@h-rig/cli 0.0.6-alpha.9 → 0.0.6-alpha.91

package/dist/src/commands/init.js

@@ -1,19 +1,325 @@
 // @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
+// packages/cli/src/commands/_spinner.ts
+function createTtySpinner(input) {
+  const output = input.output ?? process.stdout;
+  const isTty = output.isTTY === true;
+  const frames = input.frames && input.frames.length > 0 ? input.frames : SPINNER_FRAMES;
+  let label = input.label;
+  let frame = 0;
+  let paused = false;
+  let stopped = false;
+  let lastPrintedLabel = "";
+  const render = () => {
+    if (stopped || paused)
+      return;
+    if (!isTty) {
+      if (label !== lastPrintedLabel) {
+        output.write(`${label}
+`);
+        lastPrintedLabel = label;
+      }
+      return;
+    }
+    frame = (frame + 1) % frames.length;
+    const glyph = frames[frame] ?? frames[0] ?? "";
+    output.write(`\r\x1B[2K${input.styleFrame ? input.styleFrame(glyph) : glyph} ${label}`);
+  };
+  const clearLine = () => {
+    if (isTty)
+      output.write("\r\x1B[2K");
+  };
+  render();
+  const timer = isTty ? setInterval(render, input.intervalMs ?? 16) : null;
+  return {
+    setLabel(next) {
+      label = next;
+      render();
+    },
+    pause() {
+      paused = true;
+      clearLine();
+    },
+    resume() {
+      if (stopped)
+        return;
+      paused = false;
+      render();
+    },
+    stop(finalLine) {
+      if (stopped)
+        return;
+      stopped = true;
+      if (timer)
+        clearInterval(timer);
+      clearLine();
+      if (finalLine)
+        output.write(`${finalLine}
+`);
+    }
+  };
+}
+var SPINNER_FRAMES;
+var init__spinner = __esm(() => {
+  SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+});
+
+// packages/cli/src/app/drone-ui.ts
+var exports_drone_ui = {};
+__export(exports_drone_ui, {
+  droneWarn: () => droneWarn,
+  droneText: () => droneText,
+  droneStep: () => droneStep,
+  droneSpinner: () => droneSpinner,
+  droneSelect: () => droneSelect,
+  droneOutro: () => droneOutro,
+  droneNote: () => droneNote,
+  droneIntro: () => droneIntro,
+  droneInfo: () => droneInfo,
+  droneError: () => droneError,
+  droneConfirm: () => droneConfirm,
+  droneCancel: () => droneCancel
+});
+import { Input, matchesKey, ProcessTerminal, SelectList, Text, TUI } from "@oh-my-pi/pi-tui";
+function hexToRgb(hex) {
+  const value = hex.charCodeAt(0) === 35 ? hex.slice(1) : hex;
+  return [
+    Number.parseInt(value.slice(0, 2), 16),
+    Number.parseInt(value.slice(2, 4), 16),
+    Number.parseInt(value.slice(4, 6), 16)
+  ];
+}
+function fg(hex) {
+  const [r, g, b] = hexToRgb(hex);
+  return (text) => `\x1B[38;2;${r};${g};${b}m${text}\x1B[39m`;
+}
+function bold(text) {
+  return `\x1B[1m${text}\x1B[22m`;
+}
+function renderMicroDroneFrame(frame) {
+  const tick = Math.max(0, MICRO_DRONE_FRAMES.indexOf(frame));
+  const blade = MICRO_BLADES[tick % MICRO_BLADES.length];
+  const eye = EYE_FRAMES[Math.floor(tick / 2) % EYE_FRAMES.length];
+  return `${ink4("(")}${cyan(blade)}${ink4(")")}${bold(accent(eye))}${ink4("(")}${cyan(blade)}${ink4(")")}`;
+}
+function hairline(width = Math.min(process.stdout.columns ?? 80, 100)) {
+  return ink4("\u2500".repeat(Math.max(10, width)));
+}
+function droneIntro(title, subtitle) {
+  console.log("");
+  console.log(` ${accent("\u258D")}${bold(ink(title))}${subtitle ? ink3(` \u2014 ${subtitle}`) : ""}`);
+  console.log(hairline());
+}
+function droneOutro(text) {
+  console.log(hairline());
+  console.log(` ${accent("\u25C6")} ${ink2(text)}`);
+  console.log("");
+}
+function droneNote(message, title) {
+  if (title)
+    console.log(` ${accentDim("\u25C7")} ${bold(ink2(title))}`);
+  for (const line of message.split(`
+`))
+    console.log(` ${ink4("\u2502")} ${line}`);
+}
+function droneStep(text) {
+  console.log(` ${accent("\u203A")} ${ink(text)}`);
+}
+function droneInfo(text) {
+  console.log(` ${cyan("\xB7")} ${ink2(text)}`);
+}
+function droneWarn(text) {
+  console.log(` ${yellow("\u25B2")} ${ink2(text)}`);
+}
+function droneError(text) {
+  console.log(` ${red("\u2716")} ${ink2(text)}`);
+}
+function droneCancel(text) {
+  console.log(` ${red("\u2716")} ${ink3(text)}`);
+}
+function droneSpinner() {
+  let active = null;
+  return {
+    start(message) {
+      active = createTtySpinner({
+        label: message,
+        frames: MICRO_DRONE_FRAMES,
+        styleFrame: renderMicroDroneFrame
+      });
+    },
+    stop(message) {
+      active?.stop(message ? ` ${accent("\u25C6")} ${ink2(message)}` : undefined);
+      active = null;
+    },
+    error(message) {
+      active?.stop(message ? ` ${red("\u2716")} ${ink2(message)}` : undefined);
+      active = null;
+    }
+  };
+}
+async function runMiniTui(build) {
+  const tui = new TUI(new ProcessTerminal);
+  let settled = false;
+  return await new Promise((resolve5) => {
+    const finish = (result) => {
+      if (settled)
+        return;
+      settled = true;
+      tui.stop();
+      resolve5(result);
+    };
+    build(tui, finish);
+    tui.start();
+  });
+}
+async function droneSelect(input) {
+  if (!process.stdout.isTTY || input.options.length === 0)
+    return input.initialValue ?? input.options[0]?.value ?? null;
+  return runMiniTui((tui, finish) => {
+    tui.addChild(new Text(` ${accent("\u258D")}${bold(ink(input.message))}`));
+    const items = input.options.map((option) => ({
+      value: option.value,
+      label: option.label,
+      ...option.hint ? { description: option.hint } : {}
+    }));
+    const list = new SelectList(items, Math.min(items.length, 12), DRONE_SELECT_THEME);
+    const initialIndex = input.initialValue ? items.findIndex((item) => item.value === input.initialValue) : -1;
+    if (initialIndex > 0)
+      list.setSelectedIndex(initialIndex);
+    list.onSelect = (item) => finish(item.value);
+    list.onCancel = () => finish(null);
+    tui.addChild(list);
+    tui.addChild(new Text(ink4(" \u2191\u2193 navigate \xB7 enter select \xB7 esc cancel")));
+    tui.setFocus(list);
+    tui.addInputListener((data) => {
+      if (matchesKey(data, "ctrl+c") || matchesKey(data, "escape")) {
+        finish(null);
+        return { consume: true };
+      }
+      return;
+    });
+  });
+}
+async function droneText(input) {
+  if (!process.stdout.isTTY)
+    return input.initialValue ?? null;
+  return runMiniTui((tui, finish) => {
+    tui.addChild(new Text(` ${accent("\u258D")}${bold(ink(input.message))}${input.placeholder ? ink4(`  (${input.placeholder})`) : ""}`));
+    const field = new Input;
+    if (input.initialValue)
+      field.setValue(input.initialValue);
+    field.onSubmit = (value) => finish(value);
+    field.onEscape = () => finish(null);
+    tui.addChild(field);
+    tui.addChild(new Text(ink4(" enter submit \xB7 esc cancel")));
+    tui.setFocus(field);
+    tui.addInputListener((data) => {
+      if (matchesKey(data, "ctrl+c")) {
+        finish(null);
+        return { consume: true };
+      }
+      return;
+    });
+  });
+}
+async function droneConfirm(input) {
+  const answer = await droneSelect({
+    message: input.message,
+    options: [
+      { value: "yes", label: "Yes" },
+      { value: "no", label: "No" }
+    ],
+    initialValue: input.initialValue === false ? "no" : "yes"
+  });
+  return answer === null ? null : answer === "yes";
+}
+var PALETTE, ink, ink2, ink3, ink4, accent, accentDim, cyan, red, yellow, MICRO_BLADES, EYE_FRAMES, MICRO_DRONE_FRAMES, DRONE_SYMBOLS, DRONE_SELECT_THEME;
+var init_drone_ui = __esm(() => {
+  init__spinner();
+  PALETTE = {
+    ink: "#f2f3f6",
+    ink2: "#aeb0ba",
+    ink3: "#6c6e79",
+    ink4: "#44464f",
+    accent: "#ccff4d",
+    accentDim: "#a9d63f",
+    cyan: "#56d8ff",
+    red: "#ff5d5d",
+    yellow: "#ffd24d"
+  };
+  ink = fg(PALETTE.ink);
+  ink2 = fg(PALETTE.ink2);
+  ink3 = fg(PALETTE.ink3);
+  ink4 = fg(PALETTE.ink4);
+  accent = fg(PALETTE.accent);
+  accentDim = fg(PALETTE.accentDim);
+  cyan = fg(PALETTE.cyan);
+  red = fg(PALETTE.red);
+  yellow = fg(PALETTE.yellow);
+  MICRO_BLADES = ["---", "\\\\\\", "|||", "///"];
+  EYE_FRAMES = ["@", "o", "."];
+  MICRO_DRONE_FRAMES = Array.from({ length: 12 }, (_, index) => {
+    const blade = MICRO_BLADES[index % MICRO_BLADES.length];
+    const eye = EYE_FRAMES[Math.floor(index / 2) % EYE_FRAMES.length];
+    return `(${blade})${eye}(${blade})`;
+  });
+  DRONE_SYMBOLS = {
+    cursor: "\u2192",
+    inputCursor: "\u258F",
+    boxRound: { topLeft: "\u256D", topRight: "\u256E", bottomLeft: "\u2570", bottomRight: "\u256F", horizontal: "\u2500", vertical: "\u2502" },
+    boxSharp: { topLeft: "\u250C", topRight: "\u2510", bottomLeft: "\u2514", bottomRight: "\u2518", horizontal: "\u2500", vertical: "\u2502", teeDown: "\u252C", teeUp: "\u2534", teeLeft: "\u2524", teeRight: "\u251C", cross: "\u253C" },
+    table: { topLeft: "\u250C", topRight: "\u2510", bottomLeft: "\u2514", bottomRight: "\u2518", horizontal: "\u2500", vertical: "\u2502", teeDown: "\u252C", teeUp: "\u2534", teeLeft: "\u2524", teeRight: "\u251C", cross: "\u253C" },
+    quoteBorder: "\u2502",
+    hrChar: "\u2500",
+    spinnerFrames: ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"]
+  };
+  DRONE_SELECT_THEME = {
+    selectedPrefix: (text) => accent(text),
+    selectedText: (text) => bold(ink(text)),
+    description: (text) => ink3(text),
+    scrollInfo: (text) => ink4(text),
+    noMatch: (text) => ink3(text),
+    symbols: DRONE_SYMBOLS,
+    hovered: (text) => bold(ink(text))
+  };
+});
+
 // packages/cli/src/commands/init.ts
-import { appendFileSync, existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
-import { spawnSync as spawnSync2 } from "child_process";
-import { resolve as resolve6 } from "path";
+import { appendFileSync, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { spawnSync } from "child_process";
+import { basename, resolve as resolve5 } from "path";
 
 // packages/cli/src/runner.ts
 import { EventBus } from "@rig/runtime/control-plane/runtime/events";
-import { CliError } from "@rig/runtime/control-plane/errors";
+import { CliError as RuntimeCliError } from "@rig/runtime/control-plane/errors";
 import { evaluate, loadPolicy, resolveAction } from "@rig/runtime/control-plane/runtime/guard";
-import { PluginManager } from "@rig/runtime/control-plane/runtime/plugins";
-import { loadRuntimeContextFromEnv } from "@rig/runtime/control-plane/runtime/context";
 import { buildBinary } from "@rig/runtime/control-plane/runtime/isolation";
-import { CliError as CliError2 } from "@rig/runtime/control-plane/errors";
+
+class CliError extends RuntimeCliError {
+  hint;
+  constructor(message, exitCode = 1, options = {}) {
+    super(message, exitCode);
+    if (options.hint?.trim()) {
+      this.hint = options.hint.trim();
+    }
+  }
+}
 function takeFlag(args, flag) {
   const rest = [];
   let value = false;
@@ -34,7 +340,7 @@ function takeOption(args, option) {
     if (current === option) {
       const next = args[index + 1];
       if (!next || next.startsWith("-")) {
-        throw new CliError(`Missing value for ${option}`);
+        throw new CliError(`Missing value for ${option}`, 1, { hint: `Provide a value after ${option}, e.g. \`${option} <value>\`.` });
       }
       value = next;
       index += 1;
@@ -52,17 +358,7 @@ import { buildRigInitConfigSource } from "@rig/core";
 
 // packages/cli/src/commands/_connection-state.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { homedir } from "os";
 import { dirname, resolve } from "path";
-function resolveGlobalConnectionsPath(env = process.env) {
-  const explicit = env.RIG_CONNECTIONS_FILE?.trim();
-  if (explicit)
-    return resolve(explicit);
-  const stateDir = env.RIG_GLOBAL_STATE_DIR?.trim();
-  if (stateDir)
-    return resolve(stateDir, "connections.json");
-  return resolve(homedir(), ".rig", "connections.json");
-}
 function resolveRepoConnectionPath(projectRoot) {
   return resolve(projectRoot, ".rig", "state", "connection.json");
 }
@@ -72,7 +368,7 @@ function readJsonFile(path) {
   try {
     return JSON.parse(readFileSync(path, "utf8"));
   } catch (error) {
-    throw new CliError2(`Invalid Rig connection state at ${path}: ${error instanceof Error ? error.message : String(error)}`, 1);
+    throw new CliError(`Invalid Rig connection state at ${path}: ${error instanceof Error ? error.message : String(error)}`, 1, { hint: "Fix or delete that file, then re-select a server with `rig server use <alias|local>`." });
   }
 }
 function writeJsonFile(path, value) {
@@ -80,47 +376,6 @@ function writeJsonFile(path, value) {
   writeFileSync(path, `${JSON.stringify(value, null, 2)}
 `, "utf8");
 }
-function normalizeConnection(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    return null;
-  const record = value;
-  if (record.kind === "local")
-    return { kind: "local", mode: "auto" };
-  if (record.kind === "remote" && typeof record.baseUrl === "string" && record.baseUrl.trim()) {
-    const baseUrl = record.baseUrl.trim().replace(/\/+$/, "");
-    return { kind: "remote", baseUrl };
-  }
-  return null;
-}
-function readGlobalConnections(options = {}) {
-  const path = resolveGlobalConnectionsPath(options.env ?? process.env);
-  const payload = readJsonFile(path);
