@h-rig/cli 0.0.6-alpha.88 → 0.0.6-alpha.89

package/dist/src/app-opentui/react/launch.js

@@ -215,16 +215,31 @@ function taskViewIntent(argv, command = "", rest = [], raw) {
   const { payload, label } = taskViewPayload(command, rest);
   return intent("tasks", argv, "refresh", payload, label, raw);
 }
-function routeServer(argv, command, raw, checkingLabel) {
-  if (!command || command === "status") {
+function routeServer(argv, command, rest, raw, checkingLabel) {
+  if (!command || command === "status" || command === "list") {
     return intent("server", argv, "refresh", undefined, command ? checkingLabel : "Loading server", raw);
   }
+  if (command === "use") {
+    const alias = firstNonOption(rest);
+    if (alias === "local")
+      return intent("server", argv, "server-use-local", undefined, "Use local server", raw);
+    if (alias)
+      return intent("server", argv, "server-use-remote", { alias }, `Use ${alias}`, raw);
+    return intent("server", argv, "refresh", undefined, "Select a remote alias in Server", raw);
+  }
+  if (command === "add")
+    return intent("server", argv, "server-add-remote", { argv: [...argv] }, "Add remote server", raw);
+  if (command === "repair-link")
+    return intent("server", argv, "remote-link-repair", undefined, "Repair remote link", raw);
   return commandRunIntent(argv, raw);
 }
 function routeGithub(argv, command, rest, raw) {
   if (command === "auth" && (rest[0]?.toLowerCase() ?? "status") === "status" && rest.length <= 1) {
     return intent("server", argv, "refresh", undefined, "Checking GitHub auth", raw);
   }
+  if (command === "auth" && rest[0]?.toLowerCase() === "import-gh" && rest.length <= 1) {
+    return intent("server", argv, "github-auth-import", undefined, "Import GitHub auth", raw);
+  }
   return commandRunIntent(argv, raw);
 }
 function routeDoctor(argv, command, raw) {
@@ -273,11 +288,16 @@ function intentFromArgv(argv) {
     return commandRunIntent(argv);
   }
   if (normalizedGroup === "server")
-    return routeServer(argv, normalizedCommand, undefined, "Checking server");
+    return routeServer(argv, normalizedCommand, rest, undefined, "Checking server");
   if (normalizedGroup === "github")
     return routeGithub(argv, normalizedCommand, rest);
-  if (normalizedGroup === "init")
-    return commandRunIntent(argv);
+  if (normalizedGroup === "init") {
+    if (!normalizedCommand)
+      return intent("init", argv, "refresh", undefined, "Open init");
+    if (rest.includes("--yes") || normalizedCommand === "--yes")
+      return intent("init", argv, "init-start", undefined, "Run init");
+    return intent("init", argv, "refresh", undefined, "Open init");
+  }
   if (normalizedGroup === "doctor")
     return routeDoctor(argv, normalizedCommand);
   if (normalizedGroup === "inbox")
@@ -340,12 +360,17 @@ function intentFromTypeBar(value) {
       return commandRunIntent(parts, value);
     return intent("tasks", parts, "refresh", undefined, "Select a task, then press Enter; or use run next", value);
   }
-  if (first === "init")
-    return commandRunIntent(parts, value);
+  if (first === "init") {
+    if (!second)
+      return intent("init", parts, "refresh", undefined, "Open init", value);
+    if (parts.includes("--yes"))
+      return intent("init", parts, "init-start", undefined, "Run init", value);
+    return intent("init", parts, "refresh", undefined, "Open init", value);
+  }
   if (first === "doctor")
     return routeDoctor(parts, second, value);
   if (first === "server")
-    return routeServer(parts, second, value, "Loading server");
+    return routeServer(parts, second, rest, value, "Loading server");
   if (first === "github")
     return routeGithub(parts, second, rest, value);
   if (first === "inbox")
@@ -806,12 +831,13 @@ var PRIMARY_GROUPS = [
   {
     name: "server",
     summary: "Choose, inspect, and start the Rig server that owns tasks and runs.",
-    usage: ["rig server <status|list|add|use|start> [options]"],
+    usage: ["rig server <status|list|add|use|repair-link|start> [options]"],
     commands: [
-      { command: "status", description: "Show the selected server for this repo.", primary: true },
+      { command: "status", description: "Show the selected server and remote project-root link for this repo.", primary: true },
       { command: "use local", description: "Switch this repo to the local Rig server.", primary: true },
       { command: "add <alias> <url>", description: "Save a remote Rig server URL.", primary: true },
       { command: "use <alias>", description: "Select a saved remote server alias.", primary: true },
+      { command: "repair-link [--prepare|--backfill-only] [--repo owner/repo]", description: "Backfill or prepare the selected remote's server-host checkout link.", primary: true },
       { command: "list", description: "List saved local/remote server aliases.", primary: true },
       { command: "start [--host <host>] [--port <n>]", description: "Start a local rig-server process." }
     ],
@@ -819,6 +845,7 @@ var PRIMARY_GROUPS = [
       "rig server status",
       "rig server add prod https://where.rig-does.work",
       "rig server use prod",
+      "rig server repair-link --repo owner/repo",
       "rig server use local",
       "rig server start --port 3773"
