@h-rig/cli 0.0.6-alpha.82 → 0.0.6-alpha.84

package/dist/src/commands/task-run-driver.js

@@ -96,18 +96,8 @@ function resolveControlPlaneTaskConfigPath(projectRoot) {
 
 // packages/cli/src/commands/_authority-runs.ts
 var RIG_WORKSPACE_ID = "rig-local-workspace";
-function normalizeRuntimeAdapter(value) {
-  const normalized = value?.trim().toLowerCase();
-  if (!normalized) {
-    return "pi";
-  }
-  if (normalized === "codex" || normalized === "codex-cli" || normalized === "codex-app-server" || normalized === "gpt-codex") {
-    return "codex";
-  }
-  if (normalized === "pi" || normalized === "rig-pi" || normalized === "@rig/pi") {
-    return "pi";
-  }
-  return "claude-code";
+function normalizeRuntimeAdapter(_value) {
+  return "pi";
 }
 function readLatestBeadRecord(projectRoot, taskId) {
   const issuesPath = resolve2(resolveControlPlaneMonorepoRoot(projectRoot), ".beads", "issues.jsonl");
@@ -551,17 +541,21 @@ function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
 }
-function readPrivateRemoteSessionToken(projectRoot) {
+function readRemoteAuthState(projectRoot) {
   const path = resolve5(projectRoot, ".rig", "state", "github-auth.json");
   if (!existsSync3(path))
     return null;
   try {
     const parsed = JSON.parse(readFileSync3(path, "utf8"));
-    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
   }
 }
+function readPrivateRemoteSessionToken(projectRoot) {
+  const parsed = readRemoteAuthState(projectRoot);
+  return parsed ? cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined) : null;
+}
 function readGitHubBearerTokenForRemote(projectRoot) {
   const scopedKey = resolve5(projectRoot);
   if (scopedGitHubBearerTokens.has(scopedKey))
@@ -572,15 +566,25 @@ function readGitHubBearerTokenForRemote(projectRoot) {
   return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
 }
 function readStoredGitHubAuthToken(projectRoot) {
-  const path = resolve5(projectRoot, ".rig", "state", "github-auth.json");
-  if (!existsSync3(path))
+  const parsed = readRemoteAuthState(projectRoot);
+  return parsed ? cleanToken(typeof parsed.token === "string" ? parsed.token : undefined) : null;
+}
+function inferRemoteServerProjectRootFromAuthState(projectRoot) {
+  const repo = readRepoConnection(projectRoot);
+  const slug = repo?.project?.trim();
+  if (!slug || !/^[^/]+\/[^/]+$/.test(slug))
     return null;
-  try {
-    const parsed = JSON.parse(readFileSync3(path, "utf8"));
-    return cleanToken(typeof parsed.token === "string" ? parsed.token : undefined);
-  } catch {
+  const auth = readRemoteAuthState(projectRoot);
+  const authUpdatedAt = typeof auth?.updatedAt === "string" ? Date.parse(auth.updatedAt) : Number.NaN;
+  const repoLinkedAt = typeof repo?.linkedAt === "string" ? Date.parse(repo.linkedAt) : Number.NaN;
+  if (Number.isFinite(authUpdatedAt) && Number.isFinite(repoLinkedAt) && authUpdatedAt + 1000 < repoLinkedAt)
     return null;
-  }
+  const checkoutBaseDir = typeof auth?.checkoutBaseDir === "string" && auth.checkoutBaseDir.trim() ? auth.checkoutBaseDir.trim() : null;
+  if (!checkoutBaseDir)
+    return null;
+  const inferred = `${checkoutBaseDir.replace(/\/+$/, "")}/${slug}`;
+  writeRepoServerProjectRoot(projectRoot, inferred);
+  return inferred;
 }
 function readLocalConnectionFallbackToken(projectRoot) {
   return readGitHubBearerTokenForRemote(projectRoot) ?? cleanToken(process.env.RIG_GITHUB_TOKEN) ?? readStoredGitHubAuthToken(projectRoot);
@@ -591,7 +595,7 @@ async function ensureServerForCli(projectRoot) {
     if (selected?.connection.kind === "remote") {
       reportServerPhase(`Connecting to ${selected.alias}\u2026`);
       const authToken = readGitHubBearerTokenForRemote(projectRoot);
-      const serverProjectRoot = selected.serverProjectRoot ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
