@h-rig/cli 0.0.6-alpha.0

package/dist/src/commands/setup.js

@@ -0,0 +1,681 @@
+// @bun
+var __require = import.meta.require;
+
+// packages/cli/src/commands/setup.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readdirSync, writeFileSync as writeFileSync2 } from "fs";
+import { resolve as resolve5 } from "path";
+
+// packages/cli/src/runner.ts
+import { EventBus } from "@rig/runtime/control-plane/runtime/events";
+import { CliError } from "@rig/runtime/control-plane/errors";
+import { evaluate, loadPolicy, resolveAction } from "@rig/runtime/control-plane/runtime/guard";
+import { PluginManager } from "@rig/runtime/control-plane/runtime/plugins";
+import { loadRuntimeContextFromEnv } from "@rig/runtime/control-plane/runtime/context";
+import { buildBinary } from "@rig/runtime/control-plane/runtime/isolation";
+import { CliError as CliError2 } from "@rig/runtime/control-plane/errors";
+function requireNoExtraArgs(args, usage) {
+  if (args.length > 0) {
+    throw new CliError(`Unexpected arguments: ${args.join(" ")}
+Usage: ${usage}`);
+  }
+}
+
+// packages/cli/src/commands/setup.ts
+import { createPluginHost } from "@rig/core";
+import {
+  isSupportedBunVersion as isSupportedBunVersion2,
+  MIN_SUPPORTED_BUN_VERSION as MIN_SUPPORTED_BUN_VERSION2
+} from "@rig/runtime/control-plane/setup-version";
+
+// packages/cli/src/withMutedConsole.ts
+function isPromise(value) {
+  if (typeof value !== "object" && typeof value !== "function") {
+    return false;
+  }
+  return value !== null && typeof value.then === "function";
+}
+function withMutedConsole(mute, fn) {
+  if (!mute) {
+    return fn();
+  }
+  const originalLog = console.log;
+  const originalWarn = console.warn;
+  const originalInfo = console.info;
+  const restore = () => {
+    console.log = originalLog;
+    console.warn = originalWarn;
+    console.info = originalInfo;
+  };
+  console.log = () => {};
+  console.warn = () => {};
+  console.info = () => {};
+  try {
+    const result = fn();
+    if (isPromise(result)) {
+      return result.finally(restore);
+    }
+    restore();
+    return result;
+  } catch (error) {
+    restore();
+    throw error;
+  } finally {
+    if (console.log === originalLog) {
+      restore();
+    }
+  }
+}
+
+// packages/cli/src/commands/_parsers.ts
+async function loadRigConfigOrNull(projectRoot) {
+  try {
+    const { loadConfig } = await import("@rig/core/load-config");
+    return await loadConfig(projectRoot);
+  } catch {
+    return null;
+  }
+}
+
+// packages/cli/src/commands/_paths.ts
+import { resolve } from "path";
+import { resolveMonorepoRoot } from "@rig/runtime/control-plane/native/utils";
+function resolveControlPlaneMonorepoRoot(projectRoot) {
+  return resolveMonorepoRoot(projectRoot);
+}
+function resolveControlPlaneHostStateRoot(projectRoot) {
+  return resolve(projectRoot, ".rig");
+}
+function resolveControlPlaneHostStateDir(projectRoot) {
+  return resolve(resolveControlPlaneHostStateRoot(projectRoot), "state");
+}
+function resolveControlPlaneHostLogsDir(projectRoot) {
+  return resolve(resolveControlPlaneHostStateRoot(projectRoot), "logs");
