().length > 0 ? (() => {
+    try {
+      return JSON.parse(text);
+    } catch {
+      return null;
+    }
+  })() : null;
+  if (!response.ok) {
+    const diagnostics = diagnosticMessage(payload);
+    const detail = diagnostics ?? (text || response.statusText);
+    throw new CliError2(`Rig server request failed (${response.status}): ${detail}`, 1);
+  }
+  return payload;
+}
+async function postGitHubTokenViaServer(context, token, options = {}) {
+  const payload = await requestServerJson(context, "/api/github/auth/token", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ token, selectedRepo: options.selectedRepo })
+  });
+  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
+}
+async function prepareRemoteCheckoutViaServer(context, input) {
+  const payload = await requestServerJson(context, `/api/projects/${encodeURIComponent(input.repoSlug)}/prepare-checkout`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ checkout: input.checkout, repoUrl: input.repoUrl, baseDir: input.baseDir })
+  });
+  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
+}
+async function registerProjectViaServer(context, input) {
+  const payload = await requestServerJson(context, "/api/projects", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(input)
+  });
+  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
+}
+function sleep(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+async function switchServerProjectRootViaServer(context, projectRoot, options = {}) {
+  const switched = await requestServerJson(context, "/api/server/project-root", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ projectRoot })
+  });
+  const timeoutMs = options.timeoutMs ?? 30000;
+  const pollMs = options.pollMs ?? 1000;
+  const deadline = Date.now() + timeoutMs;
+  let lastError;
+  while (Date.now() < deadline) {
+    try {
+      const status = await requestServerJson(context, "/api/server/status");
+      if (status && typeof status === "object" && !Array.isArray(status)) {
+        const record = status;
+        if (record.projectRoot === projectRoot) {
+          return { ok: true, switched, status: record };
+        }
+        lastError = `server projectRoot=${String(record.projectRoot ?? "unknown")}`;
+      }
+    } catch (error) {
+      lastError = error;
+    }
+    await sleep(pollMs);
+  }
+  throw new CliError2(`Rig server did not switch to ${projectRoot} before timeout (${lastError instanceof Error ? lastError.message : String(lastError ?? "no status")}).`, 1);
+}
+
+// packages/cli/src/commands/_pi-install.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, rmSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { resolve as resolve2 } from "path";
+var PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
+var LEGACY_PI_RIG_MARKER = `// Managed by Rig. Source package: @rig/pi-rig.
+export { default } from '@rig/pi-rig';
+`;
+async function defaultCommandRunner(command, options = {}) {
+  const proc = Bun.spawn(command, { cwd: options.cwd, stdout: "pipe", stderr: "pipe" });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited
+  ]);
+  return { exitCode, stdout, stderr };
+}
+function resolvePiRigExtensionPath(homeDir) {
+  return resolve2(homeDir, ".pi", "agent", "extensions", "pi-rig");
+}
+function resolvePiRigPackageSource(projectRoot, exists = existsSync2) {
+  const localPackage = resolve2(projectRoot, "packages", "pi-rig");
+  if (exists(resolve2(localPackage, "package.json")))
+    return localPackage;
+  return `npm:${PI_RIG_PACKAGE_NAME}`;
+}
+function resolvePiHomeDir(inputHomeDir) {
+  return inputHomeDir ?? process.env.RIG_PI_HOME_DIR?.trim() ?? homedir2();
+}
+function piListContainsPiRig(output) {
+  return output.split(/\r?\n/).some((line) => {
+    const normalized = line.trim();
+    return normalized.includes(PI_RIG_PACKAGE_NAME) || /(?:^|[\\/])packages[\\/]pi-rig(?:$|\s)/.test(normalized);
+  });
+}
+async function safeRun(runner, command, options) {
+  try {
+    return await runner(command, options);
+  } catch (error) {
+    return { exitCode: 1, stdout: "", stderr: error instanceof Error ? error.message : String(error) };
+  }
+}
+function splitInstallCommand(value) {
+  return value.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g)?.map((part) => part.replace(/^['"]|['"]$/g, "")) ?? [];
+}
+async function ensurePiBinaryAvailable(input) {
+  const current = await safeRun(input.runner, ["pi", "--version"]);
+  if (current.exitCode === 0) {
+    const updateCommand = process.env.RIG_PI_UPDATE_COMMAND?.trim();
+    if (updateCommand) {
+      const parts2 = splitInstallCommand(updateCommand);
+      if (parts2.length > 0)
+        await safeRun(input.runner, parts2, input.projectRoot ? { cwd: input.projectRoot } : undefined);
+    }
+    return { ok: true, detail: (current.stdout || current.stderr).trim() || undefined };
+  }
+  const installCommand = process.env.RIG_PI_INSTALL_COMMAND?.trim() || "bunx @earendil-works/pi@latest install";
+  const parts = splitInstallCommand(installCommand);
+  if (parts.length === 0) {
+    return { ok: false, error: (current.stderr || current.stdout).trim() || "pi --version failed" };
+  }
+  const install = await safeRun(input.runner, parts, input.projectRoot ? { cwd: input.projectRoot } : undefined);
+  if (install.exitCode !== 0) {
+    return { ok: false, installedOrUpdated: true, error: (install.stderr || install.stdout).trim() || `Pi install command failed (${install.exitCode})` };
+  }
+  const next = await safeRun(input.runner, ["pi", "--version"]);
+  return {
+    ok: next.exitCode === 0,
+    installedOrUpdated: true,
+    detail: (next.stdout || next.stderr).trim() || undefined,
+    ...next.exitCode === 0 ? {} : { error: (next.stderr || next.stdout).trim() || "pi --version failed after install" }
+  };
+}
+function removeManagedLegacyPiRigBridge(homeDir, exists = existsSync2) {
+  const extensionPath = resolvePiRigExtensionPath(homeDir);
+  const indexPath = resolve2(extensionPath, "index.ts");
+  if (!exists(indexPath))
+    return;
+  try {
+    const content = readFileSync2(indexPath, "utf8");
+    if (content === LEGACY_PI_RIG_MARKER || content.includes("Managed by Rig. Source package: @rig/pi-rig")) {
+      rmSync(extensionPath, { recursive: true, force: true });
+    }
+  } catch {}
+}
+async function checkPiRigInstall(input = {}) {
+  const home = resolvePiHomeDir(input.homeDir);
+  const extensionPath = resolvePiRigExtensionPath(home);
+  if (process.env.RIG_TEST_FAKE_PI_INSTALL === "1") {
+    return {
+      extensionPath,
+      pi: { ok: true, label: "pi", detail: "fake-pi" },
+      piRig: { ok: true, label: "pi-rig global extension", detail: extensionPath }
+    };
+  }
+  const exists = input.exists ?? existsSync2;
+  const runner = input.commandRunner ?? defaultCommandRunner;
+  const piResult = await safeRun(runner, ["pi", "--version"]);
+  const piListResult = piResult.exitCode === 0 ? await safeRun(runner, ["pi", "list"]) : { exitCode: 1, stdout: "", stderr: "" };
+  const listedPiRig = piListResult.exitCode === 0 && piListContainsPiRig(`${piListResult.stdout}
+${piListResult.stderr}`);
+  const legacyBridge = exists(resolve2(extensionPath, "index.ts"));
+  const hasPiRig = listedPiRig;
+  return {
+    extensionPath,
+    pi: {
+      ok: piResult.exitCode === 0,
+      label: "pi",
+      detail: (piResult.stdout || piResult.stderr).trim() || undefined,
+      hint: piResult.exitCode === 0 ? undefined : "Install Pi or run `rig init --yes` to install/update the Pi runtime."
