@h-rig/cli 0.0.6-alpha.2 → 0.0.6-alpha.21

package/dist/src/commands/_preflight.js

@@ -94,11 +94,10 @@ function resolveSelectedConnection(projectRoot, options = {}) {
 }
 
 // packages/cli/src/commands/_server-client.ts
-import { spawnSync } from "child_process";
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { resolve as resolve2 } from "path";
 import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
-var cachedGitHubBearerToken;
+var scopedGitHubBearerTokens = new Map;
 function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
@@ -115,25 +114,13 @@ function readPrivateRemoteSessionToken(projectRoot) {
   }
 }
 function readGitHubBearerTokenForRemote(projectRoot) {
-  if (cachedGitHubBearerToken !== undefined)
-    return cachedGitHubBearerToken;
+  const scopedKey = resolve2(projectRoot);
+  if (scopedGitHubBearerTokens.has(scopedKey))
+    return scopedGitHubBearerTokens.get(scopedKey) ?? null;
   const privateSession = readPrivateRemoteSessionToken(projectRoot);
-  if (privateSession) {
-    cachedGitHubBearerToken = privateSession;
-    return cachedGitHubBearerToken;
-  }
-  const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
-  if (envToken) {
-    cachedGitHubBearerToken = envToken;
-    return cachedGitHubBearerToken;
-  }
-  const result = spawnSync("gh", ["auth", "token"], {
-    encoding: "utf8",
-    timeout: 5000,
-    stdio: ["ignore", "pipe", "ignore"]
-  });
-  cachedGitHubBearerToken = result.status === 0 ? cleanToken(result.stdout) : null;
-  return cachedGitHubBearerToken;
+  if (privateSession)
+    return privateSession;
+  return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
 }
 async function ensureServerForCli(projectRoot) {
   try {
@@ -206,7 +193,8 @@ async function requestServerJson(context, pathname, init = {}) {
 import { existsSync as existsSync3, readFileSync as readFileSync3, rmSync } from "fs";
 import { homedir as homedir2 } from "os";
 import { resolve as resolve3 } from "path";
-var PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
+var PI_RIG_PACKAGE_NAME = "@h-rig/pi-rig";
+var LEGACY_PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
 async function defaultCommandRunner(command, options = {}) {
   const proc = Bun.spawn(command, { cwd: options.cwd, stdout: "pipe", stderr: "pipe" });
   const [stdout, stderr, exitCode] = await Promise.all([
@@ -225,7 +213,7 @@ function resolvePiHomeDir(inputHomeDir) {
 function piListContainsPiRig(output) {
   return output.split(/\r?\n/).some((line) => {
     const normalized = line.trim();
-    return normalized.includes(PI_RIG_PACKAGE_NAME) || /(?:^|[\\/])packages[\\/]pi-rig(?:$|\s)/.test(normalized);
+    return normalized.includes(PI_RIG_PACKAGE_NAME) || normalized.includes(LEGACY_PI_RIG_PACKAGE_NAME) || /(?:^|[\\/])packages[\\/]pi-rig(?:$|\s)/.test(normalized);
   });
 }
 async function safeRun(runner, command, options) {
@@ -329,6 +317,9 @@ function permissionAllowsPr(payload) {
   }
   return null;
 }
+function isNotFoundError(error) {
+  return /\b(404|not found)\b/i.test(message(error));
+}
 function projectCheckoutReady(payload) {
   if (!payload || typeof payload !== "object" || Array.isArray(payload))
     return null;
@@ -361,19 +352,33 @@ async function runFastTaskRunPreflight(context, options = {}) {
   const checks = [];
   const request = options.requestJson ?? ((pathname, init) => requestServerJson(context, pathname, init));
   const taskId = options.taskId?.trim() || null;
+  const requiresCurrentRunApi = Boolean(taskId);
+  const selectedServer = options.requestJson ? null : await ensureServerForCli(context.projectRoot).catch(() => null);
+  const allowLocalLegacyTaskRunCompatibility = selectedServer?.connectionKind === "local";
+  let legacyServerCompatibility = false;
   try {
     await request("/api/server/status");
     checks.push(preflightCheck("server", "Rig server reachable", "pass"));
   } catch (error) {
-    checks.push(preflightCheck("server", "Rig server reachable", "fail", message(error), "Start or select a reachable Rig server."));
+    if (isNotFoundError(error)) {
+      try {
+        await request("/health");
+        legacyServerCompatibility = !requiresCurrentRunApi || allowLocalLegacyTaskRunCompatibility;
