@h-rig/cli 0.0.6-alpha.9 → 0.0.6-alpha.90

package/dist/src/commands/_pi-install.d.ts

@@ -0,0 +1,42 @@
+export type PiInstallCheck = {
+    readonly ok: boolean;
+    readonly label: string;
+    readonly detail?: string;
+    readonly hint?: string;
+};
+export type CommandRunner = (command: string[], options?: {
+    cwd?: string;
+}) => Promise<{
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}>;
+export type PiRigInstallStatus = {
+    readonly pi: PiInstallCheck;
+    readonly piRig: PiInstallCheck;
+    readonly extensionPath: string;
+};
+export declare function resolvePiRigExtensionPath(homeDir: string): string;
+export declare function resolvePiRigPackageSource(projectRoot: string, exists?: (path: string) => boolean): string;
+export declare function checkPiRigInstall(input?: {
+    readonly homeDir?: string;
+    readonly commandRunner?: CommandRunner;
+    readonly exists?: (path: string) => boolean;
+}): Promise<PiRigInstallStatus>;
+export declare function ensurePiRigInstalled(input: {
+    readonly projectRoot: string;
+    readonly homeDir?: string;
+    readonly commandRunner?: CommandRunner;
+}): Promise<PiRigInstallStatus & {
+    installedPath: string;
+}>;
+export declare function ensureRemotePiRigInstalled(input: {
+    readonly requestJson: (pathname: string, init?: RequestInit) => Promise<unknown>;
+}): Promise<PiRigInstallStatus & {
+    readonly remote: true;
+}>;
+export declare function buildPiSetupChecks(input?: {
+    readonly homeDir?: string;
+    readonly commandRunner?: CommandRunner;
+    readonly exists?: (path: string) => boolean;
+}): Promise<PiInstallCheck[]>;

package/dist/src/commands/_pi-install.js

@@ -3,7 +3,8 @@
 import { existsSync, readFileSync, rmSync } from "fs";
 import { homedir } from "os";
 import { resolve } from "path";
-var PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
+var PI_RIG_PACKAGE_NAME = "@h-rig/pi-rig";
+var LEGACY_PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
 var LEGACY_PI_RIG_MARKER = `// Managed by Rig. Source package: @rig/pi-rig.
 export { default } from '@rig/pi-rig';
 `;
@@ -31,7 +32,7 @@ function resolvePiHomeDir(inputHomeDir) {
 function piListContainsPiRig(output) {
   return output.split(/\r?\n/).some((line) => {
     const normalized = line.trim();
-    return normalized.includes(PI_RIG_PACKAGE_NAME) || /(?:^|[\\/])packages[\\/]pi-rig(?:$|\s)/.test(normalized);
+    return normalized.includes(PI_RIG_PACKAGE_NAME) || normalized.includes(LEGACY_PI_RIG_PACKAGE_NAME) || /(?:^|[\\/])packages[\\/]pi-rig(?:$|\s)/.test(normalized);
   });
 }
 async function safeRun(runner, command, options) {
@@ -55,7 +56,7 @@ async function ensurePiBinaryAvailable(input) {
     }
     return { ok: true, detail: (current.stdout || current.stderr).trim() || undefined };
   }
-  const installCommand = process.env.RIG_PI_INSTALL_COMMAND?.trim() || "bunx @earendil-works/pi@latest install";
+  const installCommand = process.env.RIG_PI_INSTALL_COMMAND?.trim() || "bunx @earendil-works/pi-coding-agent@latest install";
   const parts = splitInstallCommand(installCommand);
   if (parts.length === 0) {
     return { ok: false, error: (current.stderr || current.stdout).trim() || "pi --version failed" };
@@ -147,7 +148,7 @@ async function ensureRemotePiRigInstalled(input) {
   const payload = await input.requestJson("/api/pi-rig/install", {
     method: "POST",
     headers: { "content-type": "application/json" },
-    body: JSON.stringify({ package: "@rig/pi-rig", scope: "global" })
+    body: JSON.stringify({ package: PI_RIG_PACKAGE_NAME, scope: "global" })
   });
   const record = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
   const piOk = record.piOk === true || record.ok === true;

