@h-rig/cli 0.0.6-alpha.89 → 0.0.6-alpha.90

package/dist/src/commands/task.js

@@ -110,7 +110,7 @@ function createTtySpinner(input) {
       output.write("\r\x1B[2K");
   };
   render();
-  const timer = isTty ? setInterval(render, input.intervalMs ?? 16) : null;
+  const timer = isTty ? setInterval(render, input.intervalMs ?? 120) : null;
   return {
     setLabel(next) {
       label = next;
@@ -306,8 +306,18 @@ import {
 import { resolveMonorepoRoot } from "@rig/runtime/control-plane/native/utils";
 
 // packages/cli/src/commands/_authority-runs.ts
-function normalizeRuntimeAdapter(_value) {
-  return "pi";
+function normalizeRuntimeAdapter(value) {
+  const normalized = value?.trim().toLowerCase();
+  if (!normalized) {
+    return "pi";
+  }
+  if (normalized === "codex" || normalized === "codex-cli" || normalized === "codex-app-server" || normalized === "gpt-codex") {
+    return "codex";
+  }
+  if (normalized === "pi" || normalized === "rig-pi" || normalized === "@rig/pi") {
+    return "pi";
+  }
+  return "claude-code";
 }
 
 // packages/cli/src/commands/_preflight.ts
@@ -384,28 +394,12 @@ function readRepoConnection(projectRoot) {
     selected,
     project: typeof record.project === "string" ? record.project : undefined,
     linkedAt: typeof record.linkedAt === "string" ? record.linkedAt : undefined,
-    serverProjectRoot: typeof record.serverProjectRoot === "string" && record.serverProjectRoot.trim() ? record.serverProjectRoot.trim() : undefined,
-    serverProjectRootAlias: typeof record.serverProjectRootAlias === "string" && record.serverProjectRootAlias.trim() ? record.serverProjectRootAlias.trim() : undefined,
-    serverProjectRootBaseUrl: typeof record.serverProjectRootBaseUrl === "string" && record.serverProjectRootBaseUrl.trim() ? record.serverProjectRootBaseUrl.trim().replace(/\/+$/, "") : undefined
+    serverProjectRoot: typeof record.serverProjectRoot === "string" && record.serverProjectRoot.trim() ? record.serverProjectRoot.trim() : undefined
   };
 }
 function writeRepoConnection(projectRoot, state) {
   writeJsonFile(resolveRepoConnectionPath(projectRoot), state);
 }
-function rootAllowedForSelection(repo, connection) {
-  const root = repo.serverProjectRoot?.trim();
-  if (!root)
-    return;
-  if (connection.kind === "remote") {
-    if (repo.serverProjectRootAlias !== repo.selected)
-      return;
-    if (repo.serverProjectRootBaseUrl !== connection.baseUrl)
-      return;
-  } else if (repo.serverProjectRootAlias && repo.serverProjectRootAlias !== repo.selected) {
-    return;
-  }
-  return root;
-}
 function resolveSelectedConnection(projectRoot, options = {}) {
   const repo = readRepoConnection(projectRoot);
   if (!repo)
@@ -417,46 +411,18 @@ function resolveSelectedConnection(projectRoot, options = {}) {
   if (!connection) {
     throw new CliError(`Selected Rig server "${repo.selected}" was not found. Run \`rig server list\` or \`rig server use local\`.`, 1);
   }
-  return { alias: repo.selected, connection, serverProjectRoot: rootAllowedForSelection(repo, connection) };
-}
-function writeRepoServerProjectRoot(projectRoot, serverProjectRoot, metadata = {}) {
-  const repo = readRepoConnection(projectRoot);
-  if (!repo)
-    return;
-  let inferred = metadata;
-  if (!inferred.alias || !inferred.baseUrl) {
-    try {
-      const selected = resolveSelectedConnection(projectRoot);
-      if (selected?.connection.kind === "remote") {
-        inferred = {
-          alias: inferred.alias ?? selected.alias,
-          baseUrl: inferred.baseUrl ?? selected.connection.baseUrl
-        };
-      }
-    } catch {}
-  }
-  writeRepoConnection(projectRoot, {
-    ...repo,
-    ...metadata.project ? { project: metadata.project } : {},
-    serverProjectRoot,
-    ...inferred.alias ? { serverProjectRootAlias: inferred.alias } : {},
-    ...inferred.baseUrl ? { serverProjectRootBaseUrl: inferred.baseUrl.replace(/\/+$/, "") } : {}
-  });
+  return { alias: repo.selected, connection, serverProjectRoot: repo.serverProjectRoot };
 }
-function clearRepoServerProjectRoot(projectRoot) {
+function writeRepoServerProjectRoot(projectRoot, serverProjectRoot) {
   const repo = readRepoConnection(projectRoot);
   if (!repo)
     return;
-  writeRepoConnection(projectRoot, {
-    selected: repo.selected,
-    ...repo.project ? { project: repo.project } : {},
-    ...repo.linkedAt ? { linkedAt: repo.linkedAt } : {}
-  });
+  writeRepoConnection(projectRoot, { ...repo, serverProjectRoot });
 }
 
 // packages/cli/src/commands/_server-client.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname2, isAbsolute, resolve as resolve2 } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve2 } from "path";
 import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
 var scopedGitHubBearerTokens = new Map;
 var serverPhaseListener = null;
@@ -472,21 +438,17 @@ function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
 }
-function readRemoteAuthState(projectRoot) {
+function readPrivateRemoteSessionToken(projectRoot) {
   const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
   if (!existsSync2(path))
     return null;
   try {
     const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
   } catch {
     return null;
   }
 }
-function readPrivateRemoteSessionToken(projectRoot) {
-  const parsed = readRemoteAuthState(projectRoot);
-  return parsed ? cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined) : null;
-}
 function readGitHubBearerTokenForRemote(projectRoot) {
   const scopedKey = resolve2(projectRoot);
   if (scopedGitHubBearerTokens.has(scopedKey))
@@ -497,415 +459,18 @@ function readGitHubBearerTokenForRemote(projectRoot) {
   return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
 }
 function readStoredGitHubAuthToken(projectRoot) {
-  const parsed = readRemoteAuthState(projectRoot);
-  return parsed ? cleanToken(typeof parsed.token === "string" ? parsed.token : undefined) : null;
-}
-function inferRemoteServerProjectRootCandidateFromAuthState(projectRoot, repoSlug) {
-  if (!/^[^/]+\/[^/]+$/.test(repoSlug))
-    return null;
-  const repo = readRepoConnection(projectRoot);
-  const auth = readRemoteAuthState(projectRoot);
-  const authUpdatedAt = typeof auth?.updatedAt === "string" ? Date.parse(auth.updatedAt) : Number.NaN;
-  const repoLinkedAt = typeof repo?.linkedAt === "string" ? Date.parse(repo.linkedAt) : Number.NaN;
-  if (Number.isFinite(authUpdatedAt) && Number.isFinite(repoLinkedAt) && authUpdatedAt + 1000 < repoLinkedAt)
-    return null;
-  const checkoutBaseDir = typeof auth?.checkoutBaseDir === "string" && auth.checkoutBaseDir.trim() ? auth.checkoutBaseDir.trim() : null;
-  if (!checkoutBaseDir)
-    return null;