     ],
@@ -1308,12 +1335,6 @@ function cycleCompletion(value, state, candidates = commandCandidates()) {
   return { value: matches[nextIndex], state: { base, index: nextIndex } };
 }
 
-// packages/cli/src/app-opentui/pi-pty-host.ts
-function getActivePiHost() {
-  return null;
-}
-function stopActivePiHost(_reason) {}
-
 // packages/cli/src/app-opentui/keymap.ts
 var autocompleteState;
 function clearTypeBar(context, message) {
@@ -1323,22 +1344,15 @@ function clearTypeBar(context, message) {
   context.emitTypeBarPatch({ value: "", mode: "nav", prompt: undefined, message });
 }
 function handleEmbeddedTerminalKey(context, key) {
-  const state = context.getState();
-  const piHost = getActivePiHost();
-  const commandHost = getActiveCommandHost();
-  const host = state.scene === "handoff" ? piHost : state.scene === "command" ? commandHost : null;
+  if (context.getState().scene !== "command")
+    return false;
+  const host = getActiveCommandHost();
   if (!host)
     return false;
   if (key.ctrl && key.name === "]") {
-    if (state.scene === "handoff") {
-      stopActivePiHost("operator detach");
-      clearTypeBar(context, "detached from Pi");
-      context.runAppAction("Opening runs", () => context.runtime.runIntent({ scene: "fleet", argv: ["runs"], action: { kind: "refresh", label: "Opening runs" } }));
-    } else {
-      stopActiveCommandHost("operator detach");
-      clearTypeBar(context, "closed command");
-      context.runAppAction("Project menu", () => context.runtime.runIntent({ scene: "main", argv: ["main"], action: { kind: "none", label: "Project menu" } }));
-    }
+    stopActiveCommandHost("operator detach");
+    clearTypeBar(context, "closed command");
+    context.runAppAction("Project menu", () => context.runtime.runIntent({ scene: "main", argv: ["main"], action: { kind: "none", label: "Project menu" } }));
     return true;
   }
   const sequence = key.raw || key.sequence;
@@ -1591,8 +1605,8 @@ import { WsTransport } from "@rig/client";
 import { RIG_WS_CHANNELS } from "@rig/contracts";
 
 // packages/cli/src/commands/_server-client.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { resolve as resolve2 } from "path";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, isAbsolute, resolve as resolve2 } from "path";
 
 // packages/cli/src/runner.ts
 import { EventBus } from "@rig/runtime/control-plane/runtime/events";
@@ -1684,12 +1698,28 @@ function readRepoConnection(projectRoot) {
     selected,
     project: typeof record.project === "string" ? record.project : undefined,
     linkedAt: typeof record.linkedAt === "string" ? record.linkedAt : undefined,
-    serverProjectRoot: typeof record.serverProjectRoot === "string" && record.serverProjectRoot.trim() ? record.serverProjectRoot.trim() : undefined
+    serverProjectRoot: typeof record.serverProjectRoot === "string" && record.serverProjectRoot.trim() ? record.serverProjectRoot.trim() : undefined,
+    serverProjectRootAlias: typeof record.serverProjectRootAlias === "string" && record.serverProjectRootAlias.trim() ? record.serverProjectRootAlias.trim() : undefined,
+    serverProjectRootBaseUrl: typeof record.serverProjectRootBaseUrl === "string" && record.serverProjectRootBaseUrl.trim() ? record.serverProjectRootBaseUrl.trim().replace(/\/+$/, "") : undefined
   };
 }
 function writeRepoConnection(projectRoot, state) {
   writeJsonFile(resolveRepoConnectionPath(projectRoot), state);
 }
+function rootAllowedForSelection(repo, connection) {
+  const root = repo.serverProjectRoot?.trim();
+  if (!root)
+    return;
+  if (connection.kind === "remote") {
+    if (repo.serverProjectRootAlias !== repo.selected)
+      return;
+    if (repo.serverProjectRootBaseUrl !== connection.baseUrl)
+      return;
+  } else if (repo.serverProjectRootAlias && repo.serverProjectRootAlias !== repo.selected) {
+    return;
+  }
+  return root;
+}
 function resolveSelectedConnection(projectRoot, options = {}) {
   const repo = readRepoConnection(projectRoot);
   if (!repo)
@@ -1701,13 +1731,41 @@ function resolveSelectedConnection(projectRoot, options = {}) {
   if (!connection) {
     throw new CliError(`Selected Rig server "${repo.selected}" was not found. Run \`rig server list\` or \`rig server use local\`.`, 1);
   }
-  return { alias: repo.selected, connection, serverProjectRoot: repo.serverProjectRoot };
+  return { alias: repo.selected, connection, serverProjectRoot: rootAllowedForSelection(repo, connection) };
 }
-function writeRepoServerProjectRoot(projectRoot, serverProjectRoot) {
+function writeRepoServerProjectRoot(projectRoot, serverProjectRoot, metadata = {}) {
   const repo = readRepoConnection(projectRoot);
   if (!repo)
     return;
-  writeRepoConnection(projectRoot, { ...repo, serverProjectRoot });
+  let inferred = metadata;
+  if (!inferred.alias || !inferred.baseUrl) {
+    try {
+      const selected = resolveSelectedConnection(projectRoot);
+      if (selected?.connection.kind === "remote") {
+        inferred = {
+          alias: inferred.alias ?? selected.alias,
+          baseUrl: inferred.baseUrl ?? selected.connection.baseUrl
+        };
+      }
+    } catch {}
+  }
+  writeRepoConnection(projectRoot, {
+    ...repo,
+    ...metadata.project ? { project: metadata.project } : {},
+    serverProjectRoot,
