@h-rig/cli 0.0.6-alpha.90 → 0.0.6-alpha.92

package/dist/src/commands/_pi-install.js

@@ -1,13 +1,9 @@
 // @bun
 // packages/cli/src/commands/_pi-install.ts
-import { existsSync, readFileSync, rmSync } from "fs";
+import { existsSync } from "fs";
 import { homedir } from "os";
 import { resolve } from "path";
 var PI_RIG_PACKAGE_NAME = "@h-rig/pi-rig";
-var LEGACY_PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
-var LEGACY_PI_RIG_MARKER = `// Managed by Rig. Source package: @rig/pi-rig.
-export { default } from '@rig/pi-rig';
-`;
 async function defaultCommandRunner(command, options = {}) {
   const proc = Bun.spawn(command, { cwd: options.cwd, stdout: "pipe", stderr: "pipe" });
   const [stdout, stderr, exitCode] = await Promise.all([
@@ -32,7 +28,7 @@ function resolvePiHomeDir(inputHomeDir) {
 function piListContainsPiRig(output) {
   return output.split(/\r?\n/).some((line) => {
     const normalized = line.trim();
-    return normalized.includes(PI_RIG_PACKAGE_NAME) || normalized.includes(LEGACY_PI_RIG_PACKAGE_NAME) || /(?:^|[\\/])packages[\\/]pi-rig(?:$|\s)/.test(normalized);
+    return normalized.includes(PI_RIG_PACKAGE_NAME) || /(?:^|[\\/])packages[\\/]pi-rig(?:$|\s)/.test(normalized);
   });
 }
 async function safeRun(runner, command, options) {
@@ -56,7 +52,13 @@ async function ensurePiBinaryAvailable(input) {
     }
     return { ok: true, detail: (current.stdout || current.stderr).trim() || undefined };
   }
-  const installCommand = process.env.RIG_PI_INSTALL_COMMAND?.trim() || "bunx @earendil-works/pi-coding-agent@latest install";
+  const installCommand = process.env.RIG_PI_INSTALL_COMMAND?.trim();
+  if (!installCommand) {
+    return {
+      ok: false,
+      error: `${(current.stderr || current.stdout).trim() || "pi --version failed"}. Set RIG_PI_INSTALL_COMMAND to a supported installer or install Pi manually.`
+    };
+  }
   const parts = splitInstallCommand(installCommand);
   if (parts.length === 0) {
     return { ok: false, error: (current.stderr || current.stdout).trim() || "pi --version failed" };
@@ -73,18 +75,6 @@ async function ensurePiBinaryAvailable(input) {
     ...next.exitCode === 0 ? {} : { error: (next.stderr || next.stdout).trim() || "pi --version failed after install" }
   };
 }
-function removeManagedLegacyPiRigBridge(homeDir, exists = existsSync) {
-  const extensionPath = resolvePiRigExtensionPath(homeDir);
-  const indexPath = resolve(extensionPath, "index.ts");
-  if (!exists(indexPath))
-    return;
-  try {
-    const content = readFileSync(indexPath, "utf8");
-    if (content === LEGACY_PI_RIG_MARKER || content.includes("Managed by Rig. Source package: @rig/pi-rig")) {
-      rmSync(extensionPath, { recursive: true, force: true });
-    }
-  } catch {}
-}
 async function checkPiRigInstall(input = {}) {
   const home = resolvePiHomeDir(input.homeDir);
   const extensionPath = resolvePiRigExtensionPath(home);
@@ -95,48 +85,40 @@ async function checkPiRigInstall(input = {}) {
       piRig: { ok: true, label: "pi-rig global extension", detail: extensionPath }
     };
   }
-  const exists = input.exists ?? existsSync;
   const runner = input.commandRunner ?? defaultCommandRunner;
   const piResult = await safeRun(runner, ["pi", "--version"]);
   const piListResult = piResult.exitCode === 0 ? await safeRun(runner, ["pi", "list"]) : { exitCode: 1, stdout: "", stderr: "" };
-  const listedPiRig = piListResult.exitCode === 0 && piListContainsPiRig(`${piListResult.stdout}
+  const hasPiRig = piListResult.exitCode === 0 && piListContainsPiRig(`${piListResult.stdout}
 ${piListResult.stderr}`);
-  const legacyBridge = exists(resolve(extensionPath, "index.ts"));
