@h-rig/cli 0.0.6-alpha.3 → 0.0.6-alpha.30

package/dist/src/commands/init.js

@@ -3,15 +3,13 @@ var __require = import.meta.require;
 
 // packages/cli/src/commands/init.ts
 import { appendFileSync, existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync } from "child_process";
 import { resolve as resolve6 } from "path";
 
 // packages/cli/src/runner.ts
 import { EventBus } from "@rig/runtime/control-plane/runtime/events";
 import { CliError } from "@rig/runtime/control-plane/errors";
 import { evaluate, loadPolicy, resolveAction } from "@rig/runtime/control-plane/runtime/guard";
-import { PluginManager } from "@rig/runtime/control-plane/runtime/plugins";
-import { loadRuntimeContextFromEnv } from "@rig/runtime/control-plane/runtime/context";
 import { buildBinary } from "@rig/runtime/control-plane/runtime/isolation";
 import { CliError as CliError2 } from "@rig/runtime/control-plane/errors";
 function takeFlag(args, flag) {
@@ -49,6 +47,7 @@ function takeOption(args, option) {
 
 // packages/cli/src/commands/init.ts
 import { buildRigInitConfigSource } from "@rig/core";
+import { listGitHubProjects as listGitHubProjectsDirect, resolveProjectStatusField as resolveProjectStatusFieldDirect } from "@rig/server";
 
 // packages/cli/src/commands/_connection-state.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
@@ -147,23 +146,23 @@ function resolveSelectedConnection(projectRoot, options = {}) {
   const global = readGlobalConnections(options);
   const connection = global.connections[repo.selected];
   if (!connection) {
-    throw new CliError2(`Selected Rig connection "${repo.selected}" was not found. Run \`rig connect list\` or \`rig connect use local\`.`, 1);
+    throw new CliError2(`Selected Rig server "${repo.selected}" was not found. Run \`rig server list\` or \`rig server use local\`.`, 1);
   }
   return { alias: repo.selected, connection };
 }
 
 // packages/cli/src/commands/_server-client.ts
-import { spawnSync } from "child_process";
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { resolve as resolve2 } from "path";
 import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
-var cachedGitHubBearerToken;
+var scopedGitHubBearerTokens = new Map;
 function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
 }
-function setGitHubBearerTokenForCurrentProcess(token) {
-  cachedGitHubBearerToken = cleanToken(token ?? undefined);
+function setGitHubBearerTokenForCurrentProcess(token, projectRoot) {
+  const scopedKey = resolve2(projectRoot ?? process.cwd());
+  scopedGitHubBearerTokens.set(scopedKey, cleanToken(token ?? undefined));
 }
 function readPrivateRemoteSessionToken(projectRoot) {
   const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
@@ -177,25 +176,13 @@ function readPrivateRemoteSessionToken(projectRoot) {
   }
 }
 function readGitHubBearerTokenForRemote(projectRoot) {
-  if (cachedGitHubBearerToken !== undefined)
-    return cachedGitHubBearerToken;
+  const scopedKey = resolve2(projectRoot);
+  if (scopedGitHubBearerTokens.has(scopedKey))
+    return scopedGitHubBearerTokens.get(scopedKey) ?? null;
   const privateSession = readPrivateRemoteSessionToken(projectRoot);
-  if (privateSession) {
-    cachedGitHubBearerToken = privateSession;
-    return cachedGitHubBearerToken;
-  }
-  const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
-  if (envToken) {
-    cachedGitHubBearerToken = envToken;
-    return cachedGitHubBearerToken;
-  }
-  const result = spawnSync("gh", ["auth", "token"], {
-    encoding: "utf8",
-    timeout: 5000,
-    stdio: ["ignore", "pipe", "ignore"]
-  });
-  cachedGitHubBearerToken = result.status === 0 ? cleanToken(result.stdout) : null;