+    ...inferred.alias ? { serverProjectRootAlias: inferred.alias } : {},
+    ...inferred.baseUrl ? { serverProjectRootBaseUrl: inferred.baseUrl.replace(/\/+$/, "") } : {}
+  });
+}
+function clearRepoServerProjectRoot(projectRoot) {
+  const repo = readRepoConnection(projectRoot);
+  if (!repo)
+    return;
+  writeRepoConnection(projectRoot, {
+    selected: repo.selected,
+    ...repo.project ? { project: repo.project } : {},
+    ...repo.linkedAt ? { linkedAt: repo.linkedAt } : {}
+  });
 }
 
 // packages/cli/src/commands/_server-client.ts
@@ -1748,11 +1806,10 @@ function readStoredGitHubAuthToken(projectRoot) {
   const parsed = readRemoteAuthState(projectRoot);
   return parsed ? cleanToken(typeof parsed.token === "string" ? parsed.token : undefined) : null;
 }
-function inferRemoteServerProjectRootFromAuthState(projectRoot) {
-  const repo = readRepoConnection(projectRoot);
-  const slug = repo?.project?.trim();
-  if (!slug || !/^[^/]+\/[^/]+$/.test(slug))
+function inferRemoteServerProjectRootCandidateFromAuthState(projectRoot, repoSlug) {
+  if (!/^[^/]+\/[^/]+$/.test(repoSlug))
     return null;
+  const repo = readRepoConnection(projectRoot);
   const auth = readRemoteAuthState(projectRoot);
   const authUpdatedAt = typeof auth?.updatedAt === "string" ? Date.parse(auth.updatedAt) : Number.NaN;
   const repoLinkedAt = typeof repo?.linkedAt === "string" ? Date.parse(repo.linkedAt) : Number.NaN;
@@ -1761,25 +1818,413 @@ function inferRemoteServerProjectRootFromAuthState(projectRoot) {
   const checkoutBaseDir = typeof auth?.checkoutBaseDir === "string" && auth.checkoutBaseDir.trim() ? auth.checkoutBaseDir.trim() : null;
   if (!checkoutBaseDir)
     return null;
-  const inferred = `${checkoutBaseDir.replace(/\/+$/, "")}/${slug}`;
-  writeRepoServerProjectRoot(projectRoot, inferred);
-  return inferred;
+  return `${checkoutBaseDir.replace(/\/+$/, "")}/${repoSlug}`;
 }
 function readLocalConnectionFallbackToken(projectRoot) {
   return readGitHubBearerTokenForRemote(projectRoot) ?? cleanToken(process.env.RIG_GITHUB_TOKEN) ?? readStoredGitHubAuthToken(projectRoot);
 }
+function normalizeRepoSlug(value) {
+  const slug = value?.trim();
+  return slug && /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
+}
+function readProjectLinkSlug(projectRoot) {
+  const path = resolve2(projectRoot, ".rig", "state", "project-link.json");
+  if (!existsSync2(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      return null;
+    return normalizeRepoSlug(typeof parsed.repoSlug === "string" ? String(parsed.repoSlug) : null);
+  } catch {
+    return null;
+  }
+}
+function writeProjectLinkConnection(projectRoot, repoSlug, alias) {
+  const path = resolve2(projectRoot, ".rig", "state", "project-link.json");
+  mkdirSync2(dirname2(path), { recursive: true });
+  writeFileSync2(path, `${JSON.stringify({ repoSlug, connection: alias, linkedAt: new Date().toISOString() }, null, 2)}
+`, "utf8");
+}
+function remoteLinkRepairCommand(repoSlug) {
+  return repoSlug ? `rig server repair-link --repo ${repoSlug}` : "rig server repair-link --repo owner/repo";
+}
+function formatRemoteProjectLinkHint(resolution) {
+  const repair = remoteLinkRepairCommand(resolution.repoSlug);
+  if (resolution.status === "auth_required") {
+    return `Authenticate the selected remote${resolution.alias ? ` (${resolution.alias})` : ""}, then run \`${repair}\`. Use \`rig github auth import-gh\` or \`rig init --repair --server remote --github-auth device${resolution.repoSlug ? ` --repo ${resolution.repoSlug}` : ""}\`.`;
+  }
+  if (resolution.status === "missing_project") {
+    return `Record the repo slug, then run \`${repair}\` (or \`rig init --repo owner/repo --server remote --github-auth device\`).`;
+  }
+  if (resolution.status === "not_remote")
+    return "Select a remote server with `rig server use <alias>` before repairing a remote project link.";
+  return `Run \`${repair}\` to backfill or prepare a server-host checkout for the selected remote${resolution.alias ? ` (${resolution.alias})` : ""}.`;
+}
+function remoteProjectLinkFailure(input) {
+  const partial = {
+    status: input.status,
+    alias: input.alias,
+    baseUrl: input.baseUrl,
+    repoSlug: input.repoSlug
+  };
+  return {
+    ok: false,
+    ...input,
+    hint: formatRemoteProjectLinkHint(partial),
+    next: remoteLinkRepairCommand(input.repoSlug)
+  };
+}
+function remoteProjectLinkSuccess(input) {
+  return {
+    ok: true,
+    status: input.status,
+    alias: input.alias,
+    baseUrl: input.baseUrl,
+    repoSlug: input.repoSlug,
+    serverProjectRoot: input.serverProjectRoot,
+    source: input.source,
+    prepared: input.prepared ?? input.status === "prepared",
+    validated: input.validated ?? false,
+    message: input.message ?? `Remote project link ready for ${input.repoSlug}.`,
+    hint: "Remote-scoped task/run/status requests will send x-rig-project-root for this server-host checkout.",
+    next: "rig task list"
+  };
+}
+function localCheckoutPathCandidate(projectRoot, candidate) {
+  try {
+    const local = resolve2(projectRoot);
+    const resolved = resolve2(candidate);
+    return resolved === local || resolved.startsWith(`${local}/`);
+  } catch {
+    return false;
+  }
+}
