@h-rig/cli 0.0.6-alpha.10 → 0.0.6-alpha.100

package/dist/src/commands/_pi-frontend.js

@@ -0,0 +1,64 @@
+// @bun
+// packages/cli/src/commands/_pi-frontend.ts
+import { homedir } from "os";
+import { join } from "path";
+import { assertPathInsideRoot, assertSafeRunId, safePathSegment } from "@rig/shared/safe-identifiers";
+var TERMINAL_RUN_STATUSES = { completed: true, failed: true, stopped: true, cancelled: true, canceled: true, closed: true, merged: true, needs_attention: true, "needs-attention": true };
+function resolveOperatorDroneCwd(runId, homeDir = homedir()) {
+  const safeRunId = assertSafeRunId(runId);
+  const dronesRoot = join(homeDir, ".rig", "drones");
+  return assertPathInsideRoot(dronesRoot, join(dronesRoot, safePathSegment(String(safeRunId).slice(0, 8), { fallback: "run", maxLength: 32 })), "operator drone cwd");
+}
+function buildOperatorPiEnv(input) {
+  return {
+    PI_CODING_AGENT_SESSION_DIR: input.sessionDir,
+    PI_SKIP_VERSION_CHECK: "1",
+    PI_HIDDEN_COMMANDS: "import,fork,clone,tree,new,resume,trust",
+    RIG_PI_OPERATOR_SESSION: "1",
+    RIG_RUN_ID: input.runId,
+    RIG_SERVER_URL: input.serverUrl,
+    ...input.authToken ? { RIG_AUTH_TOKEN: input.authToken } : {},
+    ...input.serverProjectRoot ? { RIG_PROJECT_ROOT: input.serverProjectRoot } : {}
+  };
+}
+function shouldRequireOperatorTranscript(status) {
+  return typeof status === "string" && TERMINAL_RUN_STATUSES[status.trim().toLowerCase()] === true;
+}
+function missingOperatorTranscriptMessage(runId, status) {
+  const shortRun = runId.trim().slice(0, 8) || "unknown";
+  const statusText = typeof status === "string" && status.trim() ? status.trim() : "terminal";
+  return `Run ${shortRun} is ${statusText}, but no worker Pi session transcript is recorded for this run. It likely failed before Pi started or predates full-session capture. Use \`rig run show ${runId}\` and \`rig run logs ${runId}\` for the lifecycle details.`;
+}
+async function runWithProcessExitGuard(body) {
+  const realExit = process.exit;
+  let exitCode = 0;
+  let signalQuit = () => {};
+  const quit = new Promise((resolve) => {
+    signalQuit = resolve;
+  });
+  const guardedExit = (code) => {
+    exitCode = typeof code === "number" ? code : 0;
+    signalQuit();
+    return;
+  };
+  process.exit = guardedExit;
+  try {
+    await Promise.race([Promise.resolve().then(body), quit]);
+  } finally {
+    process.exit = realExit;
+  }
+  return exitCode;
+}
+async function attachRunBundledPiFrontend(context, input) {
+  input.steered;
+  input.returnOnQuit;
+  throw new Error(`Interactive Pi attach for run ${input.runId} was removed in the OMP-collab cutover. Run bare \`rig\` and use the OMP cockpit run detail for the live session; legacy automation can request a non-interactive text snapshot with --once or --json.`);
+}
+export {
+  shouldRequireOperatorTranscript,
+  runWithProcessExitGuard,
+  resolveOperatorDroneCwd,
+  missingOperatorTranscriptMessage,
+  buildOperatorPiEnv,
+  attachRunBundledPiFrontend
+};