+      const serverProjectRoot = selected.serverProjectRoot ?? inferRemoteServerProjectRootFromAuthState(projectRoot) ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
       return {
         baseUrl: selected.connection.baseUrl,
         authToken,
@@ -620,7 +624,10 @@ async function backfillRemoteServerProjectRoot(projectRoot, baseUrl, authToken)
   if (!slug)
     return null;
   try {
-    const response = await fetch(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`, {
+    const url = new URL(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`);
+    if (authToken && queryAuthFallbackEnabled())
+      url.searchParams.set("rt", authToken);
+    const response = await fetch(url, {
       headers: mergeHeaders(undefined, authToken)
     });
     if (!response.ok)
@@ -637,10 +644,23 @@ async function backfillRemoteServerProjectRoot(projectRoot, baseUrl, authToken)
     return null;
   }
 }
+function mergeCookie(existing, name, value) {
+  const encoded = `${name}=${encodeURIComponent(value)}`;
+  if (!existing?.trim())
+    return encoded;
+  const parts = existing.split(";").map((part) => part.trim()).filter((part) => part && !part.startsWith(`${name}=`));
+  return [...parts, encoded].join("; ");
+}
+function queryAuthFallbackEnabled(env = process.env) {
+  return env.RIG_ENABLE_QUERY_AUTH_FALLBACK === "1" || env.RIG_QUERY_AUTH_FALLBACK === "1";
+}
 function mergeHeaders(headers, authToken) {
   const merged = new Headers(headers);
   if (authToken) {
-    merged.set("authorization", `Bearer ${authToken}`);
+    const bearer = `Bearer ${authToken}`;
+    merged.set("authorization", bearer);
+    merged.set("x-auth", bearer);
+    merged.set("cookie", mergeCookie(merged.get("cookie"), "rig_auth", authToken));
   }
   return merged;
 }
@@ -701,15 +721,34 @@ async function buildServerFailureContext(projectRoot, server) {
     hint: "Check the selected server with `rig server status`, or switch with `rig server use <alias|local>`."
   };
 }
+function isLoopbackRemoteBaseUrl(baseUrl) {
+  try {
+    const host = new URL(baseUrl).hostname.toLowerCase();
+    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+  } catch {
+    return false;
+  }
+}
+function canUseRemoteWithoutProjectRoot(pathname) {
+  return pathname === "/health" || pathname === "/api/health" || pathname === "/api/server/status" || pathname === "/api/server/project-root" || pathname.startsWith("/api/github/auth/") || pathname === "/api/projects" || pathname.startsWith("/api/projects/");
+}
 async function requestServerJson(context, pathname, init = {}) {
   const server = await ensureServerForCli(context.projectRoot);
+  const requestUrl = new URL(`${server.baseUrl}${pathname}`);
+  if (server.connectionKind === "remote" && !server.serverProjectRoot && !canUseRemoteWithoutProjectRoot(requestUrl.pathname) && (server.authToken || !isLoopbackRemoteBaseUrl(server.baseUrl))) {
+    const repo = readRepoConnection(context.projectRoot);
+    throw new CliError(`Remote server is selected for ${repo?.project ?? "this repo"}, but this checkout has no server-host project root link.`, 1, { hint: "Run `rig init --repair` or `rig init --yes --repo owner/repo --server remote` to repair the remote project link before task/run commands." });
+  }
   const headers = mergeHeaders(init.headers, server.authToken);
   if (server.serverProjectRoot)
     headers.set("x-rig-project-root", server.serverProjectRoot);
+  if (server.connectionKind === "remote" && server.authToken && queryAuthFallbackEnabled()) {
+    requestUrl.searchParams.set("rt", server.authToken);
+  }
   reportServerPhase(`${(init.method ?? "GET").toUpperCase()} ${pathname.split("?")[0]}\u2026`);
   let response;
   try {
-    response = await fetch(`${server.baseUrl}${pathname}`, {
