@h-rig/cli 0.0.6-alpha.89 → 0.0.6-alpha.90

package/dist/src/commands/server.js

@@ -55,8 +55,18 @@ import {
 import { resolveMonorepoRoot } from "@rig/runtime/control-plane/native/utils";
 
 // packages/cli/src/commands/_authority-runs.ts
-function normalizeRuntimeAdapter(_value) {
-  return "pi";
+function normalizeRuntimeAdapter(value) {
+  const normalized = value?.trim().toLowerCase();
+  if (!normalized) {
+    return "pi";
+  }
+  if (normalized === "codex" || normalized === "codex-cli" || normalized === "codex-app-server" || normalized === "gpt-codex") {
+    return "codex";
+  }
+  if (normalized === "pi" || normalized === "rig-pi" || normalized === "@rig/pi") {
+    return "pi";
+  }
+  return "claude-code";
 }
 
 // packages/cli/src/app/drone-ui.ts
@@ -270,28 +280,12 @@ function readRepoConnection(projectRoot) {
     selected,
     project: typeof record.project === "string" ? record.project : undefined,
     linkedAt: typeof record.linkedAt === "string" ? record.linkedAt : undefined,
-    serverProjectRoot: typeof record.serverProjectRoot === "string" && record.serverProjectRoot.trim() ? record.serverProjectRoot.trim() : undefined,
-    serverProjectRootAlias: typeof record.serverProjectRootAlias === "string" && record.serverProjectRootAlias.trim() ? record.serverProjectRootAlias.trim() : undefined,
-    serverProjectRootBaseUrl: typeof record.serverProjectRootBaseUrl === "string" && record.serverProjectRootBaseUrl.trim() ? record.serverProjectRootBaseUrl.trim().replace(/\/+$/, "") : undefined
+    serverProjectRoot: typeof record.serverProjectRoot === "string" && record.serverProjectRoot.trim() ? record.serverProjectRoot.trim() : undefined
   };
 }
 function writeRepoConnection(projectRoot, state) {
   writeJsonFile(resolveRepoConnectionPath(projectRoot), state);
 }
-function rootAllowedForSelection(repo, connection) {
-  const root = repo.serverProjectRoot?.trim();
-  if (!root)
-    return;
-  if (connection.kind === "remote") {
-    if (repo.serverProjectRootAlias !== repo.selected)
-      return;
-    if (repo.serverProjectRootBaseUrl !== connection.baseUrl)
-      return;
-  } else if (repo.serverProjectRootAlias && repo.serverProjectRootAlias !== repo.selected) {
-    return;
-  }
-  return root;
-}
 function resolveSelectedConnection(projectRoot, options = {}) {
   const repo = readRepoConnection(projectRoot);
   if (!repo)
@@ -303,41 +297,13 @@ function resolveSelectedConnection(projectRoot, options = {}) {
   if (!connection) {
     throw new CliError(`Selected Rig server "${repo.selected}" was not found. Run \`rig server list\` or \`rig server use local\`.`, 1);
   }
-  return { alias: repo.selected, connection, serverProjectRoot: rootAllowedForSelection(repo, connection) };
-}
-function writeRepoServerProjectRoot(projectRoot, serverProjectRoot, metadata = {}) {
-  const repo = readRepoConnection(projectRoot);
-  if (!repo)
-    return;
-  let inferred = metadata;
-  if (!inferred.alias || !inferred.baseUrl) {
-    try {
-      const selected = resolveSelectedConnection(projectRoot);
-      if (selected?.connection.kind === "remote") {
-        inferred = {
-          alias: inferred.alias ?? selected.alias,
-          baseUrl: inferred.baseUrl ?? selected.connection.baseUrl
-        };
-      }
-    } catch {}
-  }
-  writeRepoConnection(projectRoot, {
-    ...repo,
-    ...metadata.project ? { project: metadata.project } : {},
-    serverProjectRoot,
-    ...inferred.alias ? { serverProjectRootAlias: inferred.alias } : {},
-    ...inferred.baseUrl ? { serverProjectRootBaseUrl: inferred.baseUrl.replace(/\/+$/, "") } : {}
-  });
+  return { alias: repo.selected, connection, serverProjectRoot: repo.serverProjectRoot };
 }
-function clearRepoServerProjectRoot(projectRoot) {
+function writeRepoServerProjectRoot(projectRoot, serverProjectRoot) {
   const repo = readRepoConnection(projectRoot);
   if (!repo)
     return;
-  writeRepoConnection(projectRoot, {
-    selected: repo.selected,
-    ...repo.project ? { project: repo.project } : {},
-    ...repo.linkedAt ? { linkedAt: repo.linkedAt } : {}
-  });
+  writeRepoConnection(projectRoot, { ...repo, serverProjectRoot });
 }
 
 // packages/cli/src/commands/_cli-format.ts
@@ -394,26 +360,131 @@ function formatConnectionList(connections) {
   return [formatSection("Rig servers", `${rows.length} available`), `${pc.bold(pad("ALIAS", aliasWidth))}  ${pc.bold("KIND")}  ${pc.bold("TARGET")}`, ...lines, "", ...formatNextSteps(["Select one: `rig server use <alias|local>`"])].join(`
 `);
 }
-function formatConnectionStatus(selected, connections, repo, remoteProjectLink) {
+function formatConnectionStatus(selected, connections) {
   const connection = selected === "local" ? { kind: "local", mode: "auto" } : connections[selected];
   const target = !connection ? "not configured" : connection.kind === "remote" ? connection.baseUrl : "local";
-  const rootLabel = remoteProjectLink ? remoteProjectLink.ok ? `ready \xB7 ${remoteProjectLink.serverProjectRoot ?? repo?.serverProjectRoot ?? "linked"}` : `${remoteProjectLink.status ?? "needs repair"} \xB7 ${remoteProjectLink.hint ?? remoteProjectLink.message ?? "run rig server repair-link"}` : repo?.serverProjectRoot ? repo.serverProjectRoot : "not required";
   return [
     formatSection("Rig server", "selected for this repo"),
     `${themeFaint("\u2502")} ${themeDim("selected ")} ${pc.bold(selected)}`,
     `${themeFaint("\u2502")} ${themeDim("kind     ")} ${formatStatusPill(connection?.kind ?? "unknown")}`,
     `${themeFaint("\u2502")} ${themeDim("target   ")} ${target ?? "not configured"}`,