+async function requestRemoteProjectLinkJson(baseUrl, pathname, authToken, init = {}) {
+  const requestUrl = new URL(`${baseUrl}${pathname}`);
+  if (authToken && queryAuthFallbackEnabled())
+    requestUrl.searchParams.set("rt", authToken);
+  const response = await fetch(requestUrl, {
+    ...init,
+    headers: mergeHeaders(init.headers, authToken)
+  });
+  const text = await response.text();
+  const payload = text.trim().length > 0 ? (() => {
+    try {
+      return JSON.parse(text);
+    } catch {
+      return null;
+    }
+  })() : null;
+  return { ok: response.ok, status: response.status, payload, text };
+}
+function payloadError(payload, fallback) {
+  if (payload && typeof payload === "object" && !Array.isArray(payload)) {
+    const record = payload;
+    const value = record.error ?? record.message ?? record.reason;
+    if (typeof value === "string" && value.trim())
+      return value.trim();
+  }
+  return fallback;
+}
+function checkoutPathsFromProjectPayload(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return [];
+  const project = payload.project;
+  if (!project || typeof project !== "object" || Array.isArray(project))
+    return [];
+  const checkouts = project.checkouts;
+  if (!Array.isArray(checkouts))
+    return [];
+  return [...checkouts].reverse().flatMap((entry) => {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry))
+      return [];
+    const path = entry.path;
+    return typeof path === "string" && path.trim() ? [path.trim()] : [];
+  });
+}
+function checkoutPathFromPreparePayload(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return null;
+  const checkout = payload.checkout;
+  if (!checkout || typeof checkout !== "object" || Array.isArray(checkout))
+    return null;
+  const path = checkout.path;
+  return typeof path === "string" && path.trim() ? path.trim() : null;
+}
+async function validateAndPersistRemoteRoot(input) {
+  const candidate = input.candidate.trim();
+  if (!candidate || !isAbsolute(candidate)) {
+    return remoteProjectLinkFailure({
+      status: "invalid_root",
+      alias: input.alias,
+      baseUrl: input.baseUrl,
+      repoSlug: input.repoSlug,
+      message: `Remote project root candidate is not an absolute server-host path: ${candidate || "(empty)"}.`
+    });
+  }
+  if (localCheckoutPathCandidate(input.projectRoot, candidate)) {
+    return remoteProjectLinkFailure({
+      status: "invalid_root",
+      alias: input.alias,
+      baseUrl: input.baseUrl,
+      repoSlug: input.repoSlug,
+      message: `Refusing to use local checkout path ${candidate} as a remote server project root.`
+    });
+  }
+  let response;
+  try {
+    response = await requestRemoteProjectLinkJson(input.baseUrl, "/api/server/project-root", input.authToken, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ projectRoot: candidate })
+    });
+  } catch (error) {
+    return remoteProjectLinkFailure({
+      status: "error",
+      alias: input.alias,
+      baseUrl: input.baseUrl,
+      repoSlug: input.repoSlug,
+      message: `Could not validate remote project root ${candidate}: ${error instanceof Error ? error.message : String(error)}`
+    });
+  }
+  if (response.status === 401 || response.status === 403) {
+    return remoteProjectLinkFailure({
+      status: "auth_required",
+      alias: input.alias,
+      baseUrl: input.baseUrl,
+      repoSlug: input.repoSlug,
+      statusCode: response.status,
+      message: `Remote server ${input.alias} requires authentication before validating project root ${candidate}.`
+    });
+  }
+  if (!response.ok) {
+    return remoteProjectLinkFailure({
+      status: "invalid_root",
+      alias: input.alias,
+      baseUrl: input.baseUrl,
+      repoSlug: input.repoSlug,
+      statusCode: response.status,
+      message: `Remote server rejected project root ${candidate} (${response.status}): ${payloadError(response.payload, response.text || "project-root validation failed")}`
+    });
+  }
+  const record = response.payload && typeof response.payload === "object" && !Array.isArray(response.payload) ? response.payload : {};
+  if (record.ok !== true) {
+    return remoteProjectLinkFailure({
+      status: "invalid_root",
+      alias: input.alias,
+      baseUrl: input.baseUrl,
+      repoSlug: input.repoSlug,
+      message: `Remote server did not accept project root ${candidate}: ${payloadError(response.payload, "project-root validation failed")}`
+    });
+  }
+  const accepted = typeof record.projectRoot === "string" && record.projectRoot.trim() ? record.projectRoot.trim() : typeof record.requestedProjectRoot === "string" && record.requestedProjectRoot.trim() ? record.requestedProjectRoot.trim() : candidate;
+  writeRepoServerProjectRoot(input.projectRoot, accepted, { alias: input.alias, baseUrl: input.baseUrl, project: input.repoSlug });
+  writeProjectLinkConnection(input.projectRoot, input.repoSlug, input.alias);
+  const status = input.status ?? (input.prepared ? "prepared" : "backfilled");
+  return remoteProjectLinkSuccess({
+    status,
+    alias: input.alias,
+    baseUrl: input.baseUrl,
+    repoSlug: input.repoSlug,
+    serverProjectRoot: accepted,
+    source: input.source,
+    prepared: input.prepared,
+    validated: true,