+}
+function resolveControlPlaneArtifactsDir(projectRoot) {
+  return resolve(resolveControlPlaneMonorepoRoot(projectRoot), "artifacts");
+}
+function resolveControlPlaneDefinitionRoot(projectRoot) {
+  return resolve(projectRoot, "rig");
+}
+
+// packages/cli/src/commands/_pi-install.ts
+import { existsSync, readFileSync, rmSync } from "fs";
+import { homedir } from "os";
+import { resolve as resolve2 } from "path";
+var PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
+async function defaultCommandRunner(command, options = {}) {
+  const proc = Bun.spawn(command, { cwd: options.cwd, stdout: "pipe", stderr: "pipe" });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited
+  ]);
+  return { exitCode, stdout, stderr };
+}
+function resolvePiRigExtensionPath(homeDir) {
+  return resolve2(homeDir, ".pi", "agent", "extensions", "pi-rig");
+}
+function resolvePiHomeDir(inputHomeDir) {
+  return inputHomeDir ?? process.env.RIG_PI_HOME_DIR?.trim() ?? homedir();
+}
+function piListContainsPiRig(output) {
+  return output.split(/\r?\n/).some((line) => {
+    const normalized = line.trim();
+    return normalized.includes(PI_RIG_PACKAGE_NAME) || /(?:^|[\\/])packages[\\/]pi-rig(?:$|\s)/.test(normalized);
+  });
+}
+async function safeRun(runner, command, options) {
+  try {
+    return await runner(command, options);
+  } catch (error) {
+    return { exitCode: 1, stdout: "", stderr: error instanceof Error ? error.message : String(error) };
+  }
+}
+async function checkPiRigInstall(input = {}) {
+  const home = resolvePiHomeDir(input.homeDir);
+  const extensionPath = resolvePiRigExtensionPath(home);
+  if (process.env.RIG_TEST_FAKE_PI_INSTALL === "1") {
+    return {
+      extensionPath,
+      pi: { ok: true, label: "pi", detail: "fake-pi" },
+      piRig: { ok: true, label: "pi-rig global extension", detail: extensionPath }
+    };
+  }
+  const exists = input.exists ?? existsSync;
+  const runner = input.commandRunner ?? defaultCommandRunner;
+  const piResult = await safeRun(runner, ["pi", "--version"]);
+  const piListResult = piResult.exitCode === 0 ? await safeRun(runner, ["pi", "list"]) : { exitCode: 1, stdout: "", stderr: "" };
+  const listedPiRig = piListResult.exitCode === 0 && piListContainsPiRig(`${piListResult.stdout}
+${piListResult.stderr}`);
+  const legacyBridge = exists(resolve2(extensionPath, "index.ts"));
+  const hasPiRig = listedPiRig;
+  return {
+    extensionPath,
+    pi: {
+      ok: piResult.exitCode === 0,
+      label: "pi",
+      detail: (piResult.stdout || piResult.stderr).trim() || undefined,
+      hint: piResult.exitCode === 0 ? undefined : "Install Pi or run `rig init --yes` to install/update the Pi runtime."
+    },
+    piRig: {
+      ok: hasPiRig,
+      label: "pi-rig global extension",
+      detail: hasPiRig ? piListResult.stdout.trim() || PI_RIG_PACKAGE_NAME : legacyBridge ? `${extensionPath} (legacy bridge; reinstall required)` : undefined,
+      hint: hasPiRig ? undefined : "Run `rig init --yes` to install/enable the global pi-rig package with `pi install`."