package/dist/src/commands/_pi-install.d.ts

@@ -0,0 +1,42 @@
+export type PiInstallCheck = {
+    readonly ok: boolean;
+    readonly label: string;
+    readonly detail?: string;
+    readonly hint?: string;
+};
+export type CommandRunner = (command: string[], options?: {
+    cwd?: string;
+}) => Promise<{
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}>;
+export type PiRigInstallStatus = {
+    readonly pi: PiInstallCheck;
+    readonly piRig: PiInstallCheck;
+    readonly extensionPath: string;
+};
+export declare function resolvePiRigExtensionPath(homeDir: string): string;
+export declare function resolvePiRigPackageSource(projectRoot: string, exists?: (path: string) => boolean): string;
+export declare function checkPiRigInstall(input?: {
+    readonly homeDir?: string;
+    readonly commandRunner?: CommandRunner;
+    readonly exists?: (path: string) => boolean;
+}): Promise<PiRigInstallStatus>;
+export declare function ensurePiRigInstalled(input: {
+    readonly projectRoot: string;
+    readonly homeDir?: string;
+    readonly commandRunner?: CommandRunner;
+}): Promise<PiRigInstallStatus & {
+    installedPath: string;
+}>;
+export declare function ensureRemotePiRigInstalled(input: {
+    readonly requestJson: (pathname: string, init?: RequestInit) => Promise<unknown>;
+}): Promise<PiRigInstallStatus & {
+    readonly remote: true;
+}>;
+export declare function buildPiSetupChecks(input?: {
+    readonly homeDir?: string;
+    readonly commandRunner?: CommandRunner;
+    readonly exists?: (path: string) => boolean;
+}): Promise<PiInstallCheck[]>;