-  return `${checkoutBaseDir.replace(/\/+$/, "")}/${repoSlug}`;
-}
-function readLocalConnectionFallbackToken(projectRoot) {
-  return readGitHubBearerTokenForRemote(projectRoot) ?? cleanToken(process.env.RIG_GITHUB_TOKEN) ?? readStoredGitHubAuthToken(projectRoot);
-}
-function normalizeRepoSlug(value) {
-  const slug = value?.trim();
-  return slug && /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
-}
-function readProjectLinkSlug(projectRoot) {
-  const path = resolve2(projectRoot, ".rig", "state", "project-link.json");
+  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
   if (!existsSync2(path))
     return null;
   try {
     const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-      return null;
-    return normalizeRepoSlug(typeof parsed.repoSlug === "string" ? String(parsed.repoSlug) : null);
+    return cleanToken(typeof parsed.token === "string" ? parsed.token : undefined);
   } catch {
     return null;
   }
 }
-function writeProjectLinkConnection(projectRoot, repoSlug, alias) {
-  const path = resolve2(projectRoot, ".rig", "state", "project-link.json");
-  mkdirSync2(dirname2(path), { recursive: true });
-  writeFileSync2(path, `${JSON.stringify({ repoSlug, connection: alias, linkedAt: new Date().toISOString() }, null, 2)}
-`, "utf8");
-}
-function remoteLinkRepairCommand(repoSlug) {
-  return repoSlug ? `rig server repair-link --repo ${repoSlug}` : "rig server repair-link --repo owner/repo";
-}
-function formatRemoteProjectLinkHint(resolution) {
-  const repair = remoteLinkRepairCommand(resolution.repoSlug);
-  if (resolution.status === "auth_required") {
-    return `Authenticate the selected remote${resolution.alias ? ` (${resolution.alias})` : ""}, then run \`${repair}\`. Use \`rig github auth import-gh\` or \`rig init --repair --server remote --github-auth device${resolution.repoSlug ? ` --repo ${resolution.repoSlug}` : ""}\`.`;
-  }
-  if (resolution.status === "missing_project") {
-    return `Record the repo slug, then run \`${repair}\` (or \`rig init --repo owner/repo --server remote --github-auth device\`).`;
-  }
-  if (resolution.status === "not_remote")
-    return "Select a remote server with `rig server use <alias>` before repairing a remote project link.";
-  return `Run \`${repair}\` to backfill or prepare a server-host checkout for the selected remote${resolution.alias ? ` (${resolution.alias})` : ""}.`;
-}
-function remoteProjectLinkFailure(input) {
-  const partial = {
-    status: input.status,
-    alias: input.alias,
-    baseUrl: input.baseUrl,
-    repoSlug: input.repoSlug
-  };
-  return {
-    ok: false,
-    ...input,
-    hint: formatRemoteProjectLinkHint(partial),
-    next: remoteLinkRepairCommand(input.repoSlug)
-  };
-}
-function remoteProjectLinkSuccess(input) {
-  return {
-    ok: true,
-    status: input.status,
-    alias: input.alias,
-    baseUrl: input.baseUrl,
-    repoSlug: input.repoSlug,
-    serverProjectRoot: input.serverProjectRoot,
-    source: input.source,
-    prepared: input.prepared ?? input.status === "prepared",
-    validated: input.validated ?? false,
-    message: input.message ?? `Remote project link ready for ${input.repoSlug}.`,
-    hint: "Remote-scoped task/run/status requests will send x-rig-project-root for this server-host checkout.",
-    next: "rig task list"
-  };
-}
-function localCheckoutPathCandidate(projectRoot, candidate) {
-  try {
-    const local = resolve2(projectRoot);
-    const resolved = resolve2(candidate);
-    return resolved === local || resolved.startsWith(`${local}/`);
-  } catch {
-    return false;
-  }
-}
-async function requestRemoteProjectLinkJson(baseUrl, pathname, authToken, init = {}) {
-  const requestUrl = new URL(`${baseUrl}${pathname}`);
-  if (authToken && queryAuthFallbackEnabled())
-    requestUrl.searchParams.set("rt", authToken);
-  const response = await fetch(requestUrl, {
-    ...init,
-    headers: mergeHeaders(init.headers, authToken)
-  });
-  const text = await response.text();
-  const payload = text.trim().length > 0 ? (() => {
-    try {
-      return JSON.parse(text);
-    } catch {
-      return null;
-    }
-  })() : null;
-  return { ok: response.ok, status: response.status, payload, text };
-}
-function payloadError(payload, fallback) {
-  if (payload && typeof payload === "object" && !Array.isArray(payload)) {
-    const record = payload;
-    const value = record.error ?? record.message ?? record.reason;
-    if (typeof value === "string" && value.trim())
-      return value.trim();
-  }
-  return fallback;
-}
-function checkoutPathsFromProjectPayload(payload) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
-    return [];
-  const project = payload.project;
-  if (!project || typeof project !== "object" || Array.isArray(project))
-    return [];
-  const checkouts = project.checkouts;
-  if (!Array.isArray(checkouts))
-    return [];
-  return [...checkouts].reverse().flatMap((entry) => {
-    if (!entry || typeof entry !== "object" || Array.isArray(entry))
-      return [];
-    const path = entry.path;
-    return typeof path === "string" && path.trim() ? [path.trim()] : [];
-  });
-}
-function checkoutPathFromPreparePayload(payload) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
-    return null;
-  const checkout = payload.checkout;
-  if (!checkout || typeof checkout !== "object" || Array.isArray(checkout))
-    return null;
-  const path = checkout.path;
-  return typeof path === "string" && path.trim() ? path.trim() : null;
-}
-async function validateAndPersistRemoteRoot(input) {
-  const candidate = input.candidate.trim();
-  if (!candidate || !isAbsolute(candidate)) {
-    return remoteProjectLinkFailure({
-      status: "invalid_root",
-      alias: input.alias,
-      baseUrl: input.baseUrl,
-      repoSlug: input.repoSlug,
-      message: `Remote project root candidate is not an absolute server-host path: ${candidate || "(empty)"}.`
-    });
-  }
-  if (localCheckoutPathCandidate(input.projectRoot, candidate)) {
-    return remoteProjectLinkFailure({
-      status: "invalid_root",
-      alias: input.alias,
-      baseUrl: input.baseUrl,
-      repoSlug: input.repoSlug,
-      message: `Refusing to use local checkout path ${candidate} as a remote server project root.`
-    });
-  }
-  let response;
-  try {
-    response = await requestRemoteProjectLinkJson(input.baseUrl, "/api/server/project-root", input.authToken, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ projectRoot: candidate })
-    });
-  } catch (error) {
-    return remoteProjectLinkFailure({
-      status: "error",
-      alias: input.alias,
-      baseUrl: input.baseUrl,
-      repoSlug: input.repoSlug,
