@h-rig/cli 0.0.6-alpha.34 → 0.0.6-alpha.35

package/dist/bin/rig.js

@@ -531,9 +531,9 @@ import { loadPolicy as loadPolicy3 } from "@rig/runtime/control-plane/runtime/gu
 // packages/cli/src/commands.ts
 init_runner();
 import {
-  existsSync as existsSync15
+  existsSync as existsSync16
 } from "fs";
-import { resolve as resolve24 } from "path";
+import { resolve as resolve25 } from "path";
 import { readBuildConfig } from "@rig/runtime/build-time-config";
 
 // packages/cli/src/commands/browser.ts
@@ -2644,6 +2644,157 @@ async function executeHarness(context, args) {
 // packages/cli/src/commands.ts
 init_plugin();
 
+// packages/cli/src/commands/pi.ts
+init_runner();
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname, resolve as resolve9 } from "path";
+function settingsPath(root) {
+  return resolve9(root, ".pi", "settings.json");
+}
+function userSettingsPath() {
+  return resolve9(homedir2(), ".pi", "agent", "settings.json");
+}
+function readJson(path, fallback) {
+  if (!existsSync5(path))
+    return fallback;
+  try {
+    return JSON.parse(readFileSync2(path, "utf-8"));
+  } catch {
+    return fallback;
+  }
+}
+function packageKey(entry) {
+  if (typeof entry === "string")
+    return entry;
+  if (entry && typeof entry === "object" && typeof entry.source === "string") {
+    return entry.source;
+  }
+  return JSON.stringify(entry);
+}
+function writeSettings(path, settings) {
+  mkdirSync5(dirname(path), { recursive: true });
+  writeFileSync3(path, `${JSON.stringify(settings, null, 2)}
+`, "utf-8");
+}
+async function searchNpmForPiExtensions(term) {
+  const query = encodeURIComponent(term ? `${term} pi extension` : "pi extension");
+  const url = `https://registry.npmjs.org/-/v1/search?text=${query}&size=20`;
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new CliError2(`npm registry search failed (${response.status}).`, 2);
+  }
+  const payload = await response.json();
+  const results = [];
+  for (const entry of payload.objects ?? []) {
+    const pkg = entry.package;
+    if (!pkg?.name)
+      continue;
+    const keywords = (pkg.keywords ?? []).map((k) => k.toLowerCase());
+    const piLike = pkg.name.startsWith("pi-") || pkg.name.includes("-pi") || keywords.includes("pi") || keywords.includes("pi-extension") || (pkg.description ?? "").toLowerCase().includes("pi extension") || (pkg.description ?? "").toLowerCase().includes("pi coding agent");
+    if (!piLike)
+      continue;
+    results.push({ name: pkg.name, version: pkg.version ?? "", description: pkg.description ?? "" });
+  }
+  return results;
+}
+async function executePi(context, args) {
+  const [command = "list", ...rest] = args;
+  const projectSettingsPath = settingsPath(context.projectRoot);
+  const managedRecordPath = resolve9(context.projectRoot, ".rig", "state", "pi-managed-packages.json");
+  switch (command) {
+    case "list": {
+      requireNoExtraArgs(rest, "rig pi list");
+      const project = readJson(projectSettingsPath, {});
+      const managed = new Set(readJson(managedRecordPath, []));
+      const user = readJson(userSettingsPath(), {});
+      const projectPackages = (Array.isArray(project.packages) ? project.packages : []).map((entry) => ({
+        source: packageKey(entry),
+        managedByRigConfig: managed.has(packageKey(entry))
+      }));
+      const userPackages = (Array.isArray(user.packages) ? user.packages : []).map(packageKey);
+      if (context.outputMode === "text") {
+        console.log("Project Pi packages (.pi/settings.json):");
+        if (projectPackages.length === 0)
+          console.log("  (none)");
+        for (const pkg of projectPackages) {
+          console.log(`  ${pkg.source}${pkg.managedByRigConfig ? "  [from rig.config runtime.pi.packages]" : ""}`);
+        }
+        console.log("User Pi packages (~/.pi/agent/settings.json):");
+        if (userPackages.length === 0)
+          console.log("  (none)");
+        for (const pkg of userPackages)
+          console.log(`  ${pkg}`);
+        console.log("Add more: `rig pi add <npm-package>` \xB7 discover: `rig pi search <term>`");
+      }
+      return { ok: true, group: "pi", command, details: { projectPackages, userPackages } };
+    }
+    case "add": {
+      const [source, ...extra] = rest;
+      requireNoExtraArgs(extra, "rig pi add <package-source>");
+      if (!source) {
+        throw new CliError2("Usage: rig pi add <package-source> (npm name, name@version, or git URL)", 2);
+      }
+      const settings = readJson(projectSettingsPath, {});
+      const packages = Array.isArray(settings.packages) ? settings.packages : [];
+      if (packages.some((entry) => packageKey(entry) === source)) {
+        throw new CliError2(`"${source}" is already in ${projectSettingsPath}.`, 2);
+      }
+      writeSettings(projectSettingsPath, { ...settings, packages: [...packages, source] });
+      if (context.outputMode === "text") {
+        console.log(`Added ${source} to ${projectSettingsPath}.`);
+        console.log("Pi installs missing packages automatically at the next session start (local and worker).");
+      }
+      return { ok: true, group: "pi", command, details: { source, settingsPath: projectSettingsPath } };
+    }
+    case "remove": {
+      const [source, ...extra] = rest;
+      requireNoExtraArgs(extra, "rig pi remove <package-source>");
+      if (!source) {
+        throw new CliError2("Usage: rig pi remove <package-source>", 2);
+      }
+      const managed = new Set(readJson(managedRecordPath, []));
+      if (managed.has(source)) {
+        throw new CliError2(`"${source}" is managed by rig.config.ts (runtime.pi.packages); remove it there instead.`, 2);
+      }
+      const settings = readJson(projectSettingsPath, {});
+      const packages = Array.isArray(settings.packages) ? settings.packages : [];
+      const next = packages.filter((entry) => packageKey(entry) !== source);
+      if (next.length === packages.length) {
+        throw new CliError2(`"${source}" is not in ${projectSettingsPath}.`, 2);
+      }
+      const nextSettings = { ...settings };
+      if (next.length > 0)
+        nextSettings.packages = next;
+      else
+        delete nextSettings.packages;
+      writeSettings(projectSettingsPath, nextSettings);
+      if (context.outputMode === "text") {
+        console.log(`Removed ${source} from ${projectSettingsPath}.`);
+      }
+      return { ok: true, group: "pi", command, details: { source } };
+    }
+    case "search": {
+      const term = rest.join(" ").trim();
+      const results = await searchNpmForPiExtensions(term);
+      if (context.outputMode === "text") {
+        if (results.length === 0) {
+          console.log(`No Pi extension packages found on npm${term ? ` for "${term}"` : ""}.`);
+        } else {
+          console.log(`Pi extension packages on npm${term ? ` matching "${term}"` : ""}:`);
+          for (const pkg of results) {
+            console.log(`  ${pkg.name}@${pkg.version}  ${pkg.description.slice(0, 80)}`);
+          }
+          console.log("Install one: `rig pi add <name>`");
+        }
+      }
+      return { ok: true, group: "pi", command, details: { term, results } };
+    }
+    default:
+      throw new CliError2(`Unknown pi command: ${command}. Use list|add|remove|search.`);
+  }
+}
+
 // packages/cli/src/commands/queue.ts
 init_runner();
 init__parsers();
@@ -2655,33 +2806,33 @@ import { ensureProjectMainFreshBeforeRun } from "@rig/runtime/control-plane/proj
 
 // packages/cli/src/commands/_connection-state.ts
 init_runner();
-import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname, resolve as resolve9 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname2, resolve as resolve10 } from "path";
 function resolveGlobalConnectionsPath(env = process.env) {
   const explicit = env.RIG_CONNECTIONS_FILE?.trim();
   if (explicit)
-    return resolve9(explicit);
+    return resolve10(explicit);
   const stateDir = env.RIG_GLOBAL_STATE_DIR?.trim();
   if (stateDir)
-    return resolve9(stateDir, "connections.json");
-  return resolve9(homedir2(), ".rig", "connections.json");
+    return resolve10(stateDir, "connections.json");
+  return resolve10(homedir3(), ".rig", "connections.json");
 }
 function resolveRepoConnectionPath(projectRoot) {
-  return resolve9(projectRoot, ".rig", "state", "connection.json");
+  return resolve10(projectRoot, ".rig", "state", "connection.json");
 }
 function readJsonFile2(path) {
-  if (!existsSync5(path))
+  if (!existsSync6(path))
     return null;
   try {
-    return JSON.parse(readFileSync2(path, "utf8"));
+    return JSON.parse(readFileSync3(path, "utf8"));
   } catch (error) {
     throw new CliError2(`Invalid Rig connection state at ${path}: ${error instanceof Error ? error.message : String(error)}`, 1);
   }
 }
 function writeJsonFile2(path, value) {
-  mkdirSync5(dirname(path), { recursive: true });
-  writeFileSync3(path, `${JSON.stringify(value, null, 2)}
+  mkdirSync6(dirname2(path), { recursive: true });
+  writeFileSync4(path, `${JSON.stringify(value, null, 2)}
 `, "utf8");
 }
 function normalizeConnection(value) {
@@ -2758,8 +2909,8 @@ function resolveSelectedConnection(projectRoot, options = {}) {
 
 // packages/cli/src/commands/_server-client.ts
 init_runner();
-import { existsSync as existsSync6, readFileSync as readFileSync3 } from "fs";
-import { resolve as resolve10 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync4 } from "fs";
+import { resolve as resolve11 } from "path";
 import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
 var scopedGitHubBearerTokens = new Map;
 function cleanToken(value) {
@@ -2767,22 +2918,22 @@ function cleanToken(value) {
   return trimmed ? trimmed : null;
 }
 function setGitHubBearerTokenForCurrentProcess(token, projectRoot) {
-  const scopedKey = resolve10(projectRoot ?? process.cwd());
+  const scopedKey = resolve11(projectRoot ?? process.cwd());
   scopedGitHubBearerTokens.set(scopedKey, cleanToken(token ?? undefined));
 }
 function readPrivateRemoteSessionToken(projectRoot) {
-  const path = resolve10(projectRoot, ".rig", "state", "github-auth.json");
-  if (!existsSync6(path))
+  const path = resolve11(projectRoot, ".rig", "state", "github-auth.json");
+  if (!existsSync7(path))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync3(path, "utf8"));
+    const parsed = JSON.parse(readFileSync4(path, "utf8"));
     return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
   } catch {
     return null;
   }
 }
 function readGitHubBearerTokenForRemote(projectRoot) {
-  const scopedKey = resolve10(projectRoot);
+  const scopedKey = resolve11(projectRoot);
   if (scopedGitHubBearerTokens.has(scopedKey))
     return scopedGitHubBearerTokens.get(scopedKey) ?? null;
   const privateSession = readPrivateRemoteSessionToken(projectRoot);
@@ -2924,7 +3075,7 @@ async function registerProjectViaServer(context, input) {
   return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
 }
 function sleep(ms) {
-  return new Promise((resolve11) => setTimeout(resolve11, ms));
+  return new Promise((resolve12) => setTimeout(resolve12, ms));
 }
 function isRetryableProjectRootSwitchError(error) {
   if (!(error instanceof Error))
@@ -3407,7 +3558,7 @@ async function executeQueue(context, args) {
 