+    message: status === "ready" ? `Remote project link already points to ${accepted} and was validated on ${input.alias}.` : input.prepared ? `Prepared and linked remote checkout ${accepted} for ${input.repoSlug}.` : `Backfilled remote checkout ${accepted} for ${input.repoSlug}.`
+  });
+}
+async function ensureRemoteProjectRootLink(projectRoot, options = {}) {
+  let selected;
+  try {
+    selected = resolveSelectedConnection(projectRoot);
+  } catch (error) {
+    return remoteProjectLinkFailure({ status: "error", message: error instanceof Error ? error.message : String(error) });
+  }
+  if (!selected || selected.connection.kind !== "remote") {
+    return remoteProjectLinkFailure({ status: "not_remote", message: "No remote Rig server is selected for this repo." });
+  }
+  const repo = readRepoConnection(projectRoot);
+  const explicitRepoRequested = options.repoSlug !== undefined;
+  const explicitRepoSlug = explicitRepoRequested ? normalizeRepoSlug(options.repoSlug) : null;
+  const repoProjectSlug = normalizeRepoSlug(repo?.project);
+  const repoSlug = explicitRepoSlug ?? repoProjectSlug ?? readProjectLinkSlug(projectRoot);
+  const alias = selected.alias;
+  const baseUrl = selected.connection.baseUrl;
+  const authToken = options.authToken === undefined ? readGitHubBearerTokenForRemote(projectRoot) : options.authToken;
+  const mode = options.mode ?? "backfill-only";
+  if (explicitRepoRequested && !explicitRepoSlug) {
+    return remoteProjectLinkFailure({
+      status: "missing_project",
+      alias,
+      baseUrl,
+      message: `Invalid --repo value ${JSON.stringify(options.repoSlug)}. Expected owner/repo.`
+    });
+  }
+  if (!repoSlug) {
+    return remoteProjectLinkFailure({
+      status: "missing_project",
+      alias,
+      baseUrl,
+      message: `Remote server ${alias} is selected, but this checkout has no GitHub repo slug recorded.`
+    });
+  }
+  const skippedCandidates = [];
+  const storedRoot = selected.serverProjectRoot?.trim() || null;
+  const storedRootMatchesResolvedRepo = repoProjectSlug === repoSlug;
+  if (storedRoot && storedRootMatchesResolvedRepo) {
+    if (localCheckoutPathCandidate(projectRoot, storedRoot)) {
+      clearRepoServerProjectRoot(projectRoot);
+      skippedCandidates.push(storedRoot);
+    } else {
+      const storedResult = await validateAndPersistRemoteRoot({
+        projectRoot,
+        alias,
+        baseUrl,
+        authToken,
+        repoSlug,
+        candidate: storedRoot,
+        source: "stored",
+        status: "ready"
+      });
+      if (storedResult.ok || storedResult.status === "auth_required" || storedResult.status === "error")
+        return storedResult;
+      clearRepoServerProjectRoot(projectRoot);
+      skippedCandidates.push(storedRoot);
+    }
+  } else if (storedRoot) {
+    skippedCandidates.push(storedRoot);
+  }
+  const authCandidate = inferRemoteServerProjectRootCandidateFromAuthState(projectRoot, repoSlug);
+  if (authCandidate) {
+    const authResult = await validateAndPersistRemoteRoot({ projectRoot, alias, baseUrl, authToken, repoSlug, candidate: authCandidate, source: "auth-state" });
+    if (authResult.ok || authResult.status === "auth_required")
+      return authResult;
+  }
+  let registryResponse;
+  try {
+    registryResponse = await requestRemoteProjectLinkJson(baseUrl, `/api/projects/${encodeURIComponent(repoSlug)}`, authToken);
+  } catch (error) {
+    return remoteProjectLinkFailure({
+      status: "error",
+      alias,
+      baseUrl,
+      repoSlug,
+      message: `Could not read remote project registry for ${repoSlug} on ${alias}: ${error instanceof Error ? error.message : String(error)}`
+    });
+  }
+  if (registryResponse.status === 401 || registryResponse.status === 403) {
+    return remoteProjectLinkFailure({
+      status: "auth_required",
+      alias,
+      baseUrl,
+      repoSlug,
+      statusCode: registryResponse.status,
+      message: `Remote server ${alias} requires authentication before reading the ${repoSlug} project registry.`
+    });
+  }
+  if (registryResponse.ok) {
+    const candidates = checkoutPathsFromProjectPayload(registryResponse.payload);
+    for (const candidate of candidates) {
+      const result = await validateAndPersistRemoteRoot({ projectRoot, alias, baseUrl, authToken, repoSlug, candidate, source: "registry" });
+      if (result.ok || result.status === "auth_required")
+        return result;
+      skippedCandidates.push(candidate);
+    }
+    if (mode === "backfill-only") {
+      return remoteProjectLinkFailure({
+        status: candidates.length > 0 ? "invalid_root" : "no_server_checkout",
+        alias,
+        baseUrl,
+        repoSlug,
+        message: candidates.length > 0 ? `Remote registry has checkout candidates for ${repoSlug}, but none validated for ${alias}.` : `Remote registry has ${repoSlug}, but no server checkout path is linked yet.`,
+        skippedCandidates
+      });
+    }
+  } else if (registryResponse.status === 404) {
+    if (mode === "backfill-only") {
+      return remoteProjectLinkFailure({
+        status: "project_not_registered",
+        alias,
+        baseUrl,
+        repoSlug,
+        statusCode: registryResponse.status,
+        message: `Remote server ${alias} has no registered project record for ${repoSlug}.`
+      });
+    }
+  } else {