-      message: `Could not validate remote project root ${candidate}: ${error instanceof Error ? error.message : String(error)}`
-    });
-  }
-  if (response.status === 401 || response.status === 403) {
-    return remoteProjectLinkFailure({
-      status: "auth_required",
-      alias: input.alias,
-      baseUrl: input.baseUrl,
-      repoSlug: input.repoSlug,
-      statusCode: response.status,
-      message: `Remote server ${input.alias} requires authentication before validating project root ${candidate}.`
-    });
-  }
-  if (!response.ok) {
-    return remoteProjectLinkFailure({
-      status: "invalid_root",
-      alias: input.alias,
-      baseUrl: input.baseUrl,
-      repoSlug: input.repoSlug,
-      statusCode: response.status,
-      message: `Remote server rejected project root ${candidate} (${response.status}): ${payloadError(response.payload, response.text || "project-root validation failed")}`
-    });
-  }
-  const record = response.payload && typeof response.payload === "object" && !Array.isArray(response.payload) ? response.payload : {};
-  if (record.ok !== true) {
-    return remoteProjectLinkFailure({
-      status: "invalid_root",
-      alias: input.alias,
-      baseUrl: input.baseUrl,
-      repoSlug: input.repoSlug,
-      message: `Remote server did not accept project root ${candidate}: ${payloadError(response.payload, "project-root validation failed")}`
-    });
-  }
-  const accepted = typeof record.projectRoot === "string" && record.projectRoot.trim() ? record.projectRoot.trim() : typeof record.requestedProjectRoot === "string" && record.requestedProjectRoot.trim() ? record.requestedProjectRoot.trim() : candidate;
-  writeRepoServerProjectRoot(input.projectRoot, accepted, { alias: input.alias, baseUrl: input.baseUrl, project: input.repoSlug });
-  writeProjectLinkConnection(input.projectRoot, input.repoSlug, input.alias);
-  const status = input.status ?? (input.prepared ? "prepared" : "backfilled");
-  return remoteProjectLinkSuccess({
-    status,
-    alias: input.alias,
-    baseUrl: input.baseUrl,
-    repoSlug: input.repoSlug,
-    serverProjectRoot: accepted,
-    source: input.source,
-    prepared: input.prepared,
-    validated: true,
-    message: status === "ready" ? `Remote project link already points to ${accepted} and was validated on ${input.alias}.` : input.prepared ? `Prepared and linked remote checkout ${accepted} for ${input.repoSlug}.` : `Backfilled remote checkout ${accepted} for ${input.repoSlug}.`
-  });
-}
-async function ensureRemoteProjectRootLink(projectRoot, options = {}) {
-  let selected;
-  try {
-    selected = resolveSelectedConnection(projectRoot);
-  } catch (error) {
-    return remoteProjectLinkFailure({ status: "error", message: error instanceof Error ? error.message : String(error) });
-  }
-  if (!selected || selected.connection.kind !== "remote") {
-    return remoteProjectLinkFailure({ status: "not_remote", message: "No remote Rig server is selected for this repo." });
-  }
-  const repo = readRepoConnection(projectRoot);
-  const explicitRepoRequested = options.repoSlug !== undefined;
-  const explicitRepoSlug = explicitRepoRequested ? normalizeRepoSlug(options.repoSlug) : null;
-  const repoProjectSlug = normalizeRepoSlug(repo?.project);
-  const repoSlug = explicitRepoSlug ?? repoProjectSlug ?? readProjectLinkSlug(projectRoot);
-  const alias = selected.alias;
-  const baseUrl = selected.connection.baseUrl;
-  const authToken = options.authToken === undefined ? readGitHubBearerTokenForRemote(projectRoot) : options.authToken;
-  const mode = options.mode ?? "backfill-only";
-  if (explicitRepoRequested && !explicitRepoSlug) {
-    return remoteProjectLinkFailure({
-      status: "missing_project",
-      alias,
-      baseUrl,
-      message: `Invalid --repo value ${JSON.stringify(options.repoSlug)}. Expected owner/repo.`
-    });
-  }
-  if (!repoSlug) {
-    return remoteProjectLinkFailure({
-      status: "missing_project",
-      alias,
-      baseUrl,
-      message: `Remote server ${alias} is selected, but this checkout has no GitHub repo slug recorded.`
-    });
-  }
-  const skippedCandidates = [];
-  const storedRoot = selected.serverProjectRoot?.trim() || null;
-  const storedRootMatchesResolvedRepo = repoProjectSlug === repoSlug;
-  if (storedRoot && storedRootMatchesResolvedRepo) {
-    if (localCheckoutPathCandidate(projectRoot, storedRoot)) {
-      clearRepoServerProjectRoot(projectRoot);
-      skippedCandidates.push(storedRoot);
-    } else {
-      const storedResult = await validateAndPersistRemoteRoot({
-        projectRoot,
-        alias,
-        baseUrl,
-        authToken,
-        repoSlug,
-        candidate: storedRoot,
-        source: "stored",
-        status: "ready"
-      });
-      if (storedResult.ok || storedResult.status === "auth_required" || storedResult.status === "error")
-        return storedResult;
-      clearRepoServerProjectRoot(projectRoot);
-      skippedCandidates.push(storedRoot);
-    }
-  } else if (storedRoot) {
-    skippedCandidates.push(storedRoot);
-  }
-  const authCandidate = inferRemoteServerProjectRootCandidateFromAuthState(projectRoot, repoSlug);
-  if (authCandidate) {
-    const authResult = await validateAndPersistRemoteRoot({ projectRoot, alias, baseUrl, authToken, repoSlug, candidate: authCandidate, source: "auth-state" });
-    if (authResult.ok || authResult.status === "auth_required")
-      return authResult;
-  }
-  let registryResponse;
-  try {
-    registryResponse = await requestRemoteProjectLinkJson(baseUrl, `/api/projects/${encodeURIComponent(repoSlug)}`, authToken);
-  } catch (error) {
-    return remoteProjectLinkFailure({
-      status: "error",
-      alias,
-      baseUrl,
-      repoSlug,
-      message: `Could not read remote project registry for ${repoSlug} on ${alias}: ${error instanceof Error ? error.message : String(error)}`
-    });
-  }
-  if (registryResponse.status === 401 || registryResponse.status === 403) {
-    return remoteProjectLinkFailure({
-      status: "auth_required",
-      alias,
-      baseUrl,
-      repoSlug,
-      statusCode: registryResponse.status,
-      message: `Remote server ${alias} requires authentication before reading the ${repoSlug} project registry.`
-    });
-  }
-  if (registryResponse.ok) {
-    const candidates = checkoutPathsFromProjectPayload(registryResponse.payload);
-    for (const candidate of candidates) {
-      const result = await validateAndPersistRemoteRoot({ projectRoot, alias, baseUrl, authToken, repoSlug, candidate, source: "registry" });
-      if (result.ok || result.status === "auth_required")
-        return result;
-      skippedCandidates.push(candidate);
