@h-rig/cli 0.0.6-alpha.34 → 0.0.6-alpha.36

package/dist/src/commands/_help-catalog.js

@@ -112,6 +112,7 @@ var PRIMARY_GROUPS = [
       { command: "show <id>|--run <id> [--raw]", description: "Show a human run summary; --raw prints the full payload.", primary: true },
       { command: "attach <run-id>|--run <id> [--follow]", description: "Attach to the run; --follow launches native bundled Pi for live Pi runs.", primary: true },
       { command: "stop [<run-id>|--run <id>]", description: "Request stop for one run or local active runs.", primary: true },
+      { command: "steer <run-id> --message <text>", description: "Queue a steering message into a live worker without attaching." },
       { command: "timeline --run <id> [--follow]", description: "Stream raw run timeline events." },
       { command: "resume", description: "Resume the most recent interrupted local run." },
       { command: "restart", description: "Restart the most recent local run from a clean runtime." },
@@ -213,6 +214,19 @@ var ADVANCED_GROUPS = [
       { command: "hp-next <dev|check|e2e|reset>", description: "Drive the hp-next browser test harness." }
     ]
   },
+  {
+    name: "pi",
+    summary: "Manage Pi extension packages for this project (community extensions from npm/git).",
+    usage: ["rig pi <list|add|remove|search> [args]"],
+    commands: [
+      { command: "list", description: "Show project and user Pi extension packages." },
+      { command: "add <source>", description: "Add an npm/git Pi extension to .pi/settings.json (auto-installs at next session)." },
+      { command: "remove <source>", description: "Remove an operator-added Pi extension." },
+      { command: "search [term]", description: "Discover Pi extension packages on the npm registry." }
+    ],
+    examples: ["rig pi search subagents", "rig pi add pi-subagents", "rig pi list"],
+    next: ["Config-managed extensions: declare `runtime: { pi: { packages: [...] } }` in rig.config.ts \u2014 workers pick them up automatically."]
+  },
   {
     name: "plugin",
     summary: "Plugin listing, validation, and plugin-contributed commands.",

package/dist/src/commands/_operator-view.js

@@ -802,7 +802,38 @@ function parseWsPayload(message) {
     return JSON.parse(message.data);
   return JSON.parse(Buffer.from(message.data).toString("utf8"));
 }
-async function connectWorkerStream(options, ctx, state) {
+var BRIDGE_LOCAL_COMMANDS = new Set(["detach", "quit", "q", "stop"]);
+function registerDaemonCommandsNatively(pi, options, ctx, state, commands, registered) {
+  for (const command of commands) {
+    const record = recordOf(command);
+    const name = typeof record?.name === "string" ? record.name : "";
+    if (!name || registered.has(name) || BRIDGE_LOCAL_COMMANDS.has(name))
+      continue;
+    registered.add(name);
+    const description = typeof record?.description === "string" ? record.description : undefined;
+    const source = typeof record?.source === "string" ? record.source : "worker";
+    try {
+      pi.registerCommand(name, {
+        description: `[worker ${source}] ${description ?? ""}`.trim(),
+        handler: async (args) => {
+          const text = `/${name}${args ? ` ${args}` : ""}`;
+          appendTranscript(state, "You", text);
+          try {
+            const result = await runRunPiCommandViaServer(options.context, options.runId, text);
+            const message = typeof result.message === "string" ? result.message : "worker command accepted";
+            appendTranscript(state, "System", message);
+            if (state.nativeStream)
+              ctx.ui.notify(message, "info");
+          } catch (error) {
+            reportBridgeError(ctx, state, error instanceof Error ? error.message : String(error));
+          }
+          updatePiUi(ctx, state);
+        }
+      });
+    } catch {}
+  }
+}
+async function connectWorkerStream(options, pi, ctx, state, registeredDaemonCommands) {
   const ready = await waitForWorkerReady(options, ctx, state);
   if (!ready)
     return;
@@ -857,6 +888,7 @@ async function connectWorkerStream(options, ctx, state) {
       const record = recordOf(command);
       return typeof record?.name === "string" ? [`/${record.name}`] : [];
     });
+    registerDaemonCommandsNatively(pi, options, ctx, state, commands, registeredDaemonCommands);
     catchupDone = true;
     for (const payload of buffered.splice(0))
       applyEnvelope(ctx, state, payload);
@@ -984,6 +1016,7 @@ function createRigWorkerPiBridgeExtension(options) {
     };
     if (options.initialMessageSent)
       appendTranscript(state, "System", "Initial message sent to worker Pi daemon.");
+    const registeredDaemonCommands = new Set;
     let nativePiUiContextAvailable = false;
     pi.on("user_bash", (event) => {
       state.nativeStream = Boolean(state.nativeStream || nativePiUiContextAvailable);
@@ -1016,7 +1049,7 @@ function createRigWorkerPiBridgeExtension(options) {
         });
         return { consume: true };
       });
-      connectWorkerStream(options, ctx, state).catch((error) => {
+      connectWorkerStream(options, pi, ctx, state, registeredDaemonCommands).catch((error) => {
         appendTranscript(state, "Error", error instanceof Error ? error.message : String(error));
         updatePiUi(ctx, state);
       });
@@ -1063,8 +1096,6 @@ async function attachRunBundledPiFrontend(context, input) {
       "--no-tools",
       "--no-builtin-tools",
       "--no-skills",
-      "--no-prompt-templates",
-      "--no-themes",
       "--no-context-files",
       "--no-approve"
     ], {