+        checks.push(requiresCurrentRunApi && !allowLocalLegacyTaskRunCompatibility ? preflightCheck("server", "Rig server reachable", "fail", "legacy /health endpoint only; current task-run APIs are required", "Upgrade/select the Rig server before launching a task run.") : preflightCheck("server", "Rig server reachable", "pass", allowLocalLegacyTaskRunCompatibility ? "local legacy /health endpoint; submit endpoint will be authoritative" : "legacy /health endpoint"));
+      } catch (healthError) {
+        checks.push(preflightCheck("server", "Rig server reachable", "fail", message(healthError), "Start or select a reachable Rig server."));
+      }
+    } else {
+      checks.push(preflightCheck("server", "Rig server reachable", "fail", message(error), "Start or select a reachable Rig server."));
+    }
   }
   const repo = readRepoConnection(context.projectRoot);
-  checks.push(repo ? preflightCheck("project-link", "project linked to Rig connection", repo.project ? "pass" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : ""}`, "Run `rig init --yes --repo owner/repo` to record the GitHub repo slug.") : preflightCheck("project-link", "project linked to Rig connection", "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig connect use <alias|local>`."));
+  checks.push(repo ? preflightCheck("project-link", "project linked to Rig connection", repo.project ? "pass" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : ""}`, "Run `rig init --yes --repo owner/repo` to record the GitHub repo slug.") : preflightCheck("project-link", "project linked to Rig connection", legacyServerCompatibility ? "warn" : "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig connect use <alias|local>`."));
   try {
     const auth = await request("/api/github/auth/status");
-    checks.push(isAuthenticated(auth) ? preflightCheck("github-auth", "GitHub auth valid", "pass") : preflightCheck("github-auth", "GitHub auth valid", "fail", "not authenticated", "Run `rig github auth import-gh` or `rig github auth token --token <token>`."));
+    checks.push(isAuthenticated(auth) ? preflightCheck("github-auth", "GitHub auth valid", "pass") : preflightCheck("github-auth", "GitHub auth valid", legacyServerCompatibility ? "warn" : "fail", "not authenticated", "Run `rig github auth import-gh` or `rig github auth token --token <token>`."));
   } catch (error) {
-    checks.push(preflightCheck("github-auth", "GitHub auth valid", "fail", message(error), "Fix GitHub auth on the selected Rig server."));
+    checks.push(preflightCheck("github-auth", "GitHub auth valid", legacyServerCompatibility ? "warn" : "fail", message(error), "Fix GitHub auth on the selected Rig server."));
   }
   try {
     const projection = await request("/api/workspace/task-projection");
@@ -401,9 +406,9 @@ async function runFastTaskRunPreflight(context, options = {}) {
     try {
       const tasks = await request(`/api/workspace/tasks?limit=200&refresh=1`);
       const found = Array.isArray(tasks) && tasks.some((task) => taskMatchesId(task, taskId));
-      checks.push(found ? preflightCheck("issue", "task/issue accessible", "pass", taskId) : preflightCheck("issue", "task/issue accessible", "fail", taskId, "Confirm the issue exists and matches the configured task filters."));
+      checks.push(found ? preflightCheck("issue", "task/issue accessible", "pass", taskId) : preflightCheck("issue", "task/issue accessible", legacyServerCompatibility ? "warn" : "fail", taskId, "Confirm the issue exists and matches the configured task filters."));
     } catch (error) {
-      checks.push(preflightCheck("issue", "task/issue accessible", "fail", message(error), "Fix the task source before launching a run."));
+      checks.push(preflightCheck("issue", "task/issue accessible", legacyServerCompatibility ? "warn" : "fail", message(error), "Fix the task source before launching a run."));
     }
     try {
       const runs = await request("/api/runs?limit=200");

package/dist/src/commands/_server-client.js

@@ -1,6 +1,5 @@
 // @bun
 // packages/cli/src/commands/_server-client.ts
-import { spawnSync } from "child_process";
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { resolve as resolve2 } from "path";
 