-    }
-    if (mode === "backfill-only") {
-      return remoteProjectLinkFailure({
-        status: candidates.length > 0 ? "invalid_root" : "no_server_checkout",
-        alias,
-        baseUrl,
-        repoSlug,
-        message: candidates.length > 0 ? `Remote registry has checkout candidates for ${repoSlug}, but none validated for ${alias}.` : `Remote registry has ${repoSlug}, but no server checkout path is linked yet.`,
-        skippedCandidates
-      });
-    }
-  } else if (registryResponse.status === 404) {
-    if (mode === "backfill-only") {
-      return remoteProjectLinkFailure({
-        status: "project_not_registered",
-        alias,
-        baseUrl,
-        repoSlug,
-        statusCode: registryResponse.status,
-        message: `Remote server ${alias} has no registered project record for ${repoSlug}.`
-      });
-    }
-  } else {
-    return remoteProjectLinkFailure({
-      status: "error",
-      alias,
-      baseUrl,
-      repoSlug,
-      statusCode: registryResponse.status,
-      message: `Could not backfill ${repoSlug} from remote registry (${registryResponse.status}): ${payloadError(registryResponse.payload, registryResponse.text || "registry lookup failed")}`,
-      skippedCandidates
-    });
-  }
-  let prepareResponse;
-  try {
-    prepareResponse = await requestRemoteProjectLinkJson(baseUrl, `/api/projects/${encodeURIComponent(repoSlug)}/prepare-checkout`, authToken, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ checkout: { kind: "managed-clone" }, repoUrl: `https://github.com/${repoSlug}.git` })
-    });
-  } catch (error) {
-    return remoteProjectLinkFailure({
-      status: "error",
-      alias,
-      baseUrl,
-      repoSlug,
-      message: `Could not prepare remote checkout for ${repoSlug} on ${alias}: ${error instanceof Error ? error.message : String(error)}`
-    });
-  }
-  if (prepareResponse.status === 401 || prepareResponse.status === 403) {
-    return remoteProjectLinkFailure({
-      status: "auth_required",
-      alias,
-      baseUrl,
-      repoSlug,
-      statusCode: prepareResponse.status,
-      message: `Remote server ${alias} requires authentication before preparing ${repoSlug}.`
-    });
-  }
-  if (!prepareResponse.ok) {
-    return remoteProjectLinkFailure({
-      status: "error",
-      alias,
-      baseUrl,
-      repoSlug,
-      statusCode: prepareResponse.status,
-      message: `Remote checkout prepare failed for ${repoSlug} (${prepareResponse.status}): ${payloadError(prepareResponse.payload, prepareResponse.text || "prepare-checkout failed")}`,
-      skippedCandidates
-    });
-  }
-  const preparedPath = checkoutPathFromPreparePayload(prepareResponse.payload);
-  if (!preparedPath) {
-    return remoteProjectLinkFailure({
-      status: "invalid_root",
-      alias,
-      baseUrl,
-      repoSlug,
-      message: `Remote checkout prepare for ${repoSlug} did not return a checkout.path.`,
-      skippedCandidates
-    });
-  }
-  return validateAndPersistRemoteRoot({ projectRoot, alias, baseUrl, authToken, repoSlug, candidate: preparedPath, source: "prepare", prepared: true });
+function readLocalConnectionFallbackToken(projectRoot) {
+  return readGitHubBearerTokenForRemote(projectRoot) ?? cleanToken(process.env.RIG_GITHUB_TOKEN) ?? readStoredGitHubAuthToken(projectRoot);
 }
 async function ensureServerForCli(projectRoot) {
   try {
@@ -913,12 +478,12 @@ async function ensureServerForCli(projectRoot) {
     if (selected?.connection.kind === "remote") {
       reportServerPhase(`Connecting to ${selected.alias}\u2026`);
       const authToken = readGitHubBearerTokenForRemote(projectRoot);
-      const link = await ensureRemoteProjectRootLink(projectRoot, { mode: "backfill-only", authToken });
+      const serverProjectRoot = selected.serverProjectRoot ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
       return {
         baseUrl: selected.connection.baseUrl,
         authToken,
         connectionKind: "remote",
-        serverProjectRoot: link.ok ? link.serverProjectRoot ?? null : null
+        serverProjectRoot
       };
     }
     reportServerPhase("Starting local Rig server\u2026");
@@ -936,6 +501,29 @@ async function ensureServerForCli(projectRoot) {
     throw error;
   }
 }
+async function backfillRemoteServerProjectRoot(projectRoot, baseUrl, authToken) {
+  const repo = readRepoConnection(projectRoot);
+  const slug = repo?.project?.trim();
+  if (!slug)
+    return null;
+  try {
+    const response = await fetch(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`, {
+      headers: mergeHeaders(undefined, authToken)
+    });
+    if (!response.ok)
+      return null;
+    const payload = await response.json();
+    const project = payload.project && typeof payload.project === "object" && !Array.isArray(payload.project) ? payload.project : null;
+    const checkouts = Array.isArray(project?.checkouts) ? project.checkouts : [];
+    const latestCheckout = [...checkouts].reverse().find((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry) && typeof entry.path === "string"));
+    const path = typeof latestCheckout?.path === "string" && latestCheckout.path.trim() ? latestCheckout.path.trim() : null;
+    if (path)
+      writeRepoServerProjectRoot(projectRoot, path);
+    return path;
+  } catch {
+    return null;
+  }
+}
 function appendTaskFilterParams(url, filters) {
   if (filters.assignee)
     url.searchParams.set("assignee", filters.assignee);
@@ -946,23 +534,10 @@ function appendTaskFilterParams(url, filters) {
   if (filters.limit !== undefined)
     url.searchParams.set("limit", String(filters.limit));
 }
-function mergeCookie(existing, name, value) {
-  const encoded = `${name}=${encodeURIComponent(value)}`;
-  if (!existing?.trim())
-    return encoded;
-  const parts = existing.split(";").map((part) => part.trim()).filter((part) => part && !part.startsWith(`${name}=`));
-  return [...parts, encoded].join("; ");
-}
-function queryAuthFallbackEnabled(env = process.env) {
-  return env.RIG_ENABLE_QUERY_AUTH_FALLBACK === "1" || env.RIG_QUERY_AUTH_FALLBACK === "1";
-}
 function mergeHeaders(headers, authToken) {
   const merged = new Headers(headers);
   if (authToken) {
-    const bearer = `Bearer ${authToken}`;
-    merged.set("authorization", bearer);
-    merged.set("x-auth", bearer);
-    merged.set("cookie", mergeCookie(merged.get("cookie"), "rig_auth", authToken));
+    merged.set("authorization", `Bearer ${authToken}`);
   }
   return merged;
 }
@@ -1023,41 +598,15 @@ async function buildServerFailureContext(projectRoot, server) {
     hint: "Check the selected server with `rig server status`, or switch with `rig server use <alias|local>`."
