@h-rig/cli 0.0.6-alpha.81 → 0.0.6-alpha.83

package/dist/src/app-opentui/adapters/pi-attach.js

@@ -192,17 +192,21 @@ function setGitHubBearerTokenForCurrentProcess(token, projectRoot) {
   const scopedKey = resolve2(projectRoot ?? process.cwd());
   scopedGitHubBearerTokens.set(scopedKey, cleanToken(token ?? undefined));
 }
-function readPrivateRemoteSessionToken(projectRoot) {
+function readRemoteAuthState(projectRoot) {
   const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
   if (!existsSync2(path))
     return null;
   try {
     const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
   }
 }
+function readPrivateRemoteSessionToken(projectRoot) {
+  const parsed = readRemoteAuthState(projectRoot);
+  return parsed ? cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined) : null;
+}
 function readGitHubBearerTokenForRemote(projectRoot) {
   const scopedKey = resolve2(projectRoot);
   if (scopedGitHubBearerTokens.has(scopedKey))
@@ -213,15 +217,25 @@ function readGitHubBearerTokenForRemote(projectRoot) {
   return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
 }
 function readStoredGitHubAuthToken(projectRoot) {
-  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
-  if (!existsSync2(path))
+  const parsed = readRemoteAuthState(projectRoot);
+  return parsed ? cleanToken(typeof parsed.token === "string" ? parsed.token : undefined) : null;
+}
+function inferRemoteServerProjectRootFromAuthState(projectRoot) {
+  const repo = readRepoConnection(projectRoot);
+  const slug = repo?.project?.trim();
+  if (!slug || !/^[^/]+\/[^/]+$/.test(slug))
     return null;
-  try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return cleanToken(typeof parsed.token === "string" ? parsed.token : undefined);
-  } catch {
+  const auth = readRemoteAuthState(projectRoot);
+  const authUpdatedAt = typeof auth?.updatedAt === "string" ? Date.parse(auth.updatedAt) : Number.NaN;
+  const repoLinkedAt = typeof repo?.linkedAt === "string" ? Date.parse(repo.linkedAt) : Number.NaN;
+  if (Number.isFinite(authUpdatedAt) && Number.isFinite(repoLinkedAt) && authUpdatedAt + 1000 < repoLinkedAt)
     return null;
-  }
+  const checkoutBaseDir = typeof auth?.checkoutBaseDir === "string" && auth.checkoutBaseDir.trim() ? auth.checkoutBaseDir.trim() : null;
+  if (!checkoutBaseDir)
+    return null;
+  const inferred = `${checkoutBaseDir.replace(/\/+$/, "")}/${slug}`;
+  writeRepoServerProjectRoot(projectRoot, inferred);
+  return inferred;
 }
 function readLocalConnectionFallbackToken(projectRoot) {
   return readGitHubBearerTokenForRemote(projectRoot) ?? cleanToken(process.env.RIG_GITHUB_TOKEN) ?? readStoredGitHubAuthToken(projectRoot);
@@ -232,7 +246,7 @@ async function ensureServerForCli(projectRoot) {
     if (selected?.connection.kind === "remote") {
       reportServerPhase(`Connecting to ${selected.alias}\u2026`);
       const authToken = readGitHubBearerTokenForRemote(projectRoot);
-      const serverProjectRoot = selected.serverProjectRoot ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
+      const serverProjectRoot = selected.serverProjectRoot ?? inferRemoteServerProjectRootFromAuthState(projectRoot) ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
       return {
         baseUrl: selected.connection.baseUrl,
         authToken,
@@ -261,7 +275,10 @@ async function backfillRemoteServerProjectRoot(projectRoot, baseUrl, authToken)
   if (!slug)
     return null;
   try {
-    const response = await fetch(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`, {
+    const url = new URL(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`);
+    if (authToken && queryAuthFallbackEnabled())
+      url.searchParams.set("rt", authToken);
+    const response = await fetch(url, {
       headers: mergeHeaders(undefined, authToken)
     });
     if (!response.ok)
@@ -288,10 +305,23 @@ function appendTaskFilterParams(url, filters) {
   if (filters.limit !== undefined)
     url.searchParams.set("limit", String(filters.limit));
 }
+function mergeCookie(existing, name, value) {
+  const encoded = `${name}=${encodeURIComponent(value)}`;
+  if (!existing?.trim())
+    return encoded;
+  const parts = existing.split(";").map((part) => part.trim()).filter((part) => part && !part.startsWith(`${name}=`));
+  return [...parts, encoded].join("; ");
+}
+function queryAuthFallbackEnabled(env = process.env) {
+  return env.RIG_ENABLE_QUERY_AUTH_FALLBACK === "1" || env.RIG_QUERY_AUTH_FALLBACK === "1";
+}
 function mergeHeaders(headers, authToken) {
   const merged = new Headers(headers);
   if (authToken) {
-    merged.set("authorization", `Bearer ${authToken}`);
+    const bearer = `Bearer ${authToken}`;
+    merged.set("authorization", bearer);
+    merged.set("x-auth", bearer);
+    merged.set("cookie", mergeCookie(merged.get("cookie"), "rig_auth", authToken));
   }
   return merged;
 }
@@ -351,15 +381,34 @@ async function buildServerFailureContext(projectRoot, server) {
     hint: "Check the selected server with `rig server status`, or switch with `rig server use <alias|local>`."