package/dist/src/commands/_policy.d.ts

@@ -0,0 +1,8 @@
+import { type RunnerContext } from "../runner";
+import type { PolicyMode } from "@rig/runtime/control-plane/runtime/guard-types";
+export declare function resolveEffectivePolicyMode(context: RunnerContext): PolicyMode;
+export declare function appendControlledBashAudit(context: RunnerContext, mode: PolicyMode, command: string, args: string[], matchedRuleIds: string[], action?: "warn" | "blocked"): void;
+export declare function enforceNativeCommandPolicy(context: RunnerContext, args: string[], options: {
+    commandPrefix: string;
+    writeAuditLog: boolean;
+}): Promise<void>;

package/dist/src/commands/_policy.js

@@ -5,12 +5,19 @@ import { resolve } from "path";
 
 // packages/cli/src/runner.ts
 import { EventBus } from "@rig/runtime/control-plane/runtime/events";
-import { CliError } from "@rig/runtime/control-plane/errors";
+import { CliError as RuntimeCliError } from "@rig/runtime/control-plane/errors";
 import { evaluate, loadPolicy, resolveAction } from "@rig/runtime/control-plane/runtime/guard";
-import { PluginManager } from "@rig/runtime/control-plane/runtime/plugins";
-import { loadRuntimeContextFromEnv } from "@rig/runtime/control-plane/runtime/context";
 import { buildBinary } from "@rig/runtime/control-plane/runtime/isolation";
-import { CliError as CliError2 } from "@rig/runtime/control-plane/errors";
+
+class CliError extends RuntimeCliError {
+  hint;
+  constructor(message, exitCode = 1, options = {}) {
+    super(message, exitCode);
+    if (options.hint?.trim()) {
+      this.hint = options.hint.trim();
+    }
+  }
+}
 function formatCommand(parts) {
   return parts.map((part) => /[^a-zA-Z0-9_./:-]/.test(part) ? JSON.stringify(part) : part).join(" ");
 }
@@ -69,7 +76,7 @@ async function enforceNativeCommandPolicy(context, args, options) {
     appendControlledBashAudit(context, mode, command, args, matchedRuleIds, action === "block" ? "blocked" : action === "warn" ? "warn" : undefined);
   }
   if (action === "block") {
-    throw new CliError2(`Policy blocked command: ${command}`, 126);
+    throw new CliError(`Policy blocked command: ${command}`, 126, { hint: "Review rig/policy/policy.json, or re-run with `--policy-mode observe` to log instead of block." });
   }
 }
 export {

package/dist/src/commands/_preflight.d.ts

@@ -0,0 +1,22 @@
+import { type RunnerContext } from "../runner";
+export type TaskRunPreflightStatus = "pass" | "warn" | "fail";
+export type TaskRunPreflightCheck = {
+    readonly id: string;
+    readonly label: string;
+    readonly status: TaskRunPreflightStatus;
+    readonly detail?: string;
+    readonly remediation?: string;
+};
+export type TaskRunPreflightResult = {
+    readonly ok: boolean;
+    readonly checks: readonly TaskRunPreflightCheck[];
+};
+export type TaskRunPreflightOptions = {
+    readonly taskId?: string | null;
+    readonly runtimeAdapter?: "claude-code" | "codex" | "pi";
+    readonly requestJson?: (pathname: string, init?: RequestInit) => Promise<unknown>;
+};
+export declare function runFastTaskRunPreflight(context: RunnerContext, options?: TaskRunPreflightOptions): Promise<TaskRunPreflightResult>;
+export declare function runProjectMainSyncPreflight(context: RunnerContext, options: {
+    disabled: boolean;
+}): Promise<void>;

