@h-rig/cli 0.0.6-alpha.90 → 0.0.6-alpha.91

package/dist/src/commands/github.d.ts

@@ -1,3 +1,3 @@
 import { type RunnerContext } from "../runner";
-import type { CommandOutcome } from "@rig/runtime/control-plane/runtime/types";
+import type { CommandOutcome } from "@rig/runtime";
 export declare function executeGithub(context: RunnerContext, args: string[]): Promise<CommandOutcome>;

package/dist/src/commands/github.js

@@ -1,6 +1,8 @@
 // @bun
 // packages/cli/src/commands/github.ts
 import { spawnSync } from "child_process";
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, resolve as resolve3 } from "path";
 
 // packages/cli/src/runner.ts
 import { EventBus } from "@rig/runtime/control-plane/runtime/events";
@@ -38,26 +40,53 @@ function takeOption(args, option) {
   return { value, rest };
 }
 
-// packages/cli/src/commands/_server-client.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { resolve as resolve2 } from "path";
-import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
+// packages/cli/src/commands/_inprocess-services.ts
+import { resolve } from "path";
+import {
+  beginGitHubDeviceFlow,
+  checkGitHubRepoPermissions,
+  createGitHubAuthStore,
+  listGitHubProjects,
+  pollGitHubDeviceFlow,
+  resolveGitHubAuthStatus,
+  resolveProjectStatusField,
+  saveGitHubTokenForProject
+} from "@rig/runtime/control-plane/github/index";
+var scopedGitHubBearerTokens = new Map;
+function cleanToken(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : null;
+}
+function oauthClientId() {
+  return cleanToken(process.env.RIG_GITHUB_OAUTH_CLIENT_ID);
+}
+function setGitHubBearerTokenForCurrentProcess(token, projectRoot) {
+  scopedGitHubBearerTokens.set(resolve(projectRoot ?? process.cwd()), cleanToken(token));
+}
+async function getGitHubAuthStatusInProcess(context) {
+  return { ok: true, ...resolveGitHubAuthStatus({ projectRoot: context.projectRoot, oauthConfigured: Boolean(oauthClientId()) }) };
+}
+async function postGitHubTokenInProcess(context, token, options = {}) {
+  const targetRoot = options.projectRoot?.trim() || context.projectRoot;
+  const result = await saveGitHubTokenForProject({
+    projectRoot: targetRoot,
+    token,
+    tokenSource: "manual-token",
+    selectedRepo: options.selectedRepo ?? null
+  });
+  const store = createGitHubAuthStore(targetRoot);
+  const session = store.createApiSession();
+  if (targetRoot !== context.projectRoot) {
+    store.copyToLocalProjectRoot(context.projectRoot);
+  }
+  return { ...result, authenticated: result.signedIn, apiSessionToken: session.token };
+}
 
 // packages/cli/src/commands/_connection-state.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { dirname, resolve } from "path";
-function resolveGlobalConnectionsPath(env = process.env) {
-  const explicit = env.RIG_CONNECTIONS_FILE?.trim();
-  if (explicit)
-    return resolve(explicit);
-  const stateDir = env.RIG_GLOBAL_STATE_DIR?.trim();
-  if (stateDir)
-    return resolve(stateDir, "connections.json");
-  return resolve(homedir(), ".rig", "connections.json");
-}
+import { dirname, resolve as resolve2 } from "path";
 function resolveRepoConnectionPath(projectRoot) {
-  return resolve(projectRoot, ".rig", "state", "connection.json");
+  return resolve2(projectRoot, ".rig", "state", "connection.json");
 }
 function readJsonFile(path) {
   if (!existsSync(path))
@@ -68,40 +97,6 @@ function readJsonFile(path) {
     throw new CliError(`Invalid Rig connection state at ${path}: ${error instanceof Error ? error.message : String(error)}`, 1, { hint: "Fix or delete that file, then re-select a server with `rig server use <alias|local>`." });
   }
 }
-function writeJsonFile(path, value) {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(value, null, 2)}
-`, "utf8");
-}
-function normalizeConnection(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    return null;
-  const record = value;
-  if (record.kind === "local")
-    return { kind: "local", mode: "auto" };
-  if (record.kind === "remote" && typeof record.baseUrl === "string" && record.baseUrl.trim()) {
-    const baseUrl = record.baseUrl.trim().replace(/\/+$/, "");
-    return { kind: "remote", baseUrl };
-  }
-  return null;
-}
-function readGlobalConnections(options = {}) {
-  const path = resolveGlobalConnectionsPath(options.env ?? process.env);
-  const payload = readJsonFile(path);
-  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
