@h-rig/cli 0.0.6-alpha.100 → 0.0.6-alpha.101

package/dist/src/commands/remote.js

@@ -1,1340 +0,0 @@
-// @bun
-// packages/cli/src/runner.ts
-import { EventBus } from "@rig/runtime/control-plane/runtime/events";
-import { CliError as RuntimeCliError } from "@rig/runtime/control-plane/errors";
-import { evaluate, loadPolicy, resolveAction } from "@rig/runtime/control-plane/runtime/guard";
-import { buildBinary } from "@rig/runtime/control-plane/runtime/isolation";
-
-class CliError extends RuntimeCliError {
-  hint;
-  constructor(message, exitCode = 1, options = {}) {
-    super(message, exitCode);
-    if (options.hint?.trim()) {
-      this.hint = options.hint.trim();
-    }
-  }
-}
-function takeFlag(args, flag) {
-  const rest = [];
-  let value = false;
-  for (const arg of args) {
-    if (arg === flag) {
-      value = true;
-      continue;
-    }
-    rest.push(arg);
-  }
-  return { value, rest };
-}
-function takeOption(args, option) {
-  const rest = [];
-  let value;
-  for (let index = 0;index < args.length; index += 1) {
-    const current = args[index];
-    if (current === option) {
-      const next = args[index + 1];
-      if (!next || next.startsWith("-")) {
-        throw new CliError(`Missing value for ${option}`, 1, { hint: `Provide a value after ${option}, e.g. \`${option} <value>\`.` });
-      }
-      value = next;
-      index += 1;
-      continue;
-    }
-    if (current !== undefined) {
-      rest.push(current);
-    }
-  }
-  return { value, rest };
-}
-function requireNoExtraArgs(args, usage) {
-  if (args.length > 0) {
-    throw new CliError(`Unexpected arguments: ${args.join(" ")}
-Usage: ${usage}`);
-  }
-}
-function requireTask(taskId, usage) {
-  if (!taskId) {
-    throw new CliError(`Missing --task option.
-Usage: ${usage}`);
-  }
-  return taskId;
-}
-
-// packages/runtime/src/control-plane/remote.ts
-import { randomUUID } from "crypto";
-import { chmodSync, existsSync as existsSync2, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "fs";
-import { homedir, tmpdir } from "os";
-import { dirname as dirname2, join, resolve as resolve2 } from "path";
-import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
-
-// packages/runtime/src/control-plane/server-paths.ts
-import { existsSync } from "fs";
-import { dirname, resolve, relative } from "path";
-import { assertPathInsideRoot, assertSafeRunId, safePathSegment } from "@rig/shared/safe-identifiers";
-function normalizeOptionalString(value) {
-  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
-}
-function resolveAuthorityPaths(projectRoot) {
-  const normalizedRoot = resolve(projectRoot);
-  const stateRoot = resolveAuthorityStateRoot(normalizedRoot);
-  const stateDir = resolveAuthorityStateDir(normalizedRoot);
-  return {
-    projectRoot: normalizedRoot,
-    harnessRoot: resolve(normalizedRoot, "rig"),
-    runsDir: resolve(stateRoot, "runs"),
-    remoteDir: resolve(stateRoot, "remote"),
-    stateDir,
-    remoteEndpointsPath: resolve(stateRoot, "remote", "endpoints.toml"),
-    remoteSecretsPath: resolve(stateDir, "remote-secrets.toml")
-  };
-}
-function resolveAuthorityStateRoot(projectRoot) {
-  const normalizedRoot = resolve(projectRoot);
-  const taskWorkspace = normalizeOptionalString(process.env.RIG_TASK_WORKSPACE);
-  if (taskWorkspace) {
-    return resolve(taskWorkspace, ".rig");
-  }
-  const stateDir = normalizeOptionalString(process.env.RIG_STATE_DIR);
-  if (stateDir) {
-    return dirname(resolve(stateDir));
-  }
-  const logsDir = normalizeOptionalString(process.env.RIG_LOGS_DIR);
-  if (logsDir) {
-    return dirname(resolve(logsDir));
-  }
-  const sessionFile = normalizeOptionalString(process.env.RIG_SESSION_FILE);
-  if (sessionFile) {
-    return dirname(dirname(resolve(sessionFile)));
-  }
-  const projectStateRoot = resolve(normalizedRoot, ".rig");
-  if (existsSync(projectStateRoot)) {
-    return projectStateRoot;
-  }
-  return resolve(normalizedRoot, ".rig");
-}
-function resolveAuthorityStateDir(projectRoot) {
-  const explicit = normalizeOptionalString(process.env.RIG_STATE_DIR);
-  if (explicit) {
-    return resolve(explicit);
-  }
-  return resolve(resolveAuthorityStateRoot(projectRoot), "state");
-}
-
-// packages/runtime/src/control-plane/remote.ts
-var DEFAULT_REMOTE_PORT = 7890;
-var DEFAULT_RIG_BACKBONE_HOST = "where.rig-does.work";
-var DEFAULT_RIG_RELAY_URL = `wss://${DEFAULT_RIG_BACKBONE_HOST}`;
-var DEFAULT_RIG_REGISTRY_URL = `https://${DEFAULT_RIG_BACKBONE_HOST}/registry`;
-var DEFAULT_TIMEOUTS = {
-  connectMs: 5000,
-  authMs: 5000,
-  requestMs: 30000,
-  subscriptionMs: 1e4
-};
-var REMOTES_CONFIG_PATH = join(homedir(), ".config", "rig", "remotes.toml");
-
-class RemoteCliError extends Error {
-  code;
-  exitCode;
-  details;
-  constructor(code, message, exitCode = 1, details) {
-    super(message);
-    this.name = "RemoteCliError";
-    this.code = code;
-    this.exitCode = exitCode;
-    this.details = details;
-  }
-}
-function loadRemotesConfig(configPath = REMOTES_CONFIG_PATH) {
-  if (!existsSync2(configPath)) {
-    return { version: 1, remotes: {} };
-  }
-  try {
-    const content = readFileSync(configPath, "utf-8");
-    if (!content.trim()) {
-      return { version: 1, remotes: {} };
-    }
-    const parsed = parseToml(content);
-    return {
-      version: parsed.version ?? 1,
-      remotes: parsed.remotes ?? {}
-    };
-  } catch (error) {
-    throw new RemoteCliError("RIG_REMOTE_CONFIG_PARSE_ERROR", `Failed to parse remotes config at ${configPath}: ${error instanceof Error ? error.message : String(error)}`, 2, { configPath });
-  }
-}
-function saveRemotesConfig(config, configPath = REMOTES_CONFIG_PATH) {
-  mkdirSync(dirname2(configPath), { recursive: true });
-  writeFileSync(configPath, `${stringifyToml(config).trimEnd()}
-`, "utf-8");
-  try {
-    chmodSync(configPath, 384);
-  } catch {}
-}
-function readTomlFile(path, fallback) {
-  if (!existsSync2(path))
-    return fallback;
-  const raw = readFileSync(path, "utf8");
-  if (!raw.trim())
-    return fallback;
-  return parseToml(raw);
-}
-function writeTomlFile(path, value) {
-  mkdirSync(dirname2(path), { recursive: true });
-  writeFileSync(path, `${stringifyToml(value).trimEnd()}
-`, "utf8");
-}
-function normalizeStringArray(value) {
-  if (!Array.isArray(value))
-    return [];
-  return value.map((entry) => normalizeString(entry)).filter((entry) => entry !== "");
-}
-function normalizePort(value) {
-  const port = typeof value === "number" ? value : Number(value);
-  return Number.isInteger(port) && port > 0 && port <= 65535 ? port : DEFAULT_REMOTE_PORT;
-}
-function loadRemoteEndpointsToml(projectRoot) {
-  const paths = resolveAuthorityPaths(projectRoot);
