@h-rig/cli 0.0.6-alpha.82 → 0.0.6-alpha.83

package/dist/src/app/board.js

@@ -564,17 +564,21 @@ function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
 }
-function readPrivateRemoteSessionToken(projectRoot) {
+function readRemoteAuthState(projectRoot) {
   const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
   if (!existsSync2(path))
     return null;
   try {
     const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
   }
 }
+function readPrivateRemoteSessionToken(projectRoot) {
+  const parsed = readRemoteAuthState(projectRoot);
+  return parsed ? cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined) : null;
+}
 function readGitHubBearerTokenForRemote(projectRoot) {
   const scopedKey = resolve2(projectRoot);
   if (scopedGitHubBearerTokens.has(scopedKey))
@@ -585,15 +589,25 @@ function readGitHubBearerTokenForRemote(projectRoot) {
   return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
 }
 function readStoredGitHubAuthToken(projectRoot) {
-  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
-  if (!existsSync2(path))
+  const parsed = readRemoteAuthState(projectRoot);
+  return parsed ? cleanToken(typeof parsed.token === "string" ? parsed.token : undefined) : null;
+}
+function inferRemoteServerProjectRootFromAuthState(projectRoot) {
+  const repo = readRepoConnection(projectRoot);
+  const slug = repo?.project?.trim();
+  if (!slug || !/^[^/]+\/[^/]+$/.test(slug))
     return null;
-  try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return cleanToken(typeof parsed.token === "string" ? parsed.token : undefined);
-  } catch {
+  const auth = readRemoteAuthState(projectRoot);
+  const authUpdatedAt = typeof auth?.updatedAt === "string" ? Date.parse(auth.updatedAt) : Number.NaN;
+  const repoLinkedAt = typeof repo?.linkedAt === "string" ? Date.parse(repo.linkedAt) : Number.NaN;
+  if (Number.isFinite(authUpdatedAt) && Number.isFinite(repoLinkedAt) && authUpdatedAt + 1000 < repoLinkedAt)
     return null;
-  }
+  const checkoutBaseDir = typeof auth?.checkoutBaseDir === "string" && auth.checkoutBaseDir.trim() ? auth.checkoutBaseDir.trim() : null;
+  if (!checkoutBaseDir)
+    return null;
+  const inferred = `${checkoutBaseDir.replace(/\/+$/, "")}/${slug}`;
+  writeRepoServerProjectRoot(projectRoot, inferred);
+  return inferred;
 }
 function readLocalConnectionFallbackToken(projectRoot) {
   return readGitHubBearerTokenForRemote(projectRoot) ?? cleanToken(process.env.RIG_GITHUB_TOKEN) ?? readStoredGitHubAuthToken(projectRoot);
@@ -604,7 +618,7 @@ async function ensureServerForCli(projectRoot) {
     if (selected?.connection.kind === "remote") {
       reportServerPhase(`Connecting to ${selected.alias}\u2026`);
       const authToken = readGitHubBearerTokenForRemote(projectRoot);
-      const serverProjectRoot = selected.serverProjectRoot ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
+      const serverProjectRoot = selected.serverProjectRoot ?? inferRemoteServerProjectRootFromAuthState(projectRoot) ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
       return {
         baseUrl: selected.connection.baseUrl,
         authToken,
@@ -633,7 +647,10 @@ async function backfillRemoteServerProjectRoot(projectRoot, baseUrl, authToken)
   if (!slug)
     return null;
   try {
-    const response = await fetch(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`, {
+    const url = new URL(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`);
+    if (authToken && queryAuthFallbackEnabled())
+      url.searchParams.set("rt", authToken);
+    const response = await fetch(url, {
       headers: mergeHeaders(undefined, authToken)
     });
