@h-rig/cli 0.0.6-alpha.1 → 0.0.6-alpha.11

package/dist/src/commands/server.js

@@ -62,6 +62,8 @@ function normalizeRuntimeAdapter(value) {
 
 // packages/cli/src/commands/_server-client.ts
 import { spawnSync } from "child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve2 } from "path";
 import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
 
 // packages/cli/src/commands/_connection-state.ts
@@ -152,9 +154,25 @@ function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
 }
-function readGitHubBearerTokenForRemote() {
+function readPrivateRemoteSessionToken(projectRoot) {
+  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
+  if (!existsSync2(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
+  } catch {
+    return null;
+  }
+}
+function readGitHubBearerTokenForRemote(projectRoot) {
   if (cachedGitHubBearerToken !== undefined)
     return cachedGitHubBearerToken;
+  const privateSession = readPrivateRemoteSessionToken(projectRoot);
+  if (privateSession) {
+    cachedGitHubBearerToken = privateSession;
+    return cachedGitHubBearerToken;
+  }
   const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
   if (envToken) {
     cachedGitHubBearerToken = envToken;
@@ -174,7 +192,7 @@ async function ensureServerForCli(projectRoot) {
     if (selected?.connection.kind === "remote") {
       return {
         baseUrl: selected.connection.baseUrl,
-        authToken: readGitHubBearerTokenForRemote(),
+        authToken: readGitHubBearerTokenForRemote(projectRoot),
         connectionKind: "remote"
       };
     }
@@ -281,7 +299,7 @@ async function executeServer(context, args, options) {
       const authTokenResult = takeOption(pending, "--auth-token");
       pending = authTokenResult.rest;
       requireNoExtraArgs(pending, "bun run rig server start [--host <host>] [--port <n>] [--poll-ms <n>] [--auth-token <token>]");
-      const commandParts = ["bun", "run", "packages/server/src/server.ts", "start"];
+      const commandParts = ["rig-server", "start"];
       if (hostResult.value) {
         commandParts.push("--host", hostResult.value);
       }
@@ -304,7 +322,7 @@ async function executeServer(context, args, options) {
       const eventResult = takeOption(pending, "--event");
       pending = eventResult.rest;
       requireNoExtraArgs(pending, "bun run rig server notify-test [--event <type>]");
-      const commandParts = ["bun", "run", "packages/server/src/server.ts", "notify-test"];
+      const commandParts = ["rig-server", "notify-test"];
       if (eventResult.value) {
         commandParts.push("--event", eventResult.value);
       }

package/dist/src/commands/setup.js

@@ -2,8 +2,8 @@
 var __require = import.meta.require;
 
 // packages/cli/src/commands/setup.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readdirSync, writeFileSync as writeFileSync2 } from "fs";
-import { resolve as resolve5 } from "path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readdirSync, writeFileSync as writeFileSync2 } from "fs";
+import { resolve as resolve6 } from "path";
 
 // packages/cli/src/runner.ts
 import { EventBus } from "@rig/runtime/control-plane/runtime/events";
@@ -171,8 +171,8 @@ async function buildPiSetupChecks(input = {}) {
 }
 
 // packages/cli/src/commands/_doctor-checks.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { resolve as resolve4 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { resolve as resolve5 } from "path";
 import { isSupportedBunVersion, MIN_SUPPORTED_BUN_VERSION } from "@rig/runtime/control-plane/setup-version";
 
 // packages/cli/src/commands/_connection-state.ts
@@ -259,15 +259,33 @@ function resolveSelectedConnection(projectRoot, options = {}) {
 