-  const parsed = readTomlFile(paths.remoteEndpointsPath, { version: 1, endpoints: {} });
-  return {
-    version: parsed.version ?? 1,
-    endpoints: parsed.endpoints ?? {}
-  };
-}
-function loadRemoteSecretsToml(projectRoot) {
-  const paths = resolveAuthorityPaths(projectRoot);
-  const parsed = readTomlFile(paths.remoteSecretsPath, { version: 1, secrets: {} });
-  return {
-    version: parsed.version ?? 1,
-    secrets: parsed.secrets ?? {}
-  };
-}
-function saveRemoteEndpointsToml(projectRoot, payload) {
-  writeTomlFile(resolveAuthorityPaths(projectRoot).remoteEndpointsPath, payload);
-}
-function saveRemoteSecretsToml(projectRoot, payload) {
-  const paths = resolveAuthorityPaths(projectRoot);
-  writeTomlFile(paths.remoteSecretsPath, payload);
-  try {
-    chmodSync(paths.remoteSecretsPath, 384);
-  } catch {}
-}
-function listAuthorityRemoteEndpoints(projectRoot) {
-  const endpoints = loadRemoteEndpointsToml(projectRoot).endpoints ?? {};
-  const secrets = loadRemoteSecretsToml(projectRoot).secrets ?? {};
-  return Object.values(endpoints).map((entry) => {
-    const token = secrets[entry.secret_ref] ?? "";
-    return {
-      id: entry.id,
-      alias: entry.alias,
-      host: entry.host,
-      port: normalizePort(entry.port),
-      token,
-      autoConnect: Boolean(entry.auto_connect),
-      addedAt: entry.created_at,
-      updatedAt: entry.updated_at,
-      lastConnectedAt: normalizeString(entry.last_connected_at) || null,
-      labels: normalizeStringArray(entry.labels),
-      capabilities: normalizeStringArray(entry.capabilities),
-      transport: normalizeString(entry.transport) || "websocket",
-      secretRef: entry.secret_ref
-    };
-  }).sort((left, right) => left.alias.localeCompare(right.alias));
-}
-function nextRemoteEndpointRecord(input) {
-  const timestamp = new Date().toISOString();
-  const secretRef = input.existing?.secret_ref ?? randomUUID();
-  return {
-    record: {
-      id: input.endpointId ?? input.existing?.id ?? randomUUID(),
-      alias: input.alias,
-      host: input.host,
-      port: normalizePort(input.port),
-      transport: normalizeString(input.transport) || normalizeString(input.existing?.transport) || "websocket",
-      auto_connect: input.autoConnect ?? input.existing?.auto_connect ?? false,
-      labels: input.labels ?? normalizeStringArray(input.existing?.labels),
-      capabilities: input.capabilities ?? normalizeStringArray(input.existing?.capabilities),
-      secret_ref: secretRef,
-      created_at: input.existing?.created_at ?? timestamp,
-      updated_at: timestamp,
-      last_connected_at: input.existing?.last_connected_at ?? null
-    },
-    secretRef
-  };
-}
-function upsertAuthorityRemoteEndpoint(projectRoot, input) {
-  const endpointsToml = loadRemoteEndpointsToml(projectRoot);
-  const secretsToml = loadRemoteSecretsToml(projectRoot);
-  const existing = Object.values(endpointsToml.endpoints ?? {}).find((entry) => entry.alias === input.alias) ?? null;
-  const { record, secretRef } = nextRemoteEndpointRecord({
-    endpointId: input.endpointId,
-    existing,
-    alias: input.alias,
-    host: input.host,
-    port: input.port,
-    token: input.token,
-    autoConnect: input.autoConnect,
-    transport: input.transport,
-    labels: input.labels,
-    capabilities: input.capabilities
-  });
-  endpointsToml.endpoints = {
-    ...endpointsToml.endpoints ?? {},
-    [record.id]: record
-  };
-  secretsToml.secrets = {
-    ...secretsToml.secrets ?? {},
-    [secretRef]: input.token
-  };
-  saveRemoteEndpointsToml(projectRoot, endpointsToml);
-  saveRemoteSecretsToml(projectRoot, secretsToml);
-  return listAuthorityRemoteEndpoints(projectRoot).find((entry) => entry.id === record.id);
-}
-function updateAuthorityRemoteEndpoint(projectRoot, input) {
-  const endpointsToml = loadRemoteEndpointsToml(projectRoot);
-  const secretsToml = loadRemoteSecretsToml(projectRoot);
-  const current = Object.values(endpointsToml.endpoints ?? {}).find((entry) => input.endpointId && entry.id === input.endpointId || input.alias && entry.alias === input.alias);
-  if (!current)
-    return null;
-  const record = {
-    ...current,
-    alias: normalizeString(input.alias) || current.alias,
-    host: normalizeString(input.host) || current.host,
-    port: input.port !== undefined ? normalizePort(input.port) : current.port,
-    auto_connect: input.autoConnect ?? current.auto_connect,
-    transport: normalizeString(input.transport) || current.transport,
-    labels: input.labels ?? normalizeStringArray(current.labels),
-    capabilities: input.capabilities ?? normalizeStringArray(current.capabilities),
-    updated_at: new Date().toISOString()
-  };
-  endpointsToml.endpoints = {
-    ...endpointsToml.endpoints ?? {},
-    [record.id]: record
-  };
-  if (input.token !== undefined) {
-    secretsToml.secrets = {
-      ...secretsToml.secrets ?? {},
-      [record.secret_ref]: input.token
-    };
-  }
-  saveRemoteEndpointsToml(projectRoot, endpointsToml);
-  saveRemoteSecretsToml(projectRoot, secretsToml);
-  return listAuthorityRemoteEndpoints(projectRoot).find((entry) => entry.id === record.id) ?? null;
-}
-function removeAuthorityRemoteEndpoint(projectRoot, endpointIdOrAlias) {
-  const endpointsToml = loadRemoteEndpointsToml(projectRoot);
-  const secretsToml = loadRemoteSecretsToml(projectRoot);
-  const entry = Object.values(endpointsToml.endpoints ?? {}).find((candidate) => candidate.id === endpointIdOrAlias || candidate.alias === endpointIdOrAlias);
-  if (!entry)
-    return false;
-  const nextEndpoints = { ...endpointsToml.endpoints ?? {} };
-  delete nextEndpoints[entry.id];
-  const nextSecrets = { ...secretsToml.secrets ?? {} };
-  delete nextSecrets[entry.secret_ref];
-  saveRemoteEndpointsToml(projectRoot, { version: endpointsToml.version ?? 1, endpoints: nextEndpoints });
-  saveRemoteSecretsToml(projectRoot, { version: secretsToml.version ?? 1, secrets: nextSecrets });
-  return true;
-}
-function markAuthorityRemoteEndpointConnected(projectRoot, endpointId, connectedAt = new Date().toISOString()) {
-  const endpointsToml = loadRemoteEndpointsToml(projectRoot);
-  const entry = endpointsToml.endpoints?.[endpointId];
-  if (!entry)
-    return;
-  endpointsToml.endpoints = {
-    ...endpointsToml.endpoints ?? {},
-    [endpointId]: {
-      ...entry,
-      last_connected_at: connectedAt,
-      updated_at: connectedAt
-    }
-  };
-  saveRemoteEndpointsToml(projectRoot, endpointsToml);
-}
-function importLegacyRemoteEndpoints(projectRoot, legacyPath = REMOTES_CONFIG_PATH) {
-  if (!existsSync2(legacyPath)) {
-    return { imported: 0, skipped: 0, sourcePath: legacyPath };
-  }
-  const parsed = readTomlFile(legacyPath, { version: 1, remotes: {} });