-  return cachedGitHubBearerToken;
+  if (privateSession)
+    return privateSession;
+  return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
 }
 async function ensureServerForCli(projectRoot) {
   try {
@@ -290,16 +277,36 @@ async function registerProjectViaServer(context, input) {
 function sleep(ms) {
   return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
+function isRetryableProjectRootSwitchError(error) {
+  if (!(error instanceof Error))
+    return false;
+  const message = error.message.toLowerCase();
+  return message.includes("rig server request failed (401): auth-required") || message.includes("rig server request failed (401): github-token-required") || message.includes("rig server request failed (502)") || message.includes("rig server request failed (503)") || message.includes("bad gateway") || message.includes("fetch failed") || message.includes("econnrefused") || message.includes("connection refused");
+}
 async function switchServerProjectRootViaServer(context, projectRoot, options = {}) {
-  const switched = await requestServerJson(context, "/api/server/project-root", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ projectRoot })
-  });
   const timeoutMs = options.timeoutMs ?? 30000;
   const pollMs = options.pollMs ?? 1000;
   const deadline = Date.now() + timeoutMs;
   let lastError;
+  let switched = null;
+  while (Date.now() < deadline) {
+    try {
+      switched = await requestServerJson(context, "/api/server/project-root", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ projectRoot })
+      });
+      break;
+    } catch (error) {
+      lastError = error;
+      if (!isRetryableProjectRootSwitchError(error))
+        throw error;
+      await sleep(pollMs);
+    }
+  }
+  if (!switched) {
+    throw new CliError2(`Rig server did not accept project-root switch to ${projectRoot} before timeout (${lastError instanceof Error ? lastError.message : String(lastError ?? "no response")}).`, 1);
+  }
   while (Date.now() < deadline) {
     try {
       const status = await requestServerJson(context, "/api/server/status");
@@ -317,12 +324,27 @@ async function switchServerProjectRootViaServer(context, projectRoot, options =
   }
   throw new CliError2(`Rig server did not switch to ${projectRoot} before timeout (${lastError instanceof Error ? lastError.message : String(lastError ?? "no status")}).`, 1);
 }
+async function ensureTaskLabelsViaServer(context) {
+  const payload = await requestServerJson(context, "/api/workspace/task-labels", { method: "POST" });
+  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
+}
+async function listGitHubProjectsViaServer(context, owner) {
+  const url = new URL("http://rig.local/api/github/projects");
+  url.searchParams.set("owner", owner);
+  const payload = await requestServerJson(context, `${url.pathname}${url.search}`);
+  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : { projects: [] };
+}
+async function getGitHubProjectStatusFieldViaServer(context, projectId) {
+  const payload = await requestServerJson(context, `/api/github/projects/${encodeURIComponent(projectId)}/status-field`);
+  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
+}
 
 // packages/cli/src/commands/_pi-install.ts
 import { existsSync as existsSync3, readFileSync as readFileSync3, rmSync } from "fs";
 import { homedir as homedir2 } from "os";
 import { resolve as resolve3 } from "path";
-var PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
+var PI_RIG_PACKAGE_NAME = "@h-rig/pi-rig";
+var LEGACY_PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
 var LEGACY_PI_RIG_MARKER = `// Managed by Rig. Source package: @rig/pi-rig.