-    ...repo?.project ? [`${themeFaint("\u2502")} ${themeDim("project  ")} ${repo.project}`] : [],
-    ...connection?.kind === "remote" ? [`${themeFaint("\u2502")} ${themeDim("root     ")} ${rootLabel}`] : [],
     "",
-    ...formatNextSteps(remoteProjectLink && !remoteProjectLink.ok ? ["Repair remote link: `rig server repair-link`", "Authenticate first if needed: `rig github auth import-gh`"] : ["Change: `rig server use <alias|local>`", "List saved servers: `rig server list`"])
+    ...formatNextSteps(["Change: `rig server use <alias|local>`", "List saved servers: `rig server list`"])
   ].join(`
 `);
 }
 
+// packages/cli/src/commands/connect.ts
+function usageName(options) {
+  return `rig ${options.group}`;
+}
+function parseConnection(alias, value, options) {
+  if (alias === "local" && !value)
+    return { kind: "local", mode: "auto" };
+  if (!value)
+    throw new CliError(`Missing remote server URL. Usage: ${usageName(options)} add <alias> <url>`, 1);
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new CliError(`Invalid Rig server URL: ${value}`, 1, { hint: "Pass a full http(s) URL, e.g. `rig server add prod https://rig.example.com`." });
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    throw new CliError("Rig remote server URL must be http(s).", 1, { hint: "Use an http:// or https:// URL, e.g. `rig server add prod https://rig.example.com`." });
+  }
+  return { kind: "remote", baseUrl: parsed.toString().replace(/\/+$/, "") };
+}
+function printJsonOrText(context, payload, text) {
+  if (context.outputMode === "json") {
+    console.log(JSON.stringify(payload, null, 2));
+  } else {
+    console.log(text);
+  }
+}
+async function promptForConnectionAlias(context) {
+  const state = readGlobalConnections();
+  const repo = readRepoConnection(context.projectRoot);
+  const options = [
+    { value: "local", label: "local", hint: "Use/start a local Rig server" },
+    ...Object.entries(state.connections).map(([alias, connection]) => ({
+      value: alias,
+      label: alias,
+      hint: connection.kind === "remote" ? connection.baseUrl : "local"
+    }))
+  ].filter((option, index, all) => all.findIndex((candidate) => candidate.value === option.value) === index);
+  const answer = await droneSelect({
+    message: "Select Rig server for this repo",
+    initialValue: repo?.selected ?? "local",
+    options
+  });
+  if (answer === null) {
+    droneCancel("No server selected.");
+    throw new CliError("No server selected.", 3);
+  }
+  return String(answer);
+}
+async function executeConnectionCommand(context, args, options) {
+  const [command, ...rest] = args;
+  switch (command ?? "status") {
+    case "list": {
+      requireNoExtraArgs(rest, `${usageName(options)} list`);
+      const state = readGlobalConnections();
+      printJsonOrText(context, state, formatConnectionList(state.connections));
+      return { ok: true, group: options.group, command: "list", details: state };
+    }
+    case "add": {
+      const [alias, url, ...extra] = rest;
+      if (!alias)
+        throw new CliError(`Missing alias. Usage: ${usageName(options)} add <alias> <url>`, 1);
+      requireNoExtraArgs(extra, `${usageName(options)} add <alias> <url>`);
+      const connection = parseConnection(alias, url, options);
+      const state = upsertGlobalConnection(alias, connection);
+      printJsonOrText(context, { alias, connection }, formatSuccessCard("Rig server saved", [
+        ["alias", alias],
+        ["target", connection.kind === "remote" ? connection.baseUrl : "local"],
+        ["next", `${usageName(options)} use ${alias}`]
+      ]));
+      return { ok: true, group: options.group, command: "add", details: { alias, connection, count: Object.keys(state.connections).length } };
+    }
+    case "use": {
+      let [alias, ...extra] = rest;
+      requireNoExtraArgs(extra, `${usageName(options)} use <alias|local>`);
+      if (!alias && options.interactiveUse && context.outputMode === "text" && process.stdin.isTTY) {
+        alias = await promptForConnectionAlias(context);
+      }
+      if (!alias)
+        throw new CliError(`Missing alias. Usage: ${usageName(options)} use <alias|local>`, 1);
+      if (alias !== "local") {
+        const state = readGlobalConnections();
+        if (!state.connections[alias])
+          throw new CliError(`Unknown Rig server: ${alias}`, 1, { hint: "Run `rig server list` to see saved aliases, or save one with `rig server add <alias> <url>`." });
+      }
+      const repoState = { selected: alias, linkedAt: new Date().toISOString() };
+      writeRepoConnection(context.projectRoot, repoState);
+      printJsonOrText(context, repoState, formatSuccessCard("Rig server selected", [
+        ["selected", alias],
+        ["scope", "this repo"],
+        ["next", "rig task list"]
+      ]));
+      return { ok: true, group: options.group, command: "use", details: repoState };
+    }
+    case "status": {
+      requireNoExtraArgs(rest, `${usageName(options)} status`);
+      const repo = readRepoConnection(context.projectRoot);
+      const global = readGlobalConnections();
+      const details = { selected: repo?.selected ?? "local", repo, connections: global.connections };
+      printJsonOrText(context, details, formatConnectionStatus(details.selected, global.connections));
+      return { ok: true, group: options.group, command: "status", details };
+    }
+    default:
+      throw new CliError(`Unknown ${options.group} command: ${String(command)}
+Usage: ${usageName(options)} <list|add|use|status>`, 1);