-    return { connections: {} };
-  }
-  const rawConnections = payload.connections;
-  const connections = {};
-  if (rawConnections && typeof rawConnections === "object" && !Array.isArray(rawConnections)) {
-    for (const [alias, raw] of Object.entries(rawConnections)) {
-      const connection = normalizeConnection(raw);
-      if (connection)
-        connections[alias] = connection;
-    }
-  }
-  return { connections };
-}
 function readRepoConnection(projectRoot) {
   const payload = readJsonFile(resolveRepoConnectionPath(projectRoot));
   if (!payload || typeof payload !== "object" || Array.isArray(payload))
@@ -114,256 +109,11 @@ function readRepoConnection(projectRoot) {
     selected,
     project: typeof record.project === "string" ? record.project : undefined,
     linkedAt: typeof record.linkedAt === "string" ? record.linkedAt : undefined,
-    serverProjectRoot: typeof record.serverProjectRoot === "string" && record.serverProjectRoot.trim() ? record.serverProjectRoot.trim() : undefined
+    serverProjectRoot: typeof record.serverProjectRoot === "string" && record.serverProjectRoot.trim() ? record.serverProjectRoot.trim() : undefined,
+    serverProjectRootAlias: typeof record.serverProjectRootAlias === "string" && record.serverProjectRootAlias.trim() ? record.serverProjectRootAlias.trim() : undefined,
+    serverProjectRootBaseUrl: typeof record.serverProjectRootBaseUrl === "string" && record.serverProjectRootBaseUrl.trim() ? record.serverProjectRootBaseUrl.trim().replace(/\/+$/, "") : undefined
   };
 }
-function writeRepoConnection(projectRoot, state) {
-  writeJsonFile(resolveRepoConnectionPath(projectRoot), state);
-}
-function resolveSelectedConnection(projectRoot, options = {}) {
-  const repo = readRepoConnection(projectRoot);
-  if (!repo)
-    return null;
-  if (repo.selected === "local")
-    return { alias: "local", connection: { kind: "local", mode: "auto" }, serverProjectRoot: repo.serverProjectRoot };
-  const global = readGlobalConnections(options);
-  const connection = global.connections[repo.selected];
-  if (!connection) {
-    throw new CliError(`Selected Rig server "${repo.selected}" was not found. Run \`rig server list\` or \`rig server use local\`.`, 1);
-  }
-  return { alias: repo.selected, connection, serverProjectRoot: repo.serverProjectRoot };
-}
-function writeRepoServerProjectRoot(projectRoot, serverProjectRoot) {
-  const repo = readRepoConnection(projectRoot);
-  if (!repo)
-    return;
-  writeRepoConnection(projectRoot, { ...repo, serverProjectRoot });
-}
-
-// packages/cli/src/commands/_server-client.ts
-var scopedGitHubBearerTokens = new Map;
-var serverPhaseListener = null;
-function setServerPhaseListener(listener) {
-  const previous = serverPhaseListener;
-  serverPhaseListener = listener;
-  return previous;
-}
-function reportServerPhase(label) {
-  serverPhaseListener?.(label);
-}
-function cleanToken(value) {
-  const trimmed = value?.trim();
-  return trimmed ? trimmed : null;
-}
-function readPrivateRemoteSessionToken(projectRoot) {
-  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
-  if (!existsSync2(path))
-    return null;
-  try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
-  } catch {
-    return null;
-  }
-}
-function readGitHubBearerTokenForRemote(projectRoot) {
-  const scopedKey = resolve2(projectRoot);
-  if (scopedGitHubBearerTokens.has(scopedKey))
-    return scopedGitHubBearerTokens.get(scopedKey) ?? null;
-  const privateSession = readPrivateRemoteSessionToken(projectRoot);
-  if (privateSession)
-    return privateSession;
-  return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
-}
-function readStoredGitHubAuthToken(projectRoot) {
-  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
-  if (!existsSync2(path))
-    return null;
-  try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return cleanToken(typeof parsed.token === "string" ? parsed.token : undefined);
-  } catch {
-    return null;
-  }
-}
-function readLocalConnectionFallbackToken(projectRoot) {
-  return readGitHubBearerTokenForRemote(projectRoot) ?? cleanToken(process.env.RIG_GITHUB_TOKEN) ?? readStoredGitHubAuthToken(projectRoot);
-}
-async function ensureServerForCli(projectRoot) {
-  try {
-    const selected = resolveSelectedConnection(projectRoot);
-    if (selected?.connection.kind === "remote") {
-      reportServerPhase(`Connecting to ${selected.alias}\u2026`);