+    response = await fetch(requestUrl, {
       ...init,
       headers
     });

package/dist/src/commands/task.js

@@ -306,18 +306,8 @@ import {
 import { resolveMonorepoRoot } from "@rig/runtime/control-plane/native/utils";
 
 // packages/cli/src/commands/_authority-runs.ts
-function normalizeRuntimeAdapter(value) {
-  const normalized = value?.trim().toLowerCase();
-  if (!normalized) {
-    return "pi";
-  }
-  if (normalized === "codex" || normalized === "codex-cli" || normalized === "codex-app-server" || normalized === "gpt-codex") {
-    return "codex";
-  }
-  if (normalized === "pi" || normalized === "rig-pi" || normalized === "@rig/pi") {
-    return "pi";
-  }
-  return "claude-code";
+function normalizeRuntimeAdapter(_value) {
+  return "pi";
 }
 
 // packages/cli/src/commands/_preflight.ts
@@ -438,17 +428,21 @@ function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
 }
-function readPrivateRemoteSessionToken(projectRoot) {
+function readRemoteAuthState(projectRoot) {
   const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
   if (!existsSync2(path))
     return null;
   try {
     const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
   }
 }
+function readPrivateRemoteSessionToken(projectRoot) {
+  const parsed = readRemoteAuthState(projectRoot);
+  return parsed ? cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined) : null;
+}
 function readGitHubBearerTokenForRemote(projectRoot) {
   const scopedKey = resolve2(projectRoot);
   if (scopedGitHubBearerTokens.has(scopedKey))
@@ -459,15 +453,25 @@ function readGitHubBearerTokenForRemote(projectRoot) {
   return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
 }
 function readStoredGitHubAuthToken(projectRoot) {
-  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
-  if (!existsSync2(path))
+  const parsed = readRemoteAuthState(projectRoot);
+  return parsed ? cleanToken(typeof parsed.token === "string" ? parsed.token : undefined) : null;
+}
+function inferRemoteServerProjectRootFromAuthState(projectRoot) {
+  const repo = readRepoConnection(projectRoot);
+  const slug = repo?.project?.trim();
+  if (!slug || !/^[^/]+\/[^/]+$/.test(slug))
     return null;
-  try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return cleanToken(typeof parsed.token === "string" ? parsed.token : undefined);
-  } catch {
+  const auth = readRemoteAuthState(projectRoot);
+  const authUpdatedAt = typeof auth?.updatedAt === "string" ? Date.parse(auth.updatedAt) : Number.NaN;
+  const repoLinkedAt = typeof repo?.linkedAt === "string" ? Date.parse(repo.linkedAt) : Number.NaN;
+  if (Number.isFinite(authUpdatedAt) && Number.isFinite(repoLinkedAt) && authUpdatedAt + 1000 < repoLinkedAt)
     return null;
-  }
+  const checkoutBaseDir = typeof auth?.checkoutBaseDir === "string" && auth.checkoutBaseDir.trim() ? auth.checkoutBaseDir.trim() : null;
+  if (!checkoutBaseDir)
+    return null;
+  const inferred = `${checkoutBaseDir.replace(/\/+$/, "")}/${slug}`;
+  writeRepoServerProjectRoot(projectRoot, inferred);
+  return inferred;
 }
 function readLocalConnectionFallbackToken(projectRoot) {
   return readGitHubBearerTokenForRemote(projectRoot) ?? cleanToken(process.env.RIG_GITHUB_TOKEN) ?? readStoredGitHubAuthToken(projectRoot);
@@ -478,7 +482,7 @@ async function ensureServerForCli(projectRoot) {
     if (selected?.connection.kind === "remote") {
       reportServerPhase(`Connecting to ${selected.alias}\u2026`);
       const authToken = readGitHubBearerTokenForRemote(projectRoot);
-      const serverProjectRoot = selected.serverProjectRoot ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
+      const serverProjectRoot = selected.serverProjectRoot ?? inferRemoteServerProjectRootFromAuthState(projectRoot) ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
       return {