-  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
-    return { connections: {} };
-  }
-  const rawConnections = payload.connections;
-  const connections = {};
-  if (rawConnections && typeof rawConnections === "object" && !Array.isArray(rawConnections)) {
-    for (const [alias, raw] of Object.entries(rawConnections)) {
-      const connection = normalizeConnection(raw);
-      if (connection)
-        connections[alias] = connection;
-    }
-  }
-  return { connections };
-}
-function writeGlobalConnections(state, options = {}) {
-  writeJsonFile(resolveGlobalConnectionsPath(options.env ?? process.env), state);
-}
-function upsertGlobalConnection(alias, connection, options = {}) {
-  const cleanAlias = alias.trim();
-  if (!cleanAlias)
-    throw new CliError2("Connection alias is required.", 1);
-  const state = readGlobalConnections(options);
-  state.connections[cleanAlias] = connection;
-  writeGlobalConnections(state, options);
-  return state;
-}
 function readRepoConnection(projectRoot) {
   const payload = readJsonFile(resolveRepoConnectionPath(projectRoot));
   if (!payload || typeof payload !== "object" || Array.isArray(payload))
@@ -132,200 +387,118 @@ function readRepoConnection(projectRoot) {
   return {
     selected,
     project: typeof record.project === "string" ? record.project : undefined,
-    linkedAt: typeof record.linkedAt === "string" ? record.linkedAt : undefined
+    linkedAt: typeof record.linkedAt === "string" ? record.linkedAt : undefined,
+    serverProjectRoot: typeof record.serverProjectRoot === "string" && record.serverProjectRoot.trim() ? record.serverProjectRoot.trim() : undefined,
+    serverProjectRootAlias: typeof record.serverProjectRootAlias === "string" && record.serverProjectRootAlias.trim() ? record.serverProjectRootAlias.trim() : undefined,
+    serverProjectRootBaseUrl: typeof record.serverProjectRootBaseUrl === "string" && record.serverProjectRootBaseUrl.trim() ? record.serverProjectRootBaseUrl.trim().replace(/\/+$/, "") : undefined
   };
 }
 function writeRepoConnection(projectRoot, state) {
   writeJsonFile(resolveRepoConnectionPath(projectRoot), state);
 }
-function resolveSelectedConnection(projectRoot, options = {}) {
-  const repo = readRepoConnection(projectRoot);
-  if (!repo)
-    return null;
-  if (repo.selected === "local")
-    return { alias: "local", connection: { kind: "local", mode: "auto" } };
-  const global = readGlobalConnections(options);
-  const connection = global.connections[repo.selected];
-  if (!connection) {
-    throw new CliError2(`Selected Rig connection "${repo.selected}" was not found. Run \`rig connect list\` or \`rig connect use local\`.`, 1);
-  }
-  return { alias: repo.selected, connection };
-}
 
-// packages/cli/src/commands/_server-client.ts
-import { spawnSync } from "child_process";
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+// packages/cli/src/commands/init.ts
+import { upsertManagedRemoteEndpoint } from "@rig/runtime/control-plane/remote";
+
+// packages/cli/src/commands/_inprocess-services.ts
 import { resolve as resolve2 } from "path";
-import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
-var cachedGitHubBearerToken;
+import {
+  beginGitHubDeviceFlow,
+  checkGitHubRepoPermissions,
+  createGitHubAuthStore,
+  listGitHubProjects,
+  pollGitHubDeviceFlow,
+  resolveGitHubAuthStatus,
+  resolveProjectStatusField,
+  saveGitHubTokenForProject
+} from "@rig/runtime/control-plane/github/index";
+var scopedGitHubBearerTokens = new Map;
 function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
 }
-function setGitHubBearerTokenForCurrentProcess(token) {
-  cachedGitHubBearerToken = cleanToken(token ?? undefined);
+function cleanString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
 }
-function readPrivateRemoteSessionToken(projectRoot) {
-  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
-  if (!existsSync2(path))
-    return null;
-  try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
-  } catch {
-    return null;
-  }
+function oauthClientId() {
+  return cleanToken(process.env.RIG_GITHUB_OAUTH_CLIENT_ID);
 }
-function readGitHubBearerTokenForRemote(projectRoot) {
-  if (cachedGitHubBearerToken !== undefined)
-    return cachedGitHubBearerToken;
-  const privateSession = readPrivateRemoteSessionToken(projectRoot);
-  if (privateSession) {
-    cachedGitHubBearerToken = privateSession;
-    return cachedGitHubBearerToken;
-  }
-  const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
-  if (envToken) {
-    cachedGitHubBearerToken = envToken;
-    return cachedGitHubBearerToken;
-  }
-  const result = spawnSync("gh", ["auth", "token"], {
-    encoding: "utf8",
-    timeout: 5000,
-    stdio: ["ignore", "pipe", "ignore"]
-  });
-  cachedGitHubBearerToken = result.status === 0 ? cleanToken(result.stdout) : null;
-  return cachedGitHubBearerToken;
+function tokenForProject(projectRoot, override) {
+  const scoped = scopedGitHubBearerTokens.get(resolve2(projectRoot));
+  return cleanToken(override) ?? scoped ?? createGitHubAuthStore(projectRoot).readToken() ?? cleanToken(process.env.RIG_GITHUB_TOKEN);
 }
-async function ensureServerForCli(projectRoot) {
-  try {
-    const selected = resolveSelectedConnection(projectRoot);
-    if (selected?.connection.kind === "remote") {
-      return {
-        baseUrl: selected.connection.baseUrl,
-        authToken: readGitHubBearerTokenForRemote(projectRoot),
-        connectionKind: "remote"
-      };
-    }
-    const connection = await ensureLocalRigServerConnection(projectRoot);
-    return {
-      baseUrl: connection.baseUrl,
-      authToken: connection.authToken,
-      connectionKind: "local"
-    };
-  } catch (error) {
-    if (error instanceof Error) {
-      throw new CliError2(error.message, 1);
-    }
-    throw error;
-  }
-}
-function mergeHeaders(headers, authToken) {
-  const merged = new Headers(headers);
-  if (authToken) {
-    merged.set("authorization", `Bearer ${authToken}`);
-  }
-  return merged;
+function setGitHubBearerTokenForCurrentProcess(token, projectRoot) {
+  scopedGitHubBearerTokens.set(resolve2(projectRoot ?? process.cwd()), cleanToken(token));
 }
-function diagnosticMessage(payload) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
-    return null;
-  const record = payload;
-  const diagnostics = Array.isArray(record.diagnostics) ? record.diagnostics : [];
-  const messages = diagnostics.flatMap((entry) => {
-    if (!entry || typeof entry !== "object" || Array.isArray(entry))
-      return [];
-    const diagnostic = entry;
-    const kind = typeof diagnostic.kind === "string" ? diagnostic.kind : "task-source";
-    const message = typeof diagnostic.message === "string" ? diagnostic.message : null;
-    return message ? [`${kind}: ${message}`] : [];
-  });
-  return messages.length > 0 ? messages.join("; ") : null;
+async function getGitHubAuthStatusInProcess(context) {
+  return { ok: true, ...resolveGitHubAuthStatus({ projectRoot: context.projectRoot, oauthConfigured: Boolean(oauthClientId()) }) };
 }
-async function requestServerJson(context, pathname, init = {}) {
-  const server = await ensureServerForCli(context.projectRoot);
-  const response = await fetch(`${server.baseUrl}${pathname}`, {
-    ...init,
-    headers: mergeHeaders(init.headers, server.authToken)
+async function postGitHubTokenInProcess(context, token, options = {}) {
+  const targetRoot = options.projectRoot?.trim() || context.projectRoot;
+  const result = await saveGitHubTokenForProject({
+    projectRoot: targetRoot,
+    token,
+    tokenSource: "manual-token",
+    selectedRepo: options.selectedRepo ?? null
   });
-  const text = await response.text();
-  const payload = text.trim().length > 0 ? (() => {
-    try {
-      return JSON.parse(text);
-    } catch {
-      return null;
-    }
-  })() : null;
-  if (!response.ok) {
-    const diagnostics = diagnosticMessage(payload);
-    const detail = diagnostics ?? (text || response.statusText);
-    throw new CliError2(`Rig server request failed (${response.status}): ${detail}`, 1);
+  const store = createGitHubAuthStore(targetRoot);
+  const session = store.createApiSession();
+  if (targetRoot !== context.projectRoot) {
+    store.copyToLocalProjectRoot(context.projectRoot);
   }
-  return payload;
-}
-async function postGitHubTokenViaServer(context, token, options = {}) {
-  const payload = await requestServerJson(context, "/api/github/auth/token", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ token, selectedRepo: options.selectedRepo, projectRoot: options.projectRoot })
-  });
-  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
-}
-async function prepareRemoteCheckoutViaServer(context, input) {
-  const payload = await requestServerJson(context, `/api/projects/${encodeURIComponent(input.repoSlug)}/prepare-checkout`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ checkout: input.checkout, repoUrl: input.repoUrl, baseDir: input.baseDir })
-  });
-  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
-}
-async function registerProjectViaServer(context, input) {
-  const payload = await requestServerJson(context, "/api/projects", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify(input)
-  });
-  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
-}
-function sleep(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
-}
-async function switchServerProjectRootViaServer(context, projectRoot, options = {}) {
-  const switched = await requestServerJson(context, "/api/server/project-root", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ projectRoot })
-  });
-  const timeoutMs = options.timeoutMs ?? 30000;
-  const pollMs = options.pollMs ?? 1000;
-  const deadline = Date.now() + timeoutMs;
-  let lastError;
-  while (Date.now() < deadline) {
-    try {
-      const status = await requestServerJson(context, "/api/server/status");
-      if (status && typeof status === "object" && !Array.isArray(status)) {
-        const record = status;
-        if (record.projectRoot === projectRoot) {
-          return { ok: true, switched, status: record };
-        }
-        lastError = `server projectRoot=${String(record.projectRoot ?? "unknown")}`;
-      }
-    } catch (error) {
-      lastError = error;
-    }
-    await sleep(pollMs);
+  return { ...result, authenticated: result.signedIn, apiSessionToken: session.token };
+}
+async function listGitHubProjectsInProcess(context, owner, options = {}) {
+  const token = tokenForProject(context.projectRoot, options.authToken);
+  if (!token)
+    return { ok: false, error: "missing-token", projects: [] };
+  const projects = await listGitHubProjects({ owner, token });
+  return { ok: true, projects };
+}
+async function getGitHubProjectStatusFieldInProcess(context, projectId, options = {}) {
+  const token = tokenForProject(context.projectRoot, options.authToken);
+  if (!token)
+    return { ok: false, error: "missing-token" };
+  const field = await resolveProjectStatusField({ projectId, token });
+  return { ok: true, field };
+}
+async function requestGitHubAuthJsonInProcess(context, pathname, init = {}) {
+  const method = (init.method ?? "GET").toUpperCase();
+  if (pathname === "/api/github/auth/status")
+    return getGitHubAuthStatusInProcess(context);
+  if (pathname === "/api/github/repo/permissions") {
+    return checkGitHubRepoPermissions({ projectRoot: context.projectRoot, oauthConfigured: Boolean(oauthClientId()) });
+  }
+  if (pathname === "/api/github/auth/device/start" && method === "POST") {
+    const clientId = oauthClientId();
+    if (!clientId)
+      return { ok: false, oauthConfigured: false, error: "RIG_GITHUB_OAUTH_CLIENT_ID is not configured." };
+    const body = init.body ? JSON.parse(String(init.body)) : {};
+    return beginGitHubDeviceFlow({
+      projectRoot: context.projectRoot,
+      clientId,
+      scope: cleanString(body.scope) ?? undefined,
+      selectedRepo: cleanString(body.repoSlug)
+    });
   }
-  throw new CliError2(`Rig server did not switch to ${projectRoot} before timeout (${lastError instanceof Error ? lastError.message : String(lastError ?? "no status")}).`, 1);
+  if (pathname === "/api/github/auth/device/poll" && method === "POST") {
+    const clientId = oauthClientId();
+    if (!clientId)
+      return { ok: false, oauthConfigured: false, error: "RIG_GITHUB_OAUTH_CLIENT_ID is not configured." };
+    const body = init.body ? JSON.parse(String(init.body)) : {};
+    const pollId = cleanString(body.pollId);
+    if (!pollId)
+      return { ok: false, status: "error", error: "pollId is required" };
+    return pollGitHubDeviceFlow({ projectRoot: context.projectRoot, clientId, pollId, selectedRepo: cleanString(body.repoSlug) });
+  }
+  throw new Error(`No in-process GitHub auth API for ${method} ${pathname}`);
 }
 
 // packages/cli/src/commands/_pi-install.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, rmSync } from "fs";
-import { homedir as homedir2 } from "os";
+import { existsSync as existsSync2 } from "fs";
+import { homedir } from "os";
 import { resolve as resolve3 } from "path";
-var PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
-var LEGACY_PI_RIG_MARKER = `// Managed by Rig. Source package: @rig/pi-rig.