   };
 }
+function isLoopbackRemoteBaseUrl(baseUrl) {
+  try {
+    const host = new URL(baseUrl).hostname.toLowerCase();
+    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+  } catch {
+    return false;
+  }
+}
+function canUseRemoteWithoutProjectRoot(pathname) {
+  return pathname === "/health" || pathname === "/api/health" || pathname === "/api/server/status" || pathname === "/api/server/project-root" || pathname.startsWith("/api/github/auth/") || pathname === "/api/projects" || pathname.startsWith("/api/projects/");
+}
 async function requestServerJson(context, pathname, init = {}) {
   const server = await ensureServerForCli(context.projectRoot);
+  const requestUrl = new URL(`${server.baseUrl}${pathname}`);
+  if (server.connectionKind === "remote" && !server.serverProjectRoot && !canUseRemoteWithoutProjectRoot(requestUrl.pathname) && (server.authToken || !isLoopbackRemoteBaseUrl(server.baseUrl))) {
+    const repo = readRepoConnection(context.projectRoot);
+    throw new CliError(`Remote server is selected for ${repo?.project ?? "this repo"}, but this checkout has no server-host project root link.`, 1, { hint: "Run `rig init --repair` or `rig init --yes --repo owner/repo --server remote` to repair the remote project link before task/run commands." });
+  }
   const headers = mergeHeaders(init.headers, server.authToken);
   if (server.serverProjectRoot)
     headers.set("x-rig-project-root", server.serverProjectRoot);
+  if (server.connectionKind === "remote" && server.authToken && queryAuthFallbackEnabled()) {
+    requestUrl.searchParams.set("rt", server.authToken);
+  }
   reportServerPhase(`${(init.method ?? "GET").toUpperCase()} ${pathname.split("?")[0]}\u2026`);
   let response;
   try {
-    response = await fetch(`${server.baseUrl}${pathname}`, {
+    response = await fetch(requestUrl, {
       ...init,
       headers
     });
@@ -421,11 +470,26 @@ async function getGitHubAuthStatusViaServer(context) {
   return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
 }
 async function postGitHubTokenViaServer(context, token, options = {}) {
-  const payload = await requestServerJson(context, "/api/github/auth/token", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ token, selectedRepo: options.selectedRepo, projectRoot: options.projectRoot })
-  });
+  const server = await ensureServerForCli(context.projectRoot);
+  const requestUrl = new URL(`${server.baseUrl}/api/github/auth/token`);
+  reportServerPhase("POST /api/github/auth/token\u2026");
+  let response;
+  try {
+    response = await fetch(requestUrl, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ token, selectedRepo: options.selectedRepo, projectRoot: options.projectRoot ?? server.serverProjectRoot ?? undefined })
+    });
+  } catch (error) {
+    const failure = await buildServerFailureContext(context.projectRoot, server);
+    throw new CliError(`Rig server auth bootstrap failed: ${error instanceof Error ? error.message : String(error)}
+${failure.contextLine}`, 1, { hint: failure.hint });
+  }
+  const payload = await response.json().catch(() => null);
+  if (!response.ok) {
+    const detail = payload && typeof payload === "object" && !Array.isArray(payload) ? String(payload.error ?? JSON.stringify(payload)) : `HTTP ${response.status}`;
+    throw new CliError(`Rig server auth bootstrap failed (${response.status}): ${detail}`, 1, { hint: "Re-run `rig github auth import-gh`, or check the selected server with `rig server status`." });
+  }
   return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
 }
 async function prepareRemoteCheckoutViaServer(context, input) {
@@ -716,7 +780,7 @@ function projectRootOf(ctx) {
   const root = ctx.rig?.projectRoot ?? ctx.projectRoot ?? ctx.getState().projectRoot;
   if (typeof root === "string" && root.trim())
