@h-rig/cli 0.0.6-alpha.88 → 0.0.6-alpha.89

package/dist/src/app-opentui/registry.js

@@ -215,7 +215,8 @@ __export(exports__connection_state, {
   resolveGlobalConnectionsPath: () => resolveGlobalConnectionsPath,
   readRepoConnection: () => readRepoConnection,
   readGlobalConnections: () => readGlobalConnections,
-  isRemoteConnectionSelected: () => isRemoteConnectionSelected
+  isRemoteConnectionSelected: () => isRemoteConnectionSelected,
+  clearRepoServerProjectRoot: () => clearRepoServerProjectRoot
 });
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { homedir } from "os";
@@ -299,12 +300,28 @@ function readRepoConnection(projectRoot) {
     selected,
     project: typeof record.project === "string" ? record.project : undefined,
     linkedAt: typeof record.linkedAt === "string" ? record.linkedAt : undefined,
-    serverProjectRoot: typeof record.serverProjectRoot === "string" && record.serverProjectRoot.trim() ? record.serverProjectRoot.trim() : undefined
+    serverProjectRoot: typeof record.serverProjectRoot === "string" && record.serverProjectRoot.trim() ? record.serverProjectRoot.trim() : undefined,
+    serverProjectRootAlias: typeof record.serverProjectRootAlias === "string" && record.serverProjectRootAlias.trim() ? record.serverProjectRootAlias.trim() : undefined,
+    serverProjectRootBaseUrl: typeof record.serverProjectRootBaseUrl === "string" && record.serverProjectRootBaseUrl.trim() ? record.serverProjectRootBaseUrl.trim().replace(/\/+$/, "") : undefined
   };
 }
 function writeRepoConnection(projectRoot, state) {
   writeJsonFile(resolveRepoConnectionPath(projectRoot), state);
 }
+function rootAllowedForSelection(repo, connection) {
+  const root = repo.serverProjectRoot?.trim();
+  if (!root)
+    return;
+  if (connection.kind === "remote") {
+    if (repo.serverProjectRootAlias !== repo.selected)
+      return;
+    if (repo.serverProjectRootBaseUrl !== connection.baseUrl)
+      return;
+  } else if (repo.serverProjectRootAlias && repo.serverProjectRootAlias !== repo.selected) {
+    return;
+  }
+  return root;
+}
 function resolveSelectedConnection(projectRoot, options = {}) {
   const repo = readRepoConnection(projectRoot);
   if (!repo)
@@ -316,13 +333,41 @@ function resolveSelectedConnection(projectRoot, options = {}) {
   if (!connection) {
     throw new CliError(`Selected Rig server "${repo.selected}" was not found. Run \`rig server list\` or \`rig server use local\`.`, 1);
   }
-  return { alias: repo.selected, connection, serverProjectRoot: repo.serverProjectRoot };
+  return { alias: repo.selected, connection, serverProjectRoot: rootAllowedForSelection(repo, connection) };
 }
-function writeRepoServerProjectRoot(projectRoot, serverProjectRoot) {
+function writeRepoServerProjectRoot(projectRoot, serverProjectRoot, metadata = {}) {
   const repo = readRepoConnection(projectRoot);
   if (!repo)
     return;
-  writeRepoConnection(projectRoot, { ...repo, serverProjectRoot });
+  let inferred = metadata;
+  if (!inferred.alias || !inferred.baseUrl) {
+    try {
+      const selected = resolveSelectedConnection(projectRoot);
+      if (selected?.connection.kind === "remote") {
+        inferred = {
+          alias: inferred.alias ?? selected.alias,
+          baseUrl: inferred.baseUrl ?? selected.connection.baseUrl
+        };
+      }
+    } catch {}
+  }
+  writeRepoConnection(projectRoot, {
+    ...repo,
+    ...metadata.project ? { project: metadata.project } : {},
+    serverProjectRoot,
+    ...inferred.alias ? { serverProjectRootAlias: inferred.alias } : {},
+    ...inferred.baseUrl ? { serverProjectRootBaseUrl: inferred.baseUrl.replace(/\/+$/, "") } : {}
+  });
+}
+function clearRepoServerProjectRoot(projectRoot) {
+  const repo = readRepoConnection(projectRoot);
+  if (!repo)
+    return;
+  writeRepoConnection(projectRoot, {
+    selected: repo.selected,
+    ...repo.project ? { project: repo.project } : {},
+    ...repo.linkedAt ? { linkedAt: repo.linkedAt } : {}
+  });
 }
 function isRemoteConnectionSelected(projectRoot) {
   return resolveSelectedConnection(projectRoot)?.connection.kind === "remote";
@@ -349,12 +394,16 @@ __export(exports__server_client, {
   respondRunPiExtensionUiViaServer: () => respondRunPiExtensionUiViaServer,
   resolveServerConnectionLabel: () => resolveServerConnectionLabel,
   requestServerJson: () => requestServerJson,
+  repairRemoteProjectRootLink: () => repairRemoteProjectRootLink,
   registerProjectViaServer: () => registerProjectViaServer,
   prepareRemoteCheckoutViaServer: () => prepareRemoteCheckoutViaServer,
   postGitHubTokenViaServer: () => postGitHubTokenViaServer,
+  normalizeRepoSlug: () => normalizeRepoSlug,
   listWorkspaceTasksViaServer: () => listWorkspaceTasksViaServer,
   listRunsViaServer: () => listRunsViaServer,
   listGitHubProjectsViaServer: () => listGitHubProjectsViaServer,
+  isRemoteProjectRootLinkError: () => isRemoteProjectRootLinkError,
+  inspectRemoteProjectLink: () => inspectRemoteProjectLink,
   getWorkspaceTaskViaServer: () => getWorkspaceTaskViaServer,
   getRunTimelineViaServer: () => getRunTimelineViaServer,
   getRunPiStatusViaServer: () => getRunPiStatusViaServer,
@@ -366,13 +415,15 @@ __export(exports__server_client, {
   getRunDetailsViaServer: () => getRunDetailsViaServer,
   getGitHubProjectStatusFieldViaServer: () => getGitHubProjectStatusFieldViaServer,
   getGitHubAuthStatusViaServer: () => getGitHubAuthStatusViaServer,
+  formatRemoteProjectLinkHint: () => formatRemoteProjectLinkHint,
   ensureTaskLabelsViaServer: () => ensureTaskLabelsViaServer,
   ensureServerForCli: () => ensureServerForCli,
+  ensureRemoteProjectRootLink: () => ensureRemoteProjectRootLink,
   buildRunPiEventsWebSocketUrl: () => buildRunPiEventsWebSocketUrl,
   abortRunPiViaServer: () => abortRunPiViaServer
 });
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { resolve as resolve2 } from "path";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, isAbsolute, resolve as resolve2 } from "path";
 import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
 function setServerPhaseListener(listener) {
   const previous = serverPhaseListener;
@@ -418,11 +469,10 @@ function readStoredGitHubAuthToken(projectRoot) {
   const parsed = readRemoteAuthState(projectRoot);
   return parsed ? cleanToken(typeof parsed.token === "string" ? parsed.token : undefined) : null;
 }
-function inferRemoteServerProjectRootFromAuthState(projectRoot) {
-  const repo = readRepoConnection(projectRoot);
-  const slug = repo?.project?.trim();
-  if (!slug || !/^[^/]+\/[^/]+$/.test(slug))
+function inferRemoteServerProjectRootCandidateFromAuthState(projectRoot, repoSlug) {
+  if (!/^[^/]+\/[^/]+$/.test(repoSlug))
     return null;
+  const repo = readRepoConnection(projectRoot);
   const auth = readRemoteAuthState(projectRoot);
   const authUpdatedAt = typeof auth?.updatedAt === "string" ? Date.parse(auth.updatedAt) : Number.NaN;
   const repoLinkedAt = typeof repo?.linkedAt === "string" ? Date.parse(repo.linkedAt) : Number.NaN;
@@ -431,25 +481,426 @@ function inferRemoteServerProjectRootFromAuthState(projectRoot) {
   const checkoutBaseDir = typeof auth?.checkoutBaseDir === "string" && auth.checkoutBaseDir.trim() ? auth.checkoutBaseDir.trim() : null;
   if (!checkoutBaseDir)
     return null;
-  const inferred = `${checkoutBaseDir.replace(/\/+$/, "")}/${slug}`;
-  writeRepoServerProjectRoot(projectRoot, inferred);
-  return inferred;
+  return `${checkoutBaseDir.replace(/\/+$/, "")}/${repoSlug}`;
 }
 function readLocalConnectionFallbackToken(projectRoot) {
   return readGitHubBearerTokenForRemote(projectRoot) ?? cleanToken(process.env.RIG_GITHUB_TOKEN) ?? readStoredGitHubAuthToken(projectRoot);
 }
+function normalizeRepoSlug(value) {
+  const slug = value?.trim();
+  return slug && /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
+}
+function readProjectLinkSlug(projectRoot) {
+  const path = resolve2(projectRoot, ".rig", "state", "project-link.json");
+  if (!existsSync2(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      return null;
+    return normalizeRepoSlug(typeof parsed.repoSlug === "string" ? String(parsed.repoSlug) : null);
+  } catch {
+    return null;
+  }
+}
+function writeProjectLinkConnection(projectRoot, repoSlug, alias) {
+  const path = resolve2(projectRoot, ".rig", "state", "project-link.json");
+  mkdirSync2(dirname2(path), { recursive: true });
+  writeFileSync2(path, `${JSON.stringify({ repoSlug, connection: alias, linkedAt: new Date().toISOString() }, null, 2)}
+`, "utf8");
+}
+function remoteLinkRepairCommand(repoSlug) {
+  return repoSlug ? `rig server repair-link --repo ${repoSlug}` : "rig server repair-link --repo owner/repo";
+}
+function isRemoteProjectRootLinkError(error) {
+  const text = error instanceof Error ? error.message : String(error ?? "");
+  return /no server-host project root link|remote project(?:-root)? link|x-rig-project-root|serverProjectRoot/i.test(text);
+}
+function formatRemoteProjectLinkHint(resolution) {
+  const repair = remoteLinkRepairCommand(resolution.repoSlug);
+  if (resolution.status === "auth_required") {
+    return `Authenticate the selected remote${resolution.alias ? ` (${resolution.alias})` : ""}, then run \`${repair}\`. Use \`rig github auth import-gh\` or \`rig init --repair --server remote --github-auth device${resolution.repoSlug ? ` --repo ${resolution.repoSlug}` : ""}\`.`;
+  }
+  if (resolution.status === "missing_project") {
+    return `Record the repo slug, then run \`${repair}\` (or \`rig init --repo owner/repo --server remote --github-auth device\`).`;
+  }
+  if (resolution.status === "not_remote")
+    return "Select a remote server with `rig server use <alias>` before repairing a remote project link.";
+  return `Run \`${repair}\` to backfill or prepare a server-host checkout for the selected remote${resolution.alias ? ` (${resolution.alias})` : ""}.`;
+}
+function remoteProjectLinkFailure(input) {
+  const partial = {
+    status: input.status,
+    alias: input.alias,
+    baseUrl: input.baseUrl,
+    repoSlug: input.repoSlug
+  };
+  return {
+    ok: false,
+    ...input,
+    hint: formatRemoteProjectLinkHint(partial),
+    next: remoteLinkRepairCommand(input.repoSlug)
+  };
+}
+function remoteProjectLinkSuccess(input) {
+  return {
+    ok: true,
+    status: input.status,
+    alias: input.alias,
+    baseUrl: input.baseUrl,
+    repoSlug: input.repoSlug,
+    serverProjectRoot: input.serverProjectRoot,
+    source: input.source,
+    prepared: input.prepared ?? input.status === "prepared",
+    validated: input.validated ?? false,
+    message: input.message ?? `Remote project link ready for ${input.repoSlug}.`,
+    hint: "Remote-scoped task/run/status requests will send x-rig-project-root for this server-host checkout.",
+    next: "rig task list"
+  };
+}
+function localCheckoutPathCandidate(projectRoot, candidate) {
+  try {
+    const local = resolve2(projectRoot);
+    const resolved = resolve2(candidate);
+    return resolved === local || resolved.startsWith(`${local}/`);
+  } catch {
+    return false;
+  }
+}
+async function requestRemoteProjectLinkJson(baseUrl, pathname, authToken, init = {}) {
+  const requestUrl = new URL(`${baseUrl}${pathname}`);
+  if (authToken && queryAuthFallbackEnabled())
+    requestUrl.searchParams.set("rt", authToken);
+  const response = await fetch(requestUrl, {
+    ...init,
+    headers: mergeHeaders(init.headers, authToken)
+  });
+  const text = await response.text();
+  const payload = text.trim().length > 0 ? (() => {
+    try {
+      return JSON.parse(text);
+    } catch {
+      return null;
+    }
+  })() : null;
+  return { ok: response.ok, status: response.status, payload, text };
+}
+function payloadError(payload, fallback) {
+  if (payload && typeof payload === "object" && !Array.isArray(payload)) {
+    const record = payload;
+    const value = record.error ?? record.message ?? record.reason;
+    if (typeof value === "string" && value.trim())
+      return value.trim();
+  }
+  return fallback;
+}
+function checkoutPathsFromProjectPayload(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return [];
+  const project = payload.project;
+  if (!project || typeof project !== "object" || Array.isArray(project))
+    return [];
+  const checkouts = project.checkouts;
+  if (!Array.isArray(checkouts))
+    return [];
+  return [...checkouts].reverse().flatMap((entry) => {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry))
+      return [];
+    const path = entry.path;
+    return typeof path === "string" && path.trim() ? [path.trim()] : [];
+  });
+}
+function checkoutPathFromPreparePayload(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return null;
+  const checkout = payload.checkout;
+  if (!checkout || typeof checkout !== "object" || Array.isArray(checkout))
+    return null;
+  const path = checkout.path;
+  return typeof path === "string" && path.trim() ? path.trim() : null;
+}
+async function validateAndPersistRemoteRoot(input) {
+  const candidate = input.candidate.trim();
+  if (!candidate || !isAbsolute(candidate)) {
+    return remoteProjectLinkFailure({
+      status: "invalid_root",
+      alias: input.alias,
+      baseUrl: input.baseUrl,
+      repoSlug: input.repoSlug,
+      message: `Remote project root candidate is not an absolute server-host path: ${candidate || "(empty)"}.`
+    });
+  }
+  if (localCheckoutPathCandidate(input.projectRoot, candidate)) {
+    return remoteProjectLinkFailure({
+      status: "invalid_root",
+      alias: input.alias,
+      baseUrl: input.baseUrl,
+      repoSlug: input.repoSlug,
+      message: `Refusing to use local checkout path ${candidate} as a remote server project root.`
+    });
+  }
+  let response;
+  try {
+    response = await requestRemoteProjectLinkJson(input.baseUrl, "/api/server/project-root", input.authToken, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ projectRoot: candidate })
+    });
+  } catch (error) {
+    return remoteProjectLinkFailure({
+      status: "error",
+      alias: input.alias,
+      baseUrl: input.baseUrl,
+      repoSlug: input.repoSlug,
+      message: `Could not validate remote project root ${candidate}: ${error instanceof Error ? error.message : String(error)}`
+    });
+  }
+  if (response.status === 401 || response.status === 403) {
+    return remoteProjectLinkFailure({
+      status: "auth_required",
+      alias: input.alias,
+      baseUrl: input.baseUrl,
+      repoSlug: input.repoSlug,
+      statusCode: response.status,
+      message: `Remote server ${input.alias} requires authentication before validating project root ${candidate}.`
+    });
+  }
+  if (!response.ok) {
+    return remoteProjectLinkFailure({
+      status: "invalid_root",
+      alias: input.alias,
+      baseUrl: input.baseUrl,
+      repoSlug: input.repoSlug,
+      statusCode: response.status,
+      message: `Remote server rejected project root ${candidate} (${response.status}): ${payloadError(response.payload, response.text || "project-root validation failed")}`
+    });
+  }
+  const record = response.payload && typeof response.payload === "object" && !Array.isArray(response.payload) ? response.payload : {};
+  if (record.ok !== true) {
+    return remoteProjectLinkFailure({
+      status: "invalid_root",
+      alias: input.alias,
+      baseUrl: input.baseUrl,
+      repoSlug: input.repoSlug,
+      message: `Remote server did not accept project root ${candidate}: ${payloadError(response.payload, "project-root validation failed")}`
+    });
+  }
+  const accepted = typeof record.projectRoot === "string" && record.projectRoot.trim() ? record.projectRoot.trim() : typeof record.requestedProjectRoot === "string" && record.requestedProjectRoot.trim() ? record.requestedProjectRoot.trim() : candidate;
+  writeRepoServerProjectRoot(input.projectRoot, accepted, { alias: input.alias, baseUrl: input.baseUrl, project: input.repoSlug });
+  writeProjectLinkConnection(input.projectRoot, input.repoSlug, input.alias);
+  const status = input.status ?? (input.prepared ? "prepared" : "backfilled");
+  return remoteProjectLinkSuccess({
+    status,
+    alias: input.alias,
+    baseUrl: input.baseUrl,
+    repoSlug: input.repoSlug,
+    serverProjectRoot: accepted,
+    source: input.source,
+    prepared: input.prepared,
+    validated: true,
+    message: status === "ready" ? `Remote project link already points to ${accepted} and was validated on ${input.alias}.` : input.prepared ? `Prepared and linked remote checkout ${accepted} for ${input.repoSlug}.` : `Backfilled remote checkout ${accepted} for ${input.repoSlug}.`
+  });
+}
+async function ensureRemoteProjectRootLink(projectRoot, options = {}) {
+  let selected;
+  try {
+    selected = resolveSelectedConnection(projectRoot);
+  } catch (error) {
+    return remoteProjectLinkFailure({ status: "error", message: error instanceof Error ? error.message : String(error) });
+  }
+  if (!selected || selected.connection.kind !== "remote") {
+    return remoteProjectLinkFailure({ status: "not_remote", message: "No remote Rig server is selected for this repo." });
+  }
+  const repo = readRepoConnection(projectRoot);
+  const explicitRepoRequested = options.repoSlug !== undefined;
+  const explicitRepoSlug = explicitRepoRequested ? normalizeRepoSlug(options.repoSlug) : null;
+  const repoProjectSlug = normalizeRepoSlug(repo?.project);
+  const repoSlug = explicitRepoSlug ?? repoProjectSlug ?? readProjectLinkSlug(projectRoot);
+  const alias = selected.alias;
+  const baseUrl = selected.connection.baseUrl;
+  const authToken = options.authToken === undefined ? readGitHubBearerTokenForRemote(projectRoot) : options.authToken;
+  const mode = options.mode ?? "backfill-only";
+  if (explicitRepoRequested && !explicitRepoSlug) {
+    return remoteProjectLinkFailure({
+      status: "missing_project",
+      alias,
+      baseUrl,
+      message: `Invalid --repo value ${JSON.stringify(options.repoSlug)}. Expected owner/repo.`
+    });
+  }
+  if (!repoSlug) {
+    return remoteProjectLinkFailure({
+      status: "missing_project",
+      alias,
+      baseUrl,
+      message: `Remote server ${alias} is selected, but this checkout has no GitHub repo slug recorded.`
+    });
+  }
+  const skippedCandidates = [];
+  const storedRoot = selected.serverProjectRoot?.trim() || null;
+  const storedRootMatchesResolvedRepo = repoProjectSlug === repoSlug;
+  if (storedRoot && storedRootMatchesResolvedRepo) {
+    if (localCheckoutPathCandidate(projectRoot, storedRoot)) {
+      clearRepoServerProjectRoot(projectRoot);
+      skippedCandidates.push(storedRoot);
+    } else {
+      const storedResult = await validateAndPersistRemoteRoot({
+        projectRoot,
+        alias,
+        baseUrl,
+        authToken,
+        repoSlug,
+        candidate: storedRoot,
+        source: "stored",
+        status: "ready"
+      });
+      if (storedResult.ok || storedResult.status === "auth_required" || storedResult.status === "error")
+        return storedResult;
+      clearRepoServerProjectRoot(projectRoot);
+      skippedCandidates.push(storedRoot);
+    }
+  } else if (storedRoot) {
+    skippedCandidates.push(storedRoot);
+  }
+  const authCandidate = inferRemoteServerProjectRootCandidateFromAuthState(projectRoot, repoSlug);
+  if (authCandidate) {
+    const authResult = await validateAndPersistRemoteRoot({ projectRoot, alias, baseUrl, authToken, repoSlug, candidate: authCandidate, source: "auth-state" });
+    if (authResult.ok || authResult.status === "auth_required")
+      return authResult;
+  }
+  let registryResponse;
+  try {
+    registryResponse = await requestRemoteProjectLinkJson(baseUrl, `/api/projects/${encodeURIComponent(repoSlug)}`, authToken);
+  } catch (error) {
+    return remoteProjectLinkFailure({
+      status: "error",
+      alias,
+      baseUrl,
+      repoSlug,
+      message: `Could not read remote project registry for ${repoSlug} on ${alias}: ${error instanceof Error ? error.message : String(error)}`
+    });
+  }
+  if (registryResponse.status === 401 || registryResponse.status === 403) {
+    return remoteProjectLinkFailure({
+      status: "auth_required",
+      alias,
+      baseUrl,
+      repoSlug,
+      statusCode: registryResponse.status,
+      message: `Remote server ${alias} requires authentication before reading the ${repoSlug} project registry.`
+    });
+  }
+  if (registryResponse.ok) {
+    const candidates = checkoutPathsFromProjectPayload(registryResponse.payload);
+    for (const candidate of candidates) {
+      const result = await validateAndPersistRemoteRoot({ projectRoot, alias, baseUrl, authToken, repoSlug, candidate, source: "registry" });
+      if (result.ok || result.status === "auth_required")
+        return result;
+      skippedCandidates.push(candidate);
+    }
+    if (mode === "backfill-only") {
+      return remoteProjectLinkFailure({
+        status: candidates.length > 0 ? "invalid_root" : "no_server_checkout",
+        alias,
+        baseUrl,
+        repoSlug,
+        message: candidates.length > 0 ? `Remote registry has checkout candidates for ${repoSlug}, but none validated for ${alias}.` : `Remote registry has ${repoSlug}, but no server checkout path is linked yet.`,
+        skippedCandidates
+      });
+    }
+  } else if (registryResponse.status === 404) {
+    if (mode === "backfill-only") {
+      return remoteProjectLinkFailure({
+        status: "project_not_registered",
+        alias,
+        baseUrl,
+        repoSlug,
+        statusCode: registryResponse.status,
+        message: `Remote server ${alias} has no registered project record for ${repoSlug}.`
+      });
+    }
+  } else {
+    return remoteProjectLinkFailure({
+      status: "error",
+      alias,
+      baseUrl,
+      repoSlug,
+      statusCode: registryResponse.status,
+      message: `Could not backfill ${repoSlug} from remote registry (${registryResponse.status}): ${payloadError(registryResponse.payload, registryResponse.text || "registry lookup failed")}`,
+      skippedCandidates
+    });
+  }
+  let prepareResponse;
+  try {
+    prepareResponse = await requestRemoteProjectLinkJson(baseUrl, `/api/projects/${encodeURIComponent(repoSlug)}/prepare-checkout`, authToken, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ checkout: { kind: "managed-clone" }, repoUrl: `https://github.com/${repoSlug}.git` })
+    });
+  } catch (error) {
+    return remoteProjectLinkFailure({
+      status: "error",
+      alias,
+      baseUrl,
+      repoSlug,
+      message: `Could not prepare remote checkout for ${repoSlug} on ${alias}: ${error instanceof Error ? error.message : String(error)}`
+    });
+  }
+  if (prepareResponse.status === 401 || prepareResponse.status === 403) {
+    return remoteProjectLinkFailure({
+      status: "auth_required",
+      alias,
+      baseUrl,
+      repoSlug,
+      statusCode: prepareResponse.status,
+      message: `Remote server ${alias} requires authentication before preparing ${repoSlug}.`
+    });
+  }
+  if (!prepareResponse.ok) {
+    return remoteProjectLinkFailure({
+      status: "error",
+      alias,
+      baseUrl,
+      repoSlug,
+      statusCode: prepareResponse.status,
+      message: `Remote checkout prepare failed for ${repoSlug} (${prepareResponse.status}): ${payloadError(prepareResponse.payload, prepareResponse.text || "prepare-checkout failed")}`,
+      skippedCandidates
+    });
+  }
+  const preparedPath = checkoutPathFromPreparePayload(prepareResponse.payload);
+  if (!preparedPath) {
+    return remoteProjectLinkFailure({
+      status: "invalid_root",
+      alias,
+      baseUrl,
+      repoSlug,
+      message: `Remote checkout prepare for ${repoSlug} did not return a checkout.path.`,
+      skippedCandidates
+    });
+  }
+  return validateAndPersistRemoteRoot({ projectRoot, alias, baseUrl, authToken, repoSlug, candidate: preparedPath, source: "prepare", prepared: true });
+}
+async function inspectRemoteProjectLink(projectRoot) {
+  return ensureRemoteProjectRootLink(projectRoot, { mode: "backfill-only" });
+}
+async function repairRemoteProjectRootLink(context, options = {}) {
+  const resolution = await ensureRemoteProjectRootLink(context.projectRoot, { mode: options.mode ?? "prepare-if-missing", repoSlug: options.repoSlug });
+  if (!resolution.ok)
+    throw new CliError(resolution.message, 1, { hint: resolution.hint });
+  return resolution;
+}
 async function ensureServerForCli(projectRoot) {
   try {
     const selected = resolveSelectedConnection(projectRoot);
     if (selected?.connection.kind === "remote") {
       reportServerPhase(`Connecting to ${selected.alias}\u2026`);
       const authToken = readGitHubBearerTokenForRemote(projectRoot);
-      const serverProjectRoot = selected.serverProjectRoot ?? inferRemoteServerProjectRootFromAuthState(projectRoot) ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
+      const link = await ensureRemoteProjectRootLink(projectRoot, { mode: "backfill-only", authToken });
       return {
         baseUrl: selected.connection.baseUrl,
         authToken,
         connectionKind: "remote",
-        serverProjectRoot
+        serverProjectRoot: link.ok ? link.serverProjectRoot ?? null : null
       };
     }
     reportServerPhase("Starting local Rig server\u2026");
@@ -467,32 +918,6 @@ async function ensureServerForCli(projectRoot) {
     throw error;
   }
 }
-async function backfillRemoteServerProjectRoot(projectRoot, baseUrl, authToken) {
-  const repo = readRepoConnection(projectRoot);
-  const slug = repo?.project?.trim();
-  if (!slug)
-    return null;
-  try {
-    const url = new URL(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`);
-    if (authToken && queryAuthFallbackEnabled())
-      url.searchParams.set("rt", authToken);
-    const response = await fetch(url, {
-      headers: mergeHeaders(undefined, authToken)
-    });
-    if (!response.ok)
-      return null;
-    const payload = await response.json();
-    const project = payload.project && typeof payload.project === "object" && !Array.isArray(payload.project) ? payload.project : null;
-    const checkouts = Array.isArray(project?.checkouts) ? project.checkouts : [];
-    const latestCheckout = [...checkouts].reverse().find((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry) && typeof entry.path === "string"));
-    const path = typeof latestCheckout?.path === "string" && latestCheckout.path.trim() ? latestCheckout.path.trim() : null;
-    if (path)
-      writeRepoServerProjectRoot(projectRoot, path);
-    return path;
-  } catch {
-    return null;
-  }
-}
 function appendTaskFilterParams(url, filters) {
   if (filters.assignee)
     url.searchParams.set("assignee", filters.assignee);
@@ -593,13 +1018,20 @@ function canUseRemoteWithoutProjectRoot(pathname) {
 async function requestServerJson(context, pathname, init = {}) {
   const server = await ensureServerForCli(context.projectRoot);
   const requestUrl = new URL(`${server.baseUrl}${pathname}`);
-  if (server.connectionKind === "remote" && !server.serverProjectRoot && !canUseRemoteWithoutProjectRoot(requestUrl.pathname) && (server.authToken || !isLoopbackRemoteBaseUrl(server.baseUrl))) {
-    const repo = readRepoConnection(context.projectRoot);
-    throw new CliError(`Remote server is selected for ${repo?.project ?? "this repo"}, but this checkout has no server-host project root link.`, 1, { hint: "Run `rig init --repair` or `rig init --yes --repo owner/repo --server remote` to repair the remote project link before task/run commands." });
+  let scopedServerProjectRoot = server.serverProjectRoot;
+  if (server.connectionKind === "remote" && !scopedServerProjectRoot && !canUseRemoteWithoutProjectRoot(requestUrl.pathname) && (server.authToken || !isLoopbackRemoteBaseUrl(server.baseUrl))) {
+    const link = await ensureRemoteProjectRootLink(context.projectRoot, { mode: "backfill-only", authToken: server.authToken });
+    if (link.ok && link.serverProjectRoot) {
+      scopedServerProjectRoot = link.serverProjectRoot;
+    } else {
+      const repo = readRepoConnection(context.projectRoot);
+      const target = link.alias && link.baseUrl ? `${link.alias} (${link.baseUrl})` : server.baseUrl;
+      throw new CliError(`Remote server ${target} is selected for ${link.repoSlug ?? repo?.project ?? "this repo"}, but this checkout has no server-host project root link. ${link.message}`, 1, { hint: link.hint });
+    }
   }
   const headers = mergeHeaders(init.headers, server.authToken);
-  if (server.serverProjectRoot)
-    headers.set("x-rig-project-root", server.serverProjectRoot);
+  if (scopedServerProjectRoot)
+    headers.set("x-rig-project-root", scopedServerProjectRoot);
   if (server.connectionKind === "remote" && server.authToken && queryAuthFallbackEnabled()) {
     requestUrl.searchParams.set("rt", server.authToken);
   }
@@ -1644,12 +2076,13 @@ var init__help_catalog = __esm(() => {
     {
       name: "server",
       summary: "Choose, inspect, and start the Rig server that owns tasks and runs.",
-      usage: ["rig server <status|list|add|use|start> [options]"],
+      usage: ["rig server <status|list|add|use|repair-link|start> [options]"],
       commands: [
-        { command: "status", description: "Show the selected server for this repo.", primary: true },
+        { command: "status", description: "Show the selected server and remote project-root link for this repo.", primary: true },
         { command: "use local", description: "Switch this repo to the local Rig server.", primary: true },
         { command: "add <alias> <url>", description: "Save a remote Rig server URL.", primary: true },
         { command: "use <alias>", description: "Select a saved remote server alias.", primary: true },
+        { command: "repair-link [--prepare|--backfill-only] [--repo owner/repo]", description: "Backfill or prepare the selected remote's server-host checkout link.", primary: true },
         { command: "list", description: "List saved local/remote server aliases.", primary: true },
         { command: "start [--host <host>] [--port <n>]", description: "Start a local rig-server process." }
       ],
@@ -1657,6 +2090,7 @@ var init__help_catalog = __esm(() => {
         "rig server status",
         "rig server add prod https://where.rig-does.work",
         "rig server use prod",
+        "rig server repair-link --repo owner/repo",
         "rig server use local",
         "rig server start --port 3773"
       ],
@@ -2367,7 +2801,7 @@ function resolveControlPlaneDefinitionRoot(projectRoot) {
 var init__paths = () => {};
 