+    }
+  };
+}
+async function buildPiSetupChecks(input = {}) {
+  const status = await checkPiRigInstall(input);
+  return [status.pi, status.piRig];
+}
+
+// packages/cli/src/commands/_doctor-checks.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { resolve as resolve4 } from "path";
+import { isSupportedBunVersion, MIN_SUPPORTED_BUN_VERSION } from "@rig/runtime/control-plane/setup-version";
+
+// packages/cli/src/commands/_connection-state.ts
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname, resolve as resolve3 } from "path";
+function resolveGlobalConnectionsPath(env = process.env) {
+  const explicit = env.RIG_CONNECTIONS_FILE?.trim();
+  if (explicit)
+    return resolve3(explicit);
+  const stateDir = env.RIG_GLOBAL_STATE_DIR?.trim();
+  if (stateDir)
+    return resolve3(stateDir, "connections.json");
+  return resolve3(homedir2(), ".rig", "connections.json");
+}
+function resolveRepoConnectionPath(projectRoot) {
+  return resolve3(projectRoot, ".rig", "state", "connection.json");
+}
+function readJsonFile(path) {
+  if (!existsSync2(path))
+    return null;
+  try {
+    return JSON.parse(readFileSync2(path, "utf8"));
+  } catch (error) {
+    throw new CliError2(`Invalid Rig connection state at ${path}: ${error instanceof Error ? error.message : String(error)}`, 1);
+  }
+}
+function normalizeConnection(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const record = value;
+  if (record.kind === "local")
+    return { kind: "local", mode: "auto" };
+  if (record.kind === "remote" && typeof record.baseUrl === "string" && record.baseUrl.trim()) {
+    const baseUrl = record.baseUrl.trim().replace(/\/+$/, "");
+    return { kind: "remote", baseUrl };
+  }
+  return null;
+}
+function readGlobalConnections(options = {}) {
+  const path = resolveGlobalConnectionsPath(options.env ?? process.env);
+  const payload = readJsonFile(path);
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return { connections: {} };
+  }
+  const rawConnections = payload.connections;
+  const connections = {};
+  if (rawConnections && typeof rawConnections === "object" && !Array.isArray(rawConnections)) {
+    for (const [alias, raw] of Object.entries(rawConnections)) {
+      const connection = normalizeConnection(raw);
+      if (connection)
+        connections[alias] = connection;
+    }
+  }
+  return { connections };
+}
+function readRepoConnection(projectRoot) {
+  const payload = readJsonFile(resolveRepoConnectionPath(projectRoot));
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return null;
+  const record = payload;
+  const selected = typeof record.selected === "string" ? record.selected.trim() : "";
+  if (!selected)
+    return null;
+  return {
+    selected,
+    project: typeof record.project === "string" ? record.project : undefined,
+    linkedAt: typeof record.linkedAt === "string" ? record.linkedAt : undefined
+  };
+}
+function resolveSelectedConnection(projectRoot, options = {}) {
+  const repo = readRepoConnection(projectRoot);
+  if (!repo)
+    return null;
+  if (repo.selected === "local")
+    return { alias: "local", connection: { kind: "local", mode: "auto" } };
+  const global = readGlobalConnections(options);
+  const connection = global.connections[repo.selected];
+  if (!connection) {
+    throw new CliError2(`Selected Rig connection "${repo.selected}" was not found. Run \`rig connect list\` or \`rig connect use local\`.`, 1);
+  }
+  return { alias: repo.selected, connection };
+}
+
+// packages/cli/src/commands/_server-client.ts
+import { spawnSync } from "child_process";
+import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
+var cachedGitHubBearerToken;
+function cleanToken(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : null;
+}
+function readGitHubBearerTokenForRemote() {
+  if (cachedGitHubBearerToken !== undefined)
+    return cachedGitHubBearerToken;
+  const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
+  if (envToken) {
+    cachedGitHubBearerToken = envToken;
+    return cachedGitHubBearerToken;
+  }