 // packages/cli/src/commands/agent.ts
 init_runner();
-import { resolve as resolve12 } from "path";
+import { resolve as resolve13 } from "path";
 import {
   agentId,
   cleanupAgentRuntime,
@@ -3417,8 +3568,8 @@ import {
 } from "@rig/runtime/control-plane/runtime/isolation";
 
 // packages/cli/src/commands/_authority-runs.ts
-import { existsSync as existsSync7 } from "fs";
-import { resolve as resolve11 } from "path";
+import { existsSync as existsSync8 } from "fs";
+import { resolve as resolve12 } from "path";
 import {
   readAuthorityRun,
   readJsonlFile as readJsonlFile2,
@@ -3440,8 +3591,8 @@ function normalizeRuntimeAdapter(value) {
   return "claude-code";
 }
 function readLatestBeadRecord(projectRoot, taskId) {
-  const issuesPath = resolve11(resolveControlPlaneMonorepoRoot(projectRoot), ".beads", "issues.jsonl");
-  if (!existsSync7(issuesPath)) {
+  const issuesPath = resolve12(resolveControlPlaneMonorepoRoot(projectRoot), ".beads", "issues.jsonl");
+  if (!existsSync8(issuesPath)) {
     return null;
   }
   let latest = null;
@@ -3509,7 +3660,7 @@ function upsertAgentAuthorityRun(projectRoot, input) {
   } else if ("errorText" in next) {
     delete next.errorText;
   }
-  writeJsonFile3(resolve11(resolveAuthorityRunDir(projectRoot, input.runId), "run.json"), next);
+  writeJsonFile3(resolve12(resolveAuthorityRunDir(projectRoot, input.runId), "run.json"), next);
   return next;
 }
 
@@ -3631,10 +3782,10 @@ async function executeAgent(context, args) {
           status: "running",
           startedAt: createdAt,
           worktreePath: runtime.workspaceDir,
-          artifactRoot: resolve12(runtime.workspaceDir, "artifacts", taskId),
+          artifactRoot: resolve13(runtime.workspaceDir, "artifacts", taskId),
           logRoot: runtime.logsDir,
-          sessionPath: resolve12(runtime.sessionDir, "session.json"),
-          sessionLogPath: resolve12(runtime.logsDir, "agent-stdout.log"),
+          sessionPath: resolve13(runtime.sessionDir, "session.json"),
+          sessionLogPath: resolve13(runtime.logsDir, "agent-stdout.log"),
           pid: process.pid
         });
         const result = await runInAgentRuntime({
@@ -3654,10 +3805,10 @@ async function executeAgent(context, args) {
             startedAt: createdAt,
             completedAt: failedAt,
             worktreePath: runtime.workspaceDir,
-            artifactRoot: resolve12(runtime.workspaceDir, "artifacts", taskId),
+            artifactRoot: resolve13(runtime.workspaceDir, "artifacts", taskId),
             logRoot: runtime.logsDir,
-            sessionPath: resolve12(runtime.sessionDir, "session.json"),
-            sessionLogPath: resolve12(runtime.logsDir, "agent-stdout.log"),
+            sessionPath: resolve13(runtime.sessionDir, "session.json"),
+            sessionLogPath: resolve13(runtime.logsDir, "agent-stdout.log"),
             pid: process.pid,
             errorText: result.stderr ? result.stderr.trim() : `Agent runtime command failed (${result.exitCode})`
           });
@@ -3674,10 +3825,10 @@ ${result.stderr.trim()}` : ""}`, result.exitCode);
           startedAt: createdAt,
           completedAt,
           worktreePath: runtime.workspaceDir,
-          artifactRoot: resolve12(runtime.workspaceDir, "artifacts", taskId),
+          artifactRoot: resolve13(runtime.workspaceDir, "artifacts", taskId),
           logRoot: runtime.logsDir,
-          sessionPath: resolve12(runtime.sessionDir, "session.json"),
-          sessionLogPath: resolve12(runtime.logsDir, "agent-stdout.log"),
+          sessionPath: resolve13(runtime.sessionDir, "session.json"),
+          sessionLogPath: resolve13(runtime.logsDir, "agent-stdout.log"),
           pid: process.pid
         });
         return {
@@ -3753,8 +3904,8 @@ init__parsers();
 import {
   chmodSync,
   copyFileSync as copyFileSync2,
-  existsSync as existsSync8,
-  mkdirSync as mkdirSync6,
+  existsSync as existsSync9,
+  mkdirSync as mkdirSync7,
   readdirSync,
   readlinkSync,
   rmSync as rmSync3,
@@ -3762,8 +3913,8 @@ import {
   symlinkSync,
   unlinkSync
 } from "fs";
-import { homedir as homedir3 } from "os";
-import { resolve as resolve13 } from "path";
+import { homedir as homedir4 } from "os";
+import { resolve as resolve14 } from "path";
 import { buildBinary as buildBinary2 } from "@rig/runtime/control-plane/runtime/isolation";
 import {
   computeRuntimeImageFingerprint,
@@ -3782,13 +3933,13 @@ async function runQuietBinaryProbe(binaryPath, args, cwd) {
 
