@h-rig/cli 0.0.6-alpha.82 → 0.0.6-alpha.84

package/dist/src/index.js

@@ -1105,17 +1105,21 @@ function setGitHubBearerTokenForCurrentProcess(token, projectRoot) {
   const scopedKey = resolve11(projectRoot ?? process.cwd());
   scopedGitHubBearerTokens.set(scopedKey, cleanToken(token ?? undefined));
 }
-function readPrivateRemoteSessionToken(projectRoot) {
+function readRemoteAuthState(projectRoot) {
   const path = resolve11(projectRoot, ".rig", "state", "github-auth.json");
   if (!existsSync7(path))
     return null;
   try {
     const parsed = JSON.parse(readFileSync4(path, "utf8"));
-    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
   }
 }
+function readPrivateRemoteSessionToken(projectRoot) {
+  const parsed = readRemoteAuthState(projectRoot);
+  return parsed ? cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined) : null;
+}
 function readGitHubBearerTokenForRemote(projectRoot) {
   const scopedKey = resolve11(projectRoot);
   if (scopedGitHubBearerTokens.has(scopedKey))
@@ -1126,15 +1130,25 @@ function readGitHubBearerTokenForRemote(projectRoot) {
   return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
 }
 function readStoredGitHubAuthToken(projectRoot) {
-  const path = resolve11(projectRoot, ".rig", "state", "github-auth.json");
-  if (!existsSync7(path))
+  const parsed = readRemoteAuthState(projectRoot);
+  return parsed ? cleanToken(typeof parsed.token === "string" ? parsed.token : undefined) : null;
+}
+function inferRemoteServerProjectRootFromAuthState(projectRoot) {
+  const repo = readRepoConnection(projectRoot);
+  const slug = repo?.project?.trim();
+  if (!slug || !/^[^/]+\/[^/]+$/.test(slug))
     return null;
-  try {
-    const parsed = JSON.parse(readFileSync4(path, "utf8"));
-    return cleanToken(typeof parsed.token === "string" ? parsed.token : undefined);
-  } catch {
+  const auth = readRemoteAuthState(projectRoot);
+  const authUpdatedAt = typeof auth?.updatedAt === "string" ? Date.parse(auth.updatedAt) : Number.NaN;
+  const repoLinkedAt = typeof repo?.linkedAt === "string" ? Date.parse(repo.linkedAt) : Number.NaN;
+  if (Number.isFinite(authUpdatedAt) && Number.isFinite(repoLinkedAt) && authUpdatedAt + 1000 < repoLinkedAt)
     return null;
-  }
+  const checkoutBaseDir = typeof auth?.checkoutBaseDir === "string" && auth.checkoutBaseDir.trim() ? auth.checkoutBaseDir.trim() : null;
+  if (!checkoutBaseDir)
+    return null;
+  const inferred = `${checkoutBaseDir.replace(/\/+$/, "")}/${slug}`;
+  writeRepoServerProjectRoot(projectRoot, inferred);
+  return inferred;
 }
 function readLocalConnectionFallbackToken(projectRoot) {
   return readGitHubBearerTokenForRemote(projectRoot) ?? cleanToken(process.env.RIG_GITHUB_TOKEN) ?? readStoredGitHubAuthToken(projectRoot);
@@ -1145,7 +1159,7 @@ async function ensureServerForCli(projectRoot) {
     if (selected?.connection.kind === "remote") {
       reportServerPhase(`Connecting to ${selected.alias}\u2026`);
       const authToken = readGitHubBearerTokenForRemote(projectRoot);
-      const serverProjectRoot = selected.serverProjectRoot ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
+      const serverProjectRoot = selected.serverProjectRoot ?? inferRemoteServerProjectRootFromAuthState(projectRoot) ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
       return {
         baseUrl: selected.connection.baseUrl,
         authToken,
@@ -1174,7 +1188,10 @@ async function backfillRemoteServerProjectRoot(projectRoot, baseUrl, authToken)
   if (!slug)
     return null;
   try {
-    const response = await fetch(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`, {
+    const url = new URL(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`);
+    if (authToken && queryAuthFallbackEnabled())
+      url.searchParams.set("rt", authToken);
+    const response = await fetch(url, {
       headers: mergeHeaders(undefined, authToken)
     });
     if (!response.ok)
@@ -1201,10 +1218,23 @@ function appendTaskFilterParams(url, filters) {
   if (filters.limit !== undefined)
     url.searchParams.set("limit", String(filters.limit));
 }
+function mergeCookie(existing, name, value) {
+  const encoded = `${name}=${encodeURIComponent(value)}`;
+  if (!existing?.trim())
+    return encoded;
+  const parts = existing.split(";").map((part) => part.trim()).filter((part) => part && !part.startsWith(`${name}=`));
+  return [...parts, encoded].join("; ");
+}
+function queryAuthFallbackEnabled(env = process.env) {
+  return env.RIG_ENABLE_QUERY_AUTH_FALLBACK === "1" || env.RIG_QUERY_AUTH_FALLBACK === "1";
+}
 function mergeHeaders(headers, authToken) {
   const merged = new Headers(headers);
   if (authToken) {
-    merged.set("authorization", `Bearer ${authToken}`);
+    const bearer = `Bearer ${authToken}`;
+    merged.set("authorization", bearer);
+    merged.set("x-auth", bearer);
+    merged.set("cookie", mergeCookie(merged.get("cookie"), "rig_auth", authToken));
   }
   return merged;
 }
@@ -1264,15 +1294,34 @@ async function buildServerFailureContext(projectRoot, server) {
     hint: "Check the selected server with `rig server status`, or switch with `rig server use <alias|local>`."
   };
 }
+function isLoopbackRemoteBaseUrl(baseUrl) {
+  try {
+    const host = new URL(baseUrl).hostname.toLowerCase();
+    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+  } catch {
+    return false;
+  }
+}
+function canUseRemoteWithoutProjectRoot(pathname) {
+  return pathname === "/health" || pathname === "/api/health" || pathname === "/api/server/status" || pathname === "/api/server/project-root" || pathname.startsWith("/api/github/auth/") || pathname === "/api/projects" || pathname.startsWith("/api/projects/");
+}
 async function requestServerJson(context, pathname, init = {}) {
   const server = await ensureServerForCli(context.projectRoot);
+  const requestUrl = new URL(`${server.baseUrl}${pathname}`);
+  if (server.connectionKind === "remote" && !server.serverProjectRoot && !canUseRemoteWithoutProjectRoot(requestUrl.pathname) && (server.authToken || !isLoopbackRemoteBaseUrl(server.baseUrl))) {
+    const repo = readRepoConnection(context.projectRoot);
+    throw new CliError(`Remote server is selected for ${repo?.project ?? "this repo"}, but this checkout has no server-host project root link.`, 1, { hint: "Run `rig init --repair` or `rig init --yes --repo owner/repo --server remote` to repair the remote project link before task/run commands." });
+  }
   const headers = mergeHeaders(init.headers, server.authToken);
   if (server.serverProjectRoot)
     headers.set("x-rig-project-root", server.serverProjectRoot);
+  if (server.connectionKind === "remote" && server.authToken && queryAuthFallbackEnabled()) {
+    requestUrl.searchParams.set("rt", server.authToken);
+  }
   reportServerPhase(`${(init.method ?? "GET").toUpperCase()} ${pathname.split("?")[0]}\u2026`);
   let response;
   try {
-    response = await fetch(`${server.baseUrl}${pathname}`, {
+    response = await fetch(requestUrl, {
       ...init,
       headers
     });
@@ -1334,11 +1383,26 @@ async function getGitHubAuthStatusViaServer(context) {
   return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
 }
 async function postGitHubTokenViaServer(context, token, options = {}) {
-  const payload = await requestServerJson(context, "/api/github/auth/token", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ token, selectedRepo: options.selectedRepo, projectRoot: options.projectRoot })
-  });
+  const server = await ensureServerForCli(context.projectRoot);
+  const requestUrl = new URL(`${server.baseUrl}/api/github/auth/token`);