+  }
+}
+
 // packages/cli/src/commands/_server-client.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname2, isAbsolute, resolve as resolve2 } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve2 } from "path";
 import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
 var scopedGitHubBearerTokens = new Map;
 var serverPhaseListener = null;
@@ -424,21 +495,17 @@ function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
 }
-function readRemoteAuthState(projectRoot) {
+function readPrivateRemoteSessionToken(projectRoot) {
   const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
   if (!existsSync2(path))
     return null;
   try {
     const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
   } catch {
     return null;
   }
 }
-function readPrivateRemoteSessionToken(projectRoot) {
-  const parsed = readRemoteAuthState(projectRoot);
-  return parsed ? cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined) : null;
-}
 function readGitHubBearerTokenForRemote(projectRoot) {
   const scopedKey = resolve2(projectRoot);
   if (scopedGitHubBearerTokens.has(scopedKey))
@@ -449,421 +516,18 @@ function readGitHubBearerTokenForRemote(projectRoot) {
   return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
 }
 function readStoredGitHubAuthToken(projectRoot) {
-  const parsed = readRemoteAuthState(projectRoot);
-  return parsed ? cleanToken(typeof parsed.token === "string" ? parsed.token : undefined) : null;
-}
-function inferRemoteServerProjectRootCandidateFromAuthState(projectRoot, repoSlug) {
-  if (!/^[^/]+\/[^/]+$/.test(repoSlug))
-    return null;
-  const repo = readRepoConnection(projectRoot);
-  const auth = readRemoteAuthState(projectRoot);
-  const authUpdatedAt = typeof auth?.updatedAt === "string" ? Date.parse(auth.updatedAt) : Number.NaN;
-  const repoLinkedAt = typeof repo?.linkedAt === "string" ? Date.parse(repo.linkedAt) : Number.NaN;
-  if (Number.isFinite(authUpdatedAt) && Number.isFinite(repoLinkedAt) && authUpdatedAt + 1000 < repoLinkedAt)
-    return null;
-  const checkoutBaseDir = typeof auth?.checkoutBaseDir === "string" && auth.checkoutBaseDir.trim() ? auth.checkoutBaseDir.trim() : null;
-  if (!checkoutBaseDir)
-    return null;
-  return `${checkoutBaseDir.replace(/\/+$/, "")}/${repoSlug}`;
-}
-function readLocalConnectionFallbackToken(projectRoot) {
-  return readGitHubBearerTokenForRemote(projectRoot) ?? cleanToken(process.env.RIG_GITHUB_TOKEN) ?? readStoredGitHubAuthToken(projectRoot);
-}
-function normalizeRepoSlug(value) {
-  const slug = value?.trim();
-  return slug && /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
-}
-function readProjectLinkSlug(projectRoot) {
-  const path = resolve2(projectRoot, ".rig", "state", "project-link.json");
+  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
   if (!existsSync2(path))
     return null;
   try {
     const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-      return null;
-    return normalizeRepoSlug(typeof parsed.repoSlug === "string" ? String(parsed.repoSlug) : null);
+    return cleanToken(typeof parsed.token === "string" ? parsed.token : undefined);
   } catch {
     return null;
   }
 }
-function writeProjectLinkConnection(projectRoot, repoSlug, alias) {
-  const path = resolve2(projectRoot, ".rig", "state", "project-link.json");
-  mkdirSync2(dirname2(path), { recursive: true });
-  writeFileSync2(path, `${JSON.stringify({ repoSlug, connection: alias, linkedAt: new Date().toISOString() }, null, 2)}
-`, "utf8");
-}
-function remoteLinkRepairCommand(repoSlug) {
-  return repoSlug ? `rig server repair-link --repo ${repoSlug}` : "rig server repair-link --repo owner/repo";
-}
-function formatRemoteProjectLinkHint(resolution) {
-  const repair = remoteLinkRepairCommand(resolution.repoSlug);
-  if (resolution.status === "auth_required") {
-    return `Authenticate the selected remote${resolution.alias ? ` (${resolution.alias})` : ""}, then run \`${repair}\`. Use \`rig github auth import-gh\` or \`rig init --repair --server remote --github-auth device${resolution.repoSlug ? ` --repo ${resolution.repoSlug}` : ""}\`.`;
-  }
-  if (resolution.status === "missing_project") {
-    return `Record the repo slug, then run \`${repair}\` (or \`rig init --repo owner/repo --server remote --github-auth device\`).`;
-  }
-  if (resolution.status === "not_remote")
-    return "Select a remote server with `rig server use <alias>` before repairing a remote project link.";
-  return `Run \`${repair}\` to backfill or prepare a server-host checkout for the selected remote${resolution.alias ? ` (${resolution.alias})` : ""}.`;
-}
-function remoteProjectLinkFailure(input) {
-  const partial = {
-    status: input.status,
-    alias: input.alias,
-    baseUrl: input.baseUrl,
-    repoSlug: input.repoSlug
-  };
-  return {
-    ok: false,
-    ...input,
-    hint: formatRemoteProjectLinkHint(partial),
-    next: remoteLinkRepairCommand(input.repoSlug)
-  };
-}
-function remoteProjectLinkSuccess(input) {
-  return {
-    ok: true,
-    status: input.status,
-    alias: input.alias,
-    baseUrl: input.baseUrl,
-    repoSlug: input.repoSlug,
-    serverProjectRoot: input.serverProjectRoot,
-    source: input.source,
-    prepared: input.prepared ?? input.status === "prepared",
-    validated: input.validated ?? false,
-    message: input.message ?? `Remote project link ready for ${input.repoSlug}.`,
-    hint: "Remote-scoped task/run/status requests will send x-rig-project-root for this server-host checkout.",
-    next: "rig task list"
-  };
-}
-function localCheckoutPathCandidate(projectRoot, candidate) {