         baseUrl: selected.connection.baseUrl,
         authToken,
@@ -507,7 +511,10 @@ async function backfillRemoteServerProjectRoot(projectRoot, baseUrl, authToken)
   if (!slug)
     return null;
   try {
-    const response = await fetch(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`, {
+    const url = new URL(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`);
+    if (authToken && queryAuthFallbackEnabled())
+      url.searchParams.set("rt", authToken);
+    const response = await fetch(url, {
       headers: mergeHeaders(undefined, authToken)
     });
     if (!response.ok)
@@ -534,10 +541,23 @@ function appendTaskFilterParams(url, filters) {
   if (filters.limit !== undefined)
     url.searchParams.set("limit", String(filters.limit));
 }
+function mergeCookie(existing, name, value) {
+  const encoded = `${name}=${encodeURIComponent(value)}`;
+  if (!existing?.trim())
+    return encoded;
+  const parts = existing.split(";").map((part) => part.trim()).filter((part) => part && !part.startsWith(`${name}=`));
+  return [...parts, encoded].join("; ");
+}
+function queryAuthFallbackEnabled(env = process.env) {
+  return env.RIG_ENABLE_QUERY_AUTH_FALLBACK === "1" || env.RIG_QUERY_AUTH_FALLBACK === "1";
+}
 function mergeHeaders(headers, authToken) {
   const merged = new Headers(headers);
   if (authToken) {
-    merged.set("authorization", `Bearer ${authToken}`);
+    const bearer = `Bearer ${authToken}`;
+    merged.set("authorization", bearer);
+    merged.set("x-auth", bearer);
+    merged.set("cookie", mergeCookie(merged.get("cookie"), "rig_auth", authToken));
   }
   return merged;
 }
@@ -598,15 +618,34 @@ async function buildServerFailureContext(projectRoot, server) {
     hint: "Check the selected server with `rig server status`, or switch with `rig server use <alias|local>`."
   };
 }
+function isLoopbackRemoteBaseUrl(baseUrl) {
+  try {
+    const host = new URL(baseUrl).hostname.toLowerCase();
+    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+  } catch {
+    return false;
+  }
+}
+function canUseRemoteWithoutProjectRoot(pathname) {
+  return pathname === "/health" || pathname === "/api/health" || pathname === "/api/server/status" || pathname === "/api/server/project-root" || pathname.startsWith("/api/github/auth/") || pathname === "/api/projects" || pathname.startsWith("/api/projects/");
+}
 async function requestServerJson(context, pathname, init = {}) {
   const server = await ensureServerForCli(context.projectRoot);
+  const requestUrl = new URL(`${server.baseUrl}${pathname}`);
+  if (server.connectionKind === "remote" && !server.serverProjectRoot && !canUseRemoteWithoutProjectRoot(requestUrl.pathname) && (server.authToken || !isLoopbackRemoteBaseUrl(server.baseUrl))) {
+    const repo = readRepoConnection(context.projectRoot);
+    throw new CliError(`Remote server is selected for ${repo?.project ?? "this repo"}, but this checkout has no server-host project root link.`, 1, { hint: "Run `rig init --repair` or `rig init --yes --repo owner/repo --server remote` to repair the remote project link before task/run commands." });
+  }
   const headers = mergeHeaders(init.headers, server.authToken);
   if (server.serverProjectRoot)
     headers.set("x-rig-project-root", server.serverProjectRoot);
+  if (server.connectionKind === "remote" && server.authToken && queryAuthFallbackEnabled()) {
+    requestUrl.searchParams.set("rt", server.authToken);
+  }
   reportServerPhase(`${(init.method ?? "GET").toUpperCase()} ${pathname.split("?")[0]}\u2026`);
   let response;
   try {
-    response = await fetch(`${server.baseUrl}${pathname}`, {
+    response = await fetch(requestUrl, {
       ...init,
       headers
     });
@@ -863,7 +902,8 @@ async function runFastTaskRunPreflight(context, options = {}) {
     }
   }