-export { default } from '@rig/pi-rig';
-`;
+var PI_RIG_PACKAGE_NAME = "@h-rig/pi-rig";
 async function defaultCommandRunner(command, options = {}) {
   const proc = Bun.spawn(command, { cwd: options.cwd, stdout: "pipe", stderr: "pipe" });
   const [stdout, stderr, exitCode] = await Promise.all([
@@ -338,14 +511,14 @@ async function defaultCommandRunner(command, options = {}) {
 function resolvePiRigExtensionPath(homeDir) {
   return resolve3(homeDir, ".pi", "agent", "extensions", "pi-rig");
 }
-function resolvePiRigPackageSource(projectRoot, exists = existsSync3) {
+function resolvePiRigPackageSource(projectRoot, exists = existsSync2) {
   const localPackage = resolve3(projectRoot, "packages", "pi-rig");
   if (exists(resolve3(localPackage, "package.json")))
     return localPackage;
   return `npm:${PI_RIG_PACKAGE_NAME}`;
 }
 function resolvePiHomeDir(inputHomeDir) {
-  return inputHomeDir ?? process.env.RIG_PI_HOME_DIR?.trim() ?? homedir2();
+  return inputHomeDir ?? process.env.RIG_PI_HOME_DIR?.trim() ?? homedir();
 }
 function piListContainsPiRig(output) {
   return output.split(/\r?\n/).some((line) => {
@@ -374,7 +547,13 @@ async function ensurePiBinaryAvailable(input) {
     }
     return { ok: true, detail: (current.stdout || current.stderr).trim() || undefined };
   }
-  const installCommand = process.env.RIG_PI_INSTALL_COMMAND?.trim() || "bunx @earendil-works/pi@latest install";
+  const installCommand = process.env.RIG_PI_INSTALL_COMMAND?.trim();
+  if (!installCommand) {
+    return {
+      ok: false,
+      error: `${(current.stderr || current.stdout).trim() || "pi --version failed"}. Set RIG_PI_INSTALL_COMMAND to a supported installer or install Pi manually.`
+    };
+  }
   const parts = splitInstallCommand(installCommand);
   if (parts.length === 0) {
     return { ok: false, error: (current.stderr || current.stdout).trim() || "pi --version failed" };
@@ -391,18 +570,6 @@ async function ensurePiBinaryAvailable(input) {
     ...next.exitCode === 0 ? {} : { error: (next.stderr || next.stdout).trim() || "pi --version failed after install" }
   };
 }
-function removeManagedLegacyPiRigBridge(homeDir, exists = existsSync3) {
-  const extensionPath = resolvePiRigExtensionPath(homeDir);
-  const indexPath = resolve3(extensionPath, "index.ts");
-  if (!exists(indexPath))
-    return;
-  try {
-    const content = readFileSync3(indexPath, "utf8");
-    if (content === LEGACY_PI_RIG_MARKER || content.includes("Managed by Rig. Source package: @rig/pi-rig")) {
-      rmSync(extensionPath, { recursive: true, force: true });
-    }
-  } catch {}
-}
 async function checkPiRigInstall(input = {}) {
   const home = resolvePiHomeDir(input.homeDir);
   const extensionPath = resolvePiRigExtensionPath(home);
@@ -413,48 +580,40 @@ async function checkPiRigInstall(input = {}) {
       piRig: { ok: true, label: "pi-rig global extension", detail: extensionPath }
     };
   }
-  const exists = input.exists ?? existsSync3;
   const runner = input.commandRunner ?? defaultCommandRunner;
   const piResult = await safeRun(runner, ["pi", "--version"]);
   const piListResult = piResult.exitCode === 0 ? await safeRun(runner, ["pi", "list"]) : { exitCode: 1, stdout: "", stderr: "" };
-  const listedPiRig = piListResult.exitCode === 0 && piListContainsPiRig(`${piListResult.stdout}
+  const hasPiRig = piListResult.exitCode === 0 && piListContainsPiRig(`${piListResult.stdout}
 ${piListResult.stderr}`);
-  const legacyBridge = exists(resolve3(extensionPath, "index.ts"));
-  const hasPiRig = listedPiRig;
+  const hasLegacyBridgeScaffold = !hasPiRig && (input.exists ?? existsSync2)(extensionPath);
   return {
     extensionPath,
     pi: {
       ok: piResult.exitCode === 0,
       label: "pi",
       detail: (piResult.stdout || piResult.stderr).trim() || undefined,
-      hint: piResult.exitCode === 0 ? undefined : "Install Pi or run `rig init --yes` to install/update the Pi runtime."
+      hint: piResult.exitCode === 0 ? undefined : "Install Pi/OMP manually or set RIG_PI_INSTALL_COMMAND before verifying with bare `rig` / Cockpit \u2192 Doctor."
     },
     piRig: {
       ok: hasPiRig,
       label: "pi-rig global extension",
-      detail: hasPiRig ? piListResult.stdout.trim() || PI_RIG_PACKAGE_NAME : legacyBridge ? `${extensionPath} (legacy bridge; reinstall required)` : undefined,
-      hint: hasPiRig ? undefined : "Run `rig init --yes` to install/enable the global pi-rig package with `pi install`."
+      detail: hasPiRig ? piListResult.stdout.trim() || PI_RIG_PACKAGE_NAME : hasLegacyBridgeScaffold ? `legacy bridge scaffold at ${extensionPath}` : undefined,
+      hint: hasPiRig ? undefined : `Install the Rig OMP extension with \`pi install ${PI_RIG_PACKAGE_NAME}\`, then verify with bare \`rig\` / Cockpit \u2192 Doctor.`
     }
   };
 }
 async function ensurePiRigInstalled(input) {
   const home = resolvePiHomeDir(input.homeDir);
   if (process.env.RIG_TEST_FAKE_PI_INSTALL === "1") {
-    const status2 = await checkPiRigInstall({ homeDir: home, commandRunner: input.commandRunner });
-    return { ...status2, installedPath: status2.extensionPath };
+    const status = await checkPiRigInstall({ homeDir: home, commandRunner: input.commandRunner });
+    return { ...status, installedPath: status.extensionPath };
   }
   const runner = input.commandRunner ?? defaultCommandRunner;
   const piAvailable = await ensurePiBinaryAvailable({ runner, projectRoot: input.projectRoot });
-  const status = piAvailable.ok ? await checkPiRigInstall({ homeDir: home, commandRunner: runner }) : {
-    extensionPath: resolvePiRigExtensionPath(home),
-    pi: { ok: false, label: "pi", detail: piAvailable.error, hint: "Install/update Pi with RIG_PI_INSTALL_COMMAND or install Pi manually." },
-    piRig: { ok: false, label: "pi-rig global extension", hint: "Pi is required before pi-rig can be installed." }
-  };
   if (!piAvailable.ok) {
     throw new Error(`Pi install/update failed: ${piAvailable.error ?? "pi unavailable"}`);
   }
   const packageSource = resolvePiRigPackageSource(input.projectRoot);
-  removeManagedLegacyPiRigBridge(home);
   const install = await runner(["pi", "install", packageSource], { cwd: input.projectRoot });
   if (install.exitCode !== 0) {
     throw new Error(`pi-rig install failed: ${(install.stderr || install.stdout).trim() || `exit ${install.exitCode}`}`);
@@ -462,132 +621,14 @@ async function ensurePiRigInstalled(input) {
   const next = await checkPiRigInstall({ homeDir: home, commandRunner: runner });
   return { ...next, installedPath: packageSource };
 }
-async function ensureRemotePiRigInstalled(input) {
-  const payload = await input.requestJson("/api/pi-rig/install", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ package: "@rig/pi-rig", scope: "global" })
-  });
-  const record = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
-  const piOk = record.piOk === true || record.ok === true;
-  const piRigOk = record.piRigOk === true || record.installed === true || record.ok === true;
-  const extensionPath = typeof record.extensionPath === "string" ? record.extensionPath : "remote:~/.pi/agent/extensions/pi-rig";
-  return {
-    remote: true,
-    extensionPath,
-    pi: {
-      ok: piOk,
-      label: "pi",
-      detail: typeof record.piVersion === "string" ? record.piVersion : undefined,
-      hint: piOk ? undefined : "Install/update Pi on the selected remote Rig server."
-    },
-    piRig: {
-      ok: piRigOk,
-      label: "pi-rig global extension",
-      detail: extensionPath,
-      hint: piRigOk ? undefined : "Install/enable pi-rig on the selected remote Rig server."
