@h-rig/cli 0.0.6-alpha.82 → 0.0.6-alpha.84

package/dist/src/app/board.js

@@ -384,30 +384,62 @@ var PRIMARY_GROUPS = [
   }
 ];
 var ADVANCED_GROUPS = [
-  { name: "setup", summary: "Bootstrap/check local setup.", usage: ["rig setup <bootstrap|check|preflight>"], commands: [{ command: "bootstrap|check|preflight", description: "Setup helpers." }] },
-  { name: "profile", summary: "Runtime profile/model defaults.", usage: ["rig profile <show|set>"], commands: [{ command: "show", description: "Show active profile." }] },
+  {
+    name: "setup",
+    summary: "Bootstrap/check local setup.",
+    usage: ["rig setup <bootstrap|check|preflight>"],
+    commands: [
+      { command: "bootstrap", description: "Bootstrap local setup dependencies.", primary: true },
+      { command: "check", description: "Check local setup state (toolchain, deps, config).", primary: true },
+      { command: "preflight", description: "Run preflight checks before a run.", primary: true }
+    ]
+  },
+  {
+    name: "profile",
+    summary: "Runtime profile/model defaults.",
+    usage: ["rig profile <show|set>"],
+    commands: [
+      { command: "show", description: "Show the active execution profile.", primary: true },
+      { command: "set [--model <model>] [--runtime <runtime>] [--plugin <plugin>]", description: "Set model/runtime/plugin profile defaults.", primary: true }
+    ]
+  },
   {
     name: "review",
     summary: "Inspect or change completion review gate policy.",
     usage: ["rig review <show|set>"],
     commands: [
       { command: "show", description: "Show current review gate settings." },
-      { command: "set <off|advisory|required> [--provider greptile]", description: "Change review strictness/provider." }
+      { command: "set <off|advisory|required> [--provider <provider>]", description: "Change review strictness/provider (e.g. --provider greptile)." }
     ],
     examples: ["rig review show", "rig review set required --provider greptile"],
     next: ["Use `rig inbox approvals` for blocked run handoffs."]
   },
   {
     name: "browser",
-    summary: "Browser/app diagnostics for browser-required tasks.",
-    usage: ["rig browser <help|explain|demo|app|hp-next> [options]"],
+    summary: "Browser workstation actions for browser-required tasks: launch, check, CDP probe, profile reset, and app-specific smokes.",
+    usage: ["rig browser <help|explain|demo|hp-next|cdp-probe|profile-persistence|profile-lock-check|smoke-test> [options]"],
     commands: [
-      { command: "help", description: "Rich browser command help (canonical: `rig browser help`)." },
-      { command: "explain", description: "Explain the browser-required task contract." },
-      { command: "demo", description: "Run browser demo flows against a local page." },
-      { command: "app", description: "Launch the Rig Browser workstation app." },
-      { command: "hp-next <dev|check|e2e|reset>", description: "Drive the hp-next browser test harness." }
-    ]
+      { command: "help", description: "Rich browser command help (canonical: `rig browser help`).", primary: true },
+      { command: "explain", description: "Explain the browser-required task contract and runtime helper commands.", primary: true },
+      { command: "demo [--port <n>] [--profile <name>] [--state-dir <path>] [--target-url <url>] [--keep-open] [--no-build]", description: "Run a guided real browser/agent demo flow.", primary: true },
+      { command: "hp-next dev", description: "Start hp-next Rig Browser in dev/watch mode.", primary: true },
+      { command: "hp-next start", description: "Build/start the hp-next browser workstation without watch mode.", primary: true },
+      { command: "hp-next check", description: "Validate the hp-next CDP endpoint on the configured port.", primary: true },
+      { command: "hp-next e2e", description: "Run hp-next browser e2e smoke checks through Rig Browser.", primary: true },
+      { command: "hp-next reset", description: "Reset the hp-next browser profile when stale browser state is suspected.", primary: true },
+      { command: "cdp-probe", description: "Run an isolated CDP attach/evaluate/layout probe." },
+      { command: "profile-persistence", description: "Verify a named browser profile persists browser state." },
+      { command: "profile-lock-check", description: "Verify concurrent launches reject the same profile." },
+      { command: "smoke-test", description: "Run the browser package smoke test." }
+    ],
+    examples: [
+      "rig browser help",
+      "rig browser hp-next check",
+      "rig browser hp-next e2e",
+      "rig browser cdp-probe",
+      "rig browser profile-lock-check"
+    ],
+    next: ["Inside a task run, use rig-browser-launch, rig-browser-check, and rig-browser-attach-info from the worker PATH."]