+    return remoteProjectLinkFailure({
+      status: "error",
+      alias,
+      baseUrl,
+      repoSlug,
+      statusCode: registryResponse.status,
+      message: `Could not backfill ${repoSlug} from remote registry (${registryResponse.status}): ${payloadError(registryResponse.payload, registryResponse.text || "registry lookup failed")}`,
+      skippedCandidates
+    });
+  }
+  let prepareResponse;
+  try {
+    prepareResponse = await requestRemoteProjectLinkJson(baseUrl, `/api/projects/${encodeURIComponent(repoSlug)}/prepare-checkout`, authToken, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ checkout: { kind: "managed-clone" }, repoUrl: `https://github.com/${repoSlug}.git` })
+    });
+  } catch (error) {
+    return remoteProjectLinkFailure({
+      status: "error",
+      alias,
+      baseUrl,
+      repoSlug,
+      message: `Could not prepare remote checkout for ${repoSlug} on ${alias}: ${error instanceof Error ? error.message : String(error)}`
+    });
+  }
+  if (prepareResponse.status === 401 || prepareResponse.status === 403) {
+    return remoteProjectLinkFailure({
+      status: "auth_required",
+      alias,
+      baseUrl,
+      repoSlug,
+      statusCode: prepareResponse.status,
+      message: `Remote server ${alias} requires authentication before preparing ${repoSlug}.`
+    });
+  }
+  if (!prepareResponse.ok) {
+    return remoteProjectLinkFailure({
+      status: "error",
+      alias,
+      baseUrl,
+      repoSlug,
+      statusCode: prepareResponse.status,
+      message: `Remote checkout prepare failed for ${repoSlug} (${prepareResponse.status}): ${payloadError(prepareResponse.payload, prepareResponse.text || "prepare-checkout failed")}`,
+      skippedCandidates
+    });
+  }
+  const preparedPath = checkoutPathFromPreparePayload(prepareResponse.payload);
+  if (!preparedPath) {
+    return remoteProjectLinkFailure({
+      status: "invalid_root",
+      alias,
+      baseUrl,
+      repoSlug,
+      message: `Remote checkout prepare for ${repoSlug} did not return a checkout.path.`,
+      skippedCandidates
+    });
+  }
+  return validateAndPersistRemoteRoot({ projectRoot, alias, baseUrl, authToken, repoSlug, candidate: preparedPath, source: "prepare", prepared: true });
+}
 async function ensureServerForCli(projectRoot) {
   try {
     const selected = resolveSelectedConnection(projectRoot);
     if (selected?.connection.kind === "remote") {
       reportServerPhase(`Connecting to ${selected.alias}\u2026`);
       const authToken = readGitHubBearerTokenForRemote(projectRoot);
-      const serverProjectRoot = selected.serverProjectRoot ?? inferRemoteServerProjectRootFromAuthState(projectRoot) ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
+      const link = await ensureRemoteProjectRootLink(projectRoot, { mode: "backfill-only", authToken });
       return {
         baseUrl: selected.connection.baseUrl,
         authToken,
         connectionKind: "remote",
-        serverProjectRoot
+        serverProjectRoot: link.ok ? link.serverProjectRoot ?? null : null
       };
     }
     reportServerPhase("Starting local Rig server\u2026");
@@ -1797,32 +2242,6 @@ async function ensureServerForCli(projectRoot) {
     throw error;
   }
 }
-async function backfillRemoteServerProjectRoot(projectRoot, baseUrl, authToken) {
-  const repo = readRepoConnection(projectRoot);
-  const slug = repo?.project?.trim();
-  if (!slug)
-    return null;
-  try {
-    const url = new URL(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`);
-    if (authToken && queryAuthFallbackEnabled())
-      url.searchParams.set("rt", authToken);
-    const response = await fetch(url, {
-      headers: mergeHeaders(undefined, authToken)
-    });
-    if (!response.ok)
-      return null;
-    const payload = await response.json();
-    const project = payload.project && typeof payload.project === "object" && !Array.isArray(payload.project) ? payload.project : null;
-    const checkouts = Array.isArray(project?.checkouts) ? project.checkouts : [];
-    const latestCheckout = [...checkouts].reverse().find((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry) && typeof entry.path === "string"));
-    const path = typeof latestCheckout?.path === "string" && latestCheckout.path.trim() ? latestCheckout.path.trim() : null;
-    if (path)
-      writeRepoServerProjectRoot(projectRoot, path);
-    return path;
-  } catch {
-    return null;
-  }
-}
 function mergeCookie(existing, name, value) {
   const encoded = `${name}=${encodeURIComponent(value)}`;
   if (!existing?.trim())
@@ -3315,6 +3734,48 @@ function destroyNativeHost(host) {
   } catch {}
 }
 
+// packages/cli/src/app-opentui/remote-link.ts
+var REPAIRABLE_REMOTE_LINK_STATUSES = new Set([
+  "auth_required",
+  "project_not_registered",
+  "no_server_checkout",
+  "invalid_root",
+  "needs_prepare",
+  "error"
+]);
+function remoteProjectLinkError(message) {
+  return /no server-host project root link|remote project(?:-root)? link|x-rig-project-root|serverProjectRoot/i.test(message ?? "");
+}
+function serverRecordForRemoteLink(state) {
+  const server = state.data.server;
+  return server && typeof server === "object" && !Array.isArray(server) ? server : null;
+}
+function remoteProjectLinkState(state) {
