@h-rig/cli 0.0.6-alpha.7 → 0.0.6-alpha.70

package/dist/src/commands/setup.js

@@ -7,12 +7,19 @@ import { resolve as resolve6 } from "path";
 
 // packages/cli/src/runner.ts
 import { EventBus } from "@rig/runtime/control-plane/runtime/events";
-import { CliError } from "@rig/runtime/control-plane/errors";
+import { CliError as RuntimeCliError } from "@rig/runtime/control-plane/errors";
 import { evaluate, loadPolicy, resolveAction } from "@rig/runtime/control-plane/runtime/guard";
-import { PluginManager } from "@rig/runtime/control-plane/runtime/plugins";
-import { loadRuntimeContextFromEnv } from "@rig/runtime/control-plane/runtime/context";
 import { buildBinary } from "@rig/runtime/control-plane/runtime/isolation";
-import { CliError as CliError2 } from "@rig/runtime/control-plane/errors";
+
+class CliError extends RuntimeCliError {
+  hint;
+  constructor(message, exitCode = 1, options = {}) {
+    super(message, exitCode);
+    if (options.hint?.trim()) {
+      this.hint = options.hint.trim();
+    }
+  }
+}
 function requireNoExtraArgs(args, usage) {
   if (args.length > 0) {
     throw new CliError(`Unexpected arguments: ${args.join(" ")}
@@ -102,7 +109,8 @@ function resolveControlPlaneDefinitionRoot(projectRoot) {
 import { existsSync, readFileSync, rmSync } from "fs";
 import { homedir } from "os";
 import { resolve as resolve2 } from "path";
-var PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
+var PI_RIG_PACKAGE_NAME = "@h-rig/pi-rig";
+var LEGACY_PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
 async function defaultCommandRunner(command, options = {}) {
   const proc = Bun.spawn(command, { cwd: options.cwd, stdout: "pipe", stderr: "pipe" });
   const [stdout, stderr, exitCode] = await Promise.all([
@@ -121,7 +129,7 @@ function resolvePiHomeDir(inputHomeDir) {
 function piListContainsPiRig(output) {
   return output.split(/\r?\n/).some((line) => {
     const normalized = line.trim();
-    return normalized.includes(PI_RIG_PACKAGE_NAME) || /(?:^|[\\/])packages[\\/]pi-rig(?:$|\s)/.test(normalized);
+    return normalized.includes(PI_RIG_PACKAGE_NAME) || normalized.includes(LEGACY_PI_RIG_PACKAGE_NAME) || /(?:^|[\\/])packages[\\/]pi-rig(?:$|\s)/.test(normalized);
   });
 }
 async function safeRun(runner, command, options) {
@@ -197,9 +205,14 @@ function readJsonFile(path) {
   try {
     return JSON.parse(readFileSync2(path, "utf8"));
   } catch (error) {
-    throw new CliError2(`Invalid Rig connection state at ${path}: ${error instanceof Error ? error.message : String(error)}`, 1);
+    throw new CliError(`Invalid Rig connection state at ${path}: ${error instanceof Error ? error.message : String(error)}`, 1, { hint: "Fix or delete that file, then re-select a server with `rig server use <alias|local>`." });
   }
 }
+function writeJsonFile(path, value) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(value, null, 2)}
+`, "utf8");
+}
 function normalizeConnection(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return null;
@@ -240,29 +253,47 @@ function readRepoConnection(projectRoot) {
   return {
     selected,
     project: typeof record.project === "string" ? record.project : undefined,
-    linkedAt: typeof record.linkedAt === "string" ? record.linkedAt : undefined
+    linkedAt: typeof record.linkedAt === "string" ? record.linkedAt : undefined,
+    serverProjectRoot: typeof record.serverProjectRoot === "string" && record.serverProjectRoot.trim() ? record.serverProjectRoot.trim() : undefined
   };
 }
+function writeRepoConnection(projectRoot, state) {
+  writeJsonFile(resolveRepoConnectionPath(projectRoot), state);
+}
 function resolveSelectedConnection(projectRoot, options = {}) {
   const repo = readRepoConnection(projectRoot);
   if (!repo)
     return null;
