@h-rig/cli 0.0.6-alpha.27 → 0.0.6-alpha.280

package/dist/src/commands/_policy.js

@@ -1,79 +0,0 @@
-// @bun
-// packages/cli/src/commands/_policy.ts
-import { appendFileSync, mkdirSync } from "fs";
-import { resolve } from "path";
-
-// packages/cli/src/runner.ts
-import { EventBus } from "@rig/runtime/control-plane/runtime/events";
-import { CliError } from "@rig/runtime/control-plane/errors";
-import { evaluate, loadPolicy, resolveAction } from "@rig/runtime/control-plane/runtime/guard";
-import { PluginManager } from "@rig/runtime/control-plane/runtime/plugins";
-import { loadRuntimeContextFromEnv } from "@rig/runtime/control-plane/runtime/context";
-import { buildBinary } from "@rig/runtime/control-plane/runtime/isolation";
-import { CliError as CliError2 } from "@rig/runtime/control-plane/errors";
-function formatCommand(parts) {
-  return parts.map((part) => /[^a-zA-Z0-9_./:-]/.test(part) ? JSON.stringify(part) : part).join(" ");
-}
-
-// packages/cli/src/commands/_policy.ts
-import { evaluate as evaluate2, loadPolicy as loadPolicy2, resolveAction as resolveAction2 } from "@rig/runtime/control-plane/runtime/guard";
-import { resolveHarnessPaths } from "@rig/runtime/control-plane/native/utils";
-function resolveEffectivePolicyMode(context) {
-  const envMode = process.env.RIG_BASH_MODE;
-  if (envMode === "off" || envMode === "observe" || envMode === "enforce") {
-    return envMode;
-  }
-  return context.policyMode || loadPolicy2(context.projectRoot).mode;
-}
-function appendControlledBashAudit(context, mode, command, args, matchedRuleIds, action) {
-  if (mode === "off") {
-    return;
-  }
-  const logsDir = resolveHarnessPaths(context.projectRoot).logsDir;
-  const logFile = resolve(logsDir, "controlled-bash.jsonl");
-  mkdirSync(logsDir, { recursive: true });
-  const payload = {
-    timestamp: new Date().toISOString(),
-    mode,
-    cwd: process.cwd(),
-    pid: process.pid,
-    ppid: process.ppid,
-    argv: args,
-    command,
-    matchedRuleIds
-  };
-  if (action) {
-    payload.action = action;
-  }
-  appendFileSync(logFile, `${JSON.stringify(payload)}
-`, "utf-8");
-}
-async function enforceNativeCommandPolicy(context, args, options) {
-  const mode = resolveEffectivePolicyMode(context);
-  const command = formatCommand([options.commandPrefix, ...args]);
-  const decision = evaluate2({
-    projectRoot: context.projectRoot,
-    evaluation: { type: "command", command }
-  });
-  const action = resolveAction2(mode, decision.matchedRules);
-  const matchedRuleIds = decision.matchedRules.map((rule) => rule.id);
-  await context.emitEvent("policy.decision", {
-    target: "command",
-    command,
-    mode,
-    allowed: action !== "block",
-    matchedRuleIds,
-    reasons: decision.matchedRules.map((rule) => rule.reason)
-  });
-  if (options.writeAuditLog) {
-    appendControlledBashAudit(context, mode, command, args, matchedRuleIds, action === "block" ? "blocked" : action === "warn" ? "warn" : undefined);
-  }
-  if (action === "block") {
-    throw new CliError2(`Policy blocked command: ${command}`, 126);
-  }
-}
-export {
-  resolveEffectivePolicyMode,
-  enforceNativeCommandPolicy,
-  appendControlledBashAudit
-};

package/dist/src/commands/_preflight.js

@@ -1,403 +0,0 @@
-// @bun
-// packages/cli/src/runner.ts
-import { EventBus } from "@rig/runtime/control-plane/runtime/events";
-import { CliError } from "@rig/runtime/control-plane/errors";
-import { evaluate, loadPolicy, resolveAction } from "@rig/runtime/control-plane/runtime/guard";
-import { PluginManager } from "@rig/runtime/control-plane/runtime/plugins";
-import { loadRuntimeContextFromEnv } from "@rig/runtime/control-plane/runtime/context";
-import { buildBinary } from "@rig/runtime/control-plane/runtime/isolation";
-import { CliError as CliError2 } from "@rig/runtime/control-plane/errors";
-
-// packages/cli/src/commands/_preflight.ts
-import { ensureProjectMainFreshBeforeRun } from "@rig/runtime/control-plane/project-main-pre-run-sync";
-
-// packages/cli/src/commands/_connection-state.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { dirname, resolve } from "path";
-function resolveGlobalConnectionsPath(env = process.env) {
-  const explicit = env.RIG_CONNECTIONS_FILE?.trim();
-  if (explicit)
-    return resolve(explicit);
-  const stateDir = env.RIG_GLOBAL_STATE_DIR?.trim();
-  if (stateDir)
-    return resolve(stateDir, "connections.json");
-  return resolve(homedir(), ".rig", "connections.json");