   };
 }
-function isLoopbackRemoteBaseUrl(baseUrl) {
-  try {
-    const host = new URL(baseUrl).hostname.toLowerCase();
-    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
-  } catch {
-    return false;
-  }
-}
-function canUseRemoteWithoutProjectRoot(pathname) {
-  return pathname === "/health" || pathname === "/api/health" || pathname === "/api/server/status" || pathname === "/api/server/project-root" || pathname.startsWith("/api/github/auth/") || pathname === "/api/projects" || pathname.startsWith("/api/projects/");
-}
 async function requestServerJson(context, pathname, init = {}) {
   const server = await ensureServerForCli(context.projectRoot);
-  const requestUrl = new URL(`${server.baseUrl}${pathname}`);
-  let scopedServerProjectRoot = server.serverProjectRoot;
-  if (server.connectionKind === "remote" && !scopedServerProjectRoot && !canUseRemoteWithoutProjectRoot(requestUrl.pathname) && (server.authToken || !isLoopbackRemoteBaseUrl(server.baseUrl))) {
-    const link = await ensureRemoteProjectRootLink(context.projectRoot, { mode: "backfill-only", authToken: server.authToken });
-    if (link.ok && link.serverProjectRoot) {
-      scopedServerProjectRoot = link.serverProjectRoot;
-    } else {
-      const repo = readRepoConnection(context.projectRoot);
-      const target = link.alias && link.baseUrl ? `${link.alias} (${link.baseUrl})` : server.baseUrl;
-      throw new CliError(`Remote server ${target} is selected for ${link.repoSlug ?? repo?.project ?? "this repo"}, but this checkout has no server-host project root link. ${link.message}`, 1, { hint: link.hint });
-    }
-  }
   const headers = mergeHeaders(init.headers, server.authToken);
-  if (scopedServerProjectRoot)
-    headers.set("x-rig-project-root", scopedServerProjectRoot);
-  if (server.connectionKind === "remote" && server.authToken && queryAuthFallbackEnabled()) {
-    requestUrl.searchParams.set("rt", server.authToken);
-  }
+  if (server.serverProjectRoot)
+    headers.set("x-rig-project-root", server.serverProjectRoot);
   reportServerPhase(`${(init.method ?? "GET").toUpperCase()} ${pathname.split("?")[0]}\u2026`);
   let response;
   try {
-    response = await fetch(requestUrl, {
+    response = await fetch(`${server.baseUrl}${pathname}`, {
       ...init,
       headers
     });
@@ -1261,14 +810,6 @@ function permissionAllowsPr(payload) {
 function isNotFoundError(error) {
   return /\b(404|not found)\b/i.test(message(error));
 }
-function isLoopbackBaseUrl(baseUrl) {
-  try {
-    const host = new URL(baseUrl).hostname.toLowerCase();
-    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
-  } catch {
-    return false;
-  }
-}
 function projectCheckoutReady(payload) {
   if (!payload || typeof payload !== "object" || Array.isArray(payload))
     return null;
@@ -1322,38 +863,25 @@ async function runFastTaskRunPreflight(context, options = {}) {
     }
   }
   const repo = readRepoConnection(context.projectRoot);
-  const remoteWithoutProjectLink = selectedServer?.connectionKind === "remote" && !repo?.project;
-  let remoteRootBlocked = false;
-  checks.push(repo ? preflightCheck("project-link", "project linked to selected server", repo.project ? "pass" : remoteWithoutProjectLink ? "fail" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : " (missing project link)"}`, remoteWithoutProjectLink ? "Run `rig server repair-link --repo owner/repo` or `rig init --repo owner/repo --server remote` to restore the remote project link." : "Run `rig init --yes --repo owner/repo` to record the GitHub repo slug.") : preflightCheck("project-link", "project linked to selected server", legacyServerCompatibility ? "warn" : "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig server use <alias|local>`."));
-  if (selectedServer?.connectionKind === "remote" && repo?.project && !selectedServer.serverProjectRoot) {
-    const link = await ensureRemoteProjectRootLink(context.projectRoot, { mode: "backfill-only", authToken: selectedServer.authToken });
-    const loopbackDevRemote = !selectedServer.authToken && isLoopbackBaseUrl(selectedServer.baseUrl);
-    checks.push(preflightCheck("remote-project-root-link", "remote server checkout/root linked", link.ok ? "pass" : loopbackDevRemote ? "warn" : "fail", link.ok ? `${link.repoSlug} -> ${link.serverProjectRoot}` : link.message, link.ok ? undefined : loopbackDevRemote ? "Loopback development remotes may continue without x-rig-project-root; production remotes must run `rig server repair-link`." : link.hint));
-    remoteRootBlocked = !link.ok && !loopbackDevRemote;
-  }
+  checks.push(repo ? preflightCheck("project-link", "project linked to Rig server", repo.project ? "pass" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : ""}`, "Run `rig init --yes --repo owner/repo` to record the GitHub repo slug.") : preflightCheck("project-link", "project linked to Rig server", legacyServerCompatibility ? "warn" : "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig server use <alias|local>`."));
   try {
     const auth = await request("/api/github/auth/status");
     checks.push(isAuthenticated(auth) ? preflightCheck("github-auth", "GitHub auth valid", "pass") : preflightCheck("github-auth", "GitHub auth valid", legacyServerCompatibility ? "warn" : "fail", "not authenticated", "Run `rig github auth import-gh` or `rig github auth token --token <token>`."));
   } catch (error) {
     checks.push(preflightCheck("github-auth", "GitHub auth valid", legacyServerCompatibility ? "warn" : "fail", message(error), "Fix GitHub auth on the selected Rig server."));
   }
-  if (!remoteRootBlocked) {
-    try {
-      const projection = await request("/api/workspace/task-projection");
-      checks.push(preflightCheck("task-projection", "task projection ready", "pass", JSON.stringify(projection).slice(0, 120)));
-    } catch (error) {
-      checks.push(preflightCheck("task-projection", "task projection ready", "warn", message(error), "Refresh task projection with `rig task list` before launching."));
-    }
-    try {
-      const permissions = await request("/api/github/repo/permissions");
-      const allowed = permissionAllowsPr(permissions);
-      checks.push(allowed === false ? preflightCheck("github-repo-permissions", "GitHub PR permissions", "fail", JSON.stringify(permissions).slice(0, 120), "Grant the selected GitHub token permission to push branches and open PRs.") : preflightCheck("github-repo-permissions", "GitHub PR permissions", allowed === true ? "pass" : "warn", JSON.stringify(permissions).slice(0, 120), "Confirm the selected token can push branches and open PRs."));
-    } catch (error) {
-      checks.push(preflightCheck("github-repo-permissions", "GitHub PR permissions", "warn", message(error), "Ensure the selected token can push branches and open PRs."));
-    }
-  } else {
-    checks.push(preflightCheck("task-projection", "task projection ready", "warn", "skipped until remote project-root link is repaired", "Run `rig server repair-link`, then retry."));
-    checks.push(preflightCheck("github-repo-permissions", "GitHub PR permissions", "warn", "skipped until remote project-root link is repaired", "Run `rig server repair-link`, then retry."));
+  try {
+    const projection = await request("/api/workspace/task-projection");
+    checks.push(preflightCheck("task-projection", "task projection ready", "pass", JSON.stringify(projection).slice(0, 120)));
+  } catch (error) {
+    checks.push(preflightCheck("task-projection", "task projection ready", "warn", message(error), "Refresh task projection with `rig task list` before launching."));