-    }
-  };
-}
 async function buildPiSetupChecks(input = {}) {
   const status = await checkPiRigInstall(input);
   return [status.pi, status.piRig];
 }
 
-// packages/cli/src/commands/_snapshot-upload.ts
-import { mkdir, readdir, readFile, writeFile } from "fs/promises";
-import { dirname as dirname2, resolve as resolve4, relative, sep } from "path";
-var SNAPSHOT_ARCHIVE_VERSION = 1;
-var SNAPSHOT_ARCHIVE_CONTENT_TYPE = "application/vnd.rig.snapshot+json";
-var DEFAULT_EXCLUDED_DIRECTORIES = new Set([
-  ".git",
-  ".rig",
-  "node_modules",
-  ".turbo",
-  ".next",
-  ".cache",
-  "coverage",
-  "dist",
-  "build",
-  "out"
-]);
-function toPosixPath(path) {
-  return path.split(sep).join("/");
-}
-function assertManifestPath(root, relativePath) {
-  if (!relativePath || relativePath.startsWith("/") || relativePath.includes("\x00")) {
-    throw new Error(`Invalid snapshot path: ${relativePath}`);
-  }
-  const resolved = resolve4(root, relativePath);
-  const relativeToRoot = relative(root, resolved);
-  if (relativeToRoot.startsWith("..") || relativeToRoot === ".." || resolve4(relativeToRoot) === resolved) {
-    throw new Error(`Snapshot path escapes project root: ${relativePath}`);
-  }
-  return resolved;
-}
-async function buildSnapshotUploadManifest(projectRoot, options = {}) {
-  const root = resolve4(projectRoot);
-  const excludedDirectories = [...new Set([
-    ...DEFAULT_EXCLUDED_DIRECTORIES,
-    ...options.excludedDirectories ?? []
-  ])];
-  const excludedSet = new Set(excludedDirectories);
-  const files = [];
-  async function visit(dir) {
-    const entries = await readdir(dir, { withFileTypes: true });
-    for (const entry of entries) {
-      if (entry.isDirectory() && excludedSet.has(entry.name))
-        continue;
-      const fullPath = resolve4(dir, entry.name);
-      if (entry.isDirectory()) {
-        await visit(fullPath);
-        continue;
-      }
-      if (!entry.isFile())
-        continue;
-      files.push(toPosixPath(relative(root, fullPath)));
-    }
-  }
-  await visit(root);
-  files.sort();
-  return { root, files, excludedDirectories };
-}
-async function createSnapshotUploadArchive(projectRoot, options = {}) {
-  const manifest = await buildSnapshotUploadManifest(projectRoot, options);
-  const files = await Promise.all(manifest.files.map(async (path) => {
-    const fullPath = assertManifestPath(manifest.root, path);
-    return {
-      path,
-      contentBase64: (await readFile(fullPath)).toString("base64")
-    };
-  }));
-  return {
-    version: SNAPSHOT_ARCHIVE_VERSION,
-    root: manifest.root,
-    files,
-    excludedDirectories: manifest.excludedDirectories,
-    createdAt: (options.now?.() ?? new Date).toISOString()
-  };
-}
-function encodeSnapshotUploadArchive(archive) {
-  return Buffer.from(JSON.stringify(archive), "utf8").toString("base64");
-}
-async function uploadSnapshotArchiveViaServer(context, input) {
-  const payload = await requestServerJson(context, `/api/projects/${encodeURIComponent(input.repoSlug)}/upload-snapshot`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({
-      archiveContentBase64: encodeSnapshotUploadArchive(input.archive),
-      contentType: SNAPSHOT_ARCHIVE_CONTENT_TYPE,
-      baseDir: input.baseDir
-    })
-  });
-  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
-}
-
 // packages/cli/src/commands/_doctor-checks.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
-import { resolve as resolve5 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve4 } from "path";
 import { isSupportedBunVersion, MIN_SUPPORTED_BUN_VERSION } from "@rig/runtime/control-plane/setup-version";
 
 // packages/cli/src/commands/_parsers.ts
@@ -619,31 +660,14 @@ function isAuthenticated(payload) {
   const record = payload;
   return record.signedIn === true || record.authenticated === true || record.status === "authenticated" || record.ok === true && typeof record.login === "string" && record.login.trim().length > 0;
 }
-function repoSlugFromConfig(config) {
-  const project = config?.project;
-  if (project && typeof project === "object" && !Array.isArray(project)) {
-    const record = project;
-    if (typeof record.repo === "string" && /^([^/\s]+)\/([^/\s]+)$/.test(record.repo))
-      return record.repo;
-    if (typeof record.name === "string" && /^([^/\s]+)\/([^/\s]+)$/.test(record.name))
-      return record.name;
-  }
-  const taskSource = config?.taskSource;
-  if (taskSource && typeof taskSource === "object" && !Array.isArray(taskSource)) {
-    const source = taskSource;
-    if (typeof source.owner === "string" && typeof source.repo === "string")
-      return `${source.owner}/${source.repo}`;
-  }
-  return null;
-}
 function loadFallbackConfig(projectRoot) {
   const candidates = ["rig.config.ts", "rig.config.mts", "rig.config.json"];
   for (const name of candidates) {
-    const path = resolve5(projectRoot, name);
-    if (!existsSync4(path))
+    const path = resolve4(projectRoot, name);
+    if (!existsSync3(path))
       continue;
     try {
-      const source = readFileSync4(path, "utf8");
+      const source = readFileSync2(path, "utf8");
       if (name.endsWith(".json"))
         return JSON.parse(source);
       const owner = source.match(/owner\s*:\s*["']([^"']+)["']/)?.[1];
@@ -662,14 +686,11 @@ function loadFallbackConfig(projectRoot) {
   }
   return null;
 }
-function projectStatusSlug(projectRoot, config) {
-  return readRepoConnection(projectRoot)?.project ?? repoSlugFromConfig(config);
-}
 function githubProjectsCheck(config) {
   const github = config?.github;
   const projects = github?.projects;
   if (!projects?.enabled) {
-    return check("github-projects", "GitHub Projects status sync", "warn", "disabled or not configured", "Run `rig init --github-project <project>` or configure github.projects when Project status sync should be authoritative.");
+    return check("github-projects", "GitHub Projects status sync", "warn", "disabled or not configured", "Current OMP flow does not require GitHub Projects status sync; configure github.projects manually when Project status sync should be authoritative.");
   }
   if (projects.projectId && projects.statusFieldId) {
     return check("github-projects", "GitHub Projects status sync", "pass", `project ${projects.projectId}`);
@@ -694,16 +715,6 @@ function permissionAllowsPr(payload) {
   }
   return null;
 }
-function labelsReady(payload) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
-    return null;
-  const record = payload;
-  if (record.ok === true || record.ready === true || record.labelsReady === true)
-    return true;
-  if (record.ok === false || record.ready === false || record.labelsReady === false)
-    return false;
-  return null;
-}
 function prMergeCheck(config) {
   const pr = config?.pr;
   const merge = config?.merge;
@@ -717,89 +728,48 @@ async function runRigDoctorChecks(options) {
   const checks = [];
   const which = options.which ?? ((binary) => Bun.which(binary));
   const bunVersion = options.bunVersion ?? Bun.version;
-  const request = options.requestJson ?? ((pathname, init) => requestServerJson({ projectRoot }, pathname, init));
+  const request = options.requestJson ?? ((pathname, init) => requestGitHubAuthJsonInProcess({ projectRoot }, pathname, init));
   const loadConfig = options.loadConfig ?? loadRigConfigOrNull;
+  const progress = options.onProgress ?? (() => {});
+  progress("Checking local toolchain\u2026");
   checks.push(check("bun", `bun >= ${MIN_SUPPORTED_BUN_VERSION}`, isSupportedBunVersion(bunVersion) ? "pass" : "fail", `found ${bunVersion}`, `Install Bun ${MIN_SUPPORTED_BUN_VERSION} or newer.`), check("git", "git", which("git") ? "pass" : "fail", which("git") ?? undefined, "Install git and ensure it is on PATH."), check("jq", "jq", which("jq") ? "pass" : "warn", which("jq") ?? undefined, "Install jq (for example `brew install jq`)."));
+  progress("Loading rig.config\u2026");
   const loadedConfig = await loadConfig(projectRoot).catch(() => null);
   const config = loadedConfig ?? loadFallbackConfig(projectRoot);
-  const hasConfigFile = ["rig.config.ts", "rig.config.mts", "rig.config.json"].some((name) => existsSync4(resolve5(projectRoot, name)));
-  checks.push(config ? check("config", "rig.config loadable", "pass") : check("config", "rig.config loadable", hasConfigFile ? "fail" : "fail", hasConfigFile ? "config file exists but failed to load" : "missing rig.config.ts/json", "Run `rig init` or fix the config error."));
+  const hasConfigFile = ["rig.config.ts", "rig.config.mts", "rig.config.json"].some((name) => existsSync3(resolve4(projectRoot, name)));
+  checks.push(config ? check("config", "rig.config loadable", "pass") : check("config", "rig.config loadable", hasConfigFile ? "fail" : "fail", hasConfigFile ? "config file exists but failed to load" : "missing rig.config.ts/json", "Create/fix rig.config.ts or use the OMP cockpit Start tab to scaffold one."));
   const taskSourceKind = config?.taskSource?.kind;
   checks.push(taskSourceKind ? check("task-source", "task source configured", "pass", taskSourceKind) : check("task-source", "task source configured", "fail", "missing taskSource", "Configure taskSource in rig.config.ts."));
   const repo = readRepoConnection(projectRoot);
-  checks.push(repo ? check("project-link", "repo selected Rig connection", repo.project ? "pass" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : ""}`, "Run `rig init --yes --repo owner/repo` to link this checkout to a GitHub repo slug.") : check("project-link", "repo selected Rig connection", "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig connect use <alias|local>`."));
-  const selected = (() => {
-    try {
-      return resolveSelectedConnection(projectRoot);
-    } catch {
-      return null;
-    }
-  })();
-  checks.push(selected ? check("connection", "selected server connection", "pass", selected.connection.kind === "remote" ? selected.connection.baseUrl : "local auto") : check("connection", "selected server connection", repo ? "fail" : "warn", repo ? "selected alias is missing" : "will auto-start local server", repo ? "Run `rig connect list` and `rig connect use <alias|local>`." : undefined));
-  let server = null;
+  checks.push(repo ? check("project-link", "repo selected for local setup", repo.project ? "pass" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : ""}`, "Run `rig init --repo owner/repo` if this project should use GitHub Issues.") : check("project-link", "repo selected for local setup", "warn", "missing .rig/state/connection.json", "Current UX can run without this compatibility file; `rig init` recreates it for GitHub-backed projects."));
   try {
-    server = await (options.resolveServer ?? ensureServerForCli)(projectRoot);
-    checks.push(check("server", "Rig server reachable", "pass", `${server.connectionKind} ${server.baseUrl}`));
+    progress("Checking GitHub auth\u2026");
+    const auth = await request("/api/github/auth/status");
+    checks.push(isAuthenticated(auth) ? check("github-auth", "GitHub auth", "pass") : check("github-auth", "GitHub auth", "fail", "not authenticated", "Run `rig github auth import-gh` or `rig github auth token --token <token>`."));
   } catch (error) {
-    checks.push(check("server", "Rig server reachable", "fail", errorMessage(error), "Start the local Rig server or fix the selected remote connection."));
+    checks.push(check("github-auth", "GitHub auth", "fail", errorMessage(error), "Authenticate GitHub through Rig."));
   }
-  if (server || options.requestJson) {
-    try {
-      const status = await request("/api/server/status");
-      checks.push(check("server-status", "server project status", "pass", JSON.stringify(status).slice(0, 180)));
-    } catch (error) {
-      checks.push(check("server-status", "server project status", "fail", errorMessage(error), "Run `rig doctor` after the selected server is reachable."));
-    }
-    try {
-      const auth = await request("/api/github/auth/status");
-      checks.push(isAuthenticated(auth) ? check("github-auth", "GitHub auth", "pass") : check("github-auth", "GitHub auth", "fail", "not authenticated", "Run `rig github auth import-gh` or `rig github auth token --token <token>`."));
-    } catch (error) {
-      checks.push(check("github-auth", "GitHub auth", "fail", errorMessage(error), "Authenticate GitHub through Rig and ensure the server exposes auth status."));
-    }
-    try {
-      const permissions = await request("/api/github/repo/permissions");
-      const allowed = permissionAllowsPr(permissions);