   if (repo.selected === "local")
-    return { alias: "local", connection: { kind: "local", mode: "auto" } };
+    return { alias: "local", connection: { kind: "local", mode: "auto" }, serverProjectRoot: repo.serverProjectRoot };
   const global = readGlobalConnections(options);
   const connection = global.connections[repo.selected];
   if (!connection) {
-    throw new CliError2(`Selected Rig connection "${repo.selected}" was not found. Run \`rig connect list\` or \`rig connect use local\`.`, 1);
+    throw new CliError(`Selected Rig server "${repo.selected}" was not found. Run \`rig server list\` or \`rig server use local\`.`, 1);
   }
-  return { alias: repo.selected, connection };
+  return { alias: repo.selected, connection, serverProjectRoot: repo.serverProjectRoot };
+}
+function writeRepoServerProjectRoot(projectRoot, serverProjectRoot) {
+  const repo = readRepoConnection(projectRoot);
+  if (!repo)
+    return;
+  writeRepoConnection(projectRoot, { ...repo, serverProjectRoot });
 }
 
 // packages/cli/src/commands/_server-client.ts
-import { spawnSync } from "child_process";
 import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
 import { resolve as resolve4 } from "path";
 import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
-var cachedGitHubBearerToken;
+var scopedGitHubBearerTokens = new Map;
+var serverPhaseListener = null;
+function setServerPhaseListener(listener) {
+  const previous = serverPhaseListener;
+  serverPhaseListener = listener;
+  return previous;
+}
+function reportServerPhase(label) {
+  serverPhaseListener?.(label);
+}
 function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
@@ -279,49 +310,80 @@ function readPrivateRemoteSessionToken(projectRoot) {
   }
 }
 function readGitHubBearerTokenForRemote(projectRoot) {
-  if (cachedGitHubBearerToken !== undefined)
-    return cachedGitHubBearerToken;
+  const scopedKey = resolve4(projectRoot);
+  if (scopedGitHubBearerTokens.has(scopedKey))
+    return scopedGitHubBearerTokens.get(scopedKey) ?? null;
   const privateSession = readPrivateRemoteSessionToken(projectRoot);
-  if (privateSession) {
-    cachedGitHubBearerToken = privateSession;
-    return cachedGitHubBearerToken;
-  }
-  const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
-  if (envToken) {
-    cachedGitHubBearerToken = envToken;
-    return cachedGitHubBearerToken;
-  }
-  const result = spawnSync("gh", ["auth", "token"], {
-    encoding: "utf8",
-    timeout: 5000,
-    stdio: ["ignore", "pipe", "ignore"]
-  });
-  cachedGitHubBearerToken = result.status === 0 ? cleanToken(result.stdout) : null;
-  return cachedGitHubBearerToken;
+  if (privateSession)
+    return privateSession;
+  return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
+}
+function readStoredGitHubAuthToken(projectRoot) {
+  const path = resolve4(projectRoot, ".rig", "state", "github-auth.json");
+  if (!existsSync3(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync3(path, "utf8"));
+    return cleanToken(typeof parsed.token === "string" ? parsed.token : undefined);
+  } catch {
+    return null;
+  }
+}
+function readLocalConnectionFallbackToken(projectRoot) {
+  return readGitHubBearerTokenForRemote(projectRoot) ?? cleanToken(process.env.RIG_GITHUB_TOKEN) ?? readStoredGitHubAuthToken(projectRoot);
 }
 async function ensureServerForCli(projectRoot) {
   try {
     const selected = resolveSelectedConnection(projectRoot);
     if (selected?.connection.kind === "remote") {
+      reportServerPhase(`Connecting to ${selected.alias}\u2026`);
+      const authToken = readGitHubBearerTokenForRemote(projectRoot);
+      const serverProjectRoot = selected.serverProjectRoot ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
       return {
         baseUrl: selected.connection.baseUrl,