 export { default } from '@rig/pi-rig';
 `;
@@ -350,7 +372,7 @@ function resolvePiHomeDir(inputHomeDir) {
 function piListContainsPiRig(output) {
   return output.split(/\r?\n/).some((line) => {
     const normalized = line.trim();
-    return normalized.includes(PI_RIG_PACKAGE_NAME) || /(?:^|[\\/])packages[\\/]pi-rig(?:$|\s)/.test(normalized);
+    return normalized.includes(PI_RIG_PACKAGE_NAME) || normalized.includes(LEGACY_PI_RIG_PACKAGE_NAME) || /(?:^|[\\/])packages[\\/]pi-rig(?:$|\s)/.test(normalized);
   });
 }
 async function safeRun(runner, command, options) {
@@ -466,7 +488,7 @@ async function ensureRemotePiRigInstalled(input) {
   const payload = await input.requestJson("/api/pi-rig/install", {
     method: "POST",
     headers: { "content-type": "application/json" },
-    body: JSON.stringify({ package: "@rig/pi-rig", scope: "global" })
+    body: JSON.stringify({ package: PI_RIG_PACKAGE_NAME, scope: "global" })
   });
   const record = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
   const piOk = record.piOk === true || record.ok === true;
@@ -727,7 +749,7 @@ async function runRigDoctorChecks(options) {
   const taskSourceKind = config?.taskSource?.kind;
   checks.push(taskSourceKind ? check("task-source", "task source configured", "pass", taskSourceKind) : check("task-source", "task source configured", "fail", "missing taskSource", "Configure taskSource in rig.config.ts."));
   const repo = readRepoConnection(projectRoot);
-  checks.push(repo ? check("project-link", "repo selected Rig connection", repo.project ? "pass" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : ""}`, "Run `rig init --yes --repo owner/repo` to link this checkout to a GitHub repo slug.") : check("project-link", "repo selected Rig connection", "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig connect use <alias|local>`."));
+  checks.push(repo ? check("project-link", "repo selected Rig server", repo.project ? "pass" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : ""}`, "Run `rig init --yes --repo owner/repo` to link this checkout to a GitHub repo slug.") : check("project-link", "repo selected Rig server", "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig server use <alias|local>`."));
   const selected = (() => {
     try {
       return resolveSelectedConnection(projectRoot);
@@ -735,7 +757,7 @@ async function runRigDoctorChecks(options) {
       return null;
     }
   })();
-  checks.push(selected ? check("connection", "selected server connection", "pass", selected.connection.kind === "remote" ? selected.connection.baseUrl : "local auto") : check("connection", "selected server connection", repo ? "fail" : "warn", repo ? "selected alias is missing" : "will auto-start local server", repo ? "Run `rig connect list` and `rig connect use <alias|local>`." : undefined));
+  checks.push(selected ? check("connection", "selected server connection", "pass", selected.connection.kind === "remote" ? selected.connection.baseUrl : "local auto") : check("connection", "selected server", repo ? "fail" : "warn", repo ? "selected alias is missing" : "will auto-start local server", repo ? "Run `rig server list` and `rig server use <alias|local>`." : undefined));
   let server = null;
   try {
     server = await (options.resolveServer ?? ensureServerForCli)(projectRoot);
@@ -809,6 +831,7 @@ function countDoctorFailures(checks) {
 
 // packages/cli/src/commands/init.ts
 var RIG_CONFIG_PACKAGE_DIST_TAG = "latest";
+var DEFAULT_REMOTE_RIG_URL = "https://where.rig-does.work";
 var RIG_CONFIG_DEV_DEPENDENCIES = {
   "@rig/core": `npm:@h-rig/core@${RIG_CONFIG_PACKAGE_DIST_TAG}`,
   "@rig/standard-plugin": `npm:@h-rig/standard-plugin@${RIG_CONFIG_PACKAGE_DIST_TAG}`
@@ -819,7 +842,7 @@ function parseRepoSlugFromRemote(remoteUrl) {
   return gitHubMatch ? `${gitHubMatch[1]}/${gitHubMatch[2]}` : null;
 }
 function detectOriginRepoSlug(projectRoot) {
-  const result = spawnSync2("git", ["-C", projectRoot, "remote", "get-url", "origin"], { encoding: "utf8" });
+  const result = spawnSync("git", ["-C", projectRoot, "remote", "get-url", "origin"], { encoding: "utf8" });