 // packages/cli/src/report-bug.ts
-import { copyFileSync, existsSync as existsSync5, mkdirSync as mkdirSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { copyFileSync, existsSync as existsSync5, mkdirSync as mkdirSync3, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { basename as basename2, extname, join, resolve as resolve7 } from "path";
 function slugifyBugTitle(value) {
   const slug = value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80).replace(/-+$/g, "");
@@ -2406,8 +2840,8 @@ function createBugReportFiles(input) {
     }
     rmSync2(reportDir, { recursive: true, force: true });
   }
-  mkdirSync2(assetDir, { recursive: true });
-  mkdirSync2(screenshotDir, { recursive: true });
+  mkdirSync3(assetDir, { recursive: true });
+  mkdirSync3(screenshotDir, { recursive: true });
   const copiedScreenshots = copyEvidenceFiles(input.projectRoot, screenshotDir, input.screenshots ?? [], "screenshot");
   const copiedAssets = copyEvidenceFiles(input.projectRoot, assetDir, input.assets ?? [], "asset");
   const manifestAssets = [
@@ -2437,15 +2871,15 @@ function createBugReportFiles(input) {
     platform: process.platform,
     arch: process.arch
   };
-  writeFileSync2(join(assetDir, "README.md"), buildAssetReadme(input.title), "utf8");
-  writeFileSync2(join(screenshotDir, "README.md"), buildScreenshotReadme(input.title), "utf8");
+  writeFileSync3(join(assetDir, "README.md"), buildAssetReadme(input.title), "utf8");
+  writeFileSync3(join(screenshotDir, "README.md"), buildScreenshotReadme(input.title), "utf8");
   if (browserPath && browser) {
-    writeFileSync2(browserPath, `${JSON.stringify(browser, null, 2)}
+    writeFileSync3(browserPath, `${JSON.stringify(browser, null, 2)}
 `, "utf8");
   }
-  writeFileSync2(manifestPath, `${JSON.stringify(manifest, null, 2)}
+  writeFileSync3(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
-  writeFileSync2(taskPath, buildBugReportMarkdown(input, browser, copiedScreenshots, copiedAssets), "utf8");
+  writeFileSync3(taskPath, buildBugReportMarkdown(input, browser, copiedScreenshots, copiedAssets), "utf8");
   return {
     slug,
     reportDir,
@@ -2622,7 +3056,7 @@ function formatAssetMarkdown(name, path) {
 var init_report_bug = () => {};
 