-  try {
-    const local = resolve2(projectRoot);
-    const resolved = resolve2(candidate);
-    return resolved === local || resolved.startsWith(`${local}/`);
-  } catch {
-    return false;
-  }
-}
-async function requestRemoteProjectLinkJson(baseUrl, pathname, authToken, init = {}) {
-  const requestUrl = new URL(`${baseUrl}${pathname}`);
-  if (authToken && queryAuthFallbackEnabled())
-    requestUrl.searchParams.set("rt", authToken);
-  const response = await fetch(requestUrl, {
-    ...init,
-    headers: mergeHeaders(init.headers, authToken)
-  });
-  const text = await response.text();
-  const payload = text.trim().length > 0 ? (() => {
-    try {
-      return JSON.parse(text);
-    } catch {
-      return null;
-    }
-  })() : null;
-  return { ok: response.ok, status: response.status, payload, text };
-}
-function payloadError(payload, fallback) {
-  if (payload && typeof payload === "object" && !Array.isArray(payload)) {
-    const record = payload;
-    const value = record.error ?? record.message ?? record.reason;
-    if (typeof value === "string" && value.trim())
-      return value.trim();
-  }
-  return fallback;
-}
-function checkoutPathsFromProjectPayload(payload) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
-    return [];
-  const project = payload.project;
-  if (!project || typeof project !== "object" || Array.isArray(project))
-    return [];
-  const checkouts = project.checkouts;
-  if (!Array.isArray(checkouts))
-    return [];
-  return [...checkouts].reverse().flatMap((entry) => {
-    if (!entry || typeof entry !== "object" || Array.isArray(entry))
-      return [];
-    const path = entry.path;
-    return typeof path === "string" && path.trim() ? [path.trim()] : [];
-  });
-}
-function checkoutPathFromPreparePayload(payload) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
-    return null;
-  const checkout = payload.checkout;
-  if (!checkout || typeof checkout !== "object" || Array.isArray(checkout))
-    return null;
-  const path = checkout.path;
-  return typeof path === "string" && path.trim() ? path.trim() : null;
-}
-async function validateAndPersistRemoteRoot(input) {
-  const candidate = input.candidate.trim();
-  if (!candidate || !isAbsolute(candidate)) {
-    return remoteProjectLinkFailure({
-      status: "invalid_root",
-      alias: input.alias,
-      baseUrl: input.baseUrl,
-      repoSlug: input.repoSlug,
-      message: `Remote project root candidate is not an absolute server-host path: ${candidate || "(empty)"}.`
-    });
-  }
-  if (localCheckoutPathCandidate(input.projectRoot, candidate)) {
-    return remoteProjectLinkFailure({
-      status: "invalid_root",
-      alias: input.alias,
-      baseUrl: input.baseUrl,
-      repoSlug: input.repoSlug,
-      message: `Refusing to use local checkout path ${candidate} as a remote server project root.`
-    });
-  }
-  let response;
-  try {
-    response = await requestRemoteProjectLinkJson(input.baseUrl, "/api/server/project-root", input.authToken, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ projectRoot: candidate })
-    });
-  } catch (error) {
-    return remoteProjectLinkFailure({
-      status: "error",
-      alias: input.alias,
-      baseUrl: input.baseUrl,
-      repoSlug: input.repoSlug,
-      message: `Could not validate remote project root ${candidate}: ${error instanceof Error ? error.message : String(error)}`
-    });
-  }
-  if (response.status === 401 || response.status === 403) {
-    return remoteProjectLinkFailure({
-      status: "auth_required",
-      alias: input.alias,
-      baseUrl: input.baseUrl,
-      repoSlug: input.repoSlug,
-      statusCode: response.status,
-      message: `Remote server ${input.alias} requires authentication before validating project root ${candidate}.`
-    });
-  }
-  if (!response.ok) {
-    return remoteProjectLinkFailure({
-      status: "invalid_root",
-      alias: input.alias,
-      baseUrl: input.baseUrl,
-      repoSlug: input.repoSlug,
-      statusCode: response.status,
-      message: `Remote server rejected project root ${candidate} (${response.status}): ${payloadError(response.payload, response.text || "project-root validation failed")}`
-    });
-  }
-  const record = response.payload && typeof response.payload === "object" && !Array.isArray(response.payload) ? response.payload : {};
-  if (record.ok !== true) {
-    return remoteProjectLinkFailure({
-      status: "invalid_root",
-      alias: input.alias,
-      baseUrl: input.baseUrl,
-      repoSlug: input.repoSlug,
-      message: `Remote server did not accept project root ${candidate}: ${payloadError(response.payload, "project-root validation failed")}`
-    });
-  }
-  const accepted = typeof record.projectRoot === "string" && record.projectRoot.trim() ? record.projectRoot.trim() : typeof record.requestedProjectRoot === "string" && record.requestedProjectRoot.trim() ? record.requestedProjectRoot.trim() : candidate;
-  writeRepoServerProjectRoot(input.projectRoot, accepted, { alias: input.alias, baseUrl: input.baseUrl, project: input.repoSlug });
-  writeProjectLinkConnection(input.projectRoot, input.repoSlug, input.alias);
-  const status = input.status ?? (input.prepared ? "prepared" : "backfilled");
-  return remoteProjectLinkSuccess({
-    status,
-    alias: input.alias,
-    baseUrl: input.baseUrl,
-    repoSlug: input.repoSlug,
-    serverProjectRoot: accepted,
-    source: input.source,
-    prepared: input.prepared,
-    validated: true,