+    },
+    piRig: {
+      ok: hasPiRig,
+      label: "pi-rig global extension",
+      detail: hasPiRig ? piListResult.stdout.trim() || PI_RIG_PACKAGE_NAME : legacyBridge ? `${extensionPath} (legacy bridge; reinstall required)` : undefined,
+      hint: hasPiRig ? undefined : "Run `rig init --yes` to install/enable the global pi-rig package with `pi install`."
+    }
+  };
+}
+async function ensurePiRigInstalled(input) {
+  const home = resolvePiHomeDir(input.homeDir);
+  if (process.env.RIG_TEST_FAKE_PI_INSTALL === "1") {
+    const status2 = await checkPiRigInstall({ homeDir: home, commandRunner: input.commandRunner });
+    return { ...status2, installedPath: status2.extensionPath };
+  }
+  const runner = input.commandRunner ?? defaultCommandRunner;
+  const piAvailable = await ensurePiBinaryAvailable({ runner, projectRoot: input.projectRoot });
+  const status = piAvailable.ok ? await checkPiRigInstall({ homeDir: home, commandRunner: runner }) : {
+    extensionPath: resolvePiRigExtensionPath(home),
+    pi: { ok: false, label: "pi", detail: piAvailable.error, hint: "Install/update Pi with RIG_PI_INSTALL_COMMAND or install Pi manually." },
+    piRig: { ok: false, label: "pi-rig global extension", hint: "Pi is required before pi-rig can be installed." }
+  };
+  if (!piAvailable.ok) {
+    throw new Error(`Pi install/update failed: ${piAvailable.error ?? "pi unavailable"}`);
+  }
+  const packageSource = resolvePiRigPackageSource(input.projectRoot);
+  removeManagedLegacyPiRigBridge(home);
+  const install = await runner(["pi", "install", packageSource], { cwd: input.projectRoot });
+  if (install.exitCode !== 0) {
+    throw new Error(`pi-rig install failed: ${(install.stderr || install.stdout).trim() || `exit ${install.exitCode}`}`);
+  }
+  const next = await checkPiRigInstall({ homeDir: home, commandRunner: runner });
+  return { ...next, installedPath: packageSource };
+}
+async function ensureRemotePiRigInstalled(input) {
+  const payload = await input.requestJson("/api/pi-rig/install", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ package: "@rig/pi-rig", scope: "global" })
+  });
+  const record = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
+  const piOk = record.piOk === true || record.ok === true;
+  const piRigOk = record.piRigOk === true || record.installed === true || record.ok === true;
+  const extensionPath = typeof record.extensionPath === "string" ? record.extensionPath : "remote:~/.pi/agent/extensions/pi-rig";
+  return {
+    remote: true,
+    extensionPath,
+    pi: {
+      ok: piOk,
+      label: "pi",
+      detail: typeof record.piVersion === "string" ? record.piVersion : undefined,
+      hint: piOk ? undefined : "Install/update Pi on the selected remote Rig server."
+    },
+    piRig: {
+      ok: piRigOk,
+      label: "pi-rig global extension",
+      detail: extensionPath,
+      hint: piRigOk ? undefined : "Install/enable pi-rig on the selected remote Rig server."
+    }
+  };
+}
+async function buildPiSetupChecks(input = {}) {
+  const status = await checkPiRigInstall(input);
+  return [status.pi, status.piRig];
+}
+
+// packages/cli/src/commands/_snapshot-upload.ts
+import { mkdir, readdir, readFile, writeFile } from "fs/promises";
+import { dirname as dirname2, resolve as resolve3, relative, sep } from "path";
+var SNAPSHOT_ARCHIVE_VERSION = 1;
+var SNAPSHOT_ARCHIVE_CONTENT_TYPE = "application/vnd.rig.snapshot+json";
+var DEFAULT_EXCLUDED_DIRECTORIES = new Set([
+  ".git",
+  ".rig",
+  "node_modules",
+  ".turbo",
+  ".next",
+  ".cache",
+  "coverage",
+  "dist",
+  "build",
+  "out"
+]);
+function toPosixPath(path) {
+  return path.split(sep).join("/");
+}
+function assertManifestPath(root, relativePath) {
+  if (!relativePath || relativePath.startsWith("/") || relativePath.includes("\x00")) {
+    throw new Error(`Invalid snapshot path: ${relativePath}`);
+  }
+  const resolved = resolve3(root, relativePath);
+  const relativeToRoot = relative(root, resolved);
+  if (relativeToRoot.startsWith("..") || relativeToRoot === ".." || resolve3(relativeToRoot) === resolved) {
+    throw new Error(`Snapshot path escapes project root: ${relativePath}`);
+  }
+  return resolved;
+}
+async function buildSnapshotUploadManifest(projectRoot, options = {}) {
+  const root = resolve3(projectRoot);
+  const excludedDirectories = [...new Set([
+    ...DEFAULT_EXCLUDED_DIRECTORIES,
+    ...options.excludedDirectories ?? []
+  ])];
+  const excludedSet = new Set(excludedDirectories);
+  const files = [];
+  async function visit(dir) {
+    const entries = await readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (entry.isDirectory() && excludedSet.has(entry.name))
+        continue;
+      const fullPath = resolve3(dir, entry.name);
+      if (entry.isDirectory()) {
+        await visit(fullPath);
+        continue;
+      }
+      if (!entry.isFile())
+        continue;
+      files.push(toPosixPath(relative(root, fullPath)));
+    }
+  }
+  await visit(root);
+  files.sort();
+  return { root, files, excludedDirectories };
+}
+async function createSnapshotUploadArchive(projectRoot, options = {}) {
+  const manifest = await buildSnapshotUploadManifest(projectRoot, options);
+  const files = await Promise.all(manifest.files.map(async (path) => {
+    const fullPath = assertManifestPath(manifest.root, path);
+    return {
+      path,
+      contentBase64: (await readFile(fullPath)).toString("base64")
+    };
+  }));
+  return {
+    version: SNAPSHOT_ARCHIVE_VERSION,
+    root: manifest.root,
+    files,
+    excludedDirectories: manifest.excludedDirectories,
+    createdAt: (options.now?.() ?? new Date).toISOString()
+  };
+}
+function encodeSnapshotUploadArchive(archive) {
+  return Buffer.from(JSON.stringify(archive), "utf8").toString("base64");
+}
+async function uploadSnapshotArchiveViaServer(context, input) {