   const repo = readRepoConnection(context.projectRoot);
-  checks.push(repo ? preflightCheck("project-link", "project linked to Rig server", repo.project ? "pass" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : ""}`, "Run `rig init --yes --repo owner/repo` to record the GitHub repo slug.") : preflightCheck("project-link", "project linked to Rig server", legacyServerCompatibility ? "warn" : "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig server use <alias|local>`."));
+  const remoteWithoutProjectLink = selectedServer?.connectionKind === "remote" && !repo?.project;
+  checks.push(repo ? preflightCheck("project-link", "project linked to selected server", repo.project ? "pass" : remoteWithoutProjectLink ? "fail" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : " (missing project link)"}`, remoteWithoutProjectLink ? "Run `rig init --repair` or `rig init --yes --repo owner/repo --server remote` to restore the remote project link." : "Run `rig init --yes --repo owner/repo` to record the GitHub repo slug.") : preflightCheck("project-link", "project linked to selected server", legacyServerCompatibility ? "warn" : "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig server use <alias|local>`."));
   try {
     const auth = await request("/api/github/auth/status");
     checks.push(isAuthenticated(auth) ? preflightCheck("github-auth", "GitHub auth valid", "pass") : preflightCheck("github-auth", "GitHub auth valid", legacyServerCompatibility ? "warn" : "fail", "not authenticated", "Run `rig github auth import-gh` or `rig github auth token --token <token>`."));
@@ -1322,6 +1362,14 @@ import { homedir as homedir2, tmpdir } from "os";
 import { join } from "path";
 import { main as runPiMain } from "@earendil-works/pi-coding-agent";
 import createPiRigExtension from "@rig/pi-rig";
+var TERMINAL_RUN_STATUSES = new Set(["completed", "failed", "stopped", "cancelled", "canceled", "closed", "merged", "needs_attention", "needs-attention"]);
+
+class OperatorTranscriptUnavailableError extends Error {
+  constructor(message2) {
+    super(message2);
+    this.name = "OperatorTranscriptUnavailableError";
+  }
+}
 function setTemporaryEnv(updates) {
   const previous = new Map;
   for (const [key, value] of Object.entries(updates)) {
@@ -1349,6 +1397,23 @@ function buildOperatorPiEnv(input) {
     ...input.serverProjectRoot ? { RIG_PROJECT_ROOT: input.serverProjectRoot } : {}
   };
 }
+function shouldRequireOperatorTranscript(status) {
+  return typeof status === "string" && TERMINAL_RUN_STATUSES.has(status.trim().toLowerCase());
+}
+function missingOperatorTranscriptMessage(runId, status) {
+  const shortRun = runId.trim().slice(0, 8) || "unknown";
+  const statusText = typeof status === "string" && status.trim() ? status.trim() : "terminal";
+  return `Run ${shortRun} is ${statusText}, but no worker Pi session transcript is recorded for this run. It likely failed before Pi started or predates full-session capture. Use \`rig run show ${runId}\` and \`rig run logs ${runId}\` for the lifecycle details.`;
+}
+function statusFromRunDetails(run) {
+  if (!run || typeof run !== "object" || Array.isArray(run))
+    return;
+  const record = run;
+  if (typeof record.status === "string")
+    return record.status;
+  const nested = record.run;
+  return nested && typeof nested === "object" && !Array.isArray(nested) ? nested.status : undefined;
+}
 async function prepareOperatorConsole(context, runId, tempSessionDir) {
   const server = await ensureServerForCli(context.projectRoot);
   const localCwd = join(homedir2(), ".rig", "drones", runId.slice(0, 8));
@@ -1378,6 +1443,13 @@ async function prepareOperatorConsole(context, runId, tempSessionDir) {
       sessionFileArg = ["--session", localSessionPath];
     }
   } catch {}
+  if (sessionFileArg.length === 0) {