     if (!response.ok)
@@ -660,10 +677,23 @@ function appendTaskFilterParams(url, filters) {
   if (filters.limit !== undefined)
     url.searchParams.set("limit", String(filters.limit));
 }
+function mergeCookie(existing, name, value) {
+  const encoded = `${name}=${encodeURIComponent(value)}`;
+  if (!existing?.trim())
+    return encoded;
+  const parts = existing.split(";").map((part) => part.trim()).filter((part) => part && !part.startsWith(`${name}=`));
+  return [...parts, encoded].join("; ");
+}
+function queryAuthFallbackEnabled(env = process.env) {
+  return env.RIG_ENABLE_QUERY_AUTH_FALLBACK === "1" || env.RIG_QUERY_AUTH_FALLBACK === "1";
+}
 function mergeHeaders(headers, authToken) {
   const merged = new Headers(headers);
   if (authToken) {
-    merged.set("authorization", `Bearer ${authToken}`);
+    const bearer = `Bearer ${authToken}`;
+    merged.set("authorization", bearer);
+    merged.set("x-auth", bearer);
+    merged.set("cookie", mergeCookie(merged.get("cookie"), "rig_auth", authToken));
   }
   return merged;
 }
@@ -724,15 +754,34 @@ async function buildServerFailureContext(projectRoot, server) {
     hint: "Check the selected server with `rig server status`, or switch with `rig server use <alias|local>`."
   };
 }
+function isLoopbackRemoteBaseUrl(baseUrl) {
+  try {
+    const host = new URL(baseUrl).hostname.toLowerCase();
+    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+  } catch {
+    return false;
+  }
+}
+function canUseRemoteWithoutProjectRoot(pathname) {
+  return pathname === "/health" || pathname === "/api/health" || pathname === "/api/server/status" || pathname === "/api/server/project-root" || pathname.startsWith("/api/github/auth/") || pathname === "/api/projects" || pathname.startsWith("/api/projects/");
+}
 async function requestServerJson(context, pathname, init = {}) {
   const server = await ensureServerForCli(context.projectRoot);
+  const requestUrl = new URL(`${server.baseUrl}${pathname}`);
+  if (server.connectionKind === "remote" && !server.serverProjectRoot && !canUseRemoteWithoutProjectRoot(requestUrl.pathname) && (server.authToken || !isLoopbackRemoteBaseUrl(server.baseUrl))) {
+    const repo = readRepoConnection(context.projectRoot);
+    throw new CliError(`Remote server is selected for ${repo?.project ?? "this repo"}, but this checkout has no server-host project root link.`, 1, { hint: "Run `rig init --repair` or `rig init --yes --repo owner/repo --server remote` to repair the remote project link before task/run commands." });
+  }
   const headers = mergeHeaders(init.headers, server.authToken);
   if (server.serverProjectRoot)
     headers.set("x-rig-project-root", server.serverProjectRoot);
+  if (server.connectionKind === "remote" && server.authToken && queryAuthFallbackEnabled()) {
+    requestUrl.searchParams.set("rt", server.authToken);
+  }
   reportServerPhase(`${(init.method ?? "GET").toUpperCase()} ${pathname.split("?")[0]}\u2026`);
   let response;
   try {
-    response = await fetch(`${server.baseUrl}${pathname}`, {
+    response = await fetch(requestUrl, {
       ...init,
       headers
     });

package/dist/src/app-opentui/adapters/command.d.ts

@@ -0,0 +1,2 @@
+import type { AppAdapterContext } from "./common";
+export declare function runCommandInAppPty(ctx: AppAdapterContext, argv: readonly string[]): Promise<void>;

package/dist/src/app-opentui/adapters/command.js

@@ -0,0 +1,329 @@
+// @bun
+// packages/cli/src/app-opentui/adapters/common.ts
+function projectRootOf(ctx) {
+  const root = ctx.rig?.projectRoot ?? ctx.projectRoot ?? ctx.getState().projectRoot;
+  if (typeof root === "string" && root.trim())