+  const payload = await requestServerJson(context, `/api/projects/${encodeURIComponent(input.repoSlug)}/upload-snapshot`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      archiveContentBase64: encodeSnapshotUploadArchive(input.archive),
+      contentType: SNAPSHOT_ARCHIVE_CONTENT_TYPE,
+      baseDir: input.baseDir
+    })
+  });
+  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
+}
+
+// packages/cli/src/commands/_doctor-checks.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { resolve as resolve4 } from "path";
+import { isSupportedBunVersion, MIN_SUPPORTED_BUN_VERSION } from "@rig/runtime/control-plane/setup-version";
+
+// packages/cli/src/commands/_parsers.ts
+async function loadRigConfigOrNull(projectRoot) {
+  try {
+    const { loadConfig } = await import("@rig/core/load-config");
+    return await loadConfig(projectRoot);
+  } catch {
+    return null;
+  }
+}
+
+// packages/cli/src/commands/_doctor-checks.ts
+function check(id, label, status, detail, remediation) {
+  return {
+    id,
+    label,
+    status,
+    ...detail ? { detail } : {},
+    ...remediation ? { remediation } : {}
+  };
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function isAuthenticated(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return false;
+  const record = payload;
+  return record.signedIn === true || record.authenticated === true || record.status === "authenticated" || record.ok === true && typeof record.login === "string" && record.login.trim().length > 0;
+}
+function repoSlugFromConfig(config) {
+  const project = config?.project;
+  if (project && typeof project === "object" && !Array.isArray(project)) {
+    const record = project;
+    if (typeof record.repo === "string" && /^([^/\s]+)\/([^/\s]+)$/.test(record.repo))
+      return record.repo;
+    if (typeof record.name === "string" && /^([^/\s]+)\/([^/\s]+)$/.test(record.name))
+      return record.name;
+  }
+  const taskSource = config?.taskSource;
+  if (taskSource && typeof taskSource === "object" && !Array.isArray(taskSource)) {
+    const source = taskSource;
+    if (typeof source.owner === "string" && typeof source.repo === "string")
+      return `${source.owner}/${source.repo}`;
+  }
+  return null;
+}
+function loadFallbackConfig(projectRoot) {
+  const candidates = ["rig.config.ts", "rig.config.mts", "rig.config.json"];
+  for (const name of candidates) {
+    const path = resolve4(projectRoot, name);
+    if (!existsSync3(path))
+      continue;
+    try {
+      const source = readFileSync3(path, "utf8");
+      if (name.endsWith(".json"))
+        return JSON.parse(source);
+      const owner = source.match(/owner\s*:\s*["']([^"']+)["']/)?.[1];
+      const repo = source.match(/repo\s*:\s*["']([^"']+)["']/)?.[1];
+      const projectRepo = source.match(/project\s*:\s*\{[^}]*repo\s*:\s*["']([^"']+)["']/s)?.[1] ?? (owner && repo ? `${owner}/${repo}` : undefined);
+      const taskKind = source.match(/taskSource\s*:\s*\{[^}]*kind\s*:\s*["']([^"']+)["']/s)?.[1];
+      if (projectRepo || taskKind) {
+        return {
+          ...projectRepo ? { project: { name: projectRepo, repo: projectRepo } } : {},
+          ...taskKind ? { taskSource: { kind: taskKind, ...owner ? { owner } : {}, ...repo ? { repo } : {} } } : {}
+        };
+      }
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function projectStatusSlug(projectRoot, config) {
+  return readRepoConnection(projectRoot)?.project ?? repoSlugFromConfig(config);
+}
+function githubProjectsCheck(config) {
+  const github = config?.github;
+  const projects = github?.projects;
+  if (!projects?.enabled) {
+    return check("github-projects", "GitHub Projects status sync", "warn", "disabled or not configured", "Run `rig init --github-project <project>` or configure github.projects when Project status sync should be authoritative.");
+  }
+  if (projects.projectId && projects.statusFieldId) {
+    return check("github-projects", "GitHub Projects status sync", "pass", `project ${projects.projectId}`);
+  }
+  return check("github-projects", "GitHub Projects status sync", "fail", "enabled but projectId/statusFieldId is incomplete", "Configure github.projects.projectId and github.projects.statusFieldId, or disable github.projects.enabled.");
+}
+function permissionAllowsPr(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return null;
+  const record = payload;
+  if (record.canOpenPullRequest === true || record.pullRequests === true || record.push === true || record.maintain === true || record.admin === true)
+    return true;
+  if (record.canOpenPullRequest === false || record.pullRequests === false || record.push === false)
+    return false;
+  const permissions = record.permissions;
+  if (permissions && typeof permissions === "object" && !Array.isArray(permissions)) {
+    const p = permissions;
+    if (p.push === true || p.maintain === true || p.admin === true)
+      return true;
+    if (p.push === false && p.maintain !== true && p.admin !== true)
+      return false;
+  }
+  return null;
+}
+function labelsReady(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return null;
+  const record = payload;
+  if (record.ok === true || record.ready === true || record.labelsReady === true)
+    return true;
+  if (record.ok === false || record.ready === false || record.labelsReady === false)
+    return false;
+  return null;
+}
+function prMergeCheck(config) {
+  const pr = config?.pr;
+  const merge = config?.merge;
+  if (pr?.mode === "off" || merge?.mode === "off") {
+    return check("pr-merge", "PR/merge automation", "warn", "automatic PR or merge is disabled", "Set pr.mode and merge.mode to auto for autonomous YOLO runs.");
+  }
+  return check("pr-merge", "PR/merge automation", "pass", `pr=${pr?.mode ?? "auto"}, merge=${merge?.mode ?? "auto"}, method=${merge?.method ?? "repo-default"}`);
+}
+async function runRigDoctorChecks(options) {
+  const projectRoot = options.projectRoot;
+  const checks = [];
+  const which = options.which ?? ((binary) => Bun.which(binary));
+  const bunVersion = options.bunVersion ?? Bun.version;