+  const serverRecord = serverRecordForRemoteLink(state);
+  if (!serverRecord || serverRecord.kind !== "remote")
+    return null;
+  const link = serverRecord.remoteProjectLink;
+  if (link && typeof link === "object" && !Array.isArray(link))
+    return link;
+  const direct = state.data.remoteProjectLink;
+  if (direct && typeof direct === "object" && !Array.isArray(direct))
+    return direct;
+  return null;
+}
+function shouldOfferRemoteLinkRepair(state, message) {
+  const link = remoteProjectLinkState(state);
+  if (link) {
+    if (link.ok === true)
+      return false;
+    const status = link.status ?? "";
+    return REPAIRABLE_REMOTE_LINK_STATUSES.has(status);
+  }
+  const serverRecord = serverRecordForRemoteLink(state);
+  if (serverRecord && serverRecord.kind !== "remote")
+    return false;
+  return remoteProjectLinkError(message ?? state.error?.message);
+}
+
 // packages/cli/src/app-opentui/selectable.ts
 function selectableDeckRow(deck, item) {
   return { ...deckRow({ ...deck, activateOnClick: true }), selectable: item };
@@ -3324,13 +3785,17 @@ function selectableDeckRow(deck, item) {
 var ERROR_ACTIONS = [
   { detail: "return to dashboard", item: { id: "main", label: "main", intent: { scene: "main", argv: [], action: { kind: "refresh", label: "Back to dashboard" } }, message: "back to dashboard" } },
   { detail: "run diagnostics", item: { id: "doctor", label: "doctor", intent: { scene: "doctor", argv: ["doctor"], action: { kind: "doctor-run", label: "Run doctor" } }, message: "run diagnostics" } },
-  { detail: "open server controls", item: { id: "server", label: "server", intent: { scene: "server", argv: ["server", "status"], action: { kind: "refresh", label: "Open server controls" } }, message: "open server controls" } },
-  { detail: "repair project/server/auth link", item: { id: "repair", label: "repair", intent: { scene: "command", argv: ["init", "--repair"], action: { kind: "command-run", label: "Repair project link" } }, message: "repair project link" } }
+  { detail: "open server controls", item: { id: "server", label: "server", intent: { scene: "server", argv: ["server", "status"], action: { kind: "refresh", label: "Open server controls" } }, message: "open server controls" } }
 ];
+var ERROR_REPAIR_LINK_ACTION = { detail: "backfill or prepare selected remote project-root link", item: { id: "repair-link", label: "repair link", intent: { scene: "server", argv: ["server", "repair-link"], action: { kind: "remote-link-repair", label: "Repair remote link", payload: { returnScene: "server" } } }, message: "repair remote project link" } };
+function errorActions(state) {
+  return shouldOfferRemoteLinkRepair(state, state.error?.message) ? [...ERROR_ACTIONS, ERROR_REPAIR_LINK_ACTION] : ERROR_ACTIONS;
+}
 function renderErrorScene(state) {
   const message = state.error?.message ?? "Unknown app error";
   const hint = state.error?.hint ?? "Use the actions below to recover.";
-  const selected = Math.max(0, Math.min(3, state.selection.index));
+  const actions = errorActions(state);
+  const selected = Math.max(0, Math.min(actions.length - 1, state.selection.index));
   return makeSceneFrame({
     scene: "error",
     title: "Error",
@@ -3348,7 +3813,7 @@ function renderErrorScene(state) {
         ...hint ? [line(hint, { fg: RIG_UI.yellow })] : [],
         line("", { fg: RIG_UI.ink3 }),
         line("ACTIONS", { fg: RIG_UI.ink3, bold: true }),
-        ...ERROR_ACTIONS.map(({ detail, item }, index) => selectableDeckRow({ label: item.label, detail, index, active: selected === index }, item))
+        ...actions.map(({ detail, item }, index) => selectableDeckRow({ label: item.label, detail, index, active: selected === index }, item))
       ],
       backgroundColor: RIG_UI.panel,
       backgroundAlpha: 184,
@@ -3476,7 +3941,7 @@ function renderHelpScene(state, layout) {
 
 // packages/cli/src/app-opentui/scenes/main.ts
 var CONFIGURED_MENU = [
-  ["init", "setup, reconfigure, repair project state", { id: "init", label: "init", intent: { scene: "command", argv: ["init"], action: { kind: "command-run", label: "Run init" } }, message: "run setup/reconfigure flow" }],
+  ["init", "guided setup, reconfigure, repair project state", { id: "init", label: "init", intent: { scene: "init", argv: ["init"], action: { kind: "refresh", label: "Open init" } }, message: "open native init flow" }],
   ["server", "local/remote target, auth, linkage", { id: "server", label: "server", intent: { scene: "server", argv: ["server", "status"], action: { kind: "refresh", label: "Checking server" } }, message: "check selected server" }],
   ["github", "auth, selected repo, stored token", { id: "github", label: "github", intent: { scene: "server", argv: ["github", "auth", "status"], action: { kind: "refresh", label: "Checking GitHub auth" } }, message: "check GitHub auth" }],
   ["tasks", "browse, filter, dispatch, attach active work", { id: "tasks", label: "tasks", intent: { scene: "tasks", argv: ["tasks"], action: { kind: "refresh", label: "Opening tasks" } }, message: "selected tasks" }],
@@ -3495,10 +3960,10 @@ var CONFIGURED_MENU = [
   ["help", "all actions, shortcuts, mouse controls", { id: "help", label: "help", intent: { scene: "help", argv: ["help"], action: { kind: "none", label: "Opening help" } }, message: "selected help" }]