+    return root;
+  throw new Error("App adapter requires a projectRoot.");
+}
+function normalizeAppError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  const rawHint = error instanceof Error ? error.hint : undefined;
+  return {
+    message,
+    ...typeof rawHint === "string" && rawHint.trim() ? { hint: rawHint.trim() } : {}
+  };
+}
+function emitStarted(ctx, label, optimistic) {
+  ctx.emit({ type: "action.started", label, ...optimistic ? { optimistic } : {} });
+}
+function emitCompleted(ctx, label, data) {
+  ctx.emit({ type: "action.completed", label, ...data ? { data } : {} });
+}
+function emitFailed(ctx, label, error, data) {
+  if (data)
+    patchData(ctx, data);
+  const normalized = normalizeAppError(error);
+  ctx.emit({
+    type: "action.failed",
+    label,
+    message: normalized.message,
+    ...normalized.hint ? { hint: normalized.hint } : {},
+    cause: error
+  });
+}
+function patchData(ctx, data) {
+  ctx.emit({ type: "data.patch", data });
+}
+function patchFooter(ctx, footer) {
+  ctx.emit({ type: "footer.patch", footer });
+}
+
+// packages/cli/src/app-opentui/command-pty-host.ts
+import { basename } from "path";
+import { fileURLToPath } from "url";
+import { Terminal as XtermTerminal } from "@xterm/headless";
+var MIN_COLS = 40;
+var MIN_ROWS = 10;
+var MAX_ROWS = 300;
+var MAX_SNAPSHOT_LINES = 420;
+var SNAPSHOT_DELAY_MS = 80;
+var fallbackCliScriptPath = fileURLToPath(new URL("../../bin/rig.ts", import.meta.url));
+var activeHost = null;
+function clampCols(cols) {
+  return Math.max(MIN_COLS, Math.trunc(cols || 120));
+}
+function clampRows(rows) {
+  return Math.max(MIN_ROWS, Math.min(MAX_ROWS, Math.trunc(rows || 36)));
+}
+function childCommandPrefix() {
+  const execName = basename(process.execPath).toLowerCase();
+  const currentEntry = process.argv[1];
+  if (execName === "bun" || execName === "bun.exe") {
+    return currentEntry ? [process.execPath, currentEntry] : [process.execPath, fallbackCliScriptPath];
+  }
+  return [process.execPath];
+}
+function withEnv(base) {
+  const env = {};
+  for (const [key, value] of Object.entries(base ?? process.env)) {
+    if (key === "NO_COLOR")
+      continue;
+    if (typeof value === "string")
+      env[key] = value;
+  }
+  return {
+    ...env,
+    TERM: "xterm-256color",
+    COLORTERM: "truecolor",
+    FORCE_COLOR: env.FORCE_COLOR ?? "1",
+    RIG_PLAIN: "1",
+    RIG_OPENTUI_COMMAND_HOST: "1",
+    RIG_CLI_PLAIN_HELP: env.RIG_CLI_PLAIN_HELP ?? "1"
+  };
+}
+function commandLabel(argv, fallback) {
+  const command = argv.join(" ").trim();
+  return fallback?.trim() || (command ? `rig ${command}` : "rig");
+}
+async function startCommandPtyHost(options) {
+  activeHost?.dispose("replace");
+  const host = new CommandPtyHost(options);
+  activeHost = host;
+  await host.start();
+  return host;
+}
+
+class CommandPtyHost {
+  argv;
+  projectRoot;
+  label;
+  env;
+  onSnapshot;
+  onExit;
+  onError;
+  terminal;
+  decoder = new TextDecoder("utf-8");
+  proc = null;
+  pty = null;
+  status = "starting";
+  cols;
+  rows;
+  message = "starting command";
+  exitCode;
+  signal;
+  notifyTimer = null;
+  _disposed = false;
+  constructor(options) {
+    this.argv = [...options.argv];
+    this.projectRoot = options.projectRoot;
+    this.label = commandLabel(options.argv, options.label);
+    this.env = options.env;
+    this.cols = clampCols(options.cols);
+    this.rows = clampRows(options.rows);
+    this.onSnapshot = options.onSnapshot;
+    this.onExit = options.onExit;
+    this.onError = options.onError;
+    this.terminal = new XtermTerminal({ allowProposedApi: true, cols: this.cols, rows: this.rows, scrollback: 2000 });