+  reportServerPhase("POST /api/github/auth/token\u2026");
+  let response;
+  try {
+    response = await fetch(requestUrl, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ token, selectedRepo: options.selectedRepo, projectRoot: options.projectRoot ?? server.serverProjectRoot ?? undefined })
+    });
+  } catch (error) {
+    const failure = await buildServerFailureContext(context.projectRoot, server);
+    throw new CliError(`Rig server auth bootstrap failed: ${error instanceof Error ? error.message : String(error)}
+${failure.contextLine}`, 1, { hint: failure.hint });
+  }
+  const payload = await response.json().catch(() => null);
+  if (!response.ok) {
+    const detail = payload && typeof payload === "object" && !Array.isArray(payload) ? String(payload.error ?? JSON.stringify(payload)) : `HTTP ${response.status}`;
+    throw new CliError(`Rig server auth bootstrap failed (${response.status}): ${detail}`, 1, { hint: "Re-run `rig github auth import-gh`, or check the selected server with `rig server status`." });
+  }
   return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
 }
 async function prepareRemoteCheckoutViaServer(context, input) {
@@ -1669,7 +1733,8 @@ async function runFastTaskRunPreflight(context, options = {}) {
     }
   }
   const repo = readRepoConnection(context.projectRoot);
-  checks.push(repo ? preflightCheck("project-link", "project linked to Rig server", repo.project ? "pass" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : ""}`, "Run `rig init --yes --repo owner/repo` to record the GitHub repo slug.") : preflightCheck("project-link", "project linked to Rig server", legacyServerCompatibility ? "warn" : "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig server use <alias|local>`."));
+  const remoteWithoutProjectLink = selectedServer?.connectionKind === "remote" && !repo?.project;
+  checks.push(repo ? preflightCheck("project-link", "project linked to selected server", repo.project ? "pass" : remoteWithoutProjectLink ? "fail" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : " (missing project link)"}`, remoteWithoutProjectLink ? "Run `rig init --repair` or `rig init --yes --repo owner/repo --server remote` to restore the remote project link." : "Run `rig init --yes --repo owner/repo` to record the GitHub repo slug.") : preflightCheck("project-link", "project linked to selected server", legacyServerCompatibility ? "warn" : "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig server use <alias|local>`."));
   try {
     const auth = await request("/api/github/auth/status");
     checks.push(isAuthenticated(auth) ? preflightCheck("github-auth", "GitHub auth valid", "pass") : preflightCheck("github-auth", "GitHub auth valid", legacyServerCompatibility ? "warn" : "fail", "not authenticated", "Run `rig github auth import-gh` or `rig github auth token --token <token>`."));
@@ -1780,18 +1845,8 @@ import {
   readJsonlFile as readJsonlFile2,
   writeAuthorityRunRecord
 } from "@rig/runtime/control-plane/authority-files";
-function normalizeRuntimeAdapter(value) {
-  const normalized = value?.trim().toLowerCase();
-  if (!normalized) {
-    return "pi";
-  }
-  if (normalized === "codex" || normalized === "codex-cli" || normalized === "codex-app-server" || normalized === "gpt-codex") {
-    return "codex";
-  }
-  if (normalized === "pi" || normalized === "rig-pi" || normalized === "@rig/pi") {
-    return "pi";
-  }
-  return "claude-code";
+function normalizeRuntimeAdapter(_value) {
+  return "pi";
 }
 function readLatestBeadRecord(projectRoot, taskId) {
   const issuesPath = resolve12(resolveControlPlaneMonorepoRoot(projectRoot), ".beads", "issues.jsonl");
@@ -2713,7 +2768,7 @@ var init__operator_surface = __esm(() => {
 });
 
 // packages/cli/src/commands/_pi-frontend.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync9, mkdtempSync, readFileSync as readFileSync10, rmSync as rmSync5, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync10, mkdtempSync, readFileSync as readFileSync10, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "fs";
 import { homedir as homedir6, tmpdir } from "os";
 import { join as join3 } from "path";
 import { main as runPiMain } from "@earendil-works/pi-coding-agent";
@@ -2745,10 +2800,27 @@ function buildOperatorPiEnv(input) {
     ...input.serverProjectRoot ? { RIG_PROJECT_ROOT: input.serverProjectRoot } : {}
   };
 }
+function shouldRequireOperatorTranscript(status) {
+  return typeof status === "string" && TERMINAL_RUN_STATUSES.has(status.trim().toLowerCase());
+}
+function missingOperatorTranscriptMessage(runId, status) {
+  const shortRun = runId.trim().slice(0, 8) || "unknown";
+  const statusText = typeof status === "string" && status.trim() ? status.trim() : "terminal";
+  return `Run ${shortRun} is ${statusText}, but no worker Pi session transcript is recorded for this run. It likely failed before Pi started or predates full-session capture. Use \`rig run show ${runId}\` and \`rig run logs ${runId}\` for the lifecycle details.`;
+}
+function statusFromRunDetails(run) {
+  if (!run || typeof run !== "object" || Array.isArray(run))
+    return;
+  const record = run;
+  if (typeof record.status === "string")
+    return record.status;
+  const nested = record.run;
+  return nested && typeof nested === "object" && !Array.isArray(nested) ? nested.status : undefined;
+}
 async function prepareOperatorConsole(context, runId, tempSessionDir) {
   const server = await ensureServerForCli(context.projectRoot);
   const localCwd = join3(homedir6(), ".rig", "drones", runId.slice(0, 8));
-  mkdirSync9(localCwd, { recursive: true });
+  mkdirSync10(localCwd, { recursive: true });
   trustDroneCwd(localCwd);
   installRigPiTheme();
   let sessionFileArg = [];
@@ -2770,21 +2842,28 @@ async function prepareOperatorConsole(context, runId, tempSessionDir) {
         return line;
       }).join(`
 `);
-      writeFileSync6(localSessionPath, content);
+      writeFileSync7(localSessionPath, content);
       sessionFileArg = ["--session", localSessionPath];
     }
   } catch {}
+  if (sessionFileArg.length === 0) {
+    const run = await getRunDetailsViaServer(context, runId).catch(() => null);
+    const status = statusFromRunDetails(run);
+    if (shouldRequireOperatorTranscript(status)) {
+      throw new OperatorTranscriptUnavailableError(missingOperatorTranscriptMessage(runId, status));
+    }
+  }
   return { server, sessionFileArg };
 }
 function trustDroneCwd(localCwd) {
   try {
     const agentDir = join3(homedir6(), ".pi", "agent");
-    mkdirSync9(agentDir, { recursive: true });
+    mkdirSync10(agentDir, { recursive: true });
     const trustPath = join3(agentDir, "trust.json");
     const store = existsSync15(trustPath) ? JSON.parse(readFileSync10(trustPath, "utf8")) : {};
     if (store[localCwd] !== true) {
       store[localCwd] = true;
-      writeFileSync6(trustPath, `${JSON.stringify(store, null, "\t")}
+      writeFileSync7(trustPath, `${JSON.stringify(store, null, "\t")}
 `);
     }
   } catch {}
@@ -2792,12 +2871,12 @@ function trustDroneCwd(localCwd) {
 function installRigPiTheme() {
   try {
     const themesDir = join3(homedir6(), ".pi", "agent", "themes");
-    mkdirSync9(themesDir, { recursive: true });
+    mkdirSync10(themesDir, { recursive: true });
     const themePath = join3(themesDir, "rig.json");
     const next = `${JSON.stringify(RIG_PI_THEME, null, "\t")}
 `;
     if (!existsSync15(themePath) || readFileSync10(themePath, "utf8") !== next) {
-      writeFileSync6(themePath, next);
+      writeFileSync7(themePath, next);
     }
   } catch {}
 }