-  let imported = 0;
-  let skipped = 0;
-  for (const [alias, entry] of Object.entries(parsed.remotes ?? {})) {
-    const host = normalizeString(entry.host);
-    const token = normalizeString(entry.token);
-    if (!host || !token) {
-      skipped += 1;
-      continue;
-    }
-    upsertAuthorityRemoteEndpoint(projectRoot, {
-      alias,
-      host,
-      port: normalizePort(entry.port),
-      token
-    });
-    imported += 1;
-  }
-  return { imported, skipped, sourcePath: legacyPath };
-}
-function doctorAuthorityRemoteEndpoints(projectRoot) {
-  const paths = resolveAuthorityPaths(projectRoot);
-  const endpoints = loadRemoteEndpointsToml(projectRoot).endpoints ?? {};
-  const secrets = loadRemoteSecretsToml(projectRoot).secrets ?? {};
-  const missingSecrets = Object.values(endpoints).filter((entry) => !normalizeString(secrets[entry.secret_ref])).map((entry) => entry.alias);
-  const warnings = [];
-  if (!existsSync2(paths.remoteEndpointsPath)) {
-    warnings.push("Remote endpoint manifest is missing.");
-  }
-  if (!existsSync2(paths.remoteSecretsPath)) {
-    warnings.push("Remote secret store is missing.");
-  }
-  return {
-    manifestPath: paths.remoteEndpointsPath,
-    secretsPath: paths.remoteSecretsPath,
-    endpointCount: Object.keys(endpoints).length,
-    missingSecrets,
-    warnings
-  };
-}
-function listManagedRemoteEndpoints(configPath = REMOTES_CONFIG_PATH, projectRoot) {
-  if (projectRoot) {
-    return listAuthorityRemoteEndpoints(projectRoot).map((entry) => ({
-      id: entry.id,
-      alias: entry.alias,
-      host: entry.host,
-      port: entry.port,
-      token: entry.token,
-      addedAt: entry.addedAt,
-      lastConnected: entry.lastConnectedAt
-    }));
-  }
-  const config = loadRemotesConfig(configPath);
-  return Object.entries(config.remotes ?? {}).map(([alias, entry]) => ({
-    id: alias,
-    alias,
-    host: normalizeString(entry.host) || "",
-    port: Number.isFinite(entry.port) ? Number(entry.port) : DEFAULT_REMOTE_PORT,
-    token: normalizeString(entry.token) || "",
-    addedAt: normalizeString(entry.addedAt) || null,
-    lastConnected: normalizeString(entry.lastConnected) || null
-  })).sort((left, right) => left.alias.localeCompare(right.alias));
-}
-function upsertManagedRemoteEndpoint(input, configPath = REMOTES_CONFIG_PATH, projectRoot) {
-  if (projectRoot) {
-    const saved = upsertAuthorityRemoteEndpoint(projectRoot, {
-      ...input,
-      token: input.token ?? ""
-    });
-    return {
-      id: saved.id,
-      alias: saved.alias,
-      host: saved.host,
-      port: saved.port,
-      token: saved.token,
-      addedAt: saved.addedAt,
-      lastConnected: saved.lastConnectedAt
-    };
-  }
-  const config = loadRemotesConfig(configPath);
-  const existing = config.remotes?.[input.alias];
-  const nextEntry = {
-    host: input.host,
-    port: input.port,
-    token: input.token,
-    addedAt: normalizeString(existing?.addedAt) || new Date().toISOString(),
-    ...normalizeString(existing?.lastConnected) ? { lastConnected: normalizeString(existing?.lastConnected) } : {}
-  };
-  const nextConfig = {
-    version: config.version ?? 1,
-    remotes: {
-      ...config.remotes ?? {},
-      [input.alias]: nextEntry
-    }
-  };
-  saveRemotesConfig(nextConfig, configPath);
-  return {
-    id: input.alias,
-    alias: input.alias,
-    host: input.host,
-    port: input.port,
-    token: input.token ?? "",
-    addedAt: nextEntry.addedAt ?? null,
-    lastConnected: nextEntry.lastConnected ?? null
-  };
-}
-function removeManagedRemoteEndpoint(alias, configPath = REMOTES_CONFIG_PATH, projectRoot) {
-  if (projectRoot) {
-    return removeAuthorityRemoteEndpoint(projectRoot, alias);
-  }
-  const config = loadRemotesConfig(configPath);
-  if (!config.remotes?.[alias]) {
-    return false;
-  }
-  const nextRemotes = { ...config.remotes ?? {} };
-  delete nextRemotes[alias];
-  saveRemotesConfig({
-    version: config.version ?? 1,
-    remotes: nextRemotes
-  }, configPath);
-  return true;
-}
-function resolveRemoteEndpoint(options) {
-  const env = options.env ?? process.env;
-  const envHost = normalizeString(env.RIG_REMOTE_HOST);
-  const envToken = normalizeString(env.RIG_REMOTE_TOKEN);
-  const envPort = parsePort(normalizeString(env.RIG_REMOTE_PORT), "RIG_REMOTE_PORT");
-  const envAlias = normalizeString(env.RIG_REMOTE_ALIAS);
-  const explicitHost = normalizeString(options.host);
-  const explicitToken = normalizeString(options.token);
-  const explicitPort = parsePort(normalizeString(options.port), "--port");
-  const explicitProvided = Boolean(explicitHost || explicitToken || explicitPort !== null);
-  const requestedAlias = normalizeString(options.remoteAlias) || envAlias;
-  let endpoint = {
-    source: "env",
-    host: envHost || "",
-    port: envPort ?? DEFAULT_REMOTE_PORT,
-    token: envToken || "",
-    configPath: REMOTES_CONFIG_PATH
-  };
-  if (requestedAlias) {
-    if (options.projectRoot) {
-      const remote = listAuthorityRemoteEndpoints(options.projectRoot).find((entry) => entry.alias === requestedAlias);
-      if (!remote) {
-        const configPath = resolveAuthorityPaths(options.projectRoot).remoteEndpointsPath;
-        throw new RemoteCliError("RIG_REMOTE_ALIAS_NOT_FOUND", `Remote alias '${requestedAlias}' was not found in ${configPath}.`, 2, { alias: requestedAlias, configPath });
-      }
-      endpoint = {
-        source: "alias",
-        alias: requestedAlias,
-        host: remote.host,
-        port: remote.port,
-        token: remote.token,
-        configPath: resolveAuthorityPaths(options.projectRoot).remoteEndpointsPath
-      };
-    } else {
-      const config = loadRemotesConfig();
-      const remote = config.remotes?.[requestedAlias];
-      if (!remote) {
-        throw new RemoteCliError("RIG_REMOTE_ALIAS_NOT_FOUND", `Remote alias '${requestedAlias}' was not found in ${REMOTES_CONFIG_PATH}.`, 2, { alias: requestedAlias, configPath: REMOTES_CONFIG_PATH });
-      }
-      endpoint = {
-        source: "alias",
-        alias: requestedAlias,
-        host: normalizeString(remote.host) || "",
-        port: Number.isFinite(remote.port) ? Number(remote.port) : DEFAULT_REMOTE_PORT,
-        token: normalizeString(remote.token) || "",
-        configPath: REMOTES_CONFIG_PATH
-      };
-    }
-  }
-  if (explicitProvided) {
-    endpoint = {
-      ...endpoint,
-      source: "flags",
-      host: explicitHost || endpoint.host,
-      port: explicitPort ?? endpoint.port,
-      token: explicitToken || endpoint.token
-    };
-  }
-  if (!endpoint.host) {
-    throw new RemoteCliError("RIG_REMOTE_HOST_REQUIRED", "Remote host is required. Pass --host, --remote <alias>, or set RIG_REMOTE_HOST.", 2);