+  }
+  get disposed() {
+    return this._disposed;
+  }
+  get snapshot() {
+    return this.createSnapshot();
+  }
+  async start() {
+    if (this._disposed)
+      throw new Error("Command PTY host is disposed.");
+    if (typeof Bun.Terminal !== "function") {
+      throw new Error("Bun native PTY is unavailable in this runtime. Command host requires Bun.Terminal.");
+    }
+    const spawnOptions = {
+      cwd: this.projectRoot,
+      env: withEnv(this.env),
+      terminal: {
+        cols: this.cols,
+        rows: this.rows,
+        name: "xterm-256color",
+        data: (_terminal, data) => this.handlePtyData(data)
+      }
+    };
+    const proc = Bun.spawn([...childCommandPrefix(), ...this.argv], spawnOptions);
+    if (!proc.terminal)
+      throw new Error("Bun did not attach a terminal to the command child process.");
+    this.proc = proc;
+    this.pty = proc.terminal;
+    this.status = "running";
+    this.message = "running";
+    this.emitSnapshotSoon(0);
+    proc.exited.then((exitCode) => {
+      if (this._disposed)
+        return;
+      this.status = exitCode === 0 ? "exited" : "failed";
+      this.exitCode = exitCode;
+      this.signal = null;
+      this.message = exitCode === 0 ? "completed" : `exited with code ${exitCode}`;
+      const snapshot = this.createSnapshot();
+      this.onSnapshot?.(snapshot);
+      this.onExit?.(snapshot);
+      if (activeHost === this)
+        activeHost = null;
+      this.dispose("exit", { kill: false, notify: false });
+    }).catch((error) => {
+      if (this._disposed)
+        return;
+      this.status = "failed";
+      this.message = error instanceof Error ? error.message : String(error);
+      const snapshot = this.createSnapshot();
+      this.onSnapshot?.(snapshot);
+      this.onError?.(error, snapshot);
+      if (activeHost === this)
+        activeHost = null;
+      this.dispose("error", { kill: false, notify: false });
+    });
+  }
+  write(data) {
+    if (this._disposed || !this.pty)
+      return;
+    try {
+      this.pty.write(data);
+    } catch (error) {
+      this.status = "failed";
+      this.message = error instanceof Error ? error.message : String(error);
+      const snapshot = this.createSnapshot();
+      this.onSnapshot?.(snapshot);
+      this.onError?.(error, snapshot);
+    }
+  }
+  resize(cols, rows) {
+    const nextCols = clampCols(cols);
+    const nextRows = clampRows(rows);
+    if (nextCols === this.cols && nextRows === this.rows)
+      return;
+    this.cols = nextCols;
+    this.rows = nextRows;
+    this.terminal.resize(nextCols, nextRows);
+    try {
+      this.pty?.resize(nextCols, nextRows);
+    } catch {}
+    this.emitSnapshotSoon(0);
+  }
+  dispose(reason = "dispose", options = {}) {
+    if (this._disposed)
+      return;
+    this._disposed = true;
+    if (this.notifyTimer)
+      clearTimeout(this.notifyTimer);
+    this.notifyTimer = null;
+    if (options.kill !== false) {
+      try {
+        this.proc?.kill("SIGTERM");
+      } catch {}
+    }
+    try {
+      this.pty?.close();
+    } catch {}
+    try {
+      this.terminal.dispose();
+    } catch {}
+    if (activeHost === this)
+      activeHost = null;
+    if (options.notify) {
+      this.message = reason;
+      this.onSnapshot?.(this.createSnapshot(reason));
+    }
+  }
+  handlePtyData(data) {
+    if (this._disposed)
+      return;
+    this.decoder.decode(data, { stream: true });
+    this.terminal.write(data, () => this.emitSnapshotSoon());
+  }
+  emitSnapshotSoon(delayMs = SNAPSHOT_DELAY_MS) {
+    if (this._disposed || this.notifyTimer)