package/dist/src/commands/_pi-install.js

@@ -1,12 +1,9 @@
 // @bun
 // packages/cli/src/commands/_pi-install.ts
-import { existsSync, readFileSync, rmSync } from "fs";
+import { existsSync } from "fs";
 import { homedir } from "os";
 import { resolve } from "path";
-var PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
-var LEGACY_PI_RIG_MARKER = `// Managed by Rig. Source package: @rig/pi-rig.
-export { default } from '@rig/pi-rig';
-`;
+var PI_RIG_PACKAGE_NAME = "@h-rig/pi-rig";
 async function defaultCommandRunner(command, options = {}) {
   const proc = Bun.spawn(command, { cwd: options.cwd, stdout: "pipe", stderr: "pipe" });
   const [stdout, stderr, exitCode] = await Promise.all([
@@ -55,7 +52,13 @@ async function ensurePiBinaryAvailable(input) {
     }
     return { ok: true, detail: (current.stdout || current.stderr).trim() || undefined };
   }
-  const installCommand = process.env.RIG_PI_INSTALL_COMMAND?.trim() || "bunx @earendil-works/pi@latest install";
+  const installCommand = process.env.RIG_PI_INSTALL_COMMAND?.trim();
+  if (!installCommand) {
+    return {
+      ok: false,
+      error: `${(current.stderr || current.stdout).trim() || "pi --version failed"}. Set RIG_PI_INSTALL_COMMAND to a supported installer or install Pi manually.`
+    };
+  }
   const parts = splitInstallCommand(installCommand);
   if (parts.length === 0) {
     return { ok: false, error: (current.stderr || current.stdout).trim() || "pi --version failed" };
@@ -72,18 +75,6 @@ async function ensurePiBinaryAvailable(input) {
     ...next.exitCode === 0 ? {} : { error: (next.stderr || next.stdout).trim() || "pi --version failed after install" }
   };
 }
-function removeManagedLegacyPiRigBridge(homeDir, exists = existsSync) {
-  const extensionPath = resolvePiRigExtensionPath(homeDir);
-  const indexPath = resolve(extensionPath, "index.ts");
-  if (!exists(indexPath))
-    return;
-  try {
-    const content = readFileSync(indexPath, "utf8");
-    if (content === LEGACY_PI_RIG_MARKER || content.includes("Managed by Rig. Source package: @rig/pi-rig")) {
-      rmSync(extensionPath, { recursive: true, force: true });
-    }
-  } catch {}
-}
 async function checkPiRigInstall(input = {}) {
   const home = resolvePiHomeDir(input.homeDir);
   const extensionPath = resolvePiRigExtensionPath(home);
@@ -94,48 +85,40 @@ async function checkPiRigInstall(input = {}) {
       piRig: { ok: true, label: "pi-rig global extension", detail: extensionPath }
     };
   }
-  const exists = input.exists ?? existsSync;
   const runner = input.commandRunner ?? defaultCommandRunner;
   const piResult = await safeRun(runner, ["pi", "--version"]);
   const piListResult = piResult.exitCode === 0 ? await safeRun(runner, ["pi", "list"]) : { exitCode: 1, stdout: "", stderr: "" };
-  const listedPiRig = piListResult.exitCode === 0 && piListContainsPiRig(`${piListResult.stdout}
+  const hasPiRig = piListResult.exitCode === 0 && piListContainsPiRig(`${piListResult.stdout}
 ${piListResult.stderr}`);
-  const legacyBridge = exists(resolve(extensionPath, "index.ts"));
-  const hasPiRig = listedPiRig;
+  const hasLegacyBridgeScaffold = !hasPiRig && (input.exists ?? existsSync)(extensionPath);
   return {
     extensionPath,
     pi: {
       ok: piResult.exitCode === 0,
       label: "pi",
       detail: (piResult.stdout || piResult.stderr).trim() || undefined,
-      hint: piResult.exitCode === 0 ? undefined : "Install Pi or run `rig init --yes` to install/update the Pi runtime."
+      hint: piResult.exitCode === 0 ? undefined : "Install Pi/OMP manually or set RIG_PI_INSTALL_COMMAND before verifying with bare `rig` / Cockpit \u2192 Doctor."
     },
     piRig: {
       ok: hasPiRig,
       label: "pi-rig global extension",
-      detail: hasPiRig ? piListResult.stdout.trim() || PI_RIG_PACKAGE_NAME : legacyBridge ? `${extensionPath} (legacy bridge; reinstall required)` : undefined,
-      hint: hasPiRig ? undefined : "Run `rig init --yes` to install/enable the global pi-rig package with `pi install`."
+      detail: hasPiRig ? piListResult.stdout.trim() || PI_RIG_PACKAGE_NAME : hasLegacyBridgeScaffold ? `legacy bridge scaffold at ${extensionPath}` : undefined,
+      hint: hasPiRig ? undefined : `Install the Rig OMP extension with \`pi install ${PI_RIG_PACKAGE_NAME}\`, then verify with bare \`rig\` / Cockpit \u2192 Doctor.`
     }
   };
 }
 async function ensurePiRigInstalled(input) {
   const home = resolvePiHomeDir(input.homeDir);
   if (process.env.RIG_TEST_FAKE_PI_INSTALL === "1") {
-    const status2 = await checkPiRigInstall({ homeDir: home, commandRunner: input.commandRunner });
-    return { ...status2, installedPath: status2.extensionPath };
+    const status = await checkPiRigInstall({ homeDir: home, commandRunner: input.commandRunner });
+    return { ...status, installedPath: status.extensionPath };
   }
   const runner = input.commandRunner ?? defaultCommandRunner;
   const piAvailable = await ensurePiBinaryAvailable({ runner, projectRoot: input.projectRoot });
-  const status = piAvailable.ok ? await checkPiRigInstall({ homeDir: home, commandRunner: runner }) : {
-    extensionPath: resolvePiRigExtensionPath(home),
-    pi: { ok: false, label: "pi", detail: piAvailable.error, hint: "Install/update Pi with RIG_PI_INSTALL_COMMAND or install Pi manually." },
-    piRig: { ok: false, label: "pi-rig global extension", hint: "Pi is required before pi-rig can be installed." }
-  };
   if (!piAvailable.ok) {
     throw new Error(`Pi install/update failed: ${piAvailable.error ?? "pi unavailable"}`);
   }
   const packageSource = resolvePiRigPackageSource(input.projectRoot);
-  removeManagedLegacyPiRigBridge(home);
   const install = await runner(["pi", "install", packageSource], { cwd: input.projectRoot });
   if (install.exitCode !== 0) {
     throw new Error(`pi-rig install failed: ${(install.stderr || install.stdout).trim() || `exit ${install.exitCode}`}`);
@@ -147,7 +130,7 @@ async function ensureRemotePiRigInstalled(input) {
   const payload = await input.requestJson("/api/pi-rig/install", {
     method: "POST",
     headers: { "content-type": "application/json" },
-    body: JSON.stringify({ package: "@rig/pi-rig", scope: "global" })
+    body: JSON.stringify({ package: PI_RIG_PACKAGE_NAME, scope: "global" })
   });
   const record = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
   const piOk = record.piOk === true || record.ok === true;
@@ -160,13 +143,13 @@ async function ensureRemotePiRigInstalled(input) {
       ok: piOk,
       label: "pi",
       detail: typeof record.piVersion === "string" ? record.piVersion : undefined,
-      hint: piOk ? undefined : "Install/update Pi on the selected remote Rig server."
+      hint: piOk ? undefined : "Install/update Pi on the selected remote control host, then verify with bare `rig` / Cockpit \u2192 Doctor."
     },
     piRig: {
       ok: piRigOk,
       label: "pi-rig global extension",
       detail: extensionPath,
-      hint: piRigOk ? undefined : "Install/enable pi-rig on the selected remote Rig server."
+      hint: piRigOk ? undefined : `Install/enable the Rig OMP extension (${PI_RIG_PACKAGE_NAME}) on the selected remote control host, then verify with bare \`rig\` / Cockpit \u2192 Doctor.`
     }
   };
 }