     return root;
-  throw new Error("Rig app adapter requires a projectRoot.");
+  throw new Error("App adapter requires a projectRoot.");
 }
 function normalizeAppError(error) {
   const message = error instanceof Error ? error.message : String(error);
@@ -776,7 +840,9 @@ import { Terminal as XtermTerminal } from "@xterm/headless";
 var MIN_COLS = 40;
 var MIN_ROWS = 12;
 var MAX_ROWS = 300;
-var MAX_SNAPSHOT_LINES = 1200;
+var MAX_SNAPSHOT_LINES = 360;
+var STYLED_SNAPSHOT_MARGIN = 6;
+var SNAPSHOT_DELAY_MS = 120;
 var fallbackChildScriptPath = fileURLToPath(new URL("./pi-host-child.ts", import.meta.url));
 var activeHost = null;
 function clampCols(cols) {
@@ -874,17 +940,15 @@ function lineToStyledText(line, cols) {
 function childCommandPrefix() {
   const execName = basename(process.execPath).toLowerCase();
   const currentEntry = process.argv[1];
-  if ((execName === "bun" || execName === "bun.exe") && currentEntry) {
-    return [process.execPath, currentEntry, "__opentui-pi-host"];
+  if (execName === "bun" || execName === "bun.exe") {
+    return currentEntry ? [process.execPath, currentEntry, "__opentui-pi-host"] : [process.execPath, fallbackChildScriptPath];
   }
-  if (currentEntry)
-    return [process.execPath, "__opentui-pi-host"];
-  return [process.execPath, fallbackChildScriptPath];
+  return [process.execPath, "__opentui-pi-host"];
 }
 function withEnv(base) {
   const env = {};
   for (const [key, value] of Object.entries(base ?? process.env)) {
-    if (key === "RIG_PLAIN" || key === "RIG_CLI_PLAIN_HELP")
+    if (key === "RIG_PLAIN" || key === "RIG_CLI_PLAIN_HELP" || key === "NO_COLOR")
       continue;
     if (typeof value === "string")
       env[key] = value;
@@ -935,7 +999,7 @@ class PiPtyHost {
       allowProposedApi: true,
       cols: this.cols,
       rows: this.rows,
-      scrollback: 5000
+      scrollback: 1000
     });
     this.registerTerminalResponders();
   }
@@ -949,7 +1013,7 @@ class PiPtyHost {
     if (this._disposed)
       throw new Error("Pi PTY host is disposed.");
     if (typeof Bun.Terminal !== "function") {
-      throw new Error("Bun native PTY is unavailable in this runtime. Rig OpenTUI Pi host requires Bun.Terminal.");
+      throw new Error("Bun native PTY is unavailable in this runtime. Pi host requires Bun.Terminal.");
     }
     const spawnOptions = {
       cwd: this.projectRoot,
@@ -973,7 +1037,7 @@ class PiPtyHost {
     this.proc = proc;
     this.pty = proc.terminal;
     this.status = "running";
-    this.message = "bundled Pi running inside Rig";
+    this.message = "bundled Pi running inside this app";
     this.emitSnapshotSoon(0);
     proc.exited.then((exitCode) => {
       if (this._disposed)
@@ -1068,7 +1132,7 @@ class PiPtyHost {
     this.respondToRawTerminalQueries(text);
     this.terminal.write(data, () => this.emitSnapshotSoon());
   }
-  emitSnapshotSoon(delayMs = 16) {
+  emitSnapshotSoon(delayMs = SNAPSHOT_DELAY_MS) {
     if (this._disposed || this.notifyTimer)
       return;
     this.notifyTimer = setTimeout(() => {
@@ -1082,16 +1146,18 @@ class PiPtyHost {
     const buffer = this.terminal.buffer.active;
     const end = buffer.length;
     const start = Math.max(0, end - MAX_SNAPSHOT_LINES);
+    const styledStart = Math.max(start, end - this.rows - STYLED_SNAPSHOT_MARGIN);
     const lines = [];
     const styledLines = [];
     for (let row = start;row < end; row += 1) {
       const line = buffer.getLine(row);
       lines.push((line?.translateToString(false) ?? "").slice(0, this.cols));
-      styledLines.push(lineToStyledText(line, this.cols));
+      if (row >= styledStart)
+        styledLines[lines.length - 1] = lineToStyledText(line, this.cols);
     }
     while (lines.length < this.rows) {
       lines.push("");