+      return;
+    this.notifyTimer = setTimeout(() => {
+      this.notifyTimer = null;
+      if (this._disposed)
+        return;
+      this.onSnapshot?.(this.createSnapshot());
+    }, delayMs);
+  }
+  createSnapshot(message = this.message) {
+    const buffer = this.terminal.buffer.active;
+    const end = buffer.length;
+    const start = Math.max(0, end - MAX_SNAPSHOT_LINES);
+    const lines = [];
+    for (let row = start;row < end; row += 1) {
+      const line = buffer.getLine(row);
+      lines.push((line?.translateToString(false) ?? "").slice(0, this.cols));
+    }
+    while (lines.length < this.rows)
+      lines.push("");
+    return {
+      command: this.argv,
+      label: this.label,
+      status: this.status,
+      cols: this.cols,
+      rows: this.rows,
+      lines,
+      message,
+      ...this.exitCode !== undefined ? { exitCode: this.exitCode } : {},
+      ...this.signal !== undefined ? { signal: this.signal } : {}
+    };
+  }
+}
+
+// packages/cli/src/app-opentui/adapters/command.ts
+function commandLabel2(argv) {
+  const command = argv.join(" ").trim();
+  return command ? `rig ${command}` : "rig";
+}
+async function runCommandInAppPty(ctx, argv) {
+  const label = commandLabel2(argv);
+  emitStarted(ctx, label, { command: { label, argv, status: "starting" } });
+  patchData(ctx, {
+    command: { label, argv, status: "starting" },
+    commandTerminal: {
+      command: argv,
+      label,
+      status: "starting",
+      cols: 120,
+      rows: 32,
+      lines: [],
+      message: "starting"
+    }
+  });
+  patchFooter(ctx, { message: label });
+  try {
+    const host = await startCommandPtyHost({
+      argv,
+      projectRoot: projectRootOf(ctx),
+      cols: 120,
+      rows: 32,
+      label,
+      onSnapshot(snapshot) {
+        patchData(ctx, { commandTerminal: snapshot, command: { label, argv, status: snapshot.status, message: snapshot.message } });
+        patchFooter(ctx, { message: `${label} \xB7 ${snapshot.message ?? snapshot.status}` });
+      },
+      onExit(snapshot) {
+        patchData(ctx, { commandTerminal: snapshot, command: { label, argv, status: snapshot.status, message: snapshot.message } });
+        if (snapshot.status === "exited")
+          emitCompleted(ctx, label, { exitCode: snapshot.exitCode ?? 0 });
+        else
+          emitFailed(ctx, label, new Error(snapshot.message ?? "Command failed"), { commandTerminal: snapshot });
+      },
+      onError(error, snapshot) {
+        patchData(ctx, { commandTerminal: snapshot, command: { label, argv, status: "failed", message: snapshot.message } });
+        emitFailed(ctx, label, error, { commandTerminal: snapshot });
+      }
+    });
+    patchData(ctx, { commandTerminal: host.snapshot });
+  } catch (error) {
+    emitFailed(ctx, label, error);
+    throw error;
+  }
+}
+export {
+  runCommandInAppPty
+};

package/dist/src/app-opentui/adapters/common.js

@@ -13,7 +13,7 @@ function projectRootOf(ctx) {
   const root = ctx.rig?.projectRoot ?? ctx.projectRoot ?? ctx.getState().projectRoot;
   if (typeof root === "string" && root.trim())
     return root;
-  throw new Error("Rig app adapter requires a projectRoot.");
+  throw new Error("App adapter requires a projectRoot.");
 }
 async function runtimeOf(ctx) {
   if (ctx.rig && "runId" in ctx.rig && ctx.ensureRuntime === undefined) {
@@ -21,7 +21,7 @@ async function runtimeOf(ctx) {
   }
   if (ctx.ensureRuntime)
     return ctx.ensureRuntime();
-  throw new Error("Rig app adapter requires ensureRuntime() before this action can run.");
+  throw new Error("App adapter requires ensureRuntime() before this action can run.");