-  }
-  if (!Number.isFinite(endpoint.port) || endpoint.port <= 0 || endpoint.port > 65535) {
-    throw new RemoteCliError("RIG_REMOTE_INVALID_PORT", `Invalid remote port: ${endpoint.port}.`, 2);
-  }
-  return endpoint;
-}
-
-class RemoteWsClient {
-  endpoint;
-  ws = null;
-  connected = false;
-  pending = new Map;
-  onEvent;
-  requestTimeoutMs;
-  connectTimeoutMs;
-  authTimeoutMs;
-  subscriptionTimeoutMs;
-  connectionToken = null;
-  connectionTokenExpiresAt = null;
-  tokenRefreshTimer = null;
-  constructor(endpoint, options = {}) {
-    this.endpoint = endpoint;
-    this.onEvent = options.onEvent;
-    this.connectTimeoutMs = options.connectTimeoutMs ?? DEFAULT_TIMEOUTS.connectMs;
-    this.authTimeoutMs = options.authTimeoutMs ?? DEFAULT_TIMEOUTS.authMs;
-    this.requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_TIMEOUTS.requestMs;
-    this.subscriptionTimeoutMs = options.subscriptionTimeoutMs ?? DEFAULT_TIMEOUTS.subscriptionMs;
-  }
-  setEventHandler(handler) {
-    this.onEvent = handler;
-  }
-  async connect() {
-    if (this.connected) {
-      return;
-    }
-    const url = `ws://${this.endpoint.host}:${this.endpoint.port}`;
-    await new Promise((resolve3, reject) => {
-      let authResolved = false;
-      let connectTimer = setTimeout(() => {
-        connectTimer = null;
-        reject(new RemoteCliError("RIG_REMOTE_CONNECT_TIMEOUT", `Timed out connecting to ${url} after ${this.connectTimeoutMs}ms.`, 3, { host: this.endpoint.host, port: this.endpoint.port, timeoutMs: this.connectTimeoutMs }));
-      }, this.connectTimeoutMs);
-      const ws = new WebSocket(url);
-      this.ws = ws;
-      ws.onopen = () => {
-        const authMessage = {
-          type: "auth",
-          id: crypto.randomUUID(),
-          timestamp: new Date().toISOString(),
-          token: this.connectionToken || this.endpoint.token,
-          tokenType: this.connectionToken ? "connection" : "server"
-        };
-        let authTimer = setTimeout(() => {
-          authTimer = null;
-          reject(new RemoteCliError("RIG_REMOTE_AUTH_TIMEOUT", `Timed out waiting for auth response from ${url} after ${this.authTimeoutMs}ms.`, 3, { host: this.endpoint.host, port: this.endpoint.port, timeoutMs: this.authTimeoutMs }));
-        }, this.authTimeoutMs);
-        ws.send(JSON.stringify(authMessage));
-        const originalOnMessage = ws.onmessage;
-        ws.onmessage = (event) => {
-          const message = parseIncomingMessage(event.data);
-          if (!message) {
-            return;
-          }
-          if (message.type === "auth_response" && !authResolved) {
-            authResolved = true;
-            if (connectTimer) {
-              clearTimeout(connectTimer);
-              connectTimer = null;
-            }
-            if (authTimer) {
-              clearTimeout(authTimer);
-              authTimer = null;
-            }
-            const auth = message;
-            if (!auth.success) {
-              reject(new RemoteCliError("RIG_REMOTE_AUTH_FAILED", auth.error || "Remote authentication failed.", 3, { host: this.endpoint.host, port: this.endpoint.port }));
-              return;
-            }
-            if (auth.connectionToken && auth.connectionTokenExpiresAt) {
-              this.connectionToken = auth.connectionToken;
-              this.connectionTokenExpiresAt = auth.connectionTokenExpiresAt;
-              this.scheduleTokenRefresh();
-            }
-            if (this.endpoint.configPath.endsWith("endpoints.toml")) {
-              const projectRoot = dirname2(dirname2(dirname2(this.endpoint.configPath)));
-              try {
-                markAuthorityRemoteEndpointConnected(projectRoot, this.endpoint.alias ? listAuthorityRemoteEndpoints(projectRoot).find((entry) => entry.alias === this.endpoint.alias)?.id ?? "" : "");
-              } catch {}
-            }
-            this.connected = true;
-            ws.onmessage = (event2) => {
-              const next = parseIncomingMessage(event2.data);
-              if (!next) {
-                return;
-              }
-              this.routeMessage(next);
-            };
-            resolve3();
-            return;
-          }
-          if (typeof originalOnMessage === "function") {
-            originalOnMessage.call(ws, event);
-          }
-        };
-      };
-      ws.onerror = () => {
-        if (connectTimer) {
-          clearTimeout(connectTimer);
-          connectTimer = null;
-        }
-        if (!authResolved) {
-          reject(new RemoteCliError("RIG_REMOTE_CONNECT_FAILED", `Failed to connect to ${url}.`, 3, { host: this.endpoint.host, port: this.endpoint.port }));
-        }
-      };
-      ws.onclose = () => {
-        this.connected = false;
-        this.clearPending("Connection closed");
-      };
-    });
-  }
-  disconnect() {
-    this.connected = false;
-    this.clearTokenRefreshTimer();
-    this.clearPending("Connection closed");
-    if (this.ws) {
-      try {
-        this.ws.close();
-      } catch {}
-      this.ws = null;
-    }
-  }
-  async subscribe(eventTypes = []) {
-    const message = { type: "subscribe" };
-    if (eventTypes.length > 0) {
-      message.eventTypes = eventTypes;
-    }
-    const response = await this.request(message, this.subscriptionTimeoutMs);
-    return expectType(response, "operation_result");
-  }
-  async unsubscribe() {
-    return expectType(await this.request({ type: "unsubscribe" }), "operation_result");
-  }
-  async getState() {
-    return expectType(await this.request({ type: "get_state" }), "state_response");
-  }
-  async getTasks() {
-    return expectType(await this.request({ type: "get_tasks" }), "tasks_response");
-  }
-  async pause() {
-    return expectType(await this.request({ type: "pause" }), "operation_result");
-  }
-  async resume() {
-    return expectType(await this.request({ type: "resume" }), "operation_result");
-  }
-  async interrupt() {
-    return expectType(await this.request({ type: "interrupt" }), "operation_result");
-  }
-  async continueExecution() {
-    return expectType(await this.request({ type: "continue" }), "operation_result");
-  }
-  async refreshTasks() {
-    return expectType(await this.request({ type: "refresh_tasks" }), "operation_result");
-  }
-  async addIterations(count) {
-    return expectType(await this.request({ type: "add_iterations", count }), "operation_result");
-  }
-  async removeIterations(count) {
-    return expectType(await this.request({ type: "remove_iterations", count }), "operation_result");
-  }
-  async getPromptPreview(taskId) {
-    return expectType(await this.request({ type: "get_prompt_preview", taskId }), "prompt_preview_response");