package/dist/src/commands/_pi-frontend.js

@@ -576,7 +576,38 @@ function parseWsPayload(message) {
     return JSON.parse(message.data);
   return JSON.parse(Buffer.from(message.data).toString("utf8"));
 }
-async function connectWorkerStream(options, ctx, state) {
+var BRIDGE_LOCAL_COMMANDS = new Set(["detach", "quit", "q", "stop"]);
+function registerDaemonCommandsNatively(pi, options, ctx, state, commands, registered) {
+  for (const command of commands) {
+    const record = recordOf(command);
+    const name = typeof record?.name === "string" ? record.name : "";
+    if (!name || registered.has(name) || BRIDGE_LOCAL_COMMANDS.has(name))
+      continue;
+    registered.add(name);
+    const description = typeof record?.description === "string" ? record.description : undefined;
+    const source = typeof record?.source === "string" ? record.source : "worker";
+    try {
+      pi.registerCommand(name, {
+        description: `[worker ${source}] ${description ?? ""}`.trim(),
+        handler: async (args) => {
+          const text = `/${name}${args ? ` ${args}` : ""}`;
+          appendTranscript(state, "You", text);
+          try {
+            const result = await runRunPiCommandViaServer(options.context, options.runId, text);
+            const message = typeof result.message === "string" ? result.message : "worker command accepted";
+            appendTranscript(state, "System", message);
+            if (state.nativeStream)
+              ctx.ui.notify(message, "info");
+          } catch (error) {
+            reportBridgeError(ctx, state, error instanceof Error ? error.message : String(error));
+          }
+          updatePiUi(ctx, state);
+        }
+      });
+    } catch {}
+  }
+}
+async function connectWorkerStream(options, pi, ctx, state, registeredDaemonCommands) {
   const ready = await waitForWorkerReady(options, ctx, state);
   if (!ready)
     return;
@@ -631,6 +662,7 @@ async function connectWorkerStream(options, ctx, state) {
       const record = recordOf(command);
       return typeof record?.name === "string" ? [`/${record.name}`] : [];
     });
+    registerDaemonCommandsNatively(pi, options, ctx, state, commands, registeredDaemonCommands);
     catchupDone = true;
     for (const payload of buffered.splice(0))
       applyEnvelope(ctx, state, payload);
@@ -758,6 +790,7 @@ function createRigWorkerPiBridgeExtension(options) {
     };
     if (options.initialMessageSent)
       appendTranscript(state, "System", "Initial message sent to worker Pi daemon.");
+    const registeredDaemonCommands = new Set;
     let nativePiUiContextAvailable = false;
     pi.on("user_bash", (event) => {
       state.nativeStream = Boolean(state.nativeStream || nativePiUiContextAvailable);
@@ -790,7 +823,7 @@ function createRigWorkerPiBridgeExtension(options) {
         });
         return { consume: true };
       });
-      connectWorkerStream(options, ctx, state).catch((error) => {
+      connectWorkerStream(options, pi, ctx, state, registeredDaemonCommands).catch((error) => {
         appendTranscript(state, "Error", error instanceof Error ? error.message : String(error));
         updatePiUi(ctx, state);
       });
@@ -837,8 +870,6 @@ async function attachRunBundledPiFrontend(context, input) {
       "--no-tools",
       "--no-builtin-tools",
       "--no-skills",
-      "--no-prompt-templates",
-      "--no-themes",
       "--no-context-files",
       "--no-approve"
     ], {