-      checks.push(allowed === true ? check("github-repo-permissions", "GitHub repo PR permissions", "pass", JSON.stringify(permissions).slice(0, 180)) : allowed === false ? check("github-repo-permissions", "GitHub repo PR permissions", "fail", JSON.stringify(permissions).slice(0, 180), "Grant the selected GitHub token permission to push branches, open PRs, and merge according to repo rules.") : check("github-repo-permissions", "GitHub repo PR permissions", "warn", JSON.stringify(permissions).slice(0, 180), "Confirm the selected token can push branches and open PRs."));
-    } catch (error) {
-      checks.push(check("github-repo-permissions", "GitHub repo PR permissions", "warn", errorMessage(error), "Ensure the server exposes repo permission checks and the token can open PRs."));
-    }
-    try {
-      const labels = await request("/api/workspace/task-labels");
-      const ready = labelsReady(labels);
-      checks.push(ready === false ? check("task-labels", "GitHub issue labels", "fail", JSON.stringify(labels).slice(0, 180), "Let Rig create required labels or create the configured lifecycle labels manually.") : check("task-labels", "GitHub issue labels", ready === true ? "pass" : "warn", JSON.stringify(labels).slice(0, 180), "Confirm required Rig lifecycle labels exist."));
-    } catch (error) {
-      checks.push(check("task-labels", "GitHub issue labels", "warn", errorMessage(error), "Run `rig init`/`rig doctor` after label setup is wired on the server."));
-    }
-    try {
-      const projection = await request("/api/workspace/task-projection");
-      checks.push(check("task-projection", "task projection", "pass", JSON.stringify(projection).slice(0, 180)));
-    } catch (error) {
-      checks.push(check("task-projection", "task projection", "warn", errorMessage(error), "Refresh task projection with `rig task list` or fix the task source."));
-    }
-    const slug = projectStatusSlug(projectRoot, config);
-    if (slug) {
-      try {
-        const project = await request(`/api/projects/${encodeURIComponent(slug)}`);
-        checks.push(check("remote-checkout", "server project checkout", "pass", JSON.stringify(project).slice(0, 180)));
-      } catch (error) {
-        checks.push(check("remote-checkout", "server project checkout", "warn", errorMessage(error), "Run `rig init --yes --repo owner/repo` to register/link the server project checkout."));
-      }
-    } else {
-      checks.push(check("remote-checkout", "server project checkout", "warn", "repo slug unknown", "Set project.repo or run `rig init --repo owner/repo`."));
-    }
+  try {
+    progress("Checking GitHub repo permissions\u2026");
+    const permissions = await request("/api/github/repo/permissions");
+    const allowed = permissionAllowsPr(permissions);
+    checks.push(allowed === true ? check("github-repo-permissions", "GitHub repo PR permissions", "pass", JSON.stringify(permissions).slice(0, 180)) : allowed === false ? check("github-repo-permissions", "GitHub repo PR permissions", "fail", JSON.stringify(permissions).slice(0, 180), "Grant the selected GitHub token permission to push branches, open PRs, and merge according to repo rules.") : check("github-repo-permissions", "GitHub repo PR permissions", "warn", JSON.stringify(permissions).slice(0, 180), "Confirm the selected token can push branches and open PRs."));
+  } catch (error) {
+    checks.push(check("github-repo-permissions", "GitHub repo PR permissions", "warn", errorMessage(error), "Ensure the token can open PRs."));
   }
   if (taskSourceKind === "github-issues") {
     checks.push(check("gh", "gh CLI fallback", which("gh") ? "pass" : "warn", which("gh") ?? undefined, "Install gh for local/dev GitHub fallback operations."));
   }
   checks.push(githubProjectsCheck(config));
   checks.push(prMergeCheck(config));
+  progress("Checking Pi installation\u2026");
   const piChecks = await (options.piChecks ?? (() => buildPiSetupChecks()))().catch((error) => [{
     ok: false,
     label: "pi/pi-rig checks",
     hint: errorMessage(error)
   }]);
   for (const pi of piChecks) {
-    checks.push(check(pi.label === "pi" ? "pi" : "pi-rig", pi.label, pi.ok ? "pass" : "warn", pi.detail, pi.hint ?? (pi.ok ? undefined : "Run `rig init --yes` to install/update Pi and enable pi-rig.")));
+    checks.push(check(pi.label === "pi" ? "pi" : "pi-rig", pi.label, pi.ok ? "pass" : "warn", pi.detail, pi.hint ?? (pi.ok ? undefined : "Install Pi/OMP and the Rig extension, then use bare `rig` or Cockpit \u2192 Doctor to verify.")));
   }
   return checks;
 }
@@ -819,7 +789,7 @@ function parseRepoSlugFromRemote(remoteUrl) {
   return gitHubMatch ? `${gitHubMatch[1]}/${gitHubMatch[2]}` : null;
 }
 function detectOriginRepoSlug(projectRoot) {
-  const result = spawnSync2("git", ["-C", projectRoot, "remote", "get-url", "origin"], { encoding: "utf8" });
+  const result = spawnSync("git", ["-C", projectRoot, "remote", "get-url", "origin"], { encoding: "utf8" });
   if (result.status !== 0)
     return null;
   return parseRepoSlugFromRemote(result.stdout.trim());
@@ -827,24 +797,24 @@ function detectOriginRepoSlug(projectRoot) {
 function parseRepoSlug(value) {
   const match = value.trim().match(/^([^/\s]+)\/([^/\s]+)$/);
   if (!match)
-    throw new CliError2(`Invalid GitHub repo slug: ${value}. Expected owner/repo.`, 1);
+    throw new CliError(`Invalid GitHub repo slug: ${value}. Expected owner/repo.`, 1, { hint: "Pass the slug as owner/repo, e.g. `rig init --repo acme/widgets`." });
   return { owner: match[1], repo: match[2], slug: `${match[1]}/${match[2]}` };
 }
 function ensureRigPrivateDirs(projectRoot) {
-  const rigDir = resolve6(projectRoot, ".rig");
-  mkdirSync2(resolve6(rigDir, "state"), { recursive: true });
-  mkdirSync2(resolve6(rigDir, "logs"), { recursive: true });
-  mkdirSync2(resolve6(rigDir, "runs"), { recursive: true });
-  mkdirSync2(resolve6(rigDir, "tmp"), { recursive: true });
-  mkdirSync2(resolve6(projectRoot, "artifacts"), { recursive: true });
-  const taskConfigPath = resolve6(rigDir, "task-config.json");
-  if (!existsSync5(taskConfigPath))
+  const rigDir = resolve5(projectRoot, ".rig");
+  mkdirSync2(resolve5(rigDir, "state"), { recursive: true });
+  mkdirSync2(resolve5(rigDir, "logs"), { recursive: true });
+  mkdirSync2(resolve5(rigDir, "runs"), { recursive: true });
+  mkdirSync2(resolve5(rigDir, "tmp"), { recursive: true });
+  mkdirSync2(resolve5(projectRoot, "artifacts"), { recursive: true });
+  const taskConfigPath = resolve5(rigDir, "task-config.json");
+  if (!existsSync4(taskConfigPath))
     writeFileSync2(taskConfigPath, `{}
 `, "utf-8");
 }
 function ensureGitignoreEntries(projectRoot) {
-  const path = resolve6(projectRoot, ".gitignore");
-  const existing = existsSync5(path) ? readFileSync5(path, "utf8") : "";
+  const path = resolve5(projectRoot, ".gitignore");
+  const existing = existsSync4(path) ? readFileSync3(path, "utf8") : "";
   const entries = [".rig/state/", ".rig/logs/", ".rig/runs/", ".rig/tmp/"];
   const missing = entries.filter((entry) => !existing.split(/\r?\n/).includes(entry));
   if (missing.length === 0)
@@ -857,14 +827,14 @@ function ensureGitignoreEntries(projectRoot) {
 `, "utf8");
 }
 function ensureRigConfigPackageDependencies(projectRoot) {
-  const path = resolve6(projectRoot, "package.json");
-  const existing = existsSync5(path) ? JSON.parse(readFileSync5(path, "utf8")) : {};
+  const path = resolve5(projectRoot, "package.json");
+  const existing = existsSync4(path) ? JSON.parse(readFileSync3(path, "utf8")) : {};
   const devDependencies = existing.devDependencies && typeof existing.devDependencies === "object" && !Array.isArray(existing.devDependencies) ? { ...existing.devDependencies } : {};
   for (const [name, spec] of Object.entries(RIG_CONFIG_DEV_DEPENDENCIES)) {
     devDependencies[name] = spec;
   }
   const next = {
-    ...existsSync5(path) ? existing : { name: "rig-project", private: true },
+    ...existsSync4(path) ? existing : { name: "rig-project", private: true },
     devDependencies
   };
   writeFileSync2(path, `${JSON.stringify(next, null, 2)}
@@ -875,67 +845,243 @@ function applyGitHubProjectConfig(source, options) {
     return source;
   const projectId = JSON.stringify(options.githubProject);
   const statusFieldId = JSON.stringify(options.githubProjectStatusField ?? "Status");
+  const statuses = options.githubProjectStatuses && Object.keys(options.githubProjectStatuses).length > 0 ? `
+      statuses: ${JSON.stringify(options.githubProjectStatuses, null, 8).replace(/\n/g, `
+      `)},` : "";
   return source.replace(`    projects: { enabled: false },`, [
     `    projects: {`,
     `      enabled: true,`,
     `      projectId: ${projectId},`,
-    `      statusFieldId: ${statusFieldId},`,
+    `      statusFieldId: ${statusFieldId},${statuses}`,
     `    },`
   ].join(`
 `));
 }
-function checkoutForInit(projectRoot, serverKind, strategy) {
-  if (serverKind === "local")
-    return { kind: "local", path: projectRoot };
-  const selected = strategy ?? { kind: "managed-clone" };
-  switch (selected.kind) {
-    case "managed-clone":
-      return { kind: "managed-clone", path: projectRoot };
-    case "current-ref":
-      return { kind: "current-ref", path: projectRoot, ...selected.ref ? { ref: selected.ref } : {} };
-    case "uploaded-snapshot":
-      return { kind: "uploaded-snapshot", path: projectRoot, source: "local-working-tree" };
-    case "existing-path":
-      return { kind: "existing-path", path: selected.path };
+function checkoutForInit(projectRoot, options) {
+  if (options.server === "remote") {
+    return {
+      kind: "remote",
+      strategy: "existing-path",
+      path: options.remoteCheckout?.trim() || null,
+      alias: options.remoteAlias ?? options.remoteHost ?? null
+    };
   }
+  return { kind: "local", path: projectRoot };
 }
 function detectGhLogin() {
-  const result = spawnSync2("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8", timeout: 5000, stdio: ["ignore", "pipe", "ignore"] });
+  const result = spawnSync("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8", timeout: 5000, stdio: ["ignore", "pipe", "ignore"] });
   return result.status === 0 && result.stdout.trim() ? result.stdout.trim() : null;
 }
 function readGhAuthToken() {
-  const result = spawnSync2("gh", ["auth", "token"], { encoding: "utf8" });
+  const result = spawnSync("gh", ["auth", "token"], { encoding: "utf8" });
   if (result.status !== 0 || !result.stdout.trim()) {
-    throw new CliError2(result.stderr.trim() || "Could not read GitHub token from `gh auth token`.", result.status || 1);
+    throw new CliError(result.stderr.trim() || "Could not read GitHub token from `gh auth token`.", result.status || 1, { hint: "Sign in with `gh auth login`, or pass a token directly: `rig init --github-auth token --github-token <token>`." });
   }
   return result.stdout.trim();
 }
+function refreshGhProjectScopesAndReadToken() {
+  const result = spawnSync("gh", ["auth", "refresh", "--scopes", "read:project"], {
+    encoding: "utf8",
+    stdio: ["inherit", "pipe", "pipe"]
+  });
+  if (result.status !== 0)
+    return null;
+  try {
+    return readGhAuthToken();
+  } catch {
+    return null;
+  }
+}
+var DRONE_CANCEL = Symbol("drone-cancel");
 async function loadClackPrompts() {
-  return await import("@clack/prompts");
+  const drone = await Promise.resolve().then(() => (init_drone_ui(), exports_drone_ui));
+  return {
+    intro: (message) => drone.droneIntro(message),
+    outro: (message) => drone.droneOutro(message),
+    cancel: (message) => drone.droneCancel(message),
+    isCancel: (value) => value === DRONE_CANCEL,
+    text: async (options) => {
+      const value = await drone.droneText({
+        message: options.message,
+        ...options.placeholder ? { placeholder: options.placeholder } : {},
+        ...(options.initialValue ?? options.defaultValue)?.trim() ? { initialValue: (options.initialValue ?? options.defaultValue).trim() } : {}
+      });
+      return value === null ? DRONE_CANCEL : value;
+    },
+    select: async (options) => {
+      const value = await drone.droneSelect({
+        message: options.message,
+        options: options.options,
+        ...options.initialValue ? { initialValue: options.initialValue } : {}
+      });
+      return value === null ? DRONE_CANCEL : value;
+    },
+    confirm: async (options) => {
+      const value = await drone.droneConfirm(options);
+      return value === null ? DRONE_CANCEL : value;
+    }
+  };
 }
 async function promptRequiredText(prompts, options) {
   const value = await prompts.text(options);