package/dist/src/commands/_preflight.js

@@ -1,12 +1,19 @@
 // @bun
 // packages/cli/src/runner.ts
 import { EventBus } from "@rig/runtime/control-plane/runtime/events";
-import { CliError } from "@rig/runtime/control-plane/errors";
+import { CliError as RuntimeCliError } from "@rig/runtime/control-plane/errors";
 import { evaluate, loadPolicy, resolveAction } from "@rig/runtime/control-plane/runtime/guard";
-import { PluginManager } from "@rig/runtime/control-plane/runtime/plugins";
-import { loadRuntimeContextFromEnv } from "@rig/runtime/control-plane/runtime/context";
 import { buildBinary } from "@rig/runtime/control-plane/runtime/isolation";
-import { CliError as CliError2 } from "@rig/runtime/control-plane/errors";
+
+class CliError extends RuntimeCliError {
+  hint;
+  constructor(message, exitCode = 1, options = {}) {
+    super(message, exitCode);
+    if (options.hint?.trim()) {
+      this.hint = options.hint.trim();
+    }
+  }
+}
 
 // packages/cli/src/commands/_preflight.ts
 import { ensureProjectMainFreshBeforeRun } from "@rig/runtime/control-plane/project-main-pre-run-sync";
@@ -33,9 +40,14 @@ function readJsonFile(path) {
   try {
     return JSON.parse(readFileSync(path, "utf8"));
   } catch (error) {
-    throw new CliError2(`Invalid Rig connection state at ${path}: ${error instanceof Error ? error.message : String(error)}`, 1);
+    throw new CliError(`Invalid Rig connection state at ${path}: ${error instanceof Error ? error.message : String(error)}`, 1, { hint: "Fix or delete that file, then re-select a server with `rig server use <alias|local>`." });
   }
 }
+function writeJsonFile(path, value) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(value, null, 2)}
+`, "utf8");
+}
 function normalizeConnection(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return null;
@@ -76,29 +88,42 @@ function readRepoConnection(projectRoot) {
   return {
     selected,
     project: typeof record.project === "string" ? record.project : undefined,
-    linkedAt: typeof record.linkedAt === "string" ? record.linkedAt : undefined
+    linkedAt: typeof record.linkedAt === "string" ? record.linkedAt : undefined,
+    serverProjectRoot: typeof record.serverProjectRoot === "string" && record.serverProjectRoot.trim() ? record.serverProjectRoot.trim() : undefined
   };
 }
+function writeRepoConnection(projectRoot, state) {
+  writeJsonFile(resolveRepoConnectionPath(projectRoot), state);
+}
 function resolveSelectedConnection(projectRoot, options = {}) {
   const repo = readRepoConnection(projectRoot);
   if (!repo)
     return null;
   if (repo.selected === "local")
-    return { alias: "local", connection: { kind: "local", mode: "auto" } };
+    return { alias: "local", connection: { kind: "local", mode: "auto" }, serverProjectRoot: repo.serverProjectRoot };
   const global = readGlobalConnections(options);
   const connection = global.connections[repo.selected];
   if (!connection) {
-    throw new CliError2(`Selected Rig connection "${repo.selected}" was not found. Run \`rig connect list\` or \`rig connect use local\`.`, 1);
+    throw new CliError(`Selected Rig server "${repo.selected}" was not found. Run \`rig server list\` or \`rig server use local\`.`, 1);
   }
-  return { alias: repo.selected, connection };
+  return { alias: repo.selected, connection, serverProjectRoot: repo.serverProjectRoot };
+}
+function writeRepoServerProjectRoot(projectRoot, serverProjectRoot) {
+  const repo = readRepoConnection(projectRoot);
+  if (!repo)
+    return;
+  writeRepoConnection(projectRoot, { ...repo, serverProjectRoot });
 }
 
