@h-rig/cli 0.0.6-alpha.1 → 0.0.6-alpha.3

package/dist/bin/rig.js

@@ -2671,6 +2671,8 @@ function resolveSelectedConnection(projectRoot, options = {}) {
 
 // packages/cli/src/commands/_server-client.ts
 import { spawnSync } from "child_process";
+import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
+import { resolve as resolve9 } from "path";
 import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
 var cachedGitHubBearerToken;
 function cleanToken(value) {
@@ -2680,9 +2682,25 @@ function cleanToken(value) {
 function setGitHubBearerTokenForCurrentProcess(token) {
   cachedGitHubBearerToken = cleanToken(token ?? undefined);
 }
-function readGitHubBearerTokenForRemote() {
+function readPrivateRemoteSessionToken(projectRoot) {
+  const path = resolve9(projectRoot, ".rig", "state", "github-auth.json");
+  if (!existsSync5(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync3(path, "utf8"));
+    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
+  } catch {
+    return null;
+  }
+}
+function readGitHubBearerTokenForRemote(projectRoot) {
   if (cachedGitHubBearerToken !== undefined)
     return cachedGitHubBearerToken;
+  const privateSession = readPrivateRemoteSessionToken(projectRoot);
+  if (privateSession) {
+    cachedGitHubBearerToken = privateSession;
+    return cachedGitHubBearerToken;
+  }
   const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
   if (envToken) {
     cachedGitHubBearerToken = envToken;
@@ -2702,7 +2720,7 @@ async function ensureServerForCli(projectRoot) {
     if (selected?.connection.kind === "remote") {
       return {
         baseUrl: selected.connection.baseUrl,
-        authToken: readGitHubBearerTokenForRemote(),
+        authToken: readGitHubBearerTokenForRemote(projectRoot),
         connectionKind: "remote"
       };
     }
@@ -2809,7 +2827,7 @@ async function postGitHubTokenViaServer(context, token, options = {}) {
   const payload = await requestServerJson(context, "/api/github/auth/token", {
     method: "POST",
     headers: { "content-type": "application/json" },
-    body: JSON.stringify({ token, selectedRepo: options.selectedRepo })
+    body: JSON.stringify({ token, selectedRepo: options.selectedRepo, projectRoot: options.projectRoot })
   });
   return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
 }
@@ -2830,7 +2848,7 @@ async function registerProjectViaServer(context, input) {
   return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
 }
 function sleep(ms) {
-  return new Promise((resolve9) => setTimeout(resolve9, ms));
+  return new Promise((resolve10) => setTimeout(resolve10, ms));
 }
 async function switchServerProjectRootViaServer(context, projectRoot, options = {}) {
   const switched = await requestServerJson(context, "/api/server/project-root", {
@@ -2921,9 +2939,9 @@ async function submitTaskRunViaServer(context, input) {
 }
 
 // packages/cli/src/commands/_pi-install.ts
-import { existsSync as existsSync5, readFileSync as readFileSync3, rmSync as rmSync3 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync4, rmSync as rmSync3 } from "fs";
 import { homedir as homedir3 } from "os";
-import { resolve as resolve9 } from "path";
+import { resolve as resolve10 } from "path";
 var PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
 var LEGACY_PI_RIG_MARKER = `// Managed by Rig. Source package: @rig/pi-rig.
 export { default } from '@rig/pi-rig';
@@ -2938,11 +2956,11 @@ async function defaultCommandRunner(command, options = {}) {
   return { exitCode, stdout, stderr };
 }
 function resolvePiRigExtensionPath(homeDir) {
-  return resolve9(homeDir, ".pi", "agent", "extensions", "pi-rig");
+  return resolve10(homeDir, ".pi", "agent", "extensions", "pi-rig");
 }
-function resolvePiRigPackageSource(projectRoot, exists = existsSync5) {
-  const localPackage = resolve9(projectRoot, "packages", "pi-rig");
-  if (exists(resolve9(localPackage, "package.json")))
+function resolvePiRigPackageSource(projectRoot, exists = existsSync6) {
+  const localPackage = resolve10(projectRoot, "packages", "pi-rig");
+  if (exists(resolve10(localPackage, "package.json")))
     return localPackage;
   return `npm:${PI_RIG_PACKAGE_NAME}`;
 }
@@ -2993,13 +3011,13 @@ async function ensurePiBinaryAvailable(input) {
     ...next.exitCode === 0 ? {} : { error: (next.stderr || next.stdout).trim() || "pi --version failed after install" }
   };
 }
-function removeManagedLegacyPiRigBridge(homeDir, exists = existsSync5) {
+function removeManagedLegacyPiRigBridge(homeDir, exists = existsSync6) {
   const extensionPath = resolvePiRigExtensionPath(homeDir);
-  const indexPath = resolve9(extensionPath, "index.ts");
+  const indexPath = resolve10(extensionPath, "index.ts");
   if (!exists(indexPath))
     return;
   try {
-    const content = readFileSync3(indexPath, "utf8");
+    const content = readFileSync4(indexPath, "utf8");
     if (content === LEGACY_PI_RIG_MARKER || content.includes("Managed by Rig. Source package: @rig/pi-rig")) {
       rmSync3(extensionPath, { recursive: true, force: true });
     }
@@ -3015,13 +3033,13 @@ async function checkPiRigInstall(input = {}) {
       piRig: { ok: true, label: "pi-rig global extension", detail: extensionPath }
     };
   }
-  const exists = input.exists ?? existsSync5;
+  const exists = input.exists ?? existsSync6;
   const runner = input.commandRunner ?? defaultCommandRunner;
   const piResult = await safeRun(runner, ["pi", "--version"]);
   const piListResult = piResult.exitCode === 0 ? await safeRun(runner, ["pi", "list"]) : { exitCode: 1, stdout: "", stderr: "" };
   const listedPiRig = piListResult.exitCode === 0 && piListContainsPiRig(`${piListResult.stdout}
 ${piListResult.stderr}`);
-  const legacyBridge = exists(resolve9(extensionPath, "index.ts"));
+  const legacyBridge = exists(resolve10(extensionPath, "index.ts"));
   const hasPiRig = listedPiRig;
   return {
     extensionPath,
@@ -3359,7 +3377,7 @@ async function executeQueue(context, args) {
 }
 
 // packages/cli/src/commands/agent.ts
-import { resolve as resolve11 } from "path";
+import { resolve as resolve12 } from "path";
 import {
   agentId,
   cleanupAgentRuntime,
@@ -3369,8 +3387,8 @@ import {
 } from "@rig/runtime/control-plane/runtime/isolation";
 
 // packages/cli/src/commands/_authority-runs.ts
-import { existsSync as existsSync6 } from "fs";
-import { resolve as resolve10 } from "path";
+import { existsSync as existsSync7 } from "fs";
+import { resolve as resolve11 } from "path";
 import {
   readAuthorityRun,
   readJsonlFile as readJsonlFile2,
@@ -3392,8 +3410,8 @@ function normalizeRuntimeAdapter(value) {
   return "claude-code";
 }
 function readLatestBeadRecord(projectRoot, taskId) {
-  const issuesPath = resolve10(resolveControlPlaneMonorepoRoot(projectRoot), ".beads", "issues.jsonl");
-  if (!existsSync6(issuesPath)) {
+  const issuesPath = resolve11(resolveControlPlaneMonorepoRoot(projectRoot), ".beads", "issues.jsonl");
+  if (!existsSync7(issuesPath)) {
     return null;
   }
   let latest = null;
@@ -3460,7 +3478,7 @@ function upsertAgentAuthorityRun(projectRoot, input) {
   } else if ("errorText" in next) {
     delete next.errorText;
   }
-  writeJsonFile3(resolve10(resolveAuthorityRunDir(projectRoot, input.runId), "run.json"), next);
+  writeJsonFile3(resolve11(resolveAuthorityRunDir(projectRoot, input.runId), "run.json"), next);
   return next;
 }
 
@@ -3581,10 +3599,10 @@ async function executeAgent(context, args) {
           status: "running",
           startedAt: createdAt,
           worktreePath: runtime.workspaceDir,
-          artifactRoot: resolve11(runtime.workspaceDir, "artifacts", taskId),
+          artifactRoot: resolve12(runtime.workspaceDir, "artifacts", taskId),
           logRoot: runtime.logsDir,
-          sessionPath: resolve11(runtime.sessionDir, "session.json"),
-          sessionLogPath: resolve11(runtime.logsDir, "agent-stdout.log"),
+          sessionPath: resolve12(runtime.sessionDir, "session.json"),
+          sessionLogPath: resolve12(runtime.logsDir, "agent-stdout.log"),
           pid: process.pid
         });
         const result = await runInAgentRuntime({
@@ -3604,10 +3622,10 @@ async function executeAgent(context, args) {
             startedAt: createdAt,
             completedAt: failedAt,
             worktreePath: runtime.workspaceDir,
-            artifactRoot: resolve11(runtime.workspaceDir, "artifacts", taskId),
+            artifactRoot: resolve12(runtime.workspaceDir, "artifacts", taskId),
             logRoot: runtime.logsDir,
-            sessionPath: resolve11(runtime.sessionDir, "session.json"),
-            sessionLogPath: resolve11(runtime.logsDir, "agent-stdout.log"),
+            sessionPath: resolve12(runtime.sessionDir, "session.json"),
+            sessionLogPath: resolve12(runtime.logsDir, "agent-stdout.log"),
             pid: process.pid,
             errorText: result.stderr ? result.stderr.trim() : `Agent runtime command failed (${result.exitCode})`
           });
@@ -3624,10 +3642,10 @@ ${result.stderr.trim()}` : ""}`, result.exitCode);
           startedAt: createdAt,
           completedAt,
           worktreePath: runtime.workspaceDir,
-          artifactRoot: resolve11(runtime.workspaceDir, "artifacts", taskId),
+          artifactRoot: resolve12(runtime.workspaceDir, "artifacts", taskId),
           logRoot: runtime.logsDir,
-          sessionPath: resolve11(runtime.sessionDir, "session.json"),
-          sessionLogPath: resolve11(runtime.logsDir, "agent-stdout.log"),
+          sessionPath: resolve12(runtime.sessionDir, "session.json"),
+          sessionLogPath: resolve12(runtime.logsDir, "agent-stdout.log"),
           pid: process.pid
         });
         return {
@@ -3701,7 +3719,7 @@ ${result.stderr.trim()}` : ""}`, result.exitCode);
 import {
   chmodSync,
   copyFileSync as copyFileSync2,
-  existsSync as existsSync7,
+  existsSync as existsSync8,
   mkdirSync as mkdirSync6,
   readdirSync,
   readlinkSync,
@@ -3711,7 +3729,7 @@ import {
   unlinkSync
 } from "fs";
 import { homedir as homedir4 } from "os";
-import { resolve as resolve12 } from "path";
+import { resolve as resolve13 } from "path";
 import { buildBinary as buildBinary2 } from "@rig/runtime/control-plane/runtime/isolation";
 import {
   computeRuntimeImageFingerprint,
@@ -3730,13 +3748,13 @@ async function runQuietBinaryProbe(binaryPath, args, cwd) {
 
