@h-rig/cli 0.0.6-alpha.7 → 0.0.6-alpha.71

package/dist/src/commands/init.js

@@ -3,17 +3,24 @@ var __require = import.meta.require;
 
 // packages/cli/src/commands/init.ts
 import { appendFileSync, existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
-import { spawnSync as spawnSync2 } from "child_process";
-import { resolve as resolve6 } from "path";
+import { spawnSync } from "child_process";
+import { basename, resolve as resolve6 } from "path";
 
 // packages/cli/src/runner.ts
 import { EventBus } from "@rig/runtime/control-plane/runtime/events";
-import { CliError } from "@rig/runtime/control-plane/errors";
+import { CliError as RuntimeCliError } from "@rig/runtime/control-plane/errors";
 import { evaluate, loadPolicy, resolveAction } from "@rig/runtime/control-plane/runtime/guard";
-import { PluginManager } from "@rig/runtime/control-plane/runtime/plugins";
-import { loadRuntimeContextFromEnv } from "@rig/runtime/control-plane/runtime/context";
 import { buildBinary } from "@rig/runtime/control-plane/runtime/isolation";
-import { CliError as CliError2 } from "@rig/runtime/control-plane/errors";
+
+class CliError extends RuntimeCliError {
+  hint;
+  constructor(message, exitCode = 1, options = {}) {
+    super(message, exitCode);
+    if (options.hint?.trim()) {
+      this.hint = options.hint.trim();
+    }
+  }
+}
 function takeFlag(args, flag) {
   const rest = [];
   let value = false;
@@ -34,7 +41,7 @@ function takeOption(args, option) {
     if (current === option) {
       const next = args[index + 1];
       if (!next || next.startsWith("-")) {
-        throw new CliError(`Missing value for ${option}`);
+        throw new CliError(`Missing value for ${option}`, 1, { hint: `Provide a value after ${option}, e.g. \`${option} <value>\`.` });
       }
       value = next;
       index += 1;
@@ -49,6 +56,7 @@ function takeOption(args, option) {
 
 // packages/cli/src/commands/init.ts
 import { buildRigInitConfigSource } from "@rig/core";
+import { listGitHubProjects as listGitHubProjectsDirect, resolveProjectStatusField as resolveProjectStatusFieldDirect } from "@rig/server";
 
 // packages/cli/src/commands/_connection-state.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
@@ -72,7 +80,7 @@ function readJsonFile(path) {
   try {
     return JSON.parse(readFileSync(path, "utf8"));
   } catch (error) {
-    throw new CliError2(`Invalid Rig connection state at ${path}: ${error instanceof Error ? error.message : String(error)}`, 1);
+    throw new CliError(`Invalid Rig connection state at ${path}: ${error instanceof Error ? error.message : String(error)}`, 1, { hint: "Fix or delete that file, then re-select a server with `rig server use <alias|local>`." });
   }
 }
 function writeJsonFile(path, value) {
@@ -115,7 +123,7 @@ function writeGlobalConnections(state, options = {}) {
 function upsertGlobalConnection(alias, connection, options = {}) {
   const cleanAlias = alias.trim();
   if (!cleanAlias)
-    throw new CliError2("Connection alias is required.", 1);
+    throw new CliError("Connection alias is required.", 1, { hint: "Save a server with `rig server add <alias> <url>`." });
   const state = readGlobalConnections(options);
   state.connections[cleanAlias] = connection;
   writeGlobalConnections(state, options);
@@ -132,7 +140,8 @@ function readRepoConnection(projectRoot) {
   return {
     selected,
     project: typeof record.project === "string" ? record.project : undefined,
-    linkedAt: typeof record.linkedAt === "string" ? record.linkedAt : undefined
+    linkedAt: typeof record.linkedAt === "string" ? record.linkedAt : undefined,
+    serverProjectRoot: typeof record.serverProjectRoot === "string" && record.serverProjectRoot.trim() ? record.serverProjectRoot.trim() : undefined
   };
 }
 function writeRepoConnection(projectRoot, state) {
@@ -143,27 +152,37 @@ function resolveSelectedConnection(projectRoot, options = {}) {
   if (!repo)
     return null;
   if (repo.selected === "local")
-    return { alias: "local", connection: { kind: "local", mode: "auto" } };
+    return { alias: "local", connection: { kind: "local", mode: "auto" }, serverProjectRoot: repo.serverProjectRoot };
   const global = readGlobalConnections(options);
   const connection = global.connections[repo.selected];
   if (!connection) {
-    throw new CliError2(`Selected Rig connection "${repo.selected}" was not found. Run \`rig connect list\` or \`rig connect use local\`.`, 1);
+    throw new CliError(`Selected Rig server "${repo.selected}" was not found. Run \`rig server list\` or \`rig server use local\`.`, 1);
   }
-  return { alias: repo.selected, connection };
+  return { alias: repo.selected, connection, serverProjectRoot: repo.serverProjectRoot };
+}
+function writeRepoServerProjectRoot(projectRoot, serverProjectRoot) {
+  const repo = readRepoConnection(projectRoot);
+  if (!repo)
+    return;
+  writeRepoConnection(projectRoot, { ...repo, serverProjectRoot });
 }
 
 // packages/cli/src/commands/_server-client.ts
-import { spawnSync } from "child_process";
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { resolve as resolve2 } from "path";
 import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
-var cachedGitHubBearerToken;
+var scopedGitHubBearerTokens = new Map;
+var serverPhaseListener = null;
+function reportServerPhase(label) {
+  serverPhaseListener?.(label);
+}
 function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
 }
-function setGitHubBearerTokenForCurrentProcess(token) {
-  cachedGitHubBearerToken = cleanToken(token ?? undefined);
+function setGitHubBearerTokenForCurrentProcess(token, projectRoot) {
+  const scopedKey = resolve2(projectRoot ?? process.cwd());
+  scopedGitHubBearerTokens.set(scopedKey, cleanToken(token ?? undefined));
 }
 function readPrivateRemoteSessionToken(projectRoot) {
   const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
@@ -177,49 +196,80 @@ function readPrivateRemoteSessionToken(projectRoot) {
   }
 }
 function readGitHubBearerTokenForRemote(projectRoot) {
-  if (cachedGitHubBearerToken !== undefined)
-    return cachedGitHubBearerToken;
+  const scopedKey = resolve2(projectRoot);
+  if (scopedGitHubBearerTokens.has(scopedKey))
+    return scopedGitHubBearerTokens.get(scopedKey) ?? null;
   const privateSession = readPrivateRemoteSessionToken(projectRoot);
-  if (privateSession) {
-    cachedGitHubBearerToken = privateSession;
-    return cachedGitHubBearerToken;
-  }
-  const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
-  if (envToken) {
-    cachedGitHubBearerToken = envToken;
-    return cachedGitHubBearerToken;
+  if (privateSession)
+    return privateSession;
+  return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
+}
+function readStoredGitHubAuthToken(projectRoot) {
+  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
+  if (!existsSync2(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    return cleanToken(typeof parsed.token === "string" ? parsed.token : undefined);
+  } catch {
+    return null;
   }
-  const result = spawnSync("gh", ["auth", "token"], {
-    encoding: "utf8",
-    timeout: 5000,
-    stdio: ["ignore", "pipe", "ignore"]
-  });
-  cachedGitHubBearerToken = result.status === 0 ? cleanToken(result.stdout) : null;
-  return cachedGitHubBearerToken;
+}
+function readLocalConnectionFallbackToken(projectRoot) {
+  return readGitHubBearerTokenForRemote(projectRoot) ?? cleanToken(process.env.RIG_GITHUB_TOKEN) ?? readStoredGitHubAuthToken(projectRoot);
 }
 async function ensureServerForCli(projectRoot) {
   try {
     const selected = resolveSelectedConnection(projectRoot);
     if (selected?.connection.kind === "remote") {
+      reportServerPhase(`Connecting to ${selected.alias}\u2026`);
+      const authToken = readGitHubBearerTokenForRemote(projectRoot);
+      const serverProjectRoot = selected.serverProjectRoot ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
       return {
         baseUrl: selected.connection.baseUrl,
-        authToken: readGitHubBearerTokenForRemote(projectRoot),
-        connectionKind: "remote"
+        authToken,
+        connectionKind: "remote",
+        serverProjectRoot
       };
     }
+    reportServerPhase("Starting local Rig server\u2026");
     const connection = await ensureLocalRigServerConnection(projectRoot);
     return {
       baseUrl: connection.baseUrl,
-      authToken: connection.authToken,
-      connectionKind: "local"
+      authToken: connection.authToken ?? readLocalConnectionFallbackToken(projectRoot),
+      connectionKind: "local",
+      serverProjectRoot: resolve2(projectRoot)
     };
   } catch (error) {
     if (error instanceof Error) {
-      throw new CliError2(error.message, 1);
+      throw new CliError(error.message, 1);
     }
     throw error;
   }
 }