 // packages/cli/src/commands/_server-client.ts
-import { spawnSync } from "child_process";
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { resolve as resolve2 } from "path";
 import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
-var cachedGitHubBearerToken;
+var scopedGitHubBearerTokens = new Map;
+var serverPhaseListener = null;
+function reportServerPhase(label) {
+  serverPhaseListener?.(label);
+}
 function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
@@ -115,49 +140,80 @@ function readPrivateRemoteSessionToken(projectRoot) {
   }
 }
 function readGitHubBearerTokenForRemote(projectRoot) {
-  if (cachedGitHubBearerToken !== undefined)
-    return cachedGitHubBearerToken;
+  const scopedKey = resolve2(projectRoot);
+  if (scopedGitHubBearerTokens.has(scopedKey))
+    return scopedGitHubBearerTokens.get(scopedKey) ?? null;
   const privateSession = readPrivateRemoteSessionToken(projectRoot);
-  if (privateSession) {
-    cachedGitHubBearerToken = privateSession;
-    return cachedGitHubBearerToken;
-  }
-  const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
-  if (envToken) {
-    cachedGitHubBearerToken = envToken;
-    return cachedGitHubBearerToken;
+  if (privateSession)
+    return privateSession;
+  return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
+}
+function readStoredGitHubAuthToken(projectRoot) {
+  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
+  if (!existsSync2(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    return cleanToken(typeof parsed.token === "string" ? parsed.token : undefined);
+  } catch {
+    return null;
   }
-  const result = spawnSync("gh", ["auth", "token"], {
-    encoding: "utf8",
-    timeout: 5000,
-    stdio: ["ignore", "pipe", "ignore"]
-  });
-  cachedGitHubBearerToken = result.status === 0 ? cleanToken(result.stdout) : null;
-  return cachedGitHubBearerToken;
+}
+function readLocalConnectionFallbackToken(projectRoot) {
+  return readGitHubBearerTokenForRemote(projectRoot) ?? cleanToken(process.env.RIG_GITHUB_TOKEN) ?? readStoredGitHubAuthToken(projectRoot);
 }
 async function ensureServerForCli(projectRoot) {
   try {
     const selected = resolveSelectedConnection(projectRoot);
     if (selected?.connection.kind === "remote") {
+      reportServerPhase(`Connecting to ${selected.alias}\u2026`);
+      const authToken = readGitHubBearerTokenForRemote(projectRoot);
+      const serverProjectRoot = selected.serverProjectRoot ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
       return {
         baseUrl: selected.connection.baseUrl,
-        authToken: readGitHubBearerTokenForRemote(projectRoot),
-        connectionKind: "remote"
+        authToken,
+        connectionKind: "remote",
+        serverProjectRoot
       };
     }
+    reportServerPhase("Starting local Rig server\u2026");
     const connection = await ensureLocalRigServerConnection(projectRoot);
     return {
       baseUrl: connection.baseUrl,
-      authToken: connection.authToken,
-      connectionKind: "local"
+      authToken: connection.authToken ?? readLocalConnectionFallbackToken(projectRoot),
+      connectionKind: "local",
+      serverProjectRoot: resolve2(projectRoot)
     };
   } catch (error) {
     if (error instanceof Error) {
-      throw new CliError2(error.message, 1);
+      throw new CliError(error.message, 1);
     }
     throw error;
   }
 }
+async function backfillRemoteServerProjectRoot(projectRoot, baseUrl, authToken) {
+  const repo = readRepoConnection(projectRoot);
+  const slug = repo?.project?.trim();
+  if (!slug)
+    return null;
+  try {
+    const response = await fetch(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`, {
+      headers: mergeHeaders(undefined, authToken)
+    });
+    if (!response.ok)
+      return null;
+    const payload = await response.json();