-        authToken: readGitHubBearerTokenForRemote(projectRoot),
-        connectionKind: "remote"
+        authToken,
+        connectionKind: "remote",
+        serverProjectRoot
       };
     }
+    reportServerPhase("Starting local Rig server\u2026");
     const connection = await ensureLocalRigServerConnection(projectRoot);
     return {
       baseUrl: connection.baseUrl,
-      authToken: connection.authToken,
-      connectionKind: "local"
+      authToken: connection.authToken ?? readLocalConnectionFallbackToken(projectRoot),
+      connectionKind: "local",
+      serverProjectRoot: resolve4(projectRoot)
     };
   } catch (error) {
     if (error instanceof Error) {
-      throw new CliError2(error.message, 1);
+      throw new CliError(error.message, 1);
     }
     throw error;
   }
 }
+async function backfillRemoteServerProjectRoot(projectRoot, baseUrl, authToken) {
+  const repo = readRepoConnection(projectRoot);
+  const slug = repo?.project?.trim();
+  if (!slug)
+    return null;
+  try {
+    const response = await fetch(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`, {
+      headers: mergeHeaders(undefined, authToken)
+    });
+    if (!response.ok)
+      return null;
+    const payload = await response.json();
+    const project = payload.project && typeof payload.project === "object" && !Array.isArray(payload.project) ? payload.project : null;
+    const checkouts = Array.isArray(project?.checkouts) ? project.checkouts : [];
+    const latestCheckout = [...checkouts].reverse().find((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry) && typeof entry.path === "string"));
+    const path = typeof latestCheckout?.path === "string" && latestCheckout.path.trim() ? latestCheckout.path.trim() : null;
+    if (path)
+      writeRepoServerProjectRoot(projectRoot, path);
+    return path;
+  } catch {
+    return null;
+  }
+}
 function mergeHeaders(headers, authToken) {
   const merged = new Headers(headers);
   if (authToken) {
@@ -344,12 +406,65 @@ function diagnosticMessage(payload) {
   });
   return messages.length > 0 ? messages.join("; ") : null;
 }
+var serverReachabilityCache = new Map;
+async function probeServerReachability(baseUrl, authToken) {
+  try {
+    const response = await fetch(`${baseUrl.replace(/\/+$/, "")}/api/server/status`, {
+      headers: mergeHeaders(undefined, authToken),
+      signal: AbortSignal.timeout(1500)
+    });
+    return response.ok;
+  } catch {
+    return false;
+  }
+}
+function cachedServerReachability(projectRoot, baseUrl, authToken) {
+  const key = resolve4(projectRoot);
+  const cached = serverReachabilityCache.get(key);
+  if (cached)
+    return cached;
+  const probe = probeServerReachability(baseUrl, authToken);
+  serverReachabilityCache.set(key, probe);
+  return probe;
+}
+function describeSelectedServer(projectRoot, server) {
+  try {
+    const selected = resolveSelectedConnection(projectRoot);
+    if (selected) {
+      return {
+        alias: selected.alias,
+        target: selected.connection.kind === "remote" ? selected.connection.baseUrl : server.baseUrl
+      };
+    }
+  } catch {}
+  return { alias: server.connectionKind === "remote" ? "remote" : "local", target: server.baseUrl };
+}
+async function buildServerFailureContext(projectRoot, server) {
+  const { alias, target } = describeSelectedServer(projectRoot, server);
+  const reachable = await cachedServerReachability(projectRoot, server.baseUrl, server.authToken);
+  const reachability = reachable ? "server is reachable" : "server is unreachable";
+  return {
+    contextLine: `Currently connected to: ${alias} at ${target} (${reachability}).`,
+    hint: "Check the selected server with `rig server status`, or switch with `rig server use <alias|local>`."