 // packages/cli/src/commands/task-report-bug.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
 import { resolve as resolve8 } from "path";
 import pc2 from "picocolors";
 import {
@@ -2984,7 +3418,7 @@ function appendTaskConfigEntryPreservingText(taskConfigPath, issueId, entry) {
 `).map((line) => `  ${line}`).join(`
 `);
   if (!trimmed || trimmed === "{}") {
-    writeFileSync3(taskConfigPath, `{
+    writeFileSync4(taskConfigPath, `{
 ${serializedEntry}
 }
 `, "utf8");
@@ -3000,7 +3434,7 @@ ${serializedEntry}
     throw new CliError(`Invalid trailing content in task config: ${taskConfigPath}`, 1, { hint: "Remove the trailing content so the file is a single JSON object, then retry." });
   }
   const comma = before.trim() === "{" ? "" : ",";
-  writeFileSync3(taskConfigPath, `${before}${comma}
+  writeFileSync4(taskConfigPath, `${before}${comma}
 ${serializedEntry}
 }
 `, "utf8");
@@ -3385,7 +3819,7 @@ var init_task_report_bug = __esm(() => {
 });
 
 // packages/cli/src/commands/browser.ts
-import { mkdirSync as mkdirSync3, rmSync as rmSync3 } from "fs";
+import { mkdirSync as mkdirSync4, rmSync as rmSync3 } from "fs";
 import { resolve as resolve9 } from "path";
 import { spawn } from "child_process";
 import { emitKeypressEvents } from "readline";
@@ -3963,7 +4397,7 @@ function readBrowserDemoCommandLine(command) {
 }
 async function launchBrowserDemo(runtime) {
   rmSync3(resolve9(runtime.browserDir, runtime.stateDir), { recursive: true, force: true });
-  mkdirSync3(resolve9(runtime.browserDir, runtime.stateDir), { recursive: true });
+  mkdirSync4(resolve9(runtime.browserDir, runtime.stateDir), { recursive: true });
   const launcherPath = resolve9(runtime.browserDir, "scripts/electron-launcher.mjs");
   const launcher = await import(pathToFileURL(launcherPath).href);
   const electronPath = await launcher.resolveElectronPath();
@@ -4312,7 +4746,7 @@ var init_profile_and_review = __esm(() => {
 });
 
 // packages/cli/src/commands/_policy.ts
-import { appendFileSync, mkdirSync as mkdirSync4 } from "fs";
+import { appendFileSync, mkdirSync as mkdirSync5 } from "fs";
 import { resolve as resolve10 } from "path";
 import { evaluate as evaluate2, loadPolicy as loadPolicy2, resolveAction as resolveAction2 } from "@rig/runtime/control-plane/runtime/guard";
 import { resolveHarnessPaths } from "@rig/runtime/control-plane/native/utils";
@@ -4329,7 +4763,7 @@ function appendControlledBashAudit(context, mode, command, args, matchedRuleIds,
   }
   const logsDir = resolveHarnessPaths(context.projectRoot).logsDir;
   const logFile = resolve10(logsDir, "controlled-bash.jsonl");
-  mkdirSync4(logsDir, { recursive: true });
+  mkdirSync5(logsDir, { recursive: true });
   const payload = {
     timestamp: new Date().toISOString(),
     mode,
@@ -4623,9 +5057,9 @@ var exports_pi = {};
 __export(exports_pi, {
   executePi: () => executePi
 });
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
 import { homedir as homedir4 } from "os";
-import { dirname as dirname2, resolve as resolve12 } from "path";
+import { dirname as dirname3, resolve as resolve12 } from "path";
 function settingsPath(root) {
   return resolve12(root, ".pi", "settings.json");
 }
@@ -4650,8 +5084,8 @@ function packageKey(entry) {
   return JSON.stringify(entry);
 }
 function writeSettings(path, settings) {
-  mkdirSync5(dirname2(path), { recursive: true });
-  writeFileSync4(path, `${JSON.stringify(settings, null, 2)}
+  mkdirSync6(dirname3(path), { recursive: true });
+  writeFileSync5(path, `${JSON.stringify(settings, null, 2)}
 `, "utf-8");
 }
 async function searchNpmForPiExtensions(term) {
@@ -4834,6 +5268,14 @@ function permissionAllowsPr2(payload) {
 function isNotFoundError(error) {
   return /\b(404|not found)\b/i.test(message(error));
 }
+function isLoopbackBaseUrl(baseUrl) {
+  try {
+    const host = new URL(baseUrl).hostname.toLowerCase();
+    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+  } catch {
+    return false;
+  }
+}
 function projectCheckoutReady(payload) {
   if (!payload || typeof payload !== "object" || Array.isArray(payload))
     return null;
@@ -4888,25 +5330,37 @@ async function runFastTaskRunPreflight(context, options = {}) {
   }
   const repo = readRepoConnection(context.projectRoot);
   const remoteWithoutProjectLink = selectedServer?.connectionKind === "remote" && !repo?.project;
-  checks.push(repo ? preflightCheck("project-link", "project linked to selected server", repo.project ? "pass" : remoteWithoutProjectLink ? "fail" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : " (missing project link)"}`, remoteWithoutProjectLink ? "Run `rig init --repair` or `rig init --yes --repo owner/repo --server remote` to restore the remote project link." : "Run `rig init --yes --repo owner/repo` to record the GitHub repo slug.") : preflightCheck("project-link", "project linked to selected server", legacyServerCompatibility ? "warn" : "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig server use <alias|local>`."));
+  let remoteRootBlocked = false;
+  checks.push(repo ? preflightCheck("project-link", "project linked to selected server", repo.project ? "pass" : remoteWithoutProjectLink ? "fail" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : " (missing project link)"}`, remoteWithoutProjectLink ? "Run `rig server repair-link --repo owner/repo` or `rig init --repo owner/repo --server remote` to restore the remote project link." : "Run `rig init --yes --repo owner/repo` to record the GitHub repo slug.") : preflightCheck("project-link", "project linked to selected server", legacyServerCompatibility ? "warn" : "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig server use <alias|local>`."));
+  if (selectedServer?.connectionKind === "remote" && repo?.project && !selectedServer.serverProjectRoot) {
+    const link = await ensureRemoteProjectRootLink(context.projectRoot, { mode: "backfill-only", authToken: selectedServer.authToken });
+    const loopbackDevRemote = !selectedServer.authToken && isLoopbackBaseUrl(selectedServer.baseUrl);
+    checks.push(preflightCheck("remote-project-root-link", "remote server checkout/root linked", link.ok ? "pass" : loopbackDevRemote ? "warn" : "fail", link.ok ? `${link.repoSlug} -> ${link.serverProjectRoot}` : link.message, link.ok ? undefined : loopbackDevRemote ? "Loopback development remotes may continue without x-rig-project-root; production remotes must run `rig server repair-link`." : link.hint));
+    remoteRootBlocked = !link.ok && !loopbackDevRemote;
+  }
   try {
     const auth = await request("/api/github/auth/status");
     checks.push(isAuthenticated2(auth) ? preflightCheck("github-auth", "GitHub auth valid", "pass") : preflightCheck("github-auth", "GitHub auth valid", legacyServerCompatibility ? "warn" : "fail", "not authenticated", "Run `rig github auth import-gh` or `rig github auth token --token <token>`."));
   } catch (error) {
     checks.push(preflightCheck("github-auth", "GitHub auth valid", legacyServerCompatibility ? "warn" : "fail", message(error), "Fix GitHub auth on the selected Rig server."));
   }
-  try {
-    const projection = await request("/api/workspace/task-projection");
-    checks.push(preflightCheck("task-projection", "task projection ready", "pass", JSON.stringify(projection).slice(0, 120)));
-  } catch (error) {
-    checks.push(preflightCheck("task-projection", "task projection ready", "warn", message(error), "Refresh task projection with `rig task list` before launching."));
-  }
-  try {
-    const permissions = await request("/api/github/repo/permissions");
-    const allowed = permissionAllowsPr2(permissions);
-    checks.push(allowed === false ? preflightCheck("github-repo-permissions", "GitHub PR permissions", "fail", JSON.stringify(permissions).slice(0, 120), "Grant the selected GitHub token permission to push branches and open PRs.") : preflightCheck("github-repo-permissions", "GitHub PR permissions", allowed === true ? "pass" : "warn", JSON.stringify(permissions).slice(0, 120), "Confirm the selected token can push branches and open PRs."));
-  } catch (error) {
-    checks.push(preflightCheck("github-repo-permissions", "GitHub PR permissions", "warn", message(error), "Ensure the selected token can push branches and open PRs."));
+  if (!remoteRootBlocked) {
+    try {
+      const projection = await request("/api/workspace/task-projection");
+      checks.push(preflightCheck("task-projection", "task projection ready", "pass", JSON.stringify(projection).slice(0, 120)));
+    } catch (error) {
+      checks.push(preflightCheck("task-projection", "task projection ready", "warn", message(error), "Refresh task projection with `rig task list` before launching."));
+    }
+    try {
+      const permissions = await request("/api/github/repo/permissions");
+      const allowed = permissionAllowsPr2(permissions);
+      checks.push(allowed === false ? preflightCheck("github-repo-permissions", "GitHub PR permissions", "fail", JSON.stringify(permissions).slice(0, 120), "Grant the selected GitHub token permission to push branches and open PRs.") : preflightCheck("github-repo-permissions", "GitHub PR permissions", allowed === true ? "pass" : "warn", JSON.stringify(permissions).slice(0, 120), "Confirm the selected token can push branches and open PRs."));
+    } catch (error) {
+      checks.push(preflightCheck("github-repo-permissions", "GitHub PR permissions", "warn", message(error), "Ensure the selected token can push branches and open PRs."));
+    }
+  } else {
+    checks.push(preflightCheck("task-projection", "task projection ready", "warn", "skipped until remote project-root link is repaired", "Run `rig server repair-link`, then retry."));
+    checks.push(preflightCheck("github-repo-permissions", "GitHub PR permissions", "warn", "skipped until remote project-root link is repaired", "Run `rig server repair-link`, then retry."));
   }
   if (repo?.project) {
     try {
@@ -4918,19 +5372,24 @@ async function runFastTaskRunPreflight(context, options = {}) {
     }
   }
   if (taskId) {
-    try {
-      const tasks = await request(`/api/workspace/tasks?limit=200&refresh=1`);
-      const found = Array.isArray(tasks) && tasks.some((task) => taskMatchesId(task, taskId));
-      checks.push(found ? preflightCheck("issue", "task/issue accessible", "pass", taskId) : preflightCheck("issue", "task/issue accessible", legacyServerCompatibility ? "warn" : "fail", taskId, "Confirm the issue exists and matches the configured task filters."));
-    } catch (error) {
-      checks.push(preflightCheck("issue", "task/issue accessible", legacyServerCompatibility ? "warn" : "fail", message(error), "Fix the task source before launching a run."));
-    }
-    try {
-      const runs = await request("/api/runs?limit=200");
-      const duplicate = activeDuplicateRun(runs, taskId);
-      checks.push(duplicate ? preflightCheck("duplicate-active-run", "one active run per task", "fail", String(duplicate.runId ?? taskId), "Attach to or stop the existing run before starting another one for this task.") : preflightCheck("duplicate-active-run", "one active run per task", "pass", taskId));
-    } catch (error) {
-      checks.push(preflightCheck("duplicate-active-run", "one active run per task", "warn", message(error), "Could not list active runs; the server will still reject conflicting runs if configured."));
+    if (!remoteRootBlocked) {
+      try {
+        const tasks = await request(`/api/workspace/tasks?limit=200&refresh=1`);
+        const found = Array.isArray(tasks) && tasks.some((task) => taskMatchesId(task, taskId));
+        checks.push(found ? preflightCheck("issue", "task/issue accessible", "pass", taskId) : preflightCheck("issue", "task/issue accessible", legacyServerCompatibility ? "warn" : "fail", taskId, "Confirm the issue exists and matches the configured task filters."));
+      } catch (error) {
+        checks.push(preflightCheck("issue", "task/issue accessible", legacyServerCompatibility ? "warn" : "fail", message(error), "Fix the task source before launching a run."));
+      }
+      try {
+        const runs = await request("/api/runs?limit=200");
+        const duplicate = activeDuplicateRun(runs, taskId);
+        checks.push(duplicate ? preflightCheck("duplicate-active-run", "one active run per task", "fail", String(duplicate.runId ?? taskId), "Attach to or stop the existing run before starting another one for this task.") : preflightCheck("duplicate-active-run", "one active run per task", "pass", taskId));
+      } catch (error) {
+        checks.push(preflightCheck("duplicate-active-run", "one active run per task", "warn", message(error), "Could not list active runs; the server will still reject conflicting runs if configured."));
+      }
+    } else {
+      checks.push(preflightCheck("issue", "task/issue accessible", "fail", "skipped until remote project-root link is repaired", "Run `rig server repair-link`, then retry."));
+      checks.push(preflightCheck("duplicate-active-run", "one active run per task", "warn", "skipped until remote project-root link is repaired", "Run `rig server repair-link`, then retry."));
     }
   }
   if ((options.runtimeAdapter ?? "pi") === "pi") {
@@ -5411,7 +5870,7 @@ import {
   chmodSync,
   copyFileSync as copyFileSync2,
   existsSync as existsSync10,
-  mkdirSync as mkdirSync6,
+  mkdirSync as mkdirSync7,
   readdirSync,
   readlinkSync,
   rmSync as rmSync4,
@@ -5516,7 +5975,7 @@ async function executeDist(context, args) {
       requireNoExtraArgs(pending, "rig dist install [--scope user|system] [--path <dir>]");
       const scope = parseInstallScope(scopeResult.value);
       const installDir = resolveInstallDir(scope, pathResult.value);
-      mkdirSync6(installDir, { recursive: true });
+      mkdirSync7(installDir, { recursive: true });
       let source = await findLatestDistBinary(context.projectRoot);
       let buildDir = null;
       if (!source) {
@@ -5571,7 +6030,7 @@ async function executeDist(context, args) {
       const fp = await computeRuntimeImageFingerprint(context.projectRoot);
       const currentId = computeRuntimeImageId(fp);
       const imagesDir = resolve15(resolveControlPlaneMonorepoRuntimeDir(context.projectRoot), "images");
-      mkdirSync6(imagesDir, { recursive: true });
+      mkdirSync7(imagesDir, { recursive: true });
       let pruned = 0;
       for (const entry of readdirSync(imagesDir, { withFileTypes: true })) {
         if (entry.isDirectory() && entry.name !== currentId) {
@@ -5583,9 +6042,9 @@ async function executeDist(context, args) {
         console.log(`Pruned ${pruned} stale image(s).`);
       }
       const imageDir = resolve15(imagesDir, currentId);
-      mkdirSync6(resolve15(imageDir, "bin/hooks"), { recursive: true });
-      mkdirSync6(resolve15(imageDir, "bin/plugins"), { recursive: true });
-      mkdirSync6(resolve15(imageDir, "bin/validators"), { recursive: true });
+      mkdirSync7(resolve15(imageDir, "bin/hooks"), { recursive: true });
+      mkdirSync7(resolve15(imageDir, "bin/plugins"), { recursive: true });
+      mkdirSync7(resolve15(imageDir, "bin/validators"), { recursive: true });
       const hookNames = [
         "scope-guard",
         "import-guard",
@@ -5610,8 +6069,8 @@ async function executeDist(context, args) {
       const binPluginsDir = resolve15(resolveControlPlaneHostBinDir(context.projectRoot), "plugins");
       const validatorsRoot = resolve15(hostProjectRoot, "packages/runtime/src/control-plane/validators");
       const binValidatorsDir = resolve15(resolveControlPlaneHostBinDir(context.projectRoot), "validators");
-      mkdirSync6(binPluginsDir, { recursive: true });
-      mkdirSync6(binValidatorsDir, { recursive: true });
+      mkdirSync7(binPluginsDir, { recursive: true });
+      mkdirSync7(binValidatorsDir, { recursive: true });
       if (existsSync10(pluginsDir)) {
         for (const entry of readdirSync(pluginsDir, { withFileTypes: true })) {
           const m = entry.name.match(/^(.+)\.plugin\.(ts|js|mjs|cjs)$/);
@@ -6050,16 +6509,19 @@ function formatConnectionList(connections) {
   return [formatSection("Rig servers", `${rows.length} available`), `${pc4.bold(pad("ALIAS", aliasWidth))}  ${pc4.bold("KIND")}  ${pc4.bold("TARGET")}`, ...lines, "", ...formatNextSteps(["Select one: `rig server use <alias|local>`"])].join(`
 `);
 }
-function formatConnectionStatus(selected, connections) {
+function formatConnectionStatus(selected, connections, repo, remoteProjectLink) {
   const connection = selected === "local" ? { kind: "local", mode: "auto" } : connections[selected];
   const target = !connection ? "not configured" : connection.kind === "remote" ? connection.baseUrl : "local";
+  const rootLabel = remoteProjectLink ? remoteProjectLink.ok ? `ready \xB7 ${remoteProjectLink.serverProjectRoot ?? repo?.serverProjectRoot ?? "linked"}` : `${remoteProjectLink.status ?? "needs repair"} \xB7 ${remoteProjectLink.hint ?? remoteProjectLink.message ?? "run rig server repair-link"}` : repo?.serverProjectRoot ? repo.serverProjectRoot : "not required";
   return [
     formatSection("Rig server", "selected for this repo"),
     `${themeFaint("\u2502")} ${themeDim("selected ")} ${pc4.bold(selected)}`,
     `${themeFaint("\u2502")} ${themeDim("kind     ")} ${formatStatusPill(connection?.kind ?? "unknown")}`,
     `${themeFaint("\u2502")} ${themeDim("target   ")} ${target ?? "not configured"}`,
+    ...repo?.project ? [`${themeFaint("\u2502")} ${themeDim("project  ")} ${repo.project}`] : [],
+    ...connection?.kind === "remote" ? [`${themeFaint("\u2502")} ${themeDim("root     ")} ${rootLabel}`] : [],
     "",
-    ...formatNextSteps(["Change: `rig server use <alias|local>`", "List saved servers: `rig server list`"])
+    ...formatNextSteps(remoteProjectLink && !remoteProjectLink.ok ? ["Repair remote link: `rig server repair-link`", "Authenticate first if needed: `rig github auth import-gh`"] : ["Change: `rig server use <alias|local>`", "List saved servers: `rig server list`"])
   ].join(`
 `);
 }
@@ -6350,7 +6812,7 @@ var init_inbox = __esm(() => {
 