 ];
 var ONBOARD_PRIMARY = {
-  id: "onboard-setup",
-  label: "Start guided setup",
-  intent: { scene: "init", argv: ["init"], action: { kind: "refresh", label: "Setup" } },
-  message: "open the guided setup checklist"
+  id: "onboard-init",
+  label: "Start guided init",
+  intent: { scene: "init", argv: ["init"], action: { kind: "refresh", label: "Init" } },
+  message: "open the native init checklist"
 };
 var ONBOARD_SECONDARY = [
   ["server", "select a local or remote target", { id: "server", label: "server", intent: { scene: "server", argv: ["server", "status"], action: { kind: "refresh", label: "Checking server" } }, message: "check selected server" }],
@@ -3561,7 +4026,7 @@ function configuredMenuRows(selectedIndex) {
   }));
 }
 function onboardingRows(selectedIndex) {
-  const primary = selectableDeckRow({ label: "setup", detail: "Start guided setup \u2014 recommended", active: selectedIndex === 0 }, ONBOARD_PRIMARY);
+  const primary = selectableDeckRow({ label: "init", detail: "Start guided init \u2014 recommended", active: selectedIndex === 0 }, ONBOARD_PRIMARY);
   const secondary = ONBOARD_SECONDARY.map(([label, detail, item], index) => ({
     ...deckRow({ label, detail, index: index + 1, active: selectedIndex === index + 1, activateOnClick: true }),
     selectable: item
@@ -3625,7 +4090,7 @@ function renderMainScene(state, layout) {
     statusLine(state)
   ] : [
     line("WELCOME", { fg: RIG_UI.ink, bold: true }),
-    line("This project isn't set up yet. One guided flow gets you running.", { fg: RIG_UI.ink2 }),
+    line("This project isn't initialized yet. One native init flow gets you running.", { fg: RIG_UI.ink2 }),
     blank(),
     line("GET STARTED", { fg: RIG_UI.ink, bold: true }),
     ...onboardingRows(actionSelected),
@@ -3677,7 +4142,7 @@ var PRIMARY_NAV = [
   { id: "tasks", label: "Tasks", scene: "tasks", argv: ["tasks"], enterLabel: "Tasks", member: ["tasks"] },
   { id: "inbox", label: "Inbox", scene: "inbox", argv: ["inbox"], enterLabel: "Inbox", member: ["inbox"], badge: inboxPendingCount },
   { id: "stats", label: "Stats", scene: "family", argv: ["stats"], enterLabel: "Stats", member: ["family"] },
-  { id: "setup", label: "Setup", scene: "init", argv: ["init"], enterLabel: "Setup", member: ["init", "doctor", "server", "pi", "plugin", "repo", "workspace"] },
+  { id: "init", label: "Init", scene: "init", argv: ["init"], enterLabel: "Init", member: ["init", "doctor", "server", "pi", "plugin", "repo", "workspace"] },
   { id: "help", label: "Help", scene: "help", argv: ["help"], enterLabel: "Help", member: ["help"] }
 ];
 function activeNavSection(scene) {
@@ -3698,7 +4163,7 @@ function entryIntentForScene(scene) {
     case "doctor":
       return { scene, argv: ["doctor"], action: { kind: "doctor-run", label: "Doctor" } };
     case "init":
-      return { scene, argv: ["init"], action: { kind: "refresh", label: "Setup" } };
+      return { scene, argv: ["init"], action: { kind: "refresh", label: "Init" } };
     case "run-detail":
       return { scene, argv: ["run", "status"], action: { kind: "refresh", label: "Run" } };
     case "pi":
@@ -3732,7 +4197,7 @@ function sceneSectionLabel(scene) {
     handoff: "pi console",
     server: "server",
     doctor: "doctor",
-    init: "setup",
+    init: "init",
     pi: "pi",
     plugin: "plugins",
     repo: "repo",
@@ -4137,7 +4602,7 @@ var PRIMARY_NAV2 = [
   { id: "tasks", label: "Tasks", scene: "tasks", argv: ["tasks"], enterLabel: "Tasks", member: ["tasks"] },
   { id: "inbox", label: "Inbox", scene: "inbox", argv: ["inbox"], enterLabel: "Inbox", member: ["inbox"], badge: inboxPendingCount2 },
   { id: "stats", label: "Stats", scene: "family", argv: ["stats"], enterLabel: "Stats", member: ["family"] },
-  { id: "setup", label: "Setup", scene: "init", argv: ["init"], enterLabel: "Setup", member: ["init", "doctor", "server", "pi", "plugin", "repo", "workspace"] },
+  { id: "init", label: "Init", scene: "init", argv: ["init"], enterLabel: "Init", member: ["init", "doctor", "server", "pi", "plugin", "repo", "workspace"] },
   { id: "help", label: "Help", scene: "help", argv: ["help"], enterLabel: "Help", member: ["help"] }
 ];
 function navSectionIntent(section) {
@@ -4401,7 +4866,7 @@ async function launchRigReactApp(options) {
         }
         for (const adapter of options.adapters ?? [])
           await adapter.start?.(runtime);
-        liveEvents = await connectRigServerEvents(options.projectRoot, {
+        connectRigServerEvents(options.projectRoot, {
           onSnapshotInvalidated: () => refreshCurrentDataScene(),
           onRunLogAppended: () => {
             const scene = store.getState().scene;
@@ -4409,9 +4874,11 @@ async function launchRigReactApp(options) {
               refreshCurrentDataScene();
           },
           onStatus: (status) => store.patch({ footer: { live: liveLinkLabel(status) } })
-        }).catch(() => null);
-        if (!liveEvents)
+        }).then((subscription) => {
+          liveEvents = subscription;
+        }).catch(() => {
           store.patch({ footer: { live: liveLinkLabel("disconnected") } });
+        });
         await runtime.runIntent(store.getState().intent);
       } catch (error) {
         const n = normalizeError(error);