+  const request = options.requestJson ?? ((pathname, init) => requestServerJson({ projectRoot }, pathname, init));
+  const loadConfig = options.loadConfig ?? loadRigConfigOrNull;
+  checks.push(check("bun", `bun >= ${MIN_SUPPORTED_BUN_VERSION}`, isSupportedBunVersion(bunVersion) ? "pass" : "fail", `found ${bunVersion}`, `Install Bun ${MIN_SUPPORTED_BUN_VERSION} or newer.`), check("git", "git", which("git") ? "pass" : "fail", which("git") ?? undefined, "Install git and ensure it is on PATH."), check("jq", "jq", which("jq") ? "pass" : "warn", which("jq") ?? undefined, "Install jq (for example `brew install jq`)."));
+  const loadedConfig = await loadConfig(projectRoot).catch(() => null);
+  const config = loadedConfig ?? loadFallbackConfig(projectRoot);
+  const hasConfigFile = ["rig.config.ts", "rig.config.mts", "rig.config.json"].some((name) => existsSync3(resolve4(projectRoot, name)));
+  checks.push(config ? check("config", "rig.config loadable", "pass") : check("config", "rig.config loadable", hasConfigFile ? "fail" : "fail", hasConfigFile ? "config file exists but failed to load" : "missing rig.config.ts/json", "Run `rig init` or fix the config error."));
+  const taskSourceKind = config?.taskSource?.kind;
+  checks.push(taskSourceKind ? check("task-source", "task source configured", "pass", taskSourceKind) : check("task-source", "task source configured", "fail", "missing taskSource", "Configure taskSource in rig.config.ts."));
+  const repo = readRepoConnection(projectRoot);
+  checks.push(repo ? check("project-link", "repo selected Rig connection", repo.project ? "pass" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : ""}`, "Run `rig init --yes --repo owner/repo` to link this checkout to a GitHub repo slug.") : check("project-link", "repo selected Rig connection", "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig connect use <alias|local>`."));
+  const selected = (() => {
+    try {
+      return resolveSelectedConnection(projectRoot);
+    } catch {
+      return null;
+    }
+  })();
+  checks.push(selected ? check("connection", "selected server connection", "pass", selected.connection.kind === "remote" ? selected.connection.baseUrl : "local auto") : check("connection", "selected server connection", repo ? "fail" : "warn", repo ? "selected alias is missing" : "will auto-start local server", repo ? "Run `rig connect list` and `rig connect use <alias|local>`." : undefined));
+  let server = null;
+  try {
+    server = await (options.resolveServer ?? ensureServerForCli)(projectRoot);
+    checks.push(check("server", "Rig server reachable", "pass", `${server.connectionKind} ${server.baseUrl}`));
+  } catch (error) {
+    checks.push(check("server", "Rig server reachable", "fail", errorMessage(error), "Start the local Rig server or fix the selected remote connection."));
+  }
+  if (server || options.requestJson) {
+    try {
+      const status = await request("/api/server/status");
+      checks.push(check("server-status", "server project status", "pass", JSON.stringify(status).slice(0, 180)));
+    } catch (error) {
+      checks.push(check("server-status", "server project status", "fail", errorMessage(error), "Run `rig doctor` after the selected server is reachable."));
+    }
+    try {
+      const auth = await request("/api/github/auth/status");
+      checks.push(isAuthenticated(auth) ? check("github-auth", "GitHub auth", "pass") : check("github-auth", "GitHub auth", "fail", "not authenticated", "Run `rig github auth import-gh` or `rig github auth token --token <token>`."));
+    } catch (error) {
+      checks.push(check("github-auth", "GitHub auth", "fail", errorMessage(error), "Authenticate GitHub through Rig and ensure the server exposes auth status."));
+    }
+    try {
+      const permissions = await request("/api/github/repo/permissions");
+      const allowed = permissionAllowsPr(permissions);
+      checks.push(allowed === true ? check("github-repo-permissions", "GitHub repo PR permissions", "pass", JSON.stringify(permissions).slice(0, 180)) : allowed === false ? check("github-repo-permissions", "GitHub repo PR permissions", "fail", JSON.stringify(permissions).slice(0, 180), "Grant the selected GitHub token permission to push branches, open PRs, and merge according to repo rules.") : check("github-repo-permissions", "GitHub repo PR permissions", "warn", JSON.stringify(permissions).slice(0, 180), "Confirm the selected token can push branches and open PRs."));
+    } catch (error) {
+      checks.push(check("github-repo-permissions", "GitHub repo PR permissions", "warn", errorMessage(error), "Ensure the server exposes repo permission checks and the token can open PRs."));
+    }
+    try {
+      const labels = await request("/api/workspace/task-labels");
+      const ready = labelsReady(labels);
+      checks.push(ready === false ? check("task-labels", "GitHub issue labels", "fail", JSON.stringify(labels).slice(0, 180), "Let Rig create required labels or create the configured lifecycle labels manually.") : check("task-labels", "GitHub issue labels", ready === true ? "pass" : "warn", JSON.stringify(labels).slice(0, 180), "Confirm required Rig lifecycle labels exist."));
+    } catch (error) {
+      checks.push(check("task-labels", "GitHub issue labels", "warn", errorMessage(error), "Run `rig init`/`rig doctor` after label setup is wired on the server."));
+    }
+    try {
+      const projection = await request("/api/workspace/task-projection");
+      checks.push(check("task-projection", "task projection", "pass", JSON.stringify(projection).slice(0, 180)));
+    } catch (error) {
+      checks.push(check("task-projection", "task projection", "warn", errorMessage(error), "Refresh task projection with `rig task list` or fix the task source."));
+    }
+    const slug = projectStatusSlug(projectRoot, config);
+    if (slug) {
+      try {
+        const project = await request(`/api/projects/${encodeURIComponent(slug)}`);