 // packages/cli/src/commands/_snapshot-upload.ts
 import { mkdir, readdir, readFile, writeFile } from "fs/promises";
-import { dirname as dirname3, resolve as resolve16, relative, sep } from "path";
+import { dirname as dirname4, resolve as resolve16, relative, sep } from "path";
 function toPosixPath(path) {
   return path.split(sep).join("/");
 }
@@ -6451,7 +6913,7 @@ __export(exports_init, {
   DEMO_TASKS_RELATIVE_DIR: () => DEMO_TASKS_RELATIVE_DIR,
   DEMO_TASKS: () => DEMO_TASKS
 });
-import { appendFileSync as appendFileSync2, existsSync as existsSync11, mkdirSync as mkdirSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
+import { appendFileSync as appendFileSync2, existsSync as existsSync11, mkdirSync as mkdirSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
 import { spawnSync } from "child_process";
 import { basename as basename3, resolve as resolve17 } from "path";
 import { buildRigInitConfigSource } from "@rig/core";
@@ -6475,14 +6937,14 @@ function parseRepoSlug(value) {
 }
 function ensureRigPrivateDirs(projectRoot) {
   const rigDir = resolve17(projectRoot, ".rig");
-  mkdirSync7(resolve17(rigDir, "state"), { recursive: true });
-  mkdirSync7(resolve17(rigDir, "logs"), { recursive: true });
-  mkdirSync7(resolve17(rigDir, "runs"), { recursive: true });
-  mkdirSync7(resolve17(rigDir, "tmp"), { recursive: true });
-  mkdirSync7(resolve17(projectRoot, "artifacts"), { recursive: true });
+  mkdirSync8(resolve17(rigDir, "state"), { recursive: true });
+  mkdirSync8(resolve17(rigDir, "logs"), { recursive: true });
+  mkdirSync8(resolve17(rigDir, "runs"), { recursive: true });
+  mkdirSync8(resolve17(rigDir, "tmp"), { recursive: true });
+  mkdirSync8(resolve17(projectRoot, "artifacts"), { recursive: true });
   const taskConfigPath = resolve17(rigDir, "task-config.json");
   if (!existsSync11(taskConfigPath))
-    writeFileSync5(taskConfigPath, `{}
+    writeFileSync6(taskConfigPath, `{}
 `, "utf-8");
 }
 function ensureGitignoreEntries(projectRoot) {
@@ -6510,7 +6972,7 @@ function ensureRigConfigPackageDependencies(projectRoot) {
     ...existsSync11(path) ? existing : { name: "rig-project", private: true },
     devDependencies
   };
-  writeFileSync5(path, `${JSON.stringify(next, null, 2)}
+  writeFileSync6(path, `${JSON.stringify(next, null, 2)}
 `, "utf8");
 }
 function applyGitHubProjectConfig(source, options) {
@@ -6536,9 +6998,9 @@ function checkoutForInit(projectRoot, serverKind, strategy) {
   const selected = strategy ?? { kind: "managed-clone" };
   switch (selected.kind) {
     case "managed-clone":
-      return { kind: "managed-clone", path: projectRoot };
+      return { kind: "managed-clone" };
     case "current-ref":
-      return { kind: "current-ref", path: projectRoot, ...selected.ref ? { ref: selected.ref } : {} };
+      return { kind: "current-ref", ...selected.ref ? { ref: selected.ref } : {} };
     case "uploaded-snapshot":
       return { kind: "uploaded-snapshot", path: projectRoot, source: "local-working-tree" };
     case "existing-path":
@@ -6791,7 +7253,7 @@ function remoteGitHubAuthMetadata(payload) {
   };
 }
 function writeRemoteGitHubAuthState(projectRoot, input) {
-  writeFileSync5(resolve17(projectRoot, ".rig", "state", "github-auth.json"), `${JSON.stringify({
+  writeFileSync6(resolve17(projectRoot, ".rig", "state", "github-auth.json"), `${JSON.stringify({
     authenticated: true,
     source: input.source,
     storedOnServer: true,
@@ -6839,7 +7301,7 @@ function runLocalFilesInit(context, options) {
       console.log("rig.config already exists; leaving it unchanged. Pass --repair to rewrite it.");
   } else {
     const projectName = basename3(projectRoot) || "rig-project";
-    writeFileSync5(configTsPath, buildRigInitConfigSource({
+    writeFileSync6(configTsPath, buildRigInitConfigSource({
       projectName,
       taskSource: { kind: "files", path: "tasks" },
       useStandardPlugin: true
@@ -6848,8 +7310,8 @@ function runLocalFilesInit(context, options) {
   ensureRigConfigPackageDependencies(projectRoot);
   const tasksDir = resolve17(projectRoot, "tasks");
   if (!existsSync11(tasksDir)) {
-    mkdirSync7(tasksDir, { recursive: true });
-    writeFileSync5(resolve17(tasksDir, "T-1.json"), `${JSON.stringify({ id: "T-1", title: "My first Rig task", body: "Describe the change you want an agent to make." }, null, 2)}
+    mkdirSync8(tasksDir, { recursive: true });
+    writeFileSync6(resolve17(tasksDir, "T-1.json"), `${JSON.stringify({ id: "T-1", title: "My first Rig task", body: "Describe the change you want an agent to make." }, null, 2)}
 `, "utf-8");
   }
   if (context.outputMode !== "json") {
@@ -6873,7 +7335,7 @@ function runDemoInit(context, options) {
       console.log("rig.config already exists; leaving it unchanged. Pass --repair to rewrite it for the demo.");
     }
   } else {
-    writeFileSync5(configTsPath, buildRigInitConfigSource({
+    writeFileSync6(configTsPath, buildRigInitConfigSource({
       projectName: basename3(projectRoot) || "rig-demo",
       taskSource: { kind: "files", path: DEMO_TASKS_RELATIVE_DIR },
       useStandardPlugin: true
@@ -6882,14 +7344,14 @@ function runDemoInit(context, options) {
   }
   ensureRigConfigPackageDependencies(projectRoot);
   const demoTasksDir = resolve17(projectRoot, DEMO_TASKS_RELATIVE_DIR);
-  mkdirSync7(demoTasksDir, { recursive: true });
+  mkdirSync8(demoTasksDir, { recursive: true });
   const taskIds = [];
   for (const task of DEMO_TASKS) {
     const id = String(task.id);
     taskIds.push(id);
     const taskPath = resolve17(demoTasksDir, `${id}.json`);
     if (!existsSync11(taskPath)) {
-      writeFileSync5(taskPath, `${JSON.stringify(task, null, 2)}
+      writeFileSync6(taskPath, `${JSON.stringify(task, null, 2)}
 `, "utf-8");
     }
   }
@@ -6917,21 +7379,32 @@ function runDemoInit(context, options) {
 }
 async function runControlPlaneInit(context, options) {
   const projectRoot = context.projectRoot;
-  const detectedSlug = options.repoSlug ?? detectOriginRepoSlug(projectRoot);
+  const existingRepoConnection = readRepoConnection(projectRoot);
+  const selectedConnection = (() => {
+    try {
+      return resolveSelectedConnection(projectRoot);
+    } catch {
+      return null;
+    }
+  })();
+  const selectedRemote = selectedConnection?.connection.kind === "remote" ? { alias: selectedConnection.alias, connection: selectedConnection.connection } : null;
+  const detectedSlug = options.repoSlug ?? existingRepoConnection?.project ?? detectOriginRepoSlug(projectRoot);
+  const serverKind = options.server ?? (selectedRemote ? "remote" : "local");
   if (!detectedSlug) {
     const authMethod2 = options.githubAuthMethod ?? (options.githubToken ? "token" : "skip");
-    if ((options.server ?? "local") === "local" && authMethod2 === "skip") {
+    if (serverKind === "local" && authMethod2 === "skip") {
       return runLocalFilesInit(context, options);
     }
     throw new CliError("Could not detect GitHub repo slug from origin. Pass --repo owner/repo \u2014 or run `rig init --yes --server local --github-auth skip` for a local files-source project without GitHub.", 1);
   }
   const repo = parseRepoSlug(detectedSlug);
-  const serverKind = options.server ?? "local";
-  const connectionAlias = options.connectionAlias ?? (serverKind === "local" ? "local" : "remote");
+  const connectionAlias = options.connectionAlias ?? (serverKind === "local" ? "local" : selectedRemote?.alias ?? "remote");
+  const selectedRemoteUrl = selectedRemote && (!options.connectionAlias || options.connectionAlias === selectedRemote.alias) ? selectedRemote.connection.baseUrl : undefined;
+  const remoteUrl = serverKind === "remote" ? (options.remoteUrl ?? selectedRemoteUrl)?.replace(/\/+$/, "") : undefined;
   if (serverKind === "remote") {
-    if (!options.remoteUrl)
-      throw new CliError("Missing --remote-url for --server remote.", 1, { hint: "Re-run as `rig init --server remote --remote-url https://your-rig-server`." });
-    upsertGlobalConnection(connectionAlias, { kind: "remote", baseUrl: options.remoteUrl });
+    if (!remoteUrl)
+      throw new CliError("Missing --remote-url for --server remote.", 1, { hint: "Re-run as `rig init --server remote --remote-url https://your-rig-server`, or first select a saved remote with `rig server use <alias>`." });
+    upsertGlobalConnection(connectionAlias, { kind: "remote", baseUrl: remoteUrl });
   }
   writeRepoConnection(projectRoot, {
     selected: connectionAlias,
@@ -6954,11 +7427,11 @@ async function runControlPlaneInit(context, options) {
         taskSource: { kind: "github-issues", owner: repo.owner, repo: repo.repo },
         useStandardPlugin: true
       }), options);
-      writeFileSync5(configTsPath, source, "utf-8");
+      writeFileSync6(configTsPath, source, "utf-8");
     }
     ensureRigConfigPackageDependencies(projectRoot);
   }
-  writeFileSync5(resolve17(projectRoot, ".rig", "state", "project-link.json"), `${JSON.stringify({ repoSlug: repo.slug, connection: connectionAlias, linkedAt: new Date().toISOString() }, null, 2)}
+  writeFileSync6(resolve17(projectRoot, ".rig", "state", "project-link.json"), `${JSON.stringify({ repoSlug: repo.slug, connection: connectionAlias, linkedAt: new Date().toISOString() }, null, 2)}
 `, "utf8");
   const checkout = checkoutForInit(projectRoot, serverKind, options.remoteCheckout);
   let uploadedSnapshot = null;
@@ -6973,7 +7446,7 @@ async function runControlPlaneInit(context, options) {
   let githubAuth = null;
   let deviceAuth = null;
   const authMethod = options.githubAuthMethod ?? (options.githubToken ? "token" : "skip");
-  const remoteGhTokenWarning = serverKind === "remote" && authMethod === "gh" ? `This sends a GitHub token from this machine to ${options.remoteUrl ?? "the remote Rig server"}.` : null;
+  const remoteGhTokenWarning = serverKind === "remote" && authMethod === "gh" ? `This sends a GitHub token from this machine to ${remoteUrl ?? "the remote Rig server"}.` : null;
   if (remoteGhTokenWarning && !options.yes) {
     throw new CliError(`${remoteGhTokenWarning} Re-run with --yes to confirm this explicit token transfer.`, 1);
   }
@@ -7353,8 +7826,8 @@ var init_init = __esm(() => {
 