 // packages/cli/src/commands/dist.ts
 function collectRigValidatorBuildTargets(input) {
-  const validatorsRoot = resolve12(input.hostProjectRoot, "packages/runtime/src/control-plane/validators");
-  if (!existsSync7(validatorsRoot))
+  const validatorsRoot = resolve13(input.hostProjectRoot, "packages/runtime/src/control-plane/validators");
+  if (!existsSync8(validatorsRoot))
     return [];
   const targets = [];
   const categories = readdirSync(validatorsRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory());
   for (const category of categories) {
-    const categoryDir = resolve12(validatorsRoot, category.name);
+    const categoryDir = resolve13(validatorsRoot, category.name);
     for (const entry of readdirSync(categoryDir, { withFileTypes: true })) {
       if (!entry.isFile() || !entry.name.endsWith(".ts"))
         continue;
@@ -3745,7 +3763,7 @@ function collectRigValidatorBuildTargets(input) {
         continue;
       targets.push({
         source: `packages/runtime/src/control-plane/validators/${category.name}/${entry.name}`,
-        dest: resolve12(input.imageDir, `bin/validators/${category.name}-${check}`),
+        dest: resolve13(input.imageDir, `bin/validators/${category.name}-${check}`),
         cwd: input.hostProjectRoot
       });
     }
@@ -3754,16 +3772,16 @@ function collectRigValidatorBuildTargets(input) {
 }
 async function findLatestDistBinary(projectRoot) {
   const distRoot = resolveControlPlaneHostDistDir(projectRoot);
-  if (!existsSync7(distRoot)) {
+  if (!existsSync8(distRoot)) {
     return null;
   }
   const entries = readdirSync(distRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && entry.name.startsWith("rig-")).map((entry) => ({
     name: entry.name,
-    mtimeMs: statSync(resolve12(distRoot, entry.name)).mtimeMs
+    mtimeMs: statSync(resolve13(distRoot, entry.name)).mtimeMs
   })).sort((a, b) => b.mtimeMs - a.mtimeMs || b.name.localeCompare(a.name));
   for (const { name } of entries) {
-    const candidate = resolve12(distRoot, name, "bin", "rig");
-    if (existsSync7(candidate) && await isRunnableRigBinary(candidate, projectRoot)) {
+    const candidate = resolve13(distRoot, name, "bin", "rig");
+    if (existsSync8(candidate) && await isRunnableRigBinary(candidate, projectRoot)) {
       return candidate;
     }
   }
@@ -3775,7 +3793,7 @@ async function isRunnableRigBinary(binaryPath, projectRoot) {
 async function runDistDoctor(projectRoot) {
   const bunPath = Bun.which("bun");
   const rigPath = Bun.which("rig");
-  const userBinDir = resolve12(homedir4(), ".local/bin");
+  const userBinDir = resolve13(homedir4(), ".local/bin");
   const userBinInPath = (process.env.PATH || "").split(":").filter(Boolean).includes(userBinDir);
   let rigRunnable = false;
   if (rigPath) {
@@ -3823,15 +3841,15 @@ async function executeDist(context, args) {
       let source = await findLatestDistBinary(context.projectRoot);
       let buildDir = null;
       if (!source) {
-        buildDir = resolve12(resolveControlPlaneHostDistDir(context.projectRoot), `rig-install-${Date.now()}`);
+        buildDir = resolve13(resolveControlPlaneHostDistDir(context.projectRoot), `rig-install-${Date.now()}`);
         await context.runCommand(["bun", "run", "packages/cli/bin/build-rig-binaries.ts", "--output-dir", buildDir]);
-        source = resolve12(buildDir, "bin", "rig");
+        source = resolve13(buildDir, "bin", "rig");
       }
-      if (!existsSync7(source)) {
+      if (!existsSync8(source)) {
         throw new CliError2(`Unable to locate rig binary at ${source}.`, 2);
       }
-      const installedPath = resolve12(installDir, "rig");
-      if (existsSync7(installedPath)) {
+      const installedPath = resolve13(installDir, "rig");
+      if (existsSync8(installedPath)) {
         unlinkSync(installedPath);
       }
       copyFileSync2(source, installedPath);
@@ -3873,22 +3891,22 @@ async function executeDist(context, args) {
       requireNoExtraArgs(rest, "bun run rig dist rebuild-agent");
       const fp = await computeRuntimeImageFingerprint(context.projectRoot);
       const currentId = computeRuntimeImageId(fp);
-      const imagesDir = resolve12(resolveControlPlaneMonorepoRuntimeDir(context.projectRoot), "images");
+      const imagesDir = resolve13(resolveControlPlaneMonorepoRuntimeDir(context.projectRoot), "images");
       mkdirSync6(imagesDir, { recursive: true });
       let pruned = 0;
       for (const entry of readdirSync(imagesDir, { withFileTypes: true })) {
         if (entry.isDirectory() && entry.name !== currentId) {
-          rmSync4(resolve12(imagesDir, entry.name), { recursive: true, force: true });
+          rmSync4(resolve13(imagesDir, entry.name), { recursive: true, force: true });
           pruned++;
         }
       }
       if (pruned > 0 && context.outputMode === "text") {
         console.log(`Pruned ${pruned} stale image(s).`);
       }
-      const imageDir = resolve12(imagesDir, currentId);
-      mkdirSync6(resolve12(imageDir, "bin/hooks"), { recursive: true });
-      mkdirSync6(resolve12(imageDir, "bin/plugins"), { recursive: true });
-      mkdirSync6(resolve12(imageDir, "bin/validators"), { recursive: true });
+      const imageDir = resolve13(imagesDir, currentId);
+      mkdirSync6(resolve13(imageDir, "bin/hooks"), { recursive: true });
+      mkdirSync6(resolve13(imageDir, "bin/plugins"), { recursive: true });
+      mkdirSync6(resolve13(imageDir, "bin/validators"), { recursive: true });
       const hookNames = [
         "scope-guard",
         "import-guard",
@@ -3902,25 +3920,25 @@ async function executeDist(context, args) {
       ];
       const targets = [];
       const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || context.projectRoot;
-      targets.push({ source: "packages/runtime/bin/rig-agent.ts", dest: resolve12(imageDir, "bin/rig-agent"), cwd: hostProjectRoot });
-      targets.push({ source: "packages/runtime/bin/rig-agent-dispatch.ts", dest: resolve12(resolveControlPlaneHostBinDir(context.projectRoot), "rig-agent"), cwd: hostProjectRoot });
+      targets.push({ source: "packages/runtime/bin/rig-agent.ts", dest: resolve13(imageDir, "bin/rig-agent"), cwd: hostProjectRoot });
+      targets.push({ source: "packages/runtime/bin/rig-agent-dispatch.ts", dest: resolve13(resolveControlPlaneHostBinDir(context.projectRoot), "rig-agent"), cwd: hostProjectRoot });
       for (const hookName of hookNames) {
         const src = `packages/runtime/src/control-plane/hooks/${hookName}.ts`;
-        targets.push({ source: src, dest: resolve12(imageDir, `bin/hooks/${hookName}`), cwd: hostProjectRoot });
-        targets.push({ source: src, dest: resolve12(resolveControlPlaneHostBinDir(context.projectRoot), `hooks/${hookName}`), cwd: hostProjectRoot });
+        targets.push({ source: src, dest: resolve13(imageDir, `bin/hooks/${hookName}`), cwd: hostProjectRoot });
+        targets.push({ source: src, dest: resolve13(resolveControlPlaneHostBinDir(context.projectRoot), `hooks/${hookName}`), cwd: hostProjectRoot });
       }
-      const pluginsDir = resolve12(context.projectRoot, "rig/plugins");
-      const binPluginsDir = resolve12(resolveControlPlaneHostBinDir(context.projectRoot), "plugins");
-      const validatorsRoot = resolve12(hostProjectRoot, "packages/runtime/src/control-plane/validators");
-      const binValidatorsDir = resolve12(resolveControlPlaneHostBinDir(context.projectRoot), "validators");
+      const pluginsDir = resolve13(context.projectRoot, "rig/plugins");
+      const binPluginsDir = resolve13(resolveControlPlaneHostBinDir(context.projectRoot), "plugins");
+      const validatorsRoot = resolve13(hostProjectRoot, "packages/runtime/src/control-plane/validators");
+      const binValidatorsDir = resolve13(resolveControlPlaneHostBinDir(context.projectRoot), "validators");
       mkdirSync6(binPluginsDir, { recursive: true });
       mkdirSync6(binValidatorsDir, { recursive: true });
-      if (existsSync7(pluginsDir)) {
+      if (existsSync8(pluginsDir)) {
         for (const entry of readdirSync(pluginsDir, { withFileTypes: true })) {
           const m = entry.name.match(/^(.+)\.plugin\.(ts|js|mjs|cjs)$/);
           if (!m)
             continue;
-          targets.push({ source: `rig/plugins/${entry.name}`, dest: resolve12(imageDir, `bin/plugins/${m[1]}`), cwd: context.projectRoot });
+          targets.push({ source: `rig/plugins/${entry.name}`, dest: resolve13(imageDir, `bin/plugins/${m[1]}`), cwd: context.projectRoot });
         }
       }
       targets.push(...collectRigValidatorBuildTargets({ contextProjectRoot: context.projectRoot, hostProjectRoot, imageDir }));
@@ -3931,17 +3949,17 @@ async function executeDist(context, args) {
         const isValidator = dest.includes("/bin/validators/");
         await buildBinary2(source, dest, cwd, isValidator ? { AGENT_BUN_PATH: Bun.which("bun") || "bun" } : { AGENT_PROJECT_ROOT: context.projectRoot });
       }
-      if (existsSync7(pluginsDir)) {
+      if (existsSync8(pluginsDir)) {
         for (const entry of readdirSync(pluginsDir, { withFileTypes: true })) {
           const m = entry.name.match(/^(.+)\.plugin\.(ts|js|mjs|cjs)$/);
           if (!m)
             continue;
           const pluginName = m[1];
-          const imageBin = resolve12(imageDir, `bin/plugins/${pluginName}`);
+          const imageBin = resolve13(imageDir, `bin/plugins/${pluginName}`);
           if (!pluginName)
             continue;
-          const symlinkPath = resolve12(binPluginsDir, pluginName);
-          if (existsSync7(imageBin)) {
+          const symlinkPath = resolve13(binPluginsDir, pluginName);
+          if (existsSync8(imageBin)) {
             try {
               unlinkSync(symlinkPath);
             } catch {}
@@ -3949,10 +3967,10 @@ async function executeDist(context, args) {
           }
         }
       }
-      if (existsSync7(validatorsRoot)) {
+      if (existsSync8(validatorsRoot)) {
         const categories = readdirSync(validatorsRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory());
         for (const category of categories) {
-          const categoryDir = resolve12(validatorsRoot, category.name);
+          const categoryDir = resolve13(validatorsRoot, category.name);
           for (const entry of readdirSync(categoryDir, { withFileTypes: true })) {
             if (!entry.isFile() || !entry.name.endsWith(".ts"))
               continue;
@@ -3960,9 +3978,9 @@ async function executeDist(context, args) {
             if (!check || check === "index" || check === "shared")
               continue;
             const validatorName = `${category.name}-${check}`;
-            const imageBin = resolve12(imageDir, `bin/validators/${validatorName}`);
-            const symlinkPath = resolve12(binValidatorsDir, validatorName);
-            if (existsSync7(imageBin)) {
+            const imageBin = resolve13(imageDir, `bin/validators/${validatorName}`);
+            const symlinkPath = resolve13(binValidatorsDir, validatorName);
+            if (existsSync8(imageBin)) {
               try {
                 unlinkSync(symlinkPath);
               } catch {}
@@ -3971,18 +3989,18 @@ async function executeDist(context, args) {
           }
         }
       }
-      const agentsDir = resolve12(resolveControlPlaneMonorepoRuntimeDir(context.projectRoot), "agents");
-      if (existsSync7(agentsDir)) {
+      const agentsDir = resolve13(resolveControlPlaneMonorepoRuntimeDir(context.projectRoot), "agents");
+      if (existsSync8(agentsDir)) {
         let relinkCount = 0;
         for (const agentEntry of readdirSync(agentsDir, { withFileTypes: true })) {
           if (!agentEntry.isDirectory())
             continue;
-          const agentBinDir = resolve12(agentsDir, agentEntry.name, "worktree", ".rig", "bin");
-          if (!existsSync7(agentBinDir))
+          const agentBinDir = resolve13(agentsDir, agentEntry.name, "worktree", ".rig", "bin");
+          if (!existsSync8(agentBinDir))
             continue;
           const walkDir = (dir) => {
             for (const entry of readdirSync(dir, { withFileTypes: true })) {
-              const fullPath = resolve12(dir, entry.name);
+              const fullPath = resolve13(dir, entry.name);
               if (entry.isDirectory()) {
                 walkDir(fullPath);
               } else if (entry.isSymbolicLink()) {
@@ -4016,7 +4034,7 @@ async function executeDist(context, args) {
 