@@ -99,13 +98,14 @@ function resolveSelectedConnection(projectRoot, options = {}) {
 }
 
 // packages/cli/src/commands/_server-client.ts
-var cachedGitHubBearerToken;
+var scopedGitHubBearerTokens = new Map;
 function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
 }
-function setGitHubBearerTokenForCurrentProcess(token) {
-  cachedGitHubBearerToken = cleanToken(token ?? undefined);
+function setGitHubBearerTokenForCurrentProcess(token, projectRoot) {
+  const scopedKey = resolve2(projectRoot ?? process.cwd());
+  scopedGitHubBearerTokens.set(scopedKey, cleanToken(token ?? undefined));
 }
 function readPrivateRemoteSessionToken(projectRoot) {
   const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
@@ -119,25 +119,13 @@ function readPrivateRemoteSessionToken(projectRoot) {
   }
 }
 function readGitHubBearerTokenForRemote(projectRoot) {
-  if (cachedGitHubBearerToken !== undefined)
-    return cachedGitHubBearerToken;
+  const scopedKey = resolve2(projectRoot);
+  if (scopedGitHubBearerTokens.has(scopedKey))
+    return scopedGitHubBearerTokens.get(scopedKey) ?? null;
   const privateSession = readPrivateRemoteSessionToken(projectRoot);
-  if (privateSession) {
-    cachedGitHubBearerToken = privateSession;
-    return cachedGitHubBearerToken;
-  }
-  const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
-  if (envToken) {
-    cachedGitHubBearerToken = envToken;
-    return cachedGitHubBearerToken;
-  }
-  const result = spawnSync("gh", ["auth", "token"], {
-    encoding: "utf8",
-    timeout: 5000,
-    stdio: ["ignore", "pipe", "ignore"]
-  });
-  cachedGitHubBearerToken = result.status === 0 ? cleanToken(result.stdout) : null;
-  return cachedGitHubBearerToken;
+  if (privateSession)
+    return privateSession;
+  return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
 }
 async function ensureServerForCli(projectRoot) {
   try {
@@ -275,16 +263,36 @@ async function registerProjectViaServer(context, input) {
 function sleep(ms) {
   return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
+function isRetryableProjectRootSwitchError(error) {
+  if (!(error instanceof Error))
+    return false;
+  const message = error.message.toLowerCase();
+  return message.includes("rig server request failed (401): auth-required") || message.includes("rig server request failed (401): github-token-required") || message.includes("rig server request failed (502)") || message.includes("rig server request failed (503)") || message.includes("bad gateway") || message.includes("fetch failed") || message.includes("econnrefused") || message.includes("connection refused");
+}
 async function switchServerProjectRootViaServer(context, projectRoot, options = {}) {
-  const switched = await requestServerJson(context, "/api/server/project-root", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ projectRoot })
-  });
   const timeoutMs = options.timeoutMs ?? 30000;
   const pollMs = options.pollMs ?? 1000;
   const deadline = Date.now() + timeoutMs;
   let lastError;
+  let switched = null;
+  while (Date.now() < deadline) {
+    try {
+      switched = await requestServerJson(context, "/api/server/project-root", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ projectRoot })
+      });
+      break;
+    } catch (error) {
+      lastError = error;
+      if (!isRetryableProjectRootSwitchError(error))
+        throw error;
+      await sleep(pollMs);
+    }
+  }
+  if (!switched) {
+    throw new CliError2(`Rig server did not accept project-root switch to ${projectRoot} before timeout (${lastError instanceof Error ? lastError.message : String(lastError ?? "no response")}).`, 1);
+  }
   while (Date.now() < deadline) {
     try {
       const status = await requestServerJson(context, "/api/server/status");
@@ -302,6 +310,14 @@ async function switchServerProjectRootViaServer(context, projectRoot, options =