 // packages/cli/src/commands/_server-client.ts
 import { spawnSync } from "child_process";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { resolve as resolve4 } from "path";
 import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
 var cachedGitHubBearerToken;
 function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
 }
-function readGitHubBearerTokenForRemote() {
+function readPrivateRemoteSessionToken(projectRoot) {
+  const path = resolve4(projectRoot, ".rig", "state", "github-auth.json");
+  if (!existsSync3(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync3(path, "utf8"));
+    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
+  } catch {
+    return null;
+  }
+}
+function readGitHubBearerTokenForRemote(projectRoot) {
   if (cachedGitHubBearerToken !== undefined)
     return cachedGitHubBearerToken;
+  const privateSession = readPrivateRemoteSessionToken(projectRoot);
+  if (privateSession) {
+    cachedGitHubBearerToken = privateSession;
+    return cachedGitHubBearerToken;
+  }
   const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
   if (envToken) {
     cachedGitHubBearerToken = envToken;
@@ -287,7 +305,7 @@ async function ensureServerForCli(projectRoot) {
     if (selected?.connection.kind === "remote") {
       return {
         baseUrl: selected.connection.baseUrl,
-        authToken: readGitHubBearerTokenForRemote(),
+        authToken: readGitHubBearerTokenForRemote(projectRoot),
         connectionKind: "remote"
       };
     }
@@ -387,11 +405,11 @@ function repoSlugFromConfig(config) {
 function loadFallbackConfig(projectRoot) {
   const candidates = ["rig.config.ts", "rig.config.mts", "rig.config.json"];
   for (const name of candidates) {
-    const path = resolve4(projectRoot, name);
-    if (!existsSync3(path))
+    const path = resolve5(projectRoot, name);
+    if (!existsSync4(path))
       continue;
     try {
-      const source = readFileSync3(path, "utf8");
+      const source = readFileSync4(path, "utf8");
       if (name.endsWith(".json"))
         return JSON.parse(source);
       const owner = source.match(/owner\s*:\s*["']([^"']+)["']/)?.[1];
@@ -470,7 +488,7 @@ async function runRigDoctorChecks(options) {
   checks.push(check("bun", `bun >= ${MIN_SUPPORTED_BUN_VERSION}`, isSupportedBunVersion(bunVersion) ? "pass" : "fail", `found ${bunVersion}`, `Install Bun ${MIN_SUPPORTED_BUN_VERSION} or newer.`), check("git", "git", which("git") ? "pass" : "fail", which("git") ?? undefined, "Install git and ensure it is on PATH."), check("jq", "jq", which("jq") ? "pass" : "warn", which("jq") ?? undefined, "Install jq (for example `brew install jq`)."));
   const loadedConfig = await loadConfig(projectRoot).catch(() => null);
   const config = loadedConfig ?? loadFallbackConfig(projectRoot);
-  const hasConfigFile = ["rig.config.ts", "rig.config.mts", "rig.config.json"].some((name) => existsSync3(resolve4(projectRoot, name)));
+  const hasConfigFile = ["rig.config.ts", "rig.config.mts", "rig.config.json"].some((name) => existsSync4(resolve5(projectRoot, name)));
   checks.push(config ? check("config", "rig.config loadable", "pass") : check("config", "rig.config loadable", hasConfigFile ? "fail" : "fail", hasConfigFile ? "config file exists but failed to load" : "missing rig.config.ts/json", "Run `rig init` or fix the config error."));
   const taskSourceKind = config?.taskSource?.kind;
   checks.push(taskSourceKind ? check("task-source", "task source configured", "pass", taskSourceKind) : check("task-source", "task source configured", "fail", "missing taskSource", "Configure taskSource in rig.config.ts."));
@@ -638,8 +656,8 @@ function runSetupInit(projectRoot) {
   mkdirSync2(stateDir, { recursive: true });
   mkdirSync2(logsDir, { recursive: true });
   mkdirSync2(artifactsDir, { recursive: true });
-  const failuresPath = resolve5(stateDir, "failed_approaches.md");
-  if (!existsSync4(failuresPath)) {
+  const failuresPath = resolve6(stateDir, "failed_approaches.md");
+  if (!existsSync5(failuresPath)) {
     writeFileSync2(failuresPath, `# Failed Approaches
 