+        checks.push(check("remote-checkout", "server project checkout", "pass", JSON.stringify(project).slice(0, 180)));
+      } catch (error) {
+        checks.push(check("remote-checkout", "server project checkout", "warn", errorMessage(error), "Run `rig init --yes --repo owner/repo` to register/link the server project checkout."));
+      }
+    } else {
+      checks.push(check("remote-checkout", "server project checkout", "warn", "repo slug unknown", "Set project.repo or run `rig init --repo owner/repo`."));
+    }
+  }
+  if (taskSourceKind === "github-issues") {
+    checks.push(check("gh", "gh CLI fallback", which("gh") ? "pass" : "warn", which("gh") ?? undefined, "Install gh for local/dev GitHub fallback operations."));
+  }
+  checks.push(githubProjectsCheck(config));
+  checks.push(prMergeCheck(config));
+  const piChecks = await (options.piChecks ?? (() => buildPiSetupChecks()))().catch((error) => [{
+    ok: false,
+    label: "pi/pi-rig checks",
+    hint: errorMessage(error)
+  }]);
+  for (const pi of piChecks) {
+    checks.push(check(pi.label === "pi" ? "pi" : "pi-rig", pi.label, pi.ok ? "pass" : "warn", pi.detail, pi.hint ?? (pi.ok ? undefined : "Run `rig init --yes` to install/update Pi and enable pi-rig.")));
+  }
+  return checks;
+}
+function countDoctorFailures(checks) {
+  return checks.filter((entry) => entry.status === "fail").length;
+}
+
+// packages/cli/src/commands/init.ts
+var RIG_CONFIG_PACKAGE_VERSION = "0.0.6-alpha.0";
+var RIG_CONFIG_DEV_DEPENDENCIES = {
+  "@rig/core": `npm:@h-rig/core@${RIG_CONFIG_PACKAGE_VERSION}`,
+  "@rig/standard-plugin": `npm:@h-rig/standard-plugin@${RIG_CONFIG_PACKAGE_VERSION}`
+};
+function parseRepoSlugFromRemote(remoteUrl) {
+  const trimmed = remoteUrl.trim();
+  const gitHubMatch = trimmed.match(/github\.com[:/]([^/]+)\/([^/.]+)(?:\.git)?$/i);
+  return gitHubMatch ? `${gitHubMatch[1]}/${gitHubMatch[2]}` : null;
+}
+function detectOriginRepoSlug(projectRoot) {
+  const result = spawnSync2("git", ["-C", projectRoot, "remote", "get-url", "origin"], { encoding: "utf8" });
+  if (result.status !== 0)
+    return null;
+  return parseRepoSlugFromRemote(result.stdout.trim());
+}
+function parseRepoSlug(value) {
+  const match = value.trim().match(/^([^/\s]+)\/([^/\s]+)$/);
+  if (!match)
+    throw new CliError2(`Invalid GitHub repo slug: ${value}. Expected owner/repo.`, 1);
+  return { owner: match[1], repo: match[2], slug: `${match[1]}/${match[2]}` };
+}
+function ensureRigPrivateDirs(projectRoot) {
+  const rigDir = resolve5(projectRoot, ".rig");
+  mkdirSync2(resolve5(rigDir, "state"), { recursive: true });
+  mkdirSync2(resolve5(rigDir, "logs"), { recursive: true });
+  mkdirSync2(resolve5(rigDir, "runs"), { recursive: true });
+  mkdirSync2(resolve5(rigDir, "tmp"), { recursive: true });
+  mkdirSync2(resolve5(projectRoot, "artifacts"), { recursive: true });
+  const taskConfigPath = resolve5(rigDir, "task-config.json");
+  if (!existsSync4(taskConfigPath))
+    writeFileSync2(taskConfigPath, `{}
+`, "utf-8");
+}
+function ensureGitignoreEntries(projectRoot) {
+  const path = resolve5(projectRoot, ".gitignore");
+  const existing = existsSync4(path) ? readFileSync4(path, "utf8") : "";
+  const entries = [".rig/state/", ".rig/logs/", ".rig/runs/", ".rig/tmp/"];
+  const missing = entries.filter((entry) => !existing.split(/\r?\n/).includes(entry));
+  if (missing.length === 0)
+    return;
+  const prefix = existing.length > 0 && !existing.endsWith(`
+`) ? `
+` : "";
+  appendFileSync(path, `${prefix}${missing.join(`
+`)}
+`, "utf8");
+}
+function ensureRigConfigPackageDependencies(projectRoot) {
+  const path = resolve5(projectRoot, "package.json");
+  const existing = existsSync4(path) ? JSON.parse(readFileSync4(path, "utf8")) : {};
+  const devDependencies = existing.devDependencies && typeof existing.devDependencies === "object" && !Array.isArray(existing.devDependencies) ? { ...existing.devDependencies } : {};
+  for (const [name, spec] of Object.entries(RIG_CONFIG_DEV_DEPENDENCIES)) {
+    devDependencies[name] = spec;
+  }
+  const next = {
+    ...existsSync4(path) ? existing : { name: "rig-project", private: true },
+    devDependencies
+  };
+  writeFileSync2(path, `${JSON.stringify(next, null, 2)}
+`, "utf8");
+}
+function applyGitHubProjectConfig(source, options) {
+  if (!options.githubProject || options.githubProject === "off")
+    return source;
+  const projectId = JSON.stringify(options.githubProject);
+  const statusFieldId = JSON.stringify(options.githubProjectStatusField ?? "Status");
+  return source.replace(`    projects: { enabled: false },`, [
+    `    projects: {`,
+    `      enabled: true,`,
+    `      projectId: ${projectId},`,
+    `      statusFieldId: ${statusFieldId},`,
+    `    },`
+  ].join(`
+`));
+}
+function checkoutForInit(projectRoot, serverKind, strategy) {
+  if (serverKind === "local")
+    return { kind: "local", path: projectRoot };
+  const selected = strategy ?? { kind: "managed-clone" };
+  switch (selected.kind) {
+    case "managed-clone":
+      return { kind: "managed-clone", path: projectRoot };
+    case "current-ref":
+      return { kind: "current-ref", path: projectRoot, ...selected.ref ? { ref: selected.ref } : {} };
+    case "uploaded-snapshot":
+      return { kind: "uploaded-snapshot", path: projectRoot, source: "local-working-tree" };
+    case "existing-path":
+      return { kind: "existing-path", path: selected.path };
+  }
+}
+function detectGhLogin() {
+  const result = spawnSync2("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8", timeout: 5000, stdio: ["ignore", "pipe", "ignore"] });
+  return result.status === 0 && result.stdout.trim() ? result.stdout.trim() : null;
+}
+function readGhAuthToken() {
+  const result = spawnSync2("gh", ["auth", "token"], { encoding: "utf8" });
+  if (result.status !== 0 || !result.stdout.trim()) {
+    throw new CliError2(result.stderr.trim() || "Could not read GitHub token from `gh auth token`.", result.status || 1);
+  }
+  return result.stdout.trim();