   if (result.status !== 0)
     return null;
   return parseRepoSlugFromRemote(result.stdout.trim());
@@ -875,11 +898,14 @@ function applyGitHubProjectConfig(source, options) {
     return source;
   const projectId = JSON.stringify(options.githubProject);
   const statusFieldId = JSON.stringify(options.githubProjectStatusField ?? "Status");
+  const statuses = options.githubProjectStatuses && Object.keys(options.githubProjectStatuses).length > 0 ? `
+      statuses: ${JSON.stringify(options.githubProjectStatuses, null, 8).replace(/\n/g, `
+      `)},` : "";
   return source.replace(`    projects: { enabled: false },`, [
     `    projects: {`,
     `      enabled: true,`,
     `      projectId: ${projectId},`,
-    `      statusFieldId: ${statusFieldId},`,
+    `      statusFieldId: ${statusFieldId},${statuses}`,
     `    },`
   ].join(`
 `));
@@ -900,21 +926,41 @@ function checkoutForInit(projectRoot, serverKind, strategy) {
   }
 }
 function detectGhLogin() {
-  const result = spawnSync2("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8", timeout: 5000, stdio: ["ignore", "pipe", "ignore"] });
+  const result = spawnSync("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8", timeout: 5000, stdio: ["ignore", "pipe", "ignore"] });
   return result.status === 0 && result.stdout.trim() ? result.stdout.trim() : null;
 }
 function readGhAuthToken() {
-  const result = spawnSync2("gh", ["auth", "token"], { encoding: "utf8" });
+  const result = spawnSync("gh", ["auth", "token"], { encoding: "utf8" });
   if (result.status !== 0 || !result.stdout.trim()) {
     throw new CliError2(result.stderr.trim() || "Could not read GitHub token from `gh auth token`.", result.status || 1);
   }
   return result.stdout.trim();
 }
+function refreshGhProjectScopesAndReadToken() {
+  const result = spawnSync("gh", ["auth", "refresh", "--scopes", "read:project"], {
+    encoding: "utf8",
+    stdio: ["inherit", "pipe", "pipe"]
+  });
+  if (result.status !== 0)
+    return null;
+  try {
+    return readGhAuthToken();
+  } catch {
+    return null;
+  }
+}
 async function loadClackPrompts() {
   return await import("@clack/prompts");
 }
+function clackTextOptions(options) {
+  return {
+    message: options.message,
+    ...options.placeholder ? { placeholder: options.placeholder } : {},
+    ...(options.initialValue ?? options.defaultValue)?.trim() ? { initialValue: (options.initialValue ?? options.defaultValue).trim() } : {}
+  };
+}
 async function promptRequiredText(prompts, options) {
-  const value = await prompts.text(options);
+  const value = await prompts.text(clackTextOptions(options));
   if (prompts.isCancel(value))
     throw new CliError2("Init cancelled.", 1);
   const text = String(value ?? "").trim();
@@ -923,7 +969,7 @@ async function promptRequiredText(prompts, options) {
   return text;
 }
 async function promptOptionalText(prompts, options) {
-  const value = await prompts.text(options);
+  const value = await prompts.text(clackTextOptions(options));
   if (prompts.isCancel(value))
     throw new CliError2("Init cancelled.", 1);
   return String(value ?? "").trim();
@@ -934,6 +980,164 @@ async function promptSelect(prompts, options) {
     throw new CliError2("Init cancelled.", 1);
   return String(value);
 }
+function repoOwnerFromSlug(repoSlug) {
+  return repoSlug.trim().match(/^([^/]+)\/[^/]+$/)?.[1] ?? null;
+}
+function recordArray(value, key) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return [];
+  const raw = value[key];
+  return Array.isArray(raw) ? raw.filter((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry))) : [];
+}
+async function listGitHubProjectsForInit(context, owner, token) {
+  if (token?.trim()) {
+    try {
+      return { ok: true, projects: await listGitHubProjectsDirect({ owner, token: token.trim() }) };
+    } catch (directError) {
+      const serverPayload = await listGitHubProjectsViaServer(context, owner).catch(() => null);
+      if (recordArray(serverPayload, "projects").length > 0)
+        return serverPayload;
+      return { ok: false, error: directError instanceof Error ? directError.message : String(directError), projects: [] };