+  const result = spawnSync("gh", ["auth", "token"], {
+    encoding: "utf8",
+    timeout: 5000,
+    stdio: ["ignore", "pipe", "ignore"]
+  });
+  cachedGitHubBearerToken = result.status === 0 ? cleanToken(result.stdout) : null;
+  return cachedGitHubBearerToken;
+}
+async function ensureServerForCli(projectRoot) {
+  try {
+    const selected = resolveSelectedConnection(projectRoot);
+    if (selected?.connection.kind === "remote") {
+      return {
+        baseUrl: selected.connection.baseUrl,
+        authToken: readGitHubBearerTokenForRemote(),
+        connectionKind: "remote"
+      };
+    }
+    const connection = await ensureLocalRigServerConnection(projectRoot);
+    return {
+      baseUrl: connection.baseUrl,
+      authToken: connection.authToken,
+      connectionKind: "local"
+    };
+  } catch (error) {
+    if (error instanceof Error) {
+      throw new CliError2(error.message, 1);
+    }
+    throw error;
+  }
+}
+function mergeHeaders(headers, authToken) {
+  const merged = new Headers(headers);
+  if (authToken) {
+    merged.set("authorization", `Bearer ${authToken}`);
+  }
+  return merged;
+}
+function diagnosticMessage(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return null;
+  const record = payload;
+  const diagnostics = Array.isArray(record.diagnostics) ? record.diagnostics : [];
+  const messages = diagnostics.flatMap((entry) => {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry))
+      return [];
+    const diagnostic = entry;
+    const kind = typeof diagnostic.kind === "string" ? diagnostic.kind : "task-source";
+    const message = typeof diagnostic.message === "string" ? diagnostic.message : null;
+    return message ? [`${kind}: ${message}`] : [];
+  });
+  return messages.length > 0 ? messages.join("; ") : null;
+}
+async function requestServerJson(context, pathname, init = {}) {
+  const server = await ensureServerForCli(context.projectRoot);
+  const response = await fetch(`${server.baseUrl}${pathname}`, {
+    ...init,
+    headers: mergeHeaders(init.headers, server.authToken)
+  });
+  const text = await response.text();
+  const payload = text.trim().length > 0 ? (() => {
+    try {
+      return JSON.parse(text);
+    } catch {
+      return null;
+    }
+  })() : null;
+  if (!response.ok) {
+    const diagnostics = diagnosticMessage(payload);
+    const detail = diagnostics ?? (text || response.statusText);
+    throw new CliError2(`Rig server request failed (${response.status}): ${detail}`, 1);
+  }
+  return payload;
+}
+
+// packages/cli/src/commands/_doctor-checks.ts
+function check(id, label, status, detail, remediation) {
+  return {
+    id,
+    label,
+    status,
+    ...detail ? { detail } : {},
+    ...remediation ? { remediation } : {}
+  };
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function isAuthenticated(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return false;
+  const record = payload;
+  return record.signedIn === true || record.authenticated === true || record.status === "authenticated" || record.ok === true && typeof record.login === "string" && record.login.trim().length > 0;
+}
+function repoSlugFromConfig(config) {
+  const project = config?.project;
+  if (project && typeof project === "object" && !Array.isArray(project)) {
+    const record = project;
+    if (typeof record.repo === "string" && /^([^/\s]+)\/([^/\s]+)$/.test(record.repo))
+      return record.repo;
+    if (typeof record.name === "string" && /^([^/\s]+)\/([^/\s]+)$/.test(record.name))
+      return record.name;
+  }
+  const taskSource = config?.taskSource;
+  if (taskSource && typeof taskSource === "object" && !Array.isArray(taskSource)) {
+    const source = taskSource;
+    if (typeof source.owner === "string" && typeof source.repo === "string")
+      return `${source.owner}/${source.repo}`;
+  }
+  return null;
+}
+function loadFallbackConfig(projectRoot) {
+  const candidates = ["rig.config.ts", "rig.config.mts", "rig.config.json"];
+  for (const name of candidates) {
+    const path = resolve4(projectRoot, name);
+    if (!existsSync3(path))