-    message: status === "ready" ? `Remote project link already points to ${accepted} and was validated on ${input.alias}.` : input.prepared ? `Prepared and linked remote checkout ${accepted} for ${input.repoSlug}.` : `Backfilled remote checkout ${accepted} for ${input.repoSlug}.`
-  });
-}
-async function ensureRemoteProjectRootLink(projectRoot, options = {}) {
-  let selected;
-  try {
-    selected = resolveSelectedConnection(projectRoot);
-  } catch (error) {
-    return remoteProjectLinkFailure({ status: "error", message: error instanceof Error ? error.message : String(error) });
-  }
-  if (!selected || selected.connection.kind !== "remote") {
-    return remoteProjectLinkFailure({ status: "not_remote", message: "No remote Rig server is selected for this repo." });
-  }
-  const repo = readRepoConnection(projectRoot);
-  const explicitRepoRequested = options.repoSlug !== undefined;
-  const explicitRepoSlug = explicitRepoRequested ? normalizeRepoSlug(options.repoSlug) : null;
-  const repoProjectSlug = normalizeRepoSlug(repo?.project);
-  const repoSlug = explicitRepoSlug ?? repoProjectSlug ?? readProjectLinkSlug(projectRoot);
-  const alias = selected.alias;
-  const baseUrl = selected.connection.baseUrl;
-  const authToken = options.authToken === undefined ? readGitHubBearerTokenForRemote(projectRoot) : options.authToken;
-  const mode = options.mode ?? "backfill-only";
-  if (explicitRepoRequested && !explicitRepoSlug) {
-    return remoteProjectLinkFailure({
-      status: "missing_project",
-      alias,
-      baseUrl,
-      message: `Invalid --repo value ${JSON.stringify(options.repoSlug)}. Expected owner/repo.`
-    });
-  }
-  if (!repoSlug) {
-    return remoteProjectLinkFailure({
-      status: "missing_project",
-      alias,
-      baseUrl,
-      message: `Remote server ${alias} is selected, but this checkout has no GitHub repo slug recorded.`
-    });
-  }
-  const skippedCandidates = [];
-  const storedRoot = selected.serverProjectRoot?.trim() || null;
-  const storedRootMatchesResolvedRepo = repoProjectSlug === repoSlug;
-  if (storedRoot && storedRootMatchesResolvedRepo) {
-    if (localCheckoutPathCandidate(projectRoot, storedRoot)) {
-      clearRepoServerProjectRoot(projectRoot);
-      skippedCandidates.push(storedRoot);
-    } else {
-      const storedResult = await validateAndPersistRemoteRoot({
-        projectRoot,
-        alias,
-        baseUrl,
-        authToken,
-        repoSlug,
-        candidate: storedRoot,
-        source: "stored",
-        status: "ready"
-      });
-      if (storedResult.ok || storedResult.status === "auth_required" || storedResult.status === "error")
-        return storedResult;
-      clearRepoServerProjectRoot(projectRoot);
-      skippedCandidates.push(storedRoot);
-    }
-  } else if (storedRoot) {
-    skippedCandidates.push(storedRoot);
-  }
-  const authCandidate = inferRemoteServerProjectRootCandidateFromAuthState(projectRoot, repoSlug);
-  if (authCandidate) {
-    const authResult = await validateAndPersistRemoteRoot({ projectRoot, alias, baseUrl, authToken, repoSlug, candidate: authCandidate, source: "auth-state" });
-    if (authResult.ok || authResult.status === "auth_required")
-      return authResult;
-  }
-  let registryResponse;
-  try {
-    registryResponse = await requestRemoteProjectLinkJson(baseUrl, `/api/projects/${encodeURIComponent(repoSlug)}`, authToken);
-  } catch (error) {
-    return remoteProjectLinkFailure({
-      status: "error",
-      alias,
-      baseUrl,
-      repoSlug,
-      message: `Could not read remote project registry for ${repoSlug} on ${alias}: ${error instanceof Error ? error.message : String(error)}`
-    });
-  }
-  if (registryResponse.status === 401 || registryResponse.status === 403) {
-    return remoteProjectLinkFailure({
-      status: "auth_required",
-      alias,
-      baseUrl,
-      repoSlug,
-      statusCode: registryResponse.status,
-      message: `Remote server ${alias} requires authentication before reading the ${repoSlug} project registry.`
-    });
-  }
-  if (registryResponse.ok) {
-    const candidates = checkoutPathsFromProjectPayload(registryResponse.payload);
-    for (const candidate of candidates) {
-      const result = await validateAndPersistRemoteRoot({ projectRoot, alias, baseUrl, authToken, repoSlug, candidate, source: "registry" });
-      if (result.ok || result.status === "auth_required")
-        return result;
-      skippedCandidates.push(candidate);
-    }
-    if (mode === "backfill-only") {
-      return remoteProjectLinkFailure({
-        status: candidates.length > 0 ? "invalid_root" : "no_server_checkout",
-        alias,
-        baseUrl,
-        repoSlug,
-        message: candidates.length > 0 ? `Remote registry has checkout candidates for ${repoSlug}, but none validated for ${alias}.` : `Remote registry has ${repoSlug}, but no server checkout path is linked yet.`,
-        skippedCandidates
-      });
-    }
-  } else if (registryResponse.status === 404) {
-    if (mode === "backfill-only") {
-      return remoteProjectLinkFailure({
-        status: "project_not_registered",
-        alias,
-        baseUrl,
-        repoSlug,
-        statusCode: registryResponse.status,
-        message: `Remote server ${alias} has no registered project record for ${repoSlug}.`
-      });
-    }
-  } else {
-    return remoteProjectLinkFailure({
-      status: "error",
-      alias,
-      baseUrl,
-      repoSlug,
-      statusCode: registryResponse.status,
-      message: `Could not backfill ${repoSlug} from remote registry (${registryResponse.status}): ${payloadError(registryResponse.payload, registryResponse.text || "registry lookup failed")}`,