   },
   {
     name: "pi",
@@ -422,12 +454,60 @@ var ADVANCED_GROUPS = [
     examples: ["rig pi search subagents", "rig pi add pi-subagents", "rig pi list"],
     next: ["Config-managed extensions: declare `runtime: { pi: { packages: [...] } }` in rig.config.ts \u2014 workers pick them up automatically."]
   },
-  { name: "queue", summary: "Run task queues locally.", usage: ["rig queue run [options]"], commands: [{ command: "run", description: "Process queue work." }] },
-  { name: "agent", summary: "Runtime agent workspace helpers.", usage: ["rig agent <list|prepare|run|cleanup>"], commands: [{ command: "list", description: "List prepared agents." }] },
+  {
+    name: "queue",
+    summary: "Run task queues locally.",
+    usage: ["rig queue run [--workers <n>] [--max-tasks <n>] [--action validate|verify|pipeline] [--isolation off|worktree] [--no-runtime-reuse] [--fail-fast] [--skip-project-sync]"],
+    commands: [
+      { command: "run [--workers <n>] [--max-tasks <n>] [--action validate|verify|pipeline] [--isolation off|worktree] [--no-runtime-reuse] [--fail-fast] [--skip-project-sync]", description: "Process queue work: drain matching tasks with N workers, optional per-task action and isolation.", primary: true }
+    ]
+  },
+  {
+    name: "agent",
+    summary: "Runtime agent workspace helpers.",
+    usage: ["rig agent <list|prepare|run|cleanup>"],
+    commands: [
+      { command: "list", description: "List prepared agent runtimes.", primary: true },
+      { command: "prepare [--id <id>] [--mode <mode>] [--task <task>]", description: "Prepare an isolated agent runtime workspace.", primary: true },
+      { command: "run [--id <id>] [--mode <mode>] [--task <task>] [--skip-project-sync]", description: "Prepare (if needed) and run an agent in its workspace.", primary: true },
+      { command: "cleanup [--all] [--id <id>]", description: "Remove prepared agent workspaces.", primary: true }
+    ]
+  },
   { name: "inspector", summary: "Event stream and drift scanners.", usage: ["rig inspector <stream|scan-upstream-drift>"], commands: [{ command: "stream", description: "Stream events." }] },
-  { name: "dist", summary: "Build/install packaged Rig CLI.", usage: ["rig dist <build|install|doctor>"], commands: [{ command: "build", description: "Build distribution." }] },
+  {
+    name: "dist",
+    summary: "Build/install packaged Rig CLI.",
+    usage: ["rig dist <build|install|doctor|rebuild-agent>"],
+    commands: [
+      { command: "build [--output-dir <dir>]", description: "Build the distributable Rig CLI.", primary: true },
+      { command: "install [--scope <scope>] [--path <path>]", description: "Install the built CLI to a scope/path.", primary: true },
+      { command: "doctor", description: "Diagnose the dist toolchain and install state.", primary: true },
+      { command: "rebuild-agent", description: "Rebuild the agent runtime image, pruning stale images.", primary: true }
+    ]
+  },
   { name: "workspace", summary: "Workspace topology/service helpers.", usage: ["rig workspace <summary|topology|remote-hosts>"], commands: [{ command: "summary", description: "Show workspace summary." }] },
-  { name: "remote", summary: "Compatibility remote orchestration controls.", usage: ["rig remote <status|watch|pause|resume|...>"], commands: [{ command: "status", description: "Show remote state." }] },
+  {
+    name: "remote",
+    summary: "Compatibility remote orchestration controls.",
+    usage: ["rig remote <status|tasks|watch|pause|resume|continue|stop|refresh|add-iterations|remove-iterations|endpoint ...>"],
+    commands: [
+      { command: "status [--remote <alias>]", description: "Show the remote orchestration state.", primary: true },
+      { command: "tasks [--remote <alias>]", description: "List the remote's tracked tasks.", primary: true },
+      { command: "watch [--remote <alias>] [--seconds <n>] [--event <type>]", description: "Stream remote orchestration events.", primary: true },
+      { command: "pause [--remote <alias>]", description: "Pause the running remote orchestration.", primary: true },
+      { command: "resume [--remote <alias>] [--max-workers <n>] [--max-iterations <n>] [--direct-merge]", description: "Resume the remote with optional tuning.", primary: true },