+  };
+}
 async function requestServerJson(context, pathname, init = {}) {
   const server = await ensureServerForCli(context.projectRoot);
-  const response = await fetch(`${server.baseUrl}${pathname}`, {
-    ...init,
-    headers: mergeHeaders(init.headers, server.authToken)
-  });
+  const headers = mergeHeaders(init.headers, server.authToken);
+  if (server.serverProjectRoot)
+    headers.set("x-rig-project-root", server.serverProjectRoot);
+  reportServerPhase(`${(init.method ?? "GET").toUpperCase()} ${pathname.split("?")[0]}\u2026`);
+  let response;
+  try {
+    response = await fetch(`${server.baseUrl}${pathname}`, {
+      ...init,
+      headers
+    });
+  } catch (error) {
+    const failure = await buildServerFailureContext(context.projectRoot, server);
+    throw new CliError(`Rig server request failed: ${error instanceof Error ? error.message : String(error)}
+${failure.contextLine}`, 1, { hint: failure.hint });
+  }
   const text = await response.text();
   const payload = text.trim().length > 0 ? (() => {
     try {
@@ -361,10 +476,23 @@ async function requestServerJson(context, pathname, init = {}) {
   if (!response.ok) {
     const diagnostics = diagnosticMessage(payload);
     const detail = diagnostics ?? (text || response.statusText);
-    throw new CliError2(`Rig server request failed (${response.status}): ${detail}`, 1);
+    const failure = await buildServerFailureContext(context.projectRoot, server);
+    throw new CliError(`Rig server request failed (${response.status}): ${detail}
+${failure.contextLine}`, 1, { hint: failure.hint });
   }
   return payload;
 }
+var RESUMABLE_RUN_STATUSES = new Set([
+  "created",
+  "preparing",
+  "running",
+  "validating",
+  "reviewing",
+  "stopped",
+  "failed",
+  "needs-attention",
+  "needs_attention"
+]);
 
 // packages/cli/src/commands/_doctor-checks.ts
 function check(id, label, status, detail, remediation) {
@@ -485,7 +613,10 @@ async function runRigDoctorChecks(options) {
   const bunVersion = options.bunVersion ?? Bun.version;
   const request = options.requestJson ?? ((pathname, init) => requestServerJson({ projectRoot }, pathname, init));
   const loadConfig = options.loadConfig ?? loadRigConfigOrNull;
+  const progress = options.onProgress ?? (() => {});
+  progress("Checking local toolchain\u2026");
   checks.push(check("bun", `bun >= ${MIN_SUPPORTED_BUN_VERSION}`, isSupportedBunVersion(bunVersion) ? "pass" : "fail", `found ${bunVersion}`, `Install Bun ${MIN_SUPPORTED_BUN_VERSION} or newer.`), check("git", "git", which("git") ? "pass" : "fail", which("git") ?? undefined, "Install git and ensure it is on PATH."), check("jq", "jq", which("jq") ? "pass" : "warn", which("jq") ?? undefined, "Install jq (for example `brew install jq`)."));
+  progress("Loading rig.config\u2026");
   const loadedConfig = await loadConfig(projectRoot).catch(() => null);
   const config = loadedConfig ?? loadFallbackConfig(projectRoot);
   const hasConfigFile = ["rig.config.ts", "rig.config.mts", "rig.config.json"].some((name) => existsSync4(resolve5(projectRoot, name)));
@@ -493,7 +624,7 @@ async function runRigDoctorChecks(options) {
   const taskSourceKind = config?.taskSource?.kind;
   checks.push(taskSourceKind ? check("task-source", "task source configured", "pass", taskSourceKind) : check("task-source", "task source configured", "fail", "missing taskSource", "Configure taskSource in rig.config.ts."));
   const repo = readRepoConnection(projectRoot);
-  checks.push(repo ? check("project-link", "repo selected Rig connection", repo.project ? "pass" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : ""}`, "Run `rig init --yes --repo owner/repo` to link this checkout to a GitHub repo slug.") : check("project-link", "repo selected Rig connection", "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig connect use <alias|local>`."));
+  checks.push(repo ? check("project-link", "repo selected Rig server", repo.project ? "pass" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : ""}`, "Run `rig init --yes --repo owner/repo` to link this checkout to a GitHub repo slug.") : check("project-link", "repo selected Rig server", "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig server use <alias|local>`."));