-  const hasPiRig = listedPiRig;
+  const hasLegacyBridgeScaffold = !hasPiRig && (input.exists ?? existsSync)(extensionPath);
   return {
     extensionPath,
     pi: {
       ok: piResult.exitCode === 0,
       label: "pi",
       detail: (piResult.stdout || piResult.stderr).trim() || undefined,
-      hint: piResult.exitCode === 0 ? undefined : "Install Pi or run `rig init --yes` to install/update the Pi runtime."
+      hint: piResult.exitCode === 0 ? undefined : "Install Pi/OMP manually or set RIG_PI_INSTALL_COMMAND before verifying with bare `rig` / Cockpit \u2192 Doctor."
     },
     piRig: {
       ok: hasPiRig,
       label: "pi-rig global extension",
-      detail: hasPiRig ? piListResult.stdout.trim() || PI_RIG_PACKAGE_NAME : legacyBridge ? `${extensionPath} (legacy bridge; reinstall required)` : undefined,
-      hint: hasPiRig ? undefined : "Run `rig init --yes` to install/enable the global pi-rig package with `pi install`."
+      detail: hasPiRig ? piListResult.stdout.trim() || PI_RIG_PACKAGE_NAME : hasLegacyBridgeScaffold ? `legacy bridge scaffold at ${extensionPath}` : undefined,
+      hint: hasPiRig ? undefined : `Install the Rig OMP extension with \`pi install ${PI_RIG_PACKAGE_NAME}\`, then verify with bare \`rig\` / Cockpit \u2192 Doctor.`
     }
   };
 }
 async function ensurePiRigInstalled(input) {
   const home = resolvePiHomeDir(input.homeDir);
   if (process.env.RIG_TEST_FAKE_PI_INSTALL === "1") {
-    const status2 = await checkPiRigInstall({ homeDir: home, commandRunner: input.commandRunner });
-    return { ...status2, installedPath: status2.extensionPath };
+    const status = await checkPiRigInstall({ homeDir: home, commandRunner: input.commandRunner });
+    return { ...status, installedPath: status.extensionPath };
   }
   const runner = input.commandRunner ?? defaultCommandRunner;
   const piAvailable = await ensurePiBinaryAvailable({ runner, projectRoot: input.projectRoot });
-  const status = piAvailable.ok ? await checkPiRigInstall({ homeDir: home, commandRunner: runner }) : {
-    extensionPath: resolvePiRigExtensionPath(home),
-    pi: { ok: false, label: "pi", detail: piAvailable.error, hint: "Install/update Pi with RIG_PI_INSTALL_COMMAND or install Pi manually." },
-    piRig: { ok: false, label: "pi-rig global extension", hint: "Pi is required before pi-rig can be installed." }
-  };
   if (!piAvailable.ok) {
     throw new Error(`Pi install/update failed: ${piAvailable.error ?? "pi unavailable"}`);
   }
   const packageSource = resolvePiRigPackageSource(input.projectRoot);
-  removeManagedLegacyPiRigBridge(home);
   const install = await runner(["pi", "install", packageSource], { cwd: input.projectRoot });
   if (install.exitCode !== 0) {
     throw new Error(`pi-rig install failed: ${(install.stderr || install.stdout).trim() || `exit ${install.exitCode}`}`);
@@ -161,13 +143,13 @@ async function ensureRemotePiRigInstalled(input) {
       ok: piOk,
       label: "pi",
       detail: typeof record.piVersion === "string" ? record.piVersion : undefined,
-      hint: piOk ? undefined : "Install/update Pi on the selected remote Rig server."
+      hint: piOk ? undefined : "Install/update Pi on the selected remote control host, then verify with bare `rig` / Cockpit \u2192 Doctor."
     },
     piRig: {
       ok: piRigOk,
       label: "pi-rig global extension",
       detail: extensionPath,
-      hint: piRigOk ? undefined : "Install/enable pi-rig on the selected remote Rig server."
+      hint: piRigOk ? undefined : `Install/enable the Rig OMP extension (${PI_RIG_PACKAGE_NAME}) on the selected remote control host, then verify with bare \`rig\` / Cockpit \u2192 Doctor.`
     }
   };
 }