+      { command: "continue [--remote <alias>]", description: "Continue a paused remote orchestration.", primary: true },
+      { command: "stop [--remote <alias>]", description: "Stop the remote orchestration.", primary: true },
+      { command: "refresh [--remote <alias>]", description: "Refresh remote state.", primary: true },
+      { command: "add-iterations [--count <n>] [--remote <alias>]", description: "Grant the remote more iterations.", primary: true },
+      { command: "remove-iterations [--count <n>] [--remote <alias>]", description: "Reduce the remote's iteration budget.", primary: true },
+      { command: "endpoint list", description: "List configured remote endpoints.", primary: true },
+      { command: "endpoint add --alias <alias> --host <host> --port <n> [--token <token>]", description: "Register a remote endpoint.", primary: true },
+      { command: "endpoint remove --alias <alias>", description: "Remove a remote endpoint.", primary: true },
+      { command: "endpoint test [--alias <alias>]", description: "Test connectivity to a remote endpoint.", primary: true },
+      { command: "endpoint doctor", description: "Diagnose remote endpoint configuration.", primary: true }
+    ]
+  },
   { name: "git", summary: "Pass through to Rig git-flow helper.", usage: ["rig git <args...>"], commands: [{ command: "<args...>", description: "Advanced git flow operations." }] },
   { name: "harness", summary: "Pass through to runtime harness CLI.", usage: ["rig harness <args...>"], commands: [{ command: "<args...>", description: "Advanced harness operations." }] },
   { name: "test", summary: "Project test wrappers.", usage: ["rig test <unit|e2e|all>"], commands: [{ command: "all", description: "Run configured project tests." }] }
@@ -564,17 +644,21 @@ function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
 }
-function readPrivateRemoteSessionToken(projectRoot) {
+function readRemoteAuthState(projectRoot) {
   const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
   if (!existsSync2(path))
     return null;
   try {
     const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
   }
 }
+function readPrivateRemoteSessionToken(projectRoot) {
+  const parsed = readRemoteAuthState(projectRoot);
+  return parsed ? cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined) : null;
+}
 function readGitHubBearerTokenForRemote(projectRoot) {
   const scopedKey = resolve2(projectRoot);
   if (scopedGitHubBearerTokens.has(scopedKey))
@@ -585,15 +669,25 @@ function readGitHubBearerTokenForRemote(projectRoot) {
   return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
 }
 function readStoredGitHubAuthToken(projectRoot) {
-  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
-  if (!existsSync2(path))
+  const parsed = readRemoteAuthState(projectRoot);
+  return parsed ? cleanToken(typeof parsed.token === "string" ? parsed.token : undefined) : null;
+}
+function inferRemoteServerProjectRootFromAuthState(projectRoot) {
+  const repo = readRepoConnection(projectRoot);
+  const slug = repo?.project?.trim();
+  if (!slug || !/^[^/]+\/[^/]+$/.test(slug))
     return null;
-  try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return cleanToken(typeof parsed.token === "string" ? parsed.token : undefined);
-  } catch {
+  const auth = readRemoteAuthState(projectRoot);
+  const authUpdatedAt = typeof auth?.updatedAt === "string" ? Date.parse(auth.updatedAt) : Number.NaN;
+  const repoLinkedAt = typeof repo?.linkedAt === "string" ? Date.parse(repo.linkedAt) : Number.NaN;
+  if (Number.isFinite(authUpdatedAt) && Number.isFinite(repoLinkedAt) && authUpdatedAt + 1000 < repoLinkedAt)
     return null;
-  }
+  const checkoutBaseDir = typeof auth?.checkoutBaseDir === "string" && auth.checkoutBaseDir.trim() ? auth.checkoutBaseDir.trim() : null;
+  if (!checkoutBaseDir)
+    return null;
+  const inferred = `${checkoutBaseDir.replace(/\/+$/, "")}/${slug}`;
+  writeRepoServerProjectRoot(projectRoot, inferred);
+  return inferred;
 }
 function readLocalConnectionFallbackToken(projectRoot) {
   return readGitHubBearerTokenForRemote(projectRoot) ?? cleanToken(process.env.RIG_GITHUB_TOKEN) ?? readStoredGitHubAuthToken(projectRoot);
@@ -604,7 +698,7 @@ async function ensureServerForCli(projectRoot) {
