@h-rig/cli 0.0.6-alpha.1 → 0.0.6-alpha.11

package/dist/src/commands/_authority-runs.js

@@ -67,6 +67,7 @@ function upsertAgentAuthorityRun(projectRoot, input) {
   const runtimeAdapter = normalizeRuntimeAdapter(input.runtimeAdapter ?? existing?.runtimeAdapter ?? "claude-code");
   const title = resolveTaskTitleForAuthorityRun(projectRoot, input.taskId) ?? input.taskId;
   const next = {
+    ...existing ?? {},
     runId: input.runId,
     projectRoot,
     workspaceId: existing?.workspaceId ?? RIG_WORKSPACE_ID,

package/dist/src/commands/_doctor-checks.js

@@ -2,8 +2,8 @@
 var __require = import.meta.require;
 
 // packages/cli/src/commands/_doctor-checks.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { resolve as resolve3 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { resolve as resolve4 } from "path";
 
 // packages/cli/src/runner.ts
 import { EventBus } from "@rig/runtime/control-plane/runtime/events";
@@ -101,15 +101,33 @@ function resolveSelectedConnection(projectRoot, options = {}) {
 
 // packages/cli/src/commands/_server-client.ts
 import { spawnSync } from "child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve2 } from "path";
 import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
 var cachedGitHubBearerToken;
 function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
 }
-function readGitHubBearerTokenForRemote() {
+function readPrivateRemoteSessionToken(projectRoot) {
+  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
+  if (!existsSync2(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
+  } catch {
+    return null;
+  }
+}
+function readGitHubBearerTokenForRemote(projectRoot) {
   if (cachedGitHubBearerToken !== undefined)
     return cachedGitHubBearerToken;
+  const privateSession = readPrivateRemoteSessionToken(projectRoot);
+  if (privateSession) {
+    cachedGitHubBearerToken = privateSession;
+    return cachedGitHubBearerToken;
+  }
   const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
   if (envToken) {
     cachedGitHubBearerToken = envToken;
@@ -129,7 +147,7 @@ async function ensureServerForCli(projectRoot) {
     if (selected?.connection.kind === "remote") {
       return {
         baseUrl: selected.connection.baseUrl,
-        authToken: readGitHubBearerTokenForRemote(),
+        authToken: readGitHubBearerTokenForRemote(projectRoot),
         connectionKind: "remote"
       };
     }
@@ -201,9 +219,9 @@ async function loadRigConfigOrNull(projectRoot) {
 }
 