 }
 function normalizeAppError(error) {
   const message = error instanceof Error ? error.message : String(error);

package/dist/src/app-opentui/adapters/doctor.js

@@ -145,17 +145,21 @@ function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
 }
-function readPrivateRemoteSessionToken(projectRoot) {
+function readRemoteAuthState(projectRoot) {
   const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
   if (!existsSync2(path))
     return null;
   try {
     const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
   }
 }
+function readPrivateRemoteSessionToken(projectRoot) {
+  const parsed = readRemoteAuthState(projectRoot);
+  return parsed ? cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined) : null;
+}
 function readGitHubBearerTokenForRemote(projectRoot) {
   const scopedKey = resolve2(projectRoot);
   if (scopedGitHubBearerTokens.has(scopedKey))
@@ -166,15 +170,25 @@ function readGitHubBearerTokenForRemote(projectRoot) {
   return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
 }
 function readStoredGitHubAuthToken(projectRoot) {
-  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
-  if (!existsSync2(path))
+  const parsed = readRemoteAuthState(projectRoot);
+  return parsed ? cleanToken(typeof parsed.token === "string" ? parsed.token : undefined) : null;
+}
+function inferRemoteServerProjectRootFromAuthState(projectRoot) {
+  const repo = readRepoConnection(projectRoot);
+  const slug = repo?.project?.trim();
+  if (!slug || !/^[^/]+\/[^/]+$/.test(slug))
     return null;
-  try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return cleanToken(typeof parsed.token === "string" ? parsed.token : undefined);
-  } catch {
+  const auth = readRemoteAuthState(projectRoot);
+  const authUpdatedAt = typeof auth?.updatedAt === "string" ? Date.parse(auth.updatedAt) : Number.NaN;
+  const repoLinkedAt = typeof repo?.linkedAt === "string" ? Date.parse(repo.linkedAt) : Number.NaN;
+  if (Number.isFinite(authUpdatedAt) && Number.isFinite(repoLinkedAt) && authUpdatedAt + 1000 < repoLinkedAt)
     return null;
-  }
+  const checkoutBaseDir = typeof auth?.checkoutBaseDir === "string" && auth.checkoutBaseDir.trim() ? auth.checkoutBaseDir.trim() : null;
+  if (!checkoutBaseDir)
+    return null;
+  const inferred = `${checkoutBaseDir.replace(/\/+$/, "")}/${slug}`;
+  writeRepoServerProjectRoot(projectRoot, inferred);
+  return inferred;
 }
 function readLocalConnectionFallbackToken(projectRoot) {
   return readGitHubBearerTokenForRemote(projectRoot) ?? cleanToken(process.env.RIG_GITHUB_TOKEN) ?? readStoredGitHubAuthToken(projectRoot);
@@ -185,7 +199,7 @@ async function ensureServerForCli(projectRoot) {
     if (selected?.connection.kind === "remote") {
       reportServerPhase(`Connecting to ${selected.alias}\u2026`);
       const authToken = readGitHubBearerTokenForRemote(projectRoot);
-      const serverProjectRoot = selected.serverProjectRoot ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
+      const serverProjectRoot = selected.serverProjectRoot ?? inferRemoteServerProjectRootFromAuthState(projectRoot) ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
       return {
         baseUrl: selected.connection.baseUrl,
         authToken,
@@ -214,7 +228,10 @@ async function backfillRemoteServerProjectRoot(projectRoot, baseUrl, authToken)
   if (!slug)
     return null;
   try {
-    const response = await fetch(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`, {
+    const url = new URL(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`);
+    if (authToken && queryAuthFallbackEnabled())
+      url.searchParams.set("rt", authToken);