+async function backfillRemoteServerProjectRoot(projectRoot, baseUrl, authToken) {
+  const repo = readRepoConnection(projectRoot);
+  const slug = repo?.project?.trim();
+  if (!slug)
+    return null;
+  try {
+    const response = await fetch(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`, {
+      headers: mergeHeaders(undefined, authToken)
+    });
+    if (!response.ok)
+      return null;
+    const payload = await response.json();
+    const project = payload.project && typeof payload.project === "object" && !Array.isArray(payload.project) ? payload.project : null;
+    const checkouts = Array.isArray(project?.checkouts) ? project.checkouts : [];
+    const latestCheckout = [...checkouts].reverse().find((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry) && typeof entry.path === "string"));
+    const path = typeof latestCheckout?.path === "string" && latestCheckout.path.trim() ? latestCheckout.path.trim() : null;
+    if (path)
+      writeRepoServerProjectRoot(projectRoot, path);
+    return path;
+  } catch {
+    return null;
+  }
+}
 function mergeHeaders(headers, authToken) {
   const merged = new Headers(headers);
   if (authToken) {
@@ -242,12 +292,65 @@ function diagnosticMessage(payload) {
   });
   return messages.length > 0 ? messages.join("; ") : null;
 }
+var serverReachabilityCache = new Map;
+async function probeServerReachability(baseUrl, authToken) {
+  try {
+    const response = await fetch(`${baseUrl.replace(/\/+$/, "")}/api/server/status`, {
+      headers: mergeHeaders(undefined, authToken),
+      signal: AbortSignal.timeout(1500)
+    });
+    return response.ok;
+  } catch {
+    return false;
+  }
+}
+function cachedServerReachability(projectRoot, baseUrl, authToken) {
+  const key = resolve2(projectRoot);
+  const cached = serverReachabilityCache.get(key);
+  if (cached)
+    return cached;
+  const probe = probeServerReachability(baseUrl, authToken);
+  serverReachabilityCache.set(key, probe);
+  return probe;
+}
+function describeSelectedServer(projectRoot, server) {
+  try {
+    const selected = resolveSelectedConnection(projectRoot);
+    if (selected) {
+      return {
+        alias: selected.alias,
+        target: selected.connection.kind === "remote" ? selected.connection.baseUrl : server.baseUrl
+      };
+    }
+  } catch {}
+  return { alias: server.connectionKind === "remote" ? "remote" : "local", target: server.baseUrl };
+}
+async function buildServerFailureContext(projectRoot, server) {
+  const { alias, target } = describeSelectedServer(projectRoot, server);
+  const reachable = await cachedServerReachability(projectRoot, server.baseUrl, server.authToken);
+  const reachability = reachable ? "server is reachable" : "server is unreachable";
+  return {
+    contextLine: `Currently connected to: ${alias} at ${target} (${reachability}).`,
+    hint: "Check the selected server with `rig server status`, or switch with `rig server use <alias|local>`."
+  };
+}
 async function requestServerJson(context, pathname, init = {}) {
   const server = await ensureServerForCli(context.projectRoot);
-  const response = await fetch(`${server.baseUrl}${pathname}`, {
-    ...init,
-    headers: mergeHeaders(init.headers, server.authToken)
-  });
+  const headers = mergeHeaders(init.headers, server.authToken);
+  if (server.serverProjectRoot)
+    headers.set("x-rig-project-root", server.serverProjectRoot);
+  reportServerPhase(`${(init.method ?? "GET").toUpperCase()} ${pathname.split("?")[0]}\u2026`);
+  let response;
+  try {
+    response = await fetch(`${server.baseUrl}${pathname}`, {
+      ...init,
+      headers
+    });
+  } catch (error) {
+    const failure = await buildServerFailureContext(context.projectRoot, server);
+    throw new CliError(`Rig server request failed: ${error instanceof Error ? error.message : String(error)}
+${failure.contextLine}`, 1, { hint: failure.hint });
+  }
   const text = await response.text();
   const payload = text.trim().length > 0 ? (() => {
     try {
@@ -259,7 +362,9 @@ async function requestServerJson(context, pathname, init = {}) {
   if (!response.ok) {
     const diagnostics = diagnosticMessage(payload);
     const detail = diagnostics ?? (text || response.statusText);
-    throw new CliError2(`Rig server request failed (${response.status}): ${detail}`, 1);
+    const failure = await buildServerFailureContext(context.projectRoot, server);
+    throw new CliError(`Rig server request failed (${response.status}): ${detail}
+${failure.contextLine}`, 1, { hint: failure.hint });
   }
   return payload;
 }
@@ -290,39 +395,75 @@ async function registerProjectViaServer(context, input) {
 function sleep(ms) {
   return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
+function isRetryableProjectRootSwitchError(error) {
+  if (!(error instanceof Error))
+    return false;
+  const message = error.message.toLowerCase();
+  return message.includes("rig server request failed (401): auth-required") || message.includes("rig server request failed (401): github-token-required") || message.includes("rig server request failed (502)") || message.includes("rig server request failed (503)") || message.includes("bad gateway") || message.includes("fetch failed") || message.includes("econnrefused") || message.includes("connection refused");
+}
 async function switchServerProjectRootViaServer(context, projectRoot, options = {}) {
-  const switched = await requestServerJson(context, "/api/server/project-root", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ projectRoot })
-  });
   const timeoutMs = options.timeoutMs ?? 30000;
   const pollMs = options.pollMs ?? 1000;
   const deadline = Date.now() + timeoutMs;
   let lastError;
+  let switched = null;
   while (Date.now() < deadline) {
     try {
-      const status = await requestServerJson(context, "/api/server/status");
-      if (status && typeof status === "object" && !Array.isArray(status)) {
-        const record = status;
-        if (record.projectRoot === projectRoot) {
-          return { ok: true, switched, status: record };
-        }
-        lastError = `server projectRoot=${String(record.projectRoot ?? "unknown")}`;
-      }
+      switched = await requestServerJson(context, "/api/server/project-root", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ projectRoot })
+      });
+      break;
     } catch (error) {
       lastError = error;
+      if (!isRetryableProjectRootSwitchError(error))
+        throw error;
+      await sleep(pollMs);
     }
-    await sleep(pollMs);
   }
-  throw new CliError2(`Rig server did not switch to ${projectRoot} before timeout (${lastError instanceof Error ? lastError.message : String(lastError ?? "no status")}).`, 1);
+  if (!switched) {
+    throw new CliError(`Rig server did not accept project-root switch to ${projectRoot} before timeout (${lastError instanceof Error ? lastError.message : String(lastError ?? "no response")}).`, 1);
+  }
+  const record = switched && typeof switched === "object" && !Array.isArray(switched) ? switched : {};
+  if (record.ok === true) {
+    writeRepoServerProjectRoot(context.projectRoot, projectRoot);
+    return { ok: true, switched: record };
+  }
+  throw new CliError(`Rig server rejected project-root scope ${projectRoot}: ${String(record.message ?? record.error ?? "unknown error")}`, 1);
 }
+async function ensureTaskLabelsViaServer(context) {
+  const payload = await requestServerJson(context, "/api/workspace/task-labels", { method: "POST" });
+  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
+}
+async function listGitHubProjectsViaServer(context, owner) {
+  const url = new URL("http://rig.local/api/github/projects");
+  url.searchParams.set("owner", owner);
+  const payload = await requestServerJson(context, `${url.pathname}${url.search}`);
+  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : { projects: [] };
+}
+async function getGitHubProjectStatusFieldViaServer(context, projectId) {
+  const payload = await requestServerJson(context, `/api/github/projects/${encodeURIComponent(projectId)}/status-field`);
+  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
+}
+var RESUMABLE_RUN_STATUSES = new Set([
+  "created",
+  "preparing",
+  "running",
+  "validating",
+  "reviewing",
+  "stopped",
+  "failed",
+  "needs-attention",
+  "needs_attention"
+]);
 
 // packages/cli/src/commands/_pi-install.ts
 import { existsSync as existsSync3, readFileSync as readFileSync3, rmSync } from "fs";
 import { homedir as homedir2 } from "os";
 import { resolve as resolve3 } from "path";
-var PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
+var PI_RIG_PACKAGE_NAME = "@h-rig/pi-rig";
+var LEGACY_PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
 var LEGACY_PI_RIG_MARKER = `// Managed by Rig. Source package: @rig/pi-rig.