 // packages/cli/src/commands/_pi-install.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, rmSync } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3, rmSync } from "fs";
 import { homedir as homedir2 } from "os";
-import { resolve as resolve2 } from "path";
+import { resolve as resolve3 } from "path";
 var PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
 async function defaultCommandRunner(command, options = {}) {
   const proc = Bun.spawn(command, { cwd: options.cwd, stdout: "pipe", stderr: "pipe" });
@@ -215,7 +233,7 @@ async function defaultCommandRunner(command, options = {}) {
   return { exitCode, stdout, stderr };
 }
 function resolvePiRigExtensionPath(homeDir) {
-  return resolve2(homeDir, ".pi", "agent", "extensions", "pi-rig");
+  return resolve3(homeDir, ".pi", "agent", "extensions", "pi-rig");
 }
 function resolvePiHomeDir(inputHomeDir) {
   return inputHomeDir ?? process.env.RIG_PI_HOME_DIR?.trim() ?? homedir2();
@@ -243,13 +261,13 @@ async function checkPiRigInstall(input = {}) {
       piRig: { ok: true, label: "pi-rig global extension", detail: extensionPath }
     };
   }
-  const exists = input.exists ?? existsSync2;
+  const exists = input.exists ?? existsSync3;
   const runner = input.commandRunner ?? defaultCommandRunner;
   const piResult = await safeRun(runner, ["pi", "--version"]);
   const piListResult = piResult.exitCode === 0 ? await safeRun(runner, ["pi", "list"]) : { exitCode: 1, stdout: "", stderr: "" };
   const listedPiRig = piListResult.exitCode === 0 && piListContainsPiRig(`${piListResult.stdout}
 ${piListResult.stderr}`);
-  const legacyBridge = exists(resolve2(extensionPath, "index.ts"));
+  const legacyBridge = exists(resolve3(extensionPath, "index.ts"));
   const hasPiRig = listedPiRig;
   return {
     extensionPath,
@@ -311,11 +329,11 @@ function repoSlugFromConfig(config) {
 function loadFallbackConfig(projectRoot) {
   const candidates = ["rig.config.ts", "rig.config.mts", "rig.config.json"];
   for (const name of candidates) {
-    const path = resolve3(projectRoot, name);
-    if (!existsSync3(path))
+    const path = resolve4(projectRoot, name);
+    if (!existsSync4(path))
       continue;
     try {
-      const source = readFileSync3(path, "utf8");
+      const source = readFileSync4(path, "utf8");
       if (name.endsWith(".json"))
         return JSON.parse(source);
       const owner = source.match(/owner\s*:\s*["']([^"']+)["']/)?.[1];
@@ -394,7 +412,7 @@ async function runRigDoctorChecks(options) {
   checks.push(check("bun", `bun >= ${MIN_SUPPORTED_BUN_VERSION}`, isSupportedBunVersion(bunVersion) ? "pass" : "fail", `found ${bunVersion}`, `Install Bun ${MIN_SUPPORTED_BUN_VERSION} or newer.`), check("git", "git", which("git") ? "pass" : "fail", which("git") ?? undefined, "Install git and ensure it is on PATH."), check("jq", "jq", which("jq") ? "pass" : "warn", which("jq") ?? undefined, "Install jq (for example `brew install jq`)."));
   const loadedConfig = await loadConfig(projectRoot).catch(() => null);
   const config = loadedConfig ?? loadFallbackConfig(projectRoot);
-  const hasConfigFile = ["rig.config.ts", "rig.config.mts", "rig.config.json"].some((name) => existsSync3(resolve3(projectRoot, name)));
+  const hasConfigFile = ["rig.config.ts", "rig.config.mts", "rig.config.json"].some((name) => existsSync4(resolve4(projectRoot, name)));
   checks.push(config ? check("config", "rig.config loadable", "pass") : check("config", "rig.config loadable", hasConfigFile ? "fail" : "fail", hasConfigFile ? "config file exists but failed to load" : "missing rig.config.ts/json", "Run `rig init` or fix the config error."));
   const taskSourceKind = config?.taskSource?.kind;
   checks.push(taskSourceKind ? check("task-source", "task source configured", "pass", taskSourceKind) : check("task-source", "task source configured", "fail", "missing taskSource", "Configure taskSource in rig.config.ts."));

package/dist/src/commands/_operator-view.js

@@ -4,6 +4,8 @@ import { createInterface } from "readline";
 
 // packages/cli/src/commands/_server-client.ts
 import { spawnSync } from "child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve2 } from "path";
 
 // packages/cli/src/runner.ts
 import { EventBus } from "@rig/runtime/control-plane/runtime/events";
@@ -105,9 +107,25 @@ function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
 }
-function readGitHubBearerTokenForRemote() {
+function readPrivateRemoteSessionToken(projectRoot) {
+  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
+  if (!existsSync2(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
+  } catch {
+    return null;
+  }
+}
+function readGitHubBearerTokenForRemote(projectRoot) {
   if (cachedGitHubBearerToken !== undefined)
     return cachedGitHubBearerToken;
+  const privateSession = readPrivateRemoteSessionToken(projectRoot);
+  if (privateSession) {
+    cachedGitHubBearerToken = privateSession;
+    return cachedGitHubBearerToken;
+  }
   const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
   if (envToken) {
     cachedGitHubBearerToken = envToken;
@@ -127,7 +145,7 @@ async function ensureServerForCli(projectRoot) {
     if (selected?.connection.kind === "remote") {
       return {
         baseUrl: selected.connection.baseUrl,
-        authToken: readGitHubBearerTokenForRemote(),
+        authToken: readGitHubBearerTokenForRemote(projectRoot),
         connectionKind: "remote"
       };
     }

package/dist/src/commands/_preflight.js

@@ -95,15 +95,33 @@ function resolveSelectedConnection(projectRoot, options = {}) {
 