 // packages/cli/src/commands/dist.ts
 function collectRigValidatorBuildTargets(input) {
-  const validatorsRoot = resolve13(input.hostProjectRoot, "packages/runtime/src/control-plane/validators");
-  if (!existsSync8(validatorsRoot))
+  const validatorsRoot = resolve14(input.hostProjectRoot, "packages/runtime/src/control-plane/validators");
+  if (!existsSync9(validatorsRoot))
     return [];
   const targets = [];
   const categories = readdirSync(validatorsRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory());
   for (const category of categories) {
-    const categoryDir = resolve13(validatorsRoot, category.name);
+    const categoryDir = resolve14(validatorsRoot, category.name);
     for (const entry of readdirSync(categoryDir, { withFileTypes: true })) {
       if (!entry.isFile() || !entry.name.endsWith(".ts"))
         continue;
@@ -3797,7 +3948,7 @@ function collectRigValidatorBuildTargets(input) {
         continue;
       targets.push({
         source: `packages/runtime/src/control-plane/validators/${category.name}/${entry.name}`,
-        dest: resolve13(input.imageDir, `bin/validators/${category.name}-${check}`),
+        dest: resolve14(input.imageDir, `bin/validators/${category.name}-${check}`),
         cwd: input.hostProjectRoot
       });
     }
@@ -3806,16 +3957,16 @@ function collectRigValidatorBuildTargets(input) {
 }
 async function findLatestDistBinary(projectRoot) {
   const distRoot = resolveControlPlaneHostDistDir(projectRoot);
-  if (!existsSync8(distRoot)) {
+  if (!existsSync9(distRoot)) {
     return null;
   }
   const entries = readdirSync(distRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && entry.name.startsWith("rig-")).map((entry) => ({
     name: entry.name,
-    mtimeMs: statSync(resolve13(distRoot, entry.name)).mtimeMs
+    mtimeMs: statSync(resolve14(distRoot, entry.name)).mtimeMs
   })).sort((a, b) => b.mtimeMs - a.mtimeMs || b.name.localeCompare(a.name));
   for (const { name } of entries) {
-    const candidate = resolve13(distRoot, name, "bin", "rig");
-    if (existsSync8(candidate) && await isRunnableRigBinary(candidate, projectRoot)) {
+    const candidate = resolve14(distRoot, name, "bin", "rig");
+    if (existsSync9(candidate) && await isRunnableRigBinary(candidate, projectRoot)) {
       return candidate;
     }
   }
@@ -3827,7 +3978,7 @@ async function isRunnableRigBinary(binaryPath, projectRoot) {
 async function runDistDoctor(projectRoot) {
   const bunPath = Bun.which("bun");
   const rigPath = Bun.which("rig");
-  const userBinDir = resolve13(homedir3(), ".local/bin");
+  const userBinDir = resolve14(homedir4(), ".local/bin");
   const userBinInPath = (process.env.PATH || "").split(":").filter(Boolean).includes(userBinDir);
   let rigRunnable = false;
   if (rigPath) {
@@ -3871,19 +4022,19 @@ async function executeDist(context, args) {
       requireNoExtraArgs(pending, "rig dist install [--scope user|system] [--path <dir>]");
       const scope = parseInstallScope(scopeResult.value);
       const installDir = resolveInstallDir(scope, pathResult.value);
-      mkdirSync6(installDir, { recursive: true });
+      mkdirSync7(installDir, { recursive: true });
       let source = await findLatestDistBinary(context.projectRoot);
       let buildDir = null;
       if (!source) {
-        buildDir = resolve13(resolveControlPlaneHostDistDir(context.projectRoot), `rig-install-${Date.now()}`);
+        buildDir = resolve14(resolveControlPlaneHostDistDir(context.projectRoot), `rig-install-${Date.now()}`);
         await context.runCommand(["bun", "run", "packages/cli/bin/build-rig-binaries.ts", "--output-dir", buildDir]);
-        source = resolve13(buildDir, "bin", "rig");
+        source = resolve14(buildDir, "bin", "rig");
       }
-      if (!existsSync8(source)) {
+      if (!existsSync9(source)) {
         throw new CliError2(`Unable to locate rig binary at ${source}.`, 2);
       }
-      const installedPath = resolve13(installDir, "rig");
-      if (existsSync8(installedPath)) {
+      const installedPath = resolve14(installDir, "rig");
+      if (existsSync9(installedPath)) {
         unlinkSync(installedPath);
       }
       copyFileSync2(source, installedPath);
@@ -3925,22 +4076,22 @@ async function executeDist(context, args) {
       requireNoExtraArgs(rest, "rig dist rebuild-agent");
       const fp = await computeRuntimeImageFingerprint(context.projectRoot);
       const currentId = computeRuntimeImageId(fp);
-      const imagesDir = resolve13(resolveControlPlaneMonorepoRuntimeDir(context.projectRoot), "images");
-      mkdirSync6(imagesDir, { recursive: true });
+      const imagesDir = resolve14(resolveControlPlaneMonorepoRuntimeDir(context.projectRoot), "images");
+      mkdirSync7(imagesDir, { recursive: true });
       let pruned = 0;
       for (const entry of readdirSync(imagesDir, { withFileTypes: true })) {
         if (entry.isDirectory() && entry.name !== currentId) {
-          rmSync3(resolve13(imagesDir, entry.name), { recursive: true, force: true });
+          rmSync3(resolve14(imagesDir, entry.name), { recursive: true, force: true });
           pruned++;
         }
       }
       if (pruned > 0 && context.outputMode === "text") {
         console.log(`Pruned ${pruned} stale image(s).`);
       }
-      const imageDir = resolve13(imagesDir, currentId);
-      mkdirSync6(resolve13(imageDir, "bin/hooks"), { recursive: true });
-      mkdirSync6(resolve13(imageDir, "bin/plugins"), { recursive: true });
-      mkdirSync6(resolve13(imageDir, "bin/validators"), { recursive: true });
+      const imageDir = resolve14(imagesDir, currentId);
+      mkdirSync7(resolve14(imageDir, "bin/hooks"), { recursive: true });
+      mkdirSync7(resolve14(imageDir, "bin/plugins"), { recursive: true });
+      mkdirSync7(resolve14(imageDir, "bin/validators"), { recursive: true });
       const hookNames = [
         "scope-guard",
         "import-guard",
@@ -3954,25 +4105,25 @@ async function executeDist(context, args) {
       ];
       const targets = [];
       const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || context.projectRoot;
-      targets.push({ source: "packages/runtime/bin/rig-agent.ts", dest: resolve13(imageDir, "bin/rig-agent"), cwd: hostProjectRoot });
-      targets.push({ source: "packages/runtime/bin/rig-agent-dispatch.ts", dest: resolve13(resolveControlPlaneHostBinDir(context.projectRoot), "rig-agent"), cwd: hostProjectRoot });
+      targets.push({ source: "packages/runtime/bin/rig-agent.ts", dest: resolve14(imageDir, "bin/rig-agent"), cwd: hostProjectRoot });
+      targets.push({ source: "packages/runtime/bin/rig-agent-dispatch.ts", dest: resolve14(resolveControlPlaneHostBinDir(context.projectRoot), "rig-agent"), cwd: hostProjectRoot });
       for (const hookName of hookNames) {
         const src = `packages/runtime/src/control-plane/hooks/${hookName}.ts`;
-        targets.push({ source: src, dest: resolve13(imageDir, `bin/hooks/${hookName}`), cwd: hostProjectRoot });
-        targets.push({ source: src, dest: resolve13(resolveControlPlaneHostBinDir(context.projectRoot), `hooks/${hookName}`), cwd: hostProjectRoot });
-      }
-      const pluginsDir = resolve13(context.projectRoot, "rig/plugins");
-      const binPluginsDir = resolve13(resolveControlPlaneHostBinDir(context.projectRoot), "plugins");
-      const validatorsRoot = resolve13(hostProjectRoot, "packages/runtime/src/control-plane/validators");
-      const binValidatorsDir = resolve13(resolveControlPlaneHostBinDir(context.projectRoot), "validators");
-      mkdirSync6(binPluginsDir, { recursive: true });
-      mkdirSync6(binValidatorsDir, { recursive: true });
-      if (existsSync8(pluginsDir)) {
+        targets.push({ source: src, dest: resolve14(imageDir, `bin/hooks/${hookName}`), cwd: hostProjectRoot });
+        targets.push({ source: src, dest: resolve14(resolveControlPlaneHostBinDir(context.projectRoot), `hooks/${hookName}`), cwd: hostProjectRoot });
+      }
+      const pluginsDir = resolve14(context.projectRoot, "rig/plugins");
+      const binPluginsDir = resolve14(resolveControlPlaneHostBinDir(context.projectRoot), "plugins");
+      const validatorsRoot = resolve14(hostProjectRoot, "packages/runtime/src/control-plane/validators");
+      const binValidatorsDir = resolve14(resolveControlPlaneHostBinDir(context.projectRoot), "validators");
+      mkdirSync7(binPluginsDir, { recursive: true });
+      mkdirSync7(binValidatorsDir, { recursive: true });
+      if (existsSync9(pluginsDir)) {
         for (const entry of readdirSync(pluginsDir, { withFileTypes: true })) {
           const m = entry.name.match(/^(.+)\.plugin\.(ts|js|mjs|cjs)$/);
           if (!m)
             continue;
-          targets.push({ source: `rig/plugins/${entry.name}`, dest: resolve13(imageDir, `bin/plugins/${m[1]}`), cwd: context.projectRoot });
+          targets.push({ source: `rig/plugins/${entry.name}`, dest: resolve14(imageDir, `bin/plugins/${m[1]}`), cwd: context.projectRoot });
         }
       }
       targets.push(...collectRigValidatorBuildTargets({ contextProjectRoot: context.projectRoot, hostProjectRoot, imageDir }));
@@ -3983,17 +4134,17 @@ async function executeDist(context, args) {
         const isValidator = dest.includes("/bin/validators/");
         await buildBinary2(source, dest, cwd, isValidator ? { AGENT_BUN_PATH: Bun.which("bun") || "bun" } : { AGENT_PROJECT_ROOT: context.projectRoot });
       }
-      if (existsSync8(pluginsDir)) {
+      if (existsSync9(pluginsDir)) {
         for (const entry of readdirSync(pluginsDir, { withFileTypes: true })) {
           const m = entry.name.match(/^(.+)\.plugin\.(ts|js|mjs|cjs)$/);
           if (!m)
             continue;
           const pluginName = m[1];
-          const imageBin = resolve13(imageDir, `bin/plugins/${pluginName}`);
+          const imageBin = resolve14(imageDir, `bin/plugins/${pluginName}`);
           if (!pluginName)
             continue;
-          const symlinkPath = resolve13(binPluginsDir, pluginName);
-          if (existsSync8(imageBin)) {
+          const symlinkPath = resolve14(binPluginsDir, pluginName);
+          if (existsSync9(imageBin)) {
             try {
               unlinkSync(symlinkPath);
             } catch {}
@@ -4001,10 +4152,10 @@ async function executeDist(context, args) {
           }
         }
       }
-      if (existsSync8(validatorsRoot)) {
+      if (existsSync9(validatorsRoot)) {
         const categories = readdirSync(validatorsRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory());
         for (const category of categories) {
-          const categoryDir = resolve13(validatorsRoot, category.name);
+          const categoryDir = resolve14(validatorsRoot, category.name);
           for (const entry of readdirSync(categoryDir, { withFileTypes: true })) {
             if (!entry.isFile() || !entry.name.endsWith(".ts"))
               continue;
@@ -4012,9 +4163,9 @@ async function executeDist(context, args) {
             if (!check || check === "index" || check === "shared")
               continue;
             const validatorName = `${category.name}-${check}`;
-            const imageBin = resolve13(imageDir, `bin/validators/${validatorName}`);
-            const symlinkPath = resolve13(binValidatorsDir, validatorName);
-            if (existsSync8(imageBin)) {
+            const imageBin = resolve14(imageDir, `bin/validators/${validatorName}`);
+            const symlinkPath = resolve14(binValidatorsDir, validatorName);
+            if (existsSync9(imageBin)) {
               try {
                 unlinkSync(symlinkPath);
               } catch {}
@@ -4023,18 +4174,18 @@ async function executeDist(context, args) {
           }
         }
       }
-      const agentsDir = resolve13(resolveControlPlaneMonorepoRuntimeDir(context.projectRoot), "agents");
-      if (existsSync8(agentsDir)) {
+      const agentsDir = resolve14(resolveControlPlaneMonorepoRuntimeDir(context.projectRoot), "agents");
+      if (existsSync9(agentsDir)) {
         let relinkCount = 0;
         for (const agentEntry of readdirSync(agentsDir, { withFileTypes: true })) {
           if (!agentEntry.isDirectory())
             continue;
-          const agentBinDir = resolve13(agentsDir, agentEntry.name, "worktree", ".rig", "bin");
-          if (!existsSync8(agentBinDir))
+          const agentBinDir = resolve14(agentsDir, agentEntry.name, "worktree", ".rig", "bin");
+          if (!existsSync9(agentBinDir))
             continue;
           const walkDir = (dir) => {
             for (const entry of readdirSync(dir, { withFileTypes: true })) {
-              const fullPath = resolve13(dir, entry.name);
+              const fullPath = resolve14(dir, entry.name);
               if (entry.isDirectory()) {
                 walkDir(fullPath);
               } else if (entry.isSymbolicLink()) {
@@ -4068,8 +4219,8 @@ async function executeDist(context, args) {
 