+}
+async function loadClackPrompts() {
+  return await import("@clack/prompts");
+}
+async function promptRequiredText(prompts, options) {
+  const value = await prompts.text(options);
+  if (prompts.isCancel(value))
+    throw new CliError2("Init cancelled.", 1);
+  const text = String(value ?? "").trim();
+  if (!text)
+    throw new CliError2(`${options.message} is required.`, 1);
+  return text;
+}
+async function promptOptionalText(prompts, options) {
+  const value = await prompts.text(options);
+  if (prompts.isCancel(value))
+    throw new CliError2("Init cancelled.", 1);
+  return String(value ?? "").trim();
+}
+async function promptSelect(prompts, options) {
+  const value = await prompts.select(options);
+  if (prompts.isCancel(value))
+    throw new CliError2("Init cancelled.", 1);
+  return String(value);
+}
+async function pollDeviceAuthOnce(context, pollId) {
+  if (typeof pollId !== "string" || !pollId.trim())
+    return null;
+  const payload = await requestServerJson(context, "/api/github/auth/device/poll", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ pollId })
+  }).catch(() => null);
+  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : null;
+}
+async function runControlPlaneInit(context, options) {
+  const projectRoot = context.projectRoot;
+  const detectedSlug = options.repoSlug ?? detectOriginRepoSlug(projectRoot);
+  if (!detectedSlug) {
+    throw new CliError2("Could not detect GitHub repo slug from origin. Pass --repo owner/repo.", 1);
+  }
+  const repo = parseRepoSlug(detectedSlug);
+  const serverKind = options.server ?? "local";
+  const connectionAlias = options.connectionAlias ?? (serverKind === "local" ? "local" : "remote");
+  if (serverKind === "remote") {
+    if (!options.remoteUrl)
+      throw new CliError2("Missing --remote-url for --server remote.", 1);
+    upsertGlobalConnection(connectionAlias, { kind: "remote", baseUrl: options.remoteUrl });
+  }
+  writeRepoConnection(projectRoot, {
+    selected: connectionAlias,
+    project: repo.slug,
+    linkedAt: new Date().toISOString()
+  });
+  ensureRigPrivateDirs(projectRoot);
+  ensureGitignoreEntries(projectRoot);
+  const configTsPath = resolve5(projectRoot, "rig.config.ts");
+  const configJsonPath = resolve5(projectRoot, "rig.config.json");
+  const configExists = existsSync4(configTsPath) || existsSync4(configJsonPath);
+  if (!options.privateStateOnly) {
+    if (configExists && !options.repair) {
+      if (context.outputMode !== "json")
+        console.log("rig.config already exists; leaving it unchanged. Pass --repair to rewrite it.");
+    } else {
+      const source = applyGitHubProjectConfig(buildRigInitConfigSource({
+        projectName: repo.slug,
+        projectRepo: repo.slug,
+        taskSource: { kind: "github-issues", owner: repo.owner, repo: repo.repo },
+        useStandardPlugin: true
+      }), options);
+      writeFileSync2(configTsPath, source, "utf-8");
+    }
+    ensureRigConfigPackageDependencies(projectRoot);
+  }
+  writeFileSync2(resolve5(projectRoot, ".rig", "state", "project-link.json"), `${JSON.stringify({ repoSlug: repo.slug, connection: connectionAlias, linkedAt: new Date().toISOString() }, null, 2)}
+`, "utf8");
+  const checkout = checkoutForInit(projectRoot, serverKind, options.remoteCheckout);
+  let uploadedSnapshot = null;
+  if (serverKind === "remote" && options.remoteCheckout?.kind === "uploaded-snapshot") {
+    const archive = await createSnapshotUploadArchive(projectRoot);
+    uploadedSnapshot = await uploadSnapshotArchiveViaServer(context, { repoSlug: repo.slug, archive });
+    const uploadedCheckout = uploadedSnapshot.checkout;
+    if (uploadedCheckout && typeof uploadedCheckout === "object" && !Array.isArray(uploadedCheckout)) {
+      Object.assign(checkout, uploadedCheckout);
+    }
+  }
+  let githubAuth = null;
+  let deviceAuth = null;
+  const authMethod = options.githubAuthMethod ?? (options.githubToken ? "token" : "skip");
+  const remoteGhTokenWarning = serverKind === "remote" && authMethod === "gh" ? `This sends a GitHub token from this machine to ${options.remoteUrl ?? "the remote Rig server"}.` : null;
+  if (remoteGhTokenWarning && !options.yes) {
+    throw new CliError2(`${remoteGhTokenWarning} Re-run with --yes to confirm this explicit token transfer.`, 1);
+  }
+  const token = authMethod === "gh" && !options.githubToken ? readGhAuthToken() : options.githubToken?.trim();
+  if (token) {
+    githubAuth = await postGitHubTokenViaServer(context, token, { selectedRepo: repo.slug });
+    setGitHubBearerTokenForCurrentProcess(token);
+    if (serverKind === "remote") {
+      writeFileSync2(resolve5(projectRoot, ".rig", "state", "github-auth.json"), `${JSON.stringify({ authenticated: true, source: authMethod === "gh" ? "gh" : "init-token", storedOnServer: true, selectedRepo: repo.slug, updatedAt: new Date().toISOString() }, null, 2)}
+`, "utf8");
+    }
+  } else if (authMethod === "device") {
+    const payload = await requestServerJson(context, "/api/github/auth/device/start", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ repoSlug: repo.slug })
+    });
+    deviceAuth = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
+    const completed = await pollDeviceAuthOnce(context, deviceAuth.pollId);
+    if (completed)
+      deviceAuth = { ...deviceAuth, poll: completed, completed: completed.status === "signed-in" };
+  }
+  let remoteCheckoutPreparation = null;
+  if (serverKind === "remote" && options.remoteCheckout?.kind !== "uploaded-snapshot") {
+    remoteCheckoutPreparation = await prepareRemoteCheckoutViaServer(context, {
+      repoSlug: repo.slug,
+      checkout,
+      repoUrl: `https://github.com/${repo.slug}.git`
+    });
+    const preparedCheckout = remoteCheckoutPreparation.checkout;
+    if (preparedCheckout && typeof preparedCheckout === "object" && !Array.isArray(preparedCheckout)) {
+      Object.assign(checkout, preparedCheckout);
+    }
+  }