-      const authToken = readGitHubBearerTokenForRemote(projectRoot);
-      const serverProjectRoot = selected.serverProjectRoot ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
-      return {
-        baseUrl: selected.connection.baseUrl,
-        authToken,
-        connectionKind: "remote",
-        serverProjectRoot
-      };
-    }
-    reportServerPhase("Starting local Rig server\u2026");
-    const connection = await ensureLocalRigServerConnection(projectRoot);
-    return {
-      baseUrl: connection.baseUrl,
-      authToken: connection.authToken ?? readLocalConnectionFallbackToken(projectRoot),
-      connectionKind: "local",
-      serverProjectRoot: resolve2(projectRoot)
-    };
-  } catch (error) {
-    if (error instanceof Error) {
-      throw new CliError(error.message, 1);
-    }
-    throw error;
-  }
-}
-async function backfillRemoteServerProjectRoot(projectRoot, baseUrl, authToken) {
-  const repo = readRepoConnection(projectRoot);
-  const slug = repo?.project?.trim();
-  if (!slug)
-    return null;
-  try {
-    const response = await fetch(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`, {
-      headers: mergeHeaders(undefined, authToken)
-    });
-    if (!response.ok)
-      return null;
-    const payload = await response.json();
-    const project = payload.project && typeof payload.project === "object" && !Array.isArray(payload.project) ? payload.project : null;
-    const checkouts = Array.isArray(project?.checkouts) ? project.checkouts : [];
-    const latestCheckout = [...checkouts].reverse().find((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry) && typeof entry.path === "string"));
-    const path = typeof latestCheckout?.path === "string" && latestCheckout.path.trim() ? latestCheckout.path.trim() : null;
-    if (path)
-      writeRepoServerProjectRoot(projectRoot, path);
-    return path;
-  } catch {
-    return null;
-  }
-}
-function mergeHeaders(headers, authToken) {
-  const merged = new Headers(headers);
-  if (authToken) {
-    merged.set("authorization", `Bearer ${authToken}`);
-  }
-  return merged;
-}
-function diagnosticMessage(payload) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
-    return null;
-  const record = payload;
-  const diagnostics = Array.isArray(record.diagnostics) ? record.diagnostics : [];
-  const messages = diagnostics.flatMap((entry) => {
-    if (!entry || typeof entry !== "object" || Array.isArray(entry))
-      return [];
-    const diagnostic = entry;
-    const kind = typeof diagnostic.kind === "string" ? diagnostic.kind : "task-source";
-    const message = typeof diagnostic.message === "string" ? diagnostic.message : null;
-    return message ? [`${kind}: ${message}`] : [];
-  });
-  return messages.length > 0 ? messages.join("; ") : null;
-}
-var serverReachabilityCache = new Map;
-async function probeServerReachability(baseUrl, authToken) {
-  try {
-    const response = await fetch(`${baseUrl.replace(/\/+$/, "")}/api/server/status`, {
-      headers: mergeHeaders(undefined, authToken),
-      signal: AbortSignal.timeout(1500)
-    });
-    return response.ok;
-  } catch {
-    return false;
-  }
-}
-function cachedServerReachability(projectRoot, baseUrl, authToken) {
-  const key = resolve2(projectRoot);
-  const cached = serverReachabilityCache.get(key);
-  if (cached)
-    return cached;
-  const probe = probeServerReachability(baseUrl, authToken);
-  serverReachabilityCache.set(key, probe);
-  return probe;
-}
-function describeSelectedServer(projectRoot, server) {
-  try {
-    const selected = resolveSelectedConnection(projectRoot);
-    if (selected) {
-      return {
-        alias: selected.alias,
-        target: selected.connection.kind === "remote" ? selected.connection.baseUrl : server.baseUrl
-      };
-    }
-  } catch {}
-  return { alias: server.connectionKind === "remote" ? "remote" : "local", target: server.baseUrl };
-}
-async function buildServerFailureContext(projectRoot, server) {
-  const { alias, target } = describeSelectedServer(projectRoot, server);
-  const reachable = await cachedServerReachability(projectRoot, server.baseUrl, server.authToken);
-  const reachability = reachable ? "server is reachable" : "server is unreachable";
-  return {
-    contextLine: `Currently connected to: ${alias} at ${target} (${reachability}).`,
-    hint: "Check the selected server with `rig server status`, or switch with `rig server use <alias|local>`."