 // packages/cli/src/commands/inbox.ts
 init_runner();
-import { writeFileSync as writeFileSync4 } from "fs";
-import { resolve as resolve14 } from "path";
+import { writeFileSync as writeFileSync5 } from "fs";
+import { resolve as resolve15 } from "path";
 import {
   listAuthorityRuns,
   readJsonlFile as readJsonlFile3,
@@ -4471,7 +4622,7 @@ async function listRemoteInboxRecords(context, kind, filters) {
 function listLocalInboxRecords(context, kind, filters) {
   const fileName = kind === "approvals" ? "approvals.jsonl" : "user-input.jsonl";
   const runs = listAuthorityRuns(context.projectRoot).filter((entry) => (!filters.run || entry.runId === filters.run) && (!filters.task || entry.taskId === filters.task));
-  return runs.flatMap((entry) => readJsonlFile3(resolve14(resolveAuthorityRunDir2(context.projectRoot, entry.runId), fileName)).map((record) => ({
+  return runs.flatMap((entry) => readJsonlFile3(resolve15(resolveAuthorityRunDir2(context.projectRoot, entry.runId), fileName)).map((record) => ({
     runId: entry.runId,
     taskId: entry.taskId ?? undefined,
     record
@@ -4519,11 +4670,11 @@ async function executeInbox(context, args) {
       if (isRemoteConnectionSelected(context.projectRoot)) {
         throw new CliError2("Remote approval resolution is not available from this CLI yet; use the server UI/API or switch to local state for direct JSONL edits.", 2);
       }
-      const approvalsPath = resolve14(resolveAuthorityRunDir2(context.projectRoot, run.value), "approvals.jsonl");
+      const approvalsPath = resolve15(resolveAuthorityRunDir2(context.projectRoot, run.value), "approvals.jsonl");
       const approvals = readJsonlFile3(approvalsPath);
       const resolvedAt = new Date().toISOString();
       const next = approvals.map((entry) => entry.requestId === request.value || entry.id === request.value ? { ...entry, status: "resolved", decision: decision.value, note: note4.value ?? null, resolvedAt } : entry);
-      writeFileSync4(approvalsPath, `${next.map((entry) => JSON.stringify(entry)).join(`
+      writeFileSync5(approvalsPath, `${next.map((entry) => JSON.stringify(entry)).join(`
 `)}
 `, "utf8");
       return { ok: true, group: "inbox", command, details: { runId: run.value, requestId: request.value, decision: decision.value } };
@@ -4575,11 +4726,11 @@ async function executeInbox(context, args) {
         const [key, ...restValue] = entry.split("=");
         return [key, restValue.join("=")];
       }));
-      const requestsPath = resolve14(resolveAuthorityRunDir2(context.projectRoot, run.value), "user-input.jsonl");
+      const requestsPath = resolve15(resolveAuthorityRunDir2(context.projectRoot, run.value), "user-input.jsonl");
       const requests = readJsonlFile3(requestsPath);
       const resolvedAt = new Date().toISOString();
       const next = requests.map((entry) => entry.requestId === request.value || entry.id === request.value ? { ...entry, status: "resolved", answers: parsedAnswers, respondedAt: resolvedAt, resolvedAt } : entry);
-      writeFileSync4(requestsPath, `${next.map((entry) => JSON.stringify(entry)).join(`
+      writeFileSync5(requestsPath, `${next.map((entry) => JSON.stringify(entry)).join(`
 `)}
 `, "utf8");
       return { ok: true, group: "inbox", command, details: { runId: run.value, requestId: request.value, answers: parsedAnswers } };
@@ -4591,16 +4742,16 @@ async function executeInbox(context, args) {
 
 // packages/cli/src/commands/init.ts
 init_runner();
-import { appendFileSync as appendFileSync2, existsSync as existsSync11, mkdirSync as mkdirSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { appendFileSync as appendFileSync2, existsSync as existsSync12, mkdirSync as mkdirSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
 import { spawnSync } from "child_process";
-import { resolve as resolve18 } from "path";
+import { resolve as resolve19 } from "path";
 import { buildRigInitConfigSource } from "@rig/core";
 import { listGitHubProjects as listGitHubProjectsDirect, resolveProjectStatusField as resolveProjectStatusFieldDirect } from "@rig/server";
 
 // packages/cli/src/commands/_pi-install.ts
-import { existsSync as existsSync9, readFileSync as readFileSync4, rmSync as rmSync4 } from "fs";
-import { homedir as homedir4 } from "os";
-import { resolve as resolve15 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync5, rmSync as rmSync4 } from "fs";
+import { homedir as homedir5 } from "os";
+import { resolve as resolve16 } from "path";
 var PI_RIG_PACKAGE_NAME = "@h-rig/pi-rig";
 var LEGACY_PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
 var LEGACY_PI_RIG_MARKER = `// Managed by Rig. Source package: @rig/pi-rig.
@@ -4616,16 +4767,16 @@ async function defaultCommandRunner(command, options = {}) {
   return { exitCode, stdout, stderr };
 }
 function resolvePiRigExtensionPath(homeDir) {
-  return resolve15(homeDir, ".pi", "agent", "extensions", "pi-rig");
+  return resolve16(homeDir, ".pi", "agent", "extensions", "pi-rig");
 }
-function resolvePiRigPackageSource(projectRoot, exists = existsSync9) {
-  const localPackage = resolve15(projectRoot, "packages", "pi-rig");
-  if (exists(resolve15(localPackage, "package.json")))
+function resolvePiRigPackageSource(projectRoot, exists = existsSync10) {
+  const localPackage = resolve16(projectRoot, "packages", "pi-rig");
+  if (exists(resolve16(localPackage, "package.json")))
     return localPackage;
   return `npm:${PI_RIG_PACKAGE_NAME}`;
 }
 function resolvePiHomeDir(inputHomeDir) {
-  return inputHomeDir ?? process.env.RIG_PI_HOME_DIR?.trim() ?? homedir4();
+  return inputHomeDir ?? process.env.RIG_PI_HOME_DIR?.trim() ?? homedir5();
 }
 function piListContainsPiRig(output) {
   return output.split(/\r?\n/).some((line) => {
@@ -4671,13 +4822,13 @@ async function ensurePiBinaryAvailable(input) {
     ...next.exitCode === 0 ? {} : { error: (next.stderr || next.stdout).trim() || "pi --version failed after install" }
   };
 }
-function removeManagedLegacyPiRigBridge(homeDir, exists = existsSync9) {
+function removeManagedLegacyPiRigBridge(homeDir, exists = existsSync10) {
   const extensionPath = resolvePiRigExtensionPath(homeDir);
-  const indexPath = resolve15(extensionPath, "index.ts");
+  const indexPath = resolve16(extensionPath, "index.ts");
   if (!exists(indexPath))
     return;
   try {
-    const content = readFileSync4(indexPath, "utf8");
+    const content = readFileSync5(indexPath, "utf8");
     if (content === LEGACY_PI_RIG_MARKER || content.includes("Managed by Rig. Source package: @rig/pi-rig")) {
       rmSync4(extensionPath, { recursive: true, force: true });
     }
@@ -4693,13 +4844,13 @@ async function checkPiRigInstall(input = {}) {
       piRig: { ok: true, label: "pi-rig global extension", detail: extensionPath }
     };
   }
-  const exists = input.exists ?? existsSync9;
+  const exists = input.exists ?? existsSync10;
   const runner = input.commandRunner ?? defaultCommandRunner;
   const piResult = await safeRun(runner, ["pi", "--version"]);
   const piListResult = piResult.exitCode === 0 ? await safeRun(runner, ["pi", "list"]) : { exitCode: 1, stdout: "", stderr: "" };
   const listedPiRig = piListResult.exitCode === 0 && piListContainsPiRig(`${piListResult.stdout}
 ${piListResult.stderr}`);
-  const legacyBridge = exists(resolve15(extensionPath, "index.ts"));
+  const legacyBridge = exists(resolve16(extensionPath, "index.ts"));
   const hasPiRig = listedPiRig;
   return {
     extensionPath,
@@ -4776,7 +4927,7 @@ async function buildPiSetupChecks(input = {}) {
 
 // packages/cli/src/commands/_snapshot-upload.ts
 import { mkdir, readdir, readFile, writeFile } from "fs/promises";
-import { dirname as dirname2, resolve as resolve16, relative, sep } from "path";
+import { dirname as dirname3, resolve as resolve17, relative, sep } from "path";
 var SNAPSHOT_ARCHIVE_VERSION = 1;
 var SNAPSHOT_ARCHIVE_CONTENT_TYPE = "application/vnd.rig.snapshot+json";
 var DEFAULT_EXCLUDED_DIRECTORIES = new Set([
@@ -4798,15 +4949,15 @@ function assertManifestPath(root, relativePath) {
   if (!relativePath || relativePath.startsWith("/") || relativePath.includes("\x00")) {
     throw new Error(`Invalid snapshot path: ${relativePath}`);
   }
-  const resolved = resolve16(root, relativePath);
+  const resolved = resolve17(root, relativePath);
   const relativeToRoot = relative(root, resolved);
-  if (relativeToRoot.startsWith("..") || relativeToRoot === ".." || resolve16(relativeToRoot) === resolved) {
+  if (relativeToRoot.startsWith("..") || relativeToRoot === ".." || resolve17(relativeToRoot) === resolved) {
     throw new Error(`Snapshot path escapes project root: ${relativePath}`);
   }
   return resolved;
 }
 async function buildSnapshotUploadManifest(projectRoot, options = {}) {
-  const root = resolve16(projectRoot);
+  const root = resolve17(projectRoot);
   const excludedDirectories = [...new Set([
     ...DEFAULT_EXCLUDED_DIRECTORIES,
     ...options.excludedDirectories ?? []
@@ -4818,7 +4969,7 @@ async function buildSnapshotUploadManifest(projectRoot, options = {}) {
     for (const entry of entries) {
       if (entry.isDirectory() && excludedSet.has(entry.name))
         continue;
-      const fullPath = resolve16(dir, entry.name);
+      const fullPath = resolve17(dir, entry.name);
       if (entry.isDirectory()) {
         await visit(fullPath);
         continue;
@@ -4867,8 +5018,8 @@ async function uploadSnapshotArchiveViaServer(context, input) {
 