     if (selected?.connection.kind === "remote") {
       reportServerPhase(`Connecting to ${selected.alias}\u2026`);
       const authToken = readGitHubBearerTokenForRemote(projectRoot);
-      const serverProjectRoot = selected.serverProjectRoot ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
+      const serverProjectRoot = selected.serverProjectRoot ?? inferRemoteServerProjectRootFromAuthState(projectRoot) ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
       return {
         baseUrl: selected.connection.baseUrl,
         authToken,
@@ -633,7 +727,10 @@ async function backfillRemoteServerProjectRoot(projectRoot, baseUrl, authToken)
   if (!slug)
     return null;
   try {
-    const response = await fetch(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`, {
+    const url = new URL(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`);
+    if (authToken && queryAuthFallbackEnabled())
+      url.searchParams.set("rt", authToken);
+    const response = await fetch(url, {
       headers: mergeHeaders(undefined, authToken)
     });
     if (!response.ok)
@@ -660,10 +757,23 @@ function appendTaskFilterParams(url, filters) {
   if (filters.limit !== undefined)
     url.searchParams.set("limit", String(filters.limit));
 }
+function mergeCookie(existing, name, value) {
+  const encoded = `${name}=${encodeURIComponent(value)}`;
+  if (!existing?.trim())
+    return encoded;
+  const parts = existing.split(";").map((part) => part.trim()).filter((part) => part && !part.startsWith(`${name}=`));
+  return [...parts, encoded].join("; ");
+}
+function queryAuthFallbackEnabled(env = process.env) {
+  return env.RIG_ENABLE_QUERY_AUTH_FALLBACK === "1" || env.RIG_QUERY_AUTH_FALLBACK === "1";
+}
 function mergeHeaders(headers, authToken) {
   const merged = new Headers(headers);
   if (authToken) {
-    merged.set("authorization", `Bearer ${authToken}`);
+    const bearer = `Bearer ${authToken}`;
+    merged.set("authorization", bearer);
+    merged.set("x-auth", bearer);
+    merged.set("cookie", mergeCookie(merged.get("cookie"), "rig_auth", authToken));
   }
   return merged;
 }
@@ -724,15 +834,34 @@ async function buildServerFailureContext(projectRoot, server) {
     hint: "Check the selected server with `rig server status`, or switch with `rig server use <alias|local>`."
   };
 }
+function isLoopbackRemoteBaseUrl(baseUrl) {
+  try {
+    const host = new URL(baseUrl).hostname.toLowerCase();
+    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+  } catch {
+    return false;
+  }
+}
+function canUseRemoteWithoutProjectRoot(pathname) {
+  return pathname === "/health" || pathname === "/api/health" || pathname === "/api/server/status" || pathname === "/api/server/project-root" || pathname.startsWith("/api/github/auth/") || pathname === "/api/projects" || pathname.startsWith("/api/projects/");
+}
 async function requestServerJson(context, pathname, init = {}) {
   const server = await ensureServerForCli(context.projectRoot);
+  const requestUrl = new URL(`${server.baseUrl}${pathname}`);
+  if (server.connectionKind === "remote" && !server.serverProjectRoot && !canUseRemoteWithoutProjectRoot(requestUrl.pathname) && (server.authToken || !isLoopbackRemoteBaseUrl(server.baseUrl))) {
+    const repo = readRepoConnection(context.projectRoot);
+    throw new CliError(`Remote server is selected for ${repo?.project ?? "this repo"}, but this checkout has no server-host project root link.`, 1, { hint: "Run `rig init --repair` or `rig init --yes --repo owner/repo --server remote` to repair the remote project link before task/run commands." });
+  }
   const headers = mergeHeaders(init.headers, server.authToken);
   if (server.serverProjectRoot)
     headers.set("x-rig-project-root", server.serverProjectRoot);
+  if (server.connectionKind === "remote" && server.authToken && queryAuthFallbackEnabled()) {
+    requestUrl.searchParams.set("rt", server.authToken);
+  }
   reportServerPhase(`${(init.method ?? "GET").toUpperCase()} ${pathname.split("?")[0]}\u2026`);
   let response;
   try {
-    response = await fetch(`${server.baseUrl}${pathname}`, {
+    response = await fetch(requestUrl, {
       ...init,
       headers
     });
@@ -852,18 +981,46 @@ import {