package/dist/src/commands/_policy.d.ts

@@ -1,5 +1,5 @@
 import { type RunnerContext } from "../runner";
-import type { PolicyMode } from "@rig/runtime/control-plane/runtime/guard-types";
+export type PolicyMode = "off" | "observe" | "enforce";
 export declare function resolveEffectivePolicyMode(context: RunnerContext): PolicyMode;
 export declare function appendControlledBashAudit(context: RunnerContext, mode: PolicyMode, command: string, args: string[], matchedRuleIds: string[], action?: "warn" | "blocked"): void;
 export declare function enforceNativeCommandPolicy(context: RunnerContext, args: string[], options: {

package/dist/src/commands/_policy.js

@@ -1,7 +1,7 @@
 // @bun
 // packages/cli/src/commands/_policy.ts
-import { appendFileSync, mkdirSync } from "fs";
-import { resolve } from "path";
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from "fs";
+import { resolve as resolve2 } from "path";
 
 // packages/cli/src/runner.ts
 import { EventBus } from "@rig/runtime/control-plane/runtime/events";
@@ -22,22 +22,64 @@ function formatCommand(parts) {
   return parts.map((part) => /[^a-zA-Z0-9_./:-]/.test(part) ? JSON.stringify(part) : part).join(" ");
 }
 