package/dist/src/commands/_policy.d.ts

@@ -0,0 +1,8 @@
+import { type RunnerContext } from "../runner";
+export type PolicyMode = "off" | "observe" | "enforce";
+export declare function resolveEffectivePolicyMode(context: RunnerContext): PolicyMode;
+export declare function appendControlledBashAudit(context: RunnerContext, mode: PolicyMode, command: string, args: string[], matchedRuleIds: string[], action?: "warn" | "blocked"): void;
+export declare function enforceNativeCommandPolicy(context: RunnerContext, args: string[], options: {
+    commandPrefix: string;
+    writeAuditLog: boolean;
+}): Promise<void>;

package/dist/src/commands/_policy.js

@@ -1,36 +1,85 @@
 // @bun
 // packages/cli/src/commands/_policy.ts
-import { appendFileSync, mkdirSync } from "fs";
-import { resolve } from "path";
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from "fs";
+import { resolve as resolve2 } from "path";
 
 // packages/cli/src/runner.ts
 import { EventBus } from "@rig/runtime/control-plane/runtime/events";
-import { CliError } from "@rig/runtime/control-plane/errors";
+import { CliError as RuntimeCliError } from "@rig/runtime/control-plane/errors";
 import { evaluate, loadPolicy, resolveAction } from "@rig/runtime/control-plane/runtime/guard";
-import { PluginManager } from "@rig/runtime/control-plane/runtime/plugins";
-import { loadRuntimeContextFromEnv } from "@rig/runtime/control-plane/runtime/context";
 import { buildBinary } from "@rig/runtime/control-plane/runtime/isolation";
-import { CliError as CliError2 } from "@rig/runtime/control-plane/errors";
+
+class CliError extends RuntimeCliError {
+  hint;
+  constructor(message, exitCode = 1, options = {}) {
+    super(message, exitCode);
+    if (options.hint?.trim()) {
+      this.hint = options.hint.trim();
+    }
+  }
+}
 function formatCommand(parts) {
   return parts.map((part) => /[^a-zA-Z0-9_./:-]/.test(part) ? JSON.stringify(part) : part).join(" ");
 }
 