 import { resolveMonorepoRoot } from "@rig/runtime/control-plane/native/utils";
 
 // packages/cli/src/commands/_authority-runs.ts
-function normalizeRuntimeAdapter(value) {
-  const normalized = value?.trim().toLowerCase();
-  if (!normalized) {
-    return "pi";
-  }
-  if (normalized === "codex" || normalized === "codex-cli" || normalized === "codex-app-server" || normalized === "gpt-codex") {
-    return "codex";
-  }
-  if (normalized === "pi" || normalized === "rig-pi" || normalized === "@rig/pi") {
-    return "pi";
-  }
-  return "claude-code";
+function normalizeRuntimeAdapter(_value) {
+  return "pi";
+}
+
+// packages/cli/src/commands/_server-events.ts
+import { WsTransport } from "@rig/client";
+import { RIG_WS_CHANNELS } from "@rig/contracts";
+function buildRigWebSocketUrl(baseUrl, authToken) {
+  const url = new URL(baseUrl);
+  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+  if (authToken)
+    url.searchParams.set("token", authToken);
+  return url.toString();
+}
+async function connectRigServerEvents(projectRoot, handlers) {
+  const { baseUrl, authToken } = await ensureServerForCli(projectRoot);
+  const transport = new WsTransport(buildRigWebSocketUrl(baseUrl, authToken));
+  const unsubscribers = [];
+  if (handlers.onSnapshotInvalidated)
+    unsubscribers.push(transport.subscribe(RIG_WS_CHANNELS.snapshotInvalidated, handlers.onSnapshotInvalidated));
+  if (handlers.onRunLogAppended)
+    unsubscribers.push(transport.subscribe(RIG_WS_CHANNELS.runLogAppended, handlers.onRunLogAppended));
+  if (handlers.onEngineEvent)
+    unsubscribers.push(transport.subscribe(RIG_WS_CHANNELS.event, handlers.onEngineEvent));
+  let status = "connecting";
+  unsubscribers.push(transport.subscribeState((state) => {
+    status = state.status;
+    handlers.onStatus?.(state.status);
+  }));
+  return {
+    connected: () => status === "connected",
+    close: () => {
+      for (const unsubscribe of unsubscribers) {
+        try {
+          unsubscribe();
+        } catch {}
+      }
+      transport.dispose();
+    }
+  };
 }
 
 // packages/cli/src/app/drone-ui.ts
@@ -924,9 +1081,10 @@ import { ensureProjectMainFreshBeforeRun } from "@rig/runtime/control-plane/proj
 // packages/cli/src/commands/_pi-frontend.ts
 import { main as runPiMain } from "@earendil-works/pi-coding-agent";
 import createPiRigExtension from "@rig/pi-rig";
+var TERMINAL_RUN_STATUSES = new Set(["completed", "failed", "stopped", "cancelled", "canceled", "closed", "merged", "needs_attention", "needs-attention"]);
 
 // packages/cli/src/commands/_operator-view.ts
-var TERMINAL_RUN_STATUSES = new Set(["completed", "failed", "stopped", "cancelled", "canceled", "closed", "merged", "needs_attention", "needs-attention"]);
+var TERMINAL_RUN_STATUSES2 = new Set(["completed", "failed", "stopped", "cancelled", "canceled", "closed", "merged", "needs_attention", "needs-attention"]);
 
 // packages/cli/src/commands/task.ts
 import { buildPluginHostContext } from "@rig/runtime/control-plane/plugin-host-context";
@@ -1782,7 +1940,24 @@ async function runOperatorBoard(context, options = {}) {
       tui.requestRender();
     }
   }, BOARD_TICK_MS);
+  const live = { subscription: null };
+  const refreshActiveView = () => {
+    refresh({ quiet: true });
+    if (view === "tasks")
+      refreshTasks();
+    if (view === "inbox")
+      refreshInbox();
+  };
+  connectRigServerEvents(context.projectRoot, {
+    onSnapshotInvalidated: () => refreshActiveView()
+  }).then((subscription) => {
+    live.subscription = subscription;
+  }).catch(() => {
+    live.subscription = null;
+  });
   const refreshTimer = setInterval(() => {
+    if (live.subscription?.connected())
+      return;
     refresh();
   }, BOARD_REFRESH_MS);
   tui.start();
@@ -1797,6 +1972,7 @@ async function runOperatorBoard(context, options = {}) {
   });
   clearInterval(animation);
   clearInterval(refreshTimer);
+  live.subscription?.close();
   return outcome;
 }
 async function runOperatorBoardLoop(context, attach, options = {}) {

package/dist/src/app-opentui/adapters/command.d.ts

@@ -0,0 +1,2 @@
+import type { AppAdapterContext } from "./common";
+export declare function runCommandInAppPty(ctx: AppAdapterContext, argv: readonly string[]): Promise<void>;