package/dist/src/commands/_pi-worker-bridge-extension.js

@@ -566,7 +566,38 @@ function parseWsPayload(message) {
     return JSON.parse(message.data);
   return JSON.parse(Buffer.from(message.data).toString("utf8"));
 }
-async function connectWorkerStream(options, ctx, state) {
+var BRIDGE_LOCAL_COMMANDS = new Set(["detach", "quit", "q", "stop"]);
+function registerDaemonCommandsNatively(pi, options, ctx, state, commands, registered) {
+  for (const command of commands) {
+    const record = recordOf(command);
+    const name = typeof record?.name === "string" ? record.name : "";
+    if (!name || registered.has(name) || BRIDGE_LOCAL_COMMANDS.has(name))
+      continue;
+    registered.add(name);
+    const description = typeof record?.description === "string" ? record.description : undefined;
+    const source = typeof record?.source === "string" ? record.source : "worker";
+    try {
+      pi.registerCommand(name, {
+        description: `[worker ${source}] ${description ?? ""}`.trim(),
+        handler: async (args) => {
+          const text = `/${name}${args ? ` ${args}` : ""}`;
+          appendTranscript(state, "You", text);
+          try {
+            const result = await runRunPiCommandViaServer(options.context, options.runId, text);
+            const message = typeof result.message === "string" ? result.message : "worker command accepted";
+            appendTranscript(state, "System", message);
+            if (state.nativeStream)
+              ctx.ui.notify(message, "info");
+          } catch (error) {
+            reportBridgeError(ctx, state, error instanceof Error ? error.message : String(error));
+          }
+          updatePiUi(ctx, state);
+        }
+      });
+    } catch {}
+  }
+}
+async function connectWorkerStream(options, pi, ctx, state, registeredDaemonCommands) {
   const ready = await waitForWorkerReady(options, ctx, state);
   if (!ready)
     return;
@@ -621,6 +652,7 @@ async function connectWorkerStream(options, ctx, state) {
       const record = recordOf(command);
       return typeof record?.name === "string" ? [`/${record.name}`] : [];
     });
+    registerDaemonCommandsNatively(pi, options, ctx, state, commands, registeredDaemonCommands);
     catchupDone = true;
     for (const payload of buffered.splice(0))
       applyEnvelope(ctx, state, payload);
@@ -748,6 +780,7 @@ function createRigWorkerPiBridgeExtension(options) {
     };
     if (options.initialMessageSent)
       appendTranscript(state, "System", "Initial message sent to worker Pi daemon.");
+    const registeredDaemonCommands = new Set;
     let nativePiUiContextAvailable = false;
     pi.on("user_bash", (event) => {
       state.nativeStream = Boolean(state.nativeStream || nativePiUiContextAvailable);
@@ -780,7 +813,7 @@ function createRigWorkerPiBridgeExtension(options) {
         });
         return { consume: true };
       });
-      connectWorkerStream(options, ctx, state).catch((error) => {
+      connectWorkerStream(options, pi, ctx, state, registeredDaemonCommands).catch((error) => {
         appendTranscript(state, "Error", error instanceof Error ? error.message : String(error));
         updatePiUi(ctx, state);
       });

package/dist/src/commands/_server-client.js

@@ -416,14 +416,6 @@ async function runRunPiCommandViaServer(context, runId, text) {
   });
   return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : { type: "done" };
 }
-async function respondRunPiCommandViaServer(context, runId, requestId, value) {
-  const payload = await requestServerJson(context, `/api/runs/${encodeURIComponent(runId)}/pi/commands/respond`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ requestId, value })
-  });
-  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : { type: "done" };
-}
 async function respondRunPiExtensionUiViaServer(context, runId, requestId, valueOrCancel) {
   const payload = await requestServerJson(context, `/api/runs/${encodeURIComponent(runId)}/pi/extension-ui/respond`, {
     method: "POST",
@@ -487,7 +479,6 @@ export {
   selectNextWorkspaceTaskViaServer,
   runRunPiCommandViaServer,
   respondRunPiExtensionUiViaServer,
-  respondRunPiCommandViaServer,
   requestServerJson,
   registerProjectViaServer,
   prepareRemoteCheckoutViaServer,