+    const project = payload.project && typeof payload.project === "object" && !Array.isArray(payload.project) ? payload.project : null;
+    const checkouts = Array.isArray(project?.checkouts) ? project.checkouts : [];
+    const latestCheckout = [...checkouts].reverse().find((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry) && typeof entry.path === "string"));
+    const path = typeof latestCheckout?.path === "string" && latestCheckout.path.trim() ? latestCheckout.path.trim() : null;
+    if (path)
+      writeRepoServerProjectRoot(projectRoot, path);
+    return path;
+  } catch {
+    return null;
+  }
+}
 function mergeHeaders(headers, authToken) {
   const merged = new Headers(headers);
   if (authToken) {
@@ -180,12 +236,65 @@ function diagnosticMessage(payload) {
   });
   return messages.length > 0 ? messages.join("; ") : null;
 }
+var serverReachabilityCache = new Map;
+async function probeServerReachability(baseUrl, authToken) {
+  try {
+    const response = await fetch(`${baseUrl.replace(/\/+$/, "")}/api/server/status`, {
+      headers: mergeHeaders(undefined, authToken),
+      signal: AbortSignal.timeout(1500)
+    });
+    return response.ok;
+  } catch {
+    return false;
+  }
+}
+function cachedServerReachability(projectRoot, baseUrl, authToken) {
+  const key = resolve2(projectRoot);
+  const cached = serverReachabilityCache.get(key);
+  if (cached)
+    return cached;
+  const probe = probeServerReachability(baseUrl, authToken);
+  serverReachabilityCache.set(key, probe);
+  return probe;
+}
+function describeSelectedServer(projectRoot, server) {
+  try {
+    const selected = resolveSelectedConnection(projectRoot);
+    if (selected) {
+      return {
+        alias: selected.alias,
+        target: selected.connection.kind === "remote" ? selected.connection.baseUrl : server.baseUrl
+      };
+    }
+  } catch {}
+  return { alias: server.connectionKind === "remote" ? "remote" : "local", target: server.baseUrl };
+}
+async function buildServerFailureContext(projectRoot, server) {
+  const { alias, target } = describeSelectedServer(projectRoot, server);
+  const reachable = await cachedServerReachability(projectRoot, server.baseUrl, server.authToken);
+  const reachability = reachable ? "server is reachable" : "server is unreachable";
+  return {
+    contextLine: `Currently connected to: ${alias} at ${target} (${reachability}).`,
+    hint: "Check the selected server with `rig server status`, or switch with `rig server use <alias|local>`."
+  };
+}
 async function requestServerJson(context, pathname, init = {}) {
   const server = await ensureServerForCli(context.projectRoot);
-  const response = await fetch(`${server.baseUrl}${pathname}`, {
-    ...init,
-    headers: mergeHeaders(init.headers, server.authToken)
-  });
+  const headers = mergeHeaders(init.headers, server.authToken);
+  if (server.serverProjectRoot)
+    headers.set("x-rig-project-root", server.serverProjectRoot);
+  reportServerPhase(`${(init.method ?? "GET").toUpperCase()} ${pathname.split("?")[0]}\u2026`);
+  let response;
+  try {
+    response = await fetch(`${server.baseUrl}${pathname}`, {
+      ...init,
+      headers
+    });
+  } catch (error) {
+    const failure = await buildServerFailureContext(context.projectRoot, server);
+    throw new CliError(`Rig server request failed: ${error instanceof Error ? error.message : String(error)}
+${failure.contextLine}`, 1, { hint: failure.hint });
+  }
   const text = await response.text();
   const payload = text.trim().length > 0 ? (() => {
     try {
@@ -196,83 +305,26 @@ async function requestServerJson(context, pathname, init = {}) {
   })() : null;
   if (!response.ok) {
     const diagnostics = diagnosticMessage(payload);
-    const detail = diagnostics ?? (text || response.statusText);