+      continue;
+    try {
+      const source = readFileSync3(path, "utf8");
+      if (name.endsWith(".json"))
+        return JSON.parse(source);
+      const owner = source.match(/owner\s*:\s*["']([^"']+)["']/)?.[1];
+      const repo = source.match(/repo\s*:\s*["']([^"']+)["']/)?.[1];
+      const projectRepo = source.match(/project\s*:\s*\{[^}]*repo\s*:\s*["']([^"']+)["']/s)?.[1] ?? (owner && repo ? `${owner}/${repo}` : undefined);
+      const taskKind = source.match(/taskSource\s*:\s*\{[^}]*kind\s*:\s*["']([^"']+)["']/s)?.[1];
+      if (projectRepo || taskKind) {
+        return {
+          ...projectRepo ? { project: { name: projectRepo, repo: projectRepo } } : {},
+          ...taskKind ? { taskSource: { kind: taskKind, ...owner ? { owner } : {}, ...repo ? { repo } : {} } } : {}
+        };
+      }
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function projectStatusSlug(projectRoot, config) {
+  return readRepoConnection(projectRoot)?.project ?? repoSlugFromConfig(config);
+}
+function githubProjectsCheck(config) {
+  const github = config?.github;
+  const projects = github?.projects;
+  if (!projects?.enabled) {
+    return check("github-projects", "GitHub Projects status sync", "warn", "disabled or not configured", "Run `rig init --github-project <project>` or configure github.projects when Project status sync should be authoritative.");
+  }
+  if (projects.projectId && projects.statusFieldId) {
+    return check("github-projects", "GitHub Projects status sync", "pass", `project ${projects.projectId}`);
+  }
+  return check("github-projects", "GitHub Projects status sync", "fail", "enabled but projectId/statusFieldId is incomplete", "Configure github.projects.projectId and github.projects.statusFieldId, or disable github.projects.enabled.");
+}
+function permissionAllowsPr(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return null;
+  const record = payload;
+  if (record.canOpenPullRequest === true || record.pullRequests === true || record.push === true || record.maintain === true || record.admin === true)
+    return true;
+  if (record.canOpenPullRequest === false || record.pullRequests === false || record.push === false)
+    return false;
+  const permissions = record.permissions;
+  if (permissions && typeof permissions === "object" && !Array.isArray(permissions)) {
+    const p = permissions;
+    if (p.push === true || p.maintain === true || p.admin === true)
+      return true;
+    if (p.push === false && p.maintain !== true && p.admin !== true)
+      return false;
+  }
+  return null;
+}
+function labelsReady(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return null;
+  const record = payload;
+  if (record.ok === true || record.ready === true || record.labelsReady === true)
+    return true;
+  if (record.ok === false || record.ready === false || record.labelsReady === false)
+    return false;
+  return null;
+}
+function prMergeCheck(config) {
+  const pr = config?.pr;
+  const merge = config?.merge;
+  if (pr?.mode === "off" || merge?.mode === "off") {
+    return check("pr-merge", "PR/merge automation", "warn", "automatic PR or merge is disabled", "Set pr.mode and merge.mode to auto for autonomous YOLO runs.");
+  }
+  return check("pr-merge", "PR/merge automation", "pass", `pr=${pr?.mode ?? "auto"}, merge=${merge?.mode ?? "auto"}, method=${merge?.method ?? "repo-default"}`);
+}
+async function runRigDoctorChecks(options) {
+  const projectRoot = options.projectRoot;
+  const checks = [];
+  const which = options.which ?? ((binary) => Bun.which(binary));
+  const bunVersion = options.bunVersion ?? Bun.version;
+  const request = options.requestJson ?? ((pathname, init) => requestServerJson({ projectRoot }, pathname, init));
+  const loadConfig = options.loadConfig ?? loadRigConfigOrNull;
+  checks.push(check("bun", `bun >= ${MIN_SUPPORTED_BUN_VERSION}`, isSupportedBunVersion(bunVersion) ? "pass" : "fail", `found ${bunVersion}`, `Install Bun ${MIN_SUPPORTED_BUN_VERSION} or newer.`), check("git", "git", which("git") ? "pass" : "fail", which("git") ?? undefined, "Install git and ensure it is on PATH."), check("jq", "jq", which("jq") ? "pass" : "warn", which("jq") ?? undefined, "Install jq (for example `brew install jq`)."));