 // packages/cli/src/commands/_doctor-checks.ts
 init_runner();
-import { existsSync as existsSync10, readFileSync as readFileSync5 } from "fs";
-import { resolve as resolve17 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync6 } from "fs";
+import { resolve as resolve18 } from "path";
 import { isSupportedBunVersion, MIN_SUPPORTED_BUN_VERSION } from "@rig/runtime/control-plane/setup-version";
 init__parsers();
 function check(id, label, status, detail, remediation) {
@@ -4909,11 +5060,11 @@ function repoSlugFromConfig(config) {
 function loadFallbackConfig(projectRoot) {
   const candidates = ["rig.config.ts", "rig.config.mts", "rig.config.json"];
   for (const name of candidates) {
-    const path = resolve17(projectRoot, name);
-    if (!existsSync10(path))
+    const path = resolve18(projectRoot, name);
+    if (!existsSync11(path))
       continue;
     try {
-      const source = readFileSync5(path, "utf8");
+      const source = readFileSync6(path, "utf8");
       if (name.endsWith(".json"))
         return JSON.parse(source);
       const owner = source.match(/owner\s*:\s*["']([^"']+)["']/)?.[1];
@@ -4992,7 +5143,7 @@ async function runRigDoctorChecks(options) {
   checks.push(check("bun", `bun >= ${MIN_SUPPORTED_BUN_VERSION}`, isSupportedBunVersion(bunVersion) ? "pass" : "fail", `found ${bunVersion}`, `Install Bun ${MIN_SUPPORTED_BUN_VERSION} or newer.`), check("git", "git", which("git") ? "pass" : "fail", which("git") ?? undefined, "Install git and ensure it is on PATH."), check("jq", "jq", which("jq") ? "pass" : "warn", which("jq") ?? undefined, "Install jq (for example `brew install jq`)."));
   const loadedConfig = await loadConfig(projectRoot).catch(() => null);
   const config = loadedConfig ?? loadFallbackConfig(projectRoot);
-  const hasConfigFile = ["rig.config.ts", "rig.config.mts", "rig.config.json"].some((name) => existsSync10(resolve17(projectRoot, name)));
+  const hasConfigFile = ["rig.config.ts", "rig.config.mts", "rig.config.json"].some((name) => existsSync11(resolve18(projectRoot, name)));
   checks.push(config ? check("config", "rig.config loadable", "pass") : check("config", "rig.config loadable", hasConfigFile ? "fail" : "fail", hasConfigFile ? "config file exists but failed to load" : "missing rig.config.ts/json", "Run `rig init` or fix the config error."));
   const taskSourceKind = config?.taskSource?.kind;
   checks.push(taskSourceKind ? check("task-source", "task source configured", "pass", taskSourceKind) : check("task-source", "task source configured", "fail", "missing taskSource", "Configure taskSource in rig.config.ts."));
@@ -5111,20 +5262,20 @@ function parseRepoSlug(value) {
   return { owner: match[1], repo: match[2], slug: `${match[1]}/${match[2]}` };
 }
 function ensureRigPrivateDirs(projectRoot) {
-  const rigDir = resolve18(projectRoot, ".rig");
-  mkdirSync7(resolve18(rigDir, "state"), { recursive: true });
-  mkdirSync7(resolve18(rigDir, "logs"), { recursive: true });
-  mkdirSync7(resolve18(rigDir, "runs"), { recursive: true });
-  mkdirSync7(resolve18(rigDir, "tmp"), { recursive: true });
-  mkdirSync7(resolve18(projectRoot, "artifacts"), { recursive: true });
-  const taskConfigPath = resolve18(rigDir, "task-config.json");
-  if (!existsSync11(taskConfigPath))
-    writeFileSync5(taskConfigPath, `{}
+  const rigDir = resolve19(projectRoot, ".rig");
+  mkdirSync8(resolve19(rigDir, "state"), { recursive: true });
+  mkdirSync8(resolve19(rigDir, "logs"), { recursive: true });
+  mkdirSync8(resolve19(rigDir, "runs"), { recursive: true });
+  mkdirSync8(resolve19(rigDir, "tmp"), { recursive: true });
+  mkdirSync8(resolve19(projectRoot, "artifacts"), { recursive: true });
+  const taskConfigPath = resolve19(rigDir, "task-config.json");
+  if (!existsSync12(taskConfigPath))
+    writeFileSync6(taskConfigPath, `{}
 `, "utf-8");
 }
 function ensureGitignoreEntries(projectRoot) {
-  const path = resolve18(projectRoot, ".gitignore");
-  const existing = existsSync11(path) ? readFileSync6(path, "utf8") : "";
+  const path = resolve19(projectRoot, ".gitignore");
+  const existing = existsSync12(path) ? readFileSync7(path, "utf8") : "";
   const entries = [".rig/state/", ".rig/logs/", ".rig/runs/", ".rig/tmp/"];
   const missing = entries.filter((entry) => !existing.split(/\r?\n/).includes(entry));
   if (missing.length === 0)
@@ -5137,17 +5288,17 @@ function ensureGitignoreEntries(projectRoot) {
 `, "utf8");
 }
 function ensureRigConfigPackageDependencies(projectRoot) {
-  const path = resolve18(projectRoot, "package.json");
-  const existing = existsSync11(path) ? JSON.parse(readFileSync6(path, "utf8")) : {};
+  const path = resolve19(projectRoot, "package.json");
+  const existing = existsSync12(path) ? JSON.parse(readFileSync7(path, "utf8")) : {};
   const devDependencies = existing.devDependencies && typeof existing.devDependencies === "object" && !Array.isArray(existing.devDependencies) ? { ...existing.devDependencies } : {};
   for (const [name, spec] of Object.entries(RIG_CONFIG_DEV_DEPENDENCIES)) {
     devDependencies[name] = spec;
   }
   const next = {
-    ...existsSync11(path) ? existing : { name: "rig-project", private: true },
+    ...existsSync12(path) ? existing : { name: "rig-project", private: true },
     devDependencies
   };
-  writeFileSync5(path, `${JSON.stringify(next, null, 2)}
+  writeFileSync6(path, `${JSON.stringify(next, null, 2)}
 `, "utf8");
 }
 function applyGitHubProjectConfig(source, options) {
@@ -5396,7 +5547,7 @@ async function promptGitHubProjectConfig(context, prompts, repoSlug, githubToken
   };
 }
 function sleep2(ms) {
-  return new Promise((resolve19) => setTimeout(resolve19, ms));
+  return new Promise((resolve20) => setTimeout(resolve20, ms));
 }
 function positiveIntFromEnv(name, fallback) {
   const value = Number.parseInt(process.env[name] ?? "", 10);
@@ -5425,7 +5576,7 @@ function remoteGitHubAuthMetadata(payload) {
   };
 }
 function writeRemoteGitHubAuthState(projectRoot, input) {
-  writeFileSync5(resolve18(projectRoot, ".rig", "state", "github-auth.json"), `${JSON.stringify({
+  writeFileSync6(resolve19(projectRoot, ".rig", "state", "github-auth.json"), `${JSON.stringify({
     authenticated: true,
     source: input.source,
     storedOnServer: true,
@@ -5482,9 +5633,9 @@ async function runControlPlaneInit(context, options) {
   });
   ensureRigPrivateDirs(projectRoot);
   ensureGitignoreEntries(projectRoot);
-  const configTsPath = resolve18(projectRoot, "rig.config.ts");
-  const configJsonPath = resolve18(projectRoot, "rig.config.json");
-  const configExists = existsSync11(configTsPath) || existsSync11(configJsonPath);
+  const configTsPath = resolve19(projectRoot, "rig.config.ts");
+  const configJsonPath = resolve19(projectRoot, "rig.config.json");
+  const configExists = existsSync12(configTsPath) || existsSync12(configJsonPath);
   if (!options.privateStateOnly) {
     if (configExists && !options.repair) {
       if (context.outputMode !== "json")
@@ -5496,11 +5647,11 @@ async function runControlPlaneInit(context, options) {
         taskSource: { kind: "github-issues", owner: repo.owner, repo: repo.repo },
         useStandardPlugin: true
       }), options);
-      writeFileSync5(configTsPath, source, "utf-8");
+      writeFileSync6(configTsPath, source, "utf-8");
     }
     ensureRigConfigPackageDependencies(projectRoot);
   }
-  writeFileSync5(resolve18(projectRoot, ".rig", "state", "project-link.json"), `${JSON.stringify({ repoSlug: repo.slug, connection: connectionAlias, linkedAt: new Date().toISOString() }, null, 2)}
+  writeFileSync6(resolve19(projectRoot, ".rig", "state", "project-link.json"), `${JSON.stringify({ repoSlug: repo.slug, connection: connectionAlias, linkedAt: new Date().toISOString() }, null, 2)}
 `, "utf8");
   const checkout = checkoutForInit(projectRoot, serverKind, options.remoteCheckout);
   let uploadedSnapshot = null;
@@ -5696,7 +5847,7 @@ function parseInitOptions(args) {
 async function runInteractiveControlPlaneInit(context, prompts) {
   prompts.intro?.("Initialize a Rig control-plane project");
   const projectRoot = context.projectRoot;
-  const existingConfig = existsSync11(resolve18(projectRoot, "rig.config.ts")) || existsSync11(resolve18(projectRoot, "rig.config.json"));
+  const existingConfig = existsSync12(resolve19(projectRoot, "rig.config.ts")) || existsSync12(resolve19(projectRoot, "rig.config.json"));
   let repair = false;
   let privateStateOnly = false;
   if (existingConfig) {
@@ -5999,8 +6150,8 @@ async function executeDoctor(context, args) {
 
 // packages/cli/src/commands/_run-driver-helpers.ts
 init_runner();
-import { readFileSync as readFileSync7 } from "fs";
-import { resolve as resolve19 } from "path";
+import { readFileSync as readFileSync8 } from "fs";
+import { resolve as resolve20 } from "path";
 import {
   appendJsonlRecord as appendJsonlRecord2,
   readAuthorityRun as readAuthorityRun2,
@@ -6020,7 +6171,7 @@ function patchAuthorityRun(projectRoot, runId, patch) {
     ...patch,
     updatedAt: new Date().toISOString()
   };
-  writeJsonFile4(resolve19(resolveAuthorityRunDir3(projectRoot, runId), "run.json"), next);
+  writeJsonFile4(resolve20(resolveAuthorityRunDir3(projectRoot, runId), "run.json"), next);
   return next;
 }
 function touchAuthorityRun(projectRoot, runId) {
@@ -6028,21 +6179,21 @@ function touchAuthorityRun(projectRoot, runId) {
   if (!current) {
     return;
   }
-  writeJsonFile4(resolve19(resolveAuthorityRunDir3(projectRoot, runId), "run.json"), {
+  writeJsonFile4(resolve20(resolveAuthorityRunDir3(projectRoot, runId), "run.json"), {
     ...current,
     updatedAt: new Date().toISOString()
   });
 }
 function appendRunTimeline(projectRoot, runId, value) {
-  appendJsonlRecord2(resolve19(resolveAuthorityRunDir3(projectRoot, runId), "timeline.jsonl"), value);
+  appendJsonlRecord2(resolve20(resolveAuthorityRunDir3(projectRoot, runId), "timeline.jsonl"), value);
   touchAuthorityRun(projectRoot, runId);
 }
 function appendRunLog(projectRoot, runId, value) {
-  appendJsonlRecord2(resolve19(resolveAuthorityRunDir3(projectRoot, runId), "logs.jsonl"), value);
+  appendJsonlRecord2(resolve20(resolveAuthorityRunDir3(projectRoot, runId), "logs.jsonl"), value);
   touchAuthorityRun(projectRoot, runId);
 }
 function appendRunAction(projectRoot, runId, value) {
-  appendJsonlRecord2(resolve19(resolveAuthorityRunDir3(projectRoot, runId), "timeline.jsonl"), {
+  appendJsonlRecord2(resolve20(resolveAuthorityRunDir3(projectRoot, runId), "timeline.jsonl"), {
     id: value.id,
     type: "action",
     actionType: value.actionType,
@@ -6113,7 +6264,7 @@ function buildRunPrompt(input) {
   })();
   const scopeText = (() => {
     try {
-      const parsed = JSON.parse(readFileSync7(resolveControlPlaneTaskConfigPath(input.projectRoot), "utf8"));
+      const parsed = JSON.parse(readFileSync8(resolveControlPlaneTaskConfigPath(input.projectRoot), "utf8"));
       const entry = parsed[input.taskId] ?? {};
       const scope = Array.isArray(entry.scope) ? entry.scope.filter((item) => typeof item === "string") : [];
       const validation = Array.isArray(entry.validation) ? entry.validation.filter((item) => typeof item === "string") : [];
@@ -6227,8 +6378,8 @@ function renderSourceScopeValidation(task, validation) {
 