-  }
-  async getIterationOutput(taskId) {
-    return expectType(await this.request({ type: "get_iteration_output", taskId }), "iteration_output_response");
-  }
-  async startOrchestration(options) {
-    return expectType(await this.request({
-      type: "orchestrate:start",
-      maxWorkers: options.maxWorkers,
-      maxIterations: options.maxIterations,
-      directMerge: options.directMerge
-    }), "orchestrate:start_response");
-  }
-  async pauseOrchestration(orchestrationId) {
-    return expectType(await this.request({ type: "orchestrate:pause", orchestrationId }), "operation_result");
-  }
-  async resumeOrchestration(orchestrationId) {
-    return expectType(await this.request({ type: "orchestrate:resume", orchestrationId }), "operation_result");
-  }
-  async stopOrchestration(orchestrationId) {
-    return expectType(await this.request({ type: "orchestrate:stop", orchestrationId }), "operation_result");
-  }
-  async getOrchestrationState(orchestrationId) {
-    return expectType(await this.request({ type: "orchestrate:get_state", orchestrationId }), "orchestrate:state_response");
-  }
-  async ping() {
-    return this.request({ type: "ping" });
-  }
-  async request(payload, timeoutMs = this.requestTimeoutMs) {
-    if (!this.connected || !this.ws) {
-      throw new RemoteCliError("RIG_REMOTE_NOT_CONNECTED", "Remote client is not connected.", 3);
-    }
-    const id = crypto.randomUUID();
-    const message = {
-      ...payload,
-      id,
-      timestamp: new Date().toISOString()
-    };
-    return await new Promise((resolve3, reject) => {
-      const timeout = setTimeout(() => {
-        this.pending.delete(id);
-        reject(new RemoteCliError("RIG_REMOTE_REQUEST_TIMEOUT", `Timed out waiting for response to '${String(payload.type)}' after ${timeoutMs}ms.`, 3, { requestType: payload.type, requestId: id, timeoutMs }));
-      }, timeoutMs);
-      this.pending.set(id, { resolve: resolve3, reject, timeout });
-      this.ws?.send(JSON.stringify(message));
-    });
-  }
-  routeMessage(message) {
-    if (message.id && this.pending.has(message.id)) {
-      const pending = this.pending.get(message.id);
-      if (pending) {
-        clearTimeout(pending.timeout);
-        this.pending.delete(message.id);
-        pending.resolve(message);
-      }
-      return;
-    }
-    if (message.type === "token_refresh_response") {
-      const token = normalizeString(message.connectionToken);
-      const expiresAt = normalizeString(message.connectionTokenExpiresAt);
-      if (token && expiresAt) {
-        this.connectionToken = token;
-        this.connectionTokenExpiresAt = expiresAt;
-        this.scheduleTokenRefresh();
-      }
-    }
-    this.onEvent?.({ receivedAt: new Date().toISOString(), message });
-  }
-  scheduleTokenRefresh() {
-    this.clearTokenRefreshTimer();
-    if (!this.connectionToken || !this.connectionTokenExpiresAt || !this.ws || !this.connected) {
-      return;
-    }
-    const expiresAt = new Date(this.connectionTokenExpiresAt).getTime();
-    if (!Number.isFinite(expiresAt)) {
-      return;
-    }
-    const refreshAt = expiresAt - 60 * 60 * 1000;
-    const delay = Math.max(0, refreshAt - Date.now());
-    this.tokenRefreshTimer = setTimeout(() => {
-      if (!this.connected || !this.ws || !this.connectionToken) {
-        return;
-      }
-      const refreshMessage = {
-        type: "token_refresh",
-        id: crypto.randomUUID(),
-        timestamp: new Date().toISOString(),
-        connectionToken: this.connectionToken
-      };
-      this.ws.send(JSON.stringify(refreshMessage));
-    }, delay);
-  }
-  clearTokenRefreshTimer() {
-    if (this.tokenRefreshTimer) {
-      clearTimeout(this.tokenRefreshTimer);
-      this.tokenRefreshTimer = null;
-    }
-  }
-  clearPending(reason) {
-    for (const [requestId, pending] of this.pending.entries()) {
-      clearTimeout(pending.timeout);
-      pending.reject(new RemoteCliError("RIG_REMOTE_REQUEST_CANCELLED", `${reason} (request ${requestId}).`, 3, { requestId }));
-      this.pending.delete(requestId);
-    }
-  }
-}
-function matchesEventFilter(message, expectedType) {
-  if (!expectedType) {
-    return true;
-  }
-  if (message.type === expectedType) {
-    return true;
-  }
-  if (message.type === "engine_event") {
-    const eventType = normalizeString(message.event?.type);
-    return eventType === expectedType;
-  }
-  if (message.type === "parallel_event") {
-    const eventType = normalizeString(message.event?.type);
-    return eventType === expectedType;
-  }
-  return false;
-}
-function summarizeMessage(message) {
-  if (message.type === "pong") {
-    return "pong";
-  }
-  if (message.type === "engine_event") {
-    const eventType = normalizeString(message.event?.type);
-    return eventType ? `engine_event:${eventType}` : "engine_event";
-  }
-  if (message.type === "parallel_event") {
-    const eventType = normalizeString(message.event?.type);
-    const orchestrationId = normalizeString(message.orchestrationId);
-    return orchestrationId ? `parallel_event:${eventType || "unknown"}:${orchestrationId}` : `parallel_event:${eventType || "unknown"}`;
-  }
-  return message.type;
-}
-function migrateManagedRemoteEndpoints(projectRoot, legacyPath = REMOTES_CONFIG_PATH) {
-  return importLegacyRemoteEndpoints(projectRoot, legacyPath);
-}
-function doctorManagedRemoteEndpoints(projectRoot) {
-  return doctorAuthorityRemoteEndpoints(projectRoot);
-}
-function updateManagedRemoteEndpointInAuthority(projectRoot, input) {
-  const updated = updateAuthorityRemoteEndpoint(projectRoot, input);
-  if (!updated)
-    return null;
-  return {
-    id: updated.id,
-    alias: updated.alias,
-    host: updated.host,
-    port: updated.port,
-    token: updated.token,
-    addedAt: updated.addedAt,
-    lastConnected: updated.lastConnectedAt
-  };
-}
-function normalizeString(value) {
-  if (!value) {
-    return "";
-  }
-  return value.trim();
-}
-function parsePort(value, label) {
-  if (!value) {
-    return null;
-  }
-  const parsed = Number.parseInt(value, 10);
-  if (!Number.isFinite(parsed) || parsed <= 0 || parsed > 65535) {
-    throw new RemoteCliError("RIG_REMOTE_INVALID_PORT", `Invalid port for ${label}: ${value}.`, 2, { label, value });
-  }
-  return parsed;
-}
-function parseIncomingMessage(raw) {
-  if (typeof raw !== "string") {
-    return null;
-  }
-  try {
-    const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== "object" || typeof parsed.type !== "string") {
-      return null;
-    }
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-function expectType(message, expectedType) {
-  if (message.type !== expectedType) {