-      styledLines.push(new StyledText([{ __isChunk: true, text: "" }]));
+      styledLines[lines.length - 1] = new StyledText([{ __isChunk: true, text: "" }]);
     }
     return {
       runId: this.runId,
@@ -1161,7 +1227,7 @@ async function refreshFleet(ctx, options = {}) {
   try {
     const { listRunsViaServer: listRunsViaServer2, resolveServerConnectionLabel: resolveServerConnectionLabel2 } = await Promise.resolve().then(() => (init__server_client(), exports__server_client));
     const projectRoot = projectRootOf(ctx);
-    emitProgress(ctx, label, "contacting selected Rig server");
+    emitProgress(ctx, label, "contacting selected server");
     const [runs, serverLabel] = await Promise.all([
       listRunsViaServer2({ projectRoot }, { limit: options.limit ?? 50 }),
       resolveServerConnectionLabel2(projectRoot)
@@ -1240,7 +1306,7 @@ async function attachRunWithBundledPi(ctx, runId) {
     throw error;
   }
   emitStarted(ctx, label, { piAttach: { runId: cleanRunId, status: "entering-pi" } });
-  patchData(ctx, { piAttach: { runId: cleanRunId, status: "entering-pi", message: "starting bundled Pi inside Rig" } });
+  patchData(ctx, { piAttach: { runId: cleanRunId, status: "entering-pi", message: "starting bundled Pi" } });
   try {
     await preparePiAttachHandoff(ctx, cleanRunId).catch(() => null);
     emitProgress(ctx, label, "starting Bun PTY host for bundled Pi");
@@ -1253,7 +1319,7 @@ async function attachRunWithBundledPi(ctx, runId) {
         piAttach: {
           runId: cleanRunId,
           status: snapshot.status === "failed" ? "failed" : snapshot.status === "exited" ? "returned" : "entering-pi",
-          message: snapshot.message ?? "bundled Pi running inside Rig",
+          message: snapshot.message ?? "bundled Pi running",
           result: { runId: cleanRunId, status: snapshot.status, exitCode: snapshot.exitCode }
         }
       });
@@ -1280,7 +1346,7 @@ async function attachRunWithBundledPi(ctx, runId) {
       status: "running",
       rendered: "bundled Pi embedded via Bun.Terminal + @xterm/headless"
     };
-    emitProgress(ctx, label, "bundled Pi is running inside Rig", { piAttach: { runId: cleanRunId, status: "entering-pi", message: "bundled Pi running inside Rig", result: record } });
+    emitProgress(ctx, label, "bundled Pi is running", { piAttach: { runId: cleanRunId, status: "entering-pi", message: "bundled Pi running", result: record } });
     return record;
   } catch (error) {
     patchData(ctx, { piAttach: { runId: cleanRunId, status: "failed", message: error instanceof Error ? error.message : String(error) } });

package/dist/src/app-opentui/adapters/run-detail.js

@@ -192,17 +192,21 @@ function setGitHubBearerTokenForCurrentProcess(token, projectRoot) {
   const scopedKey = resolve2(projectRoot ?? process.cwd());
   scopedGitHubBearerTokens.set(scopedKey, cleanToken(token ?? undefined));
 }
-function readPrivateRemoteSessionToken(projectRoot) {
+function readRemoteAuthState(projectRoot) {
   const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
   if (!existsSync2(path))
     return null;
   try {
     const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
   }
 }
+function readPrivateRemoteSessionToken(projectRoot) {
+  const parsed = readRemoteAuthState(projectRoot);
+  return parsed ? cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined) : null;
+}
 function readGitHubBearerTokenForRemote(projectRoot) {
   const scopedKey = resolve2(projectRoot);
   if (scopedGitHubBearerTokens.has(scopedKey))
@@ -213,15 +217,25 @@ function readGitHubBearerTokenForRemote(projectRoot) {
   return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
 }
 function readStoredGitHubAuthToken(projectRoot) {
-  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
-  if (!existsSync2(path))