package/dist/src/commands/inspect.js

@@ -1,7 +1,7 @@
 // @bun
 // packages/cli/src/commands/inspect.ts
-import { existsSync, readFileSync } from "fs";
-import { resolve } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { resolve as resolve3 } from "path";
 
 // packages/cli/src/runner.ts
 import { EventBus } from "@rig/runtime/control-plane/runtime/events";
@@ -53,6 +53,205 @@ import {
 import { changedFilesForTask } from "@rig/runtime/control-plane/native/task-ops";
 import { resolveHarnessPaths, resolveMonorepoRoot, runCapture } from "@rig/runtime/control-plane/native/utils";
 import { readTaskArtifactPreview } from "@rig/runtime/control-plane/native/workspace-ops";
+
+// packages/cli/src/commands/_server-client.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve2 } from "path";
+import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
+
+// packages/cli/src/commands/_connection-state.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, resolve } from "path";
+function resolveGlobalConnectionsPath(env = process.env) {
+  const explicit = env.RIG_CONNECTIONS_FILE?.trim();
+  if (explicit)
+    return resolve(explicit);
+  const stateDir = env.RIG_GLOBAL_STATE_DIR?.trim();
+  if (stateDir)
+    return resolve(stateDir, "connections.json");
+  return resolve(homedir(), ".rig", "connections.json");
+}
+function resolveRepoConnectionPath(projectRoot) {
+  return resolve(projectRoot, ".rig", "state", "connection.json");
+}
+function readJsonFile(path) {
+  if (!existsSync(path))
+    return null;
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch (error) {
+    throw new CliError2(`Invalid Rig connection state at ${path}: ${error instanceof Error ? error.message : String(error)}`, 1);
+  }
+}
+function normalizeConnection(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const record = value;
+  if (record.kind === "local")
+    return { kind: "local", mode: "auto" };
+  if (record.kind === "remote" && typeof record.baseUrl === "string" && record.baseUrl.trim()) {
+    const baseUrl = record.baseUrl.trim().replace(/\/+$/, "");
+    return { kind: "remote", baseUrl };
+  }
+  return null;
+}
+function readGlobalConnections(options = {}) {
+  const path = resolveGlobalConnectionsPath(options.env ?? process.env);
+  const payload = readJsonFile(path);
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return { connections: {} };
+  }
+  const rawConnections = payload.connections;
+  const connections = {};
+  if (rawConnections && typeof rawConnections === "object" && !Array.isArray(rawConnections)) {
+    for (const [alias, raw] of Object.entries(rawConnections)) {
+      const connection = normalizeConnection(raw);
+      if (connection)
+        connections[alias] = connection;
+    }
+  }
+  return { connections };
+}
+function readRepoConnection(projectRoot) {
+  const payload = readJsonFile(resolveRepoConnectionPath(projectRoot));
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return null;
+  const record = payload;
+  const selected = typeof record.selected === "string" ? record.selected.trim() : "";
+  if (!selected)
+    return null;
+  return {
+    selected,
+    project: typeof record.project === "string" ? record.project : undefined,
+    linkedAt: typeof record.linkedAt === "string" ? record.linkedAt : undefined
+  };
+}
+function resolveSelectedConnection(projectRoot, options = {}) {
+  const repo = readRepoConnection(projectRoot);
+  if (!repo)
+    return null;
+  if (repo.selected === "local")
+    return { alias: "local", connection: { kind: "local", mode: "auto" } };
+  const global = readGlobalConnections(options);
+  const connection = global.connections[repo.selected];
+  if (!connection) {
+    throw new CliError2(`Selected Rig server "${repo.selected}" was not found. Run \`rig server list\` or \`rig server use local\`.`, 1);
+  }
+  return { alias: repo.selected, connection };
+}
+
+// packages/cli/src/commands/_server-client.ts
+var scopedGitHubBearerTokens = new Map;
+function cleanToken(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : null;
+}
+function readPrivateRemoteSessionToken(projectRoot) {