-    throw new CliError2(`Rig server request failed (${response.status}): ${detail}`, 1);
+    const rawDetail = diagnostics ?? (text || response.statusText);
+    const detail = diagnostics ? rawDetail : rawDetail.split(`
+`).map((line) => line.trim()).find((line) => line.length > 0)?.slice(0, 200) ?? response.statusText;
+    const failure = await buildServerFailureContext(context.projectRoot, server);
+    throw new CliError(`Rig server request failed (${response.status}): ${detail}
+${failure.contextLine}`, 1, { hint: failure.hint });
   }
   return payload;
 }
-
-// packages/cli/src/commands/_pi-install.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, rmSync } from "fs";
-import { homedir as homedir2 } from "os";
-import { resolve as resolve3 } from "path";
-var PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
-async function defaultCommandRunner(command, options = {}) {
-  const proc = Bun.spawn(command, { cwd: options.cwd, stdout: "pipe", stderr: "pipe" });
-  const [stdout, stderr, exitCode] = await Promise.all([
-    new Response(proc.stdout).text(),
-    new Response(proc.stderr).text(),
-    proc.exited
-  ]);
-  return { exitCode, stdout, stderr };
-}
-function resolvePiRigExtensionPath(homeDir) {
-  return resolve3(homeDir, ".pi", "agent", "extensions", "pi-rig");
-}
-function resolvePiHomeDir(inputHomeDir) {
-  return inputHomeDir ?? process.env.RIG_PI_HOME_DIR?.trim() ?? homedir2();
-}
-function piListContainsPiRig(output) {
-  return output.split(/\r?\n/).some((line) => {
-    const normalized = line.trim();
-    return normalized.includes(PI_RIG_PACKAGE_NAME) || /(?:^|[\\/])packages[\\/]pi-rig(?:$|\s)/.test(normalized);
-  });
-}
-async function safeRun(runner, command, options) {
-  try {
-    return await runner(command, options);
-  } catch (error) {
-    return { exitCode: 1, stdout: "", stderr: error instanceof Error ? error.message : String(error) };
-  }
-}
-async function checkPiRigInstall(input = {}) {
-  const home = resolvePiHomeDir(input.homeDir);
-  const extensionPath = resolvePiRigExtensionPath(home);
-  if (process.env.RIG_TEST_FAKE_PI_INSTALL === "1") {
-    return {
-      extensionPath,
-      pi: { ok: true, label: "pi", detail: "fake-pi" },
-      piRig: { ok: true, label: "pi-rig global extension", detail: extensionPath }
-    };
-  }
-  const exists = input.exists ?? existsSync3;
-  const runner = input.commandRunner ?? defaultCommandRunner;
-  const piResult = await safeRun(runner, ["pi", "--version"]);
-  const piListResult = piResult.exitCode === 0 ? await safeRun(runner, ["pi", "list"]) : { exitCode: 1, stdout: "", stderr: "" };
-  const listedPiRig = piListResult.exitCode === 0 && piListContainsPiRig(`${piListResult.stdout}
-${piListResult.stderr}`);
-  const legacyBridge = exists(resolve3(extensionPath, "index.ts"));
-  const hasPiRig = listedPiRig;
-  return {
-    extensionPath,
-    pi: {
-      ok: piResult.exitCode === 0,
-      label: "pi",
-      detail: (piResult.stdout || piResult.stderr).trim() || undefined,
-      hint: piResult.exitCode === 0 ? undefined : "Install Pi or run `rig init --yes` to install/update the Pi runtime."
-    },
-    piRig: {
-      ok: hasPiRig,
-      label: "pi-rig global extension",
-      detail: hasPiRig ? piListResult.stdout.trim() || PI_RIG_PACKAGE_NAME : legacyBridge ? `${extensionPath} (legacy bridge; reinstall required)` : undefined,
-      hint: hasPiRig ? undefined : "Run `rig init --yes` to install/enable the global pi-rig package with `pi install`."
-    }
-  };
-}
-async function buildPiSetupChecks(input = {}) {
-  const status = await checkPiRigInstall(input);
-  return [status.pi, status.piRig];
-}
+var RESUMABLE_RUN_STATUSES = new Set([
+  "created",
+  "preparing",
+  "running",
+  "validating",
+  "reviewing",
+  "stopped",
+  "failed",
+  "needs-attention",
+  "needs_attention"
+]);
 