 // packages/cli/src/commands/github.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname4, resolve as resolve18 } from "path";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname5, resolve as resolve18 } from "path";
 function printPayload(context, payload, fallback) {
   if (context.outputMode === "json")
     console.log(JSON.stringify(payload, null, 2));
@@ -7393,8 +7866,8 @@ function persistRemoteAuthSession(context, source, result, fallbackToken) {
     return;
   const repo = readRepoConnection(context.projectRoot);
   const path = resolve18(context.projectRoot, ".rig", "state", "github-auth.json");
-  mkdirSync8(dirname4(path), { recursive: true });
-  writeFileSync6(path, `${JSON.stringify({
+  mkdirSync9(dirname5(path), { recursive: true });
+  writeFileSync7(path, `${JSON.stringify({
     authenticated: true,
     source,
     storedOnServer: true,
@@ -8905,7 +9378,7 @@ __export(exports__pi_frontend, {
   buildOperatorPiEnv: () => buildOperatorPiEnv,
   attachRunBundledPiFrontend: () => attachRunBundledPiFrontend
 });
-import { existsSync as existsSync14, mkdirSync as mkdirSync9, mkdtempSync, readFileSync as readFileSync10, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync10, mkdtempSync, readFileSync as readFileSync10, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "fs";
 import { homedir as homedir6, tmpdir } from "os";
 import { join as join3 } from "path";
 import { main as runPiMain } from "@earendil-works/pi-coding-agent";
@@ -8957,7 +9430,7 @@ function statusFromRunDetails(run) {
 async function prepareOperatorConsole(context, runId, tempSessionDir) {
   const server = await ensureServerForCli(context.projectRoot);
   const localCwd = join3(homedir6(), ".rig", "drones", runId.slice(0, 8));
-  mkdirSync9(localCwd, { recursive: true });
+  mkdirSync10(localCwd, { recursive: true });
   trustDroneCwd(localCwd);
   installRigPiTheme();
   let sessionFileArg = [];
@@ -8979,7 +9452,7 @@ async function prepareOperatorConsole(context, runId, tempSessionDir) {
         return line;
       }).join(`
 `);
-      writeFileSync7(localSessionPath, content);
+      writeFileSync8(localSessionPath, content);
       sessionFileArg = ["--session", localSessionPath];
     }
   } catch {}
@@ -8995,12 +9468,12 @@ async function prepareOperatorConsole(context, runId, tempSessionDir) {
 function trustDroneCwd(localCwd) {
   try {
     const agentDir = join3(homedir6(), ".pi", "agent");
-    mkdirSync9(agentDir, { recursive: true });
+    mkdirSync10(agentDir, { recursive: true });
     const trustPath = join3(agentDir, "trust.json");
     const store = existsSync14(trustPath) ? JSON.parse(readFileSync10(trustPath, "utf8")) : {};
     if (store[localCwd] !== true) {
       store[localCwd] = true;
-      writeFileSync7(trustPath, `${JSON.stringify(store, null, "\t")}
+      writeFileSync8(trustPath, `${JSON.stringify(store, null, "\t")}
 `);
     }
   } catch {}
@@ -9008,12 +9481,12 @@ function trustDroneCwd(localCwd) {
 function installRigPiTheme() {
   try {
     const themesDir = join3(homedir6(), ".pi", "agent", "themes");
-    mkdirSync9(themesDir, { recursive: true });
+    mkdirSync10(themesDir, { recursive: true });
     const themePath = join3(themesDir, "rig.json");
     const next = `${JSON.stringify(RIG_PI_THEME, null, "\t")}
 `;
     if (!existsSync14(themePath) || readFileSync10(themePath, "utf8") !== next) {
-      writeFileSync7(themePath, next);
+      writeFileSync8(themePath, next);
     }
   } catch {}
 }
@@ -9797,13 +10270,46 @@ function parseConnection(alias, value, options) {
   }
   return { kind: "remote", baseUrl: parsed.toString().replace(/\/+$/, "") };
 }
-function printJsonOrText(context, payload, text2) {
-  if (context.outputMode === "json") {
-    console.log(JSON.stringify(payload, null, 2));
-  } else {
+function printJsonOrText(context, _payload, text2) {
+  if (context.outputMode !== "json") {
     console.log(text2);
   }
 }
+function formatRemoteProjectLinkText(result) {
+  return formatSuccessCard(result.ok ? "Remote project link ready" : "Remote project link needs repair", [
+    ["selected", result.alias ?? "remote"],
+    ["target", result.baseUrl ?? "unknown"],
+    ["repo", result.repoSlug ?? "owner/repo"],
+    ["status", result.status],
+    ...result.serverProjectRoot ? [["server root", result.serverProjectRoot]] : [],
+    ["next", result.ok ? result.next ?? "rig task list" : result.hint]
+  ]);
+}
+function parseRepairLinkArgs(rest, usage) {
+  let repoSlug;
+  let mode = "prepare-if-missing";
+  const pending = [...rest];
+  while (pending.length > 0) {
+    const token = pending.shift();
+    if (token === "--repo") {
+      const value = pending.shift()?.trim();
+      if (!value)
+        throw new CliError(`Missing --repo value. Usage: ${usage}`, 1);
+      const normalized = normalizeRepoSlug(value);
+      if (!normalized)
+        throw new CliError(`Invalid --repo value: ${value}`, 1, { hint: "Use the canonical owner/repo slug, e.g. `--repo humanity-org/humanwork`." });
+      repoSlug = normalized;
+    } else if (token === "--backfill-only") {
+      mode = "backfill-only";
+    } else if (token === "--prepare") {
+      mode = "prepare-if-missing";
+    } else {
+      throw new CliError(`Unexpected argument: ${String(token)}
+Usage: ${usage}`, 1);
+    }
+  }
+  return { repoSlug, mode };
+}
 async function promptForConnectionAlias(context) {
   const state = readGlobalConnections();
   const repo = readRepoConnection(context.projectRoot);
@@ -9857,37 +10363,67 @@ async function executeConnectionCommand(context, args, options) {
       }
       if (!alias)
         throw new CliError(`Missing alias. Usage: ${usageName(options)} use <alias|local>`, 1);
+      let selectedConnection = { kind: "local", mode: "auto" };
       if (alias !== "local") {
         const state = readGlobalConnections();
-        if (!state.connections[alias])
+        const connection = state.connections[alias];
+        if (!connection)
           throw new CliError(`Unknown Rig server: ${alias}`, 1, { hint: "Run `rig server list` to see saved aliases, or save one with `rig server add <alias> <url>`." });
+        selectedConnection = connection;
       }
       const previousRepo = readRepoConnection(context.projectRoot);
+      const preserveRemoteRoot = Boolean(previousRepo?.serverProjectRoot && previousRepo.selected === alias && selectedConnection.kind === "remote" && previousRepo.serverProjectRootAlias === alias && previousRepo.serverProjectRootBaseUrl === selectedConnection.baseUrl);
       const repoState = {
         selected: alias,
         ...previousRepo?.project ? { project: previousRepo.project } : {},
         linkedAt: new Date().toISOString(),
-        ...previousRepo?.serverProjectRoot && previousRepo.selected === alias ? { serverProjectRoot: previousRepo.serverProjectRoot } : {}
+        ...preserveRemoteRoot ? {
+          serverProjectRoot: previousRepo.serverProjectRoot,
+          serverProjectRootAlias: previousRepo.serverProjectRootAlias,
+          serverProjectRootBaseUrl: previousRepo.serverProjectRootBaseUrl
+        } : {}
       };
       writeRepoConnection(context.projectRoot, repoState);
-      printJsonOrText(context, repoState, formatSuccessCard("Rig server selected", [
+      const remoteProjectLink = alias !== "local" ? await ensureRemoteProjectRootLink(context.projectRoot, { mode: "backfill-only" }).catch((error) => ({
+        ok: false,
+        status: "error",
+        message: error instanceof Error ? error.message : String(error),
+        hint: "Run `rig server repair-link` after authenticating the selected remote."
+      })) : null;
+      const latestRepo = readRepoConnection(context.projectRoot);
+      const details = { selected: latestRepo?.selected ?? alias, repo: latestRepo, remoteProjectLink };
+      printJsonOrText(context, details, formatSuccessCard("Rig server selected", [
         ["selected", alias],
         ["scope", "this repo"],
-        ["next", "rig task list"]
+        ...remoteProjectLink ? [["remote link", remoteProjectLink.ok ? `ready (${remoteProjectLink.serverProjectRoot ?? "linked"})` : `${remoteProjectLink.status}: ${remoteProjectLink.hint}`]] : [],
+        ["next", remoteProjectLink && !remoteProjectLink.ok ? "rig server repair-link" : "rig task list"]
       ]));
-      return { ok: true, group: options.group, command: "use", details: repoState };
+      return { ok: true, group: options.group, command: "use", details };
+    }
+    case "repair-link": {
+      const parsed = parseRepairLinkArgs(rest, `${usageName(options)} repair-link [--prepare|--backfill-only] [--repo owner/repo]`);
+      const result = await repairRemoteProjectRootLink(context, parsed);
+      printJsonOrText(context, result, formatRemoteProjectLinkText(result));
+      return { ok: true, group: options.group, command: "repair-link", details: result };
     }
     case "status": {
       requireNoExtraArgs(rest, `${usageName(options)} status`);
       const repo = readRepoConnection(context.projectRoot);
       const global = readGlobalConnections();
-      const details = { selected: repo?.selected ?? "local", repo, connections: global.connections };
-      printJsonOrText(context, details, formatConnectionStatus(details.selected, global.connections));
+      const remoteProjectLink = repo?.selected && repo.selected !== "local" ? await ensureRemoteProjectRootLink(context.projectRoot, { mode: "backfill-only" }).catch((error) => ({
+        ok: false,
+        status: "error",
+        message: error instanceof Error ? error.message : String(error),
+        hint: "Run `rig server repair-link` after authenticating the selected remote."
+      })) : null;
+      const latestRepo = readRepoConnection(context.projectRoot) ?? repo;
+      const details = { selected: latestRepo?.selected ?? "local", repo: latestRepo, connections: global.connections, remoteProjectLink };
+      printJsonOrText(context, details, formatConnectionStatus(details.selected, global.connections, latestRepo ?? null, remoteProjectLink));
       return { ok: true, group: options.group, command: "status", details };
     }
     default:
       throw new CliError(`Unknown ${options.group} command: ${String(command)}
-Usage: ${usageName(options)} <list|add|use|status>`, 1);
+Usage: ${usageName(options)} <list|add|use|status|repair-link>`, 1);
   }
 }
 var init_connect = __esm(() => {
@@ -9895,13 +10431,14 @@ var init_connect = __esm(() => {
   init_runner();
   init__connection_state();
   init__cli_format();
+  init__server_client();
 });
 
 // packages/cli/src/commands/server.ts
 import { resolveRigServerCommand } from "@rig/runtime/local-server";
 async function executeServer(context, args, options) {
   const [command = "status", ...rest] = args;
-  if (["status", "list", "add", "use"].includes(command)) {
+  if (["status", "list", "add", "use", "repair-link"].includes(command)) {
     return executeConnectionCommand(context, [command, ...rest], { group: "server", interactiveUse: true });
   }
   switch (command) {
@@ -10688,7 +11225,7 @@ var init_task = __esm(() => {
 });
 
 // packages/cli/src/commands/task-run-driver.ts
-import { copyFileSync as copyFileSync3, existsSync as existsSync15, mkdirSync as mkdirSync10, readFileSync as readFileSync12, statSync as statSync2, writeFileSync as writeFileSync8 } from "fs";
+import { copyFileSync as copyFileSync3, existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync12, statSync as statSync2, writeFileSync as writeFileSync9 } from "fs";
 import { resolve as resolve23 } from "path";
 import { spawn as spawn2, spawnSync as spawnSync4 } from "child_process";
 import { createInterface as createLineInterface } from "readline";
@@ -10791,7 +11328,7 @@ function copyUntrackedDirtyFiles(sourceRoot, targetRoot) {
     try {
       if (!statSync2(sourcePath).isFile())
         continue;
-      mkdirSync10(resolve23(targetPath, ".."), { recursive: true });
+      mkdirSync11(resolve23(targetPath, ".."), { recursive: true });
       copyFileSync3(sourcePath, targetPath);
       copied += 1;
     } catch {}
@@ -11662,8 +12199,8 @@ async function executeRigOwnedTaskRun(context, input) {
     artifactPath: planningClassification.planningRequired ? planningArtifactPath : null,
     classifiedAt: new Date().toISOString()
   };
-  mkdirSync10(resolve23(context.projectRoot, ".rig", "runs", input.runId), { recursive: true });
-  writeFileSync8(resolve23(context.projectRoot, ".rig", "runs", input.runId, "planning-classification.json"), `${JSON.stringify(persistedPlanning, null, 2)}
+  mkdirSync11(resolve23(context.projectRoot, ".rig", "runs", input.runId), { recursive: true });
+  writeFileSync9(resolve23(context.projectRoot, ".rig", "runs", input.runId, "planning-classification.json"), `${JSON.stringify(persistedPlanning, null, 2)}
 `, "utf8");
   patchAuthorityRun(context.projectRoot, input.runId, { planning: persistedPlanning });
   prompt = `${prompt}
@@ -11810,8 +12347,8 @@ ${planningClassification.planningRequired ? `Before implementing, write a concis
         const dirty = applyDirtyBaselineSnapshot({ sourceRoot: context.projectRoot, targetRoot: latestRuntimeWorkspace });
         const readyFile = childEnv.RIG_DIRTY_BASELINE_READY_FILE;
         if (readyFile) {
-          mkdirSync10(resolve23(readyFile, ".."), { recursive: true });
-          writeFileSync8(readyFile, `${JSON.stringify({ ...dirty, workspaceDir: latestRuntimeWorkspace, appliedAt: new Date().toISOString() }, null, 2)}
+          mkdirSync11(resolve23(readyFile, ".."), { recursive: true });
+          writeFileSync9(readyFile, `${JSON.stringify({ ...dirty, workspaceDir: latestRuntimeWorkspace, appliedAt: new Date().toISOString() }, null, 2)}
 `, "utf8");
         }
         appendRunLog(context.projectRoot, input.runId, {
@@ -12757,7 +13294,7 @@ var init_test = __esm(() => {
 });
 
 // packages/cli/src/commands/setup.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync11, readdirSync as readdirSync3, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync12, readdirSync as readdirSync3, writeFileSync as writeFileSync10 } from "fs";
 import { resolve as resolve24 } from "path";
 import { createPluginHost } from "@rig/core";
 import {
@@ -12812,12 +13349,12 @@ function runSetupInit(projectRoot) {
   const stateDir = resolveControlPlaneHostStateDir(projectRoot);
   const logsDir = resolveControlPlaneHostLogsDir(projectRoot);
   const artifactsDir = resolveControlPlaneArtifactsDir(projectRoot);
-  mkdirSync11(stateDir, { recursive: true });
-  mkdirSync11(logsDir, { recursive: true });
-  mkdirSync11(artifactsDir, { recursive: true });
+  mkdirSync12(stateDir, { recursive: true });
+  mkdirSync12(logsDir, { recursive: true });
+  mkdirSync12(artifactsDir, { recursive: true });
   const failuresPath = resolve24(stateDir, "failed_approaches.md");
   if (!existsSync16(failuresPath)) {
-    writeFileSync9(failuresPath, `# Failed Approaches
+    writeFileSync10(failuresPath, `# Failed Approaches
 
 `, "utf-8");
   }
@@ -16007,6 +16544,7 @@ async function stopRunFromDetail(ctx, runId) {
 }
 