 // packages/cli/src/commands/inbox.ts
 import { writeFileSync as writeFileSync4 } from "fs";
-import { resolve as resolve13 } from "path";
+import { resolve as resolve14 } from "path";
 import {
   listAuthorityRuns,
   readJsonlFile as readJsonlFile3,
@@ -4033,7 +4051,7 @@ async function executeInbox(context, args) {
       pending = task.rest;
       requireNoExtraArgs(pending, "bun run rig inbox approvals [--run <id>] [--task <id>]");
       const runs = listAuthorityRuns(context.projectRoot).filter((entry) => (!run.value || entry.runId === run.value) && (!task.value || entry.taskId === task.value));
-      const approvals = runs.flatMap((entry) => readJsonlFile3(resolve13(resolveAuthorityRunDir2(context.projectRoot, entry.runId), "approvals.jsonl")).map((record) => ({
+      const approvals = runs.flatMap((entry) => readJsonlFile3(resolve14(resolveAuthorityRunDir2(context.projectRoot, entry.runId), "approvals.jsonl")).map((record) => ({
         runId: entry.runId,
         record
       })));
@@ -4061,7 +4079,7 @@ async function executeInbox(context, args) {
       if (decision.value !== "approve" && decision.value !== "reject") {
         throw new CliError2("decision must be approve or reject.");
       }
-      const approvalsPath = resolve13(resolveAuthorityRunDir2(context.projectRoot, run.value), "approvals.jsonl");
+      const approvalsPath = resolve14(resolveAuthorityRunDir2(context.projectRoot, run.value), "approvals.jsonl");
       const approvals = readJsonlFile3(approvalsPath);
       const resolvedAt = new Date().toISOString();
       const next = approvals.map((entry) => entry.requestId === request.value || entry.id === request.value ? { ...entry, status: "resolved", decision: decision.value, note: note3.value ?? null, resolvedAt } : entry);
@@ -4078,7 +4096,7 @@ async function executeInbox(context, args) {
       pending = task.rest;
       requireNoExtraArgs(pending, "bun run rig inbox inputs [--run <id>] [--task <id>]");
       const runs = listAuthorityRuns(context.projectRoot).filter((entry) => (!run.value || entry.runId === run.value) && (!task.value || entry.taskId === task.value));
-      const requests = runs.flatMap((entry) => readJsonlFile3(resolve13(resolveAuthorityRunDir2(context.projectRoot, entry.runId), "user-input.jsonl")).map((record) => ({
+      const requests = runs.flatMap((entry) => readJsonlFile3(resolve14(resolveAuthorityRunDir2(context.projectRoot, entry.runId), "user-input.jsonl")).map((record) => ({
         runId: entry.runId,
         record
       })));
@@ -4120,7 +4138,7 @@ async function executeInbox(context, args) {
         const [key, ...restValue] = entry.split("=");
         return [key, restValue.join("=")];
       }));
-      const requestsPath = resolve13(resolveAuthorityRunDir2(context.projectRoot, run.value), "user-input.jsonl");
+      const requestsPath = resolve14(resolveAuthorityRunDir2(context.projectRoot, run.value), "user-input.jsonl");
       const requests = readJsonlFile3(requestsPath);
       const resolvedAt = new Date().toISOString();
       const next = requests.map((entry) => entry.requestId === request.value || entry.id === request.value ? { ...entry, status: "resolved", answers: parsedAnswers, respondedAt: resolvedAt, resolvedAt } : entry);
@@ -4135,14 +4153,14 @@ async function executeInbox(context, args) {
 }
 
 // packages/cli/src/commands/init.ts
-import { appendFileSync as appendFileSync2, existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
+import { appendFileSync as appendFileSync2, existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
 import { spawnSync as spawnSync2 } from "child_process";
-import { resolve as resolve16 } from "path";
+import { resolve as resolve17 } from "path";
 import { buildRigInitConfigSource } from "@rig/core";
 
 // packages/cli/src/commands/_snapshot-upload.ts
 import { mkdir, readdir, readFile, writeFile } from "fs/promises";
-import { dirname as dirname2, resolve as resolve14, relative, sep } from "path";
+import { dirname as dirname2, resolve as resolve15, relative, sep } from "path";
 var SNAPSHOT_ARCHIVE_VERSION = 1;
 var SNAPSHOT_ARCHIVE_CONTENT_TYPE = "application/vnd.rig.snapshot+json";
 var DEFAULT_EXCLUDED_DIRECTORIES = new Set([
@@ -4164,15 +4182,15 @@ function assertManifestPath(root, relativePath) {
   if (!relativePath || relativePath.startsWith("/") || relativePath.includes("\x00")) {
     throw new Error(`Invalid snapshot path: ${relativePath}`);
   }
-  const resolved = resolve14(root, relativePath);
+  const resolved = resolve15(root, relativePath);
   const relativeToRoot = relative(root, resolved);
-  if (relativeToRoot.startsWith("..") || relativeToRoot === ".." || resolve14(relativeToRoot) === resolved) {
+  if (relativeToRoot.startsWith("..") || relativeToRoot === ".." || resolve15(relativeToRoot) === resolved) {
     throw new Error(`Snapshot path escapes project root: ${relativePath}`);
   }
   return resolved;
 }
 async function buildSnapshotUploadManifest(projectRoot, options = {}) {
-  const root = resolve14(projectRoot);
+  const root = resolve15(projectRoot);
   const excludedDirectories = [...new Set([
     ...DEFAULT_EXCLUDED_DIRECTORIES,
     ...options.excludedDirectories ?? []
@@ -4184,7 +4202,7 @@ async function buildSnapshotUploadManifest(projectRoot, options = {}) {
     for (const entry of entries) {
       if (entry.isDirectory() && excludedSet.has(entry.name))
         continue;
-      const fullPath = resolve14(dir, entry.name);
+      const fullPath = resolve15(dir, entry.name);
       if (entry.isDirectory()) {
         await visit(fullPath);
         continue;
@@ -4232,8 +4250,8 @@ async function uploadSnapshotArchiveViaServer(context, input) {
 }
 