+  }
+  try {
+    const permissions = await request("/api/github/repo/permissions");
+    const allowed = permissionAllowsPr(permissions);
+    checks.push(allowed === false ? preflightCheck("github-repo-permissions", "GitHub PR permissions", "fail", JSON.stringify(permissions).slice(0, 120), "Grant the selected GitHub token permission to push branches and open PRs.") : preflightCheck("github-repo-permissions", "GitHub PR permissions", allowed === true ? "pass" : "warn", JSON.stringify(permissions).slice(0, 120), "Confirm the selected token can push branches and open PRs."));
+  } catch (error) {
+    checks.push(preflightCheck("github-repo-permissions", "GitHub PR permissions", "warn", message(error), "Ensure the selected token can push branches and open PRs."));
   }
   if (repo?.project) {
     try {
@@ -1365,24 +893,19 @@ async function runFastTaskRunPreflight(context, options = {}) {
     }
   }
   if (taskId) {
-    if (!remoteRootBlocked) {
-      try {
-        const tasks = await request(`/api/workspace/tasks?limit=200&refresh=1`);
-        const found = Array.isArray(tasks) && tasks.some((task) => taskMatchesId(task, taskId));
-        checks.push(found ? preflightCheck("issue", "task/issue accessible", "pass", taskId) : preflightCheck("issue", "task/issue accessible", legacyServerCompatibility ? "warn" : "fail", taskId, "Confirm the issue exists and matches the configured task filters."));
-      } catch (error) {
-        checks.push(preflightCheck("issue", "task/issue accessible", legacyServerCompatibility ? "warn" : "fail", message(error), "Fix the task source before launching a run."));
-      }
-      try {
-        const runs = await request("/api/runs?limit=200");
-        const duplicate = activeDuplicateRun(runs, taskId);
-        checks.push(duplicate ? preflightCheck("duplicate-active-run", "one active run per task", "fail", String(duplicate.runId ?? taskId), "Attach to or stop the existing run before starting another one for this task.") : preflightCheck("duplicate-active-run", "one active run per task", "pass", taskId));
-      } catch (error) {
-        checks.push(preflightCheck("duplicate-active-run", "one active run per task", "warn", message(error), "Could not list active runs; the server will still reject conflicting runs if configured."));
-      }
-    } else {
-      checks.push(preflightCheck("issue", "task/issue accessible", "fail", "skipped until remote project-root link is repaired", "Run `rig server repair-link`, then retry."));
-      checks.push(preflightCheck("duplicate-active-run", "one active run per task", "warn", "skipped until remote project-root link is repaired", "Run `rig server repair-link`, then retry."));
+    try {
+      const tasks = await request(`/api/workspace/tasks?limit=200&refresh=1`);
+      const found = Array.isArray(tasks) && tasks.some((task) => taskMatchesId(task, taskId));
+      checks.push(found ? preflightCheck("issue", "task/issue accessible", "pass", taskId) : preflightCheck("issue", "task/issue accessible", legacyServerCompatibility ? "warn" : "fail", taskId, "Confirm the issue exists and matches the configured task filters."));
+    } catch (error) {
+      checks.push(preflightCheck("issue", "task/issue accessible", legacyServerCompatibility ? "warn" : "fail", message(error), "Fix the task source before launching a run."));
+    }
+    try {
+      const runs = await request("/api/runs?limit=200");
+      const duplicate = activeDuplicateRun(runs, taskId);
+      checks.push(duplicate ? preflightCheck("duplicate-active-run", "one active run per task", "fail", String(duplicate.runId ?? taskId), "Attach to or stop the existing run before starting another one for this task.") : preflightCheck("duplicate-active-run", "one active run per task", "pass", taskId));
+    } catch (error) {
+      checks.push(preflightCheck("duplicate-active-run", "one active run per task", "warn", message(error), "Could not list active runs; the server will still reject conflicting runs if configured."));
     }
   }
   if ((options.runtimeAdapter ?? "pi") === "pi") {
@@ -1794,19 +1317,11 @@ async function withSpinner(label, work, options = {}) {
 }
 
 // packages/cli/src/commands/_pi-frontend.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, mkdtempSync, readFileSync as readFileSync3, rmSync, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, mkdtempSync, readFileSync as readFileSync3, rmSync, writeFileSync as writeFileSync2 } from "fs";
 import { homedir as homedir2, tmpdir } from "os";
 import { join } from "path";
 import { main as runPiMain } from "@earendil-works/pi-coding-agent";
 import createPiRigExtension from "@rig/pi-rig";
-var TERMINAL_RUN_STATUSES = new Set(["completed", "failed", "stopped", "cancelled", "canceled", "closed", "merged", "needs_attention", "needs-attention"]);
-
-class OperatorTranscriptUnavailableError extends Error {
-  constructor(message2) {
-    super(message2);
-    this.name = "OperatorTranscriptUnavailableError";
-  }
-}
 function setTemporaryEnv(updates) {
   const previous = new Map;
   for (const [key, value] of Object.entries(updates)) {
@@ -1834,27 +1349,10 @@ function buildOperatorPiEnv(input) {
     ...input.serverProjectRoot ? { RIG_PROJECT_ROOT: input.serverProjectRoot } : {}
   };
 }
-function shouldRequireOperatorTranscript(status) {
-  return typeof status === "string" && TERMINAL_RUN_STATUSES.has(status.trim().toLowerCase());
-}
-function missingOperatorTranscriptMessage(runId, status) {
-  const shortRun = runId.trim().slice(0, 8) || "unknown";
-  const statusText = typeof status === "string" && status.trim() ? status.trim() : "terminal";
-  return `Run ${shortRun} is ${statusText}, but no worker Pi session transcript is recorded for this run. It likely failed before Pi started or predates full-session capture. Use \`rig run show ${runId}\` and \`rig run logs ${runId}\` for the lifecycle details.`;
-}
-function statusFromRunDetails(run) {
-  if (!run || typeof run !== "object" || Array.isArray(run))
-    return;
-  const record = run;
-  if (typeof record.status === "string")
-    return record.status;
-  const nested = record.run;
-  return nested && typeof nested === "object" && !Array.isArray(nested) ? nested.status : undefined;
-}
 async function prepareOperatorConsole(context, runId, tempSessionDir) {
   const server = await ensureServerForCli(context.projectRoot);
   const localCwd = join(homedir2(), ".rig", "drones", runId.slice(0, 8));
-  mkdirSync3(localCwd, { recursive: true });
+  mkdirSync2(localCwd, { recursive: true });
   trustDroneCwd(localCwd);
   installRigPiTheme();
   let sessionFileArg = [];
@@ -1876,17 +1374,10 @@ async function prepareOperatorConsole(context, runId, tempSessionDir) {
         return line;
       }).join(`
 `);
-      writeFileSync3(localSessionPath, content);
+      writeFileSync2(localSessionPath, content);
       sessionFileArg = ["--session", localSessionPath];
     }
   } catch {}
-  if (sessionFileArg.length === 0) {
-    const run = await getRunDetailsViaServer(context, runId).catch(() => null);
-    const status = statusFromRunDetails(run);
-    if (shouldRequireOperatorTranscript(status)) {
-      throw new OperatorTranscriptUnavailableError(missingOperatorTranscriptMessage(runId, status));
-    }
-  }
   return { server, sessionFileArg };
 }
 var RIG_PI_THEME = {
@@ -1966,12 +1457,12 @@ var RIG_PI_THEME = {
 function trustDroneCwd(localCwd) {
   try {