+    }
+  }
+  return listGitHubProjectsViaServer(context, owner);
+}
+async function getGitHubProjectStatusFieldForInit(context, projectId, token) {
+  if (token?.trim()) {
+    try {
+      return { ok: true, field: await resolveProjectStatusFieldDirect({ projectId, token: token.trim() }) };
+    } catch (directError) {
+      const serverPayload = await getGitHubProjectStatusFieldViaServer(context, projectId).catch(() => null);
+      if (serverPayload && typeof serverPayload === "object" && !Array.isArray(serverPayload) && "field" in serverPayload) {
+        return serverPayload;
+      }
+      return { ok: false, error: directError instanceof Error ? directError.message : String(directError) };
+    }
+  }
+  return getGitHubProjectStatusFieldViaServer(context, projectId);
+}
+var PROJECT_STATUS_PROMPTS = {
+  running: "Running/In progress",
+  prOpen: "PR open/review",
+  ciFixing: "CI/review fixing",
+  merging: "Merging",
+  done: "Done",
+  needsAttention: "Needs attention"
+};
+var DEFAULT_PROJECT_STATUS_OPTIONS = {
+  running: "In Progress",
+  prOpen: "In Review",
+  ciFixing: "In Review",
+  merging: "Merging",
+  done: "Done",
+  needsAttention: "Needs Attention"
+};
+async function promptManualProjectStatusMapping(prompts) {
+  const statuses = {};
+  for (const [key, label] of Object.entries(PROJECT_STATUS_PROMPTS)) {
+    const defaultLabel = DEFAULT_PROJECT_STATUS_OPTIONS[key] ?? label;
+    const value = await promptOptionalText(prompts, {
+      message: `Project status option id/name for ${label} (blank for ${defaultLabel})`,
+      placeholder: defaultLabel
+    });
+    statuses[key] = value || defaultLabel;
+  }
+  return statuses;
+}
+function projectScopeError(value) {
+  const text = typeof value === "string" ? value : JSON.stringify(value ?? "");
+  return /INSUFFICIENT_SCOPES|read:project|required scopes/i.test(text);
+}
+function optionName(option) {
+  return String(option.name ?? option.label ?? option.id ?? "").trim();
+}
+function autoProjectStatusValue(options, key, label) {
+  const candidates = [DEFAULT_PROJECT_STATUS_OPTIONS[key], label].filter((value) => Boolean(value)).map((value) => value.trim().toLowerCase());
+  const match = options.find((option) => candidates.includes(optionName(option).toLowerCase()));
+  if (!match)
+    return null;
+  return String(match.id ?? match.name);
+}
+async function promptGitHubProjectConfig(context, prompts, repoSlug, githubToken, refreshProjectToken) {
+  const projectChoice = await promptSelect(prompts, {
+    message: "GitHub Projects status sync",
+    initialValue: "select",
+    options: [
+      { value: "select", label: "Select accessible ProjectV2" },
+      { value: "off", label: "Off" },
+      { value: "manual", label: "Enter ProjectV2 ids manually" }
+    ]
+  });
+  if (projectChoice === "off")
+    return { githubProject: "off" };
+  if (projectChoice === "manual") {
+    return {
+      githubProject: await promptRequiredText(prompts, { message: "GitHub ProjectV2 id", placeholder: "PVT_..." }),
+      githubProjectStatusField: await promptRequiredText(prompts, { message: "Project Status field id", placeholder: "field_status" }),
+      githubProjectStatuses: await promptManualProjectStatusMapping(prompts)
+    };
+  }
+  const owner = repoOwnerFromSlug(repoSlug);
+  if (!owner)
+    throw new CliError2(`Cannot derive GitHub owner from repo slug ${repoSlug}.`, 1);
+  let activeToken = githubToken?.trim() || null;
+  let projectsPayload = await listGitHubProjectsForInit(context, owner, activeToken).catch((error) => ({ ok: false, error: error instanceof Error ? error.message : String(error), projects: [] }));
+  let projects = recordArray(projectsPayload, "projects");
+  if (projects.length === 0 && projectScopeError(projectsPayload.error) && refreshProjectToken) {
+    prompts.outro?.("GitHub token is missing read:project; refreshing gh auth scopes and retrying Projects.");
+    const refreshedToken = refreshProjectToken();
+    if (refreshedToken) {
+      activeToken = refreshedToken;