-  };
-}
-async function requestServerJson(context, pathname, init = {}) {
-  const server = await ensureServerForCli(context.projectRoot);
-  const headers = mergeHeaders(init.headers, server.authToken);
-  if (server.serverProjectRoot)
-    headers.set("x-rig-project-root", server.serverProjectRoot);
-  reportServerPhase(`${(init.method ?? "GET").toUpperCase()} ${pathname.split("?")[0]}\u2026`);
-  let response;
-  try {
-    response = await fetch(`${server.baseUrl}${pathname}`, {
-      ...init,
-      headers
-    });
-  } catch (error) {
-    const failure = await buildServerFailureContext(context.projectRoot, server);
-    throw new CliError(`Rig server request failed: ${error instanceof Error ? error.message : String(error)}
-${failure.contextLine}`, 1, { hint: failure.hint });
-  }
-  const text = await response.text();
-  const payload = text.trim().length > 0 ? (() => {
-    try {
-      return JSON.parse(text);
-    } catch {
-      return null;
-    }
-  })() : null;
-  if (!response.ok) {
-    const diagnostics = diagnosticMessage(payload);
-    const rawDetail = diagnostics ?? (text || response.statusText);
-    const detail = diagnostics ? rawDetail : rawDetail.split(`
-`).map((line) => line.trim()).find((line) => line.length > 0)?.slice(0, 200) ?? response.statusText;
-    const failure = await buildServerFailureContext(context.projectRoot, server);
-    throw new CliError(`Rig server request failed (${response.status}): ${detail}
-${failure.contextLine}`, 1, { hint: failure.hint });
-  }
-  return payload;
-}
-async function getGitHubAuthStatusViaServer(context) {
-  const payload = await requestServerJson(context, "/api/github/auth/status");
-  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
-}
-async function postGitHubTokenViaServer(context, token, options = {}) {
-  const payload = await requestServerJson(context, "/api/github/auth/token", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ token, selectedRepo: options.selectedRepo, projectRoot: options.projectRoot })
-  });
-  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
-}
-var RESUMABLE_RUN_STATUSES = new Set([
-  "created",
-  "preparing",
-  "running",
-  "validating",
-  "reviewing",
-  "stopped",
-  "failed",
-  "needs-attention",
-  "needs_attention"
-]);
 
 // packages/cli/src/commands/_async-ui.ts
 import pc from "picocolors";
@@ -399,7 +149,7 @@ function createTtySpinner(input) {
       output.write("\r\x1B[2K");
   };
   render();
-  const timer = isTty ? setInterval(render, input.intervalMs ?? 120) : null;
+  const timer = isTty ? setInterval(render, input.intervalMs ?? 16) : null;
   return {
     setLabel(next) {
       label = next;
@@ -429,90 +179,20 @@ function createTtySpinner(input) {
   };
 }
 
-// packages/cli/src/app/theme.ts
-var RIG_PALETTE = {
-  ink: "#f2f3f6",
-  ink2: "#aeb0ba",
-  ink3: "#6c6e79",
-  ink4: "#44464f",
-  accent: "#ccff4d",
-  accentDim: "#a9d63f",
-  cyan: "#56d8ff",
-  red: "#ff5d5d",
-  yellow: "#ffd24d"
-};
-function hexToRgb(hex) {
-  const value = hex.replace("#", "");
-  return [
-    Number.parseInt(value.slice(0, 2), 16),
-    Number.parseInt(value.slice(2, 4), 16),
-    Number.parseInt(value.slice(4, 6), 16)
-  ];
-}
-function fg(hex) {
-  const [r, g, b] = hexToRgb(hex);
-  return (text) => `\x1B[38;2;${r};${g};${b}m${text}\x1B[39m`;
-}
-var ink = fg(RIG_PALETTE.ink);
-var ink2 = fg(RIG_PALETTE.ink2);
-var ink3 = fg(RIG_PALETTE.ink3);
-var ink4 = fg(RIG_PALETTE.ink4);
-var accent = fg(RIG_PALETTE.accent);
-var accentDim = fg(RIG_PALETTE.accentDim);
-var cyan = fg(RIG_PALETTE.cyan);
-var red = fg(RIG_PALETTE.red);
-var yellow = fg(RIG_PALETTE.yellow);
-function bold(text) {