     const agentDir = join(homedir2(), ".pi", "agent");
-    mkdirSync3(agentDir, { recursive: true });
+    mkdirSync2(agentDir, { recursive: true });
     const trustPath = join(agentDir, "trust.json");
     const store = existsSync3(trustPath) ? JSON.parse(readFileSync3(trustPath, "utf8")) : {};
     if (store[localCwd] !== true) {
       store[localCwd] = true;
-      writeFileSync3(trustPath, `${JSON.stringify(store, null, "\t")}
+      writeFileSync2(trustPath, `${JSON.stringify(store, null, "\t")}
 `);
     }
   } catch {}
@@ -1979,38 +1470,15 @@ function trustDroneCwd(localCwd) {
 function installRigPiTheme() {
   try {
     const themesDir = join(homedir2(), ".pi", "agent", "themes");
-    mkdirSync3(themesDir, { recursive: true });
+    mkdirSync2(themesDir, { recursive: true });
     const themePath = join(themesDir, "rig.json");
     const next = `${JSON.stringify(RIG_PI_THEME, null, "\t")}
 `;
     if (!existsSync3(themePath) || readFileSync3(themePath, "utf8") !== next) {
-      writeFileSync3(themePath, next);
+      writeFileSync2(themePath, next);
     }
   } catch {}
 }
-async function runWithProcessExitGuard(body) {
-  const realExit = process.exit;
-  let exitCode = 0;
-  let signalQuit = () => {};
-  const quit = new Promise((resolve3) => {
-    signalQuit = resolve3;
-  });
-  const guardedExit = (code) => {
-    exitCode = typeof code === "number" ? code : 0;
-    signalQuit();
-    return;
-  };
-  process.exit = guardedExit;
-  try {
-    await Promise.race([Promise.resolve().then(body), quit]);
-  } finally {
-    process.exit = realExit;
-  }
-  return exitCode;
-}
-function runPiMainReturningOnQuit(args, options) {
-  return runWithProcessExitGuard(() => runPiMain(args, options));
-}
 async function attachRunBundledPiFrontend(context, input) {
   const tempSessionDir = mkdtempSync(join(tmpdir(), "rig-pi-frontend-sessions-"));
   const { server, sessionFileArg } = await withSpinner(`Opening Pi console for run ${input.runId}\u2026`, () => prepareOperatorConsole(context, input.runId, tempSessionDir), { outputMode: context.outputMode });
@@ -2026,20 +1494,15 @@ async function attachRunBundledPiFrontend(context, input) {
   };
   let detached = false;
   try {
-    const piArgs = [
-      "--offline",
+    await runPiMain([
       "--no-extensions",
       "--no-skills",
       "--no-prompt-templates",
       "--no-context-files",
       ...sessionFileArg
-    ];
-    const piOptions = { extensionFactories: [piRigExtensionFactory] };
-    if (input.returnOnQuit) {
-      await runPiMainReturningOnQuit(piArgs, piOptions);
-    } else {
-      await runPiMain(piArgs, piOptions);
-    }
+    ], {
+      extensionFactories: [piRigExtensionFactory]
+    });
     detached = true;
   } finally {
     restoreEnv();
@@ -2061,7 +1524,7 @@ async function attachRunBundledPiFrontend(context, input) {
 }
 
 // packages/cli/src/commands/_operator-view.ts
-var TERMINAL_RUN_STATUSES2 = new Set(["completed", "failed", "stopped", "cancelled", "canceled", "closed", "merged", "needs_attention", "needs-attention"]);
+var TERMINAL_RUN_STATUSES = new Set(["completed", "failed", "stopped", "cancelled", "canceled", "closed", "merged", "needs_attention", "needs-attention"]);
 function runStatusFromPayload(payload) {
   const run = payload.run && typeof payload.run === "object" && !Array.isArray(payload.run) ? payload.run : payload;
   return String(run.status ?? "unknown").toLowerCase();
@@ -2139,7 +1602,7 @@ async function attachRunOperatorView(context, input) {
     }
     const pollMs = Math.max(250, Math.trunc(input.pollMs ?? 2000));
     let timelineCursor = snapshot.timelineCursor;
-    while (!detached && !TERMINAL_RUN_STATUSES2.has(runStatusFromPayload(snapshot.run))) {
+    while (!detached && !TERMINAL_RUN_STATUSES.has(runStatusFromPayload(snapshot.run))) {
       await Bun.sleep(pollMs);
       snapshot = await readOperatorSnapshot(context, input.runId, { timelineCursor });
       timelineCursor = snapshot.timelineCursor;
@@ -2422,13 +1885,12 @@ var PRIMARY_GROUPS = [
   {
     name: "server",
     summary: "Choose, inspect, and start the Rig server that owns tasks and runs.",
-    usage: ["rig server <status|list|add|use|repair-link|start> [options]"],
+    usage: ["rig server <status|list|add|use|start> [options]"],
     commands: [
-      { command: "status", description: "Show the selected server and remote project-root link for this repo.", primary: true },
+      { command: "status", description: "Show the selected server for this repo.", primary: true },
       { command: "use local", description: "Switch this repo to the local Rig server.", primary: true },
       { command: "add <alias> <url>", description: "Save a remote Rig server URL.", primary: true },
       { command: "use <alias>", description: "Select a saved remote server alias.", primary: true },
-      { command: "repair-link [--prepare|--backfill-only] [--repo owner/repo]", description: "Backfill or prepare the selected remote's server-host checkout link.", primary: true },
       { command: "list", description: "List saved local/remote server aliases.", primary: true },
       { command: "start [--host <host>] [--port <n>]", description: "Start a local rig-server process." }
     ],
@@ -2436,7 +1898,6 @@ var PRIMARY_GROUPS = [
       "rig server status",
       "rig server add prod https://where.rig-does.work",
       "rig server use prod",
-      "rig server repair-link --repo owner/repo",
       "rig server use local",
       "rig server start --port 3773"
     ],
@@ -2611,62 +2072,30 @@ var PRIMARY_GROUPS = [
   }
 ];
 var ADVANCED_GROUPS = [
-  {
-    name: "setup",
-    summary: "Bootstrap/check local setup.",
-    usage: ["rig setup <bootstrap|check|preflight>"],
-    commands: [
-      { command: "bootstrap", description: "Bootstrap local setup dependencies.", primary: true },
-      { command: "check", description: "Check local setup state (toolchain, deps, config).", primary: true },
-      { command: "preflight", description: "Run preflight checks before a run.", primary: true }
-    ]
-  },
-  {
-    name: "profile",
-    summary: "Runtime profile/model defaults.",
-    usage: ["rig profile <show|set>"],
-    commands: [
-      { command: "show", description: "Show the active execution profile.", primary: true },
-      { command: "set [--model <model>] [--runtime <runtime>] [--plugin <plugin>]", description: "Set model/runtime/plugin profile defaults.", primary: true }
-    ]
-  },
+  { name: "setup", summary: "Bootstrap/check local setup.", usage: ["rig setup <bootstrap|check|preflight>"], commands: [{ command: "bootstrap|check|preflight", description: "Setup helpers." }] },
+  { name: "profile", summary: "Runtime profile/model defaults.", usage: ["rig profile <show|set>"], commands: [{ command: "show", description: "Show active profile." }] },
   {
     name: "review",
     summary: "Inspect or change completion review gate policy.",
     usage: ["rig review <show|set>"],
     commands: [
       { command: "show", description: "Show current review gate settings." },
-      { command: "set <off|advisory|required> [--provider <provider>]", description: "Change review strictness/provider (e.g. --provider greptile)." }
+      { command: "set <off|advisory|required> [--provider greptile]", description: "Change review strictness/provider." }
     ],
     examples: ["rig review show", "rig review set required --provider greptile"],
     next: ["Use `rig inbox approvals` for blocked run handoffs."]