-    throw new RemoteCliError("RIG_REMOTE_UNEXPECTED_RESPONSE", `Unexpected response type: ${message.type}. Expected ${expectedType}.`, 3, { expectedType, actualType: message.type, message });
-  }
-  return message;
-}
-
-// packages/cli/src/commands/_parsers.ts
-function parseOptionalPositiveInt(value, option) {
-  if (!value) {
-    return;
-  }
-  const parsed = Number.parseInt(value, 10);
-  if (!Number.isFinite(parsed) || parsed <= 0) {
-    throw new CliError(`Invalid ${option} value: ${value}`, 1, { hint: `Pass a positive integer, e.g. \`${option} 10\`.` });
-  }
-  return parsed;
-}
-function parseRequiredPositiveInt(value, option) {
-  if (!value) {
-    throw new CliError(`Missing value for ${option}.`, 1, { hint: `Provide a value after ${option}, e.g. \`${option} 10\`.` });
-  }
-  const parsed = Number.parseInt(value, 10);
-  if (!Number.isFinite(parsed) || parsed <= 0) {
-    throw new CliError(`Invalid ${option} value: ${value}`, 1, { hint: `Pass a positive integer, e.g. \`${option} 10\`.` });
-  }
-  return parsed;
-}
-
-// packages/cli/src/commands/remote.ts
-function assertRemoteOperationSuccess(command, response) {
-  if (!("success" in response)) {
-    return;
-  }
-  if (response.success === false) {
-    const error = typeof response.error === "string" && response.error || `${command} failed without explicit error detail from remote server.`;
-    throw new RemoteCliError("RIG_REMOTE_OPERATION_FAILED", error, 3, { command, response: redactSecretFields(response) });
-  }
-}
-function redactRemoteEndpoint(endpoint) {
-  const { token, ...rest } = endpoint;
-  return {
-    ...rest,
-    token: "",
-    tokenConfigured: token.trim().length > 0
-  };
-}
-function isRecord(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function isSecretKey(key) {
-  const normalized = key.toLowerCase();
-  return normalized === "token" || normalized === "authtoken" || normalized === "authorization" || normalized === "connectiontoken" || normalized === "access_token" || normalized === "secret";
-}
-function redactSecretFields(value) {
-  if (Array.isArray(value)) {
-    return value.map((entry) => redactSecretFields(entry));
-  }
-  if (!isRecord(value)) {
-    return value;
-  }
-  const redacted = {};
-  for (const [key, entry] of Object.entries(value)) {
-    redacted[key] = isSecretKey(key) && typeof entry === "string" ? entry.trim().length > 0 ? "[redacted]" : "" : redactSecretFields(entry);
-  }
-  return redacted;
-}
-async function executeRemote(context, args) {
-  const [command = "status", ...rest] = args;
-  if (command === "endpoint" || command === "endpoints") {
-    const [subcommand = "list", ...subRest] = rest;
-    switch (subcommand) {
-      case "list": {
-        requireNoExtraArgs(subRest, "rig remote endpoint list");
-        const endpoints = listManagedRemoteEndpoints(undefined, context.projectRoot);
-        const redactedEndpoints = endpoints.map((endpoint2) => redactRemoteEndpoint(endpoint2));
-        if (context.outputMode === "text") {
-          if (endpoints.length === 0) {
-            console.log("No remote endpoints configured.");
-          } else {
-            for (const endpoint2 of endpoints) {
-              console.log(`- ${endpoint2.alias} \xB7 ${endpoint2.host}:${endpoint2.port}${endpoint2.lastConnected ? ` \xB7 last connected ${endpoint2.lastConnected}` : ""}`);
-            }
-          }
-        }
-        return { ok: true, group: "remote", command: "endpoint list", details: { endpoints: redactedEndpoints } };
-      }
-      case "add": {
-        let pending2 = subRest;
-        const alias = takeOption(pending2, "--alias");
-        pending2 = alias.rest;
-        const host = takeOption(pending2, "--host");
-        pending2 = host.rest;
-        const port = takeOption(pending2, "--port");
-        pending2 = port.rest;
-        const token = takeOption(pending2, "--token");
-        pending2 = token.rest;
-        requireNoExtraArgs(pending2, "rig remote endpoint add --alias <a> --host <h> --port <n> --token <t>");
-        if (!alias.value || !host.value || !token.value || !port.value) {
-          throw new CliError("remote endpoint add requires --alias, --host, --port, and --token.", 1, { hint: "Re-run as `rig remote endpoint add --alias <a> --host <h> --port <n> --token <t>`." });
-        }
-        const created = upsertManagedRemoteEndpoint({
-          alias: alias.value,
-          host: host.value,
-          port: parseRequiredPositiveInt(port.value, "--port"),
-          token: token.value
-        }, undefined, context.projectRoot);
-        if (context.outputMode === "text") {
-          console.log(`Saved remote endpoint ${created.alias} -> ${created.host}:${created.port}`);
-        }
-        return { ok: true, group: "remote", command: "endpoint add", details: redactRemoteEndpoint(created) };
-      }
-      case "update": {
-        let pending2 = subRest;
-        const endpointId = takeOption(pending2, "--id");
-        pending2 = endpointId.rest;
-        const alias = takeOption(pending2, "--alias");
-        pending2 = alias.rest;
-        const host = takeOption(pending2, "--host");
-        pending2 = host.rest;
-        const port = takeOption(pending2, "--port");
-        pending2 = port.rest;
-        const token = takeOption(pending2, "--token");
-        pending2 = token.rest;
-        requireNoExtraArgs(pending2, "rig remote endpoint update --id <id> [--alias <a>] [--host <h>] [--port <n>] [--token <t>]");
-        if (!endpointId.value && !alias.value) {
-          throw new CliError("remote endpoint update requires --id <id> or --alias <a>.", 1, { hint: "List endpoints with `rig remote endpoint list`, then pass --id or --alias." });
-        }
-        const updated = updateManagedRemoteEndpointInAuthority(context.projectRoot, {
-          endpointId: endpointId.value || undefined,
-          alias: alias.value || undefined,
-          host: host.value || undefined,
-          port: port.value ? parseRequiredPositiveInt(port.value, "--port") : undefined,
-          token: token.value || undefined
-        });
-        if (!updated) {
-          throw new CliError("Remote endpoint not found.", 2, { hint: "Run `rig remote endpoint list` to see configured endpoints." });
-        }
-        if (context.outputMode === "text") {
-          console.log(`Updated remote endpoint ${updated.alias} -> ${updated.host}:${updated.port}`);
-        }
-        return { ok: true, group: "remote", command: "endpoint update", details: redactRemoteEndpoint(updated) };
-      }
-      case "remove": {
-        let pending2 = subRest;
-        const alias = takeOption(pending2, "--alias");
-        pending2 = alias.rest;
-        requireNoExtraArgs(pending2, "rig remote endpoint remove --alias <a>");