   if (prompts.isCancel(value))
-    throw new CliError2("Init cancelled.", 1);
+    throw new CliError("Init cancelled.", 1);
   const text = String(value ?? "").trim();
   if (!text)
-    throw new CliError2(`${options.message} is required.`, 1);
+    throw new CliError(`${options.message} is required.`, 1);
   return text;
 }
 async function promptOptionalText(prompts, options) {
   const value = await prompts.text(options);
   if (prompts.isCancel(value))
-    throw new CliError2("Init cancelled.", 1);
+    throw new CliError("Init cancelled.", 1);
   return String(value ?? "").trim();
 }
 async function promptSelect(prompts, options) {
   const value = await prompts.select(options);
   if (prompts.isCancel(value))
-    throw new CliError2("Init cancelled.", 1);
+    throw new CliError("Init cancelled.", 1);
   return String(value);
 }
-function sleep2(ms) {
-  return new Promise((resolve7) => setTimeout(resolve7, ms));
+function repoOwnerFromSlug(repoSlug) {
+  return repoSlug.trim().match(/^([^/]+)\/[^/]+$/)?.[1] ?? null;
+}
+function recordArray(value, key) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return [];
+  const raw = value[key];
+  return Array.isArray(raw) ? raw.filter((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry))) : [];
+}
+async function listGitHubProjectsForInit(context, owner, token, serverBaseUrl) {
+  return listGitHubProjectsInProcess(context, owner, { authToken: token, baseUrl: serverBaseUrl });
+}
+async function getGitHubProjectStatusFieldForInit(context, projectId, token, serverBaseUrl) {
+  return getGitHubProjectStatusFieldInProcess(context, projectId, { authToken: token, baseUrl: serverBaseUrl });
+}
+var PROJECT_STATUS_PROMPTS = {
+  running: "Running/In progress",
+  prOpen: "PR open/review",
+  ciFixing: "CI/review fixing",
+  merging: "Merging",
+  done: "Done",
+  needsAttention: "Needs attention"
+};
+var DEFAULT_PROJECT_STATUS_OPTIONS = {
+  running: "In Progress",
+  prOpen: "In Review",
+  ciFixing: "In Review",
+  merging: "Merging",
+  done: "Done",
+  needsAttention: "Needs Attention"
+};
+async function promptManualProjectStatusMapping(prompts) {
+  const statuses = {};
+  for (const [key, label] of Object.entries(PROJECT_STATUS_PROMPTS)) {
+    const defaultLabel = DEFAULT_PROJECT_STATUS_OPTIONS[key] ?? label;
+    const value = await promptOptionalText(prompts, {
+      message: `Project status option id/name for ${label} (blank for ${defaultLabel})`,
+      placeholder: defaultLabel
+    });
+    statuses[key] = value || defaultLabel;
+  }
+  return statuses;
+}
+function projectScopeError(value) {
+  const text = typeof value === "string" ? value : JSON.stringify(value ?? "");
+  return /INSUFFICIENT_SCOPES|read:project|required scopes/i.test(text);
+}
+function optionName(option) {
+  return String(option.name ?? option.label ?? option.id ?? "").trim();
+}
+function autoProjectStatusValue(options, key, label) {
+  const candidates = [DEFAULT_PROJECT_STATUS_OPTIONS[key], label].filter((value) => Boolean(value)).map((value) => value.trim().toLowerCase());
+  const match = options.find((option) => candidates.includes(optionName(option).toLowerCase()));
+  if (!match)
+    return null;
+  return String(match.id ?? match.name);
+}
+async function promptGitHubProjectConfig(context, prompts, repoSlug, githubToken, refreshProjectToken, serverBaseUrl) {
+  const projectChoice = await promptSelect(prompts, {
+    message: "GitHub Projects status sync",
+    initialValue: "select",
+    options: [
+      { value: "select", label: "Select accessible ProjectV2" },
+      { value: "off", label: "Off" },
+      { value: "manual", label: "Enter ProjectV2 ids manually" }
+    ]
+  });
+  if (projectChoice === "off")
+    return { githubProject: "off" };
+  if (projectChoice === "manual") {
+    return {
+      githubProject: await promptRequiredText(prompts, { message: "GitHub ProjectV2 id", placeholder: "PVT_..." }),
+      githubProjectStatusField: await promptRequiredText(prompts, { message: "Project Status field id", placeholder: "field_status" }),
+      githubProjectStatuses: await promptManualProjectStatusMapping(prompts)
+    };
+  }
+  const owner = repoOwnerFromSlug(repoSlug);
+  if (!owner)
+    throw new CliError(`Cannot derive GitHub owner from repo slug ${repoSlug}.`, 1, { hint: "Pass the slug as owner/repo, e.g. `rig init --repo acme/widgets`." });
+  let activeToken = githubToken?.trim() || null;
+  let projectsPayload = await listGitHubProjectsForInit(context, owner, activeToken, serverBaseUrl).catch((error) => ({ ok: false, error: error instanceof Error ? error.message : String(error), projects: [] }));
+  let projects = recordArray(projectsPayload, "projects");
+  if (projects.length === 0 && projectScopeError(projectsPayload.error) && refreshProjectToken) {
+    prompts.outro?.("GitHub token is missing read:project; refreshing gh auth scopes and retrying Projects.");
+    const refreshedToken = refreshProjectToken();
+    if (refreshedToken) {
+      activeToken = refreshedToken;
+      projectsPayload = await listGitHubProjectsForInit(context, owner, activeToken, serverBaseUrl).catch((error) => ({ ok: false, error: error instanceof Error ? error.message : String(error), projects: [] }));
+      projects = recordArray(projectsPayload, "projects");
+    }
+  }
+  if (projects.length === 0) {
+    const error = typeof projectsPayload.error === "string" ? ` (${String(projectsPayload.error).replace(/\s+/g, " ").slice(0, 240)})` : "";
+    prompts.outro?.(`No accessible GitHub Projects were returned${error}; continuing with GitHub Projects status sync off.`);
+    return { githubProject: "off", ...activeToken ? { githubToken: activeToken } : {} };
+  }
+  const selectedProjectId = await promptSelect(prompts, {
+    message: "GitHub ProjectV2 project",
+    options: [
+      ...projects.map((project) => ({
+        value: String(project.id),
+        label: `${String(project.title ?? "Untitled project")} (#${String(project.number ?? "?")})`,
+        hint: typeof project.url === "string" ? project.url : undefined
+      })),
+      { value: "manual", label: "Enter ProjectV2 id manually" }
+    ]
+  });
+  const projectId = selectedProjectId === "manual" ? await promptRequiredText(prompts, { message: "GitHub ProjectV2 id", placeholder: "PVT_..." }) : selectedProjectId;
+  const fieldPayload = await getGitHubProjectStatusFieldForInit(context, projectId, activeToken, serverBaseUrl).catch((error) => ({ ok: false, error: error instanceof Error ? error.message : String(error) }));
+  const fieldPayloadRecord = fieldPayload && typeof fieldPayload === "object" && !Array.isArray(fieldPayload) ? fieldPayload : {};
+  const rawField = fieldPayloadRecord.field;
+  const field = rawField && typeof rawField === "object" && !Array.isArray(rawField) ? rawField : null;
+  const fieldId = typeof field?.id === "string" && field.id.trim() ? field.id : await promptRequiredText(prompts, { message: "Project Status field id", placeholder: "field_status" });
+  const options = Array.isArray(field?.options) ? field.options.filter((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry))) : [];
+  if (options.length === 0) {
+    return {
+      githubProject: projectId,
+      githubProjectStatusField: fieldId,
+      githubProjectStatuses: await promptManualProjectStatusMapping(prompts),
+      ...activeToken ? { githubToken: activeToken } : {}
+    };
+  }
+  const statuses = {};
+  for (const [key, label] of Object.entries(PROJECT_STATUS_PROMPTS)) {
+    const auto = autoProjectStatusValue(options, key, label);
+    statuses[key] = auto ?? await promptSelect(prompts, {
+      message: `Project status option for ${label}`,
+      options: options.map((option) => ({ value: String(option.id ?? option.name), label: optionName(option) }))
+    });
+  }
+  return {
+    githubProject: projectId,
+    githubProjectStatusField: fieldId,
+    githubProjectStatuses: Object.keys(statuses).length > 0 ? statuses : undefined,
+    ...activeToken ? { githubToken: activeToken } : {}
+  };
+}
+function sleep(ms) {
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
 }
 function positiveIntFromEnv(name, fallback) {
   const value = Number.parseInt(process.env[name] ?? "", 10);
@@ -947,17 +1093,6 @@ function apiSessionTokenFrom(payload) {
   const token = payload.apiSessionToken;
   return typeof token === "string" && token.trim() ? token.trim() : null;
 }
-function writeRemoteGitHubAuthState(projectRoot, input) {
-  writeFileSync2(resolve6(projectRoot, ".rig", "state", "github-auth.json"), `${JSON.stringify({
-    authenticated: true,
-    source: input.source,
-    storedOnServer: true,
-    selectedRepo: input.selectedRepo,
-    ...input.apiSessionToken ? { apiSessionToken: input.apiSessionToken } : {},
-    updatedAt: new Date().toISOString()
-  }, null, 2)}
-`, "utf8");
-}
 async function pollDeviceAuthUntilComplete(context, pollId, firstPayload) {
   if (typeof pollId !== "string" || !pollId.trim())
     return null;
@@ -967,7 +1102,7 @@ async function pollDeviceAuthUntilComplete(context, pollId, firstPayload) {
   const deadline = Date.now() + timeoutMs;
   let last = null;
   do {
-    const payload = await requestServerJson(context, "/api/github/auth/device/poll", {
+    const payload = await requestGitHubAuthJsonInProcess(context, "/api/github/auth/device/poll", {
       method: "POST",
       headers: { "content-type": "application/json" },
       body: JSON.stringify({ pollId })
@@ -979,34 +1114,174 @@ async function pollDeviceAuthUntilComplete(context, pollId, firstPayload) {
     }
     if (timeoutMs <= 0)
       return last;
-    await sleep2(intervalMs);
+    await sleep(intervalMs);
   } while (Date.now() < deadline);
   return last;
 }
+function runLocalFilesInit(context, options) {
+  const projectRoot = context.projectRoot;
+  ensureRigPrivateDirs(projectRoot);
+  ensureGitignoreEntries(projectRoot);
+  writeRepoConnection(projectRoot, { selected: "local", linkedAt: new Date().toISOString() });
+  const configTsPath = resolve5(projectRoot, "rig.config.ts");
+  const configExists = existsSync4(configTsPath) || existsSync4(resolve5(projectRoot, "rig.config.json"));
+  if (configExists && !options.repair) {
+    if (context.outputMode !== "json")
+      console.log("rig.config already exists; leaving it unchanged. Pass --repair to rewrite it.");
+  } else {
+    const projectName = basename(projectRoot) || "rig-project";
+    writeFileSync2(configTsPath, buildRigInitConfigSource({
+      projectName,
+      taskSource: { kind: "files", path: "tasks" },
+      useStandardPlugin: true
+    }), "utf-8");
+  }
+  ensureRigConfigPackageDependencies(projectRoot);
+  const tasksDir = resolve5(projectRoot, "tasks");
+  if (!existsSync4(tasksDir)) {
+    mkdirSync2(tasksDir, { recursive: true });
+    writeFileSync2(resolve5(tasksDir, "T-1.json"), `${JSON.stringify({ id: "T-1", title: "My first Rig task", body: "Describe the change you want an agent to make." }, null, 2)}
+`, "utf-8");
+  }
+  if (context.outputMode !== "json") {
+    console.log("Initialized a local files-source Rig project (no GitHub).");
+    console.log("  tasks live in tasks/*.json \xB7 server: local");
+    console.log("Next: `rig task list`, then `rig task run T-1`.");
+    console.log("To wire GitHub later: `rig init --repair --repo owner/repo --github-auth gh`.");
+  }
+  return { ok: true, group: "init", command: "init", details: { mode: "local-files", projectRoot, taskSourcePath: "tasks" } };
+}
+var DEMO_TASKS_RELATIVE_DIR = ".rig/demo-tasks";
+var DEMO_TASKS = [
+  {
+    id: "demo-1",
+    title: "Add a hello CLI script",
+    body: [
+      "Create `scripts/hello.ts` that prints `Hello from Rig!` plus the current date,",
+      "and add a `hello` script entry to package.json that runs it with bun.",
+      "Keep it dependency-free."
+    ].join(`
+`),
+    status: "ready",
+    labels: ["demo"]
+  },
+  {
+    id: "demo-2",
+    title: "Write a README section about this project",
+    body: [
+      "Add (or extend) README.md with a short `## What this is` section:",
+      "two or three sentences describing the repository and how to run it.",
+      "Plain prose, no badges."
+    ].join(`
+`),
+    status: "ready",
+    labels: ["demo"]
+  },
+  {
+    id: "demo-3",
+    title: "Add a unit test for the hello script",
+    body: [
+      "Add `scripts/hello.test.ts` with a bun test that imports the greeting",
+      "helper from the hello script and asserts it contains `Hello from Rig!`.",
+      "Refactor the script to export that helper if needed."