-}
-function resolveRepoConnectionPath(projectRoot) {
-  return resolve(projectRoot, ".rig", "state", "connection.json");
-}
-function readJsonFile(path) {
-  if (!existsSync(path))
-    return null;
-  try {
-    return JSON.parse(readFileSync(path, "utf8"));
-  } catch (error) {
-    throw new CliError2(`Invalid Rig connection state at ${path}: ${error instanceof Error ? error.message : String(error)}`, 1);
-  }
-}
-function normalizeConnection(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    return null;
-  const record = value;
-  if (record.kind === "local")
-    return { kind: "local", mode: "auto" };
-  if (record.kind === "remote" && typeof record.baseUrl === "string" && record.baseUrl.trim()) {
-    const baseUrl = record.baseUrl.trim().replace(/\/+$/, "");
-    return { kind: "remote", baseUrl };
-  }
-  return null;
-}
-function readGlobalConnections(options = {}) {
-  const path = resolveGlobalConnectionsPath(options.env ?? process.env);
-  const payload = readJsonFile(path);
-  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
-    return { connections: {} };
-  }
-  const rawConnections = payload.connections;
-  const connections = {};
-  if (rawConnections && typeof rawConnections === "object" && !Array.isArray(rawConnections)) {
-    for (const [alias, raw] of Object.entries(rawConnections)) {
-      const connection = normalizeConnection(raw);
-      if (connection)
-        connections[alias] = connection;
-    }
-  }
-  return { connections };
-}
-function readRepoConnection(projectRoot) {
-  const payload = readJsonFile(resolveRepoConnectionPath(projectRoot));
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
-    return null;
-  const record = payload;
-  const selected = typeof record.selected === "string" ? record.selected.trim() : "";
-  if (!selected)
-    return null;
-  return {
-    selected,
-    project: typeof record.project === "string" ? record.project : undefined,
-    linkedAt: typeof record.linkedAt === "string" ? record.linkedAt : undefined
-  };
-}
-function resolveSelectedConnection(projectRoot, options = {}) {
-  const repo = readRepoConnection(projectRoot);
-  if (!repo)
-    return null;
-  if (repo.selected === "local")
-    return { alias: "local", connection: { kind: "local", mode: "auto" } };
-  const global = readGlobalConnections(options);
-  const connection = global.connections[repo.selected];
-  if (!connection) {
-    throw new CliError2(`Selected Rig connection "${repo.selected}" was not found. Run \`rig connect list\` or \`rig connect use local\`.`, 1);
-  }
-  return { alias: repo.selected, connection };
-}
-
-// packages/cli/src/commands/_server-client.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { resolve as resolve2 } from "path";
-import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
-var scopedGitHubBearerTokens = new Map;
-function cleanToken(value) {
-  const trimmed = value?.trim();
-  return trimmed ? trimmed : null;
-}
-function readPrivateRemoteSessionToken(projectRoot) {
-  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
-  if (!existsSync2(path))
-    return null;
-  try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
-  } catch {
-    return null;
-  }
-}
-function readGitHubBearerTokenForRemote(projectRoot) {
-  const scopedKey = resolve2(projectRoot);
-  if (scopedGitHubBearerTokens.has(scopedKey))
-    return scopedGitHubBearerTokens.get(scopedKey) ?? null;
-  const privateSession = readPrivateRemoteSessionToken(projectRoot);
-  if (privateSession)
-    return privateSession;
-  return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
-}
-async function ensureServerForCli(projectRoot) {
-  try {
-    const selected = resolveSelectedConnection(projectRoot);
-    if (selected?.connection.kind === "remote") {
-      return {
-        baseUrl: selected.connection.baseUrl,
-        authToken: readGitHubBearerTokenForRemote(projectRoot),
-        connectionKind: "remote"
-      };
-    }
-    const connection = await ensureLocalRigServerConnection(projectRoot);
-    return {
-      baseUrl: connection.baseUrl,
-      authToken: connection.authToken,
-      connectionKind: "local"
-    };
-  } catch (error) {
-    if (error instanceof Error) {
-      throw new CliError2(error.message, 1);
-    }
-    throw error;
-  }
-}
-function mergeHeaders(headers, authToken) {
-  const merged = new Headers(headers);
-  if (authToken) {
-    merged.set("authorization", `Bearer ${authToken}`);
-  }