+  const parsed = readRemoteAuthState(projectRoot);
+  return parsed ? cleanToken(typeof parsed.token === "string" ? parsed.token : undefined) : null;
+}
+function inferRemoteServerProjectRootFromAuthState(projectRoot) {
+  const repo = readRepoConnection(projectRoot);
+  const slug = repo?.project?.trim();
+  if (!slug || !/^[^/]+\/[^/]+$/.test(slug))
     return null;
-  try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return cleanToken(typeof parsed.token === "string" ? parsed.token : undefined);
-  } catch {
+  const auth = readRemoteAuthState(projectRoot);
+  const authUpdatedAt = typeof auth?.updatedAt === "string" ? Date.parse(auth.updatedAt) : Number.NaN;
+  const repoLinkedAt = typeof repo?.linkedAt === "string" ? Date.parse(repo.linkedAt) : Number.NaN;
+  if (Number.isFinite(authUpdatedAt) && Number.isFinite(repoLinkedAt) && authUpdatedAt + 1000 < repoLinkedAt)
     return null;
-  }
+  const checkoutBaseDir = typeof auth?.checkoutBaseDir === "string" && auth.checkoutBaseDir.trim() ? auth.checkoutBaseDir.trim() : null;
+  if (!checkoutBaseDir)
+    return null;
+  const inferred = `${checkoutBaseDir.replace(/\/+$/, "")}/${slug}`;
+  writeRepoServerProjectRoot(projectRoot, inferred);
+  return inferred;
 }
 function readLocalConnectionFallbackToken(projectRoot) {
   return readGitHubBearerTokenForRemote(projectRoot) ?? cleanToken(process.env.RIG_GITHUB_TOKEN) ?? readStoredGitHubAuthToken(projectRoot);
@@ -232,7 +246,7 @@ async function ensureServerForCli(projectRoot) {
     if (selected?.connection.kind === "remote") {
       reportServerPhase(`Connecting to ${selected.alias}\u2026`);
       const authToken = readGitHubBearerTokenForRemote(projectRoot);
-      const serverProjectRoot = selected.serverProjectRoot ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
+      const serverProjectRoot = selected.serverProjectRoot ?? inferRemoteServerProjectRootFromAuthState(projectRoot) ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
       return {
         baseUrl: selected.connection.baseUrl,
         authToken,
@@ -261,7 +275,10 @@ async function backfillRemoteServerProjectRoot(projectRoot, baseUrl, authToken)
   if (!slug)
     return null;
   try {
-    const response = await fetch(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`, {
+    const url = new URL(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`);
+    if (authToken && queryAuthFallbackEnabled())
+      url.searchParams.set("rt", authToken);
+    const response = await fetch(url, {
       headers: mergeHeaders(undefined, authToken)
     });
     if (!response.ok)
@@ -288,10 +305,23 @@ function appendTaskFilterParams(url, filters) {
   if (filters.limit !== undefined)
     url.searchParams.set("limit", String(filters.limit));
 }
+function mergeCookie(existing, name, value) {
+  const encoded = `${name}=${encodeURIComponent(value)}`;
+  if (!existing?.trim())
+    return encoded;
+  const parts = existing.split(";").map((part) => part.trim()).filter((part) => part && !part.startsWith(`${name}=`));
+  return [...parts, encoded].join("; ");
+}
+function queryAuthFallbackEnabled(env = process.env) {
+  return env.RIG_ENABLE_QUERY_AUTH_FALLBACK === "1" || env.RIG_QUERY_AUTH_FALLBACK === "1";
+}
 function mergeHeaders(headers, authToken) {
   const merged = new Headers(headers);
   if (authToken) {
-    merged.set("authorization", `Bearer ${authToken}`);
+    const bearer = `Bearer ${authToken}`;
+    merged.set("authorization", bearer);
+    merged.set("x-auth", bearer);
+    merged.set("cookie", mergeCookie(merged.get("cookie"), "rig_auth", authToken));
   }
   return merged;
 }
@@ -351,15 +381,34 @@ async function buildServerFailureContext(projectRoot, server) {
     hint: "Check the selected server with `rig server status`, or switch with `rig server use <alias|local>`."