+    const run = await getRunDetailsViaServer(context, runId).catch(() => null);
+    const status = statusFromRunDetails(run);
+    if (shouldRequireOperatorTranscript(status)) {
+      throw new OperatorTranscriptUnavailableError(missingOperatorTranscriptMessage(runId, status));
+    }
+  }
   return { server, sessionFileArg };
 }
 var RIG_PI_THEME = {
@@ -1495,6 +1567,7 @@ async function attachRunBundledPiFrontend(context, input) {
   let detached = false;
   try {
     await runPiMain([
+      "--offline",
       "--no-extensions",
       "--no-skills",
       "--no-prompt-templates",
@@ -1524,7 +1597,7 @@ async function attachRunBundledPiFrontend(context, input) {
 }
 
 // packages/cli/src/commands/_operator-view.ts
-var TERMINAL_RUN_STATUSES = new Set(["completed", "failed", "stopped", "cancelled", "canceled", "closed", "merged", "needs_attention", "needs-attention"]);
+var TERMINAL_RUN_STATUSES2 = new Set(["completed", "failed", "stopped", "cancelled", "canceled", "closed", "merged", "needs_attention", "needs-attention"]);
 function runStatusFromPayload(payload) {
   const run = payload.run && typeof payload.run === "object" && !Array.isArray(payload.run) ? payload.run : payload;
   return String(run.status ?? "unknown").toLowerCase();
@@ -1602,7 +1675,7 @@ async function attachRunOperatorView(context, input) {
     }
     const pollMs = Math.max(250, Math.trunc(input.pollMs ?? 2000));
     let timelineCursor = snapshot.timelineCursor;
-    while (!detached && !TERMINAL_RUN_STATUSES.has(runStatusFromPayload(snapshot.run))) {
+    while (!detached && !TERMINAL_RUN_STATUSES2.has(runStatusFromPayload(snapshot.run))) {
       await Bun.sleep(pollMs);
       snapshot = await readOperatorSnapshot(context, input.runId, { timelineCursor });
       timelineCursor = snapshot.timelineCursor;
@@ -2072,30 +2145,62 @@ var PRIMARY_GROUPS = [
   }
 ];
 var ADVANCED_GROUPS = [
-  { name: "setup", summary: "Bootstrap/check local setup.", usage: ["rig setup <bootstrap|check|preflight>"], commands: [{ command: "bootstrap|check|preflight", description: "Setup helpers." }] },
-  { name: "profile", summary: "Runtime profile/model defaults.", usage: ["rig profile <show|set>"], commands: [{ command: "show", description: "Show active profile." }] },
+  {
+    name: "setup",
+    summary: "Bootstrap/check local setup.",
+    usage: ["rig setup <bootstrap|check|preflight>"],
+    commands: [
+      { command: "bootstrap", description: "Bootstrap local setup dependencies.", primary: true },
+      { command: "check", description: "Check local setup state (toolchain, deps, config).", primary: true },
+      { command: "preflight", description: "Run preflight checks before a run.", primary: true }
+    ]
+  },
+  {
+    name: "profile",
+    summary: "Runtime profile/model defaults.",
+    usage: ["rig profile <show|set>"],
+    commands: [
+      { command: "show", description: "Show the active execution profile.", primary: true },
+      { command: "set [--model <model>] [--runtime <runtime>] [--plugin <plugin>]", description: "Set model/runtime/plugin profile defaults.", primary: true }
+    ]
+  },
   {
     name: "review",
     summary: "Inspect or change completion review gate policy.",
     usage: ["rig review <show|set>"],
     commands: [
       { command: "show", description: "Show current review gate settings." },
-      { command: "set <off|advisory|required> [--provider greptile]", description: "Change review strictness/provider." }
+      { command: "set <off|advisory|required> [--provider <provider>]", description: "Change review strictness/provider (e.g. --provider greptile)." }
     ],
     examples: ["rig review show", "rig review set required --provider greptile"],
     next: ["Use `rig inbox approvals` for blocked run handoffs."]