@@ -2817,6 +2896,7 @@ async function attachRunBundledPiFrontend(context, input) {
   let detached = false;
   try {
     await runPiMain([
+      "--offline",
       "--no-extensions",
       "--no-skills",
       "--no-prompt-templates",
@@ -2844,10 +2924,17 @@ async function attachRunBundledPiFrontend(context, input) {
     rendered: "stock Pi operator console with the pi-rig extension"
   };
 }
-var RIG_PI_THEME;
+var TERMINAL_RUN_STATUSES, OperatorTranscriptUnavailableError, RIG_PI_THEME;
 var init__pi_frontend = __esm(() => {
   init__server_client();
   init__async_ui();
+  TERMINAL_RUN_STATUSES = new Set(["completed", "failed", "stopped", "cancelled", "canceled", "closed", "merged", "needs_attention", "needs-attention"]);
+  OperatorTranscriptUnavailableError = class OperatorTranscriptUnavailableError extends Error {
+    constructor(message2) {
+      super(message2);
+      this.name = "OperatorTranscriptUnavailableError";
+    }
+  };
   RIG_PI_THEME = {
     $schema: "https://raw.githubusercontent.com/earendil-works/pi/main/packages/coding-agent/src/modes/interactive/theme/theme-schema.json",
     name: "rig",
@@ -3002,7 +3089,7 @@ async function attachRunOperatorView(context, input) {
     }
     const pollMs = Math.max(250, Math.trunc(input.pollMs ?? 2000));
     let timelineCursor = snapshot.timelineCursor;
-    while (!detached && !TERMINAL_RUN_STATUSES.has(runStatusFromPayload(snapshot.run))) {
+    while (!detached && !TERMINAL_RUN_STATUSES2.has(runStatusFromPayload(snapshot.run))) {
       await Bun.sleep(pollMs);
       snapshot = await readOperatorSnapshot(context, input.runId, { timelineCursor });
       timelineCursor = snapshot.timelineCursor;
@@ -3014,13 +3101,13 @@ async function attachRunOperatorView(context, input) {
   }
   return { ...snapshot, steered, detached };
 }
-var TERMINAL_RUN_STATUSES;
+var TERMINAL_RUN_STATUSES2;
 var init__operator_view = __esm(() => {
   init__server_client();
   init__operator_surface();
   init__pi_frontend();
   init__async_ui();
-  TERMINAL_RUN_STATUSES = new Set(["completed", "failed", "stopped", "cancelled", "canceled", "closed", "merged", "needs_attention", "needs-attention"]);
+  TERMINAL_RUN_STATUSES2 = new Set(["completed", "failed", "stopped", "cancelled", "canceled", "closed", "merged", "needs_attention", "needs-attention"]);
 });
 
 // packages/cli/src/commands/_help-catalog.ts
@@ -3377,30 +3464,62 @@ var init__help_catalog = __esm(() => {
     }
   ];
   ADVANCED_GROUPS = [
-    { name: "setup", summary: "Bootstrap/check local setup.", usage: ["rig setup <bootstrap|check|preflight>"], commands: [{ command: "bootstrap|check|preflight", description: "Setup helpers." }] },
-    { name: "profile", summary: "Runtime profile/model defaults.", usage: ["rig profile <show|set>"], commands: [{ command: "show", description: "Show active profile." }] },
+    {
+      name: "setup",
+      summary: "Bootstrap/check local setup.",
+      usage: ["rig setup <bootstrap|check|preflight>"],
+      commands: [
+        { command: "bootstrap", description: "Bootstrap local setup dependencies.", primary: true },
+        { command: "check", description: "Check local setup state (toolchain, deps, config).", primary: true },
+        { command: "preflight", description: "Run preflight checks before a run.", primary: true }
+      ]
+    },
+    {
+      name: "profile",
+      summary: "Runtime profile/model defaults.",
+      usage: ["rig profile <show|set>"],
+      commands: [
+        { command: "show", description: "Show the active execution profile.", primary: true },
+        { command: "set [--model <model>] [--runtime <runtime>] [--plugin <plugin>]", description: "Set model/runtime/plugin profile defaults.", primary: true }
+      ]
+    },
     {
       name: "review",
       summary: "Inspect or change completion review gate policy.",
       usage: ["rig review <show|set>"],
       commands: [
         { command: "show", description: "Show current review gate settings." },
-        { command: "set <off|advisory|required> [--provider greptile]", description: "Change review strictness/provider." }
+        { command: "set <off|advisory|required> [--provider <provider>]", description: "Change review strictness/provider (e.g. --provider greptile)." }
       ],
       examples: ["rig review show", "rig review set required --provider greptile"],
       next: ["Use `rig inbox approvals` for blocked run handoffs."]
     },
     {
       name: "browser",
-      summary: "Browser/app diagnostics for browser-required tasks.",
-      usage: ["rig browser <help|explain|demo|app|hp-next> [options]"],
+      summary: "Browser workstation actions for browser-required tasks: launch, check, CDP probe, profile reset, and app-specific smokes.",
+      usage: ["rig browser <help|explain|demo|hp-next|cdp-probe|profile-persistence|profile-lock-check|smoke-test> [options]"],
       commands: [
-        { command: "help", description: "Rich browser command help (canonical: `rig browser help`)." },
-        { command: "explain", description: "Explain the browser-required task contract." },
-        { command: "demo", description: "Run browser demo flows against a local page." },
-        { command: "app", description: "Launch the Rig Browser workstation app." },
-        { command: "hp-next <dev|check|e2e|reset>", description: "Drive the hp-next browser test harness." }
-      ]
+        { command: "help", description: "Rich browser command help (canonical: `rig browser help`).", primary: true },
+        { command: "explain", description: "Explain the browser-required task contract and runtime helper commands.", primary: true },
+        { command: "demo [--port <n>] [--profile <name>] [--state-dir <path>] [--target-url <url>] [--keep-open] [--no-build]", description: "Run a guided real browser/agent demo flow.", primary: true },
+        { command: "hp-next dev", description: "Start hp-next Rig Browser in dev/watch mode.", primary: true },
+        { command: "hp-next start", description: "Build/start the hp-next browser workstation without watch mode.", primary: true },
+        { command: "hp-next check", description: "Validate the hp-next CDP endpoint on the configured port.", primary: true },
+        { command: "hp-next e2e", description: "Run hp-next browser e2e smoke checks through Rig Browser.", primary: true },
+        { command: "hp-next reset", description: "Reset the hp-next browser profile when stale browser state is suspected.", primary: true },
+        { command: "cdp-probe", description: "Run an isolated CDP attach/evaluate/layout probe." },
+        { command: "profile-persistence", description: "Verify a named browser profile persists browser state." },
+        { command: "profile-lock-check", description: "Verify concurrent launches reject the same profile." },
+        { command: "smoke-test", description: "Run the browser package smoke test." }
+      ],
+      examples: [
+        "rig browser help",
+        "rig browser hp-next check",
+        "rig browser hp-next e2e",
+        "rig browser cdp-probe",
+        "rig browser profile-lock-check"
+      ],
+      next: ["Inside a task run, use rig-browser-launch, rig-browser-check, and rig-browser-attach-info from the worker PATH."]
     },
     {
       name: "pi",
@@ -3415,12 +3534,60 @@ var init__help_catalog = __esm(() => {
       examples: ["rig pi search subagents", "rig pi add pi-subagents", "rig pi list"],
       next: ["Config-managed extensions: declare `runtime: { pi: { packages: [...] } }` in rig.config.ts \u2014 workers pick them up automatically."]