 // packages/cli/src/commands/_doctor-checks.ts
-import { existsSync as existsSync8, readFileSync as readFileSync4 } from "fs";
-import { resolve as resolve15 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync5 } from "fs";
+import { resolve as resolve16 } from "path";
 import { isSupportedBunVersion, MIN_SUPPORTED_BUN_VERSION } from "@rig/runtime/control-plane/setup-version";
 function check(id, label, status, detail, remediation) {
   return {
@@ -4273,11 +4291,11 @@ function repoSlugFromConfig(config) {
 function loadFallbackConfig(projectRoot) {
   const candidates = ["rig.config.ts", "rig.config.mts", "rig.config.json"];
   for (const name of candidates) {
-    const path = resolve15(projectRoot, name);
-    if (!existsSync8(path))
+    const path = resolve16(projectRoot, name);
+    if (!existsSync9(path))
       continue;
     try {
-      const source = readFileSync4(path, "utf8");
+      const source = readFileSync5(path, "utf8");
       if (name.endsWith(".json"))
         return JSON.parse(source);
       const owner = source.match(/owner\s*:\s*["']([^"']+)["']/)?.[1];
@@ -4356,7 +4374,7 @@ async function runRigDoctorChecks(options) {
   checks.push(check("bun", `bun >= ${MIN_SUPPORTED_BUN_VERSION}`, isSupportedBunVersion(bunVersion) ? "pass" : "fail", `found ${bunVersion}`, `Install Bun ${MIN_SUPPORTED_BUN_VERSION} or newer.`), check("git", "git", which("git") ? "pass" : "fail", which("git") ?? undefined, "Install git and ensure it is on PATH."), check("jq", "jq", which("jq") ? "pass" : "warn", which("jq") ?? undefined, "Install jq (for example `brew install jq`)."));
   const loadedConfig = await loadConfig(projectRoot).catch(() => null);
   const config = loadedConfig ?? loadFallbackConfig(projectRoot);
-  const hasConfigFile = ["rig.config.ts", "rig.config.mts", "rig.config.json"].some((name) => existsSync8(resolve15(projectRoot, name)));
+  const hasConfigFile = ["rig.config.ts", "rig.config.mts", "rig.config.json"].some((name) => existsSync9(resolve16(projectRoot, name)));
   checks.push(config ? check("config", "rig.config loadable", "pass") : check("config", "rig.config loadable", hasConfigFile ? "fail" : "fail", hasConfigFile ? "config file exists but failed to load" : "missing rig.config.ts/json", "Run `rig init` or fix the config error."));
   const taskSourceKind = config?.taskSource?.kind;
   checks.push(taskSourceKind ? check("task-source", "task source configured", "pass", taskSourceKind) : check("task-source", "task source configured", "fail", "missing taskSource", "Configure taskSource in rig.config.ts."));
@@ -4451,10 +4469,10 @@ function countDoctorFailures(checks) {
 }
 