-  return `\x1B[1m${text}\x1B[22m`;
-}
-var DRONE_ART = [
-  "  .-=-.                   .-=-.   ",
-  " ( !!! )                 ( !!! )  ",
-  "  '-=-'._               _.'-=-'   ",
-  "        '._           _.'         ",
-  "           '=$$$$$$$=.'           ",
-  "          =$$$$$$$$$$$=           ",
-  "         $$$@@@@@@@@@@$$$         ",
-  "        $$$@@        @@$$$        ",
-  "        $$@    ?     @$$$         ",
-  "        $$$@   '-'   @$$$         ",
-  "        $$$@@        @@$$$        ",
-  "         $$$@@@@@@@@@@$$$         ",
-  "          =$$$$$$$$$$$=           ",
-  "           '=$$$$$$$=.'           ",
-  "        _.'           '._         ",
-  "  .-=-.'                 '.-=-.   ",
-  " ( !!! )                 ( !!! )  ",
-  "  '-=-'                   '-=-'   "
-];
-var EYE_FRAMES = ["@", "o", "."];
-var DRONE_WIDTH = DRONE_ART[0].length;
-var DRONE_HEIGHT = DRONE_ART.length;
-var MICRO_BLADES = ["---", "\\\\\\", "|||", "///"];
-function microDroneFrame(tick) {
-  const blade = MICRO_BLADES[tick % MICRO_BLADES.length];
-  const eye = EYE_FRAMES[Math.floor(tick / 2) % EYE_FRAMES.length];
-  return `(${blade})${eye}(${blade})`;
-}
-var MICRO_DRONE_FRAMES = Array.from({ length: 12 }, (_, index) => microDroneFrame(index));
-function renderMicroDroneFrame(tick) {
-  const blade = MICRO_BLADES[tick % MICRO_BLADES.length];
-  const eye = EYE_FRAMES[Math.floor(tick / 2) % EYE_FRAMES.length];
-  return `${ink4("(")}${cyan(blade)}${ink4(")")}${bold(accent(eye))}${ink4("(")}${cyan(blade)}${ink4(")")}`;
-}
-
 // packages/cli/src/commands/_async-ui.ts
+var FRAMES = ["\u25D0", "\u25D3", "\u25D1", "\u25D2"];
 var DONE_SYMBOL = pc.green("\u25C7");
 var FAIL_SYMBOL = pc.red("\u25A0");
 var activeUpdate = null;
 async function withSpinner(label, work, options = {}) {
   if (options.outputMode === "json") {
-    return work(() => {});
+    return work(() => {
+      return;
+    });
   }
   if (activeUpdate) {
-    const outer = activeUpdate;
-    outer(label);
-    return work(outer);
+    activeUpdate(label);
+    return work(activeUpdate);
   }
   const output = options.output ?? process.stderr;
   const isTty = output.isTTY === true;
@@ -524,26 +204,23 @@ async function withSpinner(label, work, options = {}) {
       lastLabel = next;
     };
     activeUpdate = update2;
-    const previousListener2 = setServerPhaseListener(update2);
     try {
       return await work(update2);
     } finally {
       activeUpdate = null;
-      setServerPhaseListener(previousListener2);
     }
   }
   const spinner = createTtySpinner({
     label,
     output,
-    frames: MICRO_DRONE_FRAMES,
-    styleFrame: (frame) => renderMicroDroneFrame(Math.max(0, MICRO_DRONE_FRAMES.indexOf(frame)))
+    frames: FRAMES,
+    styleFrame: (frame) => pc.cyan(frame)
   });
   const update = (next) => {
     lastLabel = next;
     spinner.setLabel(next);
   };
   activeUpdate = update;
-  const previousListener = setServerPhaseListener(update);
   try {
     const result = await work(update);
     spinner.stop(options.doneLabel ? `${DONE_SYMBOL} ${options.doneLabel}` : undefined);
@@ -553,7 +230,6 @@ async function withSpinner(label, work, options = {}) {
     throw error;
   } finally {
     activeUpdate = null;
-    setServerPhaseListener(previousListener);
   }
 }
 
@@ -564,6 +240,52 @@ function printPayload(context, payload, fallback) {
   else
     console.log(fallback);
 }
+function apiSessionTokenFrom(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return null;
+  return payloadString(payload, "apiSessionToken");
+}
+function payloadString(payload, key) {
+  const value = Reflect.get(payload, key);