-      skippedCandidates
-    });
-  }
-  let prepareResponse;
-  try {
-    prepareResponse = await requestRemoteProjectLinkJson(baseUrl, `/api/projects/${encodeURIComponent(repoSlug)}/prepare-checkout`, authToken, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ checkout: { kind: "managed-clone" }, repoUrl: `https://github.com/${repoSlug}.git` })
-    });
-  } catch (error) {
-    return remoteProjectLinkFailure({
-      status: "error",
-      alias,
-      baseUrl,
-      repoSlug,
-      message: `Could not prepare remote checkout for ${repoSlug} on ${alias}: ${error instanceof Error ? error.message : String(error)}`
-    });
-  }
-  if (prepareResponse.status === 401 || prepareResponse.status === 403) {
-    return remoteProjectLinkFailure({
-      status: "auth_required",
-      alias,
-      baseUrl,
-      repoSlug,
-      statusCode: prepareResponse.status,
-      message: `Remote server ${alias} requires authentication before preparing ${repoSlug}.`
-    });
-  }
-  if (!prepareResponse.ok) {
-    return remoteProjectLinkFailure({
-      status: "error",
-      alias,
-      baseUrl,
-      repoSlug,
-      statusCode: prepareResponse.status,
-      message: `Remote checkout prepare failed for ${repoSlug} (${prepareResponse.status}): ${payloadError(prepareResponse.payload, prepareResponse.text || "prepare-checkout failed")}`,
-      skippedCandidates
-    });
-  }
-  const preparedPath = checkoutPathFromPreparePayload(prepareResponse.payload);
-  if (!preparedPath) {
-    return remoteProjectLinkFailure({
-      status: "invalid_root",
-      alias,
-      baseUrl,
-      repoSlug,
-      message: `Remote checkout prepare for ${repoSlug} did not return a checkout.path.`,
-      skippedCandidates
-    });
-  }
-  return validateAndPersistRemoteRoot({ projectRoot, alias, baseUrl, authToken, repoSlug, candidate: preparedPath, source: "prepare", prepared: true });
-}
-async function repairRemoteProjectRootLink(context, options = {}) {
-  const resolution = await ensureRemoteProjectRootLink(context.projectRoot, { mode: options.mode ?? "prepare-if-missing", repoSlug: options.repoSlug });
-  if (!resolution.ok)
-    throw new CliError(resolution.message, 1, { hint: resolution.hint });
-  return resolution;
+function readLocalConnectionFallbackToken(projectRoot) {
+  return readGitHubBearerTokenForRemote(projectRoot) ?? cleanToken(process.env.RIG_GITHUB_TOKEN) ?? readStoredGitHubAuthToken(projectRoot);
 }
 async function ensureServerForCli(projectRoot) {
   try {
@@ -871,12 +535,12 @@ async function ensureServerForCli(projectRoot) {
     if (selected?.connection.kind === "remote") {
       reportServerPhase(`Connecting to ${selected.alias}\u2026`);
       const authToken = readGitHubBearerTokenForRemote(projectRoot);
-      const link = await ensureRemoteProjectRootLink(projectRoot, { mode: "backfill-only", authToken });
+      const serverProjectRoot = selected.serverProjectRoot ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
       return {
         baseUrl: selected.connection.baseUrl,
         authToken,
         connectionKind: "remote",
-        serverProjectRoot: link.ok ? link.serverProjectRoot ?? null : null
+        serverProjectRoot
       };
     }
     reportServerPhase("Starting local Rig server\u2026");
@@ -894,23 +558,33 @@ async function ensureServerForCli(projectRoot) {
     throw error;
   }
 }
-function mergeCookie(existing, name, value) {
-  const encoded = `${name}=${encodeURIComponent(value)}`;
-  if (!existing?.trim())
-    return encoded;
-  const parts = existing.split(";").map((part) => part.trim()).filter((part) => part && !part.startsWith(`${name}=`));
-  return [...parts, encoded].join("; ");
-}
-function queryAuthFallbackEnabled(env = process.env) {
-  return env.RIG_ENABLE_QUERY_AUTH_FALLBACK === "1" || env.RIG_QUERY_AUTH_FALLBACK === "1";
+async function backfillRemoteServerProjectRoot(projectRoot, baseUrl, authToken) {
+  const repo = readRepoConnection(projectRoot);
+  const slug = repo?.project?.trim();
+  if (!slug)
+    return null;
+  try {
+    const response = await fetch(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`, {
+      headers: mergeHeaders(undefined, authToken)
+    });
+    if (!response.ok)
+      return null;
+    const payload = await response.json();
+    const project = payload.project && typeof payload.project === "object" && !Array.isArray(payload.project) ? payload.project : null;
+    const checkouts = Array.isArray(project?.checkouts) ? project.checkouts : [];
+    const latestCheckout = [...checkouts].reverse().find((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry) && typeof entry.path === "string"));
+    const path = typeof latestCheckout?.path === "string" && latestCheckout.path.trim() ? latestCheckout.path.trim() : null;
+    if (path)
+      writeRepoServerProjectRoot(projectRoot, path);
+    return path;
+  } catch {
+    return null;
+  }
 }
 function mergeHeaders(headers, authToken) {
   const merged = new Headers(headers);
   if (authToken) {
-    const bearer = `Bearer ${authToken}`;
-    merged.set("authorization", bearer);
-    merged.set("x-auth", bearer);
-    merged.set("cookie", mergeCookie(merged.get("cookie"), "rig_auth", authToken));
+    merged.set("authorization", `Bearer ${authToken}`);
   }
   return merged;
 }
@@ -971,41 +645,15 @@ async function buildServerFailureContext(projectRoot, server) {
     hint: "Check the selected server with `rig server status`, or switch with `rig server use <alias|local>`."