 // packages/cli/src/commands/init.ts
-var RIG_CONFIG_PACKAGE_VERSION = "0.0.6-alpha.1";
+var RIG_CONFIG_PACKAGE_DIST_TAG = "latest";
 var RIG_CONFIG_DEV_DEPENDENCIES = {
-  "@rig/core": `npm:@h-rig/core@${RIG_CONFIG_PACKAGE_VERSION}`,
-  "@rig/standard-plugin": `npm:@h-rig/standard-plugin@${RIG_CONFIG_PACKAGE_VERSION}`
+  "@rig/core": `npm:@h-rig/core@${RIG_CONFIG_PACKAGE_DIST_TAG}`,
+  "@rig/standard-plugin": `npm:@h-rig/standard-plugin@${RIG_CONFIG_PACKAGE_DIST_TAG}`
 };
 function parseRepoSlugFromRemote(remoteUrl) {
   const trimmed = remoteUrl.trim();
@@ -4474,20 +4492,20 @@ function parseRepoSlug(value) {
   return { owner: match[1], repo: match[2], slug: `${match[1]}/${match[2]}` };
 }
 function ensureRigPrivateDirs(projectRoot) {
-  const rigDir = resolve16(projectRoot, ".rig");
-  mkdirSync7(resolve16(rigDir, "state"), { recursive: true });
-  mkdirSync7(resolve16(rigDir, "logs"), { recursive: true });
-  mkdirSync7(resolve16(rigDir, "runs"), { recursive: true });
-  mkdirSync7(resolve16(rigDir, "tmp"), { recursive: true });
-  mkdirSync7(resolve16(projectRoot, "artifacts"), { recursive: true });
-  const taskConfigPath = resolve16(rigDir, "task-config.json");
-  if (!existsSync9(taskConfigPath))
+  const rigDir = resolve17(projectRoot, ".rig");
+  mkdirSync7(resolve17(rigDir, "state"), { recursive: true });
+  mkdirSync7(resolve17(rigDir, "logs"), { recursive: true });
+  mkdirSync7(resolve17(rigDir, "runs"), { recursive: true });
+  mkdirSync7(resolve17(rigDir, "tmp"), { recursive: true });
+  mkdirSync7(resolve17(projectRoot, "artifacts"), { recursive: true });
+  const taskConfigPath = resolve17(rigDir, "task-config.json");
+  if (!existsSync10(taskConfigPath))
     writeFileSync5(taskConfigPath, `{}
 `, "utf-8");
 }
 function ensureGitignoreEntries(projectRoot) {
-  const path = resolve16(projectRoot, ".gitignore");
-  const existing = existsSync9(path) ? readFileSync5(path, "utf8") : "";
+  const path = resolve17(projectRoot, ".gitignore");
+  const existing = existsSync10(path) ? readFileSync6(path, "utf8") : "";
   const entries = [".rig/state/", ".rig/logs/", ".rig/runs/", ".rig/tmp/"];
   const missing = entries.filter((entry) => !existing.split(/\r?\n/).includes(entry));
   if (missing.length === 0)
@@ -4500,14 +4518,14 @@ function ensureGitignoreEntries(projectRoot) {
 `, "utf8");
 }
 function ensureRigConfigPackageDependencies(projectRoot) {
-  const path = resolve16(projectRoot, "package.json");
-  const existing = existsSync9(path) ? JSON.parse(readFileSync5(path, "utf8")) : {};
+  const path = resolve17(projectRoot, "package.json");
+  const existing = existsSync10(path) ? JSON.parse(readFileSync6(path, "utf8")) : {};
   const devDependencies = existing.devDependencies && typeof existing.devDependencies === "object" && !Array.isArray(existing.devDependencies) ? { ...existing.devDependencies } : {};
   for (const [name, spec] of Object.entries(RIG_CONFIG_DEV_DEPENDENCIES)) {
     devDependencies[name] = spec;
   }
   const next = {
-    ...existsSync9(path) ? existing : { name: "rig-project", private: true },
+    ...existsSync10(path) ? existing : { name: "rig-project", private: true },
     devDependencies
   };
   writeFileSync5(path, `${JSON.stringify(next, null, 2)}
@@ -4577,15 +4595,54 @@ async function promptSelect(prompts, options) {
     throw new CliError2("Init cancelled.", 1);
   return String(value);
 }
-async function pollDeviceAuthOnce(context, pollId) {
+function sleep2(ms) {
+  return new Promise((resolve18) => setTimeout(resolve18, ms));
+}
+function positiveIntFromEnv(name, fallback) {
+  const value = Number.parseInt(process.env[name] ?? "", 10);
+  return Number.isFinite(value) && value >= 0 ? value : fallback;
+}
+function apiSessionTokenFrom(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return null;
+  const token = payload.apiSessionToken;
+  return typeof token === "string" && token.trim() ? token.trim() : null;
+}
+function writeRemoteGitHubAuthState(projectRoot, input) {
+  writeFileSync5(resolve17(projectRoot, ".rig", "state", "github-auth.json"), `${JSON.stringify({
+    authenticated: true,
+    source: input.source,
+    storedOnServer: true,
+    selectedRepo: input.selectedRepo,
+    ...input.apiSessionToken ? { apiSessionToken: input.apiSessionToken } : {},
+    updatedAt: new Date().toISOString()
+  }, null, 2)}
+`, "utf8");
+}
+async function pollDeviceAuthUntilComplete(context, pollId, firstPayload) {
   if (typeof pollId !== "string" || !pollId.trim())
     return null;
-  const payload = await requestServerJson(context, "/api/github/auth/device/poll", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ pollId })
-  }).catch(() => null);
-  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : null;
+  const intervalSeconds = typeof firstPayload.interval === "number" && Number.isFinite(firstPayload.interval) && firstPayload.interval > 0 ? firstPayload.interval : 5;
+  const timeoutMs = positiveIntFromEnv("RIG_DEVICE_AUTH_POLL_TIMEOUT_MS", 300000);
+  const intervalMs = positiveIntFromEnv("RIG_DEVICE_AUTH_POLL_INTERVAL_MS", Math.max(1000, intervalSeconds * 1000));
+  const deadline = Date.now() + timeoutMs;
+  let last = null;
+  do {
+    const payload = await requestServerJson(context, "/api/github/auth/device/poll", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ pollId })
+    }).catch(() => null);
+    last = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : null;
+    const status = typeof last?.status === "string" ? last.status : null;
+    if (status === "signed-in" || status === "expired" || status === "cancelled" || status === "failed") {
+      return last;
+    }
+    if (timeoutMs <= 0)
+      return last;
+    await sleep2(intervalMs);
+  } while (Date.now() < deadline);
+  return last;
 }
 async function runControlPlaneInit(context, options) {
   const projectRoot = context.projectRoot;
@@ -4608,9 +4665,9 @@ async function runControlPlaneInit(context, options) {
   });
   ensureRigPrivateDirs(projectRoot);
   ensureGitignoreEntries(projectRoot);
-  const configTsPath = resolve16(projectRoot, "rig.config.ts");
-  const configJsonPath = resolve16(projectRoot, "rig.config.json");
-  const configExists = existsSync9(configTsPath) || existsSync9(configJsonPath);
+  const configTsPath = resolve17(projectRoot, "rig.config.ts");
+  const configJsonPath = resolve17(projectRoot, "rig.config.json");
+  const configExists = existsSync10(configTsPath) || existsSync10(configJsonPath);
   if (!options.privateStateOnly) {
     if (configExists && !options.repair) {
       if (context.outputMode !== "json")
@@ -4626,7 +4683,7 @@ async function runControlPlaneInit(context, options) {
     }
     ensureRigConfigPackageDependencies(projectRoot);
   }
-  writeFileSync5(resolve16(projectRoot, ".rig", "state", "project-link.json"), `${JSON.stringify({ repoSlug: repo.slug, connection: connectionAlias, linkedAt: new Date().toISOString() }, null, 2)}
+  writeFileSync5(resolve17(projectRoot, ".rig", "state", "project-link.json"), `${JSON.stringify({ repoSlug: repo.slug, connection: connectionAlias, linkedAt: new Date().toISOString() }, null, 2)}
 `, "utf8");
   const checkout = checkoutForInit(projectRoot, serverKind, options.remoteCheckout);
   let uploadedSnapshot = null;
@@ -4648,10 +4705,14 @@ async function runControlPlaneInit(context, options) {
   const token = authMethod === "gh" && !options.githubToken ? readGhAuthToken() : options.githubToken?.trim();
   if (token) {
     githubAuth = await postGitHubTokenViaServer(context, token, { selectedRepo: repo.slug });
-    setGitHubBearerTokenForCurrentProcess(token);
+    const apiSessionToken = apiSessionTokenFrom(githubAuth);
+    setGitHubBearerTokenForCurrentProcess(apiSessionToken ?? token);
     if (serverKind === "remote") {
-      writeFileSync5(resolve16(projectRoot, ".rig", "state", "github-auth.json"), `${JSON.stringify({ authenticated: true, source: authMethod === "gh" ? "gh" : "init-token", storedOnServer: true, selectedRepo: repo.slug, updatedAt: new Date().toISOString() }, null, 2)}
-`, "utf8");
+      writeRemoteGitHubAuthState(projectRoot, {
+        source: authMethod === "gh" ? "gh" : "init-token",
+        selectedRepo: repo.slug,
+        apiSessionToken
+      });
     }
   } else if (authMethod === "device") {
     const payload = await requestServerJson(context, "/api/github/auth/device/start", {
@@ -4660,9 +4721,22 @@ async function runControlPlaneInit(context, options) {
       body: JSON.stringify({ repoSlug: repo.slug })
     });
     deviceAuth = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
-    const completed = await pollDeviceAuthOnce(context, deviceAuth.pollId);
-    if (completed)
+    if (context.outputMode !== "json") {
+      const verificationUri = String(deviceAuth.verificationUri ?? deviceAuth.verification_uri ?? deviceAuth.verification_uri_complete ?? "the verification URL returned by the server");
+      const userCode = String(deviceAuth.userCode ?? deviceAuth.user_code ?? "the returned user code");
+      console.log(`GitHub device flow: open ${verificationUri} and enter ${userCode}. Waiting for authorization...`);
+    }
+    const completed = await pollDeviceAuthUntilComplete(context, deviceAuth.pollId, deviceAuth);
+    if (completed) {
+      const apiSessionToken = apiSessionTokenFrom(completed);
+      if (apiSessionToken) {
+        setGitHubBearerTokenForCurrentProcess(apiSessionToken);
+        if (serverKind === "remote") {
+          writeRemoteGitHubAuthState(projectRoot, { source: "device", selectedRepo: repo.slug, apiSessionToken });
+        }
+      }
       deviceAuth = { ...deviceAuth, poll: completed, completed: completed.status === "signed-in" };
+    }
   }
   let remoteCheckoutPreparation = null;
   if (serverKind === "remote" && options.remoteCheckout?.kind !== "uploaded-snapshot") {
@@ -4682,6 +4756,12 @@ async function runControlPlaneInit(context, options) {
   });
   const checkoutPath = typeof checkout.path === "string" ? checkout.path : null;
   const serverRootSwitch = serverKind === "remote" && checkoutPath ? await switchServerProjectRootViaServer(context, checkoutPath) : null;
+  if (serverRootSwitch && token) {
+    githubAuth = await postGitHubTokenViaServer(context, token, { selectedRepo: repo.slug, projectRoot: checkoutPath ?? undefined });
+    const apiSessionToken = apiSessionTokenFrom(githubAuth);
+    setGitHubBearerTokenForCurrentProcess(apiSessionToken ?? token);
+    writeRemoteGitHubAuthState(projectRoot, { source: authMethod === "gh" ? "gh" : "init-token", selectedRepo: repo.slug, apiSessionToken });
+  }
   const activeProjectRegistration = serverRootSwitch ? await registerProjectViaServer(context, { repoSlug: repo.slug, checkout }) : null;
   const pi = serverKind === "remote" ? await ensureRemotePiRigInstalled({ requestJson: (pathname, init) => requestServerJson(context, pathname, init) }).catch((error) => ({
     remote: true,
@@ -4791,7 +4871,7 @@ function parseInitOptions(args) {
 async function runInteractiveControlPlaneInit(context, prompts) {
   prompts.intro?.("Initialize a Rig control-plane project");
   const projectRoot = context.projectRoot;
-  const existingConfig = existsSync9(resolve16(projectRoot, "rig.config.ts")) || existsSync9(resolve16(projectRoot, "rig.config.json"));
+  const existingConfig = existsSync10(resolve17(projectRoot, "rig.config.ts")) || existsSync10(resolve17(projectRoot, "rig.config.json"));
   let repair = false;
   let privateStateOnly = false;
   if (existingConfig) {
@@ -4891,7 +4971,7 @@ async function runInteractiveControlPlaneInit(context, prompts) {
   });
   const details = result.details && typeof result.details === "object" && !Array.isArray(result.details) ? result.details : {};
   const deviceAuth = details.deviceAuth && typeof details.deviceAuth === "object" && !Array.isArray(details.deviceAuth) ? details.deviceAuth : null;
-  const deviceMessage = deviceAuth ? ` GitHub device flow: open ${String(deviceAuth.verification_uri ?? deviceAuth.verification_uri_complete ?? "the verification URL returned by the server")} and enter ${String(deviceAuth.user_code ?? "the returned user code")}.` : "";
+  const deviceMessage = deviceAuth ? ` GitHub device flow: open ${String(deviceAuth.verificationUri ?? deviceAuth.verification_uri ?? deviceAuth.verification_uri_complete ?? "the verification URL returned by the server")} and enter ${String(deviceAuth.userCode ?? deviceAuth.user_code ?? "the returned user code")}.` : "";
   prompts.outro?.(`Rig project initialized.${deviceMessage} Next: rig doctor && rig task list`);
   return result;
 }
@@ -5053,8 +5133,8 @@ async function executeDoctor(context, args) {
 }
 