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function payloadRecord(payload, key) {
+  const value = Reflect.get(payload, key);
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function remoteNamespaceMetadata(result) {
+  const namespace = payloadRecord(result, "userNamespace");
+  return {
+    ...payloadString(result, "login") ? { login: payloadString(result, "login") } : {},
+    ...payloadString(result, "userId") ? { userId: payloadString(result, "userId") } : {},
+    ...namespace && payloadString(namespace, "key") ? { userNamespaceKey: payloadString(namespace, "key") } : {},
+    ...namespace && payloadString(namespace, "root") ? { userNamespaceRoot: payloadString(namespace, "root") } : {},
+    ...namespace && payloadString(namespace, "checkoutBaseDir") ? { checkoutBaseDir: payloadString(namespace, "checkoutBaseDir") } : {},
+    ...namespace && payloadString(namespace, "snapshotBaseDir") ? { snapshotBaseDir: payloadString(namespace, "snapshotBaseDir") } : {}
+  };
+}
+function persistRemoteAuthSession(context, source, result, fallbackToken) {
+  const apiSessionToken = result.apiSessionToken || apiSessionTokenFrom(result);
+  setGitHubBearerTokenForCurrentProcess(apiSessionToken ?? fallbackToken, context.projectRoot);
+  if (!apiSessionToken)
+    return;
+  const repo = readRepoConnection(context.projectRoot);
+  const path = resolve3(context.projectRoot, ".rig", "state", "github-auth.json");
+  mkdirSync2(dirname2(path), { recursive: true });
+  writeFileSync2(path, `${JSON.stringify({
+    authenticated: true,
+    source,
+    storedOnServer: true,
+    ...repo?.project ? { selectedRepo: repo.project } : {},
+    ...remoteNamespaceMetadata(result),
+    apiSessionToken,
+    updatedAt: new Date().toISOString()
+  }, null, 2)}
+`, "utf8");
+}
+function isSignedIn(status) {
+  return status.signedIn === true;
+}
 function readGhToken() {
   const result = spawnSync("gh", ["auth", "token"], { encoding: "utf8" });
   if (result.status !== 0) {
@@ -584,8 +306,8 @@ async function executeGithub(context, args) {
     case "status": {
       if (rest.length > 0)
         throw new CliError("Usage: rig github auth status", 1);
-      const status = await withSpinner("Checking GitHub auth on the server\u2026", () => getGitHubAuthStatusViaServer(context), { outputMode: context.outputMode });
-      printPayload(context, status, `GitHub auth: ${status.authenticated ? "authenticated" : "unauthenticated"}`);
+      const status = await withSpinner("Checking GitHub auth on the server\u2026", () => getGitHubAuthStatusInProcess(context), { outputMode: context.outputMode });
+      printPayload(context, status, `GitHub auth: ${isSignedIn(status) ? "authenticated" : "unauthenticated"}`);
       return { ok: true, group: "github", command: "auth status", details: status };
     }
     case "token": {
@@ -595,16 +317,20 @@ async function executeGithub(context, args) {
       const token = parsed.value?.trim();
       if (!token)
         throw new CliError("Missing --token value.", 1, { hint: "Re-run as `rig github auth token --token <token>`." });
-      const result = await withSpinner("Storing GitHub token on the server\u2026", () => postGitHubTokenViaServer(context, token), { outputMode: context.outputMode });
-      printPayload(context, result, "GitHub token stored on the selected Rig server.");
+      const repo = readRepoConnection(context.projectRoot);
+      const result = await withSpinner("Storing GitHub token on the server\u2026", () => postGitHubTokenInProcess(context, token, repo?.project ? { selectedRepo: repo.project } : {}), { outputMode: context.outputMode });
+      persistRemoteAuthSession(context, "token", result, token);