+// packages/cli/src/commands/_paths.ts
+import { resolve } from "path";
+import { resolveMonorepoRoot } from "@rig/runtime/layout";
+function resolveControlPlaneHostStateRoot(projectRoot) {
+  return resolve(projectRoot, ".rig");
+}
+function resolveControlPlaneHostLogsDir(projectRoot) {
+  return resolve(resolveControlPlaneHostStateRoot(projectRoot), "logs");
+}
+function resolveControlPlaneDefinitionRoot(projectRoot) {
+  return resolve(projectRoot, "rig");
+}
+
 // packages/cli/src/commands/_policy.ts
-import { evaluate as evaluate2, loadPolicy as loadPolicy2, resolveAction as resolveAction2 } from "@rig/runtime/control-plane/runtime/guard";
-import { resolveHarnessPaths } from "@rig/runtime/control-plane/native/utils";
+function loadPolicyFile(projectRoot) {
+  const policyPath = resolve2(resolveControlPlaneDefinitionRoot(projectRoot), "policy", "policy.json");
+  if (!existsSync(policyPath)) {
+    return { mode: "observe", rules: [] };
+  }
+  try {
+    const parsed = JSON.parse(readFileSync(policyPath, "utf8"));
+    const mode = parsed.mode === "off" || parsed.mode === "observe" || parsed.mode === "enforce" ? parsed.mode : "observe";
+    const rules = Array.isArray(parsed.rules) ? parsed.rules.filter((value) => Boolean(value && typeof value === "object" && !Array.isArray(value))).map((value, index) => ({
+      id: typeof value.id === "string" && value.id.trim() ? value.id.trim() : `rule-${index + 1}`,
+      reason: typeof value.reason === "string" && value.reason.trim() ? value.reason.trim() : undefined,
+      match: typeof value.match === "string" && value.match.trim() ? value.match.trim() : undefined,
+      command: typeof value.command === "string" && value.command.trim() ? value.command.trim() : undefined
+    })) : [];
+    return { mode, rules };
+  } catch {
+    return { mode: "observe", rules: [] };
+  }
+}
+function matchingRules(command, rules) {
+  return rules.filter((rule) => {
+    const rawPattern = rule.command ?? rule.match;
+    if (!rawPattern)
+      return false;
+    try {
+      return new RegExp(rawPattern, "i").test(command);
+    } catch {
+      return command.includes(rawPattern);
+    }
+  });
+}
 function resolveEffectivePolicyMode(context) {
   const envMode = process.env.RIG_BASH_MODE;
   if (envMode === "off" || envMode === "observe" || envMode === "enforce") {
     return envMode;
   }
-  return context.policyMode || loadPolicy2(context.projectRoot).mode;
+  return context.policyMode ?? loadPolicyFile(context.projectRoot).mode;
 }
 function appendControlledBashAudit(context, mode, command, args, matchedRuleIds, action) {
   if (mode === "off") {
     return;
   }
-  const logsDir = resolveHarnessPaths(context.projectRoot).logsDir;
-  const logFile = resolve(logsDir, "controlled-bash.jsonl");
+  const logsDir = resolveControlPlaneHostLogsDir(context.projectRoot);
+  const logFile = resolve2(logsDir, "controlled-bash.jsonl");
   mkdirSync(logsDir, { recursive: true });
   const payload = {
     timestamp: new Date().toISOString(),
@@ -51,25 +100,24 @@ function appendControlledBashAudit(context, mode, command, args, matchedRuleIds,
 async function enforceNativeCommandPolicy(context, args, options) {
   const mode = resolveEffectivePolicyMode(context);
   const command = formatCommand([options.commandPrefix, ...args]);
-  const decision = evaluate2({
-    projectRoot: context.projectRoot,
-    evaluation: { type: "command", command }
-  });
-  const action = resolveAction2(mode, decision.matchedRules);
-  const matchedRuleIds = decision.matchedRules.map((rule) => rule.id);
+  const rules = matchingRules(command, loadPolicyFile(context.projectRoot).rules);
+  const matchedRuleIds = rules.map((rule) => rule.id);
+  const action = rules.length === 0 ? "allow" : mode === "enforce" ? "block" : "warn";
   await context.emitEvent("policy.decision", {
     target: "command",
     command,
     mode,
     allowed: action !== "block",
     matchedRuleIds,
-    reasons: decision.matchedRules.map((rule) => rule.reason)
+    reasons: rules.map((rule) => rule.reason).filter(Boolean)
   });
   if (options.writeAuditLog) {
     appendControlledBashAudit(context, mode, command, args, matchedRuleIds, action === "block" ? "blocked" : action === "warn" ? "warn" : undefined);
   }
   if (action === "block") {
-    throw new CliError2(`Policy blocked command: ${command}`, 126);
+    throw new CliError(`Policy blocked command: ${command}`, 126, {
+      hint: "Review rig/policy/policy.json, or re-run with `--policy-mode observe` to log instead of block."
+    });
   }
 }
 export {

package/dist/src/commands/_probes.d.ts

@@ -0,0 +1 @@
+export declare function runQuietBinaryProbe(binaryPath: string, args: string[], cwd: string): Promise<boolean>;