 // packages/cli/src/commands/_preflight.ts
 function preflightCheck(id, label, status, detail, remediation) {
@@ -329,6 +381,9 @@ function permissionAllowsPr(payload) {
   }
   return null;
 }
+function isNotFoundError(error) {
+  return /\b(404|not found)\b/i.test(message(error));
+}
 function projectCheckoutReady(payload) {
   if (!payload || typeof payload !== "object" || Array.isArray(payload))
     return null;
@@ -361,19 +416,33 @@ async function runFastTaskRunPreflight(context, options = {}) {
   const checks = [];
   const request = options.requestJson ?? ((pathname, init) => requestServerJson(context, pathname, init));
   const taskId = options.taskId?.trim() || null;
+  const requiresCurrentRunApi = Boolean(taskId);
+  const selectedServer = options.requestJson ? null : await ensureServerForCli(context.projectRoot).catch(() => null);
+  const allowLocalLegacyTaskRunCompatibility = selectedServer?.connectionKind === "local";
+  let legacyServerCompatibility = false;
   try {
     await request("/api/server/status");
     checks.push(preflightCheck("server", "Rig server reachable", "pass"));
   } catch (error) {
-    checks.push(preflightCheck("server", "Rig server reachable", "fail", message(error), "Start or select a reachable Rig server."));
+    if (isNotFoundError(error)) {
+      try {
+        await request("/health");
+        legacyServerCompatibility = !requiresCurrentRunApi || allowLocalLegacyTaskRunCompatibility;
+        checks.push(requiresCurrentRunApi && !allowLocalLegacyTaskRunCompatibility ? preflightCheck("server", "Rig server reachable", "fail", "legacy /health endpoint only; current task-run APIs are required", "Upgrade/select the Rig server before launching a task run.") : preflightCheck("server", "Rig server reachable", "pass", allowLocalLegacyTaskRunCompatibility ? "local legacy /health endpoint; submit endpoint will be authoritative" : "legacy /health endpoint"));
+      } catch (healthError) {
+        checks.push(preflightCheck("server", "Rig server reachable", "fail", message(healthError), "Start or select a reachable Rig server."));
+      }
+    } else {
+      checks.push(preflightCheck("server", "Rig server reachable", "fail", message(error), "Start or select a reachable Rig server."));
+    }
   }
   const repo = readRepoConnection(context.projectRoot);
-  checks.push(repo ? preflightCheck("project-link", "project linked to Rig connection", repo.project ? "pass" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : ""}`, "Run `rig init --yes --repo owner/repo` to record the GitHub repo slug.") : preflightCheck("project-link", "project linked to Rig connection", "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig connect use <alias|local>`."));
+  checks.push(repo ? preflightCheck("project-link", "project linked to Rig server", repo.project ? "pass" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : ""}`, "Run `rig init --yes --repo owner/repo` to record the GitHub repo slug.") : preflightCheck("project-link", "project linked to Rig server", legacyServerCompatibility ? "warn" : "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig server use <alias|local>`."));
   try {
     const auth = await request("/api/github/auth/status");
-    checks.push(isAuthenticated(auth) ? preflightCheck("github-auth", "GitHub auth valid", "pass") : preflightCheck("github-auth", "GitHub auth valid", "fail", "not authenticated", "Run `rig github auth import-gh` or `rig github auth token --token <token>`."));
+    checks.push(isAuthenticated(auth) ? preflightCheck("github-auth", "GitHub auth valid", "pass") : preflightCheck("github-auth", "GitHub auth valid", legacyServerCompatibility ? "warn" : "fail", "not authenticated", "Run `rig github auth import-gh` or `rig github auth token --token <token>`."));
   } catch (error) {
-    checks.push(preflightCheck("github-auth", "GitHub auth valid", "fail", message(error), "Fix GitHub auth on the selected Rig server."));