   const selected = (() => {
     try {
       return resolveSelectedConnection(projectRoot);
@@ -501,9 +632,10 @@ async function runRigDoctorChecks(options) {
       return null;
     }
   })();
-  checks.push(selected ? check("connection", "selected server connection", "pass", selected.connection.kind === "remote" ? selected.connection.baseUrl : "local auto") : check("connection", "selected server connection", repo ? "fail" : "warn", repo ? "selected alias is missing" : "will auto-start local server", repo ? "Run `rig connect list` and `rig connect use <alias|local>`." : undefined));
+  checks.push(selected ? check("connection", "selected server connection", "pass", selected.connection.kind === "remote" ? selected.connection.baseUrl : "local auto") : check("connection", "selected server", repo ? "fail" : "warn", repo ? "selected alias is missing" : "will auto-start local server", repo ? "Run `rig server list` and `rig server use <alias|local>`." : undefined));
   let server = null;
   try {
+    progress("Connecting to the selected Rig server\u2026");
     server = await (options.resolveServer ?? ensureServerForCli)(projectRoot);
     checks.push(check("server", "Rig server reachable", "pass", `${server.connectionKind} ${server.baseUrl}`));
   } catch (error) {
@@ -511,18 +643,21 @@ async function runRigDoctorChecks(options) {
   }
   if (server || options.requestJson) {
     try {
+      progress("Checking server status\u2026");
       const status = await request("/api/server/status");
       checks.push(check("server-status", "server project status", "pass", JSON.stringify(status).slice(0, 180)));
     } catch (error) {
       checks.push(check("server-status", "server project status", "fail", errorMessage(error), "Run `rig doctor` after the selected server is reachable."));
     }
     try {
+      progress("Checking GitHub auth\u2026");
       const auth = await request("/api/github/auth/status");
       checks.push(isAuthenticated(auth) ? check("github-auth", "GitHub auth", "pass") : check("github-auth", "GitHub auth", "fail", "not authenticated", "Run `rig github auth import-gh` or `rig github auth token --token <token>`."));
     } catch (error) {
       checks.push(check("github-auth", "GitHub auth", "fail", errorMessage(error), "Authenticate GitHub through Rig and ensure the server exposes auth status."));
     }
     try {
+      progress("Checking GitHub repo permissions\u2026");
       const permissions = await request("/api/github/repo/permissions");
       const allowed = permissionAllowsPr(permissions);
       checks.push(allowed === true ? check("github-repo-permissions", "GitHub repo PR permissions", "pass", JSON.stringify(permissions).slice(0, 180)) : allowed === false ? check("github-repo-permissions", "GitHub repo PR permissions", "fail", JSON.stringify(permissions).slice(0, 180), "Grant the selected GitHub token permission to push branches, open PRs, and merge according to repo rules.") : check("github-repo-permissions", "GitHub repo PR permissions", "warn", JSON.stringify(permissions).slice(0, 180), "Confirm the selected token can push branches and open PRs."));
@@ -530,6 +665,7 @@ async function runRigDoctorChecks(options) {
       checks.push(check("github-repo-permissions", "GitHub repo PR permissions", "warn", errorMessage(error), "Ensure the server exposes repo permission checks and the token can open PRs."));
     }
     try {
+      progress("Checking GitHub issue labels\u2026");
       const labels = await request("/api/workspace/task-labels");
       const ready = labelsReady(labels);
       checks.push(ready === false ? check("task-labels", "GitHub issue labels", "fail", JSON.stringify(labels).slice(0, 180), "Let Rig create required labels or create the configured lifecycle labels manually.") : check("task-labels", "GitHub issue labels", ready === true ? "pass" : "warn", JSON.stringify(labels).slice(0, 180), "Confirm required Rig lifecycle labels exist."));
@@ -537,6 +673,7 @@ async function runRigDoctorChecks(options) {
       checks.push(check("task-labels", "GitHub issue labels", "warn", errorMessage(error), "Run `rig init`/`rig doctor` after label setup is wired on the server."));
     }