 export { default } from '@rig/pi-rig';
 `;
@@ -350,7 +491,7 @@ function resolvePiHomeDir(inputHomeDir) {
 function piListContainsPiRig(output) {
   return output.split(/\r?\n/).some((line) => {
     const normalized = line.trim();
-    return normalized.includes(PI_RIG_PACKAGE_NAME) || /(?:^|[\\/])packages[\\/]pi-rig(?:$|\s)/.test(normalized);
+    return normalized.includes(PI_RIG_PACKAGE_NAME) || normalized.includes(LEGACY_PI_RIG_PACKAGE_NAME) || /(?:^|[\\/])packages[\\/]pi-rig(?:$|\s)/.test(normalized);
   });
 }
 async function safeRun(runner, command, options) {
@@ -466,7 +607,7 @@ async function ensureRemotePiRigInstalled(input) {
   const payload = await input.requestJson("/api/pi-rig/install", {
     method: "POST",
     headers: { "content-type": "application/json" },
-    body: JSON.stringify({ package: "@rig/pi-rig", scope: "global" })
+    body: JSON.stringify({ package: PI_RIG_PACKAGE_NAME, scope: "global" })
   });
   const record = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
   const piOk = record.piOk === true || record.ok === true;
@@ -719,7 +860,10 @@ async function runRigDoctorChecks(options) {
   const bunVersion = options.bunVersion ?? Bun.version;
   const request = options.requestJson ?? ((pathname, init) => requestServerJson({ projectRoot }, pathname, init));
   const loadConfig = options.loadConfig ?? loadRigConfigOrNull;
+  const progress = options.onProgress ?? (() => {});
+  progress("Checking local toolchain\u2026");
   checks.push(check("bun", `bun >= ${MIN_SUPPORTED_BUN_VERSION}`, isSupportedBunVersion(bunVersion) ? "pass" : "fail", `found ${bunVersion}`, `Install Bun ${MIN_SUPPORTED_BUN_VERSION} or newer.`), check("git", "git", which("git") ? "pass" : "fail", which("git") ?? undefined, "Install git and ensure it is on PATH."), check("jq", "jq", which("jq") ? "pass" : "warn", which("jq") ?? undefined, "Install jq (for example `brew install jq`)."));
+  progress("Loading rig.config\u2026");
   const loadedConfig = await loadConfig(projectRoot).catch(() => null);
   const config = loadedConfig ?? loadFallbackConfig(projectRoot);
   const hasConfigFile = ["rig.config.ts", "rig.config.mts", "rig.config.json"].some((name) => existsSync4(resolve5(projectRoot, name)));
@@ -727,7 +871,7 @@ async function runRigDoctorChecks(options) {
   const taskSourceKind = config?.taskSource?.kind;
   checks.push(taskSourceKind ? check("task-source", "task source configured", "pass", taskSourceKind) : check("task-source", "task source configured", "fail", "missing taskSource", "Configure taskSource in rig.config.ts."));
   const repo = readRepoConnection(projectRoot);
-  checks.push(repo ? check("project-link", "repo selected Rig connection", repo.project ? "pass" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : ""}`, "Run `rig init --yes --repo owner/repo` to link this checkout to a GitHub repo slug.") : check("project-link", "repo selected Rig connection", "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig connect use <alias|local>`."));
+  checks.push(repo ? check("project-link", "repo selected Rig server", repo.project ? "pass" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : ""}`, "Run `rig init --yes --repo owner/repo` to link this checkout to a GitHub repo slug.") : check("project-link", "repo selected Rig server", "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig server use <alias|local>`."));
   const selected = (() => {
     try {
       return resolveSelectedConnection(projectRoot);
@@ -735,9 +879,10 @@ async function runRigDoctorChecks(options) {
       return null;
     }
   })();
-  checks.push(selected ? check("connection", "selected server connection", "pass", selected.connection.kind === "remote" ? selected.connection.baseUrl : "local auto") : check("connection", "selected server connection", repo ? "fail" : "warn", repo ? "selected alias is missing" : "will auto-start local server", repo ? "Run `rig connect list` and `rig connect use <alias|local>`." : undefined));
+  checks.push(selected ? check("connection", "selected server connection", "pass", selected.connection.kind === "remote" ? selected.connection.baseUrl : "local auto") : check("connection", "selected server", repo ? "fail" : "warn", repo ? "selected alias is missing" : "will auto-start local server", repo ? "Run `rig server list` and `rig server use <alias|local>`." : undefined));
   let server = null;
   try {
+    progress("Connecting to the selected Rig server\u2026");
     server = await (options.resolveServer ?? ensureServerForCli)(projectRoot);
     checks.push(check("server", "Rig server reachable", "pass", `${server.connectionKind} ${server.baseUrl}`));
   } catch (error) {
@@ -745,18 +890,21 @@ async function runRigDoctorChecks(options) {
   }
   if (server || options.requestJson) {
     try {
+      progress("Checking server status\u2026");
       const status = await request("/api/server/status");
       checks.push(check("server-status", "server project status", "pass", JSON.stringify(status).slice(0, 180)));
     } catch (error) {
       checks.push(check("server-status", "server project status", "fail", errorMessage(error), "Run `rig doctor` after the selected server is reachable."));
     }
     try {
+      progress("Checking GitHub auth\u2026");
       const auth = await request("/api/github/auth/status");
       checks.push(isAuthenticated(auth) ? check("github-auth", "GitHub auth", "pass") : check("github-auth", "GitHub auth", "fail", "not authenticated", "Run `rig github auth import-gh` or `rig github auth token --token <token>`."));
     } catch (error) {
       checks.push(check("github-auth", "GitHub auth", "fail", errorMessage(error), "Authenticate GitHub through Rig and ensure the server exposes auth status."));
     }
     try {
+      progress("Checking GitHub repo permissions\u2026");
       const permissions = await request("/api/github/repo/permissions");
       const allowed = permissionAllowsPr(permissions);
       checks.push(allowed === true ? check("github-repo-permissions", "GitHub repo PR permissions", "pass", JSON.stringify(permissions).slice(0, 180)) : allowed === false ? check("github-repo-permissions", "GitHub repo PR permissions", "fail", JSON.stringify(permissions).slice(0, 180), "Grant the selected GitHub token permission to push branches, open PRs, and merge according to repo rules.") : check("github-repo-permissions", "GitHub repo PR permissions", "warn", JSON.stringify(permissions).slice(0, 180), "Confirm the selected token can push branches and open PRs."));
@@ -764,6 +912,7 @@ async function runRigDoctorChecks(options) {