-        if (!alias.value) {
-          throw new CliError("remote endpoint remove requires --alias.", 1, { hint: "Run `rig remote endpoint list` to find the alias, then `rig remote endpoint remove --alias <a>`." });
-        }
-        const removed = removeManagedRemoteEndpoint(alias.value, undefined, context.projectRoot);
-        if (!removed) {
-          throw new CliError(`Remote endpoint alias not found: ${alias.value}`, 2, { hint: "Run `rig remote endpoint list` to see configured endpoint aliases." });
-        }
-        if (context.outputMode === "text") {
-          console.log(`Removed remote endpoint ${alias.value}`);
-        }
-        return { ok: true, group: "remote", command: "endpoint remove", details: { alias: alias.value } };
-      }
-      case "test": {
-        let pending2 = subRest;
-        const alias = takeOption(pending2, "--alias");
-        pending2 = alias.rest;
-        requireNoExtraArgs(pending2, "rig remote endpoint test --alias <a>");
-        if (!alias.value) {
-          throw new CliError("remote endpoint test requires --alias.", 1, { hint: "Run `rig remote endpoint list` to find the alias, then `rig remote endpoint test --alias <a>`." });
-        }
-        const endpoint2 = resolveRemoteEndpoint({ remoteAlias: alias.value, projectRoot: context.projectRoot });
-        const client = new RemoteWsClient(endpoint2);
-        const startedAt = Date.now();
-        try {
-          await client.connect();
-          const response = await client.ping();
-          const latencyMs = Date.now() - startedAt;
-          if (context.outputMode === "text") {
-            console.log(`Remote endpoint ${alias.value} responded in ${latencyMs}ms.`);
-          }
-          return {
-            ok: true,
-            group: "remote",
-            command: "endpoint test",
-            details: {
-              alias: alias.value,
-              host: endpoint2.host,
-              port: endpoint2.port,
-              latencyMs,
-              response: redactSecretFields(response)
-            }
-          };
-        } finally {
-          client.disconnect();
-        }
-      }
-      case "migrate": {
-        requireNoExtraArgs(subRest, "rig remote endpoint migrate");
-        const result = migrateManagedRemoteEndpoints(context.projectRoot);
-        if (context.outputMode === "text") {
-          console.log(`Imported ${result.imported} endpoint(s) from ${result.sourcePath}${result.skipped > 0 ? `, skipped ${result.skipped}` : ""}.`);
-        }
-        return { ok: true, group: "remote", command: "endpoint migrate", details: result };
-      }
-      case "doctor": {
-        requireNoExtraArgs(subRest, "rig remote endpoint doctor");
-        const result = doctorManagedRemoteEndpoints(context.projectRoot);
-        if (context.outputMode === "text") {
-          console.log(JSON.stringify(result, null, 2));
-        }
-        return { ok: true, group: "remote", command: "endpoint doctor", details: result };
-      }
-      default:
-        throw new CliError(`Unknown remote endpoint command: ${subcommand}`, 1, { hint: "Run `rig remote --help` for endpoint commands (list|add|update|remove|test)." });
-    }
-  }
-  let pending = rest;
-  const remoteAliasResult = takeOption(pending, "--remote");
-  pending = remoteAliasResult.rest;
-  const hostResult = takeOption(pending, "--host");
-  pending = hostResult.rest;
-  const portResult = takeOption(pending, "--port");
-  pending = portResult.rest;
-  const tokenResult = takeOption(pending, "--token");
-  pending = tokenResult.rest;
-  const endpoint = resolveRemoteEndpoint({
-    host: hostResult.value,
-    port: portResult.value,
-    token: tokenResult.value,
-    remoteAlias: remoteAliasResult.value,
-    projectRoot: context.projectRoot
-  });
-  const remoteMeta = {
-    source: endpoint.source,
-    alias: endpoint.alias || null,
-    host: endpoint.host,
-    port: endpoint.port
-  };
-  const withClient = async (runner) => {
-    const client = new RemoteWsClient(endpoint);
-    try {
-      await client.connect();
-      return await runner(client);
-    } finally {
-      client.disconnect();
-    }
-  };
-  const toDetails = (response) => ({
-    command: `remote ${command}`,
-    remote: remoteMeta,
-    requestId: response.id || null,
-    messageType: response.type,
-    payload: redactSecretFields(response),
-    error: null
-  });
-  try {
-    switch (command) {
-      case "test": {
-        requireNoExtraArgs(pending, "rig remote test [--remote <alias>] [--host <host>] [--port <n>] [--token <token>]");
-        const response = await withClient((client) => client.ping());
-        return { ok: true, group: "remote", command, details: toDetails(response) };
-      }
-      case "status": {
-        requireNoExtraArgs(pending, "rig remote status [--remote <alias>] [--host <host>] [--port <n>] [--token <token>]");
-        const response = await withClient((client) => client.getState());
-        return { ok: true, group: "remote", command, details: toDetails(response) };
-      }
-      case "tasks": {
-        requireNoExtraArgs(pending, "rig remote tasks [--remote <alias>] [--host <host>] [--port <n>] [--token <token>]");
-        const response = await withClient((client) => client.getTasks());
-        return { ok: true, group: "remote", command, details: toDetails(response) };
-      }
-      case "watch": {
-        let watchPending = pending;
-        const secondsResult = takeOption(watchPending, "--seconds");
-        watchPending = secondsResult.rest;
-        const eventResult = takeOption(watchPending, "--event");
-        watchPending = eventResult.rest;
-        requireNoExtraArgs(watchPending, "rig remote watch [--seconds <n>] [--event <type>] [--remote <alias>] [--host <host>] [--port <n>] [--token <token>]");
-        const seconds = parseOptionalPositiveInt(secondsResult.value, "--seconds");
-        const eventFilter = eventResult.value || undefined;
-        if (context.outputMode === "json" && !seconds) {
-          throw new CliError("--json remote watch requires --seconds <n> to produce bounded output.", 2, { hint: "Re-run as `rig remote watch --seconds 10 --json`." });
-        }
-        const captured = [];
-        let dropped = 0;
-        let received = 0;
-        let stop = false;
-        const onSignal = () => {
-          stop = true;
-        };
-        process.once("SIGINT", onSignal);
-        process.once("SIGTERM", onSignal);
-        try {
-          await withClient(async (client) => {
-            client.setEventHandler((event) => {
-              if (!matchesEventFilter(event.message, eventFilter)) {
-                return;
-              }
-              received += 1;