+    checks.push(preflightCheck("github-auth", "GitHub auth valid", legacyServerCompatibility ? "warn" : "fail", message(error), "Fix GitHub auth on the selected Rig server."));
   }
   try {
     const projection = await request("/api/workspace/task-projection");
@@ -401,9 +470,9 @@ async function runFastTaskRunPreflight(context, options = {}) {
     try {
       const tasks = await request(`/api/workspace/tasks?limit=200&refresh=1`);
       const found = Array.isArray(tasks) && tasks.some((task) => taskMatchesId(task, taskId));
-      checks.push(found ? preflightCheck("issue", "task/issue accessible", "pass", taskId) : preflightCheck("issue", "task/issue accessible", "fail", taskId, "Confirm the issue exists and matches the configured task filters."));
+      checks.push(found ? preflightCheck("issue", "task/issue accessible", "pass", taskId) : preflightCheck("issue", "task/issue accessible", legacyServerCompatibility ? "warn" : "fail", taskId, "Confirm the issue exists and matches the configured task filters."));
     } catch (error) {
-      checks.push(preflightCheck("issue", "task/issue accessible", "fail", message(error), "Fix the task source before launching a run."));
+      checks.push(preflightCheck("issue", "task/issue accessible", legacyServerCompatibility ? "warn" : "fail", message(error), "Fix the task source before launching a run."));
     }
     try {
       const runs = await request("/api/runs?limit=200");
@@ -414,14 +483,7 @@ async function runFastTaskRunPreflight(context, options = {}) {
     }
   }
   if ((options.runtimeAdapter ?? "pi") === "pi") {
-    const piChecks = await (options.piChecks ?? (() => buildPiSetupChecks()))().catch((error) => [{
-      ok: false,
-      label: "pi/pi-rig checks",
-      hint: message(error)
-    }]);
-    for (const pi of piChecks) {
-      checks.push(preflightCheck(pi.label === "pi" ? "pi" : "pi-rig", pi.label, pi.ok ? "pass" : "fail", pi.detail, pi.hint ?? (pi.ok ? undefined : "Run `rig init --yes` to install/update Pi and enable pi-rig.")));
-    }
+    checks.push(preflightCheck("runtime", "worker Pi SDK session daemon", "pass", selectedServer?.connectionKind === "remote" ? "remote worker-owned runtime" : "bundled server-owned runtime"));
   } else {
     checks.push(preflightCheck("runtime", "runtime adapter", "pass", options.runtimeAdapter));
   }
@@ -429,9 +491,9 @@ async function runFastTaskRunPreflight(context, options = {}) {
   if (failures.length > 0) {
     const summary = failures.map((check) => `${check.label}${check.detail ? `: ${check.detail}` : ""}`).join("; ");
     if (failures.some((check) => check.id === "duplicate-active-run") && taskId) {
-      throw new CliError2(`Task ${taskId} already has an active Rig run. ${summary}`, 1);
+      throw new CliError(`Task ${taskId} already has an active Rig run. ${summary}`, 1, { hint: `Attach to it with \`rig run attach <run-id> --follow\`, or stop it first with \`rig run stop <run-id>\`.` });
     }
-    throw new CliError2(`Task run preflight failed: ${summary}`, 1);
+    throw new CliError(`Task run preflight failed: ${summary}`, 1, { hint: "Run `rig doctor` to diagnose, then retry `rig task run`." });
   }
   return { ok: true, checks };
 }
@@ -448,7 +510,7 @@ async function runProjectMainSyncPreflight(context, options) {
     runBootstrap: async () => {
       const bootstrap = await context.runCommand(["bun", "run", "bootstrap"]);
       if (bootstrap.exitCode !== 0) {
-        throw new CliError2(bootstrap.stderr || bootstrap.stdout || "bun run bootstrap failed during project pre-run sync", bootstrap.exitCode || 1);
+        throw new CliError(bootstrap.stderr || bootstrap.stdout || "bun run bootstrap failed during project pre-run sync", bootstrap.exitCode || 1);
       }
     }
   });

package/dist/src/commands/_probes.d.ts

@@ -0,0 +1 @@
+export declare function runQuietBinaryProbe(binaryPath: string, args: string[], cwd: string): Promise<boolean>;