+  const registered = await registerProjectViaServer(context, {
+    repoSlug: repo.slug,
+    checkout
+  });
+  const checkoutPath = typeof checkout.path === "string" ? checkout.path : null;
+  const serverRootSwitch = serverKind === "remote" && checkoutPath ? await switchServerProjectRootViaServer(context, checkoutPath) : null;
+  const activeProjectRegistration = serverRootSwitch ? await registerProjectViaServer(context, { repoSlug: repo.slug, checkout }) : null;
+  const pi = serverKind === "remote" ? await ensureRemotePiRigInstalled({ requestJson: (pathname, init) => requestServerJson(context, pathname, init) }).catch((error) => ({
+    remote: true,
+    pi: { ok: false, label: "pi", hint: error instanceof Error ? error.message : String(error) },
+    piRig: { ok: false, label: "pi-rig global extension", hint: "Remote server did not complete pi-rig installation." },
+    extensionPath: "remote:~/.pi/agent/extensions/pi-rig"
+  })) : await ensurePiRigInstalled({ projectRoot, homeDir: process.env.RIG_PI_HOME_DIR }).catch((error) => ({
+    pi: { ok: false, label: "pi", hint: error instanceof Error ? error.message : String(error) },
+    piRig: { ok: false, label: "pi-rig global extension", hint: "Local pi-rig installation failed." },
+    extensionPath: null,
+    installedPath: null
+  }));
+  const doctor = await runRigDoctorChecks({ projectRoot }).then((checks) => ({
+    ok: countDoctorFailures(checks) === 0,
+    failures: countDoctorFailures(checks),
+    checks
+  }));
+  const details = {
+    repoSlug: repo.slug,
+    server: serverKind,
+    connection: connectionAlias,
+    githubProject: options.githubProject ?? "off",
+    checkout,
+    remoteCheckoutPreparation,
+    uploadedSnapshot,
+    projectRegistration: registered,
+    activeProjectRegistration,
+    serverRootSwitch,
+    githubAuth,
+    deviceAuth,
+    githubAuthWarning: remoteGhTokenWarning,
+    pi,
+    doctor
+  };
+  if (context.outputMode === "json")
+    console.log(JSON.stringify(details, null, 2));
+  else
+    console.log(`Initialized Rig control-plane project ${repo.slug}. Next: rig doctor && rig task list`);
+  return { ok: true, group: "init", command: "init", details };
+}
+function parseInitOptions(args) {
+  let rest = [...args];
+  const yes = takeFlag(rest, "--yes");
+  rest = yes.rest;
+  const repair = takeFlag(rest, "--repair");
+  rest = repair.rest;
+  const privateStateOnly = takeFlag(rest, "--private-state-only");
+  rest = privateStateOnly.rest;
+  const server = takeOption(rest, "--server");
+  rest = server.rest;
+  const remoteUrl = takeOption(rest, "--remote-url");
+  rest = remoteUrl.rest;
+  const connectionAlias = takeOption(rest, "--connection");
+  rest = connectionAlias.rest;
+  const repoSlug = takeOption(rest, "--repo");
+  rest = repoSlug.rest;
+  const githubToken = takeOption(rest, "--github-token");
+  rest = githubToken.rest;
+  const githubProject = takeOption(rest, "--github-project");
+  rest = githubProject.rest;
+  const githubProjectStatusField = takeOption(rest, "--github-project-status-field");
+  rest = githubProjectStatusField.rest;
+  const githubAuth = takeOption(rest, "--github-auth");
+  rest = githubAuth.rest;
+  const remoteCheckout = takeOption(rest, "--remote-checkout");
+  rest = remoteCheckout.rest;
+  const existingPath = takeOption(rest, "--existing-path");
+  rest = existingPath.rest;
+  const ref = takeOption(rest, "--ref");
+  rest = ref.rest;
+  const options = {
+    yes: yes.value,
+    repair: repair.value,
+    privateStateOnly: privateStateOnly.value,
+    server: server.value === "remote" ? "remote" : server.value === "local" ? "local" : undefined,
+    remoteUrl: remoteUrl.value,
+    connectionAlias: connectionAlias.value,
+    repoSlug: repoSlug.value,
+    githubToken: githubToken.value,
+    githubAuthMethod: githubAuth.value,
+    githubProject: githubProject.value,
+    githubProjectStatusField: githubProjectStatusField.value
+  };
+  if (server.value && options.server === undefined) {
+    throw new CliError2("--server must be local or remote.", 1);
+  }
+  if (githubAuth.value && !["gh", "token", "device", "skip"].includes(githubAuth.value)) {
+    throw new CliError2("--github-auth must be gh, token, device, or skip.", 1);
+  }
+  if (remoteCheckout.value) {
+    if (remoteCheckout.value === "managed-clone")
+      options.remoteCheckout = { kind: "managed-clone" };
+    else if (remoteCheckout.value === "current-ref")
+      options.remoteCheckout = { kind: "current-ref", ref: ref.value };
+    else if (remoteCheckout.value === "uploaded-snapshot")
+      options.remoteCheckout = { kind: "uploaded-snapshot" };
+    else if (remoteCheckout.value === "existing-path") {
+      if (!existingPath.value)
+        throw new CliError2("--remote-checkout existing-path requires --existing-path <path>.", 1);
+      options.remoteCheckout = { kind: "existing-path", path: existingPath.value };
+    } else {
+      throw new CliError2("--remote-checkout must be managed-clone, current-ref, uploaded-snapshot, or existing-path.", 1);
+    }
+  }
+  return { options, rest };
+}
+async function runInteractiveControlPlaneInit(context, prompts) {
+  prompts.intro?.("Initialize a Rig control-plane project");
+  const projectRoot = context.projectRoot;
+  const existingConfig = existsSync4(resolve5(projectRoot, "rig.config.ts")) || existsSync4(resolve5(projectRoot, "rig.config.json"));
+  let repair = false;
+  let privateStateOnly = false;
+  if (existingConfig) {
+    const action = await promptSelect(prompts, {
+      message: "rig.config already exists. What should rig init do?",
+      options: [
+        { value: "repair", label: "Verify/repair generated config" },
+        { value: "reconfigure", label: "Reconfigure project and rewrite config" },
+        { value: "private-state-only", label: "Leave config unchanged; update private connection/auth state only" },
+        { value: "cancel", label: "Cancel" }
+      ]
+    });
+    if (action === "cancel") {