+  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
+  if (!existsSync2(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
+  } catch {
+    return null;
+  }
+}
+function readGitHubBearerTokenForRemote(projectRoot) {
+  const scopedKey = resolve2(projectRoot);
+  if (scopedGitHubBearerTokens.has(scopedKey))
+    return scopedGitHubBearerTokens.get(scopedKey) ?? null;
+  const privateSession = readPrivateRemoteSessionToken(projectRoot);
+  if (privateSession)
+    return privateSession;
+  return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
+}
+async function ensureServerForCli(projectRoot) {
+  try {
+    const selected = resolveSelectedConnection(projectRoot);
+    if (selected?.connection.kind === "remote") {
+      return {
+        baseUrl: selected.connection.baseUrl,
+        authToken: readGitHubBearerTokenForRemote(projectRoot),
+        connectionKind: "remote"
+      };
+    }
+    const connection = await ensureLocalRigServerConnection(projectRoot);
+    return {
+      baseUrl: connection.baseUrl,
+      authToken: connection.authToken,
+      connectionKind: "local"
+    };
+  } catch (error) {
+    if (error instanceof Error) {
+      throw new CliError2(error.message, 1);
+    }
+    throw error;
+  }
+}
+function mergeHeaders(headers, authToken) {
+  const merged = new Headers(headers);
+  if (authToken) {
+    merged.set("authorization", `Bearer ${authToken}`);
+  }
+  return merged;
+}
+function diagnosticMessage(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return null;
+  const record = payload;
+  const diagnostics = Array.isArray(record.diagnostics) ? record.diagnostics : [];
+  const messages = diagnostics.flatMap((entry) => {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry))
+      return [];
+    const diagnostic = entry;
+    const kind = typeof diagnostic.kind === "string" ? diagnostic.kind : "task-source";
+    const message = typeof diagnostic.message === "string" ? diagnostic.message : null;
+    return message ? [`${kind}: ${message}`] : [];
+  });
+  return messages.length > 0 ? messages.join("; ") : null;
+}
+async function requestServerJson(context, pathname, init = {}) {
+  const server = await ensureServerForCli(context.projectRoot);
+  const response = await fetch(`${server.baseUrl}${pathname}`, {
+    ...init,
+    headers: mergeHeaders(init.headers, server.authToken)
+  });
+  const text = await response.text();
+  const payload = text.trim().length > 0 ? (() => {
+    try {
+      return JSON.parse(text);
+    } catch {
+      return null;
+    }
+  })() : null;
+  if (!response.ok) {
+    const diagnostics = diagnosticMessage(payload);
+    const detail = diagnostics ?? (text || response.statusText);
+    throw new CliError2(`Rig server request failed (${response.status}): ${detail}`, 1);
+  }
+  return payload;
+}
+async function listRunsViaServer(context, options = {}) {
+  const url = new URL("http://rig.local/api/runs");
+  if (options.limit !== undefined)
+    url.searchParams.set("limit", String(options.limit));
+  const payload = await requestServerJson(context, `${url.pathname}${url.search}`);
+  const runs = Array.isArray(payload) ? payload : payload && typeof payload === "object" && !Array.isArray(payload) && Array.isArray(payload.runs) ? payload.runs : [];
+  return runs.filter((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry)));
+}
+async function getRunLogsViaServer(context, runId, options = {}) {
+  const url = new URL(`http://rig.local/api/runs/${encodeURIComponent(runId)}/logs`);
+  if (options.limit !== undefined)
+    url.searchParams.set("limit", String(options.limit));
+  if (options.cursor)
+    url.searchParams.set("cursor", options.cursor);
+  const payload = await requestServerJson(context, `${url.pathname}${url.search}`);
+  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : { entries: [] };
+}
+
+// packages/cli/src/commands/inspect.ts
 async function executeInspect(context, args) {
   const [command = "failures", ...rest] = args;
   switch (command) {
@@ -62,10 +261,27 @@ async function executeInspect(context, args) {
       const requiredTask = requireTask(task, "rig inspect logs --task <task-id>");