 `, "utf-8");
@@ -657,18 +675,18 @@ async function runSetupCheck(projectRoot) {
 }
 async function runSetupPreflight(projectRoot) {
   await runSetupCheck(projectRoot);
-  const validationRoot = resolve5(resolveControlPlaneDefinitionRoot(projectRoot), "validation");
-  if (existsSync4(validationRoot)) {
+  const validationRoot = resolve6(resolveControlPlaneDefinitionRoot(projectRoot), "validation");
+  if (existsSync5(validationRoot)) {
     const validators = readdirSync(validationRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory());
     for (const validator of validators) {
-      const script = resolve5(validationRoot, validator.name, "validate.sh");
-      if (existsSync4(script)) {
+      const script = resolve6(validationRoot, validator.name, "validate.sh");
+      if (existsSync5(script)) {
         console.log(`OK: validator script ${script}`);
       }
     }
   }
-  const hooksRoot = resolve5(resolveControlPlaneDefinitionRoot(projectRoot), "hooks");
-  if (existsSync4(hooksRoot)) {
+  const hooksRoot = resolve6(resolveControlPlaneDefinitionRoot(projectRoot), "hooks");
+  if (existsSync5(hooksRoot)) {
     const hooks = readdirSync(hooksRoot).filter((name) => name.endsWith(".sh"));
     for (const hook of hooks) {
       console.log(`OK: hook ${hook}`);