 // packages/cli/src/app-opentui/adapters/server.ts
+import { spawnSync as spawnSync5 } from "child_process";
 var SERVER_PROBE_TIMEOUT_MS = Number(process.env.RIG_SERVER_PROBE_TIMEOUT_MS) || 5000;
 function withTimeout(promise, ms, label) {
   return new Promise((resolve28, reject) => {
@@ -16044,11 +16582,128 @@ function startLocalRequested(ctx) {
   const action = intent.action;
   return action?.payload?.startLocal === true;
 }
+async function serverAliases(projectRoot) {
+  const { readGlobalConnections: readGlobalConnections2, readRepoConnection: readRepoConnection2 } = await Promise.resolve().then(() => (init__connection_state(), exports__connection_state));
+  const selected = readRepoConnection2(projectRoot)?.selected ?? "local";
+  const global = readGlobalConnections2();
+  const aliases = [{ alias: "local", kind: "local", selected: selected === "local" }];
+  for (const [alias, connection] of Object.entries(global.connections)) {
+    aliases.push({
+      alias,
+      kind: connection.kind,
+      ...connection.kind === "remote" ? { baseUrl: connection.baseUrl } : {},
+      selected: alias === selected
+    });
+  }
+  return aliases;
+}
+function firstString2(parts, offset = 0) {
+  return parts.slice(offset).find((part) => part.trim() && !part.startsWith("-"))?.trim();
+}
+function normalizeUrl(value) {
+  const trimmed = value?.trim().replace(/\/+$/, "");
+  if (!trimmed)
+    return;
+  return /^https?:\/\//i.test(trimmed) ? trimmed : undefined;
+}
+async function useLocalServerFromApp(ctx) {
+  const label = "Selecting local server";
+  emitStarted(ctx, label);
+  try {
+    const projectRoot = projectRootOf(ctx);
+    const { readRepoConnection: readRepoConnection2, writeRepoConnection: writeRepoConnection2 } = await Promise.resolve().then(() => (init__connection_state(), exports__connection_state));
+    const previous = readRepoConnection2(projectRoot);
+    writeRepoConnection2(projectRoot, {
+      selected: "local",
+      ...previous?.project ? { project: previous.project } : {},
+      linkedAt: new Date().toISOString()
+    });
+    emitCompleted(ctx, label, { selected: "local" });
+    return refreshServerStatus(ctx);
+  } catch (error) {
+    emitFailed(ctx, label, error);
+    throw error;
+  }
+}
+async function useRemoteServerFromApp(ctx, alias) {
+  const label = alias ? `Selecting remote ${alias}` : "Selecting remote server";
+  emitStarted(ctx, label);
+  try {
+    const cleanAlias = alias?.trim();
+    if (!cleanAlias)
+      throw new Error("Enter a saved remote alias, or add one with: add remote \u2192 <alias> <https-url>.");
+    const projectRoot = projectRootOf(ctx);
+    const { readGlobalConnections: readGlobalConnections2, readRepoConnection: readRepoConnection2, writeRepoConnection: writeRepoConnection2 } = await Promise.resolve().then(() => (init__connection_state(), exports__connection_state));
+    const connection = readGlobalConnections2().connections[cleanAlias];
+    if (!connection)
+      throw new Error(`Remote alias ${cleanAlias} is not saved yet. Use add remote first.`);
+    if (connection.kind !== "remote")
+      throw new Error(`${cleanAlias} is not a remote server alias.`);
+    const previous = readRepoConnection2(projectRoot);
+    writeRepoConnection2(projectRoot, {
+      selected: cleanAlias,
+      ...previous?.project ? { project: previous.project } : {},
+      linkedAt: new Date().toISOString()
+    });
+    emitCompleted(ctx, label, { selected: cleanAlias, baseUrl: connection.baseUrl });
+    return refreshServerStatus(ctx);
+  } catch (error) {
+    emitFailed(ctx, label, error);
+    throw error;
+  }
+}
+async function addRemoteServerFromApp(ctx, args) {
+  const label = "Adding remote server";
+  emitStarted(ctx, label);
+  try {
+    const alias = firstString2(args, 2);
+    const url = normalizeUrl(firstString2(args, alias ? args.indexOf(alias) + 1 : 3));
+    if (!alias || !url)
+      throw new Error("Add remote expects: <alias> <https-url>. Example: prod https://rig.example.com");
+    const projectRoot = projectRootOf(ctx);
+    const { readRepoConnection: readRepoConnection2, upsertGlobalConnection: upsertGlobalConnection2, writeRepoConnection: writeRepoConnection2 } = await Promise.resolve().then(() => (init__connection_state(), exports__connection_state));
+    upsertGlobalConnection2(alias, { kind: "remote", baseUrl: url });
+    const previous = readRepoConnection2(projectRoot);
+    writeRepoConnection2(projectRoot, {
+      selected: alias,
+      ...previous?.project ? { project: previous.project } : {},
+      linkedAt: new Date().toISOString()
+    });
+    emitCompleted(ctx, label, { alias, baseUrl: url });
+    return refreshServerStatus(ctx);
+  } catch (error) {
+    emitFailed(ctx, label, error);
+    throw error;
+  }
+}
+async function importGitHubAuthFromGhApp(ctx) {
+  const label = "Importing GitHub auth";
+  emitStarted(ctx, label);
+  try {
+    const projectRoot = projectRootOf(ctx);
+    const token = spawnSync5("gh", ["auth", "token"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 1e4 }).stdout.trim();
+    if (!token)
+      throw new Error("Could not read GitHub token from gh. Sign in with gh auth login, then retry import auth.");
+    const runtime = await runtimeOf(ctx);
+    const { postGitHubTokenViaServer: postGitHubTokenViaServer2, setGitHubBearerTokenForCurrentProcess: setGitHubBearerTokenForCurrentProcess2 } = await Promise.resolve().then(() => (init__server_client(), exports__server_client));
+    const { readRepoConnection: readRepoConnection2 } = await Promise.resolve().then(() => (init__connection_state(), exports__connection_state));
+    const selectedRepo = readRepoConnection2(projectRoot)?.project;
+    const payload = await postGitHubTokenViaServer2(runtime, token, selectedRepo ? { selectedRepo } : {});
+    const apiSessionToken = payload && typeof payload === "object" && !Array.isArray(payload) ? payload.apiSessionToken : undefined;
+    setGitHubBearerTokenForCurrentProcess2(typeof apiSessionToken === "string" ? apiSessionToken : token, projectRoot);
+    emitCompleted(ctx, label, { selectedRepo: selectedRepo ?? null });
+    return refreshServerStatus(ctx);
+  } catch (error) {
+    emitFailed(ctx, label, error);
+    throw error;
+  }
+}
 async function startLocalServerFromApp(ctx) {
   const label = "Starting local server";
   emitStarted(ctx, label);
   patchData(ctx, {
     lastIntent: undefined,
+    remoteProjectLink: undefined,
     server: { label: "starting local server", reachable: false, error: "spawning local rig-server (detached)\u2026" }
   });
   try {
@@ -16073,32 +16728,61 @@ async function startLocalServerFromApp(ctx) {
       reachable: false,
       error: error instanceof Error ? error.message : String(error)
     };
-    patchData(ctx, { server: state, lastRefreshError: state.error });
+    patchData(ctx, { server: state, remoteProjectLink: undefined, lastRefreshError: state.error });
     patchFooter(ctx, { server: "unavailable" });
-    emitCompleted(ctx, label, { server: state.label, reachable: false, error: state.error });
+    emitCompleted(ctx, label, { serverLabel: state.label, reachable: false, error: state.error });
     return state;
   }
 }
+async function repairRemoteProjectRootLinkFromApp(ctx) {
+  const label = "Repairing remote project link";
+  emitStarted(ctx, label);
+  try {
+    const projectRoot = projectRootOf(ctx);
+    const { ensureRemoteProjectRootLink: ensureRemoteProjectRootLink2 } = await Promise.resolve().then(() => (init__server_client(), exports__server_client));
+    emitProgress(ctx, label, "backfilling or preparing server-host checkout");
+    const result = await ensureRemoteProjectRootLink2(projectRoot, { mode: "prepare-if-missing" });
+    patchData(ctx, { remoteProjectLink: result, server: { label: result.alias ?? "remote", baseUrl: result.baseUrl, kind: "remote", reachable: result.status !== "not_remote", remoteProjectLink: result } });
+    patchFooter(ctx, { server: result.alias ?? "remote", message: `remote link ${result.status}` });
+    if (!result.ok) {
+      const error = new Error(result.message);
+      error.hint = result.hint;
+      patchData(ctx, { lastRefreshError: result.message });
+      throw error;
+    }
+    emitCompleted(ctx, label, { repoSlug: result.repoSlug, serverProjectRoot: result.serverProjectRoot, status: result.status });
+    return result;
+  } catch (error) {
+    const message2 = error instanceof Error ? error.message : String(error);
+    const existing = ctx.getState().data?.remoteProjectLink;
+    const remoteProjectLink = existing && typeof existing === "object" && !Array.isArray(existing) ? existing : { ok: false, status: "error", message: message2 };
+    patchData(ctx, { lastRefreshError: message2, remoteProjectLink });
+    emitCompleted(ctx, label, { ok: false, error: message2, remoteProjectLink });
+    throw error;
+  }
+}
 async function refreshServerStatus(ctx) {
   if (startLocalRequested(ctx)) {
     return startLocalServerFromApp(ctx);
   }
   const label = "Checking server";
   emitStarted(ctx, label);
-  patchData(ctx, { server: { label: "checking selected server", reachable: false, error: "checking selected server\u2026" } });
+  patchData(ctx, { server: { label: "checking selected server", reachable: false, error: "checking selected server\u2026" }, remoteProjectLink: undefined });
   const started = Date.now();
   try {
-    const { ensureServerForCli: ensureServerForCli2, requestServerJson: requestServerJson2, resolveServerConnectionLabel: resolveServerConnectionLabel2 } = await Promise.resolve().then(() => (init__server_client(), exports__server_client));
+    const { ensureRemoteProjectRootLink: ensureRemoteProjectRootLink2, ensureServerForCli: ensureServerForCli2, requestServerJson: requestServerJson2, resolveServerConnectionLabel: resolveServerConnectionLabel2 } = await Promise.resolve().then(() => (init__server_client(), exports__server_client));
     const projectRoot = projectRootOf(ctx);
+    const aliases = await serverAliases(projectRoot);
     emitProgress(ctx, label, "resolving selected server");
     const [connectionLabel, server] = await Promise.all([
       resolveServerConnectionLabel2(projectRoot),
       withTimeout(ensureServerForCli2(projectRoot), 5000, "server connection")
     ]);
     emitProgress(ctx, label, "requesting server status", { baseUrl: server.baseUrl, kind: server.connectionKind });
-    const [status, auth] = await Promise.all([
+    const [status, auth, remoteProjectLink] = await Promise.all([
       withRetry("server status", () => withTimeout(requestServerJson2({ projectRoot }, "/api/server/status"), SERVER_PROBE_TIMEOUT_MS, "server status")).catch((error) => ({ ok: false, error: error instanceof Error ? error.message : String(error) })),
-      withRetry("github auth status", () => withTimeout(requestServerJson2({ projectRoot }, "/api/github/auth/status"), SERVER_PROBE_TIMEOUT_MS, "github auth status")).catch((error) => ({ ok: false, error: error instanceof Error ? error.message : String(error) }))
+      withRetry("github auth status", () => withTimeout(requestServerJson2({ projectRoot }, "/api/github/auth/status"), SERVER_PROBE_TIMEOUT_MS, "github auth status")).catch((error) => ({ ok: false, error: error instanceof Error ? error.message : String(error) })),
+      server.connectionKind === "remote" ? withTimeout(ensureRemoteProjectRootLink2(projectRoot, { mode: "backfill-only", authToken: server.authToken }), SERVER_PROBE_TIMEOUT_MS, "remote project link").catch((error) => ({ ok: false, status: "error", message: error instanceof Error ? error.message : String(error) })) : Promise.resolve(null)
     ]);
     const state = {
       label: connectionLabel,
@@ -16107,22 +16791,25 @@ async function refreshServerStatus(ctx) {
       reachable: true,
       latencyMs: Date.now() - started,
       status: status && typeof status === "object" && !Array.isArray(status) ? status : {},
-      auth: auth && typeof auth === "object" && !Array.isArray(auth) ? auth : {}
+      auth: auth && typeof auth === "object" && !Array.isArray(auth) ? auth : {},
+      aliases,
+      ...remoteProjectLink && typeof remoteProjectLink === "object" && !Array.isArray(remoteProjectLink) ? { remoteProjectLink } : {}
     };
-    patchData(ctx, { server: state });
+    patchData(ctx, { server: state, remoteProjectLink: state.remoteProjectLink });
     patchFooter(ctx, { server: connectionLabel, latency: `${state.latencyMs}ms` });
-    emitCompleted(ctx, label, { server: connectionLabel, latencyMs: state.latencyMs });
+    emitCompleted(ctx, label, { serverLabel: connectionLabel, latencyMs: state.latencyMs });
     return state;
   } catch (error) {
     const state = {
       label: "server unavailable",
       reachable: false,
       latencyMs: Date.now() - started,
+      aliases: await serverAliases(projectRootOf(ctx)).catch(() => []),
       error: error instanceof Error ? error.message : String(error)
     };
-    patchData(ctx, { server: state });
+    patchData(ctx, { server: state, remoteProjectLink: undefined });
     patchFooter(ctx, { server: "unavailable" });
-    emitCompleted(ctx, label, { server: state.label, reachable: false, error: state.error });
+    emitCompleted(ctx, label, { serverLabel: state.label, reachable: false, error: state.error });
     return state;
   }
 }
@@ -16992,7 +17679,7 @@ function withSelectable(line2, item) {
 var DOCTOR_ACTIONS = [
   { detail: "run diagnostics now", item: { id: "run", label: "run", intent: { scene: "doctor", argv: ["doctor"], action: { kind: "doctor-run", label: "Run doctor" } }, message: "run diagnostics" } },
   { detail: "open server controls", item: { id: "server", label: "server", intent: { scene: "server", argv: ["server", "status"], action: { kind: "refresh", label: "Open server controls" } }, message: "open server controls" } },
-  { detail: "repair project/server/auth link", item: { id: "repair", label: "repair", intent: { scene: "command", argv: ["init", "--repair"], action: { kind: "command-run", label: "Repair project link" } }, message: "repair project link" } },
+  { detail: "repair project/server/auth link", item: { id: "repair", label: "repair", intent: { scene: "init", argv: ["init", "--repair", "--yes"], action: { kind: "init-start", label: "Repair project link" } }, message: "repair project link natively" } },
   { detail: "open tasks", item: { id: "tasks", label: "tasks", intent: { scene: "tasks", argv: ["tasks"], action: { kind: "refresh", label: "Open tasks" } }, message: "open tasks" } }
 ];
 function checks(state) {
@@ -17065,6 +17752,48 @@ function renderDoctorScene(state, layout) {
   });
 }
 
+// packages/cli/src/app-opentui/remote-link.ts
+var REPAIRABLE_REMOTE_LINK_STATUSES = new Set([
+  "auth_required",
+  "project_not_registered",
+  "no_server_checkout",
+  "invalid_root",
+  "needs_prepare",
+  "error"
+]);
+function remoteProjectLinkError(message2) {
+  return /no server-host project root link|remote project(?:-root)? link|x-rig-project-root|serverProjectRoot/i.test(message2 ?? "");
+}
+function serverRecordForRemoteLink(state) {
+  const server = state.data.server;
+  return server && typeof server === "object" && !Array.isArray(server) ? server : null;
+}
+function remoteProjectLinkState(state) {
+  const serverRecord = serverRecordForRemoteLink(state);
+  if (!serverRecord || serverRecord.kind !== "remote")
+    return null;
+  const link = serverRecord.remoteProjectLink;
+  if (link && typeof link === "object" && !Array.isArray(link))
+    return link;
+  const direct = state.data.remoteProjectLink;
+  if (direct && typeof direct === "object" && !Array.isArray(direct))
+    return direct;
+  return null;
+}
+function shouldOfferRemoteLinkRepair(state, message2) {
+  const link = remoteProjectLinkState(state);
+  if (link) {
+    if (link.ok === true)
+      return false;
+    const status = link.status ?? "";
+    return REPAIRABLE_REMOTE_LINK_STATUSES.has(status);
+  }
+  const serverRecord = serverRecordForRemoteLink(state);
+  if (serverRecord && serverRecord.kind !== "remote")
+    return false;
+  return remoteProjectLinkError(message2 ?? state.error?.message);
+}
+
 // packages/cli/src/app-opentui/fleet-stats.ts
 var ACTIVE_STATUSES = new Set([
   "running",
@@ -18912,13 +19641,18 @@ function overviewBody(state, family, snap, layout) {
 function familyRecoveryRows(state, family, errorMessage2) {
   const selected = Math.max(0, state.selection.index);
   const intro = errorMessage2 ? line(`\u2717 couldn't load ${family || "this family"} \u2014 ${errorMessage2}`, { fg: RIG_UI.red, bold: true }) : line(`No data for ${family || "this family"} yet.`, { fg: RIG_UI.ink2 });
-  return [
+  const repairRemote = shouldOfferRemoteLinkRepair(state, errorMessage2);
+  const rows = [
     intro,
-    blank(),
-    selectableDeckRow({ label: "retry", detail: `reload ${family || "the family"}`, index: 0, active: selected === 0 }, { id: "family-retry", label: "retry", intent: { scene: "family", argv: [family], action: { kind: "refresh", label: `Reload ${family}`, payload: { family } } }, message: "reload this family" }),
-    selectableDeckRow({ label: "cockpit", detail: "back to the project cockpit", index: 1, active: selected === 1 }, { id: "family-home", label: "cockpit", intent: { scene: "main", argv: [], action: { kind: "refresh", label: "Home" } }, message: "back to the cockpit" }),
-    selectableDeckRow({ label: "doctor", detail: "diagnose project/setup", index: 2, active: selected === 2 }, { id: "family-doctor", label: "doctor", intent: { scene: "doctor", argv: ["doctor"], action: { kind: "doctor-run", label: "Run doctor" } }, message: "diagnose setup" })
+    blank()
   ];
+  let index = 0;
+  if (repairRemote) {
+    rows.push(selectableDeckRow({ label: "repair link", detail: "backfill/prepare selected remote checkout link", index, active: selected === index }, { id: "family-repair-link", label: "repair link", intent: { scene: "server", argv: ["server", "repair-link"], action: { kind: "remote-link-repair", label: "Repair remote link", payload: { returnScene: "family", family } } }, message: "repair remote project link" }));
+    index += 1;
+  }
+  rows.push(selectableDeckRow({ label: "retry", detail: `reload ${family || "the family"}`, index, active: selected === index }, { id: "family-retry", label: "retry", intent: { scene: "family", argv: [family], action: { kind: "refresh", label: `Reload ${family}`, payload: { family } } }, message: "reload this family" }), selectableDeckRow({ label: "cockpit", detail: "back to the project cockpit", index: index + 1, active: selected === index + 1 }, { id: "family-home", label: "cockpit", intent: { scene: "main", argv: [], action: { kind: "refresh", label: "Home" } }, message: "back to the cockpit" }), selectableDeckRow({ label: "doctor", detail: "diagnose project/setup", index: index + 2, active: selected === index + 2 }, { id: "family-doctor", label: "doctor", intent: { scene: "doctor", argv: ["doctor"], action: { kind: "doctor-run", label: "Run doctor" } }, message: "diagnose setup" }));
+  return rows;
 }
 function renderFamilyScene(state, layout) {
   const family = typeof state.data.familyName === "string" ? state.data.familyName : "";
@@ -18927,9 +19661,16 @@ function renderFamilyScene(state, layout) {
   const loading = state.status === "loading" && !snap;
   const errorMessage2 = state.error?.message ?? lastRefreshError(state) ?? undefined;
   const probeFailed = snap ? snap.state.ran === false && Boolean(state.error) : Boolean(state.error);
+  const selected = Math.max(0, state.selection.index);
   const body = [
     ...loading ? loadingRows(family || "family", state.tick) : snap ? [
-      ...probeFailed && errorMessage2 ? [...errorBanner(errorMessage2), blank()] : [],
+      ...probeFailed && errorMessage2 ? [
+        ...errorBanner(errorMessage2),
+        ...shouldOfferRemoteLinkRepair(state, errorMessage2) ? [
+          selectableDeckRow({ label: "repair link", detail: "backfill/prepare selected remote checkout link", index: 0, active: selected === 0 }, { id: "family-repair-link", label: "repair link", intent: { scene: "server", argv: ["server", "repair-link"], action: { kind: "remote-link-repair", label: "Repair remote link", payload: { returnScene: "family", family } } }, message: "repair remote project link" })
+        ] : [],
+        blank()
+      ] : [],
       ...current.subId ? formView(state, family, snap, current).lines : overviewBody(state, family, snap, layout)
     ] : familyRecoveryRows(state, family, errorMessage2)
   ];
@@ -19076,12 +19817,12 @@ function sortTasks2(tasks, spec) {
 }
 