   },
   {
     name: "browser",
-    summary: "Browser workstation actions for browser-required tasks: launch, check, CDP probe, profile reset, and app-specific smokes.",
-    usage: ["rig browser <help|explain|demo|hp-next|cdp-probe|profile-persistence|profile-lock-check|smoke-test> [options]"],
+    summary: "Browser/app diagnostics for browser-required tasks.",
+    usage: ["rig browser <help|explain|demo|app|hp-next> [options]"],
     commands: [
-      { command: "help", description: "Rich browser command help (canonical: `rig browser help`).", primary: true },
-      { command: "explain", description: "Explain the browser-required task contract and runtime helper commands.", primary: true },
-      { command: "demo [--port <n>] [--profile <name>] [--state-dir <path>] [--target-url <url>] [--keep-open] [--no-build]", description: "Run a guided real browser/agent demo flow.", primary: true },
-      { command: "hp-next dev", description: "Start hp-next Rig Browser in dev/watch mode.", primary: true },
-      { command: "hp-next start", description: "Build/start the hp-next browser workstation without watch mode.", primary: true },
-      { command: "hp-next check", description: "Validate the hp-next CDP endpoint on the configured port.", primary: true },
-      { command: "hp-next e2e", description: "Run hp-next browser e2e smoke checks through Rig Browser.", primary: true },
-      { command: "hp-next reset", description: "Reset the hp-next browser profile when stale browser state is suspected.", primary: true },
-      { command: "cdp-probe", description: "Run an isolated CDP attach/evaluate/layout probe." },
-      { command: "profile-persistence", description: "Verify a named browser profile persists browser state." },
-      { command: "profile-lock-check", description: "Verify concurrent launches reject the same profile." },
-      { command: "smoke-test", description: "Run the browser package smoke test." }
-    ],
-    examples: [
-      "rig browser help",
-      "rig browser hp-next check",
-      "rig browser hp-next e2e",
-      "rig browser cdp-probe",
-      "rig browser profile-lock-check"
-    ],
-    next: ["Inside a task run, use rig-browser-launch, rig-browser-check, and rig-browser-attach-info from the worker PATH."]
+      { command: "help", description: "Rich browser command help (canonical: `rig browser help`)." },
+      { command: "explain", description: "Explain the browser-required task contract." },
+      { command: "demo", description: "Run browser demo flows against a local page." },
+      { command: "app", description: "Launch the Rig Browser workstation app." },
+      { command: "hp-next <dev|check|e2e|reset>", description: "Drive the hp-next browser test harness." }
+    ]
   },
   {
     name: "pi",
@@ -2681,60 +2110,12 @@ var ADVANCED_GROUPS = [
     examples: ["rig pi search subagents", "rig pi add pi-subagents", "rig pi list"],
     next: ["Config-managed extensions: declare `runtime: { pi: { packages: [...] } }` in rig.config.ts \u2014 workers pick them up automatically."]
   },
-  {
-    name: "queue",
-    summary: "Run task queues locally.",
-    usage: ["rig queue run [--workers <n>] [--max-tasks <n>] [--action validate|verify|pipeline] [--isolation off|worktree] [--no-runtime-reuse] [--fail-fast] [--skip-project-sync]"],
-    commands: [
-      { command: "run [--workers <n>] [--max-tasks <n>] [--action validate|verify|pipeline] [--isolation off|worktree] [--no-runtime-reuse] [--fail-fast] [--skip-project-sync]", description: "Process queue work: drain matching tasks with N workers, optional per-task action and isolation.", primary: true }
-    ]
-  },
-  {
-    name: "agent",
-    summary: "Runtime agent workspace helpers.",
-    usage: ["rig agent <list|prepare|run|cleanup>"],
-    commands: [
-      { command: "list", description: "List prepared agent runtimes.", primary: true },
-      { command: "prepare [--id <id>] [--mode <mode>] [--task <task>]", description: "Prepare an isolated agent runtime workspace.", primary: true },
-      { command: "run [--id <id>] [--mode <mode>] [--task <task>] [--skip-project-sync]", description: "Prepare (if needed) and run an agent in its workspace.", primary: true },
-      { command: "cleanup [--all] [--id <id>]", description: "Remove prepared agent workspaces.", primary: true }
-    ]
-  },
+  { name: "queue", summary: "Run task queues locally.", usage: ["rig queue run [options]"], commands: [{ command: "run", description: "Process queue work." }] },
+  { name: "agent", summary: "Runtime agent workspace helpers.", usage: ["rig agent <list|prepare|run|cleanup>"], commands: [{ command: "list", description: "List prepared agents." }] },
   { name: "inspector", summary: "Event stream and drift scanners.", usage: ["rig inspector <stream|scan-upstream-drift>"], commands: [{ command: "stream", description: "Stream events." }] },
-  {
-    name: "dist",
-    summary: "Build/install packaged Rig CLI.",
-    usage: ["rig dist <build|install|doctor|rebuild-agent>"],
-    commands: [
-      { command: "build [--output-dir <dir>]", description: "Build the distributable Rig CLI.", primary: true },
-      { command: "install [--scope <scope>] [--path <path>]", description: "Install the built CLI to a scope/path.", primary: true },
-      { command: "doctor", description: "Diagnose the dist toolchain and install state.", primary: true },
-      { command: "rebuild-agent", description: "Rebuild the agent runtime image, pruning stale images.", primary: true }
-    ]
-  },
+  { name: "dist", summary: "Build/install packaged Rig CLI.", usage: ["rig dist <build|install|doctor>"], commands: [{ command: "build", description: "Build distribution." }] },
   { name: "workspace", summary: "Workspace topology/service helpers.", usage: ["rig workspace <summary|topology|remote-hosts>"], commands: [{ command: "summary", description: "Show workspace summary." }] },
-  {
-    name: "remote",
-    summary: "Compatibility remote orchestration controls.",
-    usage: ["rig remote <status|tasks|watch|pause|resume|continue|stop|refresh|add-iterations|remove-iterations|endpoint ...>"],
-    commands: [
-      { command: "status [--remote <alias>]", description: "Show the remote orchestration state.", primary: true },
-      { command: "tasks [--remote <alias>]", description: "List the remote's tracked tasks.", primary: true },
-      { command: "watch [--remote <alias>] [--seconds <n>] [--event <type>]", description: "Stream remote orchestration events.", primary: true },
-      { command: "pause [--remote <alias>]", description: "Pause the running remote orchestration.", primary: true },
-      { command: "resume [--remote <alias>] [--max-workers <n>] [--max-iterations <n>] [--direct-merge]", description: "Resume the remote with optional tuning.", primary: true },
-      { command: "continue [--remote <alias>]", description: "Continue a paused remote orchestration.", primary: true },
-      { command: "stop [--remote <alias>]", description: "Stop the remote orchestration.", primary: true },
-      { command: "refresh [--remote <alias>]", description: "Refresh remote state.", primary: true },
-      { command: "add-iterations [--count <n>] [--remote <alias>]", description: "Grant the remote more iterations.", primary: true },
-      { command: "remove-iterations [--count <n>] [--remote <alias>]", description: "Reduce the remote's iteration budget.", primary: true },
-      { command: "endpoint list", description: "List configured remote endpoints.", primary: true },
-      { command: "endpoint add --alias <alias> --host <host> --port <n> [--token <token>]", description: "Register a remote endpoint.", primary: true },
-      { command: "endpoint remove --alias <alias>", description: "Remove a remote endpoint.", primary: true },
-      { command: "endpoint test [--alias <alias>]", description: "Test connectivity to a remote endpoint.", primary: true },
-      { command: "endpoint doctor", description: "Diagnose remote endpoint configuration.", primary: true }
-    ]
-  },
+  { name: "remote", summary: "Compatibility remote orchestration controls.", usage: ["rig remote <status|watch|pause|resume|...>"], commands: [{ command: "status", description: "Show remote state." }] },
   { name: "git", summary: "Pass through to Rig git-flow helper.", usage: ["rig git <args...>"], commands: [{ command: "<args...>", description: "Advanced git flow operations." }] },
   { name: "harness", summary: "Pass through to runtime harness CLI.", usage: ["rig harness <args...>"], commands: [{ command: "<args...>", description: "Advanced harness operations." }] },
   { name: "test", summary: "Project test wrappers.", usage: ["rig test <unit|e2e|all>"], commands: [{ command: "all", description: "Run configured project tests." }] }