   };
 }
-function isLoopbackRemoteBaseUrl(baseUrl) {
-  try {
-    const host = new URL(baseUrl).hostname.toLowerCase();
-    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
-  } catch {
-    return false;
-  }
-}
-function canUseRemoteWithoutProjectRoot(pathname) {
-  return pathname === "/health" || pathname === "/api/health" || pathname === "/api/server/status" || pathname === "/api/server/project-root" || pathname.startsWith("/api/github/auth/") || pathname === "/api/projects" || pathname.startsWith("/api/projects/");
-}
 async function requestServerJson(context, pathname, init = {}) {
   const server = await ensureServerForCli(context.projectRoot);
-  const requestUrl = new URL(`${server.baseUrl}${pathname}`);
-  let scopedServerProjectRoot = server.serverProjectRoot;
-  if (server.connectionKind === "remote" && !scopedServerProjectRoot && !canUseRemoteWithoutProjectRoot(requestUrl.pathname) && (server.authToken || !isLoopbackRemoteBaseUrl(server.baseUrl))) {
-    const link = await ensureRemoteProjectRootLink(context.projectRoot, { mode: "backfill-only", authToken: server.authToken });
-    if (link.ok && link.serverProjectRoot) {
-      scopedServerProjectRoot = link.serverProjectRoot;
-    } else {
-      const repo = readRepoConnection(context.projectRoot);
-      const target = link.alias && link.baseUrl ? `${link.alias} (${link.baseUrl})` : server.baseUrl;
-      throw new CliError(`Remote server ${target} is selected for ${link.repoSlug ?? repo?.project ?? "this repo"}, but this checkout has no server-host project root link. ${link.message}`, 1, { hint: link.hint });
-    }
-  }
   const headers = mergeHeaders(init.headers, server.authToken);
-  if (scopedServerProjectRoot)
-    headers.set("x-rig-project-root", scopedServerProjectRoot);
-  if (server.connectionKind === "remote" && server.authToken && queryAuthFallbackEnabled()) {
-    requestUrl.searchParams.set("rt", server.authToken);
-  }
+  if (server.serverProjectRoot)
+    headers.set("x-rig-project-root", server.serverProjectRoot);
   reportServerPhase(`${(init.method ?? "GET").toUpperCase()} ${pathname.split("?")[0]}\u2026`);
   let response;
   try {
-    response = await fetch(requestUrl, {
+    response = await fetch(`${server.baseUrl}${pathname}`, {
       ...init,
       headers
     });
@@ -1076,187 +724,10 @@ async function submitTaskRunViaServer(context, input) {
   return { runId };
 }
 
-// packages/cli/src/commands/connect.ts
-function usageName(options) {
-  return `rig ${options.group}`;
-}
-function parseConnection(alias, value, options) {
-  if (alias === "local" && !value)
-    return { kind: "local", mode: "auto" };
-  if (!value)
-    throw new CliError(`Missing remote server URL. Usage: ${usageName(options)} add <alias> <url>`, 1);
-  let parsed;
-  try {
-    parsed = new URL(value);
-  } catch {
-    throw new CliError(`Invalid Rig server URL: ${value}`, 1, { hint: "Pass a full http(s) URL, e.g. `rig server add prod https://rig.example.com`." });
-  }
-  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
-    throw new CliError("Rig remote server URL must be http(s).", 1, { hint: "Use an http:// or https:// URL, e.g. `rig server add prod https://rig.example.com`." });
-  }
-  return { kind: "remote", baseUrl: parsed.toString().replace(/\/+$/, "") };
-}
-function printJsonOrText(context, _payload, text) {
-  if (context.outputMode !== "json") {
-    console.log(text);
-  }
-}
-function formatRemoteProjectLinkText(result) {
-  return formatSuccessCard(result.ok ? "Remote project link ready" : "Remote project link needs repair", [
-    ["selected", result.alias ?? "remote"],
-    ["target", result.baseUrl ?? "unknown"],
-    ["repo", result.repoSlug ?? "owner/repo"],
-    ["status", result.status],
-    ...result.serverProjectRoot ? [["server root", result.serverProjectRoot]] : [],
-    ["next", result.ok ? result.next ?? "rig task list" : result.hint]
-  ]);
-}
-function parseRepairLinkArgs(rest, usage) {
-  let repoSlug;
-  let mode = "prepare-if-missing";
-  const pending = [...rest];
-  while (pending.length > 0) {
-    const token = pending.shift();
-    if (token === "--repo") {
-      const value = pending.shift()?.trim();
-      if (!value)
-        throw new CliError(`Missing --repo value. Usage: ${usage}`, 1);
-      const normalized = normalizeRepoSlug(value);
-      if (!normalized)
-        throw new CliError(`Invalid --repo value: ${value}`, 1, { hint: "Use the canonical owner/repo slug, e.g. `--repo humanity-org/humanwork`." });
-      repoSlug = normalized;
-    } else if (token === "--backfill-only") {
-      mode = "backfill-only";
-    } else if (token === "--prepare") {
-      mode = "prepare-if-missing";
-    } else {
-      throw new CliError(`Unexpected argument: ${String(token)}
-Usage: ${usage}`, 1);
-    }
-  }
-  return { repoSlug, mode };
-}
-async function promptForConnectionAlias(context) {
-  const state = readGlobalConnections();
-  const repo = readRepoConnection(context.projectRoot);
-  const options = [
-    { value: "local", label: "local", hint: "Use/start a local Rig server" },
-    ...Object.entries(state.connections).map(([alias, connection]) => ({
-      value: alias,
-      label: alias,
-      hint: connection.kind === "remote" ? connection.baseUrl : "local"
-    }))
-  ].filter((option, index, all) => all.findIndex((candidate) => candidate.value === option.value) === index);
-  const answer = await droneSelect({
-    message: "Select Rig server for this repo",
-    initialValue: repo?.selected ?? "local",
-    options
-  });
-  if (answer === null) {
-    droneCancel("No server selected.");
-    throw new CliError("No server selected.", 3);
-  }
-  return String(answer);
-}
-async function executeConnectionCommand(context, args, options) {
-  const [command, ...rest] = args;
-  switch (command ?? "status") {
-    case "list": {
-      requireNoExtraArgs(rest, `${usageName(options)} list`);