       checks.push(check("github-repo-permissions", "GitHub repo PR permissions", "warn", errorMessage(error), "Ensure the server exposes repo permission checks and the token can open PRs."));
     }
     try {
+      progress("Checking GitHub issue labels\u2026");
       const labels = await request("/api/workspace/task-labels");
       const ready = labelsReady(labels);
       checks.push(ready === false ? check("task-labels", "GitHub issue labels", "fail", JSON.stringify(labels).slice(0, 180), "Let Rig create required labels or create the configured lifecycle labels manually.") : check("task-labels", "GitHub issue labels", ready === true ? "pass" : "warn", JSON.stringify(labels).slice(0, 180), "Confirm required Rig lifecycle labels exist."));
@@ -771,6 +920,7 @@ async function runRigDoctorChecks(options) {
       checks.push(check("task-labels", "GitHub issue labels", "warn", errorMessage(error), "Run `rig init`/`rig doctor` after label setup is wired on the server."));
     }
     try {
+      progress("Checking task projection\u2026");
       const projection = await request("/api/workspace/task-projection");
       checks.push(check("task-projection", "task projection", "pass", JSON.stringify(projection).slice(0, 180)));
     } catch (error) {
@@ -779,6 +929,7 @@ async function runRigDoctorChecks(options) {
     const slug = projectStatusSlug(projectRoot, config);
     if (slug) {
       try {
+        progress("Checking server project checkout\u2026");
         const project = await request(`/api/projects/${encodeURIComponent(slug)}`);
         checks.push(check("remote-checkout", "server project checkout", "pass", JSON.stringify(project).slice(0, 180)));
       } catch (error) {
@@ -793,6 +944,7 @@ async function runRigDoctorChecks(options) {
   }
   checks.push(githubProjectsCheck(config));
   checks.push(prMergeCheck(config));
+  progress("Checking Pi installation\u2026");
   const piChecks = await (options.piChecks ?? (() => buildPiSetupChecks()))().catch((error) => [{
     ok: false,
     label: "pi/pi-rig checks",
@@ -809,6 +961,7 @@ function countDoctorFailures(checks) {
 
 // packages/cli/src/commands/init.ts
 var RIG_CONFIG_PACKAGE_DIST_TAG = "latest";
+var DEFAULT_REMOTE_RIG_URL = "https://where.rig-does.work";
 var RIG_CONFIG_DEV_DEPENDENCIES = {
   "@rig/core": `npm:@h-rig/core@${RIG_CONFIG_PACKAGE_DIST_TAG}`,
   "@rig/standard-plugin": `npm:@h-rig/standard-plugin@${RIG_CONFIG_PACKAGE_DIST_TAG}`
@@ -819,7 +972,7 @@ function parseRepoSlugFromRemote(remoteUrl) {
   return gitHubMatch ? `${gitHubMatch[1]}/${gitHubMatch[2]}` : null;
 }
 function detectOriginRepoSlug(projectRoot) {
-  const result = spawnSync2("git", ["-C", projectRoot, "remote", "get-url", "origin"], { encoding: "utf8" });
+  const result = spawnSync("git", ["-C", projectRoot, "remote", "get-url", "origin"], { encoding: "utf8" });
   if (result.status !== 0)
     return null;
   return parseRepoSlugFromRemote(result.stdout.trim());
@@ -827,7 +980,7 @@ function detectOriginRepoSlug(projectRoot) {
 function parseRepoSlug(value) {
   const match = value.trim().match(/^([^/\s]+)\/([^/\s]+)$/);
   if (!match)
-    throw new CliError2(`Invalid GitHub repo slug: ${value}. Expected owner/repo.`, 1);
+    throw new CliError(`Invalid GitHub repo slug: ${value}. Expected owner/repo.`, 1, { hint: "Pass the slug as owner/repo, e.g. `rig init --repo acme/widgets`." });
   return { owner: match[1], repo: match[2], slug: `${match[1]}/${match[2]}` };
 }
 function ensureRigPrivateDirs(projectRoot) {
@@ -875,11 +1028,14 @@ function applyGitHubProjectConfig(source, options) {
     return source;
   const projectId = JSON.stringify(options.githubProject);
   const statusFieldId = JSON.stringify(options.githubProjectStatusField ?? "Status");
+  const statuses = options.githubProjectStatuses && Object.keys(options.githubProjectStatuses).length > 0 ? `
+      statuses: ${JSON.stringify(options.githubProjectStatuses, null, 8).replace(/\n/g, `
+      `)},` : "";
   return source.replace(`    projects: { enabled: false },`, [
     `    projects: {`,
     `      enabled: true,`,
     `      projectId: ${projectId},`,
-    `      statusFieldId: ${statusFieldId},`,
+    `      statusFieldId: ${statusFieldId},${statuses}`,
     `    },`
   ].join(`
 `));
@@ -900,40 +1056,218 @@ function checkoutForInit(projectRoot, serverKind, strategy) {
   }
 }
 function detectGhLogin() {
-  const result = spawnSync2("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8", timeout: 5000, stdio: ["ignore", "pipe", "ignore"] });
+  const result = spawnSync("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8", timeout: 5000, stdio: ["ignore", "pipe", "ignore"] });
   return result.status === 0 && result.stdout.trim() ? result.stdout.trim() : null;
 }
 function readGhAuthToken() {
-  const result = spawnSync2("gh", ["auth", "token"], { encoding: "utf8" });
+  const result = spawnSync("gh", ["auth", "token"], { encoding: "utf8" });
   if (result.status !== 0 || !result.stdout.trim()) {
-    throw new CliError2(result.stderr.trim() || "Could not read GitHub token from `gh auth token`.", result.status || 1);
+    throw new CliError(result.stderr.trim() || "Could not read GitHub token from `gh auth token`.", result.status || 1, { hint: "Sign in with `gh auth login`, or pass a token directly: `rig init --github-auth token --github-token <token>`." });
   }
   return result.stdout.trim();
 }
+function refreshGhProjectScopesAndReadToken() {
+  const result = spawnSync("gh", ["auth", "refresh", "--scopes", "read:project"], {
+    encoding: "utf8",
+    stdio: ["inherit", "pipe", "pipe"]
+  });
+  if (result.status !== 0)
+    return null;
+  try {
+    return readGhAuthToken();
+  } catch {
+    return null;
+  }
+}
 async function loadClackPrompts() {
   return await import("@clack/prompts");
 }
+function clackTextOptions(options) {
+  return {
+    message: options.message,
+    ...options.placeholder ? { placeholder: options.placeholder } : {},
+    ...(options.initialValue ?? options.defaultValue)?.trim() ? { initialValue: (options.initialValue ?? options.defaultValue).trim() } : {}
+  };
+}
 async function promptRequiredText(prompts, options) {
-  const value = await prompts.text(options);
+  const value = await prompts.text(clackTextOptions(options));
   if (prompts.isCancel(value))
-    throw new CliError2("Init cancelled.", 1);
+    throw new CliError("Init cancelled.", 1);
   const text = String(value ?? "").trim();
   if (!text)
-    throw new CliError2(`${options.message} is required.`, 1);
+    throw new CliError(`${options.message} is required.`, 1);
   return text;
 }
 async function promptOptionalText(prompts, options) {