   };
 }
+function isLoopbackRemoteBaseUrl(baseUrl) {
+  try {
+    const host = new URL(baseUrl).hostname.toLowerCase();
+    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+  } catch {
+    return false;
+  }
+}
+function canUseRemoteWithoutProjectRoot(pathname) {
+  return pathname === "/health" || pathname === "/api/health" || pathname === "/api/server/status" || pathname === "/api/server/project-root" || pathname.startsWith("/api/github/auth/") || pathname === "/api/projects" || pathname.startsWith("/api/projects/");
+}
 async function requestServerJson(context, pathname, init = {}) {
   const server = await ensureServerForCli(context.projectRoot);
+  const requestUrl = new URL(`${server.baseUrl}${pathname}`);
+  if (server.connectionKind === "remote" && !server.serverProjectRoot && !canUseRemoteWithoutProjectRoot(requestUrl.pathname) && (server.authToken || !isLoopbackRemoteBaseUrl(server.baseUrl))) {
+    const repo = readRepoConnection(context.projectRoot);
+    throw new CliError(`Remote server is selected for ${repo?.project ?? "this repo"}, but this checkout has no server-host project root link.`, 1, { hint: "Run `rig init --repair` or `rig init --yes --repo owner/repo --server remote` to repair the remote project link before task/run commands." });
+  }
   const headers = mergeHeaders(init.headers, server.authToken);
   if (server.serverProjectRoot)
     headers.set("x-rig-project-root", server.serverProjectRoot);
+  if (server.connectionKind === "remote" && server.authToken && queryAuthFallbackEnabled()) {
+    requestUrl.searchParams.set("rt", server.authToken);
+  }
   reportServerPhase(`${(init.method ?? "GET").toUpperCase()} ${pathname.split("?")[0]}\u2026`);
   let response;
   try {
-    response = await fetch(`${server.baseUrl}${pathname}`, {
+    response = await fetch(requestUrl, {
       ...init,
       headers
     });
@@ -421,11 +470,26 @@ async function getGitHubAuthStatusViaServer(context) {
   return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
 }
 async function postGitHubTokenViaServer(context, token, options = {}) {
-  const payload = await requestServerJson(context, "/api/github/auth/token", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ token, selectedRepo: options.selectedRepo, projectRoot: options.projectRoot })
-  });
+  const server = await ensureServerForCli(context.projectRoot);
+  const requestUrl = new URL(`${server.baseUrl}/api/github/auth/token`);
+  reportServerPhase("POST /api/github/auth/token\u2026");
+  let response;
+  try {
+    response = await fetch(requestUrl, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ token, selectedRepo: options.selectedRepo, projectRoot: options.projectRoot ?? server.serverProjectRoot ?? undefined })
+    });
+  } catch (error) {
+    const failure = await buildServerFailureContext(context.projectRoot, server);
+    throw new CliError(`Rig server auth bootstrap failed: ${error instanceof Error ? error.message : String(error)}
+${failure.contextLine}`, 1, { hint: failure.hint });
+  }
+  const payload = await response.json().catch(() => null);
+  if (!response.ok) {
+    const detail = payload && typeof payload === "object" && !Array.isArray(payload) ? String(payload.error ?? JSON.stringify(payload)) : `HTTP ${response.status}`;
+    throw new CliError(`Rig server auth bootstrap failed (${response.status}): ${detail}`, 1, { hint: "Re-run `rig github auth import-gh`, or check the selected server with `rig server status`." });
+  }
   return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
 }
 async function prepareRemoteCheckoutViaServer(context, input) {
@@ -716,7 +780,7 @@ function projectRootOf(ctx) {
   const root = ctx.rig?.projectRoot ?? ctx.projectRoot ?? ctx.getState().projectRoot;
   if (typeof root === "string" && root.trim())
     return root;
-  throw new Error("Rig app adapter requires a projectRoot.");
+  throw new Error("App adapter requires a projectRoot.");
 }
 function normalizeAppError(error) {
   const message = error instanceof Error ? error.message : String(error);