+// packages/cli/src/commands/_paths.ts
+import { resolve } from "path";
+import { resolveMonorepoRoot } from "@rig/runtime/layout";
+function resolveControlPlaneHostStateRoot(projectRoot) {
+  return resolve(projectRoot, ".rig");
+}
+function resolveControlPlaneHostLogsDir(projectRoot) {
+  return resolve(resolveControlPlaneHostStateRoot(projectRoot), "logs");
+}
+function resolveControlPlaneDefinitionRoot(projectRoot) {
+  return resolve(projectRoot, "rig");
+}
+
 // packages/cli/src/commands/_policy.ts
-import { evaluate as evaluate2, loadPolicy as loadPolicy2, resolveAction as resolveAction2 } from "@rig/runtime/control-plane/runtime/guard";
-import { resolveHarnessPaths } from "@rig/runtime/control-plane/native/utils";
+function loadPolicyFile(projectRoot) {
+  const policyPath = resolve2(resolveControlPlaneDefinitionRoot(projectRoot), "policy", "policy.json");
+  if (!existsSync(policyPath)) {
+    return { mode: "observe", rules: [] };
+  }
+  try {
+    const parsed = JSON.parse(readFileSync(policyPath, "utf8"));
+    const mode = parsed.mode === "off" || parsed.mode === "observe" || parsed.mode === "enforce" ? parsed.mode : "observe";
+    const rules = Array.isArray(parsed.rules) ? parsed.rules.filter((value) => Boolean(value && typeof value === "object" && !Array.isArray(value))).map((value, index) => ({
+      id: typeof value.id === "string" && value.id.trim() ? value.id.trim() : `rule-${index + 1}`,
+      reason: typeof value.reason === "string" && value.reason.trim() ? value.reason.trim() : undefined,
+      match: typeof value.match === "string" && value.match.trim() ? value.match.trim() : undefined,
+      command: typeof value.command === "string" && value.command.trim() ? value.command.trim() : undefined
+    })) : [];
+    return { mode, rules };
+  } catch {
+    return { mode: "observe", rules: [] };
+  }
+}
+function matchingRules(command, rules) {
+  return rules.filter((rule) => {
+    const rawPattern = rule.command ?? rule.match;
+    if (!rawPattern)
+      return false;
+    try {
+      return new RegExp(rawPattern, "i").test(command);
+    } catch {
+      return command.includes(rawPattern);
+    }
+  });
+}
 function resolveEffectivePolicyMode(context) {
   const envMode = process.env.RIG_BASH_MODE;
   if (envMode === "off" || envMode === "observe" || envMode === "enforce") {
     return envMode;
   }
-  return context.policyMode || loadPolicy2(context.projectRoot).mode;
+  return context.policyMode ?? loadPolicyFile(context.projectRoot).mode;
 }
 function appendControlledBashAudit(context, mode, command, args, matchedRuleIds, action) {
   if (mode === "off") {
     return;
   }
-  const logsDir = resolveHarnessPaths(context.projectRoot).logsDir;
-  const logFile = resolve(logsDir, "controlled-bash.jsonl");
+  const logsDir = resolveControlPlaneHostLogsDir(context.projectRoot);
+  const logFile = resolve2(logsDir, "controlled-bash.jsonl");
   mkdirSync(logsDir, { recursive: true });
   const payload = {
     timestamp: new Date().toISOString(),
@@ -58,25 +100,24 @@ function appendControlledBashAudit(context, mode, command, args, matchedRuleIds,
 async function enforceNativeCommandPolicy(context, args, options) {
   const mode = resolveEffectivePolicyMode(context);
   const command = formatCommand([options.commandPrefix, ...args]);
-  const decision = evaluate2({
-    projectRoot: context.projectRoot,
-    evaluation: { type: "command", command }
-  });
-  const action = resolveAction2(mode, decision.matchedRules);
-  const matchedRuleIds = decision.matchedRules.map((rule) => rule.id);
+  const rules = matchingRules(command, loadPolicyFile(context.projectRoot).rules);
+  const matchedRuleIds = rules.map((rule) => rule.id);
+  const action = rules.length === 0 ? "allow" : mode === "enforce" ? "block" : "warn";
   await context.emitEvent("policy.decision", {
     target: "command",
     command,
     mode,
     allowed: action !== "block",
     matchedRuleIds,
-    reasons: decision.matchedRules.map((rule) => rule.reason)
+    reasons: rules.map((rule) => rule.reason).filter(Boolean)
   });
   if (options.writeAuditLog) {
     appendControlledBashAudit(context, mode, command, args, matchedRuleIds, action === "block" ? "blocked" : action === "warn" ? "warn" : undefined);
   }
   if (action === "block") {
-    throw new CliError(`Policy blocked command: ${command}`, 126, { hint: "Review rig/policy/policy.json, or re-run with `--policy-mode observe` to log instead of block." });
+    throw new CliError(`Policy blocked command: ${command}`, 126, {
+      hint: "Review rig/policy/policy.json, or re-run with `--policy-mode observe` to log instead of block."
+    });
   }
 }
 export {