 // packages/cli/src/commands/_server-client.ts
 import { spawnSync } from "child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve2 } from "path";
 import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
 var cachedGitHubBearerToken;
 function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
 }
-function readGitHubBearerTokenForRemote() {
+function readPrivateRemoteSessionToken(projectRoot) {
+  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
+  if (!existsSync2(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
+  } catch {
+    return null;
+  }
+}
+function readGitHubBearerTokenForRemote(projectRoot) {
   if (cachedGitHubBearerToken !== undefined)
     return cachedGitHubBearerToken;
+  const privateSession = readPrivateRemoteSessionToken(projectRoot);
+  if (privateSession) {
+    cachedGitHubBearerToken = privateSession;
+    return cachedGitHubBearerToken;
+  }
   const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
   if (envToken) {
     cachedGitHubBearerToken = envToken;
@@ -123,7 +141,7 @@ async function ensureServerForCli(projectRoot) {
     if (selected?.connection.kind === "remote") {
       return {
         baseUrl: selected.connection.baseUrl,
-        authToken: readGitHubBearerTokenForRemote(),
+        authToken: readGitHubBearerTokenForRemote(projectRoot),
         connectionKind: "remote"
       };
     }
@@ -185,9 +203,9 @@ async function requestServerJson(context, pathname, init = {}) {
 }
 
 // packages/cli/src/commands/_pi-install.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, rmSync } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3, rmSync } from "fs";
 import { homedir as homedir2 } from "os";
-import { resolve as resolve2 } from "path";
+import { resolve as resolve3 } from "path";
 var PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
 async function defaultCommandRunner(command, options = {}) {
   const proc = Bun.spawn(command, { cwd: options.cwd, stdout: "pipe", stderr: "pipe" });
@@ -199,7 +217,7 @@ async function defaultCommandRunner(command, options = {}) {
   return { exitCode, stdout, stderr };
 }
 function resolvePiRigExtensionPath(homeDir) {
-  return resolve2(homeDir, ".pi", "agent", "extensions", "pi-rig");
+  return resolve3(homeDir, ".pi", "agent", "extensions", "pi-rig");
 }
 function resolvePiHomeDir(inputHomeDir) {
   return inputHomeDir ?? process.env.RIG_PI_HOME_DIR?.trim() ?? homedir2();
@@ -227,13 +245,13 @@ async function checkPiRigInstall(input = {}) {
       piRig: { ok: true, label: "pi-rig global extension", detail: extensionPath }
     };
   }
-  const exists = input.exists ?? existsSync2;
+  const exists = input.exists ?? existsSync3;
   const runner = input.commandRunner ?? defaultCommandRunner;
   const piResult = await safeRun(runner, ["pi", "--version"]);
   const piListResult = piResult.exitCode === 0 ? await safeRun(runner, ["pi", "list"]) : { exitCode: 1, stdout: "", stderr: "" };
   const listedPiRig = piListResult.exitCode === 0 && piListContainsPiRig(`${piListResult.stdout}
 ${piListResult.stderr}`);
-  const legacyBridge = exists(resolve2(extensionPath, "index.ts"));
+  const legacyBridge = exists(resolve3(extensionPath, "index.ts"));
   const hasPiRig = listedPiRig;
   return {
     extensionPath,

package/dist/src/commands/_server-client.js

@@ -1,6 +1,8 @@
 // @bun
 // packages/cli/src/commands/_server-client.ts
 import { spawnSync } from "child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve2 } from "path";
 