-  const value = await prompts.text(options);
+  const value = await prompts.text(clackTextOptions(options));
   if (prompts.isCancel(value))
-    throw new CliError2("Init cancelled.", 1);
+    throw new CliError("Init cancelled.", 1);
   return String(value ?? "").trim();
 }
 async function promptSelect(prompts, options) {
   const value = await prompts.select(options);
   if (prompts.isCancel(value))
-    throw new CliError2("Init cancelled.", 1);
+    throw new CliError("Init cancelled.", 1);
   return String(value);
 }
+function repoOwnerFromSlug(repoSlug) {
+  return repoSlug.trim().match(/^([^/]+)\/[^/]+$/)?.[1] ?? null;
+}
+function recordArray(value, key) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return [];
+  const raw = value[key];
+  return Array.isArray(raw) ? raw.filter((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry))) : [];
+}
+async function listGitHubProjectsForInit(context, owner, token) {
+  if (token?.trim()) {
+    try {
+      return { ok: true, projects: await listGitHubProjectsDirect({ owner, token: token.trim() }) };
+    } catch (directError) {
+      const serverPayload = await listGitHubProjectsViaServer(context, owner).catch(() => null);
+      if (recordArray(serverPayload, "projects").length > 0)
+        return serverPayload;
+      return { ok: false, error: directError instanceof Error ? directError.message : String(directError), projects: [] };
+    }
+  }
+  return listGitHubProjectsViaServer(context, owner);
+}
+async function getGitHubProjectStatusFieldForInit(context, projectId, token) {
+  if (token?.trim()) {
+    try {
+      return { ok: true, field: await resolveProjectStatusFieldDirect({ projectId, token: token.trim() }) };
+    } catch (directError) {
+      const serverPayload = await getGitHubProjectStatusFieldViaServer(context, projectId).catch(() => null);
+      if (serverPayload && typeof serverPayload === "object" && !Array.isArray(serverPayload) && "field" in serverPayload) {
+        return serverPayload;
+      }
+      return { ok: false, error: directError instanceof Error ? directError.message : String(directError) };
+    }
+  }
+  return getGitHubProjectStatusFieldViaServer(context, projectId);
+}
+var PROJECT_STATUS_PROMPTS = {
+  running: "Running/In progress",
+  prOpen: "PR open/review",
+  ciFixing: "CI/review fixing",
+  merging: "Merging",
+  done: "Done",
+  needsAttention: "Needs attention"
+};
+var DEFAULT_PROJECT_STATUS_OPTIONS = {
+  running: "In Progress",
+  prOpen: "In Review",
+  ciFixing: "In Review",
+  merging: "Merging",
+  done: "Done",
+  needsAttention: "Needs Attention"
+};
+async function promptManualProjectStatusMapping(prompts) {
+  const statuses = {};
+  for (const [key, label] of Object.entries(PROJECT_STATUS_PROMPTS)) {
+    const defaultLabel = DEFAULT_PROJECT_STATUS_OPTIONS[key] ?? label;
+    const value = await promptOptionalText(prompts, {
+      message: `Project status option id/name for ${label} (blank for ${defaultLabel})`,
+      placeholder: defaultLabel
+    });
+    statuses[key] = value || defaultLabel;
+  }
+  return statuses;
+}
+function projectScopeError(value) {
+  const text = typeof value === "string" ? value : JSON.stringify(value ?? "");
+  return /INSUFFICIENT_SCOPES|read:project|required scopes/i.test(text);
+}
+function optionName(option) {
+  return String(option.name ?? option.label ?? option.id ?? "").trim();
+}
+function autoProjectStatusValue(options, key, label) {
+  const candidates = [DEFAULT_PROJECT_STATUS_OPTIONS[key], label].filter((value) => Boolean(value)).map((value) => value.trim().toLowerCase());
+  const match = options.find((option) => candidates.includes(optionName(option).toLowerCase()));
+  if (!match)
+    return null;
+  return String(match.id ?? match.name);
+}
+async function promptGitHubProjectConfig(context, prompts, repoSlug, githubToken, refreshProjectToken) {
+  const projectChoice = await promptSelect(prompts, {
+    message: "GitHub Projects status sync",
+    initialValue: "select",
+    options: [
+      { value: "select", label: "Select accessible ProjectV2" },
+      { value: "off", label: "Off" },
+      { value: "manual", label: "Enter ProjectV2 ids manually" }
+    ]
+  });
+  if (projectChoice === "off")
+    return { githubProject: "off" };
+  if (projectChoice === "manual") {
+    return {
+      githubProject: await promptRequiredText(prompts, { message: "GitHub ProjectV2 id", placeholder: "PVT_..." }),
+      githubProjectStatusField: await promptRequiredText(prompts, { message: "Project Status field id", placeholder: "field_status" }),
+      githubProjectStatuses: await promptManualProjectStatusMapping(prompts)
+    };
+  }
+  const owner = repoOwnerFromSlug(repoSlug);
+  if (!owner)
+    throw new CliError(`Cannot derive GitHub owner from repo slug ${repoSlug}.`, 1, { hint: "Pass the slug as owner/repo, e.g. `rig init --repo acme/widgets`." });
+  let activeToken = githubToken?.trim() || null;
+  let projectsPayload = await listGitHubProjectsForInit(context, owner, activeToken).catch((error) => ({ ok: false, error: error instanceof Error ? error.message : String(error), projects: [] }));
+  let projects = recordArray(projectsPayload, "projects");
+  if (projects.length === 0 && projectScopeError(projectsPayload.error) && refreshProjectToken) {
+    prompts.outro?.("GitHub token is missing read:project; refreshing gh auth scopes and retrying Projects.");
+    const refreshedToken = refreshProjectToken();
+    if (refreshedToken) {
+      activeToken = refreshedToken;
+      projectsPayload = await listGitHubProjectsForInit(context, owner, activeToken).catch((error) => ({ ok: false, error: error instanceof Error ? error.message : String(error), projects: [] }));
+      projects = recordArray(projectsPayload, "projects");
+    }
+  }
+  if (projects.length === 0) {
+    const error = typeof projectsPayload.error === "string" ? ` (${String(projectsPayload.error).replace(/\s+/g, " ").slice(0, 240)})` : "";
+    prompts.outro?.(`No accessible GitHub Projects were returned${error}; continuing with GitHub Projects status sync off.`);
+    return { githubProject: "off", ...activeToken ? { githubToken: activeToken } : {} };
+  }
+  const selectedProjectId = await promptSelect(prompts, {
+    message: "GitHub ProjectV2 project",
+    options: [
+      ...projects.map((project) => ({
+        value: String(project.id),
+        label: `${String(project.title ?? "Untitled project")} (#${String(project.number ?? "?")})`,
+        hint: typeof project.url === "string" ? project.url : undefined
+      })),
+      { value: "manual", label: "Enter ProjectV2 id manually" }
+    ]
+  });