     },
-    { name: "queue", summary: "Run task queues locally.", usage: ["rig queue run [options]"], commands: [{ command: "run", description: "Process queue work." }] },
-    { name: "agent", summary: "Runtime agent workspace helpers.", usage: ["rig agent <list|prepare|run|cleanup>"], commands: [{ command: "list", description: "List prepared agents." }] },
+    {
+      name: "queue",
+      summary: "Run task queues locally.",
+      usage: ["rig queue run [--workers <n>] [--max-tasks <n>] [--action validate|verify|pipeline] [--isolation off|worktree] [--no-runtime-reuse] [--fail-fast] [--skip-project-sync]"],
+      commands: [
+        { command: "run [--workers <n>] [--max-tasks <n>] [--action validate|verify|pipeline] [--isolation off|worktree] [--no-runtime-reuse] [--fail-fast] [--skip-project-sync]", description: "Process queue work: drain matching tasks with N workers, optional per-task action and isolation.", primary: true }
+      ]
+    },
+    {
+      name: "agent",
+      summary: "Runtime agent workspace helpers.",
+      usage: ["rig agent <list|prepare|run|cleanup>"],
+      commands: [
+        { command: "list", description: "List prepared agent runtimes.", primary: true },
+        { command: "prepare [--id <id>] [--mode <mode>] [--task <task>]", description: "Prepare an isolated agent runtime workspace.", primary: true },
+        { command: "run [--id <id>] [--mode <mode>] [--task <task>] [--skip-project-sync]", description: "Prepare (if needed) and run an agent in its workspace.", primary: true },
+        { command: "cleanup [--all] [--id <id>]", description: "Remove prepared agent workspaces.", primary: true }
+      ]
+    },
     { name: "inspector", summary: "Event stream and drift scanners.", usage: ["rig inspector <stream|scan-upstream-drift>"], commands: [{ command: "stream", description: "Stream events." }] },
-    { name: "dist", summary: "Build/install packaged Rig CLI.", usage: ["rig dist <build|install|doctor>"], commands: [{ command: "build", description: "Build distribution." }] },
+    {
+      name: "dist",
+      summary: "Build/install packaged Rig CLI.",
+      usage: ["rig dist <build|install|doctor|rebuild-agent>"],
+      commands: [
+        { command: "build [--output-dir <dir>]", description: "Build the distributable Rig CLI.", primary: true },
+        { command: "install [--scope <scope>] [--path <path>]", description: "Install the built CLI to a scope/path.", primary: true },
+        { command: "doctor", description: "Diagnose the dist toolchain and install state.", primary: true },
+        { command: "rebuild-agent", description: "Rebuild the agent runtime image, pruning stale images.", primary: true }
+      ]
+    },
     { name: "workspace", summary: "Workspace topology/service helpers.", usage: ["rig workspace <summary|topology|remote-hosts>"], commands: [{ command: "summary", description: "Show workspace summary." }] },
-    { name: "remote", summary: "Compatibility remote orchestration controls.", usage: ["rig remote <status|watch|pause|resume|...>"], commands: [{ command: "status", description: "Show remote state." }] },
+    {
+      name: "remote",
+      summary: "Compatibility remote orchestration controls.",
+      usage: ["rig remote <status|tasks|watch|pause|resume|continue|stop|refresh|add-iterations|remove-iterations|endpoint ...>"],
+      commands: [
+        { command: "status [--remote <alias>]", description: "Show the remote orchestration state.", primary: true },
+        { command: "tasks [--remote <alias>]", description: "List the remote's tracked tasks.", primary: true },
+        { command: "watch [--remote <alias>] [--seconds <n>] [--event <type>]", description: "Stream remote orchestration events.", primary: true },
+        { command: "pause [--remote <alias>]", description: "Pause the running remote orchestration.", primary: true },
+        { command: "resume [--remote <alias>] [--max-workers <n>] [--max-iterations <n>] [--direct-merge]", description: "Resume the remote with optional tuning.", primary: true },
+        { command: "continue [--remote <alias>]", description: "Continue a paused remote orchestration.", primary: true },
+        { command: "stop [--remote <alias>]", description: "Stop the remote orchestration.", primary: true },
+        { command: "refresh [--remote <alias>]", description: "Refresh remote state.", primary: true },
+        { command: "add-iterations [--count <n>] [--remote <alias>]", description: "Grant the remote more iterations.", primary: true },
+        { command: "remove-iterations [--count <n>] [--remote <alias>]", description: "Reduce the remote's iteration budget.", primary: true },
+        { command: "endpoint list", description: "List configured remote endpoints.", primary: true },
+        { command: "endpoint add --alias <alias> --host <host> --port <n> [--token <token>]", description: "Register a remote endpoint.", primary: true },
+        { command: "endpoint remove --alias <alias>", description: "Remove a remote endpoint.", primary: true },
+        { command: "endpoint test [--alias <alias>]", description: "Test connectivity to a remote endpoint.", primary: true },
+        { command: "endpoint doctor", description: "Diagnose remote endpoint configuration.", primary: true }
+      ]
+    },
     { name: "git", summary: "Pass through to Rig git-flow helper.", usage: ["rig git <args...>"], commands: [{ command: "<args...>", description: "Advanced git flow operations." }] },
     { name: "harness", summary: "Pass through to runtime harness CLI.", usage: ["rig harness <args...>"], commands: [{ command: "<args...>", description: "Advanced harness operations." }] },
     { name: "test", summary: "Project test wrappers.", usage: ["rig test <unit|e2e|all>"], commands: [{ command: "all", description: "Run configured project tests." }] }
@@ -3487,7 +3654,7 @@ var init__task_picker = __esm(() => {
 // packages/cli/src/commands/task.ts
 import { readFileSync as readFileSync11 } from "fs";
 import { spawnSync as spawnSync3 } from "child_process";
-import { resolve as resolve22 } from "path";
+import { resolve as resolve23 } from "path";
 import {
   taskArtifactDir,
   taskArtifacts,
@@ -3765,7 +3932,7 @@ async function executeTask(context, args, options) {
       const fileFlag = takeOption(rest.slice(1), "--file");
       let content;
       if (fileFlag.value) {
-        content = readFileSync11(resolve22(context.projectRoot, fileFlag.value), "utf-8");
+        content = readFileSync11(resolve23(context.projectRoot, fileFlag.value), "utf-8");
       } else {
         content = await readStdin();
       }
@@ -4003,6 +4170,47 @@ var init_task = __esm(() => {
   init__connection_state();
 });
 
+// packages/cli/src/commands/_server-events.ts
+import { WsTransport } from "@rig/client";
+import { RIG_WS_CHANNELS } from "@rig/contracts";
+function buildRigWebSocketUrl(baseUrl, authToken) {
+  const url = new URL(baseUrl);
+  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+  if (authToken)
+    url.searchParams.set("token", authToken);
+  return url.toString();
+}
+async function connectRigServerEvents(projectRoot, handlers) {
+  const { baseUrl, authToken } = await ensureServerForCli(projectRoot);
+  const transport = new WsTransport(buildRigWebSocketUrl(baseUrl, authToken));
+  const unsubscribers = [];
+  if (handlers.onSnapshotInvalidated)
+    unsubscribers.push(transport.subscribe(RIG_WS_CHANNELS.snapshotInvalidated, handlers.onSnapshotInvalidated));
+  if (handlers.onRunLogAppended)
+    unsubscribers.push(transport.subscribe(RIG_WS_CHANNELS.runLogAppended, handlers.onRunLogAppended));
+  if (handlers.onEngineEvent)
+    unsubscribers.push(transport.subscribe(RIG_WS_CHANNELS.event, handlers.onEngineEvent));
+  let status = "connecting";
+  unsubscribers.push(transport.subscribeState((state) => {
+    status = state.status;
+    handlers.onStatus?.(state.status);
+  }));
+  return {
+    connected: () => status === "connected",
+    close: () => {