 // packages/cli/src/runner.ts
 import { EventBus } from "@rig/runtime/control-plane/runtime/events";
@@ -105,9 +107,25 @@ function cleanToken(value) {
 function setGitHubBearerTokenForCurrentProcess(token) {
   cachedGitHubBearerToken = cleanToken(token ?? undefined);
 }
-function readGitHubBearerTokenForRemote() {
+function readPrivateRemoteSessionToken(projectRoot) {
+  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
+  if (!existsSync2(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
+  } catch {
+    return null;
+  }
+}
+function readGitHubBearerTokenForRemote(projectRoot) {
   if (cachedGitHubBearerToken !== undefined)
     return cachedGitHubBearerToken;
+  const privateSession = readPrivateRemoteSessionToken(projectRoot);
+  if (privateSession) {
+    cachedGitHubBearerToken = privateSession;
+    return cachedGitHubBearerToken;
+  }
   const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
   if (envToken) {
     cachedGitHubBearerToken = envToken;
@@ -127,7 +145,7 @@ async function ensureServerForCli(projectRoot) {
     if (selected?.connection.kind === "remote") {
       return {
         baseUrl: selected.connection.baseUrl,
-        authToken: readGitHubBearerTokenForRemote(),
+        authToken: readGitHubBearerTokenForRemote(projectRoot),
         connectionKind: "remote"
       };
     }
@@ -234,7 +252,7 @@ async function postGitHubTokenViaServer(context, token, options = {}) {
   const payload = await requestServerJson(context, "/api/github/auth/token", {
     method: "POST",
     headers: { "content-type": "application/json" },
-    body: JSON.stringify({ token, selectedRepo: options.selectedRepo })
+    body: JSON.stringify({ token, selectedRepo: options.selectedRepo, projectRoot: options.projectRoot })
   });
   return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
 }
@@ -255,18 +273,38 @@ async function registerProjectViaServer(context, input) {
   return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
 }
 function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+function isRetryableProjectRootSwitchError(error) {
+  if (!(error instanceof Error))
+    return false;
+  const message = error.message.toLowerCase();
+  return message.includes("rig server request failed (401): auth-required") || message.includes("rig server request failed (401): github-token-required") || message.includes("rig server request failed (502)") || message.includes("rig server request failed (503)") || message.includes("bad gateway") || message.includes("fetch failed") || message.includes("econnrefused") || message.includes("connection refused");
 }
 async function switchServerProjectRootViaServer(context, projectRoot, options = {}) {
-  const switched = await requestServerJson(context, "/api/server/project-root", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ projectRoot })
-  });
   const timeoutMs = options.timeoutMs ?? 30000;
   const pollMs = options.pollMs ?? 1000;
   const deadline = Date.now() + timeoutMs;
   let lastError;
+  let switched = null;
+  while (Date.now() < deadline) {
+    try {
+      switched = await requestServerJson(context, "/api/server/project-root", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ projectRoot })
+      });
+      break;
+    } catch (error) {
+      lastError = error;
+      if (!isRetryableProjectRootSwitchError(error))
+        throw error;
+      await sleep(pollMs);
+    }
+  }
+  if (!switched) {
+    throw new CliError2(`Rig server did not accept project-root switch to ${projectRoot} before timeout (${lastError instanceof Error ? lastError.message : String(lastError ?? "no response")}).`, 1);
+  }
   while (Date.now() < deadline) {
     try {
       const status = await requestServerJson(context, "/api/server/status");

package/dist/src/commands/_snapshot-upload.js

@@ -1,10 +1,12 @@
 // @bun
 // packages/cli/src/commands/_snapshot-upload.ts
 import { mkdir, readdir, readFile, writeFile } from "fs/promises";
-import { dirname as dirname2, resolve as resolve2, relative, sep } from "path";
+import { dirname as dirname2, resolve as resolve3, relative, sep } from "path";
 
 // packages/cli/src/commands/_server-client.ts
 import { spawnSync } from "child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve2 } from "path";
 