+  const projectId = selectedProjectId === "manual" ? await promptRequiredText(prompts, { message: "GitHub ProjectV2 id", placeholder: "PVT_..." }) : selectedProjectId;
+  const fieldPayload = await getGitHubProjectStatusFieldForInit(context, projectId, activeToken).catch((error) => ({ ok: false, error: error instanceof Error ? error.message : String(error) }));
+  const fieldPayloadRecord = fieldPayload && typeof fieldPayload === "object" && !Array.isArray(fieldPayload) ? fieldPayload : {};
+  const rawField = fieldPayloadRecord.field;
+  const field = rawField && typeof rawField === "object" && !Array.isArray(rawField) ? rawField : null;
+  const fieldId = typeof field?.id === "string" && field.id.trim() ? field.id : await promptRequiredText(prompts, { message: "Project Status field id", placeholder: "field_status" });
+  const options = Array.isArray(field?.options) ? field.options.filter((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry))) : [];
+  if (options.length === 0) {
+    return {
+      githubProject: projectId,
+      githubProjectStatusField: fieldId,
+      githubProjectStatuses: await promptManualProjectStatusMapping(prompts),
+      ...activeToken ? { githubToken: activeToken } : {}
+    };
+  }
+  const statuses = {};
+  for (const [key, label] of Object.entries(PROJECT_STATUS_PROMPTS)) {
+    const auto = autoProjectStatusValue(options, key, label);
+    statuses[key] = auto ?? await promptSelect(prompts, {
+      message: `Project status option for ${label}`,
+      options: options.map((option) => ({ value: String(option.id ?? option.name), label: optionName(option) }))
+    });
+  }
+  return {
+    githubProject: projectId,
+    githubProjectStatusField: fieldId,
+    githubProjectStatuses: Object.keys(statuses).length > 0 ? statuses : undefined,
+    ...activeToken ? { githubToken: activeToken } : {}
+  };
+}
 function sleep2(ms) {
   return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
@@ -947,12 +1281,29 @@ function apiSessionTokenFrom(payload) {
   const token = payload.apiSessionToken;
   return typeof token === "string" && token.trim() ? token.trim() : null;
 }
+function cleanPayloadString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function remoteGitHubAuthMetadata(payload) {
+  if (!payload)
+    return {};
+  const userNamespace = payload.userNamespace && typeof payload.userNamespace === "object" && !Array.isArray(payload.userNamespace) ? payload.userNamespace : null;
+  return {
+    ...cleanPayloadString(payload.login) ? { login: cleanPayloadString(payload.login) } : {},
+    ...cleanPayloadString(payload.userId) ? { userId: cleanPayloadString(payload.userId) } : {},
+    ...cleanPayloadString(userNamespace?.key) ? { userNamespaceKey: cleanPayloadString(userNamespace?.key) } : {},
+    ...cleanPayloadString(userNamespace?.root) ? { userNamespaceRoot: cleanPayloadString(userNamespace?.root) } : {},
+    ...cleanPayloadString(userNamespace?.checkoutBaseDir) ? { checkoutBaseDir: cleanPayloadString(userNamespace?.checkoutBaseDir) } : {},
+    ...cleanPayloadString(userNamespace?.snapshotBaseDir) ? { snapshotBaseDir: cleanPayloadString(userNamespace?.snapshotBaseDir) } : {}
+  };
+}
 function writeRemoteGitHubAuthState(projectRoot, input) {
   writeFileSync2(resolve6(projectRoot, ".rig", "state", "github-auth.json"), `${JSON.stringify({
     authenticated: true,
     source: input.source,
     storedOnServer: true,
     selectedRepo: input.selectedRepo,
+    ...remoteGitHubAuthMetadata(input.authPayload ?? null),
     ...input.apiSessionToken ? { apiSessionToken: input.apiSessionToken } : {},
     updatedAt: new Date().toISOString()
   }, null, 2)}
@@ -983,18 +1334,149 @@ async function pollDeviceAuthUntilComplete(context, pollId, firstPayload) {
   } while (Date.now() < deadline);
   return last;
 }
+function runLocalFilesInit(context, options) {
+  const projectRoot = context.projectRoot;
+  ensureRigPrivateDirs(projectRoot);
+  ensureGitignoreEntries(projectRoot);
+  writeRepoConnection(projectRoot, { selected: "local", linkedAt: new Date().toISOString() });
+  const configTsPath = resolve6(projectRoot, "rig.config.ts");
+  const configExists = existsSync5(configTsPath) || existsSync5(resolve6(projectRoot, "rig.config.json"));
+  if (configExists && !options.repair) {
+    if (context.outputMode !== "json")
+      console.log("rig.config already exists; leaving it unchanged. Pass --repair to rewrite it.");
+  } else {
+    const projectName = basename(projectRoot) || "rig-project";
+    writeFileSync2(configTsPath, buildRigInitConfigSource({
+      projectName,
+      taskSource: { kind: "files", path: "tasks" },
+      useStandardPlugin: true
+    }), "utf-8");
+  }
+  ensureRigConfigPackageDependencies(projectRoot);
+  const tasksDir = resolve6(projectRoot, "tasks");
+  if (!existsSync5(tasksDir)) {
+    mkdirSync2(tasksDir, { recursive: true });
+    writeFileSync2(resolve6(tasksDir, "T-1.json"), `${JSON.stringify({ id: "T-1", title: "My first Rig task", body: "Describe the change you want an agent to make." }, null, 2)}
+`, "utf-8");
+  }
+  if (context.outputMode !== "json") {
+    console.log("Initialized a local files-source Rig project (no GitHub).");
+    console.log("  tasks live in tasks/*.json \xB7 server: local");
+    console.log("Next: `rig task list`, then `rig task run T-1`.");
+    console.log("To wire GitHub later: `rig init --repair --repo owner/repo --github-auth gh`.");
+  }
+  return { ok: true, group: "init", command: "init", details: { mode: "local-files", projectRoot, taskSourcePath: "tasks" } };
+}
+var DEMO_TASKS_RELATIVE_DIR = ".rig/demo-tasks";
+var DEMO_TASKS = [
+  {
+    id: "demo-1",
+    title: "Add a hello CLI script",
+    body: [
+      "Create `scripts/hello.ts` that prints `Hello from Rig!` plus the current date,",
+      "and add a `hello` script entry to package.json that runs it with bun.",
+      "Keep it dependency-free."
+    ].join(`
+`),
+    status: "ready",
+    labels: ["demo"]
+  },
+  {
+    id: "demo-2",
+    title: "Write a README section about this project",
+    body: [
+      "Add (or extend) README.md with a short `## What this is` section:",
+      "two or three sentences describing the repository and how to run it.",
+      "Plain prose, no badges."
+    ].join(`
+`),
+    status: "ready",
+    labels: ["demo"]
+  },
+  {
+    id: "demo-3",
+    title: "Add a unit test for the hello script",
+    body: [
+      "Add `scripts/hello.test.ts` with a bun test that imports the greeting",
+      "helper from the hello script and asserts it contains `Hello from Rig!`.",
+      "Refactor the script to export that helper if needed."