 // packages/cli/src/app-opentui/scenes/fleet.ts
-var FLEET_RECOVERY_ITEMS = [
+var BASE_FLEET_RECOVERY_ITEMS = [
   { id: "tasks", label: "tasks", intent: { scene: "tasks", argv: ["tasks"], action: { kind: "refresh", label: "Open tasks" } }, message: "open tasks and dispatch work" },
-  { id: "repair", label: "repair", intent: { scene: "command", argv: ["init", "--repair"], action: { kind: "command-run", label: "Repair project link" } }, message: "repair project/server/auth link" },
   { id: "server", label: "server", intent: { scene: "server", argv: ["server", "status"], action: { kind: "refresh", label: "Open server controls" } }, message: "server controls" },
   { id: "doctor", label: "doctor", intent: { scene: "doctor", argv: ["doctor"], action: { kind: "doctor-run", label: "Run doctor" } }, message: "diagnose project" }
 ];
+var FLEET_REPAIR_LINK_ITEM = { id: "repair-link", label: "repair link", intent: { scene: "server", argv: ["server", "repair-link"], action: { kind: "remote-link-repair", label: "Repair remote link", payload: { returnScene: "fleet" } } }, message: "backfill or prepare remote project link" };
 var COL2 = {
   glyph: 1,
   runId: 8,
@@ -19246,33 +19987,43 @@ function runRow(width, run, active, optimistic) {
   const item = runSelectableItem(run);
   return item ? withSelectable(row, item) : row;
 }
-var RECOVERY_DECKS = [
+var BASE_RECOVERY_DECKS = [
   { label: "tasks", detail: "open tasks and dispatch work" },
-  { label: "repair", detail: "repair project/server/auth link" },
   { label: "server", detail: "open server controls" },
   { label: "doctor", detail: "diagnose project" }
 ];
-function recoveryRows(selected, reason) {
+function fleetRecoveryItems(state) {
+  if (!shouldOfferRemoteLinkRepair(state))
+    return BASE_FLEET_RECOVERY_ITEMS;
+  return [BASE_FLEET_RECOVERY_ITEMS[0], FLEET_REPAIR_LINK_ITEM, ...BASE_FLEET_RECOVERY_ITEMS.slice(1)];
+}
+function fleetRecoveryDecks(state) {
+  if (!shouldOfferRemoteLinkRepair(state))
+    return BASE_RECOVERY_DECKS;
+  return [BASE_RECOVERY_DECKS[0], { label: "repair link", detail: "backfill/prepare remote project-root link" }, ...BASE_RECOVERY_DECKS.slice(1)];
+}
+function recoveryRows(state, selected, reason) {
+  const items = fleetRecoveryItems(state);
   return [
     ...reason ? [line(reason, { fg: RIG_UI.yellow }), line("", { fg: RIG_UI.ink3 })] : [],
     line("ACTIONS", { fg: RIG_UI.ink3, bold: true }),
-    ...RECOVERY_DECKS.map((deck, index) => selectableDeckRow({ ...deck, index, active: selected === index }, FLEET_RECOVERY_ITEMS[index]))
+    ...fleetRecoveryDecks(state).map((deck, index) => selectableDeckRow({ ...deck, index, active: selected === index }, items[index]))
   ];
 }
-function emptyRows(query, total, selected) {
+function emptyRows(state, query, total, selected) {
   if (!query.trim() && total === 0)
-    return recoveryRows(selected, "No runs yet.");
+    return recoveryRows(state, selected, "No runs yet.");
   if (query.trim() && total > 0) {
     return [
-      ...recoveryRows(selected, `No matching runs for ${JSON.stringify(query)} (${total} total).`)
+      ...recoveryRows(state, selected, `No matching runs for ${JSON.stringify(query)} (${total} total).`)
     ];
   }
-  return recoveryRows(selected, "No runs are visible with this filter.");
+  return recoveryRows(state, selected, "No runs are visible with this filter.");
 }
 function degradedRows(state, selected) {
   if (!state.error)
     return [];
-  return recoveryRows(selected, state.error.message);
+  return recoveryRows(state, selected, state.error.message);
 }
 function renderFleetScene(state, layout) {
   const width = panelWidth4(layout);
@@ -19282,7 +20033,7 @@ function renderFleetScene(state, layout) {
   const runs = sortRuns(filterRunsForSearch(allRuns, query), spec);
   const selectedRun = typeof state.data.selectedRunId === "string" && runs.some((run) => run.runId === state.data.selectedRunId) ? state.data.selectedRunId : runs[0]?.runId;
   const selectedIndex = Math.max(0, runs.findIndex((run) => run.runId === selectedRun));
-  const recoveryIndex = Math.max(0, Math.min(3, state.selection.index));
+  const recoveryIndex = Math.max(0, Math.min(fleetRecoveryItems(state).length - 1, state.selection.index));
   const optimistic = optimisticStatuses(state);
   const updatedAgo = updatedAgoLabel(state);
   const panelTop = 0;
@@ -19314,7 +20065,7 @@ function renderFleetScene(state, layout) {
       ...runs.map((run, index) => runRow(contentWidth, run, index === selectedIndex, optimistic.get(run.runId)))
     ] : state.error ? degradedRows(state, recoveryIndex) : loading ? loadingRows("runs", state.tick) : [
       ...query.trim() ? [line(searchSummary("runs", query, runs.length, allRuns.length), { fg: RIG_UI.ink4 }), line("", { fg: RIG_UI.ink3 })] : [],
-      ...emptyRows(query, allRuns.length, recoveryIndex)
+      ...emptyRows(state, query, allRuns.length, recoveryIndex)
     ]
   ];
   return makeSceneFrame({
@@ -19869,19 +20620,19 @@ function renderInboxScene(state, layout) {
 }
 
 // packages/cli/src/app-opentui/scenes/init.ts
-var STEP_CONFIG_RUN = { id: "step-config", label: "run setup wizard", intent: { scene: "command", argv: ["init"], action: { kind: "command-run", label: "Run setup wizard" } }, message: "full interactive setup wizard" };
+var STEP_CONFIG_RUN = { id: "step-config", label: "run init", intent: { scene: "init", argv: ["init", "--yes"], action: { kind: "init-start", label: "Run init" } }, message: "initialize without embedded CLI prompts" };
 var STEP_SERVER = { id: "step-server", label: "select server", intent: { scene: "server", argv: ["server", "status"], action: { kind: "refresh", label: "Choose server" } }, message: "select local or remote server" };
-var STEP_AUTH = { id: "step-auth", label: "connect GitHub", intent: { scene: "command", argv: ["github", "auth", "import-gh"], action: { kind: "command-run", label: "Connect GitHub" } }, message: "import GitHub auth into the selected server" };
-var STEP_TASKS = { id: "step-tasks", label: "pick a task source", intent: { scene: "command", argv: ["init", "--repair"], action: { kind: "command-run", label: "Configure task source" } }, message: "configure or repair the task source" };
+var STEP_AUTH = { id: "step-auth", label: "connect GitHub", intent: { scene: "server", argv: ["github", "auth", "status"], action: { kind: "refresh", label: "Open GitHub auth" } }, message: "open native server/auth controls" };
+var STEP_TASKS = { id: "step-tasks", label: "repair task source", intent: { scene: "init", argv: ["init", "--repair", "--yes"], action: { kind: "init-start", label: "Repair task source" } }, message: "repair generated task-source config without embedded CLI prompts" };
 var SETUP_STEPS = [
-  { id: "config", label: "Project config", detail: "rig.config + private state", done: (s) => s.configured, cta: "Run setup wizard", item: STEP_CONFIG_RUN },
+  { id: "config", label: "Project config", detail: "rig.config + private state", done: (s) => s.configured, cta: "Run init", item: STEP_CONFIG_RUN },
   { id: "server", label: "Server target", detail: "local or remote, reachable", done: (s) => s.serverReachable, cta: "Choose a server", item: STEP_SERVER },
   { id: "auth", label: "GitHub auth", detail: "signed in on the selected server", done: (s) => s.authSignedIn, cta: "Connect GitHub", item: STEP_AUTH },
   { id: "tasks", label: "Task source", detail: "where work comes from", done: (s) => s.taskSourceReady, cta: "Pick a task source", item: STEP_TASKS }
 ];
 var SECONDARY_ACTIONS = [
-  { label: "repair", detail: "reconfigure generated config and private state", item: { id: "repair", label: "repair", intent: { scene: "command", argv: ["init", "--repair"], action: { kind: "command-run", label: "Reconfigure project" } }, message: "verify or rewrite generated config" } },
-  { label: "demo", detail: "seed an offline demo task source to explore", item: { id: "demo", label: "demo", intent: { scene: "command", argv: ["init", "--demo", "--repair"], action: { kind: "command-run", label: "Seed demo project" } }, message: "offline demo project" } },
+  { label: "repair", detail: "reconfigure generated config and private state", item: { id: "repair", label: "repair", intent: { scene: "init", argv: ["init", "--repair", "--yes"], action: { kind: "init-start", label: "Reconfigure project" } }, message: "verify or rewrite generated config natively" } },
+  { label: "demo", detail: "seed an offline demo task source to explore", item: { id: "demo", label: "demo", intent: { scene: "init", argv: ["init", "--demo", "--repair", "--yes"], action: { kind: "init-start", label: "Seed demo project" } }, message: "offline demo project without embedded CLI prompts" } },
   { label: "doctor", detail: "diagnose what is still missing", item: { id: "doctor", label: "doctor", intent: { scene: "doctor", argv: ["doctor"], action: { kind: "doctor-run", label: "Run doctor" } }, message: "verify setup" } }
 ];
 function record2(value) {
@@ -19925,11 +20676,11 @@ function renderInitScene(state, layout) {
   const allDone = completed === SETUP_STEPS.length;
   const nextStep = SETUP_STEPS.find((step) => !step.done(signals));
   const selected = Math.max(0, state.selection.index);
-  const primary = nextStep ? selectableDeckRow({ label: "next", detail: `${nextStep.cta} \u2014 recommended`, active: selected === 0 }, { ...nextStep.item, id: "init-primary" }) : selectableDeckRow({ label: "verify", detail: "Setup complete \u2014 run doctor to confirm", active: selected === 0 }, { id: "init-primary", label: "verify", intent: { scene: "doctor", argv: ["doctor"], action: { kind: "doctor-run", label: "Run doctor" } }, message: "verify setup end-to-end" });
+  const primary = nextStep ? selectableDeckRow({ label: "next", detail: `${nextStep.cta} \u2014 recommended`, active: selected === 0 }, { ...nextStep.item, id: "init-primary" }) : selectableDeckRow({ label: "verify", detail: "Init complete \u2014 run doctor to confirm", active: selected === 0 }, { id: "init-primary", label: "verify", intent: { scene: "doctor", argv: ["doctor"], action: { kind: "doctor-run", label: "Run doctor" } }, message: "verify setup end-to-end" });
   const secondaryRows = SECONDARY_ACTIONS.map(({ label, detail, item }, index) => selectableDeckRow({ label, detail, active: selected === index + 1 }, item));
   const progress = allDone ? "all set" : `${completed} of ${SETUP_STEPS.length} complete`;
   const panelLines = [
-    line(allDone ? "SETUP \xB7 ready to go" : "SETUP \xB7 let's get you running", { fg: allDone ? RIG_UI.limeDim : RIG_UI.ink, bold: true }),
+    line(allDone ? "INIT \xB7 ready to go" : "INIT \xB7 let's get you running", { fg: allDone ? RIG_UI.limeDim : RIG_UI.ink, bold: true }),
     line(`progress  ${progress}`, { fg: allDone ? RIG_UI.limeDim : RIG_UI.ink2 }),
     blank(),
     line("CHECKLIST", { fg: RIG_UI.ink3, bold: true }),
@@ -19941,11 +20692,11 @@ function renderInitScene(state, layout) {
     line("OTHER PATHS", { fg: RIG_UI.ink3, bold: true }),
     ...secondaryRows,
     blank(),
-    line("enter/click runs the highlighted action \xB7 esc goes back \xB7 tab switches sections", { fg: RIG_UI.ink4 })
+    line("enter/click runs the highlighted native action \xB7 esc goes back \xB7 tab switches sections", { fg: RIG_UI.ink4 })
   ];
   return makeSceneFrame({
     scene: "init",
-    title: "Setup",
+    title: "Init",
     lines: [],
     panels: [{
       id: "init-setup",
@@ -19958,11 +20709,11 @@ function renderInitScene(state, layout) {
       opacity: 0.98,
       border: false,
       chrome: "ad-terminal",
-      headerText: "rig setup \xB7 guided onboarding",
+      headerText: "rig init \xB7 guided onboarding",
       paddingX: 5,
       paddingY: 2
     }],
-    footer: { message: allDone ? "setup complete" : "setup in progress" },
+    footer: { message: allDone ? "init complete" : "init in progress" },
     live: !allDone || state.status === "action"
   });
 }
@@ -21235,16 +21986,40 @@ function renderRunDetailScene(state, layout) {
 // packages/cli/src/app-opentui/scenes/server.ts
 var SERVER_ACTIONS = [
   { detail: "probe selected server, project root, and GitHub auth", item: { id: "refresh", label: "refresh", intent: { scene: "server", argv: ["server", "status"], action: { kind: "refresh", label: "Refresh server" } }, message: "refresh selected server" } },
-  { detail: "select local server for this repo", item: { id: "local", label: "use local", intent: { scene: "command", argv: ["server", "use", "local"], action: { kind: "command-run", label: "Use local server" } }, message: "switch this repo to local" } },
-  { detail: "choose/switch to a saved remote server alias", item: { id: "remote", label: "use remote", intent: { scene: "command", argv: ["server", "use"], action: { kind: "command-run", label: "Choose remote server" } }, message: "choose a saved remote alias" } },
-  { detail: "show saved local/remote aliases", item: { id: "list", label: "list servers", intent: { scene: "command", argv: ["server", "list"], action: { kind: "command-run", label: "List saved servers" } }, message: "list saved server aliases" } },
-  { detail: "open server add command workspace", item: { id: "add", label: "add remote", intent: { scene: "command", argv: ["server", "add"], action: { kind: "command-run", label: "Add remote server" } }, message: "open server add workspace" } },
+  { detail: "select local server for this repo", item: { id: "local", label: "use local", intent: { scene: "server", argv: ["server", "use", "local"], action: { kind: "server-use-local", label: "Use local server" } }, message: "switch this repo to local" } },
+  { detail: "type a saved remote alias to select", item: { id: "remote", label: "use remote", prompt: { label: "Use remote alias", scene: "server", argv: ["server", "use"], intentKind: "server-use-remote", payloadBase: {}, payloadKey: "alias" }, message: "choose a saved remote alias" } },
+  { detail: "show saved local/remote aliases in the status panel", item: { id: "list", label: "list servers", intent: { scene: "server", argv: ["server", "list"], action: { kind: "refresh", label: "List servers" } }, message: "list saved server aliases" } },
+  { detail: "add and select a remote: enter <alias> <https-url>", item: { id: "add", label: "add remote", prompt: { label: "Add remote", scene: "server", argv: ["server", "add"], intentKind: "server-add-remote", payloadBase: {}, payloadKey: "remote", appendValueToArgv: true }, message: "add a remote server alias" } },
   { detail: "spawn the local rig-server detached and return here", item: { id: "start", label: "start local", intent: { scene: "server", argv: ["server", "start"], action: { kind: "refresh", payload: { startLocal: true }, label: "Start local server" } }, message: "start local server detached" } },
-  { detail: "import gh token into the selected server namespace", item: { id: "auth", label: "import auth", intent: { scene: "command", argv: ["github", "auth", "import-gh"], action: { kind: "command-run", label: "Import GitHub auth" } }, message: "import gh auth to selected server" } },
+  { detail: "import gh token into the selected server namespace", item: { id: "auth", label: "import auth", intent: { scene: "server", argv: ["github", "auth", "import-gh"], action: { kind: "github-auth-import", label: "Import GitHub auth" } }, message: "import gh auth to selected server" } },
   { detail: "diagnose server/auth/project linkage", item: { id: "doctor", label: "doctor", intent: { scene: "doctor", argv: ["doctor"], action: { kind: "doctor-run", label: "Run doctor" } }, message: "verify server/auth" } },
   { detail: "verify selected server can list task source", item: { id: "tasks", label: "tasks", intent: { scene: "tasks", argv: ["task", "list"], action: { kind: "refresh", label: "Open tasks" } }, message: "verify task source" } },
   { detail: "verify selected server can list recent runs", item: { id: "runs", label: "runs", intent: { scene: "fleet", argv: ["run", "status"], action: { kind: "refresh", label: "Open runs" } }, message: "open recent runs" } }
 ];
+function remoteAliasActions(server) {
+  const aliases = (server?.aliases ?? []).filter((alias) => alias.kind === "remote");
+  return aliases.map((alias) => ({
+    detail: `${alias.selected ? "selected" : "select"} ${alias.baseUrl ?? "remote endpoint"}`,
+    item: {
+      id: `remote-alias:${alias.alias}`,
+      label: alias.selected ? `\u2713 ${alias.alias}` : `use ${alias.alias}`,
+      intent: { scene: "server", argv: ["server", "use", alias.alias], action: { kind: "server-use-remote", label: `Use ${alias.alias}`, payload: { alias: alias.alias } } },
+      message: `select ${alias.alias}`
+    }
+  }));
+}
+function serverActions(state) {
+  const server = serverState(state);
+  const remoteRows = remoteAliasActions(server);
+  let actions = remoteRows.length > 0 ? [...SERVER_ACTIONS.slice(0, 3), ...remoteRows, ...SERVER_ACTIONS.slice(3)] : [...SERVER_ACTIONS];
+  if (!shouldOfferRemoteLinkRepair(state))
+    return actions;
+  const repair = { detail: "backfill or prepare the selected remote checkout/root link", item: { id: "repair-link", label: "repair link", intent: { scene: "server", argv: ["server", "repair-link"], action: { kind: "remote-link-repair", label: "Repair remote link" } }, message: "prepare remote checkout link" } };
+  const doctorIndex = actions.findIndex((entry) => entry.item.id === "doctor");
+  if (doctorIndex < 0)
+    return [...actions, repair];
+  return [...actions.slice(0, doctorIndex), repair, ...actions.slice(doctorIndex)];
+}
 function cleanVisible(value, fallback = "unknown") {
   return value?.trim() || fallback;
 }
@@ -21269,31 +22044,37 @@ function selectedIndex(state, count) {
 function statusRows2(server) {
   const auth = server?.auth;
   const signedIn = auth && (auth.signedIn === true || auth.authenticated === true || auth.status === "authenticated") ? "authenticated" : "auth unknown";
+  const link = server?.remoteProjectLink;
+  const linkText = link ? link.ok ? `ready \xB7 ${link.serverProjectRoot ?? "linked"}` : `${link.status ?? "needs repair"} \xB7 ${link.hint ?? link.message ?? "run repair link"}` : server?.kind === "remote" ? "not checked" : "not required";
+  const selectedLinkSummary = link?.ok ? " \xB7 root link ready" : server?.kind === "remote" && link ? ` \xB7 root link ${link.status ?? "needs repair"}` : "";
   return [
-    line(`selected    ${cleanVisible(server?.label, "not checked")}`, { fg: RIG_UI.ink2 }),
+    line(`selected    ${cleanVisible(server?.label, "not checked")}${selectedLinkSummary}`, { fg: RIG_UI.ink2 }),
     line(`target      ${targetLabel(server)}`, { fg: RIG_UI.ink3 }),
     line(`mode        ${server?.kind ?? "local or remote"}`, { fg: RIG_UI.ink3 }),
     line(`health      ${server ? server.reachable ? "reachable" : "unreachable" : "check pending"}`, { fg: server?.reachable ? RIG_UI.limeDim : server ? RIG_UI.red : RIG_UI.yellow }),
     line(`github      ${signedIn}`, { fg: signedIn === "authenticated" ? RIG_UI.limeDim : RIG_UI.ink4 }),
+    line(`root link   ${linkText}`, { fg: link?.ok ? RIG_UI.limeDim : server?.kind === "remote" ? RIG_UI.yellow : RIG_UI.ink4 }),
+    ...server?.aliases && server.aliases.length > 0 ? [line(`aliases     ${server.aliases.map((alias) => `${alias.selected ? "*" : ""}${alias.alias}${alias.kind === "remote" && alias.baseUrl ? `=${alias.baseUrl}` : ""}`).join(", ")}`, { fg: RIG_UI.ink4 })] : [],
     ...server?.error ? [line(`attention   ${server.error}`, { fg: RIG_UI.yellow })] : []
   ];
 }
 function renderServerScene(state, layout) {
   const server = serverState(state);
-  const selected = selectedIndex(state, 10);
+  const actions = serverActions(state);
+  const selected = selectedIndex(state, actions.length);
   const loading = state.status === "loading" && !server;
   const errorText = state.error?.message ?? lastRefreshError(state);
   const panelLines = [
     ...errorText ? errorBanner(errorText, "select refresh or doctor below to retry") : [],
     line("server controls", { fg: RIG_UI.ink3 }),
     blank(),
-    line("ACTIONS", { fg: RIG_UI.ink3, bold: true }),
-    ...SERVER_ACTIONS.map(({ detail, item }, index) => selectableDeckRow({ label: item.label, detail, index, active: selected === index }, item)),
-    blank(),
     line("STATUS", { fg: RIG_UI.ink3, bold: true }),
     ...loading ? loadingRows("server status", state.tick) : statusRows2(server),
     blank(),
-    line("enter/click runs action \xB7 command rows stay inside OpenTUI PTY", { fg: RIG_UI.ink4 })
+    line("ACTIONS", { fg: RIG_UI.ink3, bold: true }),
+    ...actions.map(({ detail, item }, index) => selectableDeckRow({ label: item.label, detail, index, active: selected === index }, item)),
+    blank(),
+    line("enter/click runs native actions \xB7 add/use remote prompts stay in OpenTUI", { fg: RIG_UI.ink4 })
   ];
   return makeSceneFrame({
     scene: "server",
@@ -21320,13 +22101,13 @@ function renderServerScene(state, layout) {
 }
 