     try {
+      progress("Checking task projection\u2026");
       const projection = await request("/api/workspace/task-projection");
       checks.push(check("task-projection", "task projection", "pass", JSON.stringify(projection).slice(0, 180)));
     } catch (error) {
@@ -545,6 +682,7 @@ async function runRigDoctorChecks(options) {
     const slug = projectStatusSlug(projectRoot, config);
     if (slug) {
       try {
+        progress("Checking server project checkout\u2026");
         const project = await request(`/api/projects/${encodeURIComponent(slug)}`);
         checks.push(check("remote-checkout", "server project checkout", "pass", JSON.stringify(project).slice(0, 180)));
       } catch (error) {
@@ -559,6 +697,7 @@ async function runRigDoctorChecks(options) {
   }
   checks.push(githubProjectsCheck(config));
   checks.push(prMergeCheck(config));
+  progress("Checking Pi installation\u2026");
   const piChecks = await (options.piChecks ?? (() => buildPiSetupChecks()))().catch((error) => [{
     ok: false,
     label: "pi/pi-rig checks",
@@ -582,12 +721,133 @@ function countDoctorFailures(checks) {
   return checks.filter((entry) => entry.status === "fail").length;
 }
 
+// packages/cli/src/commands/_async-ui.ts
+import pc from "picocolors";
+
+// packages/cli/src/commands/_spinner.ts
+var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+function createTtySpinner(input) {
+  const output = input.output ?? process.stdout;
+  const isTty = output.isTTY === true;
+  const frames = input.frames && input.frames.length > 0 ? input.frames : SPINNER_FRAMES;
+  let label = input.label;
+  let frame = 0;
+  let paused = false;
+  let stopped = false;
+  let lastPrintedLabel = "";
+  const render = () => {
+    if (stopped || paused)
+      return;
+    if (!isTty) {
+      if (label !== lastPrintedLabel) {
+        output.write(`${label}
+`);
+        lastPrintedLabel = label;
+      }
+      return;
+    }
+    frame = (frame + 1) % frames.length;
+    const glyph = frames[frame] ?? frames[0] ?? "";
+    output.write(`\r\x1B[2K${input.styleFrame ? input.styleFrame(glyph) : glyph} ${label}`);
+  };
+  const clearLine = () => {
+    if (isTty)
+      output.write("\r\x1B[2K");
+  };
+  render();
+  const timer = isTty ? setInterval(render, input.intervalMs ?? 120) : null;
+  return {
+    setLabel(next) {
+      label = next;
+      render();
+    },
+    pause() {
+      paused = true;
+      clearLine();
+    },
+    resume() {
+      if (stopped)
+        return;
+      paused = false;
+      render();
+    },
+    stop(finalLine) {
+      if (stopped)
+        return;
+      stopped = true;
+      if (timer)
+        clearInterval(timer);
+      clearLine();
+      if (finalLine)
+        output.write(`${finalLine}
+`);
+    }
+  };
+}
+
+// packages/cli/src/commands/_async-ui.ts
+var CLACK_SPINNER_FRAMES = ["\u25D2", "\u25D0", "\u25D3", "\u25D1"];
+var DONE_SYMBOL = pc.green("\u25C7");
+var FAIL_SYMBOL = pc.red("\u25A0");
+var activeUpdate = null;
+async function withSpinner(label, work, options = {}) {
+  if (options.outputMode === "json") {
+    return work(() => {});
+  }
+  if (activeUpdate) {
+    const outer = activeUpdate;
+    outer(label);
+    return work(outer);
+  }
+  const output = options.output ?? process.stderr;
+  const isTty = output.isTTY === true;
+  let lastLabel = label;
+  if (!isTty) {
+    output.write(`${label}
+`);
+    const update2 = (next) => {
+      lastLabel = next;
+    };
+    activeUpdate = update2;
+    const previousListener2 = setServerPhaseListener(update2);
+    try {
+      return await work(update2);
+    } finally {
+      activeUpdate = null;
+      setServerPhaseListener(previousListener2);
+    }
+  }
+  const spinner = createTtySpinner({
+    label,
+    output,
+    frames: CLACK_SPINNER_FRAMES,
+    styleFrame: (frame) => pc.magenta(frame)
+  });
+  const update = (next) => {
+    lastLabel = next;
+    spinner.setLabel(next);
+  };
+  activeUpdate = update;
+  const previousListener = setServerPhaseListener(update);
+  try {
+    const result = await work(update);
+    spinner.stop(options.doneLabel ? `${DONE_SYMBOL} ${options.doneLabel}` : undefined);
+    return result;
+  } catch (error) {