+      prompts.cancel?.("Init cancelled.");
+      return { ok: false, group: "init", command: "init", details: { cancelled: true } };
+    }
+    repair = action === "repair" || action === "reconfigure";
+    privateStateOnly = action === "private-state-only";
+  }
+  const detectedRepo = detectOriginRepoSlug(projectRoot) ?? undefined;
+  const repoSlug = await promptRequiredText(prompts, {
+    message: "GitHub repo slug",
+    placeholder: "owner/repo",
+    defaultValue: detectedRepo
+  });
+  const serverChoice = await promptSelect(prompts, {
+    message: "Rig server",
+    options: [
+      { value: "local", label: "Local server", hint: "run on this machine" },
+      { value: "remote", label: "Remote server", hint: "connect to an HTTPS Rig server" }
+    ]
+  });
+  const remoteUrl = serverChoice === "remote" ? await promptRequiredText(prompts, { message: "Remote Rig server URL", placeholder: "https://rig.example.com" }) : undefined;
+  let remoteCheckout;
+  if (serverChoice === "remote") {
+    const checkout = await promptSelect(prompts, {
+      message: "Remote checkout strategy",
+      options: [
+        { value: "managed-clone", label: "Server-managed clone (recommended)" },
+        { value: "current-ref", label: "Clone current branch/ref" },
+        { value: "uploaded-snapshot", label: "Upload current working-tree snapshot" },
+        { value: "existing-path", label: "Use existing server path" }
+      ]
+    });
+    if (checkout === "existing-path") {
+      remoteCheckout = { kind: "existing-path", path: await promptRequiredText(prompts, { message: "Existing server checkout path", placeholder: "/srv/rig/checkouts/repo" }) };
+    } else if (checkout === "current-ref") {
+      remoteCheckout = { kind: "current-ref", ref: await promptOptionalText(prompts, { message: "Branch/ref to clone (blank for current HEAD)", placeholder: "main" }) || undefined };
+    } else if (checkout === "uploaded-snapshot") {
+      remoteCheckout = { kind: "uploaded-snapshot" };
+    } else {
+      remoteCheckout = { kind: "managed-clone" };
+    }
+  }
+  const detectedGhLogin = detectGhLogin();
+  const authMethod = await promptSelect(prompts, {
+    message: `GitHub auth method${detectedGhLogin ? ` (detected gh login: ${detectedGhLogin})` : ""}`,
+    options: [
+      { value: "gh", label: "Import token from gh auth token", hint: serverChoice === "local" ? "recommended for local" : "sends this machine's token to the remote server" },
+      { value: "device", label: "Start server GitHub device flow", hint: serverChoice === "remote" ? "recommended for remote" : undefined },
+      { value: "token", label: "Paste token" },
+      { value: "skip", label: "Skip for now" }
+    ]
+  });
+  if (serverChoice === "remote" && authMethod === "gh") {
+    if (!prompts.confirm)
+      throw new CliError2("Remote gh-token import requires explicit confirmation.", 1);
+    const confirmed = await prompts.confirm({
+      message: `This sends a GitHub token from this machine to ${remoteUrl}. Continue?`,
+      initialValue: false
+    });
+    if (prompts.isCancel(confirmed) || confirmed !== true) {
+      throw new CliError2("Remote gh-token import cancelled.", 1);
+    }
+  }
+  const githubToken = authMethod === "token" ? await promptRequiredText(prompts, { message: "GitHub token", placeholder: "ghp_..." }) : undefined;
+  const projectChoice = await promptSelect(prompts, {
+    message: "GitHub Projects status sync",
+    options: [
+      { value: "off", label: "Off" },
+      { value: "configure", label: "Configure ProjectV2 status field" }
+    ]
+  });
+  const githubProject = projectChoice === "configure" ? await promptRequiredText(prompts, { message: "GitHub ProjectV2 id", placeholder: "PVT_..." }) : "off";
+  const githubProjectStatusField = projectChoice === "configure" ? await promptRequiredText(prompts, { message: "Project Status field id", placeholder: "field_status" }) : undefined;
+  const result = await runControlPlaneInit(context, {
+    server: serverChoice,
+    remoteUrl,
+    repoSlug,
+    githubToken,
+    githubAuthMethod: authMethod,
+    githubProject,
+    githubProjectStatusField,
+    remoteCheckout,
+    repair,
+    privateStateOnly
+  });
+  const details = result.details && typeof result.details === "object" && !Array.isArray(result.details) ? result.details : {};
+  const deviceAuth = details.deviceAuth && typeof details.deviceAuth === "object" && !Array.isArray(details.deviceAuth) ? details.deviceAuth : null;
+  const deviceMessage = deviceAuth ? ` GitHub device flow: open ${String(deviceAuth.verification_uri ?? deviceAuth.verification_uri_complete ?? "the verification URL returned by the server")} and enter ${String(deviceAuth.user_code ?? "the returned user code")}.` : "";
+  prompts.outro?.(`Rig project initialized.${deviceMessage} Next: rig doctor && rig task list`);
+  return result;
+}
+async function executeInit(context, args) {
+  const parsed = parseInitOptions(args);
+  if (parsed.options.yes || parsed.options.server || parsed.options.repoSlug || parsed.options.githubToken || parsed.options.privateStateOnly || parsed.options.repair || parsed.options.githubAuthMethod || parsed.options.remoteCheckout) {
+    if (parsed.rest.length > 0)
+      throw new CliError2(`Unexpected arguments: ${parsed.rest.join(" ")}
+Usage: rig init [--server local|remote] [--remote-url <url>] [--repo owner/repo] [--github-auth gh|token|device|skip] [--github-token <token>] [--github-project off|<project-id>] [--remote-checkout managed-clone|current-ref|uploaded-snapshot|existing-path] [--yes]`, 1);
+    return runControlPlaneInit(context, parsed.options);
+  }
+  if (parsed.rest.length > 0)
+    throw new CliError2(`Unexpected arguments: ${parsed.rest.join(" ")}
+Usage: rig init`, 1);
+  return runInteractiveControlPlaneInit(context, await loadClackPrompts());
+}
+export {
+  runInteractiveControlPlaneInit,
+  executeInit,
+  buildRigInitConfigSource
+};