-  return merged;
-}
-function diagnosticMessage(payload) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
-    return null;
-  const record = payload;
-  const diagnostics = Array.isArray(record.diagnostics) ? record.diagnostics : [];
-  const messages = diagnostics.flatMap((entry) => {
-    if (!entry || typeof entry !== "object" || Array.isArray(entry))
-      return [];
-    const diagnostic = entry;
-    const kind = typeof diagnostic.kind === "string" ? diagnostic.kind : "task-source";
-    const message = typeof diagnostic.message === "string" ? diagnostic.message : null;
-    return message ? [`${kind}: ${message}`] : [];
-  });
-  return messages.length > 0 ? messages.join("; ") : null;
-}
-async function requestServerJson(context, pathname, init = {}) {
-  const server = await ensureServerForCli(context.projectRoot);
-  const response = await fetch(`${server.baseUrl}${pathname}`, {
-    ...init,
-    headers: mergeHeaders(init.headers, server.authToken)
-  });
-  const text = await response.text();
-  const payload = text.trim().length > 0 ? (() => {
-    try {
-      return JSON.parse(text);
-    } catch {
-      return null;
-    }
-  })() : null;
-  if (!response.ok) {
-    const diagnostics = diagnosticMessage(payload);
-    const detail = diagnostics ?? (text || response.statusText);
-    throw new CliError2(`Rig server request failed (${response.status}): ${detail}`, 1);
-  }
-  return payload;
-}
-
-// packages/cli/src/commands/_preflight.ts
-function preflightCheck(id, label, status, detail, remediation) {
-  return {
-    id,
-    label,
-    status,
-    ...detail ? { detail } : {},
-    ...remediation ? { remediation } : {}
-  };
-}
-function message(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-function isAuthenticated(payload) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
-    return false;
-  const record = payload;
-  return record.signedIn === true || record.authenticated === true || record.status === "authenticated" || record.ok === true && typeof record.login === "string" && record.login.trim().length > 0;
-}
-function taskMatchesId(entry, taskId) {
-  if (!entry || typeof entry !== "object" || Array.isArray(entry))
-    return false;
-  const record = entry;
-  if (record.id === taskId || record.taskId === taskId)
-    return true;
-  const raw = record.raw;
-  if (raw && typeof raw === "object" && !Array.isArray(raw)) {
-    const rawRecord = raw;
-    if (String(rawRecord.number ?? "") === taskId.replace(/^#/, ""))
-      return true;
-  }
-  return false;
-}
-function isActiveRunStatus(status) {
-  const normalized = String(status ?? "running").toLowerCase();
-  return !["completed", "complete", "done", "merged", "closed", "failed", "cancelled", "canceled", "needs_attention", "needs-attention", "stopped"].includes(normalized);
-}
-function permissionAllowsPr(payload) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
-    return null;
-  const record = payload;
-  if (record.canOpenPullRequest === true || record.pullRequests === true || record.push === true || record.maintain === true || record.admin === true)
-    return true;
-  if (record.canOpenPullRequest === false || record.pullRequests === false || record.push === false)
-    return false;
-  const permissions = record.permissions;
-  if (permissions && typeof permissions === "object" && !Array.isArray(permissions)) {
-    const p = permissions;
-    if (p.push === true || p.maintain === true || p.admin === true)
-      return true;
-    if (p.push === false && p.maintain !== true && p.admin !== true)
-      return false;
-  }
-  return null;
-}
-function isNotFoundError(error) {
-  return /\b(404|not found)\b/i.test(message(error));
-}
-function projectCheckoutReady(payload) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
-    return null;
-  const record = payload;
-  if (record.checkoutReady === true || record.ready === true)
-    return true;
-  if (record.checkoutReady === false || record.ready === false)
-    return false;
-  const project = record.project;
-  if (project && typeof project === "object" && !Array.isArray(project)) {
-    const checkouts = project.checkouts;
-    if (Array.isArray(checkouts))
-      return checkouts.length > 0;
-  }
-  return null;
-}
-function activeDuplicateRun(runs, taskId) {
-  if (!Array.isArray(runs))
-    return null;
-  for (const run of runs) {
-    if (!run || typeof run !== "object" || Array.isArray(run))
-      continue;
-    const record = run;