 // packages/cli/src/commands/inspect.ts
 init_runner();
-import { existsSync as existsSync12, readFileSync as readFileSync8 } from "fs";
-import { resolve as resolve20 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync9 } from "fs";
+import { resolve as resolve21 } from "path";
 import {
   listAuthorityRuns as listAuthorityRuns2,
   readAuthorityRun as readAuthorityRun3,
@@ -6249,8 +6400,8 @@ async function executeInspect(context, args) {
       if (!latestRun) {
         throw new CliError2(`No runs found for ${requiredTask}.`);
       }
-      const logsPath = resolve20(resolveAuthorityRunDir4(context.projectRoot, latestRun.runId), "logs.jsonl");
-      if (!existsSync12(logsPath)) {
+      const logsPath = resolve21(resolveAuthorityRunDir4(context.projectRoot, latestRun.runId), "logs.jsonl");
+      if (!existsSync13(logsPath)) {
         throw new CliError2(`No logs found for run ${latestRun.runId}.`);
       }
       await context.runCommand(["cat", logsPath]);
@@ -6260,7 +6411,7 @@ async function executeInspect(context, args) {
       const { value: task, rest: remaining } = takeOption(rest, "--task");
       requireNoExtraArgs(remaining, "rig inspect artifacts --task <task-id>");
       const requiredTask = requireTask(task, "rig inspect artifacts --task <task-id>");
-      const artifactRoot = resolveTaskArtifactDirs(context.projectRoot, requiredTask).find((path) => existsSync12(path));
+      const artifactRoot = resolveTaskArtifactDirs(context.projectRoot, requiredTask).find((path) => existsSync13(path));
       if (!artifactRoot) {
         throw new CliError2(`No artifacts found for ${requiredTask}.`);
       }
@@ -6317,10 +6468,10 @@ async function executeInspect(context, args) {
     case "failures": {
       requireNoExtraArgs(rest, "rig inspect failures");
       const failed = resolveHarnessPaths2(context.projectRoot).failedApproachesPath;
-      if (!existsSync12(failed)) {
+      if (!existsSync13(failed)) {
         console.log("No failures recorded.");
       } else {
-        process.stdout.write(readFileSync8(failed, "utf-8"));
+        process.stdout.write(readFileSync9(failed, "utf-8"));
       }
       return { ok: true, group: "inspect", command };
     }
@@ -6337,11 +6488,11 @@ async function executeInspect(context, args) {
       return { ok: true, group: "inspect", command };
     case "audit": {
       requireNoExtraArgs(rest, "rig inspect audit");
-      const auditPath = resolve20(resolveHarnessPaths2(context.projectRoot).logsDir, "audit.jsonl");
-      if (!existsSync12(auditPath)) {
+      const auditPath = resolve21(resolveHarnessPaths2(context.projectRoot).logsDir, "audit.jsonl");
+      if (!existsSync13(auditPath)) {
         console.log("No audit log found.");
       } else {
-        const lines = readFileSync8(auditPath, "utf-8").split(/\r?\n/).filter(Boolean).slice(-20);
+        const lines = readFileSync9(auditPath, "utf-8").split(/\r?\n/).filter(Boolean).slice(-20);
         for (const line of lines) {
           console.log(line);
         }
@@ -7540,7 +7691,7 @@ async function connectWorkerStream(options, ctx, state) {
   const buffered = [];
   const wsUrl = await buildRunPiEventsWebSocketUrl(options.context, options.runId);
   const socket = new WebSocket(wsUrl);
-  const closePromise = new Promise((resolve21) => {
+  const closePromise = new Promise((resolve22) => {
     socket.onopen = () => {
       state.wsConnected = true;
       state.status = "live worker Pi WebSocket connected";
@@ -7565,7 +7716,7 @@ async function connectWorkerStream(options, ctx, state) {
       state.wsConnected = false;
       state.status = "worker Pi WebSocket disconnected";
       updatePiUi(ctx, state);
-      resolve21();
+      resolve22();
     };
   });
   try {
@@ -7601,11 +7752,11 @@ async function connectWorkerStream(options, ctx, state) {
 function createRemoteBashOperations(options, state, excludeFromContext) {
   return {
     exec(command, _cwd, execOptions) {
-      return new Promise((resolve21, reject) => {
+      return new Promise((resolve22, reject) => {
         const pending = {
           command,
           onData: execOptions.onData,
-          resolve: resolve21,
+          resolve: resolve22,
           reject,
           sawChunk: false
         };
@@ -8268,6 +8419,33 @@ async function executeRun(context, args) {
       }
       return { ok: true, group: "run", command, details: restarted };
     }
+    case "steer": {
+      const runOption = takeOption(rest, "--run");
+      const messageOption = takeOption(runOption.rest, "--message");
+      const shortMessageOption = takeOption(messageOption.rest, "-m");
+      const positionalRunId = shortMessageOption.rest.length > 0 ? shortMessageOption.rest[0] : undefined;
+      const extra = positionalRunId ? shortMessageOption.rest.slice(1) : shortMessageOption.rest;
+      requireNoExtraArgs(extra, "rig run steer [<run-id>|--run <id>] --message <text>");
+      const runId = runOption.value ?? positionalRunId;
+      const message2 = messageOption.value ?? shortMessageOption.value;
+      if (!runId) {
+        throw new CliError2("run steer requires a run id (positional or --run <id>).", 2);
+      }
+      if (!message2?.trim()) {
+        throw new CliError2("run steer requires --message <text>.", 2);
+      }
+      if (context.dryRun) {
+        if (context.outputMode === "text") {
+          console.log(`[dry-run] rig run steer ${runId} --message ${JSON.stringify(message2)}`);
+        }
+        return { ok: true, group: "run", command, details: { runId, dryRun: true } };
+      }
+      await steerRunViaServer(context, runId, message2.trim());
+      if (context.outputMode === "text") {
+        console.log(`Steering message queued for ${runId}.`);
+      }
+      return { ok: true, group: "run", command, details: { runId, queued: true } };
+    }
     case "stop": {
       const runOption = takeOption(rest, "--run");
       const positionalRunId = runOption.rest.length > 0 ? runOption.rest[0] : undefined;
@@ -8414,9 +8592,9 @@ async function executeServer(context, args, options) {
 
 // packages/cli/src/commands/task.ts
 init_runner();
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 import { spawnSync as spawnSync3 } from "child_process";
-import { resolve as resolve21 } from "path";
+import { resolve as resolve22 } from "path";
 import { cancel as cancel4, confirm as confirm2, isCancel as isCancel4 } from "@clack/prompts";
 import {
   taskArtifactDir,
@@ -8594,6 +8772,7 @@ var PRIMARY_GROUPS = [
       { command: "show <id>|--run <id> [--raw]", description: "Show a human run summary; --raw prints the full payload.", primary: true },
       { command: "attach <run-id>|--run <id> [--follow]", description: "Attach to the run; --follow launches native bundled Pi for live Pi runs.", primary: true },
       { command: "stop [<run-id>|--run <id>]", description: "Request stop for one run or local active runs.", primary: true },
+      { command: "steer <run-id> --message <text>", description: "Queue a steering message into a live worker without attaching." },
       { command: "timeline --run <id> [--follow]", description: "Stream raw run timeline events." },
       { command: "resume", description: "Resume the most recent interrupted local run." },
       { command: "restart", description: "Restart the most recent local run from a clean runtime." },
@@ -8695,6 +8874,19 @@ var ADVANCED_GROUPS = [
       { command: "hp-next <dev|check|e2e|reset>", description: "Drive the hp-next browser test harness." }
     ]
   },
+  {
+    name: "pi",
+    summary: "Manage Pi extension packages for this project (community extensions from npm/git).",
+    usage: ["rig pi <list|add|remove|search> [args]"],
+    commands: [
+      { command: "list", description: "Show project and user Pi extension packages." },
+      { command: "add <source>", description: "Add an npm/git Pi extension to .pi/settings.json (auto-installs at next session)." },
+      { command: "remove <source>", description: "Remove an operator-added Pi extension." },
+      { command: "search [term]", description: "Discover Pi extension packages on the npm registry." }
+    ],
+    examples: ["rig pi search subagents", "rig pi add pi-subagents", "rig pi list"],
+    next: ["Config-managed extensions: declare `runtime: { pi: { packages: [...] } }` in rig.config.ts \u2014 workers pick them up automatically."]
+  },
   {
     name: "plugin",
     summary: "Plugin listing, validation, and plugin-contributed commands.",
@@ -9125,7 +9317,7 @@ async function executeTask(context, args, options) {
       const fileFlag = takeOption(rest.slice(1), "--file");
       let content;
       if (fileFlag.value) {
-        content = readFileSync9(resolve21(context.projectRoot, fileFlag.value), "utf-8");
+        content = readFileSync10(resolve22(context.projectRoot, fileFlag.value), "utf-8");
       } else {
         content = await readStdin();
       }
@@ -9359,8 +9551,8 @@ async function executeTask(context, args, options) {
 