package/dist/src/commands/task-run-driver.js

@@ -1,6 +1,6 @@
 // @bun
 // packages/cli/src/commands/task-run-driver.ts
-import { copyFileSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, statSync } from "fs";
+import { copyFileSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, statSync, writeFileSync } from "fs";
 import { resolve as resolve4 } from "path";
 import { spawn, spawnSync } from "child_process";
 import { createInterface as createLineInterface } from "readline";
@@ -135,6 +135,7 @@ function upsertAgentAuthorityRun(projectRoot, input) {
   const runtimeAdapter = normalizeRuntimeAdapter(input.runtimeAdapter ?? existing?.runtimeAdapter ?? "claude-code");
   const title = resolveTaskTitleForAuthorityRun(projectRoot, input.taskId) ?? input.taskId;
   const next = {
+    ...existing ?? {},
     runId: input.runId,
     projectRoot,
     workspaceId: existing?.workspaceId ?? RIG_WORKSPACE_ID,
@@ -405,7 +406,24 @@ var PI_CANONICAL_RUN_STAGES = [
 function canonicalPiRunStages() {
   return [...PI_CANONICAL_RUN_STAGES];
 }
+function looksLikeGitHubToken(value) {
+  const token = value?.trim();
+  if (!token)
+    return false;
+  return /^(gh[opusr]_|github_pat_)/.test(token);
+}
+function githubBridgeEnv(token) {
+  const clean = token?.trim();
+  if (!clean)
+    return {};
+  return {
+    RIG_GITHUB_TOKEN: clean,
+    GITHUB_TOKEN: clean,
+    GH_TOKEN: clean
+  };
+}
 function buildPiRigBridgeEnv(input) {
+  const githubToken = input.githubToken?.trim() || (looksLikeGitHubToken(input.authToken) ? input.authToken.trim() : "");
   return {
     RIG_PROJECT_ROOT: input.projectRoot,
     PROJECT_RIG_ROOT: input.projectRoot,
@@ -415,7 +433,7 @@ function buildPiRigBridgeEnv(input) {
     RIG_RUNTIME_ADAPTER: "pi",
     ...input.serverUrl ? { RIG_SERVER_URL: input.serverUrl } : {},
     ...input.authToken ? { RIG_AUTH_TOKEN: input.authToken } : {},
-    ...input.githubToken ? { RIG_GITHUB_TOKEN: input.githubToken } : {}
+    ...githubBridgeEnv(githubToken)
   };
 }
 function runGitSync(cwd, args, input) {
@@ -476,6 +494,14 @@ function buildTaskRunReviewEnv(config) {
     ...review?.provider ? { AI_REVIEW_PROVIDER: review.provider } : {}
   };
 }
+function buildDirtyBaselineHandshakeEnv(input) {
+  if (input.baselineMode !== "dirty-snapshot")
+    return { RIG_BASELINE_MODE: input.baselineMode ?? "head" };
+  return {
+    RIG_BASELINE_MODE: "dirty-snapshot",
+    RIG_DIRTY_BASELINE_READY_FILE: resolve4(input.projectRoot, ".rig", "runs", input.runId, "dirty-baseline.ready.json")
+  };
+}
 function positiveInt(value, fallback) {
   return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;
 }
@@ -1056,8 +1082,11 @@ function stringArrayField(record, key) {
 }
 async function executeRigOwnedTaskRun(context, input) {
   const runtimeTaskId = input.taskId?.trim() || `adhoc-${input.runId}`;
+  const existingRunRecord = readAuthorityRun3(context.projectRoot, input.runId);
+  const resumeMode = process.env.RIG_RUN_RESUME === "1";
+  const resumePreviousStatus = String(existingRunRecord?.status ?? "").toLowerCase();
   const sourceTask = readRunSourceTaskContract(context.projectRoot, input.runId, input.taskId);
-  const prompt = buildRunPrompt({
+  let prompt = buildRunPrompt({
     projectRoot: context.projectRoot,
     taskId: input.taskId,
     fallbackTitle: input.title,
@@ -1111,14 +1140,14 @@ async function executeRigOwnedTaskRun(context, input) {
     taskId: runtimeTaskId,
     createdAt: startedAt,
     runtimeAdapter: input.runtimeAdapter,
-    status: "created"
+    status: resumeMode ? "preparing" : "created"
   });
   patchAuthorityRun(context.projectRoot, input.runId, {
     status: "preparing",
     startedAt,
     completedAt: null,
     errorText: null,
-    artifactRoot: null,
+    artifactRoot: resumeMode ? existingRunRecord?.artifactRoot ?? null : null,
     runtimeAdapter: input.runtimeAdapter,
     runtimeMode: input.runtimeMode,
     interactionMode: input.interactionMode,
@@ -1134,9 +1163,9 @@ async function executeRigOwnedTaskRun(context, input) {
     detail: input.taskId ?? input.title ?? runtimeTaskId
   });
   appendRunLog(context.projectRoot, input.runId, {
-    id: `log:${input.runId}:start`,
-    title: "Rig task run started",
-    detail: input.taskId ?? input.title ?? runtimeTaskId,
+    id: `log:${input.runId}:${resumeMode ? "resume" : "start"}`,
+    title: resumeMode ? "Rig task run resumed" : "Rig task run started",