+    ].join(`
+`),
+    status: "ready",
+    labels: ["demo"]
+  }
+];
+function runDemoInit(context, options) {
+  const projectRoot = context.projectRoot;
+  ensureRigPrivateDirs(projectRoot);
+  ensureGitignoreEntries(projectRoot);
+  writeRepoConnection(projectRoot, { selected: "local", linkedAt: new Date().toISOString() });
+  const configTsPath = resolve6(projectRoot, "rig.config.ts");
+  const configExists = existsSync5(configTsPath) || existsSync5(resolve6(projectRoot, "rig.config.json"));
+  let configWritten = false;
+  if (configExists && !options.repair) {
+    if (context.outputMode !== "json") {
+      console.log("rig.config already exists; leaving it unchanged. Pass --repair to rewrite it for the demo.");
+    }
+  } else {
+    writeFileSync2(configTsPath, buildRigInitConfigSource({
+      projectName: basename(projectRoot) || "rig-demo",
+      taskSource: { kind: "files", path: DEMO_TASKS_RELATIVE_DIR },
+      useStandardPlugin: true
+    }), "utf-8");
+    configWritten = true;
+  }
+  ensureRigConfigPackageDependencies(projectRoot);
+  const demoTasksDir = resolve6(projectRoot, DEMO_TASKS_RELATIVE_DIR);
+  mkdirSync2(demoTasksDir, { recursive: true });
+  const taskIds = [];
+  for (const task of DEMO_TASKS) {
+    const id = String(task.id);
+    taskIds.push(id);
+    const taskPath = resolve6(demoTasksDir, `${id}.json`);
+    if (!existsSync5(taskPath)) {
+      writeFileSync2(taskPath, `${JSON.stringify(task, null, 2)}
+`, "utf-8");
+    }
+  }
+  if (context.outputMode !== "json") {
+    console.log(`Demo Rig project ready (offline, no GitHub).`);
+    console.log(`  config: rig.config.ts (files task source -> ${DEMO_TASKS_RELATIVE_DIR}/)`);
+    console.log(`  tasks:  ${taskIds.join(", ")}`);
+    console.log("Next steps:");
+    console.log("  1. rig task list");
+    console.log("  2. rig task run --next");
+  }
+  return {
+    ok: true,
+    group: "init",
+    command: "init",
+    details: {
+      mode: "demo",
+      projectRoot,
+      taskSourcePath: DEMO_TASKS_RELATIVE_DIR,
+      demoTasksDir,
+      tasks: taskIds,
+      configWritten
+    }
+  };
+}
 async function runControlPlaneInit(context, options) {
   const projectRoot = context.projectRoot;
   const detectedSlug = options.repoSlug ?? detectOriginRepoSlug(projectRoot);
   if (!detectedSlug) {
-    throw new CliError2("Could not detect GitHub repo slug from origin. Pass --repo owner/repo.", 1);
+    const authMethod2 = options.githubAuthMethod ?? (options.githubToken ? "token" : "skip");
+    if ((options.server ?? "local") === "local" && authMethod2 === "skip") {
+      return runLocalFilesInit(context, options);
+    }
+    throw new CliError("Could not detect GitHub repo slug from origin. Pass --repo owner/repo \u2014 or run `rig init --yes --server local --github-auth skip` for a local files-source project without GitHub.", 1);
   }
   const repo = parseRepoSlug(detectedSlug);
   const serverKind = options.server ?? "local";
   const connectionAlias = options.connectionAlias ?? (serverKind === "local" ? "local" : "remote");
   if (serverKind === "remote") {
     if (!options.remoteUrl)
-      throw new CliError2("Missing --remote-url for --server remote.", 1);
+      throw new CliError("Missing --remote-url for --server remote.", 1, { hint: "Re-run as `rig init --server remote --remote-url https://your-rig-server`." });
     upsertGlobalConnection(connectionAlias, { kind: "remote", baseUrl: options.remoteUrl });
   }
   writeRepoConnection(projectRoot, {
@@ -1039,18 +1521,19 @@ async function runControlPlaneInit(context, options) {
   const authMethod = options.githubAuthMethod ?? (options.githubToken ? "token" : "skip");
   const remoteGhTokenWarning = serverKind === "remote" && authMethod === "gh" ? `This sends a GitHub token from this machine to ${options.remoteUrl ?? "the remote Rig server"}.` : null;
   if (remoteGhTokenWarning && !options.yes) {
-    throw new CliError2(`${remoteGhTokenWarning} Re-run with --yes to confirm this explicit token transfer.`, 1);
+    throw new CliError(`${remoteGhTokenWarning} Re-run with --yes to confirm this explicit token transfer.`, 1);
   }
   const token = authMethod === "gh" && !options.githubToken ? readGhAuthToken() : options.githubToken?.trim();
   if (token) {
     githubAuth = await postGitHubTokenViaServer(context, token, { selectedRepo: repo.slug });
     const apiSessionToken = apiSessionTokenFrom(githubAuth);
-    setGitHubBearerTokenForCurrentProcess(apiSessionToken ?? token);
+    setGitHubBearerTokenForCurrentProcess(apiSessionToken ?? token, projectRoot);
     if (serverKind === "remote") {
       writeRemoteGitHubAuthState(projectRoot, {
         source: authMethod === "gh" ? "gh" : "init-token",
         selectedRepo: repo.slug,
-        apiSessionToken
+        apiSessionToken,
+        authPayload: githubAuth
       });
     }
   } else if (authMethod === "device") {
@@ -1069,9 +1552,9 @@ async function runControlPlaneInit(context, options) {
     if (completed) {
       const apiSessionToken = apiSessionTokenFrom(completed);
       if (apiSessionToken) {
-        setGitHubBearerTokenForCurrentProcess(apiSessionToken);
+        setGitHubBearerTokenForCurrentProcess(apiSessionToken, projectRoot);
         if (serverKind === "remote") {
-          writeRemoteGitHubAuthState(projectRoot, { source: "device", selectedRepo: repo.slug, apiSessionToken });
+          writeRemoteGitHubAuthState(projectRoot, { source: "device", selectedRepo: repo.slug, apiSessionToken, authPayload: completed });
         }
       }
       deviceAuth = { ...deviceAuth, poll: completed, completed: completed.status === "signed-in" };
@@ -1089,19 +1572,25 @@ async function runControlPlaneInit(context, options) {
       Object.assign(checkout, preparedCheckout);
     }
   }
+  const checkoutPath = typeof checkout.path === "string" ? checkout.path : null;
+  if (serverKind === "remote" && checkoutPath && token) {
+    githubAuth = await postGitHubTokenViaServer(context, token, { selectedRepo: repo.slug, projectRoot: checkoutPath });
+    const apiSessionToken = apiSessionTokenFrom(githubAuth);
+    setGitHubBearerTokenForCurrentProcess(apiSessionToken ?? token, projectRoot);
+    writeRemoteGitHubAuthState(projectRoot, { source: authMethod === "gh" ? "gh" : "init-token", selectedRepo: repo.slug, apiSessionToken, authPayload: githubAuth });
+  }
   const registered = await registerProjectViaServer(context, {
     repoSlug: repo.slug,
     checkout
   });
-  const checkoutPath = typeof checkout.path === "string" ? checkout.path : null;
   const serverRootSwitch = serverKind === "remote" && checkoutPath ? await switchServerProjectRootViaServer(context, checkoutPath) : null;
-  if (serverRootSwitch && token) {
-    githubAuth = await postGitHubTokenViaServer(context, token, { selectedRepo: repo.slug, projectRoot: checkoutPath ?? undefined });
-    const apiSessionToken = apiSessionTokenFrom(githubAuth);
-    setGitHubBearerTokenForCurrentProcess(apiSessionToken ?? token);
-    writeRemoteGitHubAuthState(projectRoot, { source: authMethod === "gh" ? "gh" : "init-token", selectedRepo: repo.slug, apiSessionToken });
-  }
   const activeProjectRegistration = serverRootSwitch ? await registerProjectViaServer(context, { repoSlug: repo.slug, checkout }) : null;
+  const labelSetup = await ensureTaskLabelsViaServer(context).catch((error) => ({
+    ok: false,
+    ready: false,
+    labelsReady: false,
+    error: error instanceof Error ? error.message : String(error)
+  }));
   const pi = serverKind === "remote" ? await ensureRemotePiRigInstalled({ requestJson: (pathname, init) => requestServerJson(context, pathname, init) }).catch((error) => ({
     remote: true,
     pi: { ok: false, label: "pi", hint: error instanceof Error ? error.message : String(error) },
@@ -1132,6 +1621,7 @@ async function runControlPlaneInit(context, options) {
     githubAuth,
     deviceAuth,
     githubAuthWarning: remoteGhTokenWarning,
+    labelSetup,
     pi,
     doctor
   };
@@ -1143,6 +1633,8 @@ async function runControlPlaneInit(context, options) {
 }
 function parseInitOptions(args) {