   },
   {
     name: "browser",
-    summary: "Browser/app diagnostics for browser-required tasks.",
-    usage: ["rig browser <help|explain|demo|app|hp-next> [options]"],
+    summary: "Browser workstation actions for browser-required tasks: launch, check, CDP probe, profile reset, and app-specific smokes.",
+    usage: ["rig browser <help|explain|demo|hp-next|cdp-probe|profile-persistence|profile-lock-check|smoke-test> [options]"],
     commands: [
-      { command: "help", description: "Rich browser command help (canonical: `rig browser help`)." },
-      { command: "explain", description: "Explain the browser-required task contract." },
-      { command: "demo", description: "Run browser demo flows against a local page." },
-      { command: "app", description: "Launch the Rig Browser workstation app." },
-      { command: "hp-next <dev|check|e2e|reset>", description: "Drive the hp-next browser test harness." }
-    ]
+      { command: "help", description: "Rich browser command help (canonical: `rig browser help`).", primary: true },
+      { command: "explain", description: "Explain the browser-required task contract and runtime helper commands.", primary: true },
+      { command: "demo [--port <n>] [--profile <name>] [--state-dir <path>] [--target-url <url>] [--keep-open] [--no-build]", description: "Run a guided real browser/agent demo flow.", primary: true },
+      { command: "hp-next dev", description: "Start hp-next Rig Browser in dev/watch mode.", primary: true },
+      { command: "hp-next start", description: "Build/start the hp-next browser workstation without watch mode.", primary: true },
+      { command: "hp-next check", description: "Validate the hp-next CDP endpoint on the configured port.", primary: true },
+      { command: "hp-next e2e", description: "Run hp-next browser e2e smoke checks through Rig Browser.", primary: true },
+      { command: "hp-next reset", description: "Reset the hp-next browser profile when stale browser state is suspected.", primary: true },
+      { command: "cdp-probe", description: "Run an isolated CDP attach/evaluate/layout probe." },
+      { command: "profile-persistence", description: "Verify a named browser profile persists browser state." },
+      { command: "profile-lock-check", description: "Verify concurrent launches reject the same profile." },
+      { command: "smoke-test", description: "Run the browser package smoke test." }
+    ],
+    examples: [
+      "rig browser help",
+      "rig browser hp-next check",
+      "rig browser hp-next e2e",
+      "rig browser cdp-probe",
+      "rig browser profile-lock-check"
+    ],
+    next: ["Inside a task run, use rig-browser-launch, rig-browser-check, and rig-browser-attach-info from the worker PATH."]
   },
   {
     name: "pi",
@@ -2110,12 +2215,60 @@ var ADVANCED_GROUPS = [
     examples: ["rig pi search subagents", "rig pi add pi-subagents", "rig pi list"],
     next: ["Config-managed extensions: declare `runtime: { pi: { packages: [...] } }` in rig.config.ts \u2014 workers pick them up automatically."]
   },
-  { name: "queue", summary: "Run task queues locally.", usage: ["rig queue run [options]"], commands: [{ command: "run", description: "Process queue work." }] },
-  { name: "agent", summary: "Runtime agent workspace helpers.", usage: ["rig agent <list|prepare|run|cleanup>"], commands: [{ command: "list", description: "List prepared agents." }] },
+  {
+    name: "queue",
+    summary: "Run task queues locally.",
+    usage: ["rig queue run [--workers <n>] [--max-tasks <n>] [--action validate|verify|pipeline] [--isolation off|worktree] [--no-runtime-reuse] [--fail-fast] [--skip-project-sync]"],
+    commands: [
+      { command: "run [--workers <n>] [--max-tasks <n>] [--action validate|verify|pipeline] [--isolation off|worktree] [--no-runtime-reuse] [--fail-fast] [--skip-project-sync]", description: "Process queue work: drain matching tasks with N workers, optional per-task action and isolation.", primary: true }
+    ]
+  },
+  {
+    name: "agent",
+    summary: "Runtime agent workspace helpers.",
+    usage: ["rig agent <list|prepare|run|cleanup>"],
+    commands: [
+      { command: "list", description: "List prepared agent runtimes.", primary: true },
+      { command: "prepare [--id <id>] [--mode <mode>] [--task <task>]", description: "Prepare an isolated agent runtime workspace.", primary: true },