+      for (const unsubscribe of unsubscribers) {
+        try {
+          unsubscribe();
+        } catch {}
+      }
+      transport.dispose();
+    }
+  };
+}
+var init__server_events = __esm(() => {
+  init__server_client();
+});
+
 // packages/cli/src/app/board.ts
 var exports_board = {};
 __export(exports_board, {
@@ -4841,21 +5049,39 @@ async function runOperatorBoard(context, options = {}) {
       tui.requestRender();
     }
   }, BOARD_TICK_MS);
+  const live = { subscription: null };
+  const refreshActiveView = () => {
+    refresh({ quiet: true });
+    if (view === "tasks")
+      refreshTasks();
+    if (view === "inbox")
+      refreshInbox();
+  };
+  connectRigServerEvents(context.projectRoot, {
+    onSnapshotInvalidated: () => refreshActiveView()
+  }).then((subscription) => {
+    live.subscription = subscription;
+  }).catch(() => {
+    live.subscription = null;
+  });
   const refreshTimer = setInterval(() => {
+    if (live.subscription?.connected())
+      return;
     refresh();
   }, BOARD_REFRESH_MS);
   tui.start();
   refresh({ quiet: true });
-  await new Promise((resolve25) => {
+  await new Promise((resolve26) => {
     const poll = setInterval(() => {
       if (stopped) {
         clearInterval(poll);
-        resolve25();
+        resolve26();
       }
     }, 50);
   });
   clearInterval(animation);
   clearInterval(refreshTimer);
+  live.subscription?.close();
   return outcome;
 }
 async function runOperatorBoardLoop(context, attach, options = {}) {
@@ -4874,6 +5100,7 @@ var init_board = __esm(() => {
   init__help_catalog();
   init__server_client();
   init__authority_runs();
+  init__server_events();
   init_inbox();
   init_task();
 });
@@ -4884,7 +5111,7 @@ import {
   existsSync as existsSync19,
   readFileSync as readFileSync13
 } from "fs";
-import { resolve as resolve25 } from "path";
+import { resolve as resolve26 } from "path";
 import { readBuildConfig } from "@rig/runtime/build-time-config";
 
 // packages/cli/src/commands/browser.ts
@@ -9112,14 +9339,64 @@ Usage: rig init`, 1);
 // packages/cli/src/commands/github.ts
 init_runner();
 init__server_client();
+init__connection_state();
 init__async_ui();
 import { spawnSync as spawnSync2 } from "child_process";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname4, resolve as resolve19 } from "path";
 function printPayload(context, payload, fallback) {
   if (context.outputMode === "json")
     console.log(JSON.stringify(payload, null, 2));
   else
     console.log(fallback);
 }
+function apiSessionTokenFrom2(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return null;
+  const token = payload.apiSessionToken;
+  return typeof token === "string" && token.trim() ? token.trim() : null;
+}
+function payloadString(payload, key) {
+  const value = payload[key];
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function payloadRecord(payload, key) {
+  const value = payload[key];
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function remoteNamespaceMetadata(result) {
+  const namespace = payloadRecord(result, "userNamespace");
+  return {
+    ...payloadString(result, "login") ? { login: payloadString(result, "login") } : {},
+    ...payloadString(result, "userId") ? { userId: payloadString(result, "userId") } : {},
+    ...namespace && payloadString(namespace, "key") ? { userNamespaceKey: payloadString(namespace, "key") } : {},
+    ...namespace && payloadString(namespace, "root") ? { userNamespaceRoot: payloadString(namespace, "root") } : {},
+    ...namespace && payloadString(namespace, "checkoutBaseDir") ? { checkoutBaseDir: payloadString(namespace, "checkoutBaseDir") } : {},
+    ...namespace && payloadString(namespace, "snapshotBaseDir") ? { snapshotBaseDir: payloadString(namespace, "snapshotBaseDir") } : {}
+  };
+}
+function persistRemoteAuthSession(context, source, result, fallbackToken) {
+  const apiSessionToken = apiSessionTokenFrom2(result);
+  setGitHubBearerTokenForCurrentProcess(apiSessionToken ?? fallbackToken, context.projectRoot);
+  if (!apiSessionToken)
+    return;
+  const repo = readRepoConnection(context.projectRoot);
+  const path = resolve19(context.projectRoot, ".rig", "state", "github-auth.json");
+  mkdirSync9(dirname4(path), { recursive: true });
+  writeFileSync6(path, `${JSON.stringify({
+    authenticated: true,
+    source,
+    storedOnServer: true,
+    ...repo?.project ? { selectedRepo: repo.project } : {},
+    ...remoteNamespaceMetadata(result),
+    apiSessionToken,
+    updatedAt: new Date().toISOString()
+  }, null, 2)}
+`, "utf8");
+}
+function isSignedIn(status) {
+  return status.signedIn === true || status.authenticated === true;
+}
 function readGhToken() {
   const result = spawnSync2("gh", ["auth", "token"], { encoding: "utf8" });
   if (result.status !== 0) {
@@ -9141,7 +9418,7 @@ async function executeGithub(context, args) {
       if (rest.length > 0)
         throw new CliError("Usage: rig github auth status", 1);
       const status = await withSpinner("Checking GitHub auth on the server\u2026", () => getGitHubAuthStatusViaServer(context), { outputMode: context.outputMode });
-      printPayload(context, status, `GitHub auth: ${status.authenticated ? "authenticated" : "unauthenticated"}`);
+      printPayload(context, status, `GitHub auth: ${isSignedIn(status) ? "authenticated" : "unauthenticated"}`);
       return { ok: true, group: "github", command: "auth status", details: status };
     }
     case "token": {
@@ -9151,16 +9428,20 @@ async function executeGithub(context, args) {
       const token = parsed.value?.trim();
       if (!token)
         throw new CliError("Missing --token value.", 1, { hint: "Re-run as `rig github auth token --token <token>`." });
-      const result = await withSpinner("Storing GitHub token on the server\u2026", () => postGitHubTokenViaServer(context, token), { outputMode: context.outputMode });
-      printPayload(context, result, "GitHub token stored on the selected Rig server.");
+      const repo = readRepoConnection(context.projectRoot);
+      const result = await withSpinner("Storing GitHub token on the server\u2026", () => postGitHubTokenViaServer(context, token, repo?.project ? { selectedRepo: repo.project } : {}), { outputMode: context.outputMode });
+      persistRemoteAuthSession(context, "token", result, token);
+      printPayload(context, result, "GitHub token stored on the selected server.");
       return { ok: true, group: "github", command: "auth token", details: result };
     }
     case "import-gh": {
       if (rest.length > 0)
         throw new CliError("Usage: rig github auth import-gh", 1);
       const importedToken = readGhToken();
-      const result = await withSpinner("Storing GitHub token on the server\u2026", () => postGitHubTokenViaServer(context, importedToken), { outputMode: context.outputMode });
-      printPayload(context, result, "GitHub token imported from gh and stored on the selected Rig server.");
+      const repo = readRepoConnection(context.projectRoot);
+      const result = await withSpinner("Storing GitHub token on the server\u2026", () => postGitHubTokenViaServer(context, importedToken, repo?.project ? { selectedRepo: repo.project } : {}), { outputMode: context.outputMode });
+      persistRemoteAuthSession(context, "gh", result, importedToken);
+      printPayload(context, result, "GitHub token imported from gh and stored on the selected server.");
       return { ok: true, group: "github", command: "auth import-gh", details: result };
     }
     default:
@@ -9190,7 +9471,7 @@ init_runner();
 init__authority_runs();
 init__paths();
 import { readFileSync as readFileSync8 } from "fs";
-import { resolve as resolve19 } from "path";
+import { resolve as resolve20 } from "path";
 import {
   appendRunJournalEvent,
   appendRunLogEntry,
@@ -9227,7 +9508,7 @@ function touchAuthorityRun(projectRoot, runId) {
   if (!current) {
     return;
   }
-  writeJsonFile3(resolve19(resolveAuthorityRunDir(projectRoot, runId), "run.json"), {