 // packages/cli/src/app-opentui/scenes/tasks.ts
-var TASK_RECOVERY_ITEMS = [
+var BASE_TASK_RECOVERY_ITEMS = [
   { id: "refresh", label: "refresh", intent: { scene: "tasks", argv: ["tasks"], action: { kind: "refresh", label: "Refresh tasks" } }, message: "refresh task source" },
-  { id: "next", label: "next", intent: { scene: "command", argv: ["task", "run", "--next"], action: { kind: "command-run", label: "Run next task" } }, message: "dispatch next runnable task" },
-  { id: "repair", label: "repair", intent: { scene: "command", argv: ["init", "--repair"], action: { kind: "command-run", label: "Repair task source" } }, message: "repair project/task source" },
+  { id: "next", label: "next", intent: { scene: "tasks", argv: ["task", "run", "--next"], action: { kind: "task-run-next", label: "Dispatch next task" } }, message: "dispatch next runnable task" },
   { id: "server", label: "server", intent: { scene: "server", argv: ["server", "status"], action: { kind: "refresh", label: "Open server controls" } }, message: "server controls" },
   { id: "doctor", label: "doctor", intent: { scene: "doctor", argv: ["doctor"], action: { kind: "doctor-run", label: "Run doctor" } }, message: "diagnose task source" }
 ];
+var TASK_REPAIR_LINK_ITEM = { id: "repair-link", label: "repair link", intent: { scene: "server", argv: ["server", "repair-link"], action: { kind: "remote-link-repair", label: "Repair remote link", payload: { returnScene: "tasks" } } }, message: "backfill or prepare remote project link" };
 var COL3 = {
   glyph: 1,
   id: 11,
@@ -21486,34 +22267,44 @@ function taskRow(width, task, active, optimistic) {
   const item = taskSelectableItem(task);
   return item ? withSelectable(row, item) : row;
 }
-var RECOVERY_DECKS2 = [
+var BASE_RECOVERY_DECKS2 = [
   { label: "refresh", detail: "reload task source" },
   { label: "next", detail: "dispatch next runnable task" },
-  { label: "repair", detail: "repair project/task source link" },
   { label: "server", detail: "open server controls" },
   { label: "doctor", detail: "diagnose task source" }
 ];
-function recoveryRows2(selected, reason) {
+function taskRecoveryItems(state) {
+  if (!shouldOfferRemoteLinkRepair(state))
+    return BASE_TASK_RECOVERY_ITEMS;
+  return [BASE_TASK_RECOVERY_ITEMS[0], BASE_TASK_RECOVERY_ITEMS[1], TASK_REPAIR_LINK_ITEM, ...BASE_TASK_RECOVERY_ITEMS.slice(2)];
+}
+function taskRecoveryDecks(state) {
+  if (!shouldOfferRemoteLinkRepair(state))
+    return BASE_RECOVERY_DECKS2;
+  return [BASE_RECOVERY_DECKS2[0], BASE_RECOVERY_DECKS2[1], { label: "repair link", detail: "backfill/prepare remote project-root link" }, ...BASE_RECOVERY_DECKS2.slice(2)];
+}
+function recoveryRows2(state, selected, reason) {
+  const items = taskRecoveryItems(state);
   return [
     ...reason ? [line(reason, { fg: RIG_UI.yellow }), line("", { fg: RIG_UI.ink3 })] : [],
     line("ACTIONS", { fg: RIG_UI.ink3, bold: true }),
-    ...RECOVERY_DECKS2.map((deck, index) => selectableDeckRow({ ...deck, index, active: selected === index }, TASK_RECOVERY_ITEMS[index]))
+    ...taskRecoveryDecks(state).map((deck, index) => selectableDeckRow({ ...deck, index, active: selected === index }, items[index]))
   ];
 }
-function emptyRows2(query, total, selected) {
+function emptyRows2(state, query, total, selected) {
   if (!query.trim() && total === 0)
-    return recoveryRows2(selected, "No tasks loaded.");
+    return recoveryRows2(state, selected, "No tasks loaded.");
   if (query.trim() && total > 0) {
     return [
-      ...recoveryRows2(selected, `No matching tasks for ${JSON.stringify(query)} (${total} total).`)
+      ...recoveryRows2(state, selected, `No matching tasks for ${JSON.stringify(query)} (${total} total).`)
     ];
   }
-  return recoveryRows2(selected, "No tasks are visible with this filter.");
+  return recoveryRows2(state, selected, "No tasks are visible with this filter.");
 }
 function degradedRows2(state, selected) {
   if (!state.error)
     return [];
-  return recoveryRows2(selected, state.error.message);
+  return recoveryRows2(state, selected, state.error.message);
 }
 function rawString(raw, key) {
   const value = raw?.[key];
@@ -21537,7 +22328,10 @@ function renderTaskDetail(state, taskId3, layout) {
   const activeRunId = task?.activeRun?.runId?.trim();
   const width = panelWidth13(layout);
   const selected = Math.max(0, state.selection.index);
+  const errorText = state.error?.message ?? lastRefreshError(state);
+  const offerRepairLink = shouldOfferRemoteLinkRepair(state, errorText);
   const headerLines = [
+    ...errorText ? errorBanner(errorText, offerRepairLink ? "select repair link below to prepare the remote checkout" : "retry dispatch after resolving the issue") : [],
     line(`${glyph2} ${title}`, { fg: color, bold: true }),
     line(`task ${taskId3} \xB7 ${status}`, { fg: RIG_UI.ink3 }),
     ...task && task.labels.length > 0 ? [line(`labels: ${task.labels.join(", ")}`, { fg: RIG_UI.ink4 })] : [],
@@ -21549,8 +22343,16 @@ function renderTaskDetail(state, taskId3, layout) {
   const actionRows2 = [];
   actionRows2.push(selectableDeckRow({ label: "back", detail: "return to the task list", index, active: selected === index }, { id: "task-detail-back", label: "back", data: { taskDetailId: undefined }, message: "back to task list" }));
   index += 1;
-  actionRows2.push(selectableDeckRow({ label: "dispatch", detail: "submit a Pi run for this task", index, active: selected === index }, { id: `task-detail-run:${taskId3}`, label: `dispatch ${taskId3}`, intent: { scene: "tasks", argv: ["run", taskId3], action: { kind: "task-run-id", payload: { task: taskId3 }, label: `Dispatching ${taskId3}` } }, message: `dispatch task ${taskId3}` }));
-  index += 1;
+  if (offerRepairLink) {
+    actionRows2.push(selectableDeckRow({ label: "repair link", detail: "prepare/backfill the selected remote project-root link", index, active: selected === index }, { id: `task-detail-repair-link:${taskId3}`, label: "repair link", intent: { scene: "server", argv: ["server", "repair-link"], action: { kind: "remote-link-repair", label: "Repair remote link", payload: { returnScene: "tasks", taskDetailId: taskId3 } } }, message: "prepare remote checkout link" }));
+    index += 1;
+  }
+  if (offerRepairLink) {
+    actionRows2.push(line("  dispatch   blocked until the remote project link is repaired", { fg: RIG_UI.ink4 }));
+  } else {
+    actionRows2.push(selectableDeckRow({ label: "dispatch", detail: "submit a Pi run for this task", index, active: selected === index }, { id: `task-detail-run:${taskId3}`, label: `dispatch ${taskId3}`, intent: { scene: "tasks", argv: ["run", taskId3], action: { kind: "task-run-id", payload: { task: taskId3 }, label: `Dispatching ${taskId3}` } }, message: `dispatch task ${taskId3}` }));
+    index += 1;
+  }
   if (activeRunId) {
     actionRows2.push(selectableDeckRow({ label: "attach", detail: `attach the Pi console to run ${activeRunId.slice(0, 8)}`, index, active: selected === index }, { id: `task-detail-attach:${taskId3}`, label: `attach ${activeRunId.slice(0, 8)}`, intent: { scene: "handoff", argv: ["attach", activeRunId], action: { kind: "run-attach", payload: { runId: activeRunId }, label: `Attach Pi ${activeRunId.slice(0, 8)}` } }, message: `attach Pi to ${activeRunId.slice(0, 8)}` }));
     index += 1;
@@ -21609,7 +22411,7 @@ function renderTasksScene(state, layout) {
   const tasks = sortTasks2(filterTasksForSearch(allTasks, query), spec);
   const selected = typeof state.data.selectedTaskId === "string" && tasks.some((task) => task.id === state.data.selectedTaskId) ? state.data.selectedTaskId : tasks[0]?.id;
   const selectedIndex2 = Math.max(0, tasks.findIndex((task) => task.id === selected));
-  const recoveryIndex = Math.max(0, Math.min(4, state.selection.index));
+  const recoveryIndex = Math.max(0, Math.min(taskRecoveryItems(state).length - 1, state.selection.index));
   const dispatching = dispatchingFor(state);
   const dispatchLine = dispatching ? ` \xB7 ${state.data.dispatchingRun?.runId ?? "new"} ${dispatching.status}` : "";
   const updatedAgo = updatedAgoLabel2(state);
@@ -21629,7 +22431,7 @@ function renderTasksScene(state, layout) {
       ...tasks.map((task, index) => taskRow(contentWidth, task, index === selectedIndex2, dispatching && dispatching.taskId === task.id ? dispatching.status : undefined))
     ] : state.error ? degradedRows2(state, recoveryIndex) : loading ? loadingRows("tasks", state.tick) : [
       ...query.trim() ? [line(searchSummary("tasks", query, tasks.length, allTasks.length), { fg: RIG_UI.ink4 }), line("", { fg: RIG_UI.ink3 })] : [],
-      ...emptyRows2(query, allTasks.length, recoveryIndex)
+      ...emptyRows2(state, query, allTasks.length, recoveryIndex)
     ]
   ];
   return makeSceneFrame({
@@ -21986,6 +22788,29 @@ function createDomainAdapter() {
           else
             await loadInitFacts(ctx);
           return true;
+        case "server-use-local":
+          await useLocalServerFromApp(ctx);
+          return true;
+        case "server-use-remote":
+          await useRemoteServerFromApp(ctx, payloadString8(intent, "alias") ?? intent.argv[2]);
+          return true;
+        case "server-add-remote":
+          await addRemoteServerFromApp(ctx, intent.argv);
+          return true;
+        case "github-auth-import":
+          await importGitHubAuthFromGhApp(ctx);
+          return true;
+        case "remote-link-repair": {
+          await repairRemoteProjectRootLinkFromApp(ctx);
+          const returnScene = payloadString8(intent, "returnScene");
+          if (returnScene && returnScene !== intent.scene) {
+            ctx.emit({ type: "scene.change", scene: returnScene, intent: { scene: returnScene, argv: intent.argv, action: { kind: "refresh", label: `Refresh ${returnScene}`, payload: intent.action.payload } } });
+            await refreshScene(ctx, returnScene, { scene: returnScene, argv: intent.argv, action: { kind: "refresh", label: `Refresh ${returnScene}`, payload: intent.action.payload } });
+          } else {
+            await refreshServerStatus(ctx);
+          }
+          return true;
+        }
         case "doctor-run":
           await runDoctorChecksForApp(ctx);
           return true;