       const latestRun = listAuthorityRuns(context.projectRoot).map((entry) => readAuthorityRun(context.projectRoot, entry.runId)).filter((run) => Boolean(run)).filter((run) => run.taskId === requiredTask).sort((left, right) => String(right.updatedAt ?? "").localeCompare(String(left.updatedAt ?? "")))[0];
       if (!latestRun) {
-        throw new CliError2(`No runs found for ${requiredTask}.`);
+        const serverRuns = await listRunsViaServer(context, { limit: 200 }).catch(() => []);
+        const serverRun = serverRuns.filter((run) => String(run.taskId ?? "") === requiredTask).sort((left, right) => String(right.updatedAt ?? "").localeCompare(String(left.updatedAt ?? "")))[0];
+        if (!serverRun || typeof serverRun.runId !== "string") {
+          throw new CliError2(`No runs found for ${requiredTask} (local or on the selected server).`);
+        }
+        const page = await getRunLogsViaServer(context, serverRun.runId, { limit: 500 });
+        const entries = Array.isArray(page.entries) ? page.entries : [];
+        if (context.outputMode === "text") {
+          for (const entry of entries) {
+            const record = entry && typeof entry === "object" ? entry : {};
+            const title = String(record.title ?? "");
+            const detail = String(record.detail ?? "");
+            console.log([title, detail].filter(Boolean).join(" \u2014 "));
+          }
+          if (entries.length === 0)
+            console.log(`(no log entries for run ${serverRun.runId})`);
+        }
+        return { ok: true, group: "inspect", command, details: { task: requiredTask, runId: serverRun.runId, source: "server", entries } };
       }
-      const logsPath = resolve(resolveAuthorityRunDir(context.projectRoot, latestRun.runId), "logs.jsonl");
-      if (!existsSync(logsPath)) {
+      const logsPath = resolve3(resolveAuthorityRunDir(context.projectRoot, latestRun.runId), "logs.jsonl");
+      if (!existsSync3(logsPath)) {
         throw new CliError2(`No logs found for run ${latestRun.runId}.`);
       }
       await context.runCommand(["cat", logsPath]);
@@ -75,7 +291,7 @@ async function executeInspect(context, args) {
       const { value: task, rest: remaining } = takeOption(rest, "--task");
       requireNoExtraArgs(remaining, "rig inspect artifacts --task <task-id>");
       const requiredTask = requireTask(task, "rig inspect artifacts --task <task-id>");
-      const artifactRoot = resolveTaskArtifactDirs(context.projectRoot, requiredTask).find((path) => existsSync(path));
+      const artifactRoot = resolveTaskArtifactDirs(context.projectRoot, requiredTask).find((path) => existsSync3(path));
       if (!artifactRoot) {
         throw new CliError2(`No artifacts found for ${requiredTask}.`);
       }
@@ -132,10 +348,10 @@ async function executeInspect(context, args) {
     case "failures": {
       requireNoExtraArgs(rest, "rig inspect failures");
       const failed = resolveHarnessPaths(context.projectRoot).failedApproachesPath;
-      if (!existsSync(failed)) {
+      if (!existsSync3(failed)) {
         console.log("No failures recorded.");
       } else {
-        process.stdout.write(readFileSync(failed, "utf-8"));
+        process.stdout.write(readFileSync3(failed, "utf-8"));
       }
       return { ok: true, group: "inspect", command };
     }
@@ -152,11 +368,11 @@ async function executeInspect(context, args) {
       return { ok: true, group: "inspect", command };
     case "audit": {
       requireNoExtraArgs(rest, "rig inspect audit");
-      const auditPath = resolve(resolveHarnessPaths(context.projectRoot).logsDir, "audit.jsonl");
-      if (!existsSync(auditPath)) {
+      const auditPath = resolve3(resolveHarnessPaths(context.projectRoot).logsDir, "audit.jsonl");
+      if (!existsSync3(auditPath)) {
         console.log("No audit log found.");
       } else {
-        const lines = readFileSync(auditPath, "utf-8").split(/\r?\n/).filter(Boolean).slice(-20);
+        const lines = readFileSync3(auditPath, "utf-8").split(/\r?\n/).filter(Boolean).slice(-20);
         for (const line of lines) {
           console.log(line);
         }