+    const response = await fetch(url, {
       headers: mergeHeaders(undefined, authToken)
     });
     if (!response.ok)
@@ -231,10 +248,23 @@ async function backfillRemoteServerProjectRoot(projectRoot, baseUrl, authToken)
     return null;
   }
 }
+function mergeCookie(existing, name, value) {
+  const encoded = `${name}=${encodeURIComponent(value)}`;
+  if (!existing?.trim())
+    return encoded;
+  const parts = existing.split(";").map((part) => part.trim()).filter((part) => part && !part.startsWith(`${name}=`));
+  return [...parts, encoded].join("; ");
+}
+function queryAuthFallbackEnabled(env = process.env) {
+  return env.RIG_ENABLE_QUERY_AUTH_FALLBACK === "1" || env.RIG_QUERY_AUTH_FALLBACK === "1";
+}
 function mergeHeaders(headers, authToken) {
   const merged = new Headers(headers);
   if (authToken) {
-    merged.set("authorization", `Bearer ${authToken}`);
+    const bearer = `Bearer ${authToken}`;
+    merged.set("authorization", bearer);
+    merged.set("x-auth", bearer);
+    merged.set("cookie", mergeCookie(merged.get("cookie"), "rig_auth", authToken));
   }
   return merged;
 }
@@ -294,15 +324,34 @@ async function buildServerFailureContext(projectRoot, server) {
     hint: "Check the selected server with `rig server status`, or switch with `rig server use <alias|local>`."
   };
 }
+function isLoopbackRemoteBaseUrl(baseUrl) {
+  try {
+    const host = new URL(baseUrl).hostname.toLowerCase();
+    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+  } catch {
+    return false;
+  }
+}
+function canUseRemoteWithoutProjectRoot(pathname) {
+  return pathname === "/health" || pathname === "/api/health" || pathname === "/api/server/status" || pathname === "/api/server/project-root" || pathname.startsWith("/api/github/auth/") || pathname === "/api/projects" || pathname.startsWith("/api/projects/");
+}
 async function requestServerJson(context, pathname, init = {}) {
   const server = await ensureServerForCli(context.projectRoot);
+  const requestUrl = new URL(`${server.baseUrl}${pathname}`);
+  if (server.connectionKind === "remote" && !server.serverProjectRoot && !canUseRemoteWithoutProjectRoot(requestUrl.pathname) && (server.authToken || !isLoopbackRemoteBaseUrl(server.baseUrl))) {
+    const repo = readRepoConnection(context.projectRoot);
+    throw new CliError(`Remote server is selected for ${repo?.project ?? "this repo"}, but this checkout has no server-host project root link.`, 1, { hint: "Run `rig init --repair` or `rig init --yes --repo owner/repo --server remote` to repair the remote project link before task/run commands." });
+  }
   const headers = mergeHeaders(init.headers, server.authToken);
   if (server.serverProjectRoot)
     headers.set("x-rig-project-root", server.serverProjectRoot);
+  if (server.connectionKind === "remote" && server.authToken && queryAuthFallbackEnabled()) {
+    requestUrl.searchParams.set("rt", server.authToken);
+  }
   reportServerPhase(`${(init.method ?? "GET").toUpperCase()} ${pathname.split("?")[0]}\u2026`);
   let response;
   try {
-    response = await fetch(`${server.baseUrl}${pathname}`, {
+    response = await fetch(requestUrl, {
       ...init,
       headers
     });
@@ -699,7 +748,7 @@ function projectRootOf(ctx) {
   const root = ctx.rig?.projectRoot ?? ctx.projectRoot ?? ctx.getState().projectRoot;
   if (typeof root === "string" && root.trim())
     return root;
-  throw new Error("Rig app adapter requires a projectRoot.");
+  throw new Error("App adapter requires a projectRoot.");
 }
 function normalizeAppError(error) {
   const message = error instanceof Error ? error.message : String(error);