package/dist/src/commands/_run-bridge.d.ts

@@ -0,0 +1,114 @@
+import type { ChildProcess, SpawnOptions } from "node:child_process";
+import { type RegisteredTaskSource } from "@rig/contracts";
+import { type CollabRegistryFilter, type LiveCollabProjection } from "@oh-my-pi/pi-coding-agent/collab/api";
+export type RigExtensionTask = {
+    readonly id: string;
+    readonly title?: string | null;
+    readonly status?: string | null;
+    readonly source?: string | null;
+    readonly url?: string | null;
+    readonly body?: string | null;
+};
+export type RigExtensionServerState = {
+    readonly alias: string;
+    readonly kind: "local" | "remote";
+    readonly baseUrl?: string | null;
+    readonly projectRoot?: string | null;
+    readonly status?: string | null;
+    readonly taskSource?: string | null;
+};
+export type RigExtensionAttachResult = {
+    readonly sessionPath?: string | null;
+    readonly joinLink?: string | null;
+    readonly collabSessionId?: string | null;
+};
+export type RunRunProcessInput = {
+    readonly projectRoot?: string;
+    readonly taskId: string;
+    readonly runId?: string;
+    readonly title?: string | null;
+    readonly model?: string | null;
+    readonly prompt?: string | null;
+    readonly rigRunBin?: string;
+    readonly writeStdout?: (text: string) => void;
+};
+export type RunRunProcessResult = {
+    readonly runId: string;
+    readonly pid: number;
+    readonly sessionName: string;
+    readonly runtime: unknown;
+};
+export type RunRunProcess = (input: RunRunProcessInput) => Promise<RunRunProcessResult>;
+type SpawnFunction = (command: string, args: readonly string[], options: SpawnOptions) => ChildProcess;
+type ListTasksDeps = {
+    readonly loadTaskSource?: (projectRoot: string) => Promise<{
+        readonly kind: string;
+        readonly source: RegisteredTaskSource;
+    }>;
+};
+type SpawnRunProcessDeps = {
+    readonly runRunProcess?: RunRunProcess;
+    readonly spawn?: SpawnFunction;
+    readonly uuid?: () => string;
+    readonly resolveRigRunBin?: () => string;
+    readonly env?: NodeJS.ProcessEnv;
+};
+type AttachViaRelayDeps = {
+    readonly listActiveCollabSessions?: (filter: CollabRegistryFilter) => Promise<readonly LiveCollabProjection[]>;
+    readonly sleep?: (ms: number) => Promise<void>;
+    readonly now?: () => number;
+};
+export type SpawnRunProcessInput = {
+    readonly projectRoot: string;
+    readonly taskId: string;
+    readonly title?: string | null;
+};
+export type AttachViaRelayInput = {
+    readonly runId: string;
+    readonly taskId?: string | null;
+    readonly identityFilter: CollabRegistryFilter;
+    readonly timeoutMs?: number;
+    readonly pollIntervalMs?: number;
+};
+export declare function listTasksFromSource(projectRoot: string, deps?: ListTasksDeps): Promise<readonly RigExtensionTask[]>;
+export declare function getTaskFromSource(projectRoot: string, taskId: string, deps?: ListTasksDeps): Promise<RigExtensionTask | null>;
+export declare function readSelectedTarget(projectRoot: string, env?: NodeJS.ProcessEnv): Promise<RigExtensionServerState>;
+export declare function resolveRigRunBin(): string;
+export declare function spawnRunProcess(input: SpawnRunProcessInput, deps?: SpawnRunProcessDeps): Promise<{
+    readonly runId: string;
+}>;
+export type RunControl = {
+    readonly kind: "steer";
+    readonly message: string;
+} | {
+    readonly kind: "stop";
+    readonly reason: string;
+};
+export interface DeliverRemoteControlDeps {
+    readonly env?: NodeJS.ProcessEnv;
+    readonly spawn?: SpawnFunction;
+}
+interface RemoteControlContext {
+    readonly checkout?: string | null;
+    readonly registryBaseUrl?: string | null;
+    readonly namespaceKey?: string | null;
+}
+/**
+ * Build the remote shell command that re-runs the operator's control VERB on the
+ * remote host. The run is LOCAL there (its session journal lives on the remote
+ * disk), so `rig run steer/stop <runId>` resolves it locally and the remote
+ * worker's own localRunChanges consumer applies it — fully symmetric with local
+ * placement. We SSH the verb (not a pre-built sentinel) so the remote rebuilds via
+ * its canonical stop path. Identity is passed inline (SSH does not forward local
+ * env); the registry HMAC secret is read from the remote env, never sent over argv.
+ */
+export declare function buildRemoteControlCommand(runId: string, control: RunControl, ctx: RemoteControlContext): string;
+/**
+ * Deliver a steer/stop control to a REMOTE run by running the verb on the remote
+ * host over SSH (login shell, identical to spawnRunProcess). Awaits the remote
+ * exit code so the operator gets an honest success/failure — not fire-and-forget.
+ */
+export declare function deliverRemoteRunControl(projectRoot: string, runId: string, control: RunControl, deps?: DeliverRemoteControlDeps): Promise<void>;
+export declare function listActiveRunCollab(filter: CollabRegistryFilter): Promise<readonly LiveCollabProjection[]>;
+export declare function attachViaRelay(input: AttachViaRelayInput, deps?: AttachViaRelayDeps): Promise<RigExtensionAttachResult | null>;
+export {};