+      { command: "run [--id <id>] [--mode <mode>] [--task <task>] [--skip-project-sync]", description: "Prepare (if needed) and run an agent in its workspace.", primary: true },
+      { command: "cleanup [--all] [--id <id>]", description: "Remove prepared agent workspaces.", primary: true }
+    ]
+  },
   { name: "inspector", summary: "Event stream and drift scanners.", usage: ["rig inspector <stream|scan-upstream-drift>"], commands: [{ command: "stream", description: "Stream events." }] },
-  { name: "dist", summary: "Build/install packaged Rig CLI.", usage: ["rig dist <build|install|doctor>"], commands: [{ command: "build", description: "Build distribution." }] },
+  {
+    name: "dist",
+    summary: "Build/install packaged Rig CLI.",
+    usage: ["rig dist <build|install|doctor|rebuild-agent>"],
+    commands: [
+      { command: "build [--output-dir <dir>]", description: "Build the distributable Rig CLI.", primary: true },
+      { command: "install [--scope <scope>] [--path <path>]", description: "Install the built CLI to a scope/path.", primary: true },
+      { command: "doctor", description: "Diagnose the dist toolchain and install state.", primary: true },
+      { command: "rebuild-agent", description: "Rebuild the agent runtime image, pruning stale images.", primary: true }
+    ]
+  },
   { name: "workspace", summary: "Workspace topology/service helpers.", usage: ["rig workspace <summary|topology|remote-hosts>"], commands: [{ command: "summary", description: "Show workspace summary." }] },
-  { name: "remote", summary: "Compatibility remote orchestration controls.", usage: ["rig remote <status|watch|pause|resume|...>"], commands: [{ command: "status", description: "Show remote state." }] },
+  {
+    name: "remote",
+    summary: "Compatibility remote orchestration controls.",
+    usage: ["rig remote <status|tasks|watch|pause|resume|continue|stop|refresh|add-iterations|remove-iterations|endpoint ...>"],
+    commands: [
+      { command: "status [--remote <alias>]", description: "Show the remote orchestration state.", primary: true },
+      { command: "tasks [--remote <alias>]", description: "List the remote's tracked tasks.", primary: true },
+      { command: "watch [--remote <alias>] [--seconds <n>] [--event <type>]", description: "Stream remote orchestration events.", primary: true },
+      { command: "pause [--remote <alias>]", description: "Pause the running remote orchestration.", primary: true },
+      { command: "resume [--remote <alias>] [--max-workers <n>] [--max-iterations <n>] [--direct-merge]", description: "Resume the remote with optional tuning.", primary: true },
+      { command: "continue [--remote <alias>]", description: "Continue a paused remote orchestration.", primary: true },
+      { command: "stop [--remote <alias>]", description: "Stop the remote orchestration.", primary: true },
+      { command: "refresh [--remote <alias>]", description: "Refresh remote state.", primary: true },
+      { command: "add-iterations [--count <n>] [--remote <alias>]", description: "Grant the remote more iterations.", primary: true },
+      { command: "remove-iterations [--count <n>] [--remote <alias>]", description: "Reduce the remote's iteration budget.", primary: true },
+      { command: "endpoint list", description: "List configured remote endpoints.", primary: true },
+      { command: "endpoint add --alias <alias> --host <host> --port <n> [--token <token>]", description: "Register a remote endpoint.", primary: true },
+      { command: "endpoint remove --alias <alias>", description: "Remove a remote endpoint.", primary: true },
+      { command: "endpoint test [--alias <alias>]", description: "Test connectivity to a remote endpoint.", primary: true },
+      { command: "endpoint doctor", description: "Diagnose remote endpoint configuration.", primary: true }
+    ]
+  },
   { name: "git", summary: "Pass through to Rig git-flow helper.", usage: ["rig git <args...>"], commands: [{ command: "<args...>", description: "Advanced git flow operations." }] },
   { name: "harness", summary: "Pass through to runtime harness CLI.", usage: ["rig harness <args...>"], commands: [{ command: "<args...>", description: "Advanced harness operations." }] },
   { name: "test", summary: "Project test wrappers.", usage: ["rig test <unit|e2e|all>"], commands: [{ command: "all", description: "Run configured project tests." }] }