   }
   throw new CliError2(`Rig server did not switch to ${projectRoot} before timeout (${lastError instanceof Error ? lastError.message : String(lastError ?? "no status")}).`, 1);
 }
+async function listRunsViaServer(context, options = {}) {
+  const url = new URL("http://rig.local/api/runs");
+  if (options.limit !== undefined)
+    url.searchParams.set("limit", String(options.limit));
+  const payload = await requestServerJson(context, `${url.pathname}${url.search}`);
+  const runs = Array.isArray(payload) ? payload : payload && typeof payload === "object" && !Array.isArray(payload) && Array.isArray(payload.runs) ? payload.runs : [];
+  return runs.filter((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry)));
+}
 async function getRunDetailsViaServer(context, runId) {
   const payload = await requestServerJson(context, `/api/runs/${encodeURIComponent(runId)}`);
   return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
@@ -315,6 +331,37 @@ async function getRunLogsViaServer(context, runId, options = {}) {
   const payload = await requestServerJson(context, `${url.pathname}${url.search}`);
   return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : { entries: [] };
 }
+async function getRunTimelineViaServer(context, runId, options = {}) {
+  const url = new URL(`http://rig.local/api/runs/${encodeURIComponent(runId)}/timeline`);
+  if (options.limit !== undefined)
+    url.searchParams.set("limit", String(options.limit));
+  if (options.cursor)
+    url.searchParams.set("cursor", options.cursor);
+  const payload = await requestServerJson(context, `${url.pathname}${url.search}`);
+  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : { entries: [] };
+}
+async function ensureTaskLabelsViaServer(context) {
+  const payload = await requestServerJson(context, "/api/workspace/task-labels", { method: "POST" });
+  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
+}
+async function listGitHubProjectsViaServer(context, owner) {
+  const url = new URL("http://rig.local/api/github/projects");
+  url.searchParams.set("owner", owner);
+  const payload = await requestServerJson(context, `${url.pathname}${url.search}`);
+  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : { projects: [] };
+}
+async function getGitHubProjectStatusFieldViaServer(context, projectId) {
+  const payload = await requestServerJson(context, `/api/github/projects/${encodeURIComponent(projectId)}/status-field`);
+  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
+}
+async function updateWorkspaceTaskViaServer(context, input) {
+  const payload = await requestServerJson(context, "/api/tasks/update", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(input)
+  });
+  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : { ok: true };
+}
 async function stopRunViaServer(context, runId) {
   const payload = await requestServerJson(context, "/api/runs/stop", {
     method: "POST",
@@ -363,6 +410,7 @@ async function submitTaskRunViaServer(context, input) {
   return { runId };
 }
 export {
+  updateWorkspaceTaskViaServer,
   switchServerProjectRootViaServer,
   submitTaskRunViaServer,
   stopRunViaServer,
@@ -374,9 +422,14 @@ export {
   prepareRemoteCheckoutViaServer,
   postGitHubTokenViaServer,
   listWorkspaceTasksViaServer,
+  listRunsViaServer,
+  listGitHubProjectsViaServer,
   getWorkspaceTaskViaServer,
+  getRunTimelineViaServer,
   getRunLogsViaServer,
   getRunDetailsViaServer,
+  getGitHubProjectStatusFieldViaServer,
   getGitHubAuthStatusViaServer,
+  ensureTaskLabelsViaServer,
   ensureServerForCli
 };

package/dist/src/commands/_snapshot-upload.js

@@ -4,7 +4,6 @@ import { mkdir, readdir, readFile, writeFile } from "fs/promises";
 import { dirname as dirname2, resolve as resolve3, relative, sep } from "path";
 