+  writeJsonFile3(resolve20(resolveAuthorityRunDir(projectRoot, runId), "run.json"), {
     ...current,
     updatedAt: new Date().toISOString()
   });
@@ -9465,7 +9746,7 @@ init_runner();
 init__server_client();
 init__async_ui();
 import { existsSync as existsSync13, readFileSync as readFileSync9 } from "fs";
-import { resolve as resolve20 } from "path";
+import { resolve as resolve21 } from "path";
 import {
   listAuthorityRuns,
   readAuthorityRun as readAuthorityRun3,
@@ -9509,7 +9790,7 @@ async function executeInspect(context, args) {
         }
         return { ok: true, group: "inspect", command, details: { task: requiredTask, runId: fallback.runId, source: "server", entries } };
       }
-      const logsPath = resolve20(resolveAuthorityRunDir2(context.projectRoot, latestRun.runId), "logs.jsonl");
+      const logsPath = resolve21(resolveAuthorityRunDir2(context.projectRoot, latestRun.runId), "logs.jsonl");
       if (!existsSync13(logsPath)) {
         throw new CliError(`No logs found for run ${latestRun.runId}.`, 1, { hint: `Try \`rig run show ${latestRun.runId}\` or \`rig run replay ${latestRun.runId}\`.` });
       }
@@ -9597,7 +9878,7 @@ async function executeInspect(context, args) {
       return { ok: true, group: "inspect", command };
     case "audit": {
       requireNoExtraArgs(rest, "rig inspect audit");
-      const auditPath = resolve20(resolveHarnessPaths2(context.projectRoot).logsDir, "audit.jsonl");
+      const auditPath = resolve21(resolveHarnessPaths2(context.projectRoot).logsDir, "audit.jsonl");
       if (!existsSync13(auditPath)) {
         console.log("No audit log found.");
       } else {
@@ -10256,7 +10537,7 @@ import { loadRuntimeContextFromEnv } from "@rig/runtime/control-plane/runtime/co
 
 // packages/cli/src/commands/_run-replay.ts
 import { existsSync as existsSync14, readdirSync as readdirSync2 } from "fs";
-import { join as join2, resolve as resolve21 } from "path";
+import { join as join2, resolve as resolve22 } from "path";
 import {
   readAuthorityRun as readAuthorityRun4,
   readJsonlFile as readJsonlFile3,
@@ -10349,7 +10630,7 @@ function resolveRunSessionFile(record) {
   const sessionId = text(piSession.sessionId);
   if (!cwd || !sessionId)
     return null;
-  const sessionDir = resolve21(cwd, ".rig", "session");
+  const sessionDir = resolve22(cwd, ".rig", "session");
   try {
     const match = readdirSync2(sessionDir).find((name) => name.endsWith(`_${sessionId}.jsonl`));
     return match ? join2(sessionDir, match) : null;
@@ -10847,6 +11128,9 @@ async function executeRun(context, args) {
           console.log(`Stop requested: ${runId}`);
         return { ok: true, group: "run", command, details: stopped };
       }
+      if (isRemoteConnectionSelected(context.projectRoot)) {
+        throw new CliError("Remote run stop requires an explicit run id.", 2, { hint: "Run `rig run list`, then `rig run stop <run-id>`." });
+      }
       const result = await runStop(context.projectRoot);
       if (result.remaining.length > 0) {
         throw new CliError(`Failed to stop run(s): ${result.remaining.join(", ")}`, 1, { hint: "Check `rig run status`, then retry `rig run stop <run-id>` for the remaining runs." });
@@ -10963,7 +11247,13 @@ async function executeConnectionCommand(context, args, options) {
         if (!state.connections[alias])
           throw new CliError(`Unknown Rig server: ${alias}`, 1, { hint: "Run `rig server list` to see saved aliases, or save one with `rig server add <alias> <url>`." });
       }
-      const repoState = { selected: alias, linkedAt: new Date().toISOString() };
+      const previousRepo = readRepoConnection(context.projectRoot);
+      const repoState = {
+        selected: alias,
+        ...previousRepo?.project ? { project: previousRepo.project } : {},
+        linkedAt: new Date().toISOString(),
+        ...previousRepo?.serverProjectRoot && previousRepo.selected === alias ? { serverProjectRoot: previousRepo.serverProjectRoot } : {}
+      };
       writeRepoConnection(context.projectRoot, repoState);
       printJsonOrText(context, repoState, formatSuccessCard("Rig server selected", [
         ["selected", alias],
@@ -11198,8 +11488,8 @@ init_task();
 
 // packages/cli/src/commands/task-run-driver.ts
 init_runner();
-import { copyFileSync as copyFileSync3, existsSync as existsSync16, mkdirSync as mkdirSync10, readFileSync as readFileSync12, statSync as statSync2, writeFileSync as writeFileSync7 } from "fs";
-import { resolve as resolve23 } from "path";
+import { copyFileSync as copyFileSync3, existsSync as existsSync16, mkdirSync as mkdirSync11, readFileSync as readFileSync12, statSync as statSync2, writeFileSync as writeFileSync8 } from "fs";
+import { resolve as resolve24 } from "path";
 import { spawn as spawn2, spawnSync as spawnSync4 } from "child_process";
 import { createInterface as createLineInterface } from "readline";
 import { loadConfig as loadConfig2 } from "@rig/core/load-config";
@@ -11298,12 +11588,12 @@ function copyUntrackedDirtyFiles(sourceRoot, targetRoot) {
     return 0;
   let copied = 0;
   for (const relativePath of listed.stdout.split("\x00").filter(Boolean)) {
-    const sourcePath = resolve23(sourceRoot, relativePath);
-    const targetPath = resolve23(targetRoot, relativePath);
+    const sourcePath = resolve24(sourceRoot, relativePath);
+    const targetPath = resolve24(targetRoot, relativePath);
     try {
       if (!statSync2(sourcePath).isFile())
         continue;
-      mkdirSync10(resolve23(targetPath, ".."), { recursive: true });
+      mkdirSync11(resolve24(targetPath, ".."), { recursive: true });
       copyFileSync3(sourcePath, targetPath);
       copied += 1;
     } catch {}
@@ -11342,7 +11632,7 @@ function buildDirtyBaselineHandshakeEnv(input) {
     return { RIG_BASELINE_MODE: input.baselineMode ?? "head" };
   return {
     RIG_BASELINE_MODE: "dirty-snapshot",
-    RIG_DIRTY_BASELINE_READY_FILE: resolve23(input.projectRoot, ".rig", "runs", input.runId, "dirty-baseline.ready.json")
+    RIG_DIRTY_BASELINE_READY_FILE: resolve24(input.projectRoot, ".rig", "runs", input.runId, "dirty-baseline.ready.json")
   };
 }
 function positiveInt(value, fallback) {
@@ -11447,9 +11737,9 @@ function createCommandRunner(binary) {
     const stderrChunks = [];
     child.stdout.on("data", (chunk) => stdoutChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk))));
     child.stderr.on("data", (chunk) => stderrChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk))));
-    return await new Promise((resolve24) => {
-      child.once("error", (error) => resolve24({ exitCode: 1, stderr: error.message }));
-      child.once("close", (code) => resolve24({
+    return await new Promise((resolve25) => {
+      child.once("error", (error) => resolve25({ exitCode: 1, stderr: error.message }));
+      child.once("close", (code) => resolve25({
         exitCode: code ?? 1,
         stdout: Buffer.concat(stdoutChunks).toString("utf8"),
         stderr: Buffer.concat(stderrChunks).toString("utf8")
@@ -11523,7 +11813,7 @@ async function runTaskRunPostValidationLifecycle(input) {
     config,
     sourceTask: input.sourceTask,
     uploadedSnapshot: input.uploadedSnapshot,
-    artifactRoot: resolve23(input.projectRoot, "artifacts", taskId3),
+    artifactRoot: resolve24(input.projectRoot, "artifacts", taskId3),
     command: ghCommand,
     gitCommand,
     steerPi,
@@ -11653,7 +11943,7 @@ function summarizeValidationFailure(projectRoot, taskId3) {
     return null;
   }
   for (const artifactDir of resolveTaskArtifactDirs2(projectRoot, taskId3)) {
-    const summary = readJsonFile3(resolve23(artifactDir, "validation-summary.json"), null);
+    const summary = readJsonFile3(resolve24(artifactDir, "validation-summary.json"), null);
     if (!summary || summary.status !== "fail") {
       continue;
     }
@@ -11734,9 +12024,9 @@ function readTaskRunAcceptedArtifactState(input) {
   if (!input.taskId || !input.workspaceDir) {
     return { accepted: false, reason: null };