   let rest = [...args];
+  const demo = takeFlag(rest, "--demo");
+  rest = demo.rest;
   const yes = takeFlag(rest, "--yes");
   rest = yes.rest;
   const repair = takeFlag(rest, "--repair");
@@ -1172,6 +1664,7 @@ function parseInitOptions(args) {
   const ref = takeOption(rest, "--ref");
   rest = ref.rest;
   const options = {
+    demo: demo.value,
     yes: yes.value,
     repair: repair.value,
     privateStateOnly: privateStateOnly.value,
@@ -1185,10 +1678,10 @@ function parseInitOptions(args) {
     githubProjectStatusField: githubProjectStatusField.value
   };
   if (server.value && options.server === undefined) {
-    throw new CliError2("--server must be local or remote.", 1);
+    throw new CliError("--server must be local or remote.", 1);
   }
   if (githubAuth.value && !["gh", "token", "device", "skip"].includes(githubAuth.value)) {
-    throw new CliError2("--github-auth must be gh, token, device, or skip.", 1);
+    throw new CliError("--github-auth must be gh, token, device, or skip.", 1);
   }
   if (remoteCheckout.value) {
     if (remoteCheckout.value === "managed-clone")
@@ -1199,10 +1692,10 @@ function parseInitOptions(args) {
       options.remoteCheckout = { kind: "uploaded-snapshot" };
     else if (remoteCheckout.value === "existing-path") {
       if (!existingPath.value)
-        throw new CliError2("--remote-checkout existing-path requires --existing-path <path>.", 1);
+        throw new CliError("--remote-checkout existing-path requires --existing-path <path>.", 1);
       options.remoteCheckout = { kind: "existing-path", path: existingPath.value };
     } else {
-      throw new CliError2("--remote-checkout must be managed-clone, current-ref, uploaded-snapshot, or existing-path.", 1);
+      throw new CliError("--remote-checkout must be managed-clone, current-ref, uploaded-snapshot, or existing-path.", 1);
     }
   }
   return { options, rest };
@@ -1238,12 +1731,13 @@ async function runInteractiveControlPlaneInit(context, prompts) {
   });
   const serverChoice = await promptSelect(prompts, {
     message: "Rig server",
+    initialValue: "remote",
     options: [
-      { value: "local", label: "Local server", hint: "run on this machine" },
-      { value: "remote", label: "Remote server", hint: "connect to an HTTPS Rig server" }
+      { value: "remote", label: "Remote server", hint: "connect to an HTTPS Rig server" },
+      { value: "local", label: "Local server", hint: "run on this machine" }
     ]
   });
-  const remoteUrl = serverChoice === "remote" ? await promptRequiredText(prompts, { message: "Remote Rig server URL", placeholder: "https://rig.example.com" }) : undefined;
+  const remoteUrl = serverChoice === "remote" ? await promptRequiredText(prompts, { message: "Remote Rig server URL", placeholder: DEFAULT_REMOTE_RIG_URL, initialValue: DEFAULT_REMOTE_RIG_URL }) : undefined;
   let remoteCheckout;
   if (serverChoice === "remote") {
     const checkout = await promptSelect(prompts, {
@@ -1275,38 +1769,35 @@ async function runInteractiveControlPlaneInit(context, prompts) {
       { value: "skip", label: "Skip for now" }
     ]
   });
+  let remoteGhTokenConfirmed = false;
   if (serverChoice === "remote" && authMethod === "gh") {
     if (!prompts.confirm)
-      throw new CliError2("Remote gh-token import requires explicit confirmation.", 1);
+      throw new CliError("Remote gh-token import requires explicit confirmation.", 1);
     const confirmed = await prompts.confirm({
       message: `This sends a GitHub token from this machine to ${remoteUrl}. Continue?`,
-      initialValue: false
+      initialValue: true
     });
     if (prompts.isCancel(confirmed) || confirmed !== true) {
-      throw new CliError2("Remote gh-token import cancelled.", 1);
+      throw new CliError("Remote gh-token import cancelled.", 1);
     }
+    remoteGhTokenConfirmed = true;
   }
-  const githubToken = authMethod === "token" ? await promptRequiredText(prompts, { message: "GitHub token", placeholder: "ghp_..." }) : undefined;
-  const projectChoice = await promptSelect(prompts, {
-    message: "GitHub Projects status sync",
-    options: [
-      { value: "off", label: "Off" },
-      { value: "configure", label: "Configure ProjectV2 status field" }
-    ]
-  });
-  const githubProject = projectChoice === "configure" ? await promptRequiredText(prompts, { message: "GitHub ProjectV2 id", placeholder: "PVT_..." }) : "off";
-  const githubProjectStatusField = projectChoice === "configure" ? await promptRequiredText(prompts, { message: "Project Status field id", placeholder: "field_status" }) : undefined;
+  const githubToken = authMethod === "token" ? await promptRequiredText(prompts, { message: "GitHub token", placeholder: "ghp_..." }) : authMethod === "gh" ? readGhAuthToken() : undefined;
+  const projectConfig = await promptGitHubProjectConfig(context, prompts, repoSlug, githubToken, authMethod === "gh" ? refreshGhProjectScopesAndReadToken : undefined);
+  const effectiveGithubToken = projectConfig.githubToken ?? githubToken;
   const result = await runControlPlaneInit(context, {
     server: serverChoice,
     remoteUrl,
     repoSlug,
-    githubToken,
+    githubToken: effectiveGithubToken,
     githubAuthMethod: authMethod,
-    githubProject,
-    githubProjectStatusField,
+    githubProject: projectConfig.githubProject,
+    githubProjectStatusField: projectConfig.githubProjectStatusField,
+    githubProjectStatuses: projectConfig.githubProjectStatuses,
     remoteCheckout,
     repair,
-    privateStateOnly
+    privateStateOnly,
+    yes: remoteGhTokenConfirmed || undefined
   });
   const details = result.details && typeof result.details === "object" && !Array.isArray(result.details) ? result.details : {};
   const deviceAuth = details.deviceAuth && typeof details.deviceAuth === "object" && !Array.isArray(details.deviceAuth) ? details.deviceAuth : null;
@@ -1316,19 +1807,32 @@ async function runInteractiveControlPlaneInit(context, prompts) {
 }
 async function executeInit(context, args) {
   const parsed = parseInitOptions(args);
+  if (parsed.options.demo) {
+    if (parsed.rest.length > 0) {
+      throw new CliError(`Unexpected arguments: ${parsed.rest.join(" ")}
+Usage: rig init --demo [--yes] [--repair]`, 1, { hint: "Run `rig init --demo` (optionally with --repair to rewrite an existing rig.config)." });
+    }
+    return runDemoInit(context, parsed.options);
+  }
   if (parsed.options.yes || parsed.options.server || parsed.options.repoSlug || parsed.options.githubToken || parsed.options.privateStateOnly || parsed.options.repair || parsed.options.githubAuthMethod || parsed.options.remoteCheckout) {
     if (parsed.rest.length > 0)
-      throw new CliError2(`Unexpected arguments: ${parsed.rest.join(" ")}
-Usage: rig init [--server local|remote] [--remote-url <url>] [--repo owner/repo] [--github-auth gh|token|device|skip] [--github-token <token>] [--github-project off|<project-id>] [--remote-checkout managed-clone|current-ref|uploaded-snapshot|existing-path] [--yes]`, 1);
+      throw new CliError(`Unexpected arguments: ${parsed.rest.join(" ")}
+Usage: rig init [--demo] [--server local|remote] [--remote-url <url>] [--repo owner/repo] [--github-auth gh|token|device|skip] [--github-token <token>] [--github-project off|<project-id>] [--remote-checkout managed-clone|current-ref|uploaded-snapshot|existing-path] [--yes]`, 1);
     return runControlPlaneInit(context, parsed.options);
   }
   if (parsed.rest.length > 0)
-    throw new CliError2(`Unexpected arguments: ${parsed.rest.join(" ")}
+    throw new CliError(`Unexpected arguments: ${parsed.rest.join(" ")}
 Usage: rig init`, 1);
+  if (!process.stdin.isTTY) {
+    throw new CliError("rig init is interactive and needs a terminal. For scripts, pass flags: rig init --yes --server local --github-auth skip [--repo owner/repo].", 1);
+  }
   return runInteractiveControlPlaneInit(context, await loadClackPrompts());
 }
 export {
   runInteractiveControlPlaneInit,
+  runDemoInit,
   executeInit,
-  buildRigInitConfigSource
+  buildRigInitConfigSource,
+  DEMO_TASKS_RELATIVE_DIR,
+  DEMO_TASKS
 };