+      projectsPayload = await listGitHubProjectsForInit(context, owner, activeToken).catch((error) => ({ ok: false, error: error instanceof Error ? error.message : String(error), projects: [] }));
+      projects = recordArray(projectsPayload, "projects");
+    }
+  }
+  if (projects.length === 0) {
+    const error = typeof projectsPayload.error === "string" ? ` (${String(projectsPayload.error).replace(/\s+/g, " ").slice(0, 240)})` : "";
+    prompts.outro?.(`No accessible GitHub Projects were returned${error}; continuing with GitHub Projects status sync off.`);
+    return { githubProject: "off", ...activeToken ? { githubToken: activeToken } : {} };
+  }
+  const selectedProjectId = await promptSelect(prompts, {
+    message: "GitHub ProjectV2 project",
+    options: [
+      ...projects.map((project) => ({
+        value: String(project.id),
+        label: `${String(project.title ?? "Untitled project")} (#${String(project.number ?? "?")})`,
+        hint: typeof project.url === "string" ? project.url : undefined
+      })),
+      { value: "manual", label: "Enter ProjectV2 id manually" }
+    ]
+  });
+  const projectId = selectedProjectId === "manual" ? await promptRequiredText(prompts, { message: "GitHub ProjectV2 id", placeholder: "PVT_..." }) : selectedProjectId;
+  const fieldPayload = await getGitHubProjectStatusFieldForInit(context, projectId, activeToken).catch((error) => ({ ok: false, error: error instanceof Error ? error.message : String(error) }));
+  const fieldPayloadRecord = fieldPayload && typeof fieldPayload === "object" && !Array.isArray(fieldPayload) ? fieldPayload : {};
+  const rawField = fieldPayloadRecord.field;
+  const field = rawField && typeof rawField === "object" && !Array.isArray(rawField) ? rawField : null;
+  const fieldId = typeof field?.id === "string" && field.id.trim() ? field.id : await promptRequiredText(prompts, { message: "Project Status field id", placeholder: "field_status" });
+  const options = Array.isArray(field?.options) ? field.options.filter((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry))) : [];
+  if (options.length === 0) {
+    return {
+      githubProject: projectId,
+      githubProjectStatusField: fieldId,
+      githubProjectStatuses: await promptManualProjectStatusMapping(prompts),
+      ...activeToken ? { githubToken: activeToken } : {}
+    };
+  }
+  const statuses = {};
+  for (const [key, label] of Object.entries(PROJECT_STATUS_PROMPTS)) {
+    const auto = autoProjectStatusValue(options, key, label);
+    statuses[key] = auto ?? await promptSelect(prompts, {
+      message: `Project status option for ${label}`,
+      options: options.map((option) => ({ value: String(option.id ?? option.name), label: optionName(option) }))
+    });
+  }
+  return {
+    githubProject: projectId,
+    githubProjectStatusField: fieldId,
+    githubProjectStatuses: Object.keys(statuses).length > 0 ? statuses : undefined,
+    ...activeToken ? { githubToken: activeToken } : {}
+  };
+}
 function sleep2(ms) {
   return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
@@ -947,12 +1151,29 @@ function apiSessionTokenFrom(payload) {
   const token = payload.apiSessionToken;
   return typeof token === "string" && token.trim() ? token.trim() : null;
 }
+function cleanPayloadString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function remoteGitHubAuthMetadata(payload) {
+  if (!payload)
+    return {};
+  const userNamespace = payload.userNamespace && typeof payload.userNamespace === "object" && !Array.isArray(payload.userNamespace) ? payload.userNamespace : null;
+  return {
+    ...cleanPayloadString(payload.login) ? { login: cleanPayloadString(payload.login) } : {},
+    ...cleanPayloadString(payload.userId) ? { userId: cleanPayloadString(payload.userId) } : {},
+    ...cleanPayloadString(userNamespace?.key) ? { userNamespaceKey: cleanPayloadString(userNamespace?.key) } : {},
+    ...cleanPayloadString(userNamespace?.root) ? { userNamespaceRoot: cleanPayloadString(userNamespace?.root) } : {},
+    ...cleanPayloadString(userNamespace?.checkoutBaseDir) ? { checkoutBaseDir: cleanPayloadString(userNamespace?.checkoutBaseDir) } : {},