 // packages/cli/src/commands/_run-driver-helpers.ts
-import { readFileSync as readFileSync6 } from "fs";
-import { resolve as resolve17 } from "path";
+import { readFileSync as readFileSync7 } from "fs";
+import { resolve as resolve18 } from "path";
 import {
   appendJsonlRecord as appendJsonlRecord2,
   readAuthorityRun as readAuthorityRun2,
@@ -5074,7 +5154,7 @@ function patchAuthorityRun(projectRoot, runId, patch) {
     ...patch,
     updatedAt: new Date().toISOString()
   };
-  writeJsonFile4(resolve17(resolveAuthorityRunDir3(projectRoot, runId), "run.json"), next);
+  writeJsonFile4(resolve18(resolveAuthorityRunDir3(projectRoot, runId), "run.json"), next);
   return next;
 }
 function touchAuthorityRun(projectRoot, runId) {
@@ -5082,21 +5162,21 @@ function touchAuthorityRun(projectRoot, runId) {
   if (!current) {
     return;
   }
-  writeJsonFile4(resolve17(resolveAuthorityRunDir3(projectRoot, runId), "run.json"), {
+  writeJsonFile4(resolve18(resolveAuthorityRunDir3(projectRoot, runId), "run.json"), {
     ...current,
     updatedAt: new Date().toISOString()
   });
 }
 function appendRunTimeline(projectRoot, runId, value) {
-  appendJsonlRecord2(resolve17(resolveAuthorityRunDir3(projectRoot, runId), "timeline.jsonl"), value);
+  appendJsonlRecord2(resolve18(resolveAuthorityRunDir3(projectRoot, runId), "timeline.jsonl"), value);
   touchAuthorityRun(projectRoot, runId);
 }
 function appendRunLog(projectRoot, runId, value) {
-  appendJsonlRecord2(resolve17(resolveAuthorityRunDir3(projectRoot, runId), "logs.jsonl"), value);
+  appendJsonlRecord2(resolve18(resolveAuthorityRunDir3(projectRoot, runId), "logs.jsonl"), value);
   touchAuthorityRun(projectRoot, runId);
 }
 function appendRunAction(projectRoot, runId, value) {
-  appendJsonlRecord2(resolve17(resolveAuthorityRunDir3(projectRoot, runId), "timeline.jsonl"), {
+  appendJsonlRecord2(resolve18(resolveAuthorityRunDir3(projectRoot, runId), "timeline.jsonl"), {
     id: value.id,
     type: "action",
     actionType: value.actionType,
@@ -5167,7 +5247,7 @@ function buildRunPrompt(input) {
   })();
   const scopeText = (() => {
     try {
-      const parsed = JSON.parse(readFileSync6(resolveControlPlaneTaskConfigPath(input.projectRoot), "utf8"));
+      const parsed = JSON.parse(readFileSync7(resolveControlPlaneTaskConfigPath(input.projectRoot), "utf8"));
       const entry = parsed[input.taskId] ?? {};
       const scope = Array.isArray(entry.scope) ? entry.scope.filter((item) => typeof item === "string") : [];
       const validation = Array.isArray(entry.validation) ? entry.validation.filter((item) => typeof item === "string") : [];
@@ -5280,8 +5360,8 @@ function renderSourceScopeValidation(task, validation) {
 }
 
 // packages/cli/src/commands/inspect.ts
-import { existsSync as existsSync10, readFileSync as readFileSync7 } from "fs";
-import { resolve as resolve18 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync8 } from "fs";
+import { resolve as resolve19 } from "path";
 import {
   listAuthorityRuns as listAuthorityRuns2,
   readAuthorityRun as readAuthorityRun3,
@@ -5302,8 +5382,8 @@ async function executeInspect(context, args) {
       if (!latestRun) {
         throw new CliError2(`No runs found for ${requiredTask}.`);
       }
-      const logsPath = resolve18(resolveAuthorityRunDir4(context.projectRoot, latestRun.runId), "logs.jsonl");
-      if (!existsSync10(logsPath)) {
+      const logsPath = resolve19(resolveAuthorityRunDir4(context.projectRoot, latestRun.runId), "logs.jsonl");
+      if (!existsSync11(logsPath)) {
         throw new CliError2(`No logs found for run ${latestRun.runId}.`);
       }
       await context.runCommand(["cat", logsPath]);
@@ -5313,7 +5393,7 @@ async function executeInspect(context, args) {
       const { value: task, rest: remaining } = takeOption(rest, "--task");
       requireNoExtraArgs(remaining, "bun run rig inspect artifacts --task <beads-id>");
       const requiredTask = requireTask(task, "bun run rig inspect artifacts --task <beads-id>");
-      const artifactRoot = resolveTaskArtifactDirs(context.projectRoot, requiredTask).find((path) => existsSync10(path));
+      const artifactRoot = resolveTaskArtifactDirs(context.projectRoot, requiredTask).find((path) => existsSync11(path));
       if (!artifactRoot) {
         throw new CliError2(`No artifacts found for ${requiredTask}.`);
       }
@@ -5370,10 +5450,10 @@ async function executeInspect(context, args) {
     case "failures": {
       requireNoExtraArgs(rest, "bun run rig inspect failures");
       const failed = resolveHarnessPaths2(context.projectRoot).failedApproachesPath;
-      if (!existsSync10(failed)) {
+      if (!existsSync11(failed)) {
         console.log("No failures recorded.");
       } else {
-        process.stdout.write(readFileSync7(failed, "utf-8"));
+        process.stdout.write(readFileSync8(failed, "utf-8"));
       }
       return { ok: true, group: "inspect", command };
     }
@@ -5390,11 +5470,11 @@ async function executeInspect(context, args) {
       return { ok: true, group: "inspect", command };
     case "audit": {
       requireNoExtraArgs(rest, "bun run rig inspect audit");
-      const auditPath = resolve18(resolveHarnessPaths2(context.projectRoot).logsDir, "audit.jsonl");
-      if (!existsSync10(auditPath)) {
+      const auditPath = resolve19(resolveHarnessPaths2(context.projectRoot).logsDir, "audit.jsonl");
+      if (!existsSync11(auditPath)) {
         console.log("No audit log found.");
       } else {
-        const lines = readFileSync7(auditPath, "utf-8").split(/\r?\n/).filter(Boolean).slice(-20);
+        const lines = readFileSync8(auditPath, "utf-8").split(/\r?\n/).filter(Boolean).slice(-20);
         for (const line of lines) {
           console.log(line);
         }
@@ -6023,8 +6103,8 @@ async function executeRemote(context, args) {
 }
 
 // packages/cli/src/commands/run.ts
-import { existsSync as existsSync11, readFileSync as readFileSync8 } from "fs";
-import { resolve as resolve19 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
+import { resolve as resolve20 } from "path";
 import { createInterface as createInterface2 } from "readline/promises";
 import {
   listAuthorityRuns as listAuthorityRuns3,
@@ -6303,7 +6383,7 @@ async function executeRun(context, args) {
       if (!run.value) {
         throw new CliError2("run timeline requires --run <id>.");
       }
-      const timelinePath = resolve19(resolveAuthorityRunDir5(context.projectRoot, run.value), "timeline.jsonl");
+      const timelinePath = resolve20(resolveAuthorityRunDir5(context.projectRoot, run.value), "timeline.jsonl");
       const printEvents = () => {
         const events2 = readJsonlFile4(timelinePath);
         if (context.outputMode === "text") {
@@ -6315,12 +6395,12 @@ async function executeRun(context, args) {
       };
       const events = printEvents();
       if (follow.value && context.outputMode === "text") {
-        let lastLength = existsSync11(timelinePath) ? readFileSync8(timelinePath, "utf8").length : 0;
+        let lastLength = existsSync12(timelinePath) ? readFileSync9(timelinePath, "utf8").length : 0;
         while (true) {
           await Bun.sleep(1000);
-          if (!existsSync11(timelinePath))
+          if (!existsSync12(timelinePath))
             continue;
-          const next = readFileSync8(timelinePath, "utf8");
+          const next = readFileSync9(timelinePath, "utf8");
           if (next.length <= lastLength)
             continue;
           const delta = next.slice(lastLength);
@@ -6606,10 +6686,10 @@ async function executeServer(context, args, options) {
 }
 
 // packages/cli/src/commands/task.ts
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 import { spawnSync as spawnSync4 } from "child_process";
 import { createInterface as createInterface4 } from "readline/promises";
-import { resolve as resolve20 } from "path";
+import { resolve as resolve21 } from "path";
 import {
   taskArtifactDir,
   taskArtifacts,
@@ -6940,7 +7020,7 @@ async function executeTask(context, args, options) {
       const fileFlag = takeOption(rest.slice(1), "--file");
       let content;
       if (fileFlag.value) {
-        content = readFileSync9(resolve20(context.projectRoot, fileFlag.value), "utf-8");
+        content = readFileSync10(resolve21(context.projectRoot, fileFlag.value), "utf-8");
       } else {
         content = await readStdin();
       }
@@ -7161,8 +7241,8 @@ async function executeTask(context, args, options) {
 }
 