 // packages/cli/src/commands/task-run-driver.ts
 init_runner();
-import { copyFileSync as copyFileSync3, existsSync as existsSync13, mkdirSync as mkdirSync8, readFileSync as readFileSync10, statSync as statSync2, writeFileSync as writeFileSync6 } from "fs";
-import { resolve as resolve22 } from "path";
+import { copyFileSync as copyFileSync3, existsSync as existsSync14, mkdirSync as mkdirSync9, readFileSync as readFileSync11, statSync as statSync2, writeFileSync as writeFileSync7 } from "fs";
+import { resolve as resolve23 } from "path";
 import { spawn as spawn2, spawnSync as spawnSync4 } from "child_process";
 import { createInterface as createLineInterface } from "readline";
 import { loadConfig as loadConfig2 } from "@rig/core/load-config";
@@ -9443,12 +9635,12 @@ function copyUntrackedDirtyFiles(sourceRoot, targetRoot) {
     return 0;
   let copied = 0;
   for (const relativePath of listed.stdout.split("\x00").filter(Boolean)) {
-    const sourcePath = resolve22(sourceRoot, relativePath);
-    const targetPath = resolve22(targetRoot, relativePath);
+    const sourcePath = resolve23(sourceRoot, relativePath);
+    const targetPath = resolve23(targetRoot, relativePath);
     try {
       if (!statSync2(sourcePath).isFile())
         continue;
-      mkdirSync8(resolve22(targetPath, ".."), { recursive: true });
+      mkdirSync9(resolve23(targetPath, ".."), { recursive: true });
       copyFileSync3(sourcePath, targetPath);
       copied += 1;
     } catch {}
@@ -9487,7 +9679,7 @@ function buildDirtyBaselineHandshakeEnv(input) {
     return { RIG_BASELINE_MODE: input.baselineMode ?? "head" };
   return {
     RIG_BASELINE_MODE: "dirty-snapshot",
-    RIG_DIRTY_BASELINE_READY_FILE: resolve22(input.projectRoot, ".rig", "runs", input.runId, "dirty-baseline.ready.json")
+    RIG_DIRTY_BASELINE_READY_FILE: resolve23(input.projectRoot, ".rig", "runs", input.runId, "dirty-baseline.ready.json")
   };
 }
 function positiveInt(value, fallback) {
@@ -9598,9 +9790,9 @@ function createCommandRunner(binary) {
     const stderrChunks = [];
     child.stdout.on("data", (chunk) => stdoutChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk))));
     child.stderr.on("data", (chunk) => stderrChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk))));
-    return await new Promise((resolve23) => {
-      child.once("error", (error) => resolve23({ exitCode: 1, stderr: error.message }));
-      child.once("close", (code) => resolve23({
+    return await new Promise((resolve24) => {
+      child.once("error", (error) => resolve24({ exitCode: 1, stderr: error.message }));
+      child.once("close", (code) => resolve24({
         exitCode: code ?? 1,
         stdout: Buffer.concat(stdoutChunks).toString("utf8"),
         stderr: Buffer.concat(stderrChunks).toString("utf8")
@@ -9674,7 +9866,7 @@ async function runTaskRunPostValidationLifecycle(input) {
     config,
     sourceTask: input.sourceTask,
     uploadedSnapshot: input.uploadedSnapshot,
-    artifactRoot: resolve22(input.projectRoot, "artifacts", taskId3),
+    artifactRoot: resolve23(input.projectRoot, "artifacts", taskId3),
     command: ghCommand,
     gitCommand,
     steerPi,
@@ -9804,7 +9996,7 @@ function summarizeValidationFailure(projectRoot, taskId3) {
     return null;
   }
   for (const artifactDir of resolveTaskArtifactDirs2(projectRoot, taskId3)) {
-    const summary = readJsonFile3(resolve22(artifactDir, "validation-summary.json"), null);
+    const summary = readJsonFile3(resolve23(artifactDir, "validation-summary.json"), null);
     if (!summary || summary.status !== "fail") {
       continue;
     }
@@ -9885,9 +10077,9 @@ function readTaskRunAcceptedArtifactState(input) {
   if (!input.taskId || !input.workspaceDir) {
     return { accepted: false, reason: null };
   }
-  const artifactDir = resolve22(input.workspaceDir, "artifacts", input.taskId);
-  const reviewStatusPath = resolve22(artifactDir, "review-status.txt");
-  const taskResultPath = resolve22(artifactDir, "task-result.json");
+  const artifactDir = resolve23(input.workspaceDir, "artifacts", input.taskId);
+  const reviewStatusPath = resolve23(artifactDir, "review-status.txt");
+  const taskResultPath = resolve23(artifactDir, "task-result.json");
   const reviewStatus = readTaskRunReviewStatus(reviewStatusPath);
   if (reviewStatus !== "APPROVED") {
     return { accepted: false, reason: null };
@@ -9924,12 +10116,12 @@ function resolveTaskRunRetryContext(input) {
   if (!input.taskId || !input.workspaceDir) {
     return { shouldRetry: false, failureDetail: null, nextPrompt: null };
   }
-  const artifactDir = resolve22(input.workspaceDir, "artifacts", input.taskId);
-  const reviewStatePath = resolve22(artifactDir, "review-state.json");
-  const reviewFeedbackPath = resolve22(artifactDir, "review-feedback.md");
-  const reviewStatusPath = resolve22(artifactDir, "review-status.txt");
-  const failedApproachesPath = resolve22(input.workspaceDir, ".rig", "state", "failed_approaches.md");
-  const validationSummaryPath = resolve22(artifactDir, "validation-summary.json");
+  const artifactDir = resolve23(input.workspaceDir, "artifacts", input.taskId);
+  const reviewStatePath = resolve23(artifactDir, "review-state.json");
+  const reviewFeedbackPath = resolve23(artifactDir, "review-feedback.md");
+  const reviewStatusPath = resolve23(artifactDir, "review-status.txt");
+  const failedApproachesPath = resolve23(input.workspaceDir, ".rig", "state", "failed_approaches.md");
+  const validationSummaryPath = resolve23(artifactDir, "validation-summary.json");
   const reviewState = readJsonFile3(reviewStatePath, null);
   const reviewStatus = readTaskRunReviewStatus(reviewStatusPath);
   const reviewRejected = isTaskRunReviewRejected(reviewState);
@@ -10115,11 +10307,11 @@ function appendToolTimelineFromLog(input) {
   });
 }
 function readTaskRunReviewStatus(reviewStatusPath) {
-  if (!existsSync13(reviewStatusPath)) {
+  if (!existsSync14(reviewStatusPath)) {
     return null;
   }
   try {
-    const status = readFileSync10(reviewStatusPath, "utf8").trim().toUpperCase();
+    const status = readFileSync11(reviewStatusPath, "utf8").trim().toUpperCase();
     return status === "APPROVED" || status === "REJECTED" ? status : null;
   } catch {
     return null;
@@ -10333,15 +10525,15 @@ async function executeRigOwnedTaskRun(context, input) {
   const loadedAutomationConfig = await loadTaskRunAutomationConfig(context.projectRoot);
   const automationConfig = input.prMode ? { ...loadedAutomationConfig ?? {}, pr: { ...loadedAutomationConfig?.pr ?? {}, mode: input.prMode } } : loadedAutomationConfig;
   const planningClassification = classifyPlanningNeed({ config: automationConfig, sourceTask });
-  const planningArtifactPath = resolve22("artifacts", runtimeTaskId, "implementation-plan.md");
+  const planningArtifactPath = resolve23("artifacts", runtimeTaskId, "implementation-plan.md");
   const persistedPlanning = {
     ...planningClassification,
     classifier: input.runtimeAdapter === "pi" ? "pi-rig-structured-policy" : "rig-structured-policy",
     artifactPath: planningClassification.planningRequired ? planningArtifactPath : null,
     classifiedAt: new Date().toISOString()
   };
-  mkdirSync8(resolve22(context.projectRoot, ".rig", "runs", input.runId), { recursive: true });
-  writeFileSync6(resolve22(context.projectRoot, ".rig", "runs", input.runId, "planning-classification.json"), `${JSON.stringify(persistedPlanning, null, 2)}
+  mkdirSync9(resolve23(context.projectRoot, ".rig", "runs", input.runId), { recursive: true });
+  writeFileSync7(resolve23(context.projectRoot, ".rig", "runs", input.runId, "planning-classification.json"), `${JSON.stringify(persistedPlanning, null, 2)}
 `, "utf8");
   patchAuthorityRun(context.projectRoot, input.runId, { planning: persistedPlanning });
   prompt = `${prompt}
@@ -10391,7 +10583,7 @@ ${planningClassification.planningRequired ? `Before implementing, write a concis
   let verificationStarted = false;
   let reviewStarted = false;
   let latestRuntimeWorkspace = resumeMode && typeof existingRunRecord?.worktreePath === "string" ? existingRunRecord.worktreePath : null;
-  let latestSessionDir = resumeMode && typeof existingRunRecord?.sessionPath === "string" ? resolve22(existingRunRecord.sessionPath, "..") : null;
+  let latestSessionDir = resumeMode && typeof existingRunRecord?.sessionPath === "string" ? resolve23(existingRunRecord.sessionPath, "..") : null;
   let latestLogsDir = resumeMode && typeof existingRunRecord?.logRoot === "string" ? existingRunRecord.logRoot : null;
   let latestProviderCommand = null;
   let latestRuntimeBranch = resumeMode && typeof existingRunRecord?.branch === "string" ? existingRunRecord.branch : null;
@@ -10477,10 +10669,10 @@ ${planningClassification.planningRequired ? `Before implementing, write a concis
       patchAuthorityRun(context.projectRoot, input.runId, {
         status: "running",
         worktreePath: latestRuntimeWorkspace,
-        artifactRoot: latestRuntimeWorkspace && input.taskId ? resolve22(latestRuntimeWorkspace, "artifacts", input.taskId) : null,
+        artifactRoot: latestRuntimeWorkspace && input.taskId ? resolve23(latestRuntimeWorkspace, "artifacts", input.taskId) : null,
         logRoot: latestLogsDir,
-        sessionPath: latestSessionDir ? resolve22(latestSessionDir, "session.json") : null,
-        sessionLogPath: latestLogsDir ? resolve22(latestLogsDir, "agent-stdout.log") : null,
+        sessionPath: latestSessionDir ? resolve23(latestSessionDir, "session.json") : null,
+        sessionLogPath: latestLogsDir ? resolve23(latestLogsDir, "agent-stdout.log") : null,
         branch: runtimeId
       });
       if (!dirtyBaselineApplied && input.baselineMode === "dirty-snapshot" && latestRuntimeWorkspace) {
@@ -10488,8 +10680,8 @@ ${planningClassification.planningRequired ? `Before implementing, write a concis
         const dirty = applyDirtyBaselineSnapshot({ sourceRoot: context.projectRoot, targetRoot: latestRuntimeWorkspace });
         const readyFile = childEnv.RIG_DIRTY_BASELINE_READY_FILE;
         if (readyFile) {
-          mkdirSync8(resolve22(readyFile, ".."), { recursive: true });
-          writeFileSync6(readyFile, `${JSON.stringify({ ...dirty, workspaceDir: latestRuntimeWorkspace, appliedAt: new Date().toISOString() }, null, 2)}
+          mkdirSync9(resolve23(readyFile, ".."), { recursive: true });
+          writeFileSync7(readyFile, `${JSON.stringify({ ...dirty, workspaceDir: latestRuntimeWorkspace, appliedAt: new Date().toISOString() }, null, 2)}
 `, "utf8");
         }
         appendRunLog(context.projectRoot, input.runId, {
@@ -10873,7 +11065,7 @@ ${planningClassification.planningRequired ? `Before implementing, write a concis
     let acceptedArtifactObservedAt = null;
     let acceptedArtifactPollTimer = null;
     let acceptedArtifactKillTimer = null;
-    const attemptExit = await new Promise((resolve23) => {
+    const attemptExit = await new Promise((resolve24) => {
       let settled = false;
       const settle = (result) => {
         if (settled)
@@ -10881,7 +11073,7 @@ ${planningClassification.planningRequired ? `Before implementing, write a concis
         settled = true;
         if (acceptedArtifactPollTimer)
           clearInterval(acceptedArtifactPollTimer);
-        resolve23(result);
+        resolve24(result);
       };
       const pollAcceptedArtifacts = () => {
         const artifactState = readTaskRunAcceptedArtifactState({
@@ -11083,8 +11275,8 @@ Failed to update task source for ${input.taskId ?? runtimeTaskId} to failed: ${e
   }
   if (planningClassification.planningRequired) {
     const planWorkspace = latestRuntimeWorkspace ?? context.projectRoot;
-    const expectedPlanPath = resolve22(planWorkspace, planningArtifactPath);
-    if (!existsSync13(expectedPlanPath)) {
+    const expectedPlanPath = resolve23(planWorkspace, planningArtifactPath);
+    if (!existsSync14(expectedPlanPath)) {
       const failedAt = new Date().toISOString();
       const failureDetail = `Planning was required (${planningClassification.reason}) but ${planningArtifactPath} was not written before implementation completed.`;
       patchAuthorityRun(context.projectRoot, input.runId, {
@@ -11254,9 +11446,9 @@ Failed to update task source for ${input.taskId ?? runtimeTaskId} to failed: ${e
       });
       emitServerRunEvent({ type: "log", runId: input.runId, title: "Pi PR feedback fix stderr" });
     });
-    const exitCode = await new Promise((resolve23) => {
-      child.once("error", () => resolve23(1));
-      child.once("close", (code) => resolve23(code ?? 1));
+    const exitCode = await new Promise((resolve24) => {
+      child.once("error", () => resolve24(1));
+      child.once("close", (code) => resolve24(code ?? 1));
     });
     for (const pendingLog of flushPendingClaudeToolUseLogs({
       runId: input.runId,
@@ -11398,8 +11590,8 @@ async function executeTest(context, args) {
 