+      printPayload(context, result, "GitHub token stored on the selected server.");
       return { ok: true, group: "github", command: "auth token", details: result };
     }
     case "import-gh": {
       if (rest.length > 0)
         throw new CliError("Usage: rig github auth import-gh", 1);
       const importedToken = readGhToken();
-      const result = await withSpinner("Storing GitHub token on the server\u2026", () => postGitHubTokenViaServer(context, importedToken), { outputMode: context.outputMode });
-      printPayload(context, result, "GitHub token imported from gh and stored on the selected Rig server.");
+      const repo = readRepoConnection(context.projectRoot);
+      const result = await withSpinner("Storing GitHub token on the server\u2026", () => postGitHubTokenInProcess(context, importedToken, repo?.project ? { selectedRepo: repo.project } : {}), { outputMode: context.outputMode });
+      persistRemoteAuthSession(context, "gh", result, importedToken);
+      printPayload(context, result, "GitHub token imported from gh and stored on the selected server.");
       return { ok: true, group: "github", command: "auth import-gh", details: result };
     }
     default:

package/dist/src/commands/inbox.d.ts

@@ -1,30 +1,28 @@
 import { type RunnerContext } from "../runner";
-import type { CommandOutcome } from "@rig/runtime/control-plane/runtime/types";
+import type { CommandOutcome } from "@rig/runtime";
+import { type RunProjectionRecord } from "./_run-projection";
 export type InboxKind = "approvals" | "inputs";
-export type InboxRecord = {
-    runId?: string;
-    taskId?: string | null;
-    requestId?: string | null;
-    status?: string | null;
-    record?: Record<string, unknown>;
-};
-/** Exported for the board's inbox view — same records `rig inbox` renders. */
-export declare function listInboxRecords(context: Pick<RunnerContext, "projectRoot">, kind: InboxKind, filters: {
-    run?: string;
-    task?: string;
-    pendingOnly?: boolean;
-}): Promise<InboxRecord[]>;
-/**
- * Pending-gate counts for proactive surfacing. Returns null when the server
- * is unreachable — footer callers must never break the primary command.
- */
+export interface InboxFilters {
+    readonly run?: string;
+    readonly task?: string;
+}
+export interface InboxRecord {
+    readonly runId: string;
+    readonly taskId: string | null;
+    readonly requestId: string;
+    readonly status: "pending";
+    readonly prompt: string;
+    readonly requestedAt: string;
+    readonly payload: unknown;
+}
+/** Every pending inbox request across discoverable runs, optionally filtered by run/task. */
+export interface InboxDeps {
+    readonly listRuns?: (projectRoot: string) => Promise<RunProjectionRecord[]>;
+}
+export declare function listInboxRecords(context: Pick<RunnerContext, "projectRoot">, kind: InboxKind, filters?: InboxFilters, deps?: InboxDeps): Promise<InboxRecord[]>;
+/** Pending-gate counts for proactive surfacing; null-safe for footer callers. */
 export declare function readPendingInboxCounts(context: Pick<RunnerContext, "projectRoot">): Promise<{
     approvals: number;
     inputs: number;
 } | null>;
-/**
- * One-line warning under task/run command output when human gates are
- * waiting. Silent when there is nothing pending or the server is down.
- */
-export declare function printPendingInboxFooter(context: RunnerContext): Promise<void>;
-export declare function executeInbox(context: RunnerContext, args: string[]): Promise<CommandOutcome>;
+export declare function executeInbox(context: RunnerContext, args: string[], deps?: InboxDeps): Promise<CommandOutcome>;