+    detail: resumeMode ? `Continuing the same run lifecycle for ${input.taskId ?? input.title ?? runtimeTaskId}.` : input.taskId ?? input.title ?? runtimeTaskId,
     tone: "info",
     status: "preparing",
     createdAt: startedAt
@@ -1157,7 +1186,22 @@ async function executeRigOwnedTaskRun(context, input) {
   const loadedAutomationConfig = await loadTaskRunAutomationConfig(context.projectRoot);
   const automationConfig = input.prMode ? { ...loadedAutomationConfig ?? {}, pr: { ...loadedAutomationConfig?.pr ?? {}, mode: input.prMode } } : loadedAutomationConfig;
   const planningClassification = classifyPlanningNeed({ config: automationConfig, sourceTask });
-  patchAuthorityRun(context.projectRoot, input.runId, { planning: planningClassification });
+  const planningArtifactPath = resolve4("artifacts", runtimeTaskId, "implementation-plan.md");
+  const persistedPlanning = {
+    ...planningClassification,
+    classifier: input.runtimeAdapter === "pi" ? "pi-rig-structured-policy" : "rig-structured-policy",
+    artifactPath: planningClassification.planningRequired ? planningArtifactPath : null,
+    classifiedAt: new Date().toISOString()
+  };
+  mkdirSync(resolve4(context.projectRoot, ".rig", "runs", input.runId), { recursive: true });
+  writeFileSync(resolve4(context.projectRoot, ".rig", "runs", input.runId, "planning-classification.json"), `${JSON.stringify(persistedPlanning, null, 2)}
+`, "utf8");
+  patchAuthorityRun(context.projectRoot, input.runId, { planning: persistedPlanning });
+  prompt = `${prompt}
+
+Rig planning classification:
+${JSON.stringify(persistedPlanning, null, 2)}
+${planningClassification.planningRequired ? `Before implementing, write a concise implementation plan to ${planningArtifactPath}. Treat that plan artifact as required acceptance evidence for the Plan stage.` : "Planning is not required for this run; briefly state why before implementation."}`;
   if (input.runtimeAdapter === "pi") {
     for (const stage of ["Connect", "GitHub/task sync", "Prepare workspace", "Launch Pi", "Plan", "Implement"]) {
       appendPiStageLog({
@@ -1199,11 +1243,11 @@ async function executeRigOwnedTaskRun(context, input) {
   let reviewAction;
   let verificationStarted = false;
   let reviewStarted = false;
-  let latestRuntimeWorkspace = null;
-  let latestSessionDir = null;
-  let latestLogsDir = null;
+  let latestRuntimeWorkspace = resumeMode && typeof existingRunRecord?.worktreePath === "string" ? existingRunRecord.worktreePath : null;
+  let latestSessionDir = resumeMode && typeof existingRunRecord?.sessionPath === "string" ? resolve4(existingRunRecord.sessionPath, "..") : null;
+  let latestLogsDir = resumeMode && typeof existingRunRecord?.logRoot === "string" ? existingRunRecord.logRoot : null;
   let latestProviderCommand = null;
-  let latestRuntimeBranch = null;
+  let latestRuntimeBranch = resumeMode && typeof existingRunRecord?.branch === "string" ? existingRunRecord.branch : null;
   let snapshotSidecarPromise = null;
   let dirtyBaselineApplied = false;
   const childEnv = {
@@ -1221,9 +1265,14 @@ async function executeRigOwnedTaskRun(context, input) {
       RIG_RUNTIME_ADAPTER: input.runtimeAdapter,
       RIG_SERVER_RUN_ID: input.runId
     },
-    ...sourceTask ? { RIG_SOURCE_TASK_JSON: JSON.stringify(sourceTask) } : {}
+    ...sourceTask ? { RIG_SOURCE_TASK_JSON: JSON.stringify(sourceTask) } : {},
+    ...resumeMode ? {
+      RIG_RUN_RESUME: "1",
+      RIG_RUNTIME_ARTIFACT_CLEANUP: "preserve"
+    } : {}
   };
   Object.assign(childEnv, buildTaskRunReviewEnv(automationConfig));
+  Object.assign(childEnv, buildDirtyBaselineHandshakeEnv({ projectRoot: context.projectRoot, runId: input.runId, baselineMode: input.baselineMode }));
   const automationLimits = resolveTaskRunAutomationLimits(automationConfig);
   const maxAttempts = automationLimits.maxValidationAttempts;
   const promoteToValidating = (detail) => {
@@ -1287,13 +1336,20 @@ async function executeRigOwnedTaskRun(context, input) {
       if (!dirtyBaselineApplied && input.baselineMode === "dirty-snapshot" && latestRuntimeWorkspace) {
         dirtyBaselineApplied = true;
         const dirty = applyDirtyBaselineSnapshot({ sourceRoot: context.projectRoot, targetRoot: latestRuntimeWorkspace });
+        const readyFile = childEnv.RIG_DIRTY_BASELINE_READY_FILE;
+        if (readyFile) {
+          mkdirSync(resolve4(readyFile, ".."), { recursive: true });