-    if ((record.taskId === taskId || record.task === taskId) && isActiveRunStatus(record.status))
-      return record;
-  }
-  return null;
-}
-async function runFastTaskRunPreflight(context, options = {}) {
-  const checks = [];
-  const request = options.requestJson ?? ((pathname, init) => requestServerJson(context, pathname, init));
-  const taskId = options.taskId?.trim() || null;
-  const requiresCurrentRunApi = Boolean(taskId);
-  const selectedServer = options.requestJson ? null : await ensureServerForCli(context.projectRoot).catch(() => null);
-  const allowLocalLegacyTaskRunCompatibility = selectedServer?.connectionKind === "local";
-  let legacyServerCompatibility = false;
-  try {
-    await request("/api/server/status");
-    checks.push(preflightCheck("server", "Rig server reachable", "pass"));
-  } catch (error) {
-    if (isNotFoundError(error)) {
-      try {
-        await request("/health");
-        legacyServerCompatibility = !requiresCurrentRunApi || allowLocalLegacyTaskRunCompatibility;
-        checks.push(requiresCurrentRunApi && !allowLocalLegacyTaskRunCompatibility ? preflightCheck("server", "Rig server reachable", "fail", "legacy /health endpoint only; current task-run APIs are required", "Upgrade/select the Rig server before launching a task run.") : preflightCheck("server", "Rig server reachable", "pass", allowLocalLegacyTaskRunCompatibility ? "local legacy /health endpoint; submit endpoint will be authoritative" : "legacy /health endpoint"));
-      } catch (healthError) {
-        checks.push(preflightCheck("server", "Rig server reachable", "fail", message(healthError), "Start or select a reachable Rig server."));
-      }
-    } else {
-      checks.push(preflightCheck("server", "Rig server reachable", "fail", message(error), "Start or select a reachable Rig server."));
-    }
-  }
-  const repo = readRepoConnection(context.projectRoot);
-  checks.push(repo ? preflightCheck("project-link", "project linked to Rig connection", repo.project ? "pass" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : ""}`, "Run `rig init --yes --repo owner/repo` to record the GitHub repo slug.") : preflightCheck("project-link", "project linked to Rig connection", legacyServerCompatibility ? "warn" : "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig connect use <alias|local>`."));
-  try {
-    const auth = await request("/api/github/auth/status");
-    checks.push(isAuthenticated(auth) ? preflightCheck("github-auth", "GitHub auth valid", "pass") : preflightCheck("github-auth", "GitHub auth valid", legacyServerCompatibility ? "warn" : "fail", "not authenticated", "Run `rig github auth import-gh` or `rig github auth token --token <token>`."));
-  } catch (error) {
-    checks.push(preflightCheck("github-auth", "GitHub auth valid", legacyServerCompatibility ? "warn" : "fail", message(error), "Fix GitHub auth on the selected Rig server."));
-  }
-  try {
-    const projection = await request("/api/workspace/task-projection");
-    checks.push(preflightCheck("task-projection", "task projection ready", "pass", JSON.stringify(projection).slice(0, 120)));
-  } catch (error) {
-    checks.push(preflightCheck("task-projection", "task projection ready", "warn", message(error), "Refresh task projection with `rig task list` before launching."));
-  }
-  try {
-    const permissions = await request("/api/github/repo/permissions");
-    const allowed = permissionAllowsPr(permissions);
-    checks.push(allowed === false ? preflightCheck("github-repo-permissions", "GitHub PR permissions", "fail", JSON.stringify(permissions).slice(0, 120), "Grant the selected GitHub token permission to push branches and open PRs.") : preflightCheck("github-repo-permissions", "GitHub PR permissions", allowed === true ? "pass" : "warn", JSON.stringify(permissions).slice(0, 120), "Confirm the selected token can push branches and open PRs."));
-  } catch (error) {
-    checks.push(preflightCheck("github-repo-permissions", "GitHub PR permissions", "warn", message(error), "Ensure the selected token can push branches and open PRs."));
-  }
-  if (repo?.project) {
-    try {
-      const project = await request(`/api/projects/${encodeURIComponent(repo.project)}`);
-      const ready = projectCheckoutReady(project);