+    ].join(`
+`),
+    status: "ready",
+    labels: ["demo"]
+  }
+];
+function runDemoInit(context, options) {
+  const projectRoot = context.projectRoot;
+  ensureRigPrivateDirs(projectRoot);
+  ensureGitignoreEntries(projectRoot);
+  writeRepoConnection(projectRoot, { selected: "local", linkedAt: new Date().toISOString() });
+  const configTsPath = resolve5(projectRoot, "rig.config.ts");
+  const configExists = existsSync4(configTsPath) || existsSync4(resolve5(projectRoot, "rig.config.json"));
+  let configWritten = false;
+  if (configExists && !options.repair) {
+    if (context.outputMode !== "json") {
+      console.log("rig.config already exists; leaving it unchanged. Pass --repair to rewrite it for the demo.");
+    }
+  } else {
+    writeFileSync2(configTsPath, buildRigInitConfigSource({
+      projectName: basename(projectRoot) || "rig-demo",
+      taskSource: { kind: "files", path: DEMO_TASKS_RELATIVE_DIR },
+      useStandardPlugin: true
+    }), "utf-8");
+    configWritten = true;
+  }
+  ensureRigConfigPackageDependencies(projectRoot);
+  const demoTasksDir = resolve5(projectRoot, DEMO_TASKS_RELATIVE_DIR);
+  mkdirSync2(demoTasksDir, { recursive: true });
+  const taskIds = [];
+  for (const task of DEMO_TASKS) {
+    const id = String(task.id);
+    taskIds.push(id);
+    const taskPath = resolve5(demoTasksDir, `${id}.json`);
+    if (!existsSync4(taskPath)) {
+      writeFileSync2(taskPath, `${JSON.stringify(task, null, 2)}
+`, "utf-8");
+    }
+  }
+  if (context.outputMode !== "json") {
+    console.log(`Demo Rig project ready (offline, no GitHub).`);
+    console.log(`  config: rig.config.ts (files task source -> ${DEMO_TASKS_RELATIVE_DIR}/)`);
+    console.log(`  tasks:  ${taskIds.join(", ")}`);
+    console.log("Next steps:");
+    console.log("  1. run bare `rig`");
+    console.log("  2. use the OMP cockpit Start screen");
+  }
+  return {
+    ok: true,
+    group: "init",
+    command: "init",
+    details: {
+      mode: "demo",
+      projectRoot,
+      taskSourcePath: DEMO_TASKS_RELATIVE_DIR,
+      demoTasksDir,
+      tasks: taskIds,
+      configWritten
+    }
+  };
+}
 async function runControlPlaneInit(context, options) {
   const projectRoot = context.projectRoot;
-  const detectedSlug = options.repoSlug ?? detectOriginRepoSlug(projectRoot);
+  const existingRepoConnection = readRepoConnection(projectRoot);
+  const detectedSlug = options.repoSlug ?? existingRepoConnection?.project ?? detectOriginRepoSlug(projectRoot);
   if (!detectedSlug) {
-    throw new CliError2("Could not detect GitHub repo slug from origin. Pass --repo owner/repo.", 1);
+    const authMethod2 = options.githubAuthMethod ?? (options.githubToken ? "token" : "skip");
+    if (authMethod2 === "skip") {
+      return runLocalFilesInit(context, options);
+    }
+    throw new CliError("Could not detect GitHub repo slug from origin. Current UX starts from bare `rig`; pass --repo owner/repo or use `rig init --yes --github-auth skip` for a local files-source project without GitHub.", 1);
   }
   const repo = parseRepoSlug(detectedSlug);
-  const serverKind = options.server ?? "local";
-  const connectionAlias = options.connectionAlias ?? (serverKind === "local" ? "local" : "remote");
-  if (serverKind === "remote") {
-    if (!options.remoteUrl)
-      throw new CliError2("Missing --remote-url for --server remote.", 1);
-    upsertGlobalConnection(connectionAlias, { kind: "remote", baseUrl: options.remoteUrl });
+  const placement = options.server ?? "local";
+  let connectionAlias = "local";
+  if (placement === "remote") {
+    const host = (options.remoteHost ?? "").trim();
+    const alias = (options.remoteAlias ?? host).trim();
+    if (!host || !alias) {
+      throw new CliError("Remote placement needs --remote-host <host>.", 1, {
+        hint: "rig init --server remote --remote-host rig.example.com [--remote-alias prod] [--remote-port 22] [--remote-checkout /srv/repo]"
+      });
+    }
+    upsertManagedRemoteEndpoint({ alias, host, port: options.remotePort ?? 22 }, undefined, projectRoot);
+    connectionAlias = alias;
   }
+  const remoteCheckoutPath = placement === "remote" ? options.remoteCheckout?.trim() || null : null;
   writeRepoConnection(projectRoot, {
     selected: connectionAlias,
     project: repo.slug,
-    linkedAt: new Date().toISOString()
+    linkedAt: new Date().toISOString(),
+    ...remoteCheckoutPath ? { serverProjectRoot: remoteCheckoutPath, serverProjectRootAlias: connectionAlias } : {}
   });
   ensureRigPrivateDirs(projectRoot);
   ensureGitignoreEntries(projectRoot);
-  const configTsPath = resolve6(projectRoot, "rig.config.ts");
-  const configJsonPath = resolve6(projectRoot, "rig.config.json");
-  const configExists = existsSync5(configTsPath) || existsSync5(configJsonPath);
+  const configTsPath = resolve5(projectRoot, "rig.config.ts");
+  const configJsonPath = resolve5(projectRoot, "rig.config.json");
+  const configExists = existsSync4(configTsPath) || existsSync4(configJsonPath);
   if (!options.privateStateOnly) {
     if (configExists && !options.repair) {
       if (context.outputMode !== "json")
@@ -1022,46 +1297,26 @@ async function runControlPlaneInit(context, options) {
     }
     ensureRigConfigPackageDependencies(projectRoot);
   }
-  writeFileSync2(resolve6(projectRoot, ".rig", "state", "project-link.json"), `${JSON.stringify({ repoSlug: repo.slug, connection: connectionAlias, linkedAt: new Date().toISOString() }, null, 2)}
+  writeFileSync2(resolve5(projectRoot, ".rig", "state", "project-link.json"), `${JSON.stringify({ repoSlug: repo.slug, connection: connectionAlias, linkedAt: new Date().toISOString() }, null, 2)}
 `, "utf8");
-  const checkout = checkoutForInit(projectRoot, serverKind, options.remoteCheckout);
-  let uploadedSnapshot = null;
-  if (serverKind === "remote" && options.remoteCheckout?.kind === "uploaded-snapshot") {
-    const archive = await createSnapshotUploadArchive(projectRoot);
-    uploadedSnapshot = await uploadSnapshotArchiveViaServer(context, { repoSlug: repo.slug, archive });
-    const uploadedCheckout = uploadedSnapshot.checkout;
-    if (uploadedCheckout && typeof uploadedCheckout === "object" && !Array.isArray(uploadedCheckout)) {
-      Object.assign(checkout, uploadedCheckout);
-    }
-  }
+  const checkout = checkoutForInit(projectRoot, options);
   let githubAuth = null;
   let deviceAuth = null;
   const authMethod = options.githubAuthMethod ?? (options.githubToken ? "token" : "skip");
-  const remoteGhTokenWarning = serverKind === "remote" && authMethod === "gh" ? `This sends a GitHub token from this machine to ${options.remoteUrl ?? "the remote Rig server"}.` : null;
-  if (remoteGhTokenWarning && !options.yes) {
-    throw new CliError2(`${remoteGhTokenWarning} Re-run with --yes to confirm this explicit token transfer.`, 1);
-  }
   const token = authMethod === "gh" && !options.githubToken ? readGhAuthToken() : options.githubToken?.trim();
   if (token) {
-    githubAuth = await postGitHubTokenViaServer(context, token, { selectedRepo: repo.slug });
+    githubAuth = await postGitHubTokenInProcess(context, token, { selectedRepo: repo.slug });
     const apiSessionToken = apiSessionTokenFrom(githubAuth);
-    setGitHubBearerTokenForCurrentProcess(apiSessionToken ?? token);
-    if (serverKind === "remote") {
-      writeRemoteGitHubAuthState(projectRoot, {
-        source: authMethod === "gh" ? "gh" : "init-token",
-        selectedRepo: repo.slug,
-        apiSessionToken
-      });
-    }
+    setGitHubBearerTokenForCurrentProcess(apiSessionToken ?? token, projectRoot);
   } else if (authMethod === "device") {
-    const payload = await requestServerJson(context, "/api/github/auth/device/start", {
+    const payload = await requestGitHubAuthJsonInProcess(context, "/api/github/auth/device/start", {
       method: "POST",
       headers: { "content-type": "application/json" },
       body: JSON.stringify({ repoSlug: repo.slug })
     });
     deviceAuth = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
     if (context.outputMode !== "json") {
-      const verificationUri = String(deviceAuth.verificationUri ?? deviceAuth.verification_uri ?? deviceAuth.verification_uri_complete ?? "the verification URL returned by the server");
+      const verificationUri = String(deviceAuth.verificationUri ?? deviceAuth.verification_uri ?? deviceAuth.verification_uri_complete ?? "the verification URL returned by GitHub");
       const userCode = String(deviceAuth.userCode ?? deviceAuth.user_code ?? "the returned user code");
       console.log(`GitHub device flow: open ${verificationUri} and enter ${userCode}. Waiting for authorization...`);
     }
@@ -1069,45 +1324,19 @@ async function runControlPlaneInit(context, options) {
     if (completed) {
       const apiSessionToken = apiSessionTokenFrom(completed);
       if (apiSessionToken) {
-        setGitHubBearerTokenForCurrentProcess(apiSessionToken);
-        if (serverKind === "remote") {
-          writeRemoteGitHubAuthState(projectRoot, { source: "device", selectedRepo: repo.slug, apiSessionToken });
-        }
+        setGitHubBearerTokenForCurrentProcess(apiSessionToken, projectRoot);
       }
       deviceAuth = { ...deviceAuth, poll: completed, completed: completed.status === "signed-in" };
     }
   }
-  let remoteCheckoutPreparation = null;
-  if (serverKind === "remote" && options.remoteCheckout?.kind !== "uploaded-snapshot") {
-    remoteCheckoutPreparation = await prepareRemoteCheckoutViaServer(context, {
-      repoSlug: repo.slug,
-      checkout,
-      repoUrl: `https://github.com/${repo.slug}.git`
-    });
-    const preparedCheckout = remoteCheckoutPreparation.checkout;
-    if (preparedCheckout && typeof preparedCheckout === "object" && !Array.isArray(preparedCheckout)) {
-      Object.assign(checkout, preparedCheckout);
-    }
-  }
-  const registered = await registerProjectViaServer(context, {
-    repoSlug: repo.slug,
-    checkout
-  });
-  const checkoutPath = typeof checkout.path === "string" ? checkout.path : null;
-  const serverRootSwitch = serverKind === "remote" && checkoutPath ? await switchServerProjectRootViaServer(context, checkoutPath) : null;
-  if (serverRootSwitch && token) {
-    githubAuth = await postGitHubTokenViaServer(context, token, { selectedRepo: repo.slug, projectRoot: checkoutPath ?? undefined });
-    const apiSessionToken = apiSessionTokenFrom(githubAuth);
-    setGitHubBearerTokenForCurrentProcess(apiSessionToken ?? token);
-    writeRemoteGitHubAuthState(projectRoot, { source: authMethod === "gh" ? "gh" : "init-token", selectedRepo: repo.slug, apiSessionToken });
-  }
-  const activeProjectRegistration = serverRootSwitch ? await registerProjectViaServer(context, { repoSlug: repo.slug, checkout }) : null;
-  const pi = serverKind === "remote" ? await ensureRemotePiRigInstalled({ requestJson: (pathname, init) => requestServerJson(context, pathname, init) }).catch((error) => ({
-    remote: true,
-    pi: { ok: false, label: "pi", hint: error instanceof Error ? error.message : String(error) },
-    piRig: { ok: false, label: "pi-rig global extension", hint: "Remote server did not complete pi-rig installation." },
-    extensionPath: "remote:~/.pi/agent/extensions/pi-rig"
-  })) : await ensurePiRigInstalled({ projectRoot, homeDir: process.env.RIG_PI_HOME_DIR }).catch((error) => ({
+  const labelSetup = {
+    ok: false,
+    ready: false,
+    labelsReady: false,
+    skipped: true,
+    reason: "retired-server-label-bootstrap"
+  };
+  const pi = await ensurePiRigInstalled({ projectRoot, homeDir: process.env.RIG_PI_HOME_DIR }).catch((error) => ({
     pi: { ok: false, label: "pi", hint: error instanceof Error ? error.message : String(error) },
     piRig: { ok: false, label: "pi-rig global extension", hint: "Local pi-rig installation failed." },
     extensionPath: null,
@@ -1120,41 +1349,32 @@ async function runControlPlaneInit(context, options) {
   }));
   const details = {
     repoSlug: repo.slug,
-    server: serverKind,
+    server: placement,
     connection: connectionAlias,
     githubProject: options.githubProject ?? "off",
     checkout,
-    remoteCheckoutPreparation,
-    uploadedSnapshot,
-    projectRegistration: registered,
-    activeProjectRegistration,
-    serverRootSwitch,
     githubAuth,
     deviceAuth,
-    githubAuthWarning: remoteGhTokenWarning,
+    labelSetup,
     pi,
     doctor
   };
   if (context.outputMode === "json")
     console.log(JSON.stringify(details, null, 2));
   else
-    console.log(`Initialized Rig control-plane project ${repo.slug}. Next: rig doctor && rig task list`);
+    console.log(`Initialized Rig control-plane project ${repo.slug} (${placement} placement). Next: rig doctor && rig task list`);
   return { ok: true, group: "init", command: "init", details };
 }
 function parseInitOptions(args) {
   let rest = [...args];
+  const demo = takeFlag(rest, "--demo");
+  rest = demo.rest;
   const yes = takeFlag(rest, "--yes");
   rest = yes.rest;
   const repair = takeFlag(rest, "--repair");
   rest = repair.rest;
   const privateStateOnly = takeFlag(rest, "--private-state-only");
   rest = privateStateOnly.rest;
-  const server = takeOption(rest, "--server");
-  rest = server.rest;
-  const remoteUrl = takeOption(rest, "--remote-url");
-  rest = remoteUrl.rest;
-  const connectionAlias = takeOption(rest, "--connection");