package/dist/src/commands/_run-bridge.d.ts

@@ -0,0 +1,114 @@
+import type { ChildProcess, SpawnOptions } from "node:child_process";
+import { type RegisteredTaskSource } from "@rig/contracts";
+import { type CollabRegistryFilter, type LiveCollabProjection } from "@oh-my-pi/pi-coding-agent/collab/api";
+export type RigExtensionTask = {
+    readonly id: string;
+    readonly title?: string | null;
+    readonly status?: string | null;
+    readonly source?: string | null;
+    readonly url?: string | null;
+    readonly body?: string | null;
+};
+export type RigExtensionServerState = {
+    readonly alias: string;
+    readonly kind: "local" | "remote";
+    readonly baseUrl?: string | null;
+    readonly projectRoot?: string | null;
+    readonly status?: string | null;
+    readonly taskSource?: string | null;
+};
+export type RigExtensionAttachResult = {
+    readonly sessionPath?: string | null;
+    readonly joinLink?: string | null;
+    readonly collabSessionId?: string | null;
+};
+export type RunRunProcessInput = {
+    readonly projectRoot?: string;
+    readonly taskId: string;
+    readonly runId?: string;
+    readonly title?: string | null;
+    readonly model?: string | null;
+    readonly prompt?: string | null;
+    readonly rigRunBin?: string;
+    readonly writeStdout?: (text: string) => void;
+};
+export type RunRunProcessResult = {
+    readonly runId: string;
+    readonly pid: number;
+    readonly sessionName: string;
+    readonly runtime: unknown;
+};
+export type RunRunProcess = (input: RunRunProcessInput) => Promise<RunRunProcessResult>;
+type SpawnFunction = (command: string, args: readonly string[], options: SpawnOptions) => ChildProcess;
+type ListTasksDeps = {
+    readonly loadTaskSource?: (projectRoot: string) => Promise<{
+        readonly kind: string;
+        readonly source: RegisteredTaskSource;
+    }>;
+};
+type SpawnRunProcessDeps = {
+    readonly runRunProcess?: RunRunProcess;
+    readonly spawn?: SpawnFunction;
+    readonly uuid?: () => string;
+    readonly resolveRigRunBin?: () => string;
+    readonly env?: NodeJS.ProcessEnv;
+};
+type AttachViaRelayDeps = {
+    readonly listActiveCollabSessions?: (filter: CollabRegistryFilter) => Promise<readonly LiveCollabProjection[]>;
+    readonly sleep?: (ms: number) => Promise<void>;
+    readonly now?: () => number;
+};
+export type SpawnRunProcessInput = {
+    readonly projectRoot: string;
+    readonly taskId: string;
+    readonly title?: string | null;
+};
+export type AttachViaRelayInput = {
+    readonly runId: string;
+    readonly taskId?: string | null;
+    readonly identityFilter: CollabRegistryFilter;
+    readonly timeoutMs?: number;
+    readonly pollIntervalMs?: number;
+};
+export declare function listTasksFromSource(projectRoot: string, deps?: ListTasksDeps): Promise<readonly RigExtensionTask[]>;
+export declare function getTaskFromSource(projectRoot: string, taskId: string, deps?: ListTasksDeps): Promise<RigExtensionTask | null>;
+export declare function readSelectedTarget(projectRoot: string, env?: NodeJS.ProcessEnv): Promise<RigExtensionServerState>;
+export declare function resolveRigRunBin(): string;
+export declare function spawnRunProcess(input: SpawnRunProcessInput, deps?: SpawnRunProcessDeps): Promise<{
+    readonly runId: string;
+}>;
+export type RunControl = {
+    readonly kind: "steer";
+    readonly message: string;
+} | {
+    readonly kind: "stop";
+    readonly reason: string;
+};
+export interface DeliverRemoteControlDeps {
+    readonly env?: NodeJS.ProcessEnv;
+    readonly spawn?: SpawnFunction;
+}
+interface RemoteControlContext {
+    readonly checkout?: string | null;
+    readonly registryBaseUrl?: string | null;
+    readonly namespaceKey?: string | null;
+}
+/**
+ * Build the remote shell command that re-runs the operator's control VERB on the
+ * remote host. The run is LOCAL there (its session journal lives on the remote
+ * disk), so `rig run steer/stop <runId>` resolves it locally and the remote
+ * worker's own localRunChanges consumer applies it — fully symmetric with local
+ * placement. We SSH the verb (not a pre-built sentinel) so the remote rebuilds via
+ * its canonical stop path. Identity is passed inline (SSH does not forward local
+ * env); the registry HMAC secret is read from the remote env, never sent over argv.
+ */
+export declare function buildRemoteControlCommand(runId: string, control: RunControl, ctx: RemoteControlContext): string;
+/**
+ * Deliver a steer/stop control to a REMOTE run by running the verb on the remote
+ * host over SSH (login shell, identical to spawnRunProcess). Awaits the remote
+ * exit code so the operator gets an honest success/failure — not fire-and-forget.
+ */
+export declare function deliverRemoteRunControl(projectRoot: string, runId: string, control: RunControl, deps?: DeliverRemoteControlDeps): Promise<void>;
+export declare function listActiveRunCollab(filter: CollabRegistryFilter): Promise<readonly LiveCollabProjection[]>;
+export declare function attachViaRelay(input: AttachViaRelayInput, deps?: AttachViaRelayDeps): Promise<RigExtensionAttachResult | null>;
+export {};