 // packages/cli/src/commands/task-run-driver.ts
-import { copyFileSync as copyFileSync3, existsSync as existsSync12, mkdirSync as mkdirSync8, readFileSync as readFileSync10, statSync as statSync2 } from "fs";
-import { resolve as resolve21 } from "path";
+import { copyFileSync as copyFileSync3, existsSync as existsSync13, mkdirSync as mkdirSync8, readFileSync as readFileSync11, statSync as statSync2, writeFileSync as writeFileSync6 } from "fs";
+import { resolve as resolve22 } from "path";
 import { spawn as spawn2, spawnSync as spawnSync5 } from "child_process";
 import { createInterface as createLineInterface } from "readline";
 import { loadConfig as loadConfig2 } from "@rig/core/load-config";
@@ -7196,7 +7276,24 @@ import {
   commitRunChanges,
   runPrAutomation
 } from "@rig/runtime/control-plane/native/pr-automation";
+function looksLikeGitHubToken(value) {
+  const token = value?.trim();
+  if (!token)
+    return false;
+  return /^(gh[opusr]_|github_pat_)/.test(token);
+}
+function githubBridgeEnv(token) {
+  const clean = token?.trim();
+  if (!clean)
+    return {};
+  return {
+    RIG_GITHUB_TOKEN: clean,
+    GITHUB_TOKEN: clean,
+    GH_TOKEN: clean
+  };
+}
 function buildPiRigBridgeEnv(input) {
+  const githubToken = input.githubToken?.trim() || (looksLikeGitHubToken(input.authToken) ? input.authToken.trim() : "");
   return {
     RIG_PROJECT_ROOT: input.projectRoot,
     PROJECT_RIG_ROOT: input.projectRoot,
@@ -7206,7 +7303,7 @@ function buildPiRigBridgeEnv(input) {
     RIG_RUNTIME_ADAPTER: "pi",
     ...input.serverUrl ? { RIG_SERVER_URL: input.serverUrl } : {},
     ...input.authToken ? { RIG_AUTH_TOKEN: input.authToken } : {},
-    ...input.githubToken ? { RIG_GITHUB_TOKEN: input.githubToken } : {}
+    ...githubBridgeEnv(githubToken)
   };
 }
 function runGitSync(cwd, args, input) {
@@ -7228,12 +7325,12 @@ function copyUntrackedDirtyFiles(sourceRoot, targetRoot) {
     return 0;
   let copied = 0;
   for (const relativePath of listed.stdout.split("\x00").filter(Boolean)) {
-    const sourcePath = resolve21(sourceRoot, relativePath);
-    const targetPath = resolve21(targetRoot, relativePath);
+    const sourcePath = resolve22(sourceRoot, relativePath);
+    const targetPath = resolve22(targetRoot, relativePath);
     try {
       if (!statSync2(sourcePath).isFile())
         continue;
-      mkdirSync8(resolve21(targetPath, ".."), { recursive: true });
+      mkdirSync8(resolve22(targetPath, ".."), { recursive: true });
       copyFileSync3(sourcePath, targetPath);
       copied += 1;
     } catch {}
@@ -7267,6 +7364,14 @@ function buildTaskRunReviewEnv(config) {
     ...review?.provider ? { AI_REVIEW_PROVIDER: review.provider } : {}
   };
 }
+function buildDirtyBaselineHandshakeEnv(input) {
+  if (input.baselineMode !== "dirty-snapshot")
+    return { RIG_BASELINE_MODE: input.baselineMode ?? "head" };
+  return {
+    RIG_BASELINE_MODE: "dirty-snapshot",
+    RIG_DIRTY_BASELINE_READY_FILE: resolve22(input.projectRoot, ".rig", "runs", input.runId, "dirty-baseline.ready.json")
+  };
+}
 function positiveInt(value, fallback) {
   return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;
 }
@@ -7375,9 +7480,9 @@ function createCommandRunner(binary) {
     const stderrChunks = [];
     child.stdout.on("data", (chunk) => stdoutChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk))));
     child.stderr.on("data", (chunk) => stderrChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk))));
-    return await new Promise((resolve22) => {
-      child.once("error", (error) => resolve22({ exitCode: 1, stderr: error.message }));
-      child.once("close", (code) => resolve22({
+    return await new Promise((resolve23) => {
+      child.once("error", (error) => resolve23({ exitCode: 1, stderr: error.message }));
+      child.once("close", (code) => resolve23({
         exitCode: code ?? 1,
         stdout: Buffer.concat(stdoutChunks).toString("utf8"),
         stderr: Buffer.concat(stderrChunks).toString("utf8")
@@ -7573,7 +7678,7 @@ function summarizeValidationFailure(projectRoot, taskId2) {
     return null;
   }
   for (const artifactDir of resolveTaskArtifactDirs2(projectRoot, taskId2)) {
-    const summary = readJsonFile3(resolve21(artifactDir, "validation-summary.json"), null);
+    const summary = readJsonFile3(resolve22(artifactDir, "validation-summary.json"), null);
     if (!summary || summary.status !== "fail") {
       continue;
     }
@@ -7654,9 +7759,9 @@ function readTaskRunAcceptedArtifactState(input) {
   if (!input.taskId || !input.workspaceDir) {
     return { accepted: false, reason: null };
   }
-  const artifactDir = resolve21(input.workspaceDir, "artifacts", input.taskId);
-  const reviewStatusPath = resolve21(artifactDir, "review-status.txt");
-  const taskResultPath = resolve21(artifactDir, "task-result.json");
+  const artifactDir = resolve22(input.workspaceDir, "artifacts", input.taskId);
+  const reviewStatusPath = resolve22(artifactDir, "review-status.txt");
+  const taskResultPath = resolve22(artifactDir, "task-result.json");
   const reviewStatus = readTaskRunReviewStatus(reviewStatusPath);
   if (reviewStatus !== "APPROVED") {
     return { accepted: false, reason: null };
@@ -7693,12 +7798,12 @@ function resolveTaskRunRetryContext(input) {
   if (!input.taskId || !input.workspaceDir) {
     return { shouldRetry: false, failureDetail: null, nextPrompt: null };
   }
-  const artifactDir = resolve21(input.workspaceDir, "artifacts", input.taskId);
-  const reviewStatePath = resolve21(artifactDir, "review-state.json");
-  const reviewFeedbackPath = resolve21(artifactDir, "review-feedback.md");
-  const reviewStatusPath = resolve21(artifactDir, "review-status.txt");
-  const failedApproachesPath = resolve21(input.workspaceDir, ".rig", "state", "failed_approaches.md");
-  const validationSummaryPath = resolve21(artifactDir, "validation-summary.json");
+  const artifactDir = resolve22(input.workspaceDir, "artifacts", input.taskId);
+  const reviewStatePath = resolve22(artifactDir, "review-state.json");
+  const reviewFeedbackPath = resolve22(artifactDir, "review-feedback.md");
+  const reviewStatusPath = resolve22(artifactDir, "review-status.txt");
+  const failedApproachesPath = resolve22(input.workspaceDir, ".rig", "state", "failed_approaches.md");
+  const validationSummaryPath = resolve22(artifactDir, "validation-summary.json");
   const reviewState = readJsonFile3(reviewStatePath, null);
   const reviewStatus = readTaskRunReviewStatus(reviewStatusPath);
   const reviewRejected = isTaskRunReviewRejected(reviewState);
@@ -7753,11 +7858,11 @@ function summarizeTaskRunReviewFailure(reviewState) {
   return "Completion verification rejected the task. Read review-feedback.md for required fixes.";
 }
 function readTaskRunReviewStatus(reviewStatusPath) {
-  if (!existsSync12(reviewStatusPath)) {
+  if (!existsSync13(reviewStatusPath)) {
     return null;
   }
   try {
-    const status = readFileSync10(reviewStatusPath, "utf8").trim().toUpperCase();
+    const status = readFileSync11(reviewStatusPath, "utf8").trim().toUpperCase();
     return status === "APPROVED" || status === "REJECTED" ? status : null;
   } catch {
     return null;
@@ -7841,7 +7946,7 @@ function stringArrayField(record, key) {
 async function executeRigOwnedTaskRun(context, input) {
   const runtimeTaskId = input.taskId?.trim() || `adhoc-${input.runId}`;
   const sourceTask = readRunSourceTaskContract(context.projectRoot, input.runId, input.taskId);
-  const prompt = buildRunPrompt({
+  let prompt = buildRunPrompt({
     projectRoot: context.projectRoot,
     taskId: input.taskId,
     fallbackTitle: input.title,
@@ -7941,7 +8046,22 @@ async function executeRigOwnedTaskRun(context, input) {
   const loadedAutomationConfig = await loadTaskRunAutomationConfig(context.projectRoot);
   const automationConfig = input.prMode ? { ...loadedAutomationConfig ?? {}, pr: { ...loadedAutomationConfig?.pr ?? {}, mode: input.prMode } } : loadedAutomationConfig;
   const planningClassification = classifyPlanningNeed({ config: automationConfig, sourceTask });
-  patchAuthorityRun(context.projectRoot, input.runId, { planning: planningClassification });
+  const planningArtifactPath = resolve22("artifacts", runtimeTaskId, "implementation-plan.md");
+  const persistedPlanning = {
+    ...planningClassification,
+    classifier: input.runtimeAdapter === "pi" ? "pi-rig-structured-policy" : "rig-structured-policy",
+    artifactPath: planningClassification.planningRequired ? planningArtifactPath : null,
+    classifiedAt: new Date().toISOString()
+  };
+  mkdirSync8(resolve22(context.projectRoot, ".rig", "runs", input.runId), { recursive: true });
+  writeFileSync6(resolve22(context.projectRoot, ".rig", "runs", input.runId, "planning-classification.json"), `${JSON.stringify(persistedPlanning, null, 2)}
+`, "utf8");
+  patchAuthorityRun(context.projectRoot, input.runId, { planning: persistedPlanning });
+  prompt = `${prompt}
+
+Rig planning classification:
+${JSON.stringify(persistedPlanning, null, 2)}
+${planningClassification.planningRequired ? `Before implementing, write a concise implementation plan to ${planningArtifactPath}. Treat that plan artifact as required acceptance evidence for the Plan stage.` : "Planning is not required for this run; briefly state why before implementation."}`;
   if (input.runtimeAdapter === "pi") {
     for (const stage of ["Connect", "GitHub/task sync", "Prepare workspace", "Launch Pi", "Plan", "Implement"]) {
       appendPiStageLog({
@@ -8008,6 +8128,7 @@ async function executeRigOwnedTaskRun(context, input) {
     ...sourceTask ? { RIG_SOURCE_TASK_JSON: JSON.stringify(sourceTask) } : {}
   };
   Object.assign(childEnv, buildTaskRunReviewEnv(automationConfig));
+  Object.assign(childEnv, buildDirtyBaselineHandshakeEnv({ projectRoot: context.projectRoot, runId: input.runId, baselineMode: input.baselineMode }));
   const automationLimits = resolveTaskRunAutomationLimits(automationConfig);
   const maxAttempts = automationLimits.maxValidationAttempts;
   const promoteToValidating = (detail) => {
@@ -8062,22 +8183,29 @@ async function executeRigOwnedTaskRun(context, input) {
       patchAuthorityRun(context.projectRoot, input.runId, {
         status: "running",
         worktreePath: latestRuntimeWorkspace,
-        artifactRoot: latestRuntimeWorkspace && input.taskId ? resolve21(latestRuntimeWorkspace, "artifacts", input.taskId) : null,
+        artifactRoot: latestRuntimeWorkspace && input.taskId ? resolve22(latestRuntimeWorkspace, "artifacts", input.taskId) : null,
         logRoot: latestLogsDir,
-        sessionPath: latestSessionDir ? resolve21(latestSessionDir, "session.json") : null,
-        sessionLogPath: latestLogsDir ? resolve21(latestLogsDir, "agent-stdout.log") : null,
+        sessionPath: latestSessionDir ? resolve22(latestSessionDir, "session.json") : null,
+        sessionLogPath: latestLogsDir ? resolve22(latestLogsDir, "agent-stdout.log") : null,
         branch: runtimeId
       });
       if (!dirtyBaselineApplied && input.baselineMode === "dirty-snapshot" && latestRuntimeWorkspace) {
         dirtyBaselineApplied = true;
         const dirty = applyDirtyBaselineSnapshot({ sourceRoot: context.projectRoot, targetRoot: latestRuntimeWorkspace });
+        const readyFile = childEnv.RIG_DIRTY_BASELINE_READY_FILE;
+        if (readyFile) {
+          mkdirSync8(resolve22(readyFile, ".."), { recursive: true });
+          writeFileSync6(readyFile, `${JSON.stringify({ ...dirty, workspaceDir: latestRuntimeWorkspace, appliedAt: new Date().toISOString() }, null, 2)}
+`, "utf8");
+        }
         appendRunLog(context.projectRoot, input.runId, {
           id: `log:${input.runId}:dirty-baseline`,
           title: "Dirty baseline snapshot",
           detail: dirty.detail,
           tone: dirty.applied ? "tool" : "info",
           status: dirty.applied ? "completed" : "skipped",
-          createdAt: new Date().toISOString()
+          createdAt: new Date().toISOString(),
+          payload: readyFile ? { readyFile } : undefined
         });
         emitServerRunEvent({ type: "log", runId: input.runId, title: "Dirty baseline snapshot" });
       }
@@ -8344,7 +8472,7 @@ async function executeRigOwnedTaskRun(context, input) {
     let acceptedArtifactObservedAt = null;
     let acceptedArtifactPollTimer = null;
     let acceptedArtifactKillTimer = null;
-    const attemptExit = await new Promise((resolve22) => {
+    const attemptExit = await new Promise((resolve23) => {
       let settled = false;
       const settle = (result) => {
         if (settled)
@@ -8352,7 +8480,7 @@ async function executeRigOwnedTaskRun(context, input) {
         settled = true;
         if (acceptedArtifactPollTimer)
           clearInterval(acceptedArtifactPollTimer);
-        resolve22(result);
+        resolve23(result);
       };
       const pollAcceptedArtifacts = () => {
         const artifactState = readTaskRunAcceptedArtifactState({
@@ -8549,6 +8677,29 @@ Failed to update task source for ${input.taskId ?? runtimeTaskId} to failed: ${e
     });
     throw new CliError2(terminalFailureDetail, exit.code ?? 1);
   }
+  if (planningClassification.planningRequired) {
+    const planWorkspace = latestRuntimeWorkspace ?? context.projectRoot;
+    const expectedPlanPath = resolve22(planWorkspace, planningArtifactPath);
+    if (!existsSync13(expectedPlanPath)) {
+      const failedAt = new Date().toISOString();
+      const failureDetail = `Planning was required (${planningClassification.reason}) but ${planningArtifactPath} was not written before implementation completed.`;
+      patchAuthorityRun(context.projectRoot, input.runId, {
+        status: "needs_attention",
+        completedAt: failedAt,
+        errorText: failureDetail
+      });
+      appendRunLog(context.projectRoot, input.runId, {
+        id: `log:${input.runId}:plan-artifact-missing`,
+        title: "Required plan artifact missing",
+        detail: failureDetail,
+        tone: "error",
+        status: "needs_attention",
+        createdAt: failedAt
+      });
+      emitServerRunEvent({ type: "failed", runId: input.runId, error: failureDetail });
+      throw new CliError2(failureDetail, 1);
+    }
+  }
   const runPiPrFeedbackFix = async (message2) => {
     appendPiStageLog({
       projectRoot: context.projectRoot,
@@ -8606,9 +8757,9 @@ Failed to update task source for ${input.taskId ?? runtimeTaskId} to failed: ${e
       });
       emitServerRunEvent({ type: "log", runId: input.runId, title: "Pi PR feedback fix stderr" });
     });
-    const exitCode = await new Promise((resolve22) => {
-      child.once("error", () => resolve22(1));
-      child.once("close", (code) => resolve22(code ?? 1));
+    const exitCode = await new Promise((resolve23) => {
+      child.once("error", () => resolve23(1));
+      child.once("close", (code) => resolve23(code ?? 1));
     });
     if (exitCode !== 0) {
       throw new Error(`Pi PR feedback fix failed with exit code ${exitCode}.`);
@@ -8727,8 +8878,8 @@ async function executeTest(context, args) {
 }
 