   }
-  const artifactDir = resolve23(input.workspaceDir, "artifacts", input.taskId);
-  const reviewStatusPath = resolve23(artifactDir, "review-status.txt");
-  const taskResultPath = resolve23(artifactDir, "task-result.json");
+  const artifactDir = resolve24(input.workspaceDir, "artifacts", input.taskId);
+  const reviewStatusPath = resolve24(artifactDir, "review-status.txt");
+  const taskResultPath = resolve24(artifactDir, "task-result.json");
   const reviewStatus = readTaskRunReviewStatus(reviewStatusPath);
   if (reviewStatus !== "APPROVED") {
     return { accepted: false, reason: null };
@@ -11773,12 +12063,12 @@ function resolveTaskRunRetryContext(input) {
   if (!input.taskId || !input.workspaceDir) {
     return { shouldRetry: false, failureDetail: null, nextPrompt: null };
   }
-  const artifactDir = resolve23(input.workspaceDir, "artifacts", input.taskId);
-  const reviewStatePath = resolve23(artifactDir, "review-state.json");
-  const reviewFeedbackPath = resolve23(artifactDir, "review-feedback.md");
-  const reviewStatusPath = resolve23(artifactDir, "review-status.txt");
-  const failedApproachesPath = resolve23(input.workspaceDir, ".rig", "state", "failed_approaches.md");
-  const validationSummaryPath = resolve23(artifactDir, "validation-summary.json");
+  const artifactDir = resolve24(input.workspaceDir, "artifacts", input.taskId);
+  const reviewStatePath = resolve24(artifactDir, "review-state.json");
+  const reviewFeedbackPath = resolve24(artifactDir, "review-feedback.md");
+  const reviewStatusPath = resolve24(artifactDir, "review-status.txt");
+  const failedApproachesPath = resolve24(input.workspaceDir, ".rig", "state", "failed_approaches.md");
+  const validationSummaryPath = resolve24(artifactDir, "validation-summary.json");
   const reviewState = readJsonFile3(reviewStatePath, null);
   const reviewStatus = readTaskRunReviewStatus(reviewStatusPath);
   const reviewRejected = isTaskRunReviewRejected(reviewState);
@@ -12188,15 +12478,15 @@ async function executeRigOwnedTaskRun(context, input) {
   const loadedAutomationConfig = await loadTaskRunAutomationConfig(context.projectRoot);
   const automationConfig = input.prMode ? { ...loadedAutomationConfig ?? {}, pr: { ...loadedAutomationConfig?.pr ?? {}, mode: input.prMode } } : loadedAutomationConfig;
   const planningClassification = classifyPlanningNeed({ config: automationConfig, sourceTask });
-  const planningArtifactPath = resolve23("artifacts", runtimeTaskId, "implementation-plan.md");
+  const planningArtifactPath = resolve24("artifacts", runtimeTaskId, "implementation-plan.md");
   const persistedPlanning = {
     ...planningClassification,
     classifier: input.runtimeAdapter === "pi" ? "pi-rig-structured-policy" : "rig-structured-policy",
     artifactPath: planningClassification.planningRequired ? planningArtifactPath : null,
     classifiedAt: new Date().toISOString()
   };
-  mkdirSync10(resolve23(context.projectRoot, ".rig", "runs", input.runId), { recursive: true });
-  writeFileSync7(resolve23(context.projectRoot, ".rig", "runs", input.runId, "planning-classification.json"), `${JSON.stringify(persistedPlanning, null, 2)}
+  mkdirSync11(resolve24(context.projectRoot, ".rig", "runs", input.runId), { recursive: true });
+  writeFileSync8(resolve24(context.projectRoot, ".rig", "runs", input.runId, "planning-classification.json"), `${JSON.stringify(persistedPlanning, null, 2)}
 `, "utf8");
   patchAuthorityRun(context.projectRoot, input.runId, { planning: persistedPlanning });
   prompt = `${prompt}
@@ -12246,7 +12536,7 @@ ${planningClassification.planningRequired ? `Before implementing, write a concis
   let verificationStarted = false;
   let reviewStarted = false;
   let latestRuntimeWorkspace = resumeMode && typeof existingRunRecord?.worktreePath === "string" ? existingRunRecord.worktreePath : null;
-  let latestSessionDir = resumeMode && typeof existingRunRecord?.sessionPath === "string" ? resolve23(existingRunRecord.sessionPath, "..") : null;
+  let latestSessionDir = resumeMode && typeof existingRunRecord?.sessionPath === "string" ? resolve24(existingRunRecord.sessionPath, "..") : null;
   let latestLogsDir = resumeMode && typeof existingRunRecord?.logRoot === "string" ? existingRunRecord.logRoot : null;
   let latestProviderCommand = null;
   let latestRuntimeBranch = resumeMode && typeof existingRunRecord?.branch === "string" ? existingRunRecord.branch : null;
@@ -12332,10 +12622,10 @@ ${planningClassification.planningRequired ? `Before implementing, write a concis
       setRunStatusOrFail(context.projectRoot, input.runId, "running");
       patchAuthorityRun(context.projectRoot, input.runId, {
         worktreePath: latestRuntimeWorkspace,
-        artifactRoot: latestRuntimeWorkspace && input.taskId ? resolve23(latestRuntimeWorkspace, "artifacts", input.taskId) : null,
+        artifactRoot: latestRuntimeWorkspace && input.taskId ? resolve24(latestRuntimeWorkspace, "artifacts", input.taskId) : null,
         logRoot: latestLogsDir,
-        sessionPath: latestSessionDir ? resolve23(latestSessionDir, "session.json") : null,
-        sessionLogPath: latestLogsDir ? resolve23(latestLogsDir, "agent-stdout.log") : null,
+        sessionPath: latestSessionDir ? resolve24(latestSessionDir, "session.json") : null,
+        sessionLogPath: latestLogsDir ? resolve24(latestLogsDir, "agent-stdout.log") : null,
         branch: runtimeId
       });
       if (!dirtyBaselineApplied && input.baselineMode === "dirty-snapshot" && latestRuntimeWorkspace) {
@@ -12343,8 +12633,8 @@ ${planningClassification.planningRequired ? `Before implementing, write a concis
         const dirty = applyDirtyBaselineSnapshot({ sourceRoot: context.projectRoot, targetRoot: latestRuntimeWorkspace });
         const readyFile = childEnv.RIG_DIRTY_BASELINE_READY_FILE;
         if (readyFile) {
-          mkdirSync10(resolve23(readyFile, ".."), { recursive: true });
-          writeFileSync7(readyFile, `${JSON.stringify({ ...dirty, workspaceDir: latestRuntimeWorkspace, appliedAt: new Date().toISOString() }, null, 2)}
+          mkdirSync11(resolve24(readyFile, ".."), { recursive: true });
+          writeFileSync8(readyFile, `${JSON.stringify({ ...dirty, workspaceDir: latestRuntimeWorkspace, appliedAt: new Date().toISOString() }, null, 2)}
 `, "utf8");
         }
         appendRunLog(context.projectRoot, input.runId, {
@@ -12740,7 +13030,7 @@ ${planningClassification.planningRequired ? `Before implementing, write a concis
     let acceptedArtifactObservedAt = null;
     let acceptedArtifactPollTimer = null;
     let acceptedArtifactKillTimer = null;
-    const attemptExit = await new Promise((resolve24) => {
+    const attemptExit = await new Promise((resolve25) => {
       let settled = false;
       const settle = (result) => {
         if (settled)
@@ -12748,7 +13038,7 @@ ${planningClassification.planningRequired ? `Before implementing, write a concis
         settled = true;
         if (acceptedArtifactPollTimer)
           clearInterval(acceptedArtifactPollTimer);
-        resolve24(result);
+        resolve25(result);
       };
       const pollAcceptedArtifacts = () => {
         const artifactState = readTaskRunAcceptedArtifactState({
@@ -12951,7 +13241,7 @@ Failed to update task source for ${input.taskId ?? runtimeTaskId} to failed: ${e
   }
   if (planningClassification.planningRequired) {
     const planWorkspace = latestRuntimeWorkspace ?? context.projectRoot;
-    const expectedPlanPath = resolve23(planWorkspace, planningArtifactPath);
+    const expectedPlanPath = resolve24(planWorkspace, planningArtifactPath);
     if (!existsSync16(expectedPlanPath)) {
       const failedAt = new Date().toISOString();
       const failureDetail = `Planning was required (${planningClassification.reason}) but ${planningArtifactPath} was not written before implementation completed.`;
@@ -13121,9 +13411,9 @@ Failed to update task source for ${input.taskId ?? runtimeTaskId} to failed: ${e
       });