-  rest = connectionAlias.rest;
   const repoSlug = takeOption(rest, "--repo");
   rest = repoSlug.rest;
   const githubToken = takeOption(rest, "--github-token");
@@ -1165,52 +1385,51 @@ function parseInitOptions(args) {
   rest = githubProjectStatusField.rest;
   const githubAuth = takeOption(rest, "--github-auth");
   rest = githubAuth.rest;
+  const server = takeOption(rest, "--server");
+  rest = server.rest;
+  const remoteHost = takeOption(rest, "--remote-host");
+  rest = remoteHost.rest;
+  const remoteUrl = takeOption(rest, "--remote-url");
+  rest = remoteUrl.rest;
+  const remoteAlias = takeOption(rest, "--remote-alias");
+  rest = remoteAlias.rest;
+  const remotePort = takeOption(rest, "--remote-port");
+  rest = remotePort.rest;
   const remoteCheckout = takeOption(rest, "--remote-checkout");
   rest = remoteCheckout.rest;
-  const existingPath = takeOption(rest, "--existing-path");
-  rest = existingPath.rest;
-  const ref = takeOption(rest, "--ref");
-  rest = ref.rest;
+  if (server.value && !["local", "remote"].includes(server.value)) {
+    throw new CliError("--server must be local or remote.", 1);
+  }
+  if (githubAuth.value && !["gh", "token", "device", "skip"].includes(githubAuth.value)) {
+    throw new CliError("--github-auth must be gh, token, device, or skip.", 1);
+  }
+  const portValue = remotePort.value ? Number(remotePort.value) : undefined;
+  if (portValue !== undefined && !Number.isFinite(portValue)) {
+    throw new CliError("--remote-port must be a number.", 1);
+  }
+  const hostFromUrl = remoteUrl.value ? remoteUrl.value.replace(/^[a-z]+:\/\//i, "").replace(/[/:].*$/, "").trim() : undefined;
   const options = {
+    demo: demo.value,
     yes: yes.value,
     repair: repair.value,
     privateStateOnly: privateStateOnly.value,
-    server: server.value === "remote" ? "remote" : server.value === "local" ? "local" : undefined,
-    remoteUrl: remoteUrl.value,
-    connectionAlias: connectionAlias.value,
     repoSlug: repoSlug.value,
     githubToken: githubToken.value,
     githubAuthMethod: githubAuth.value,
     githubProject: githubProject.value,
-    githubProjectStatusField: githubProjectStatusField.value
+    githubProjectStatusField: githubProjectStatusField.value,
+    server: server.value === "remote" ? "remote" : server.value === "local" ? "local" : undefined,
+    remoteAlias: remoteAlias.value,
+    remoteHost: remoteHost.value ?? hostFromUrl,
+    remotePort: portValue,
+    remoteCheckout: remoteCheckout.value
   };
-  if (server.value && options.server === undefined) {
-    throw new CliError2("--server must be local or remote.", 1);
-  }
-  if (githubAuth.value && !["gh", "token", "device", "skip"].includes(githubAuth.value)) {
-    throw new CliError2("--github-auth must be gh, token, device, or skip.", 1);
-  }
-  if (remoteCheckout.value) {
-    if (remoteCheckout.value === "managed-clone")
-      options.remoteCheckout = { kind: "managed-clone" };
-    else if (remoteCheckout.value === "current-ref")
-      options.remoteCheckout = { kind: "current-ref", ref: ref.value };
-    else if (remoteCheckout.value === "uploaded-snapshot")
-      options.remoteCheckout = { kind: "uploaded-snapshot" };
-    else if (remoteCheckout.value === "existing-path") {
-      if (!existingPath.value)
-        throw new CliError2("--remote-checkout existing-path requires --existing-path <path>.", 1);
-      options.remoteCheckout = { kind: "existing-path", path: existingPath.value };
-    } else {
-      throw new CliError2("--remote-checkout must be managed-clone, current-ref, uploaded-snapshot, or existing-path.", 1);
-    }
-  }
   return { options, rest };
 }
 async function runInteractiveControlPlaneInit(context, prompts) {
   prompts.intro?.("Initialize a Rig control-plane project");
   const projectRoot = context.projectRoot;
-  const existingConfig = existsSync5(resolve6(projectRoot, "rig.config.ts")) || existsSync5(resolve6(projectRoot, "rig.config.json"));
+  const existingConfig = existsSync4(resolve5(projectRoot, "rig.config.ts")) || existsSync4(resolve5(projectRoot, "rig.config.json"));
   let repair = false;
   let privateStateOnly = false;
   if (existingConfig) {
@@ -1236,99 +1455,87 @@ async function runInteractiveControlPlaneInit(context, prompts) {
     placeholder: "owner/repo",
     defaultValue: detectedRepo
   });
-  const serverChoice = await promptSelect(prompts, {
-    message: "Rig server",
+  const placement = await promptSelect(prompts, {
+    message: "Execution placement",
+    initialValue: "local",
     options: [
-      { value: "local", label: "Local server", hint: "run on this machine" },
-      { value: "remote", label: "Remote server", hint: "connect to an HTTPS Rig server" }
+      { value: "local", label: "Local", hint: "runs execute on this machine (tmux)" },
+      { value: "remote", label: "Remote", hint: "runs execute on an SSH host" }
     ]
   });
-  const remoteUrl = serverChoice === "remote" ? await promptRequiredText(prompts, { message: "Remote Rig server URL", placeholder: "https://rig.example.com" }) : undefined;
+  let remoteAlias;
+  let remoteHost;
+  let remotePort;
   let remoteCheckout;
-  if (serverChoice === "remote") {
-    const checkout = await promptSelect(prompts, {
-      message: "Remote checkout strategy",
-      options: [
-        { value: "managed-clone", label: "Server-managed clone (recommended)" },
-        { value: "current-ref", label: "Clone current branch/ref" },
-        { value: "uploaded-snapshot", label: "Upload current working-tree snapshot" },
-        { value: "existing-path", label: "Use existing server path" }
-      ]
-    });
-    if (checkout === "existing-path") {
-      remoteCheckout = { kind: "existing-path", path: await promptRequiredText(prompts, { message: "Existing server checkout path", placeholder: "/srv/rig/checkouts/repo" }) };
-    } else if (checkout === "current-ref") {
-      remoteCheckout = { kind: "current-ref", ref: await promptOptionalText(prompts, { message: "Branch/ref to clone (blank for current HEAD)", placeholder: "main" }) || undefined };
-    } else if (checkout === "uploaded-snapshot") {
-      remoteCheckout = { kind: "uploaded-snapshot" };
-    } else {
-      remoteCheckout = { kind: "managed-clone" };
-    }
+  if (placement === "remote") {
+    remoteHost = await promptRequiredText(prompts, { message: "Remote host (ssh)", placeholder: "rig.example.com" });
+    remoteAlias = await promptOptionalText(prompts, { message: "Alias for this remote", placeholder: "prod", initialValue: remoteHost }) || remoteHost;
+    const portText = await promptOptionalText(prompts, { message: "SSH port", placeholder: "22", initialValue: "22" });
+    remotePort = portText && Number.isFinite(Number(portText)) ? Number(portText) : 22;
+    remoteCheckout = await promptOptionalText(prompts, { message: "Remote working directory (existing checkout path)", placeholder: "/srv/rig/<repo>" }) || undefined;
   }
   const detectedGhLogin = detectGhLogin();
   const authMethod = await promptSelect(prompts, {
     message: `GitHub auth method${detectedGhLogin ? ` (detected gh login: ${detectedGhLogin})` : ""}`,
     options: [
-      { value: "gh", label: "Import token from gh auth token", hint: serverChoice === "local" ? "recommended for local" : "sends this machine's token to the remote server" },
-      { value: "device", label: "Start server GitHub device flow", hint: serverChoice === "remote" ? "recommended for remote" : undefined },
+      { value: "gh", label: "Import token from gh auth token", hint: "recommended for local" },
+      { value: "device", label: "Start GitHub device flow" },
       { value: "token", label: "Paste token" },
       { value: "skip", label: "Skip for now" }
     ]
   });
-  if (serverChoice === "remote" && authMethod === "gh") {
-    if (!prompts.confirm)
-      throw new CliError2("Remote gh-token import requires explicit confirmation.", 1);
-    const confirmed = await prompts.confirm({
-      message: `This sends a GitHub token from this machine to ${remoteUrl}. Continue?`,
-      initialValue: false
-    });
-    if (prompts.isCancel(confirmed) || confirmed !== true) {
-      throw new CliError2("Remote gh-token import cancelled.", 1);
-    }
-  }
-  const githubToken = authMethod === "token" ? await promptRequiredText(prompts, { message: "GitHub token", placeholder: "ghp_..." }) : undefined;
-  const projectChoice = await promptSelect(prompts, {
-    message: "GitHub Projects status sync",
-    options: [
-      { value: "off", label: "Off" },
-      { value: "configure", label: "Configure ProjectV2 status field" }
-    ]
-  });
-  const githubProject = projectChoice === "configure" ? await promptRequiredText(prompts, { message: "GitHub ProjectV2 id", placeholder: "PVT_..." }) : "off";
-  const githubProjectStatusField = projectChoice === "configure" ? await promptRequiredText(prompts, { message: "Project Status field id", placeholder: "field_status" }) : undefined;
+  const githubToken = authMethod === "token" ? await promptRequiredText(prompts, { message: "GitHub token", placeholder: "ghp_..." }) : authMethod === "gh" ? readGhAuthToken() : undefined;
+  const projectConfig = await promptGitHubProjectConfig(context, prompts, repoSlug, githubToken, authMethod === "gh" ? refreshGhProjectScopesAndReadToken : undefined);
+  const effectiveGithubToken = projectConfig.githubToken ?? githubToken;
   const result = await runControlPlaneInit(context, {
-    server: serverChoice,
-    remoteUrl,
     repoSlug,
-    githubToken,
+    githubToken: effectiveGithubToken,
     githubAuthMethod: authMethod,
-    githubProject,
-    githubProjectStatusField,
-    remoteCheckout,
+    githubProject: projectConfig.githubProject,
+    githubProjectStatusField: projectConfig.githubProjectStatusField,
+    githubProjectStatuses: projectConfig.githubProjectStatuses,
     repair,
-    privateStateOnly
+    privateStateOnly,
+    server: placement,
+    ...remoteAlias ? { remoteAlias } : {},
+    ...remoteHost ? { remoteHost } : {},
+    ...remotePort !== undefined ? { remotePort } : {},
+    ...remoteCheckout ? { remoteCheckout } : {}
   });
   const details = result.details && typeof result.details === "object" && !Array.isArray(result.details) ? result.details : {};
   const deviceAuth = details.deviceAuth && typeof details.deviceAuth === "object" && !Array.isArray(details.deviceAuth) ? details.deviceAuth : null;
   const deviceMessage = deviceAuth ? ` GitHub device flow: open ${String(deviceAuth.verificationUri ?? deviceAuth.verification_uri ?? deviceAuth.verification_uri_complete ?? "the verification URL returned by the server")} and enter ${String(deviceAuth.userCode ?? deviceAuth.user_code ?? "the returned user code")}.` : "";
-  prompts.outro?.(`Rig project initialized.${deviceMessage} Next: rig doctor && rig task list`);
+  prompts.outro?.(`Rig project initialized (${placement} placement).${deviceMessage} Next: rig doctor && rig task list`);
   return result;
 }
 async function executeInit(context, args) {
   const parsed = parseInitOptions(args);
-  if (parsed.options.yes || parsed.options.server || parsed.options.repoSlug || parsed.options.githubToken || parsed.options.privateStateOnly || parsed.options.repair || parsed.options.githubAuthMethod || parsed.options.remoteCheckout) {
+  if (parsed.options.demo) {
+    if (parsed.rest.length > 0) {
+      throw new CliError(`Unexpected arguments: ${parsed.rest.join(" ")}
+Usage: rig init --demo [--yes] [--repair]`, 1, { hint: "Run `rig init --demo` (optionally with --repair to rewrite an existing rig.config)." });
+    }
+    return runDemoInit(context, parsed.options);
+  }
+  if (parsed.options.yes || parsed.options.repoSlug || parsed.options.githubToken || parsed.options.privateStateOnly || parsed.options.repair || parsed.options.githubAuthMethod || parsed.options.server || parsed.options.remoteHost) {
     if (parsed.rest.length > 0)
-      throw new CliError2(`Unexpected arguments: ${parsed.rest.join(" ")}
-Usage: rig init [--server local|remote] [--remote-url <url>] [--repo owner/repo] [--github-auth gh|token|device|skip] [--github-token <token>] [--github-project off|<project-id>] [--remote-checkout managed-clone|current-ref|uploaded-snapshot|existing-path] [--yes]`, 1);
+      throw new CliError(`Unexpected arguments: ${parsed.rest.join(" ")}
+Usage: rig init [--demo] [--repo owner/repo] [--server local|remote] [--remote-host <host>] [--remote-alias <a>] [--remote-port <n>] [--remote-checkout <path>] [--github-auth gh|token|device|skip] [--github-token <token>] [--github-project off|<project-id>] [--yes]`, 1);
     return runControlPlaneInit(context, parsed.options);
   }
   if (parsed.rest.length > 0)
-    throw new CliError2(`Unexpected arguments: ${parsed.rest.join(" ")}
+    throw new CliError(`Unexpected arguments: ${parsed.rest.join(" ")}
 Usage: rig init`, 1);
+  if (!process.stdin.isTTY) {
+    throw new CliError("rig init needs an interactive terminal. For scripts, pass flags: rig init --yes --repo owner/repo [--server local|remote --remote-host <host>] [--github-auth gh|token|device|skip].", 1);
+  }
   return runInteractiveControlPlaneInit(context, await loadClackPrompts());
 }
 export {
   runInteractiveControlPlaneInit,
+  runDemoInit,
   executeInit,
-  buildRigInitConfigSource
+  buildRigInitConfigSource,
+  DEMO_TASKS_RELATIVE_DIR,
+  DEMO_TASKS
 };