+  const loadedConfig = await loadConfig(projectRoot).catch(() => null);
+  const config = loadedConfig ?? loadFallbackConfig(projectRoot);
+  const hasConfigFile = ["rig.config.ts", "rig.config.mts", "rig.config.json"].some((name) => existsSync3(resolve4(projectRoot, name)));
+  checks.push(config ? check("config", "rig.config loadable", "pass") : check("config", "rig.config loadable", hasConfigFile ? "fail" : "fail", hasConfigFile ? "config file exists but failed to load" : "missing rig.config.ts/json", "Run `rig init` or fix the config error."));
+  const taskSourceKind = config?.taskSource?.kind;
+  checks.push(taskSourceKind ? check("task-source", "task source configured", "pass", taskSourceKind) : check("task-source", "task source configured", "fail", "missing taskSource", "Configure taskSource in rig.config.ts."));
+  const repo = readRepoConnection(projectRoot);
+  checks.push(repo ? check("project-link", "repo selected Rig connection", repo.project ? "pass" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : ""}`, "Run `rig init --yes --repo owner/repo` to link this checkout to a GitHub repo slug.") : check("project-link", "repo selected Rig connection", "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig connect use <alias|local>`."));
+  const selected = (() => {
+    try {
+      return resolveSelectedConnection(projectRoot);
+    } catch {
+      return null;
+    }
+  })();
+  checks.push(selected ? check("connection", "selected server connection", "pass", selected.connection.kind === "remote" ? selected.connection.baseUrl : "local auto") : check("connection", "selected server connection", repo ? "fail" : "warn", repo ? "selected alias is missing" : "will auto-start local server", repo ? "Run `rig connect list` and `rig connect use <alias|local>`." : undefined));
+  let server = null;
+  try {
+    server = await (options.resolveServer ?? ensureServerForCli)(projectRoot);
+    checks.push(check("server", "Rig server reachable", "pass", `${server.connectionKind} ${server.baseUrl}`));
+  } catch (error) {
+    checks.push(check("server", "Rig server reachable", "fail", errorMessage(error), "Start the local Rig server or fix the selected remote connection."));
+  }
+  if (server || options.requestJson) {
+    try {
+      const status = await request("/api/server/status");
+      checks.push(check("server-status", "server project status", "pass", JSON.stringify(status).slice(0, 180)));
+    } catch (error) {
+      checks.push(check("server-status", "server project status", "fail", errorMessage(error), "Run `rig doctor` after the selected server is reachable."));
+    }
+    try {
+      const auth = await request("/api/github/auth/status");
+      checks.push(isAuthenticated(auth) ? check("github-auth", "GitHub auth", "pass") : check("github-auth", "GitHub auth", "fail", "not authenticated", "Run `rig github auth import-gh` or `rig github auth token --token <token>`."));
+    } catch (error) {
+      checks.push(check("github-auth", "GitHub auth", "fail", errorMessage(error), "Authenticate GitHub through Rig and ensure the server exposes auth status."));
+    }
+    try {
+      const permissions = await request("/api/github/repo/permissions");
+      const allowed = permissionAllowsPr(permissions);
+      checks.push(allowed === true ? check("github-repo-permissions", "GitHub repo PR permissions", "pass", JSON.stringify(permissions).slice(0, 180)) : allowed === false ? check("github-repo-permissions", "GitHub repo PR permissions", "fail", JSON.stringify(permissions).slice(0, 180), "Grant the selected GitHub token permission to push branches, open PRs, and merge according to repo rules.") : check("github-repo-permissions", "GitHub repo PR permissions", "warn", JSON.stringify(permissions).slice(0, 180), "Confirm the selected token can push branches and open PRs."));