 // packages/cli/src/runner.ts
 import { EventBus } from "@rig/runtime/control-plane/runtime/events";
@@ -106,9 +108,25 @@ function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
 }
-function readGitHubBearerTokenForRemote() {
+function readPrivateRemoteSessionToken(projectRoot) {
+  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
+  if (!existsSync2(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
+  } catch {
+    return null;
+  }
+}
+function readGitHubBearerTokenForRemote(projectRoot) {
   if (cachedGitHubBearerToken !== undefined)
     return cachedGitHubBearerToken;
+  const privateSession = readPrivateRemoteSessionToken(projectRoot);
+  if (privateSession) {
+    cachedGitHubBearerToken = privateSession;
+    return cachedGitHubBearerToken;
+  }
   const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
   if (envToken) {
     cachedGitHubBearerToken = envToken;
@@ -128,7 +146,7 @@ async function ensureServerForCli(projectRoot) {
     if (selected?.connection.kind === "remote") {
       return {
         baseUrl: selected.connection.baseUrl,
-        authToken: readGitHubBearerTokenForRemote(),
+        authToken: readGitHubBearerTokenForRemote(projectRoot),
         connectionKind: "remote"
       };
     }
@@ -212,15 +230,15 @@ function assertManifestPath(root, relativePath) {
   if (!relativePath || relativePath.startsWith("/") || relativePath.includes("\x00")) {
     throw new Error(`Invalid snapshot path: ${relativePath}`);
   }
-  const resolved = resolve2(root, relativePath);
+  const resolved = resolve3(root, relativePath);
   const relativeToRoot = relative(root, resolved);
-  if (relativeToRoot.startsWith("..") || relativeToRoot === ".." || resolve2(relativeToRoot) === resolved) {
+  if (relativeToRoot.startsWith("..") || relativeToRoot === ".." || resolve3(relativeToRoot) === resolved) {
     throw new Error(`Snapshot path escapes project root: ${relativePath}`);
   }
   return resolved;
 }
 async function buildSnapshotUploadManifest(projectRoot, options = {}) {
-  const root = resolve2(projectRoot);
+  const root = resolve3(projectRoot);
   const excludedDirectories = [...new Set([
     ...DEFAULT_EXCLUDED_DIRECTORIES,
     ...options.excludedDirectories ?? []
@@ -232,7 +250,7 @@ async function buildSnapshotUploadManifest(projectRoot, options = {}) {
     for (const entry of entries) {
       if (entry.isDirectory() && excludedSet.has(entry.name))
         continue;
-      const fullPath = resolve2(dir, entry.name);
+      const fullPath = resolve3(dir, entry.name);
       if (entry.isDirectory()) {
         await visit(fullPath);
         continue;
@@ -268,7 +286,7 @@ function encodeSnapshotUploadArchive(archive) {
 }
 async function writeSnapshotUploadArchive(projectRoot, outputPath, options = {}) {
   const archive = await createSnapshotUploadArchive(projectRoot, options);
-  const target = resolve2(outputPath);
+  const target = resolve3(outputPath);
   await mkdir(dirname2(target), { recursive: true });
   await writeFile(target, JSON.stringify(archive, null, 2), "utf8");
   return archive;

package/dist/src/commands/agent.js

@@ -126,6 +126,7 @@ function upsertAgentAuthorityRun(projectRoot, input) {
   const runtimeAdapter = normalizeRuntimeAdapter(input.runtimeAdapter ?? existing?.runtimeAdapter ?? "claude-code");
   const title = resolveTaskTitleForAuthorityRun(projectRoot, input.taskId) ?? input.taskId;
   const next = {
+    ...existing ?? {},
     runId: input.runId,
     projectRoot,
     workspaceId: existing?.workspaceId ?? RIG_WORKSPACE_ID,

package/dist/src/commands/doctor.js

@@ -17,8 +17,8 @@ Usage: ${usage}`);
 }
 
 // packages/cli/src/commands/_doctor-checks.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { resolve as resolve3 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { resolve as resolve4 } from "path";
 import { isSupportedBunVersion, MIN_SUPPORTED_BUN_VERSION } from "@rig/runtime/control-plane/setup-version";
 