 // packages/cli/src/commands/_server-client.ts
-import { spawnSync } from "child_process";
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { resolve as resolve2 } from "path";
 
@@ -103,7 +102,7 @@ function resolveSelectedConnection(projectRoot, options = {}) {
 }
 
 // packages/cli/src/commands/_server-client.ts
-var cachedGitHubBearerToken;
+var scopedGitHubBearerTokens = new Map;
 function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
@@ -120,25 +119,13 @@ function readPrivateRemoteSessionToken(projectRoot) {
   }
 }
 function readGitHubBearerTokenForRemote(projectRoot) {
-  if (cachedGitHubBearerToken !== undefined)
-    return cachedGitHubBearerToken;
+  const scopedKey = resolve2(projectRoot);
+  if (scopedGitHubBearerTokens.has(scopedKey))
+    return scopedGitHubBearerTokens.get(scopedKey) ?? null;
   const privateSession = readPrivateRemoteSessionToken(projectRoot);
-  if (privateSession) {
-    cachedGitHubBearerToken = privateSession;
-    return cachedGitHubBearerToken;
-  }
-  const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
-  if (envToken) {
-    cachedGitHubBearerToken = envToken;
-    return cachedGitHubBearerToken;
-  }
-  const result = spawnSync("gh", ["auth", "token"], {
-    encoding: "utf8",
-    timeout: 5000,
-    stdio: ["ignore", "pipe", "ignore"]
-  });
-  cachedGitHubBearerToken = result.status === 0 ? cleanToken(result.stdout) : null;
-  return cachedGitHubBearerToken;
+  if (privateSession)
+    return privateSession;
+  return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
 }
 async function ensureServerForCli(projectRoot) {
   try {

package/dist/src/commands/_task-picker.js

@@ -1,6 +1,9 @@
 // @bun
 // packages/cli/src/commands/_task-picker.ts
-import { createInterface } from "readline/promises";
+import { cancel, isCancel, select } from "@clack/prompts";
+
+// packages/cli/src/commands/_operator-surface.ts
+import { createInterface as createPromptInterface } from "readline/promises";
 function taskId(task) {
   return typeof task.id === "string" && task.id.trim() ? task.id : "<unknown>";
 }
@@ -13,6 +16,19 @@ function taskStatus(task) {
 function renderTaskPickerRows(tasks) {
   return tasks.map((task, index) => `${index + 1}. ${taskId(task)} \xB7 ${taskStatus(task)} \xB7 ${taskTitle(task)}`);
 }
+async function promptForTaskSelection(question) {
+  const rl = createPromptInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await rl.question(question);
+  } finally {
+    rl.close();
+  }
+}
+
+// packages/cli/src/commands/_task-picker.ts
+function taskId2(task) {
+  return typeof task.id === "string" && task.id.trim() ? task.id : "<unknown>";
+}
 async function selectTaskWithTextPicker(tasks, io = {}) {
   if (tasks.length === 0)
     return null;
@@ -22,25 +38,37 @@ async function selectTaskWithTextPicker(tasks, io = {}) {
   if (!isTty) {
     throw new Error("task run requires an interactive terminal to pick a task; pass --task <id>, --next, or --detach with a task id.");
   }
-  const prompt = io.prompt ?? (async (question) => {
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    try {
-      return await rl.question(question);
-    } finally {
-      rl.close();
+  if (io.prompt || io.renderer) {
+    const prompt = io.prompt ?? promptForTaskSelection;
+    const renderer = io.renderer ?? { writeLine: (line) => process.stdout.write(`${line}
+`) };
+    renderer.writeLine("Select Rig task:");
+    for (const row of renderTaskPickerRows(tasks))
+      renderer.writeLine(`  ${row}`);
+    const answer2 = (await prompt(`Task [1-${tasks.length}] or id: `)).trim();
+    if (!answer2)
+      return null;
+    if (/^\d+$/.test(answer2)) {
+      const index2 = Number.parseInt(answer2, 10) - 1;
+      return tasks[index2] ?? null;
     }
+    return tasks.find((task) => taskId2(task) === answer2) ?? null;
+  }
+  const options = tasks.map((task, index2) => ({
+    value: `${index2}`,
+    label: `${taskId2(task)} \xB7 ${typeof task.title === "string" && task.title.trim() ? task.title.trim() : "Untitled task"}`,
+    hint: typeof task.status === "string" && task.status.trim() ? task.status.trim() : undefined
+  }));
+  const answer = await select({
+    message: "Select Rig task",
+    options
   });
-  console.log("Select Rig task:");
-  for (const row of renderTaskPickerRows(tasks))
-    console.log(`  ${row}`);
-  const answer = (await prompt(`Task [1-${tasks.length}] or id: `)).trim();
-  if (!answer)
+  if (isCancel(answer)) {
+    cancel("No task selected.");
     return null;
-  if (/^\d+$/.test(answer)) {
-    const index = Number.parseInt(answer, 10) - 1;
-    return tasks[index] ?? null;
   }
-  return tasks.find((task) => taskId(task) === answer) ?? null;
+  const index = Number.parseInt(String(answer), 10);
+  return Number.isFinite(index) ? tasks[index] ?? null : null;
 }
 export {
   selectTaskWithTextPicker,