       emitServerRunEvent({ type: "log", runId: input.runId, title: "Pi PR feedback fix stderr" });
     });
-    const exitCode = await new Promise((resolve24) => {
-      child.once("error", () => resolve24(1));
-      child.once("close", (code) => resolve24(code ?? 1));
+    const exitCode = await new Promise((resolve25) => {
+      child.once("error", () => resolve25(1));
+      child.once("close", (code) => resolve25(code ?? 1));
     });
     for (const pendingLog of flushPendingClaudeToolUseLogs({
       runId: input.runId,
@@ -13264,8 +13554,8 @@ async function executeTest(context, args) {
 init_runner();
 init__parsers();
 init__paths();
-import { existsSync as existsSync17, mkdirSync as mkdirSync11, readdirSync as readdirSync3, writeFileSync as writeFileSync8 } from "fs";
-import { resolve as resolve24 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync12, readdirSync as readdirSync3, writeFileSync as writeFileSync9 } from "fs";
+import { resolve as resolve25 } from "path";
 import { createPluginHost } from "@rig/core";
 import {
   isSupportedBunVersion as isSupportedBunVersion2,
@@ -13320,12 +13610,12 @@ function runSetupInit(projectRoot) {
   const stateDir = resolveControlPlaneHostStateDir(projectRoot);
   const logsDir = resolveControlPlaneHostLogsDir(projectRoot);
   const artifactsDir = resolveControlPlaneArtifactsDir(projectRoot);
-  mkdirSync11(stateDir, { recursive: true });
-  mkdirSync11(logsDir, { recursive: true });
-  mkdirSync11(artifactsDir, { recursive: true });
-  const failuresPath = resolve24(stateDir, "failed_approaches.md");
+  mkdirSync12(stateDir, { recursive: true });
+  mkdirSync12(logsDir, { recursive: true });
+  mkdirSync12(artifactsDir, { recursive: true });
+  const failuresPath = resolve25(stateDir, "failed_approaches.md");
   if (!existsSync17(failuresPath)) {
-    writeFileSync8(failuresPath, `# Failed Approaches
+    writeFileSync9(failuresPath, `# Failed Approaches
 
 `, "utf-8");
   }
@@ -13342,17 +13632,17 @@ async function runSetupCheck(projectRoot, outputMode = "text") {
 }
 async function runSetupPreflight(projectRoot, outputMode = "text") {
   await runSetupCheck(projectRoot, outputMode);
-  const validationRoot = resolve24(resolveControlPlaneDefinitionRoot(projectRoot), "validation");
+  const validationRoot = resolve25(resolveControlPlaneDefinitionRoot(projectRoot), "validation");
   if (existsSync17(validationRoot)) {
     const validators = readdirSync3(validationRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory());
     for (const validator of validators) {
-      const script = resolve24(validationRoot, validator.name, "validate.sh");
+      const script = resolve25(validationRoot, validator.name, "validate.sh");
       if (existsSync17(script)) {
         console.log(`OK: validator script ${script}`);
       }
     }
   }
-  const hooksRoot = resolve24(resolveControlPlaneDefinitionRoot(projectRoot), "hooks");
+  const hooksRoot = resolve25(resolveControlPlaneDefinitionRoot(projectRoot), "hooks");
   if (existsSync17(hooksRoot)) {
     const hooks = readdirSync3(hooksRoot).filter((name) => name.endsWith(".sh"));
     for (const hook of hooks) {
@@ -13499,7 +13789,7 @@ var PROJECT_REQUIRED_GROUPS = new Set([
 ]);
 var RIG_CONFIG_FILENAMES = ["rig.config.ts", "rig.config.mts", "rig.config.json"];
 function hasInitializedRigProject(projectRoot) {
-  return RIG_CONFIG_FILENAMES.some((name) => existsSync19(resolve25(projectRoot, name))) || existsSync19(resolve25(projectRoot, ".rig"));
+  return RIG_CONFIG_FILENAMES.some((name) => existsSync19(resolve26(projectRoot, name))) || existsSync19(resolve26(projectRoot, ".rig"));
 }
 function requireInitializedRigProject(context, group) {
   if (hasInitializedRigProject(context.projectRoot)) {
@@ -13553,7 +13843,7 @@ function resolveTopLevelLaunchState(context) {
   let selectedServer = null;
   if (projectInitialized) {
     try {
-      const statePath = resolve25(context.projectRoot, ".rig", "state", "connection.json");
+      const statePath = resolve26(context.projectRoot, ".rig", "state", "connection.json");
       if (existsSync19(statePath)) {
         const parsed = JSON.parse(readFileSync13(statePath, "utf-8"));
         selectedServer = parsed.remoteUrl || parsed.url || parsed.selected || null;
@@ -13562,8 +13852,14 @@ function resolveTopLevelLaunchState(context) {
   }
   return { projectInitialized, selectedServer, version: process.env.RIG_CLI_VERSION || readBuildConfig().RIG_CLI_VERSION || undefined };
 }
+function envTruthy(value) {
+  if (!value)
+    return false;
+  const normalized = value.trim().toLowerCase();
+  return normalized !== "0" && normalized !== "false" && normalized !== "no";
+}
 function shouldOpenApp(context) {
-  return context.outputMode === "text" && Boolean(process.stdin.isTTY && process.stdout.isTTY) && process.env.RIG_CLI_PLAIN_HELP !== "1";
+  return context.outputMode === "text" && Boolean(process.stdin.isTTY && process.stdout.isTTY) && process.env.RIG_CLI_PLAIN_HELP !== "1" && process.env.RIG_PLAIN !== "1" && !envTruthy(process.env.CI);
 }
 async function openApp(context, options = {}) {
   const { runOperatorBoardLoop: runOperatorBoardLoop2 } = await Promise.resolve().then(() => (init_board(), exports_board));
@@ -13772,7 +14068,7 @@ var __testOnly = {
 };
 // packages/cli/src/launcher.ts
 import { existsSync as existsSync20 } from "fs";
-import { basename as basename3, resolve as resolve26 } from "path";
+import { basename as basename3, resolve as resolve27 } from "path";
 import { loadDotEnvSecrets } from "@rig/runtime/baked-secrets";
 import { RIG_DEFINITION_DIRNAME, RIG_STATE_DIRNAME, resolveNearestRigProjectRoot } from "@rig/runtime/layout";
 
@@ -13836,7 +14132,7 @@ function parsePolicyMode(value) {
   throw new Error(`Invalid --policy-mode value: ${value}. Use off|observe|enforce.`);
 }
 function hasRigProjectMarker(candidate) {
-  return existsSync20(resolve26(candidate, RIG_DEFINITION_DIRNAME)) || existsSync20(resolve26(candidate, RIG_STATE_DIRNAME)) || existsSync20(resolve26(candidate, "rig.config.ts")) || existsSync20(resolve26(candidate, "rig.config.json")) || existsSync20(resolve26(candidate, ".git"));
+  return existsSync20(resolve27(candidate, RIG_DEFINITION_DIRNAME)) || existsSync20(resolve27(candidate, RIG_STATE_DIRNAME)) || existsSync20(resolve27(candidate, "rig.config.ts")) || existsSync20(resolve27(candidate, "rig.config.json")) || existsSync20(resolve27(candidate, ".git"));
 }
 function resolveProjectRoot({
   envProjectRoot,
@@ -13845,19 +14141,19 @@ function resolveProjectRoot({
   cwd = process.cwd()
 }) {
   if (envProjectRoot) {
-    return resolve26(cwd, envProjectRoot);
+    return resolve27(cwd, envProjectRoot);
   }
   const fallbackImportDir = importDir ?? cwd;
   const execName = basename3(execPath).toLowerCase();
-  const execCandidates = execName === "rig" || execName === "rig.exe" ? [resolve26(execPath, "..", "..")] : [];
-  const candidates = [cwd, ...execCandidates, resolve26(fallbackImportDir, "..")];
+  const execCandidates = execName === "rig" || execName === "rig.exe" ? [resolve27(execPath, "..", "..")] : [];
+  const candidates = [cwd, ...execCandidates, resolve27(fallbackImportDir, "..")];
   for (const candidate of candidates) {
     const nearest = resolveNearestRigProjectRoot(candidate);
     if (hasRigProjectMarker(nearest)) {
       return nearest;
     }
   }
-  return resolve26(cwd);
+  return resolve27(cwd);
 }
 function normalizeCliErrorCode(message2, isCliError) {
   if (message2.startsWith("Invalid --policy-mode value:")) {
@@ -13931,7 +14227,7 @@ async function runRigCli(module, options = {}) {
           runId: context.runId,
           outcome,
           eventsFile: context.eventBus.getEventsFile(),
-          policyFile: resolve26(projectRoot, "rig", "policy", "policy.json"),
+          policyFile: resolve27(projectRoot, "rig", "policy", "policy.json"),
           policyMode: context.policyMode ?? policyMode ?? module.loadPolicy(projectRoot).mode
         }, null, 2));
       }