 // packages/cli/src/commands/setup.ts
 init_runner();
-import { existsSync as existsSync14, mkdirSync as mkdirSync9, readdirSync as readdirSync2, writeFileSync as writeFileSync7 } from "fs";
-import { resolve as resolve23 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync10, readdirSync as readdirSync2, writeFileSync as writeFileSync8 } from "fs";
+import { resolve as resolve24 } from "path";
 import { createPluginHost } from "@rig/core";
 import {
   isSupportedBunVersion as isSupportedBunVersion2,
@@ -11454,12 +11646,12 @@ function runSetupInit(projectRoot) {
   const stateDir = resolveControlPlaneHostStateDir(projectRoot);
   const logsDir = resolveControlPlaneHostLogsDir(projectRoot);
   const artifactsDir = resolveControlPlaneArtifactsDir(projectRoot);
-  mkdirSync9(stateDir, { recursive: true });
-  mkdirSync9(logsDir, { recursive: true });
-  mkdirSync9(artifactsDir, { recursive: true });
-  const failuresPath = resolve23(stateDir, "failed_approaches.md");
-  if (!existsSync14(failuresPath)) {
-    writeFileSync7(failuresPath, `# Failed Approaches
+  mkdirSync10(stateDir, { recursive: true });
+  mkdirSync10(logsDir, { recursive: true });
+  mkdirSync10(artifactsDir, { recursive: true });
+  const failuresPath = resolve24(stateDir, "failed_approaches.md");
+  if (!existsSync15(failuresPath)) {
+    writeFileSync8(failuresPath, `# Failed Approaches
 
 `, "utf-8");
   }
@@ -11476,18 +11668,18 @@ async function runSetupCheck(projectRoot) {
 }
 async function runSetupPreflight(projectRoot) {
   await runSetupCheck(projectRoot);
-  const validationRoot = resolve23(resolveControlPlaneDefinitionRoot(projectRoot), "validation");
-  if (existsSync14(validationRoot)) {
+  const validationRoot = resolve24(resolveControlPlaneDefinitionRoot(projectRoot), "validation");
+  if (existsSync15(validationRoot)) {
     const validators = readdirSync2(validationRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory());
     for (const validator of validators) {
-      const script = resolve23(validationRoot, validator.name, "validate.sh");
-      if (existsSync14(script)) {
+      const script = resolve24(validationRoot, validator.name, "validate.sh");
+      if (existsSync15(script)) {
         console.log(`OK: validator script ${script}`);
       }
     }
   }
-  const hooksRoot = resolve23(resolveControlPlaneDefinitionRoot(projectRoot), "hooks");
-  if (existsSync14(hooksRoot)) {
+  const hooksRoot = resolve24(resolveControlPlaneDefinitionRoot(projectRoot), "hooks");
+  if (existsSync15(hooksRoot)) {
     const hooks = readdirSync2(hooksRoot).filter((name) => name.endsWith(".sh"));
     for (const hook of hooks) {
       console.log(`OK: hook ${hook}`);
@@ -11632,7 +11824,7 @@ var PROJECT_REQUIRED_GROUPS = new Set([
 ]);
 var RIG_CONFIG_FILENAMES = ["rig.config.ts", "rig.config.mts", "rig.config.json"];
 function hasInitializedRigProject(projectRoot) {
-  return RIG_CONFIG_FILENAMES.some((name) => existsSync15(resolve24(projectRoot, name))) || existsSync15(resolve24(projectRoot, ".rig"));
+  return RIG_CONFIG_FILENAMES.some((name) => existsSync16(resolve25(projectRoot, name))) || existsSync16(resolve25(projectRoot, ".rig"));
 }
 function requireInitializedRigProject(context, group) {
   if (hasInitializedRigProject(context.projectRoot)) {
@@ -11658,6 +11850,7 @@ var GROUPS = new Set([
   "review",
   "git",
   "harness",
+  "pi",
   "plugin",
   "queue",
   "agent",
@@ -11803,6 +11996,8 @@ async function executeGroup(context, group, args) {
       return executeGit(context, args);
     case "harness":
       return executeHarness(context, args);
+    case "pi":
+      return executePi(context, args);
     case "plugin":
       return executePlugin(context, args);
     case "queue":
@@ -11832,8 +12027,8 @@ async function executeGroup(context, group, args) {
   }
 }
 // packages/cli/src/launcher.ts
-import { existsSync as existsSync16 } from "fs";
-import { basename as basename2, resolve as resolve25 } from "path";
+import { existsSync as existsSync17 } from "fs";
+import { basename as basename2, resolve as resolve26 } from "path";
 import { loadDotEnvSecrets } from "@rig/runtime/baked-secrets";
 import { RIG_DEFINITION_DIRNAME, RIG_STATE_DIRNAME, resolveNearestRigProjectRoot } from "@rig/runtime/layout";
 function parsePolicyMode(value) {
@@ -11846,7 +12041,7 @@ function parsePolicyMode(value) {
   throw new Error(`Invalid --policy-mode value: ${value}. Use off|observe|enforce.`);
 }
 function hasRigProjectMarker(candidate) {
-  return existsSync16(resolve25(candidate, RIG_DEFINITION_DIRNAME)) || existsSync16(resolve25(candidate, RIG_STATE_DIRNAME)) || existsSync16(resolve25(candidate, "rig.config.ts")) || existsSync16(resolve25(candidate, "rig.config.json")) || existsSync16(resolve25(candidate, ".git"));
+  return existsSync17(resolve26(candidate, RIG_DEFINITION_DIRNAME)) || existsSync17(resolve26(candidate, RIG_STATE_DIRNAME)) || existsSync17(resolve26(candidate, "rig.config.ts")) || existsSync17(resolve26(candidate, "rig.config.json")) || existsSync17(resolve26(candidate, ".git"));
 }
 function resolveProjectRoot({
   envProjectRoot,
@@ -11855,19 +12050,19 @@ function resolveProjectRoot({
   cwd = process.cwd()
 }) {
   if (envProjectRoot) {
-    return resolve25(cwd, envProjectRoot);
+    return resolve26(cwd, envProjectRoot);
   }
   const fallbackImportDir = importDir ?? cwd;
   const execName = basename2(execPath).toLowerCase();
-  const execCandidates = execName === "rig" || execName === "rig.exe" ? [resolve25(execPath, "..", "..")] : [];
-  const candidates = [cwd, ...execCandidates, resolve25(fallbackImportDir, "..")];
+  const execCandidates = execName === "rig" || execName === "rig.exe" ? [resolve26(execPath, "..", "..")] : [];
+  const candidates = [cwd, ...execCandidates, resolve26(fallbackImportDir, "..")];
   for (const candidate of candidates) {
     const nearest = resolveNearestRigProjectRoot(candidate);
     if (hasRigProjectMarker(nearest)) {
       return nearest;
     }
   }
-  return resolve25(cwd);
+  return resolve26(cwd);
 }
 function normalizeCliErrorCode(message2, isCliError) {
   if (message2.startsWith("Invalid --policy-mode value:")) {
@@ -11934,7 +12129,7 @@ async function runRigCli(module, options = {}) {
         runId: context.runId,
         outcome,
         eventsFile: context.eventBus.getEventsFile(),
-        policyFile: resolve25(projectRoot, "rig", "policy", "policy.json"),
+        policyFile: resolve26(projectRoot, "rig", "policy", "policy.json"),
         policyMode: context.policyMode ?? policyMode ?? module.loadPolicy(projectRoot).mode
       }, null, 2));
     }