+    } catch (error) {
+      checks.push(check("github-repo-permissions", "GitHub repo PR permissions", "warn", errorMessage(error), "Ensure the server exposes repo permission checks and the token can open PRs."));
+    }
+    try {
+      const labels = await request("/api/workspace/task-labels");
+      const ready = labelsReady(labels);
+      checks.push(ready === false ? check("task-labels", "GitHub issue labels", "fail", JSON.stringify(labels).slice(0, 180), "Let Rig create required labels or create the configured lifecycle labels manually.") : check("task-labels", "GitHub issue labels", ready === true ? "pass" : "warn", JSON.stringify(labels).slice(0, 180), "Confirm required Rig lifecycle labels exist."));
+    } catch (error) {
+      checks.push(check("task-labels", "GitHub issue labels", "warn", errorMessage(error), "Run `rig init`/`rig doctor` after label setup is wired on the server."));
+    }
+    try {
+      const projection = await request("/api/workspace/task-projection");
+      checks.push(check("task-projection", "task projection", "pass", JSON.stringify(projection).slice(0, 180)));
+    } catch (error) {
+      checks.push(check("task-projection", "task projection", "warn", errorMessage(error), "Refresh task projection with `rig task list` or fix the task source."));
+    }
+    const slug = projectStatusSlug(projectRoot, config);
+    if (slug) {
+      try {
+        const project = await request(`/api/projects/${encodeURIComponent(slug)}`);
+        checks.push(check("remote-checkout", "server project checkout", "pass", JSON.stringify(project).slice(0, 180)));
+      } catch (error) {
+        checks.push(check("remote-checkout", "server project checkout", "warn", errorMessage(error), "Run `rig init --yes --repo owner/repo` to register/link the server project checkout."));
+      }
+    } else {
+      checks.push(check("remote-checkout", "server project checkout", "warn", "repo slug unknown", "Set project.repo or run `rig init --repo owner/repo`."));
+    }
+  }
+  if (taskSourceKind === "github-issues") {
+    checks.push(check("gh", "gh CLI fallback", which("gh") ? "pass" : "warn", which("gh") ?? undefined, "Install gh for local/dev GitHub fallback operations."));
+  }
+  checks.push(githubProjectsCheck(config));
+  checks.push(prMergeCheck(config));
+  const piChecks = await (options.piChecks ?? (() => buildPiSetupChecks()))().catch((error) => [{
+    ok: false,
+    label: "pi/pi-rig checks",
+    hint: errorMessage(error)
+  }]);
+  for (const pi of piChecks) {
+    checks.push(check(pi.label === "pi" ? "pi" : "pi-rig", pi.label, pi.ok ? "pass" : "warn", pi.detail, pi.hint ?? (pi.ok ? undefined : "Run `rig init --yes` to install/update Pi and enable pi-rig.")));
+  }
+  return checks;
+}
+function formatDoctorChecks(checks) {
+  return checks.map((entry) => {
+    const prefix = entry.status.toUpperCase();
+    const detail = entry.detail ? ` \u2014 ${entry.detail}` : "";
+    const remediation = entry.remediation && entry.status !== "pass" ? ` (${entry.remediation})` : "";
+    return `${prefix}: ${entry.label}${detail}${remediation}`;
+  }).join(`
+`);
+}
+function countDoctorFailures(checks) {
+  return checks.filter((entry) => entry.status === "fail").length;
+}
+
+// packages/cli/src/commands/setup.ts
+async function executeSetup(context, args) {
+  const [command = "check", ...rest] = args;
+  switch (command) {
+    case "bootstrap":
+      requireNoExtraArgs(rest, "bun run rig setup bootstrap");
+      {
+        const hostBash = Bun.which("bash") || "/bin/bash";
+        const env = { ...process.env };
+        delete env.BASH;
+        delete env.RIG_BASH_MODE;
+        delete env.RIG_TASK_ID;
+        delete env.RIG_TASK_RUNTIME_ID;
+        delete env.RIG_TASK_WORKSPACE;
+        const proc = Bun.spawn([hostBash, "./bootstrap.sh"], {
+          cwd: context.projectRoot,
+          env,
+          stdin: "inherit",
+          stdout: "inherit",
+          stderr: "inherit"
+        });
+        const exitCode = await proc.exited;
+        if (exitCode !== 0) {