package/dist/src/commands/agent.js

@@ -126,6 +126,7 @@ function upsertAgentAuthorityRun(projectRoot, input) {
   const runtimeAdapter = normalizeRuntimeAdapter(input.runtimeAdapter ?? existing?.runtimeAdapter ?? "claude-code");
   const title = resolveTaskTitleForAuthorityRun(projectRoot, input.taskId) ?? input.taskId;
   const next = {
+    ...existing ?? {},
     runId: input.runId,
     projectRoot,
     workspaceId: existing?.workspaceId ?? RIG_WORKSPACE_ID,
@@ -220,6 +221,7 @@ import { ensureProjectMainFreshBeforeRun } from "@rig/runtime/control-plane/proj
 
 // packages/cli/src/commands/_server-client.ts
 import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
+var scopedGitHubBearerTokens = new Map;
 
 // packages/cli/src/commands/_preflight.ts
 async function runProjectMainSyncPreflight(context, options) {

package/dist/src/commands/doctor.js

@@ -104,11 +104,10 @@ function resolveSelectedConnection(projectRoot, options = {}) {
 }
 
 // packages/cli/src/commands/_server-client.ts
-import { spawnSync } from "child_process";
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { resolve as resolve2 } from "path";
 import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
-var cachedGitHubBearerToken;
+var scopedGitHubBearerTokens = new Map;
 function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
@@ -125,25 +124,13 @@ function readPrivateRemoteSessionToken(projectRoot) {
   }
 }
 function readGitHubBearerTokenForRemote(projectRoot) {
-  if (cachedGitHubBearerToken !== undefined)
-    return cachedGitHubBearerToken;
+  const scopedKey = resolve2(projectRoot);
+  if (scopedGitHubBearerTokens.has(scopedKey))
+    return scopedGitHubBearerTokens.get(scopedKey) ?? null;
   const privateSession = readPrivateRemoteSessionToken(projectRoot);
-  if (privateSession) {
-    cachedGitHubBearerToken = privateSession;
-    return cachedGitHubBearerToken;
-  }
-  const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
-  if (envToken) {
-    cachedGitHubBearerToken = envToken;
-    return cachedGitHubBearerToken;
-  }
-  const result = spawnSync("gh", ["auth", "token"], {
-    encoding: "utf8",
-    timeout: 5000,
-    stdio: ["ignore", "pipe", "ignore"]
-  });
-  cachedGitHubBearerToken = result.status === 0 ? cleanToken(result.stdout) : null;
-  return cachedGitHubBearerToken;
+  if (privateSession)
+    return privateSession;
+  return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
 }
 async function ensureServerForCli(projectRoot) {
   try {
@@ -226,7 +213,8 @@ async function loadRigConfigOrNull(projectRoot) {
 import { existsSync as existsSync3, readFileSync as readFileSync3, rmSync } from "fs";
 import { homedir as homedir2 } from "os";
 import { resolve as resolve3 } from "path";
-var PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
+var PI_RIG_PACKAGE_NAME = "@h-rig/pi-rig";
+var LEGACY_PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
 async function defaultCommandRunner(command, options = {}) {
   const proc = Bun.spawn(command, { cwd: options.cwd, stdout: "pipe", stderr: "pipe" });
   const [stdout, stderr, exitCode] = await Promise.all([
@@ -245,7 +233,7 @@ function resolvePiHomeDir(inputHomeDir) {
 function piListContainsPiRig(output) {
   return output.split(/\r?\n/).some((line) => {
     const normalized = line.trim();
-    return normalized.includes(PI_RIG_PACKAGE_NAME) || /(?:^|[\\/])packages[\\/]pi-rig(?:$|\s)/.test(normalized);
+    return normalized.includes(PI_RIG_PACKAGE_NAME) || normalized.includes(LEGACY_PI_RIG_PACKAGE_NAME) || /(?:^|[\\/])packages[\\/]pi-rig(?:$|\s)/.test(normalized);
   });
 }
 async function safeRun(runner, command, options) {