-      checks.push(ready === false ? preflightCheck("remote-checkout", "execution checkout ready", "fail", JSON.stringify(project).slice(0, 120), "Repair the server checkout or rerun `rig init` with a valid checkout strategy.") : preflightCheck("remote-checkout", "execution checkout ready", ready === true ? "pass" : "warn", JSON.stringify(project).slice(0, 120), "Confirm the selected server has a prepared execution checkout."));
-    } catch (error) {
-      checks.push(preflightCheck("remote-checkout", "execution checkout ready", "warn", message(error), "Run `rig init` or repair the server checkout before launch."));
-    }
-  }
-  if (taskId) {
-    try {
-      const tasks = await request(`/api/workspace/tasks?limit=200&refresh=1`);
-      const found = Array.isArray(tasks) && tasks.some((task) => taskMatchesId(task, taskId));
-      checks.push(found ? preflightCheck("issue", "task/issue accessible", "pass", taskId) : preflightCheck("issue", "task/issue accessible", legacyServerCompatibility ? "warn" : "fail", taskId, "Confirm the issue exists and matches the configured task filters."));
-    } catch (error) {
-      checks.push(preflightCheck("issue", "task/issue accessible", legacyServerCompatibility ? "warn" : "fail", message(error), "Fix the task source before launching a run."));
-    }
-    try {
-      const runs = await request("/api/runs?limit=200");
-      const duplicate = activeDuplicateRun(runs, taskId);
-      checks.push(duplicate ? preflightCheck("duplicate-active-run", "one active run per task", "fail", String(duplicate.runId ?? taskId), "Attach to or stop the existing run before starting another one for this task.") : preflightCheck("duplicate-active-run", "one active run per task", "pass", taskId));
-    } catch (error) {
-      checks.push(preflightCheck("duplicate-active-run", "one active run per task", "warn", message(error), "Could not list active runs; the server will still reject conflicting runs if configured."));
-    }
-  }
-  if ((options.runtimeAdapter ?? "pi") === "pi") {
-    checks.push(preflightCheck("runtime", "worker Pi SDK session daemon", "pass", selectedServer?.connectionKind === "remote" ? "remote worker-owned runtime" : "bundled server-owned runtime"));
-  } else {
-    checks.push(preflightCheck("runtime", "runtime adapter", "pass", options.runtimeAdapter));
-  }
-  const failures = checks.filter((check) => check.status === "fail");
-  if (failures.length > 0) {
-    const summary = failures.map((check) => `${check.label}${check.detail ? `: ${check.detail}` : ""}`).join("; ");
-    if (failures.some((check) => check.id === "duplicate-active-run") && taskId) {
-      throw new CliError2(`Task ${taskId} already has an active Rig run. ${summary}`, 1);
-    }
-    throw new CliError2(`Task run preflight failed: ${summary}`, 1);
-  }
-  return { ok: true, checks };
-}
-async function runProjectMainSyncPreflight(context, options) {
-  if (context.dryRun) {
-    if (context.outputMode === "text" && !options.disabled) {
-      console.log("[dry-run] project-rig pre-run sync check");
-    }
-    return;
-  }
-  const result = await ensureProjectMainFreshBeforeRun({
-    projectRoot: context.projectRoot,
-    disabled: options.disabled,
-    runBootstrap: async () => {
-      const bootstrap = await context.runCommand(["bun", "run", "bootstrap"]);
-      if (bootstrap.exitCode !== 0) {
-        throw new CliError2(bootstrap.stderr || bootstrap.stdout || "bun run bootstrap failed during project pre-run sync", bootstrap.exitCode || 1);
-      }
-    }
-  });
-  if (context.outputMode !== "text") {
-    return;
-  }
-  switch (result.status) {
-    case "disabled":
-      console.log("Project pre-run sync skipped (--skip-project-sync).");
-      break;
-    case "skipped_not_main":
-      console.log(`Project pre-run sync skipped (current branch: ${result.branch}).`);
-      break;
-    case "up_to_date":
-      break;
-    case "local_ahead":
-      console.log(`Project pre-run sync skipped (local main ahead by ${result.localAhead} commit(s)).`);
-      break;
-    case "updated":
-      console.log(`Project pre-run sync updated local main from origin/main (+${result.remoteAhead}) and bootstrapped.`);
-      break;
-  }
-}
-export {
-  runProjectMainSyncPreflight,
-  runFastTaskRunPreflight
-};

package/dist/src/commands/_probes.js

@@ -1,13 +0,0 @@
-// @bun
-// packages/cli/src/commands/_probes.ts
-async function runQuietBinaryProbe(binaryPath, args, cwd) {
-  try {
-    const run = await Bun.$`${binaryPath} ${args}`.cwd(cwd).quiet().nothrow();
-    return run.exitCode === 0;
-  } catch {
-    return false;
-  }
-}
-export {
-  runQuietBinaryProbe
-};