 // packages/cli/src/commands/setup.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync9, readdirSync as readdirSync2, writeFileSync as writeFileSync6 } from "fs";
-import { resolve as resolve22 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync9, readdirSync as readdirSync2, writeFileSync as writeFileSync7 } from "fs";
+import { resolve as resolve23 } from "path";
 import { createPluginHost } from "@rig/core";
 import {
   isSupportedBunVersion as isSupportedBunVersion2,
@@ -8791,9 +8942,9 @@ function runSetupInit(projectRoot) {
   mkdirSync9(stateDir, { recursive: true });
   mkdirSync9(logsDir, { recursive: true });
   mkdirSync9(artifactsDir, { recursive: true });
-  const failuresPath = resolve22(stateDir, "failed_approaches.md");
-  if (!existsSync13(failuresPath)) {
-    writeFileSync6(failuresPath, `# Failed Approaches
+  const failuresPath = resolve23(stateDir, "failed_approaches.md");
+  if (!existsSync14(failuresPath)) {
+    writeFileSync7(failuresPath, `# Failed Approaches
 
 `, "utf-8");
   }
@@ -8810,18 +8961,18 @@ async function runSetupCheck(projectRoot) {
 }
 async function runSetupPreflight(projectRoot) {
   await runSetupCheck(projectRoot);
-  const validationRoot = resolve22(resolveControlPlaneDefinitionRoot(projectRoot), "validation");
-  if (existsSync13(validationRoot)) {
+  const validationRoot = resolve23(resolveControlPlaneDefinitionRoot(projectRoot), "validation");
+  if (existsSync14(validationRoot)) {
     const validators = readdirSync2(validationRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory());
     for (const validator of validators) {
-      const script = resolve22(validationRoot, validator.name, "validate.sh");
-      if (existsSync13(script)) {
+      const script = resolve23(validationRoot, validator.name, "validate.sh");
+      if (existsSync14(script)) {
         console.log(`OK: validator script ${script}`);
       }
     }
   }
-  const hooksRoot = resolve22(resolveControlPlaneDefinitionRoot(projectRoot), "hooks");
-  if (existsSync13(hooksRoot)) {
+  const hooksRoot = resolve23(resolveControlPlaneDefinitionRoot(projectRoot), "hooks");
+  if (existsSync14(hooksRoot)) {
     const hooks = readdirSync2(hooksRoot).filter((name) => name.endsWith(".sh"));
     for (const hook of hooks) {
       console.log(`OK: hook ${hook}`);
@@ -9198,8 +9349,8 @@ async function executeGroup(context, group, args) {
   }
 }
 // packages/cli/src/launcher.ts
-import { existsSync as existsSync14 } from "fs";
-import { resolve as resolve23 } from "path";
+import { existsSync as existsSync15 } from "fs";
+import { resolve as resolve24 } from "path";
 import { loadDotEnvSecrets } from "@rig/runtime/baked-secrets";
 import { RIG_DEFINITION_DIRNAME, RIG_STATE_DIRNAME, resolveNearestRigProjectRoot } from "@rig/runtime/layout";
 function parsePolicyMode(value) {
@@ -9212,7 +9363,7 @@ function parsePolicyMode(value) {
   throw new Error(`Invalid --policy-mode value: ${value}. Use off|observe|enforce.`);
 }
 function hasRigProjectMarker(candidate) {
-  return existsSync14(resolve23(candidate, RIG_DEFINITION_DIRNAME)) || existsSync14(resolve23(candidate, RIG_STATE_DIRNAME)) || existsSync14(resolve23(candidate, "rig.config.ts")) || existsSync14(resolve23(candidate, "rig.config.json"));
+  return existsSync15(resolve24(candidate, RIG_DEFINITION_DIRNAME)) || existsSync15(resolve24(candidate, RIG_STATE_DIRNAME)) || existsSync15(resolve24(candidate, "rig.config.ts")) || existsSync15(resolve24(candidate, "rig.config.json"));
 }
 function resolveProjectRoot({
   envProjectRoot,
@@ -9221,17 +9372,17 @@ function resolveProjectRoot({
   cwd = process.cwd()
 }) {
   if (envProjectRoot) {
-    return resolve23(cwd, envProjectRoot);
+    return resolve24(cwd, envProjectRoot);
   }
   const fallbackImportDir = importDir ?? cwd;
-  const candidates = [cwd, resolve23(execPath, "..", ".."), resolve23(fallbackImportDir, "..")];
+  const candidates = [cwd, resolve24(execPath, "..", ".."), resolve24(fallbackImportDir, "..")];
   for (const candidate of candidates) {
     const nearest = resolveNearestRigProjectRoot(candidate);
     if (hasRigProjectMarker(nearest)) {
       return nearest;
     }
   }
-  return resolve23(cwd);
+  return resolve24(cwd);
 }
 function normalizeCliErrorCode(message2, isCliError) {
   if (message2.startsWith("Invalid --policy-mode value:")) {
@@ -9298,7 +9449,7 @@ async function runRigCli(module, options = {}) {
         runId: context.runId,
         outcome,
         eventsFile: context.eventBus.getEventsFile(),
-        policyFile: resolve23(projectRoot, "rig", "policy", "policy.json"),
+        policyFile: resolve24(projectRoot, "rig", "policy", "policy.json"),
         policyMode: context.policyMode ?? policyMode ?? module.loadPolicy(projectRoot).mode
       }, null, 2));
     }