+          writeFileSync(readyFile, `${JSON.stringify({ ...dirty, workspaceDir: latestRuntimeWorkspace, appliedAt: new Date().toISOString() }, null, 2)}
+`, "utf8");
+        }
         appendRunLog(context.projectRoot, input.runId, {
           id: `log:${input.runId}:dirty-baseline`,
           title: "Dirty baseline snapshot",
           detail: dirty.detail,
           tone: dirty.applied ? "tool" : "info",
           status: dirty.applied ? "completed" : "skipped",
-          createdAt: new Date().toISOString()
+          createdAt: new Date().toISOString(),
+          payload: readyFile ? { readyFile } : undefined
         });
         emitServerRunEvent({ type: "log", runId: input.runId, title: "Dirty baseline snapshot" });
       }
@@ -1519,7 +1575,36 @@ async function executeRigOwnedTaskRun(context, input) {
   let reviewFailureDetail = null;
   const stderrLines = [];
   const piAcceptedArtifactExitGraceMs = resolvePiAcceptedArtifactExitGraceMs(childEnv);
-  for (let attempt = 1;attempt <= maxAttempts; attempt += 1) {
+  if (resumeMode && ["validating", "reviewing"].includes(resumePreviousStatus)) {
+    appendRunLog(context.projectRoot, input.runId, {
+      id: `log:${input.runId}:resume-closeout-phase`,
+      title: "Resume continuing from closeout phase",
+      detail: `Previous run status was ${resumePreviousStatus}; skipping agent relaunch and continuing validation/PR/merge closeout for the same run.`,
+      tone: "info",
+      status: resumePreviousStatus,
+      createdAt: new Date().toISOString()
+    });
+    emitServerRunEvent({ type: "log", runId: input.runId, title: "Resume continuing from closeout phase" });
+    exit = { code: 0, signal: null };
+  } else if (resumeMode && latestRuntimeWorkspace) {
+    const acceptedArtifactState = readTaskRunAcceptedArtifactState({
+      taskId: input.taskId ?? runtimeTaskId,
+      workspaceDir: latestRuntimeWorkspace
+    });
+    if (acceptedArtifactState.accepted) {
+      appendRunLog(context.projectRoot, input.runId, {
+        id: `log:${input.runId}:resume-accepted-artifacts`,
+        title: "Resume found accepted artifacts; continuing closeout",
+        detail: acceptedArtifactState.reason ?? "Accepted task artifacts are present from the previous run process.",
+        tone: "info",
+        status: "validating",
+        createdAt: new Date().toISOString()
+      });
+      emitServerRunEvent({ type: "log", runId: input.runId, title: "Resume found accepted artifacts; continuing closeout" });
+      exit = { code: 0, signal: null };
+    }
+  }
+  for (let attempt = 1;!exit && attempt <= maxAttempts; attempt += 1) {
     const attemptHostAgentCommand = buildHostAgentCommand(currentPrompt);
     const child = spawn(attemptHostAgentCommand[0], attemptHostAgentCommand.slice(1), {
       cwd: context.projectRoot,
@@ -1765,6 +1850,29 @@ Failed to update task source for ${input.taskId ?? runtimeTaskId} to failed: ${e
     });
     throw new CliError2(terminalFailureDetail, exit.code ?? 1);
   }
+  if (planningClassification.planningRequired) {
+    const planWorkspace = latestRuntimeWorkspace ?? context.projectRoot;
+    const expectedPlanPath = resolve4(planWorkspace, planningArtifactPath);
+    if (!existsSync2(expectedPlanPath)) {
+      const failedAt = new Date().toISOString();
+      const failureDetail = `Planning was required (${planningClassification.reason}) but ${planningArtifactPath} was not written before implementation completed.`;
+      patchAuthorityRun(context.projectRoot, input.runId, {
+        status: "needs_attention",
+        completedAt: failedAt,
+        errorText: failureDetail
+      });
+      appendRunLog(context.projectRoot, input.runId, {
+        id: `log:${input.runId}:plan-artifact-missing`,
+        title: "Required plan artifact missing",
+        detail: failureDetail,
+        tone: "error",
+        status: "needs_attention",
+        createdAt: failedAt
+      });
+      emitServerRunEvent({ type: "failed", runId: input.runId, error: failureDetail });
+      throw new CliError2(failureDetail, 1);
+    }
+  }
   const runPiPrFeedbackFix = async (message) => {
     appendPiStageLog({
       projectRoot: context.projectRoot,
@@ -1935,5 +2043,6 @@ export {
   buildTaskRunReviewEnv,
   buildPiValidationRetrySteeringPrompt,
   buildPiRigBridgeEnv,
+  buildDirtyBaselineHandshakeEnv,
   applyDirtyBaselineSnapshot
 };