-              if (context.outputMode === "text") {
-                console.log(`[${event.receivedAt}] ${summarizeMessage(event.message)}`);
-              } else if (captured.length < 200) {
-                captured.push(event.message);
-              } else {
-                dropped += 1;
-              }
-            });
-            const subscribed = await client.subscribe(eventFilter ? [eventFilter] : []);
-            if (!subscribed.success) {
-              throw new RemoteCliError("RIG_REMOTE_SUBSCRIBE_FAILED", subscribed.error || "Failed to subscribe to remote events.", 3);
-            }
-            if (seconds) {
-              await Bun.sleep(seconds * 1000);
-              return;
-            }
-            while (!stop) {
-              await Bun.sleep(250);
-            }
-          });
-        } finally {
-          process.off("SIGINT", onSignal);
-          process.off("SIGTERM", onSignal);
-        }
-        return {
-          ok: true,
-          group: "remote",
-          command,
-          details: {
-            command: "remote watch",
-            remote: remoteMeta,
-            messageType: "stream",
-            requestId: null,
-            payload: context.outputMode === "json" ? captured : null,
-            error: null,
-            received,
-            dropped,
-            event: eventFilter || null,
-            seconds: seconds || null
-          }
-        };
-      }
-      case "pause":
-      case "resume":
-      case "stop":
-      case "continue":
-      case "refresh": {
-        requireNoExtraArgs(pending, `rig remote ${command} [--remote <alias>] [--host <host>] [--port <n>] [--token <token>]`);
-        const response = await withClient(async (client) => {
-          switch (command) {
-            case "pause":
-              return await client.pause();
-            case "resume":
-              return await client.resume();
-            case "stop":
-              return await client.interrupt();
-            case "continue":
-              return await client.continueExecution();
-            default:
-              return await client.refreshTasks();
-          }
-        });
-        assertRemoteOperationSuccess(command, response);
-        return { ok: true, group: "remote", command, details: toDetails(response) };
-      }
-      case "add-iterations":
-      case "remove-iterations": {
-        let countPending = pending;
-        const countResult = takeOption(countPending, "--count");
-        countPending = countResult.rest;
-        requireNoExtraArgs(countPending, `rig remote ${command} --count <n> [--remote <alias>] [--host <host>] [--port <n>] [--token <token>]`);
-        const count = parseRequiredPositiveInt(countResult.value, "--count");
-        const response = await withClient(async (client) => command === "add-iterations" ? await client.addIterations(count) : await client.removeIterations(count));
-        assertRemoteOperationSuccess(command, response);
-        return { ok: true, group: "remote", command, details: toDetails(response) };
-      }
-      case "prompt-preview":
-      case "iteration-output": {
-        let taskPending = pending;
-        const taskResult = takeOption(taskPending, "--task");
-        taskPending = taskResult.rest;
-        requireNoExtraArgs(taskPending, `rig remote ${command} --task <id> [--remote <alias>] [--host <host>] [--port <n>] [--token <token>]`);
-        const taskId = requireTask(taskResult.value, `rig remote ${command} --task <id>`);
-        const response = await withClient(async (client) => command === "prompt-preview" ? await client.getPromptPreview(taskId) : await client.getIterationOutput(taskId));
-        assertRemoteOperationSuccess(command, response);
-        return { ok: true, group: "remote", command, details: toDetails(response) };
-      }
-      case "orchestrate-start": {
-        let orchestrationPending = pending;
-        const maxWorkersResult = takeOption(orchestrationPending, "--max-workers");
-        orchestrationPending = maxWorkersResult.rest;
-        const maxIterationsResult = takeOption(orchestrationPending, "--max-iterations");
-        orchestrationPending = maxIterationsResult.rest;
-        const directMergeResult = takeFlag(orchestrationPending, "--direct-merge");
-        orchestrationPending = directMergeResult.rest;
-        requireNoExtraArgs(orchestrationPending, "rig remote orchestrate-start [--max-workers <n>] [--max-iterations <n>] [--direct-merge]");
-        const response = await withClient((client) => client.startOrchestration({
-          maxWorkers: parseOptionalPositiveInt(maxWorkersResult.value, "--max-workers"),
-          maxIterations: parseOptionalPositiveInt(maxIterationsResult.value, "--max-iterations"),
-          directMerge: directMergeResult.value
-        }));
-        assertRemoteOperationSuccess(command, response);
-        return {
-          ok: true,
-          group: "remote",
-          command,
-          details: toDetails(response)
-        };
-      }
-      case "orchestrate-pause":
-      case "orchestrate-resume":
-      case "orchestrate-stop":
-      case "orchestrate-state": {
-        let orchestrationPending = pending;
-        const idResult = takeOption(orchestrationPending, "--id");
-        orchestrationPending = idResult.rest;
-        requireNoExtraArgs(orchestrationPending, `rig remote ${command} --id <orch-id> [--remote <alias>] [--host <host>] [--port <n>] [--token <token>]`);
-        const orchestrationId = requireTask(idResult.value, `rig remote ${command} --id <orch-id> [--remote <alias>] [--host <host>] [--port <n>] [--token <token>]`);
-        const response = await withClient(async (client) => {
-          switch (command) {
-            case "orchestrate-pause":
-              return await client.pauseOrchestration(orchestrationId);
-            case "orchestrate-resume":
-              return await client.resumeOrchestration(orchestrationId);
-            case "orchestrate-stop":
-              return await client.stopOrchestration(orchestrationId);
-            default:
-              return await client.getOrchestrationState(orchestrationId);
-          }
-        });
-        assertRemoteOperationSuccess(command, response);
-        return { ok: true, group: "remote", command, details: toDetails(response) };
-      }
-      default:
-        throw new CliError(`Unknown remote command: ${command}`, 1, { hint: "Run `rig remote --help` to list remote commands." });
-    }
-  } catch (error) {
-    if (error instanceof RemoteCliError) {
-      throw new CliError(`[${error.code}] ${error.message}`, error.exitCode);
-    }
-    throw error;
-  }
-}
-export {
-  executeRemote
-};