 // packages/cli/src/commands/_connection-state.ts
@@ -105,15 +105,33 @@ function resolveSelectedConnection(projectRoot, options = {}) {
 
 // packages/cli/src/commands/_server-client.ts
 import { spawnSync } from "child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve2 } from "path";
 import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
 var cachedGitHubBearerToken;
 function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
 }
-function readGitHubBearerTokenForRemote() {
+function readPrivateRemoteSessionToken(projectRoot) {
+  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
+  if (!existsSync2(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
+  } catch {
+    return null;
+  }
+}
+function readGitHubBearerTokenForRemote(projectRoot) {
   if (cachedGitHubBearerToken !== undefined)
     return cachedGitHubBearerToken;
+  const privateSession = readPrivateRemoteSessionToken(projectRoot);
+  if (privateSession) {
+    cachedGitHubBearerToken = privateSession;
+    return cachedGitHubBearerToken;
+  }
   const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
   if (envToken) {
     cachedGitHubBearerToken = envToken;
@@ -133,7 +151,7 @@ async function ensureServerForCli(projectRoot) {
     if (selected?.connection.kind === "remote") {
       return {
         baseUrl: selected.connection.baseUrl,
-        authToken: readGitHubBearerTokenForRemote(),
+        authToken: readGitHubBearerTokenForRemote(projectRoot),
         connectionKind: "remote"
       };
     }
@@ -205,9 +223,9 @@ async function loadRigConfigOrNull(projectRoot) {
 }
 
 // packages/cli/src/commands/_pi-install.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, rmSync } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3, rmSync } from "fs";
 import { homedir as homedir2 } from "os";
-import { resolve as resolve2 } from "path";
+import { resolve as resolve3 } from "path";
 var PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
 async function defaultCommandRunner(command, options = {}) {
   const proc = Bun.spawn(command, { cwd: options.cwd, stdout: "pipe", stderr: "pipe" });
@@ -219,7 +237,7 @@ async function defaultCommandRunner(command, options = {}) {
   return { exitCode, stdout, stderr };
 }
 function resolvePiRigExtensionPath(homeDir) {
-  return resolve2(homeDir, ".pi", "agent", "extensions", "pi-rig");
+  return resolve3(homeDir, ".pi", "agent", "extensions", "pi-rig");
 }
 function resolvePiHomeDir(inputHomeDir) {
   return inputHomeDir ?? process.env.RIG_PI_HOME_DIR?.trim() ?? homedir2();
@@ -247,13 +265,13 @@ async function checkPiRigInstall(input = {}) {
       piRig: { ok: true, label: "pi-rig global extension", detail: extensionPath }
     };
   }
-  const exists = input.exists ?? existsSync2;
+  const exists = input.exists ?? existsSync3;
   const runner = input.commandRunner ?? defaultCommandRunner;
   const piResult = await safeRun(runner, ["pi", "--version"]);
   const piListResult = piResult.exitCode === 0 ? await safeRun(runner, ["pi", "list"]) : { exitCode: 1, stdout: "", stderr: "" };
   const listedPiRig = piListResult.exitCode === 0 && piListContainsPiRig(`${piListResult.stdout}
 ${piListResult.stderr}`);
-  const legacyBridge = exists(resolve2(extensionPath, "index.ts"));
+  const legacyBridge = exists(resolve3(extensionPath, "index.ts"));
   const hasPiRig = listedPiRig;
   return {
     extensionPath,
@@ -315,11 +333,11 @@ function repoSlugFromConfig(config) {
 function loadFallbackConfig(projectRoot) {
   const candidates = ["rig.config.ts", "rig.config.mts", "rig.config.json"];
   for (const name of candidates) {
-    const path = resolve3(projectRoot, name);
-    if (!existsSync3(path))
+    const path = resolve4(projectRoot, name);
+    if (!existsSync4(path))
       continue;
     try {
-      const source = readFileSync3(path, "utf8");
+      const source = readFileSync4(path, "utf8");
       if (name.endsWith(".json"))
         return JSON.parse(source);
       const owner = source.match(/owner\s*:\s*["']([^"']+)["']/)?.[1];
@@ -398,7 +416,7 @@ async function runRigDoctorChecks(options) {
   checks.push(check("bun", `bun >= ${MIN_SUPPORTED_BUN_VERSION}`, isSupportedBunVersion(bunVersion) ? "pass" : "fail", `found ${bunVersion}`, `Install Bun ${MIN_SUPPORTED_BUN_VERSION} or newer.`), check("git", "git", which("git") ? "pass" : "fail", which("git") ?? undefined, "Install git and ensure it is on PATH."), check("jq", "jq", which("jq") ? "pass" : "warn", which("jq") ?? undefined, "Install jq (for example `brew install jq`)."));
   const loadedConfig = await loadConfig(projectRoot).catch(() => null);
   const config = loadedConfig ?? loadFallbackConfig(projectRoot);
-  const hasConfigFile = ["rig.config.ts", "rig.config.mts", "rig.config.json"].some((name) => existsSync3(resolve3(projectRoot, name)));
+  const hasConfigFile = ["rig.config.ts", "rig.config.mts", "rig.config.json"].some((name) => existsSync4(resolve4(projectRoot, name)));
   checks.push(config ? check("config", "rig.config loadable", "pass") : check("config", "rig.config loadable", hasConfigFile ? "fail" : "fail", hasConfigFile ? "config file exists but failed to load" : "missing rig.config.ts/json", "Run `rig init` or fix the config error."));
   const taskSourceKind = config?.taskSource?.kind;
   checks.push(taskSourceKind ? check("task-source", "task source configured", "pass", taskSourceKind) : check("task-source", "task source configured", "fail", "missing taskSource", "Configure taskSource in rig.config.ts."));