package/dist/src/commands/github.js

@@ -1,6 +1,6 @@
 // @bun
 // packages/cli/src/commands/github.ts
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync } from "child_process";
 
 // packages/cli/src/runner.ts
 import { EventBus } from "@rig/runtime/control-plane/runtime/events";
@@ -32,7 +32,6 @@ function takeOption(args, option) {
 }
 
 // packages/cli/src/commands/_server-client.ts
-import { spawnSync } from "child_process";
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { resolve as resolve2 } from "path";
 import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
@@ -120,7 +119,7 @@ function resolveSelectedConnection(projectRoot, options = {}) {
 }
 
 // packages/cli/src/commands/_server-client.ts
-var cachedGitHubBearerToken;
+var scopedGitHubBearerTokens = new Map;
 function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
@@ -137,25 +136,13 @@ function readPrivateRemoteSessionToken(projectRoot) {
   }
 }
 function readGitHubBearerTokenForRemote(projectRoot) {
-  if (cachedGitHubBearerToken !== undefined)
-    return cachedGitHubBearerToken;
+  const scopedKey = resolve2(projectRoot);
+  if (scopedGitHubBearerTokens.has(scopedKey))
+    return scopedGitHubBearerTokens.get(scopedKey) ?? null;
   const privateSession = readPrivateRemoteSessionToken(projectRoot);
-  if (privateSession) {
-    cachedGitHubBearerToken = privateSession;
-    return cachedGitHubBearerToken;
-  }
-  const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
-  if (envToken) {
-    cachedGitHubBearerToken = envToken;
-    return cachedGitHubBearerToken;
-  }
-  const result = spawnSync("gh", ["auth", "token"], {
-    encoding: "utf8",
-    timeout: 5000,
-    stdio: ["ignore", "pipe", "ignore"]
-  });
-  cachedGitHubBearerToken = result.status === 0 ? cleanToken(result.stdout) : null;
-  return cachedGitHubBearerToken;
+  if (privateSession)
+    return privateSession;
+  return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
 }
 async function ensureServerForCli(projectRoot) {
   try {
@@ -244,7 +231,7 @@ function printPayload(context, payload, fallback) {
     console.log(fallback);
 }
 function readGhToken() {
-  const result = spawnSync2("gh", ["auth", "token"], { encoding: "utf8" });
+  const result = spawnSync("gh", ["auth", "token"], { encoding: "utf8" });
   if (result.status !== 0) {
     const detail = result.stderr?.trim() || result.stdout?.trim() || "gh auth token failed";
     throw new CliError2(`Could not import GitHub token from gh: ${detail}`, 1);