+    ...cleanPayloadString(userNamespace?.snapshotBaseDir) ? { snapshotBaseDir: cleanPayloadString(userNamespace?.snapshotBaseDir) } : {}
+  };
+}
 function writeRemoteGitHubAuthState(projectRoot, input) {
   writeFileSync2(resolve6(projectRoot, ".rig", "state", "github-auth.json"), `${JSON.stringify({
     authenticated: true,
     source: input.source,
     storedOnServer: true,
     selectedRepo: input.selectedRepo,
+    ...remoteGitHubAuthMetadata(input.authPayload ?? null),
     ...input.apiSessionToken ? { apiSessionToken: input.apiSessionToken } : {},
     updatedAt: new Date().toISOString()
   }, null, 2)}
@@ -1045,12 +1266,13 @@ async function runControlPlaneInit(context, options) {
   if (token) {
     githubAuth = await postGitHubTokenViaServer(context, token, { selectedRepo: repo.slug });
     const apiSessionToken = apiSessionTokenFrom(githubAuth);
-    setGitHubBearerTokenForCurrentProcess(apiSessionToken ?? token);
+    setGitHubBearerTokenForCurrentProcess(apiSessionToken ?? token, projectRoot);
     if (serverKind === "remote") {
       writeRemoteGitHubAuthState(projectRoot, {
         source: authMethod === "gh" ? "gh" : "init-token",
         selectedRepo: repo.slug,
-        apiSessionToken
+        apiSessionToken,
+        authPayload: githubAuth
       });
     }
   } else if (authMethod === "device") {
@@ -1069,9 +1291,9 @@ async function runControlPlaneInit(context, options) {
     if (completed) {
       const apiSessionToken = apiSessionTokenFrom(completed);
       if (apiSessionToken) {
-        setGitHubBearerTokenForCurrentProcess(apiSessionToken);
+        setGitHubBearerTokenForCurrentProcess(apiSessionToken, projectRoot);
         if (serverKind === "remote") {
-          writeRemoteGitHubAuthState(projectRoot, { source: "device", selectedRepo: repo.slug, apiSessionToken });
+          writeRemoteGitHubAuthState(projectRoot, { source: "device", selectedRepo: repo.slug, apiSessionToken, authPayload: completed });
         }
       }
       deviceAuth = { ...deviceAuth, poll: completed, completed: completed.status === "signed-in" };
@@ -1089,19 +1311,25 @@ async function runControlPlaneInit(context, options) {
       Object.assign(checkout, preparedCheckout);
     }
   }
+  const checkoutPath = typeof checkout.path === "string" ? checkout.path : null;
+  if (serverKind === "remote" && checkoutPath && token) {
+    githubAuth = await postGitHubTokenViaServer(context, token, { selectedRepo: repo.slug, projectRoot: checkoutPath });
+    const apiSessionToken = apiSessionTokenFrom(githubAuth);
+    setGitHubBearerTokenForCurrentProcess(apiSessionToken ?? token, projectRoot);
+    writeRemoteGitHubAuthState(projectRoot, { source: authMethod === "gh" ? "gh" : "init-token", selectedRepo: repo.slug, apiSessionToken, authPayload: githubAuth });
+  }
   const registered = await registerProjectViaServer(context, {
     repoSlug: repo.slug,
     checkout
   });
-  const checkoutPath = typeof checkout.path === "string" ? checkout.path : null;
   const serverRootSwitch = serverKind === "remote" && checkoutPath ? await switchServerProjectRootViaServer(context, checkoutPath) : null;
-  if (serverRootSwitch && token) {
-    githubAuth = await postGitHubTokenViaServer(context, token, { selectedRepo: repo.slug, projectRoot: checkoutPath ?? undefined });
-    const apiSessionToken = apiSessionTokenFrom(githubAuth);
-    setGitHubBearerTokenForCurrentProcess(apiSessionToken ?? token);
-    writeRemoteGitHubAuthState(projectRoot, { source: authMethod === "gh" ? "gh" : "init-token", selectedRepo: repo.slug, apiSessionToken });
-  }
   const activeProjectRegistration = serverRootSwitch ? await registerProjectViaServer(context, { repoSlug: repo.slug, checkout }) : null;
+  const labelSetup = await ensureTaskLabelsViaServer(context).catch((error) => ({
+    ok: false,
+    ready: false,
+    labelsReady: false,
+    error: error instanceof Error ? error.message : String(error)
+  }));
   const pi = serverKind === "remote" ? await ensureRemotePiRigInstalled({ requestJson: (pathname, init) => requestServerJson(context, pathname, init) }).catch((error) => ({
     remote: true,