package/dist/src/commands/task.js

@@ -1,9 +1,9 @@
 // @bun
 // packages/cli/src/commands/task.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { spawnSync as spawnSync2 } from "child_process";
 import { createInterface as createInterface3 } from "readline/promises";
-import { resolve as resolve3 } from "path";
+import { resolve as resolve4 } from "path";
 
 // packages/cli/src/runner.ts
 import { EventBus } from "@rig/runtime/control-plane/runtime/events";
@@ -189,15 +189,33 @@ function resolveSelectedConnection(projectRoot, options = {}) {
 
 // packages/cli/src/commands/_server-client.ts
 import { spawnSync } from "child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve2 } from "path";
 import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
 var cachedGitHubBearerToken;
 function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
 }
-function readGitHubBearerTokenForRemote() {
+function readPrivateRemoteSessionToken(projectRoot) {
+  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
+  if (!existsSync2(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
+  } catch {
+    return null;
+  }
+}
+function readGitHubBearerTokenForRemote(projectRoot) {
   if (cachedGitHubBearerToken !== undefined)
     return cachedGitHubBearerToken;
+  const privateSession = readPrivateRemoteSessionToken(projectRoot);
+  if (privateSession) {
+    cachedGitHubBearerToken = privateSession;
+    return cachedGitHubBearerToken;
+  }
   const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
   if (envToken) {
     cachedGitHubBearerToken = envToken;
@@ -217,7 +235,7 @@ async function ensureServerForCli(projectRoot) {
     if (selected?.connection.kind === "remote") {
       return {
         baseUrl: selected.connection.baseUrl,
-        authToken: readGitHubBearerTokenForRemote(),
+        authToken: readGitHubBearerTokenForRemote(projectRoot),
         connectionKind: "remote"
       };
     }
@@ -378,9 +396,9 @@ async function submitTaskRunViaServer(context, input) {
 }
 
 // packages/cli/src/commands/_pi-install.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, rmSync } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3, rmSync } from "fs";
 import { homedir as homedir2 } from "os";
-import { resolve as resolve2 } from "path";
+import { resolve as resolve3 } from "path";
 var PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
 async function defaultCommandRunner(command, options = {}) {
   const proc = Bun.spawn(command, { cwd: options.cwd, stdout: "pipe", stderr: "pipe" });
@@ -392,7 +410,7 @@ async function defaultCommandRunner(command, options = {}) {
   return { exitCode, stdout, stderr };
 }
 function resolvePiRigExtensionPath(homeDir) {
-  return resolve2(homeDir, ".pi", "agent", "extensions", "pi-rig");
+  return resolve3(homeDir, ".pi", "agent", "extensions", "pi-rig");
 }
 function resolvePiHomeDir(inputHomeDir) {
   return inputHomeDir ?? process.env.RIG_PI_HOME_DIR?.trim() ?? homedir2();
@@ -420,13 +438,13 @@ async function checkPiRigInstall(input = {}) {
       piRig: { ok: true, label: "pi-rig global extension", detail: extensionPath }
     };
   }
-  const exists = input.exists ?? existsSync2;
+  const exists = input.exists ?? existsSync3;
   const runner = input.commandRunner ?? defaultCommandRunner;
   const piResult = await safeRun(runner, ["pi", "--version"]);
   const piListResult = piResult.exitCode === 0 ? await safeRun(runner, ["pi", "list"]) : { exitCode: 1, stdout: "", stderr: "" };
   const listedPiRig = piListResult.exitCode === 0 && piListContainsPiRig(`${piListResult.stdout}
 ${piListResult.stderr}`);
-  const legacyBridge = exists(resolve2(extensionPath, "index.ts"));
+  const legacyBridge = exists(resolve3(extensionPath, "index.ts"));
   const hasPiRig = listedPiRig;
   return {
     extensionPath,
@@ -1101,7 +1119,7 @@ async function executeTask(context, args, options) {
       const fileFlag = takeOption(rest.slice(1), "--file");
       let content;
       if (fileFlag.value) {
-        content = readFileSync3(resolve3(context.projectRoot, fileFlag.value), "utf-8");
+        content = readFileSync4(resolve4(context.projectRoot, fileFlag.value), "utf-8");
       } else {
         content = await readStdin();
       }