+          throw new CliError2(`Command failed (${exitCode}): ${hostBash} ./bootstrap.sh`, exitCode);
+        }
+      }
+      return { ok: true, group: "setup", command };
+    case "check":
+      requireNoExtraArgs(rest, `bun run rig setup ${command}`);
+      {
+        const checks = await withMutedConsole(context.outputMode === "json", () => runSetupCheck(context.projectRoot));
+        return { ok: true, group: "setup", command, details: { checks, failures: countDoctorFailures(checks) } };
+      }
+    case "setup":
+      requireNoExtraArgs(rest, "bun run rig setup setup");
+      withMutedConsole(context.outputMode === "json", () => runSetupInit(context.projectRoot));
+      return { ok: true, group: "setup", command };
+    case "preflight":
+      requireNoExtraArgs(rest, "bun run rig setup preflight");
+      await withMutedConsole(context.outputMode === "json", () => runSetupPreflight(context.projectRoot));
+      return { ok: true, group: "setup", command };
+    case "install-agent-shell":
+      requireNoExtraArgs(rest, "bun run rig setup install-agent-shell");
+      if (context.outputMode === "text") {
+        console.log("install-agent-shell is deprecated. Runtime shells now use compiled rig-agent directly.");
+      }
+      return { ok: true, group: "setup", command };
+    default:
+      throw new CliError2(`Unknown setup command: ${command}`);
+  }
+}
+function formatTaskSourceKinds(kinds) {
+  return kinds.length > 0 ? kinds.join(", ") : "none";
+}
+function buildTaskSourceKindSetupCheck(config) {
+  if (!config.taskSource)
+    return null;
+  const kind = config.taskSource.kind;
+  const pluginHost = createPluginHost(config.plugins ?? []);
+  const registeredKinds = pluginHost.listExecutableTaskSources().map((source) => source.kind);
+  const isRegistered = Boolean(pluginHost.resolveTaskSourceFactoryByKind(kind));
+  return {
+    ok: isRegistered,
+    label: `task source kind "${kind}" registered`,
+    hint: isRegistered ? undefined : `registered kinds: ${formatTaskSourceKinds(registeredKinds)}; load a plugin that contributes an executable task source factory for "${kind}"`
+  };
+}
+function runSetupInit(projectRoot) {
+  const stateDir = resolveControlPlaneHostStateDir(projectRoot);
+  const logsDir = resolveControlPlaneHostLogsDir(projectRoot);
+  const artifactsDir = resolveControlPlaneArtifactsDir(projectRoot);
+  mkdirSync2(stateDir, { recursive: true });
+  mkdirSync2(logsDir, { recursive: true });
+  mkdirSync2(artifactsDir, { recursive: true });
+  const failuresPath = resolve5(stateDir, "failed_approaches.md");
+  if (!existsSync4(failuresPath)) {
+    writeFileSync2(failuresPath, `# Failed Approaches
+
+`, "utf-8");
+  }
+  console.log("Harness directories ready.");
+}
+async function runSetupCheck(projectRoot) {
+  const doctorChecks = await runRigDoctorChecks({ projectRoot });
+  console.log(formatDoctorChecks(doctorChecks));
+  const failures = countDoctorFailures(doctorChecks);
+  if (failures > 0) {
+    throw new CliError2(`Setup check failed (${failures} failing doctor check${failures === 1 ? "" : "s"}).`, 1);
+  }
+  return doctorChecks;
+}
+async function runSetupPreflight(projectRoot) {
+  await runSetupCheck(projectRoot);
+  const validationRoot = resolve5(resolveControlPlaneDefinitionRoot(projectRoot), "validation");
+  if (existsSync4(validationRoot)) {
+    const validators = readdirSync(validationRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory());
+    for (const validator of validators) {
+      const script = resolve5(validationRoot, validator.name, "validate.sh");
+      if (existsSync4(script)) {
+        console.log(`OK: validator script ${script}`);
+      }
+    }
+  }
+  const hooksRoot = resolve5(resolveControlPlaneDefinitionRoot(projectRoot), "hooks");
+  if (existsSync4(hooksRoot)) {
+    const hooks = readdirSync(hooksRoot).filter((name) => name.endsWith(".sh"));
+    for (const hook of hooks) {
+      console.log(`OK: hook ${hook}`);
+    }
+  }
+}
+export {
+  executeSetup,
+  buildTaskSourceKindSetupCheck
+};