     pi: { ok: false, label: "pi", hint: error instanceof Error ? error.message : String(error) },
@@ -1132,6 +1360,7 @@ async function runControlPlaneInit(context, options) {
     githubAuth,
     deviceAuth,
     githubAuthWarning: remoteGhTokenWarning,
+    labelSetup,
     pi,
     doctor
   };
@@ -1238,12 +1467,13 @@ async function runInteractiveControlPlaneInit(context, prompts) {
   });
   const serverChoice = await promptSelect(prompts, {
     message: "Rig server",
+    initialValue: "remote",
     options: [
-      { value: "local", label: "Local server", hint: "run on this machine" },
-      { value: "remote", label: "Remote server", hint: "connect to an HTTPS Rig server" }
+      { value: "remote", label: "Remote server", hint: "connect to an HTTPS Rig server" },
+      { value: "local", label: "Local server", hint: "run on this machine" }
     ]
   });
-  const remoteUrl = serverChoice === "remote" ? await promptRequiredText(prompts, { message: "Remote Rig server URL", placeholder: "https://rig.example.com" }) : undefined;
+  const remoteUrl = serverChoice === "remote" ? await promptRequiredText(prompts, { message: "Remote Rig server URL", placeholder: DEFAULT_REMOTE_RIG_URL, initialValue: DEFAULT_REMOTE_RIG_URL }) : undefined;
   let remoteCheckout;
   if (serverChoice === "remote") {
     const checkout = await promptSelect(prompts, {
@@ -1275,38 +1505,35 @@ async function runInteractiveControlPlaneInit(context, prompts) {
       { value: "skip", label: "Skip for now" }
     ]
   });
+  let remoteGhTokenConfirmed = false;
   if (serverChoice === "remote" && authMethod === "gh") {
     if (!prompts.confirm)
       throw new CliError2("Remote gh-token import requires explicit confirmation.", 1);
     const confirmed = await prompts.confirm({
       message: `This sends a GitHub token from this machine to ${remoteUrl}. Continue?`,
-      initialValue: false
+      initialValue: true
     });
     if (prompts.isCancel(confirmed) || confirmed !== true) {
       throw new CliError2("Remote gh-token import cancelled.", 1);
     }
+    remoteGhTokenConfirmed = true;
   }
-  const githubToken = authMethod === "token" ? await promptRequiredText(prompts, { message: "GitHub token", placeholder: "ghp_..." }) : undefined;
-  const projectChoice = await promptSelect(prompts, {
-    message: "GitHub Projects status sync",
-    options: [
-      { value: "off", label: "Off" },
-      { value: "configure", label: "Configure ProjectV2 status field" }
-    ]
-  });
-  const githubProject = projectChoice === "configure" ? await promptRequiredText(prompts, { message: "GitHub ProjectV2 id", placeholder: "PVT_..." }) : "off";
-  const githubProjectStatusField = projectChoice === "configure" ? await promptRequiredText(prompts, { message: "Project Status field id", placeholder: "field_status" }) : undefined;
+  const githubToken = authMethod === "token" ? await promptRequiredText(prompts, { message: "GitHub token", placeholder: "ghp_..." }) : authMethod === "gh" ? readGhAuthToken() : undefined;
+  const projectConfig = await promptGitHubProjectConfig(context, prompts, repoSlug, githubToken, authMethod === "gh" ? refreshGhProjectScopesAndReadToken : undefined);
+  const effectiveGithubToken = projectConfig.githubToken ?? githubToken;
   const result = await runControlPlaneInit(context, {
     server: serverChoice,
     remoteUrl,
     repoSlug,
-    githubToken,
+    githubToken: effectiveGithubToken,
     githubAuthMethod: authMethod,
-    githubProject,
-    githubProjectStatusField,
+    githubProject: projectConfig.githubProject,
+    githubProjectStatusField: projectConfig.githubProjectStatusField,
+    githubProjectStatuses: projectConfig.githubProjectStatuses,
     remoteCheckout,
     repair,
-    privateStateOnly
+    privateStateOnly,
+    yes: remoteGhTokenConfirmed || undefined
   });
   const details = result.details && typeof result.details === "object" && !Array.isArray(result.details) ? result.details : {};
   const deviceAuth = details.deviceAuth && typeof details.deviceAuth === "object" && !Array.isArray(details.deviceAuth) ? details.deviceAuth : null;