-      const state = readGlobalConnections();
-      printJsonOrText(context, state, formatConnectionList(state.connections));
-      return { ok: true, group: options.group, command: "list", details: state };
-    }
-    case "add": {
-      const [alias, url, ...extra] = rest;
-      if (!alias)
-        throw new CliError(`Missing alias. Usage: ${usageName(options)} add <alias> <url>`, 1);
-      requireNoExtraArgs(extra, `${usageName(options)} add <alias> <url>`);
-      const connection = parseConnection(alias, url, options);
-      const state = upsertGlobalConnection(alias, connection);
-      printJsonOrText(context, { alias, connection }, formatSuccessCard("Rig server saved", [
-        ["alias", alias],
-        ["target", connection.kind === "remote" ? connection.baseUrl : "local"],
-        ["next", `${usageName(options)} use ${alias}`]
-      ]));
-      return { ok: true, group: options.group, command: "add", details: { alias, connection, count: Object.keys(state.connections).length } };
-    }
-    case "use": {
-      let [alias, ...extra] = rest;
-      requireNoExtraArgs(extra, `${usageName(options)} use <alias|local>`);
-      if (!alias && options.interactiveUse && context.outputMode === "text" && process.stdin.isTTY) {
-        alias = await promptForConnectionAlias(context);
-      }
-      if (!alias)
-        throw new CliError(`Missing alias. Usage: ${usageName(options)} use <alias|local>`, 1);
-      let selectedConnection = { kind: "local", mode: "auto" };
-      if (alias !== "local") {
-        const state = readGlobalConnections();
-        const connection = state.connections[alias];
-        if (!connection)
-          throw new CliError(`Unknown Rig server: ${alias}`, 1, { hint: "Run `rig server list` to see saved aliases, or save one with `rig server add <alias> <url>`." });
-        selectedConnection = connection;
-      }
-      const previousRepo = readRepoConnection(context.projectRoot);
-      const preserveRemoteRoot = Boolean(previousRepo?.serverProjectRoot && previousRepo.selected === alias && selectedConnection.kind === "remote" && previousRepo.serverProjectRootAlias === alias && previousRepo.serverProjectRootBaseUrl === selectedConnection.baseUrl);
-      const repoState = {
-        selected: alias,
-        ...previousRepo?.project ? { project: previousRepo.project } : {},
-        linkedAt: new Date().toISOString(),
-        ...preserveRemoteRoot ? {
-          serverProjectRoot: previousRepo.serverProjectRoot,
-          serverProjectRootAlias: previousRepo.serverProjectRootAlias,
-          serverProjectRootBaseUrl: previousRepo.serverProjectRootBaseUrl
-        } : {}
-      };
-      writeRepoConnection(context.projectRoot, repoState);
-      const remoteProjectLink = alias !== "local" ? await ensureRemoteProjectRootLink(context.projectRoot, { mode: "backfill-only" }).catch((error) => ({
-        ok: false,
-        status: "error",
-        message: error instanceof Error ? error.message : String(error),
-        hint: "Run `rig server repair-link` after authenticating the selected remote."
-      })) : null;
-      const latestRepo = readRepoConnection(context.projectRoot);
-      const details = { selected: latestRepo?.selected ?? alias, repo: latestRepo, remoteProjectLink };
-      printJsonOrText(context, details, formatSuccessCard("Rig server selected", [
-        ["selected", alias],
-        ["scope", "this repo"],
-        ...remoteProjectLink ? [["remote link", remoteProjectLink.ok ? `ready (${remoteProjectLink.serverProjectRoot ?? "linked"})` : `${remoteProjectLink.status}: ${remoteProjectLink.hint}`]] : [],
-        ["next", remoteProjectLink && !remoteProjectLink.ok ? "rig server repair-link" : "rig task list"]
-      ]));
-      return { ok: true, group: options.group, command: "use", details };
-    }
-    case "repair-link": {
-      const parsed = parseRepairLinkArgs(rest, `${usageName(options)} repair-link [--prepare|--backfill-only] [--repo owner/repo]`);
-      const result = await repairRemoteProjectRootLink(context, parsed);
-      printJsonOrText(context, result, formatRemoteProjectLinkText(result));
-      return { ok: true, group: options.group, command: "repair-link", details: result };
-    }
-    case "status": {
-      requireNoExtraArgs(rest, `${usageName(options)} status`);
-      const repo = readRepoConnection(context.projectRoot);
-      const global = readGlobalConnections();
-      const remoteProjectLink = repo?.selected && repo.selected !== "local" ? await ensureRemoteProjectRootLink(context.projectRoot, { mode: "backfill-only" }).catch((error) => ({
-        ok: false,
-        status: "error",
-        message: error instanceof Error ? error.message : String(error),
-        hint: "Run `rig server repair-link` after authenticating the selected remote."
-      })) : null;
-      const latestRepo = readRepoConnection(context.projectRoot) ?? repo;
-      const details = { selected: latestRepo?.selected ?? "local", repo: latestRepo, connections: global.connections, remoteProjectLink };
-      printJsonOrText(context, details, formatConnectionStatus(details.selected, global.connections, latestRepo ?? null, remoteProjectLink));
-      return { ok: true, group: options.group, command: "status", details };
-    }
-    default:
-      throw new CliError(`Unknown ${options.group} command: ${String(command)}
-Usage: ${usageName(options)} <list|add|use|status|repair-link>`, 1);
-  }
-}
-
 // packages/cli/src/commands/server.ts
 async function executeServer(context, args, options) {
   const [command = "status", ...rest] = args;
-  if (["status", "list", "add", "use", "repair-link"].includes(command)) {
+  if (["status", "list", "add", "use"].includes(command)) {
     return executeConnectionCommand(context, [command, ...rest], { group: "server", interactiveUse: true });
   }
   switch (command) {