package/dist/src/commands/github.js

@@ -33,6 +33,8 @@ function takeOption(args, option) {
 
 // packages/cli/src/commands/_server-client.ts
 import { spawnSync } from "child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve2 } from "path";
 import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
 
 // packages/cli/src/commands/_connection-state.ts
@@ -123,9 +125,25 @@ function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
 }
-function readGitHubBearerTokenForRemote() {
+function readPrivateRemoteSessionToken(projectRoot) {
+  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
+  if (!existsSync2(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
+  } catch {
+    return null;
+  }
+}
+function readGitHubBearerTokenForRemote(projectRoot) {
   if (cachedGitHubBearerToken !== undefined)
     return cachedGitHubBearerToken;
+  const privateSession = readPrivateRemoteSessionToken(projectRoot);
+  if (privateSession) {
+    cachedGitHubBearerToken = privateSession;
+    return cachedGitHubBearerToken;
+  }
   const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
   if (envToken) {
     cachedGitHubBearerToken = envToken;
@@ -145,7 +163,7 @@ async function ensureServerForCli(projectRoot) {
     if (selected?.connection.kind === "remote") {
       return {
         baseUrl: selected.connection.baseUrl,
-        authToken: readGitHubBearerTokenForRemote(),
+        authToken: readGitHubBearerTokenForRemote(projectRoot),
         connectionKind: "remote"
       };
     }
@@ -213,7 +231,7 @@ async function postGitHubTokenViaServer(context, token, options = {}) {
   const payload = await requestServerJson(context, "/api/github/auth/token", {
     method: "POST",
     headers: { "content-type": "application/json" },
-    body: JSON.stringify({ token, selectedRepo: options.selectedRepo })
+    body: JSON.stringify({ token, selectedRepo: options.selectedRepo, projectRoot: options.projectRoot })
   });
   return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
 }