+    spinner.stop(`${FAIL_SYMBOL} ${lastLabel}`);
+    throw error;
+  } finally {
+    activeUpdate = null;
+    setServerPhaseListener(previousListener);
+  }
+}
+
 // packages/cli/src/commands/setup.ts
 async function executeSetup(context, args) {
   const [command = "check", ...rest] = args;
   switch (command) {
     case "bootstrap":
-      requireNoExtraArgs(rest, "bun run rig setup bootstrap");
+      requireNoExtraArgs(rest, "rig setup bootstrap");
       {
         const hostBash = Bun.which("bash") || "/bin/bash";
         const env = { ...process.env };
@@ -605,32 +865,26 @@ async function executeSetup(context, args) {
         });
         const exitCode = await proc.exited;
         if (exitCode !== 0) {
-          throw new CliError2(`Command failed (${exitCode}): ${hostBash} ./bootstrap.sh`, exitCode);
+          throw new CliError(`Command failed (${exitCode}): ${hostBash} ./bootstrap.sh`, exitCode);
         }
       }
       return { ok: true, group: "setup", command };
     case "check":
-      requireNoExtraArgs(rest, `bun run rig setup ${command}`);
+      requireNoExtraArgs(rest, `rig setup ${command}`);
       {
-        const checks = await withMutedConsole(context.outputMode === "json", () => runSetupCheck(context.projectRoot));
+        const checks = await withMutedConsole(context.outputMode === "json", () => runSetupCheck(context.projectRoot, context.outputMode));
         return { ok: true, group: "setup", command, details: { checks, failures: countDoctorFailures(checks) } };
       }
     case "setup":
-      requireNoExtraArgs(rest, "bun run rig setup setup");
+      requireNoExtraArgs(rest, "rig setup setup");
       withMutedConsole(context.outputMode === "json", () => runSetupInit(context.projectRoot));
       return { ok: true, group: "setup", command };
     case "preflight":
-      requireNoExtraArgs(rest, "bun run rig setup preflight");
-      await withMutedConsole(context.outputMode === "json", () => runSetupPreflight(context.projectRoot));
-      return { ok: true, group: "setup", command };
-    case "install-agent-shell":
-      requireNoExtraArgs(rest, "bun run rig setup install-agent-shell");
-      if (context.outputMode === "text") {
-        console.log("install-agent-shell is deprecated. Runtime shells now use compiled rig-agent directly.");
-      }
+      requireNoExtraArgs(rest, "rig setup preflight");
+      await withMutedConsole(context.outputMode === "json", () => runSetupPreflight(context.projectRoot, context.outputMode));
       return { ok: true, group: "setup", command };
     default:
-      throw new CliError2(`Unknown setup command: ${command}`);
+      throw new CliError(`Unknown setup command: ${command}`, 1, { hint: "Run `rig setup --help` \u2014 commands are bootstrap|check|preflight." });
   }
 }
 function formatTaskSourceKinds(kinds) {
@@ -664,17 +918,17 @@ function runSetupInit(projectRoot) {
   }
   console.log("Harness directories ready.");
 }
-async function runSetupCheck(projectRoot) {
-  const doctorChecks = await runRigDoctorChecks({ projectRoot });
+async function runSetupCheck(projectRoot, outputMode = "text") {
+  const doctorChecks = await withSpinner("Running setup checks\u2026", (update) => runRigDoctorChecks({ projectRoot, onProgress: update }), { outputMode });
   console.log(formatDoctorChecks(doctorChecks));
   const failures = countDoctorFailures(doctorChecks);
   if (failures > 0) {
-    throw new CliError2(`Setup check failed (${failures} failing doctor check${failures === 1 ? "" : "s"}).`, 1);
+    throw new CliError(`Setup check failed (${failures} failing doctor check${failures === 1 ? "" : "s"}).`, 1, { hint: "Run `rig doctor` for the full check list with remediations." });
   }
   return doctorChecks;
 }
-async function runSetupPreflight(projectRoot) {
-  await runSetupCheck(projectRoot);
+async function runSetupPreflight(projectRoot, outputMode = "text") {
+  await runSetupCheck(projectRoot, outputMode);
   const validationRoot = resolve6(resolveControlPlaneDefinitionRoot(projectRoot), "validation");
   if (existsSync5(validationRoot)) {
     const validators = readdirSync(validationRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory());