@h-rig/cli 0.0.6-alpha.90 → 0.0.6-alpha.92

package/dist/src/commands/inspect.js

@@ -1,7 +1,12 @@
 // @bun
 // packages/cli/src/commands/inspect.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { resolve as resolve3 } from "path";
+import { RIG_RUN_LOG_ENTRY } from "@rig/contracts";
+import {
+  changedFilesForTask,
+  taskArtifactRead,
+  taskArtifacts,
+  taskDeps
+} from "@rig/runtime/control-plane/native/task-ops";
 
 // packages/cli/src/runner.ts
 import { EventBus } from "@rig/runtime/control-plane/runtime/events";
@@ -52,675 +57,704 @@ Usage: ${usage}`);
   return taskId;
 }
 
-// packages/cli/src/commands/inspect.ts
-import {
-  listAuthorityRuns,
-  readAuthorityRun,
-  resolveAuthorityRunDir,
-  resolveTaskArtifactDirs
-} from "@rig/runtime/control-plane/authority-files";
-import { changedFilesForTask } from "@rig/runtime/control-plane/native/task-ops";
-import { resolveHarnessPaths, resolveMonorepoRoot, runCapture } from "@rig/runtime/control-plane/native/utils";
-import { readTaskArtifactPreview } from "@rig/runtime/control-plane/native/workspace-ops";
-
-// packages/cli/src/commands/_server-client.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { resolve as resolve2 } from "path";
-import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
-
-// packages/cli/src/commands/_connection-state.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { dirname, resolve } from "path";
-function resolveGlobalConnectionsPath(env = process.env) {
-  const explicit = env.RIG_CONNECTIONS_FILE?.trim();
-  if (explicit)
-    return resolve(explicit);
-  const stateDir = env.RIG_GLOBAL_STATE_DIR?.trim();
-  if (stateDir)
-    return resolve(stateDir, "connections.json");
-  return resolve(homedir(), ".rig", "connections.json");
-}
-function resolveRepoConnectionPath(projectRoot) {
-  return resolve(projectRoot, ".rig", "state", "connection.json");
-}
-function readJsonFile(path) {
-  if (!existsSync(path))
-    return null;
-  try {
-    return JSON.parse(readFileSync(path, "utf8"));
-  } catch (error) {
-    throw new CliError(`Invalid Rig connection state at ${path}: ${error instanceof Error ? error.message : String(error)}`, 1, { hint: "Fix or delete that file, then re-select a server with `rig server use <alias|local>`." });
+// packages/cli/src/commands/_cli-format.ts
+import pc from "picocolors";
+var dim = pc.dim;
+var faintBar = pc.dim("\u2502");
+var accent = pc.cyan;
+function truncate(value, width) {
+  return value.length <= width ? value : `${value.slice(0, Math.max(0, width - 1))}\u2026`;
+}
+function pad(value, width) {
+  return value.length >= width ? value : `${value}${" ".repeat(width - value.length)}`;
+}
+function statusColor(status) {
+  const normalized = status.trim().toLowerCase();
+  if (["done", "completed", "ready", "healthy", "open", "approved"].includes(normalized))
+    return pc.green;
+  if (["failed", "error", "blocked", "rejected", "stopped"].includes(normalized))
+    return pc.red;
+  if (["running", "in_progress", "in-progress", "active", "booting"].includes(normalized))
+    return pc.cyan;
+  if (["pending", "queued", "created", "local"].includes(normalized))
+    return pc.yellow;
+  return pc.dim;
+}
+function firstString(record, keys, fallback = "") {
+  for (const key of keys) {
+    const value = record[key];
+    if (typeof value === "string" && value.trim())
+      return value;
   }
+  return fallback;
 }
-function writeJsonFile(path, value) {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(value, null, 2)}
-`, "utf8");
+function runIdOf(run) {
+  return firstString(run, ["runId", "id"], "(unknown-run)");
 }
-function normalizeConnection(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    return null;
-  const record = value;
-  if (record.kind === "local")
-    return { kind: "local", mode: "auto" };
-  if (record.kind === "remote" && typeof record.baseUrl === "string" && record.baseUrl.trim()) {
-    const baseUrl = record.baseUrl.trim().replace(/\/+$/, "");
-    return { kind: "remote", baseUrl };
-  }
-  return null;
+function taskIdOf(run) {
+  return firstString(run, ["taskId", "task", "task_id"]);
 }
-function readGlobalConnections(options = {}) {
-  const path = resolveGlobalConnectionsPath(options.env ?? process.env);
-  const payload = readJsonFile(path);
-  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
-    return { connections: {} };
-  }
-  const rawConnections = payload.connections;
-  const connections = {};
-  if (rawConnections && typeof rawConnections === "object" && !Array.isArray(rawConnections)) {
-    for (const [alias, raw] of Object.entries(rawConnections)) {
-      const connection = normalizeConnection(raw);
-      if (connection)
-        connections[alias] = connection;
-    }
+function runTitleOf(run) {
+  return firstString(run, ["title", "summary", "name"], taskIdOf(run) || "(untitled)");
+}
+function printFormattedOutput(message) {
+  console.log(message);
+}
+function formatSection(title, subtitle) {
+  return `${pc.bold(accent("\u25C6"))} ${pc.bold(title)}${subtitle ? dim(` \u2014 ${subtitle}`) : ""}`;
+}
+function formatLegacyAutomationSurface() {
+  return [];
+}
+function formatRunList(runs, options = {}) {
+  if (runs.length === 0) {
+    return [
+      formatSection("Runs", "none recorded"),
+      options.source === "server" ? dim("No runs recorded on the selected server.") : dim("No runs recorded in local state."),
+      "",
+      ...formatLegacyAutomationSurface()
+    ].join(`
+`);
   }
-  return { connections };
+  const body = runs.map((run) => {
+    const row = run;
+    const runId = runIdOf(row);
+    const status = firstString(row, ["status"], "unknown");
+    const runtime = firstString(row, ["runtime", "runtimeAdapter"], "");
+    return [
+      pc.bold(runId),
+      statusColor(status)(pad(truncate(status, 12), 12)),
+      `${runTitleOf(row)}${runtime ? dim(`  ${runtime}`) : ""}`
+    ].join("  ");
+  });
+  return [formatSection("Runs", options.source === "server" ? "selected server" : "local state"), ...body, "", ...formatLegacyAutomationSurface()].join(`
+`);
 }
-function readRepoConnection(projectRoot) {
-  const payload = readJsonFile(resolveRepoConnectionPath(projectRoot));
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
-    return null;
-  const record = payload;
-  const selected = typeof record.selected === "string" ? record.selected.trim() : "";
-  if (!selected)
-    return null;
+
+// packages/cli/src/commands/_run-projection.ts
+import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve2 } from "path";
+import {
+  foldRunSessionEntries,
+  sessionIdFromSessionFile as sessionIdFromSessionFile2
+} from "@rig/contracts";
+import { listAgentRuntimes as listAgentRuntimes2 } from "@rig/runtime/control-plane/runtime/isolation";
+
+// packages/cli/src/commands/_run-bridge.ts
+import { existsSync, readdirSync, readFileSync } from "fs";
+import { dirname, resolve } from "path";
+import { CUSTOM_TYPE_FOR, sessionIdFromSessionFile } from "@rig/contracts";
+import { createPluginHost } from "@rig/core";
+import { loadConfig } from "@rig/core/load-config";
+import { resolveOwnerNamespaceKey, resolveRegistryBaseUrl, resolveRegistrySecret, resolveSelectedRemote } from "@rig/runtime/control-plane/remote";
+import { listAgentRuntimes } from "@rig/runtime/control-plane/runtime/isolation";
+import { createRegistryClient } from "@rig/relay-registry";
+import {
+  listActiveCollabSessions as ompListActiveCollabSessions
+} from "@oh-my-pi/pi-coding-agent/collab/api";
+function registrySecret(env = process.env) {
+  return resolveRegistrySecret(process.cwd(), env) ?? null;
+}
+function registryBaseUrl(env = process.env) {
+  return resolveRegistryBaseUrl(process.cwd(), env);
+}
+function collabFromRegistryEntry(entry) {
   return {
-    selected,
-    project: typeof record.project === "string" ? record.project : undefined,
-    linkedAt: typeof record.linkedAt === "string" ? record.linkedAt : undefined,
-    serverProjectRoot: typeof record.serverProjectRoot === "string" && record.serverProjectRoot.trim() ? record.serverProjectRoot.trim() : undefined
+    sessionId: entry.roomId,
+    sessionPath: "",
+    cwd: "",
+    title: entry.title,
+    joinLink: entry.joinLink,
+    webLink: entry.webLink,
+    relayUrl: entry.relayUrl,
+    owner: entry.owner,
+    selectedRepo: entry.repo,
+    startedAt: entry.startedAt,
+    updatedAt: entry.heartbeatAt,
+    ...entry.pid === undefined ? {} : { pid: entry.pid },
+    stale: entry.stale
   };
 }
-function writeRepoConnection(projectRoot, state) {
-  writeJsonFile(resolveRepoConnectionPath(projectRoot), state);
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
 }
-function resolveSelectedConnection(projectRoot, options = {}) {
-  const repo = readRepoConnection(projectRoot);
-  if (!repo)
+function readLocalRunCollab(runtime) {
+  if (!runtime.sessionDir || !existsSync(runtime.sessionDir))
+    return null;
+  let files;
+  try {
+    files = readdirSync(runtime.sessionDir).filter((f) => f.endsWith(".jsonl")).sort().reverse();
+  } catch {
     return null;
-  if (repo.selected === "local")
-    return { alias: "local", connection: { kind: "local", mode: "auto" }, serverProjectRoot: repo.serverProjectRoot };
-  const global = readGlobalConnections(options);
-  const connection = global.connections[repo.selected];
-  if (!connection) {
-    throw new CliError(`Selected Rig server "${repo.selected}" was not found. Run \`rig server list\` or \`rig server use local\`.`, 1);
   }
-  return { alias: repo.selected, connection, serverProjectRoot: repo.serverProjectRoot };
+  for (const file of files) {
+    let lines;
+    try {
+      lines = readFileSync(resolve(runtime.sessionDir, file), "utf8").split(`
+`);
+    } catch {
+      continue;
+    }
+    let host = null;
+    for (const line of lines) {
+      if (!line.includes("collab-host-started"))
+        continue;
+      let entry;
+      try {
+        entry = JSON.parse(line);
+      } catch {
+        continue;
+      }
+      if (!isRecord(entry) || entry.customType !== CUSTOM_TYPE_FOR["timeline-entry"] || !isRecord(entry.data))
+        continue;
+      const payload = isRecord(entry.data.payload) ? entry.data.payload : entry.data;
+      if (payload.type !== "collab-host-started")
+        continue;
+      host = {
+        roomId: typeof payload.roomId === "string" ? payload.roomId : undefined,
+        joinLink: typeof payload.joinLink === "string" ? payload.joinLink : undefined,
+        webLink: typeof payload.webLink === "string" ? payload.webLink : undefined,
+        relayUrl: typeof payload.relayUrl === "string" ? payload.relayUrl : undefined,
+        at: typeof entry.data.at === "string" ? entry.data.at : undefined
+      };
+    }
+    if (!host?.joinLink)
+      continue;
+    const at = host.at ?? "";
+    const sessionId = host.roomId ?? sessionIdFromSessionFile(resolve(runtime.sessionDir, file)) ?? runtime.id;
+    return {
+      sessionId,
+      sessionPath: resolve(runtime.sessionDir, file),
+      cwd: runtime.workspaceDir,
+      joinLink: host.joinLink,
+      webLink: host.webLink ?? "",
+      relayUrl: host.relayUrl ?? "",
+      title: runtime.taskId ? `[${runtime.taskId}] Rig run ${sessionId}` : `Rig run ${sessionId}`,
+      startedAt: at,
+      updatedAt: at,
+      stale: false
+    };
+  }
+  return null;
+}
+async function listLocalRunCollabSessions(projectRoot) {
+  let runtimes;
+  try {
+    runtimes = await listAgentRuntimes(projectRoot);
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const runtime of runtimes) {
+    const collab = readLocalRunCollab(runtime);
+    if (collab)
+      out.push(collab);
+  }
+  return out;
+}
+async function listActiveRunCollab(filter) {
+  return defaultListActiveCollabSessions(filter);
 }
-function writeRepoServerProjectRoot(projectRoot, serverProjectRoot) {
-  const repo = readRepoConnection(projectRoot);
-  if (!repo)
-    return;
-  writeRepoConnection(projectRoot, { ...repo, serverProjectRoot });
+async function defaultListActiveCollabSessions(filter) {
+  const projectRoot = process.cwd();
+  const local = await listLocalRunCollabSessions(projectRoot);
+  const namespaceKey = filter.namespaceKey ?? resolveOwnerNamespaceKey(projectRoot);
+  const secret = registrySecret();
+  const remote = namespaceKey && secret ? (await createRegistryClient({ baseUrl: registryBaseUrl(), namespaceKey, secret }).listRoomsByOwner(filter)).map(collabFromRegistryEntry) : await ompListActiveCollabSessions(filter);
+  const seen = new Set(local.map((c) => c.sessionId));
+  return [...local, ...remote.filter((c) => !seen.has(c.sessionId))];
 }
 
-// packages/cli/src/commands/_server-client.ts
-var scopedGitHubBearerTokens = new Map;
-var serverPhaseListener = null;
-function setServerPhaseListener(listener) {
-  const previous = serverPhaseListener;
-  serverPhaseListener = listener;
-  return previous;
-}
-function reportServerPhase(label) {
-  serverPhaseListener?.(label);
-}
-function cleanToken(value) {
-  const trimmed = value?.trim();
-  return trimmed ? trimmed : null;
-}
-function readPrivateRemoteSessionToken(projectRoot) {
-  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
-  if (!existsSync2(path))
+// packages/cli/src/commands/_run-diagnostics.ts
+function normalizeString(value) {
+  if (typeof value !== "string")
     return null;
-  try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
-  } catch {
+  const normalized = value.replace(/\s+/g, " ").trim();
+  return normalized.length > 0 ? normalized : null;
+}
+function isGenericRunFailure(value) {
+  const text = normalizeString(value);
+  return Boolean(text && /^Task run failed \([^)]*\)$/i.test(text));
+}
+function appendCandidate(candidates, value) {
+  const text = normalizeString(value);
+  if (text && !candidates.includes(text))
+    candidates.push(text);
+}
+function categorizeUsefulRunError(lines) {
+  const taskSourceFailure = lines.find((line) => /failed to update task source/i.test(line));
+  if (taskSourceFailure)
+    return `Task source update failed: ${taskSourceFailure}`;
+  const moduleFailure = lines.find((line) => /cannot find module/i.test(line));
+  if (moduleFailure)
+    return `Runtime module resolution failed: ${moduleFailure}`;
+  const providerFailure = lines.find((line) => /no api key found|unauthorized|authentication failed|invalid api key/i.test(line));
+  if (providerFailure)
+    return `Provider authentication failed: ${providerFailure}`;
+  return null;
+}
+function summarizeUsefulRunError(projection) {
+  if (projection.status !== "failed")
     return null;
+  const candidates = [];
+  for (const anomaly of projection.anomalies) {
+    appendCandidate(candidates, `Journal anomaly (${anomaly.kind}): ${anomaly.detail}`);
+  }
+  for (const phase of projection.closeoutPhases) {
+    if (phase.outcome === "failed")
+      appendCandidate(candidates, phase.detail);
   }
+  for (const entry of projection.statusHistory) {
+    appendCandidate(candidates, entry.reason);
+  }
+  appendCandidate(candidates, projection.record.statusDetail);
+  appendCandidate(candidates, projection.record.errorText);
+  const nonGeneric = candidates.filter((candidate) => !isGenericRunFailure(candidate));
+  return categorizeUsefulRunError(nonGeneric) ?? nonGeneric.at(-1) ?? normalizeString(projection.record.errorText);
 }
-function readGitHubBearerTokenForRemote(projectRoot) {
-  const scopedKey = resolve2(projectRoot);
-  if (scopedGitHubBearerTokens.has(scopedKey))
-    return scopedGitHubBearerTokens.get(scopedKey) ?? null;
-  const privateSession = readPrivateRemoteSessionToken(projectRoot);
-  if (privateSession)
-    return privateSession;
-  return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
+
+// packages/cli/src/commands/_run-projection.ts
+var EMPTY_PROJECTION = foldRunSessionEntries([], "");
+function stringOrNull(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
 }
-function readStoredGitHubAuthToken(projectRoot) {
-  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
-  if (!existsSync2(path))
+function newestSessionFile(sessionDir) {
+  if (!sessionDir || !existsSync2(sessionDir))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return cleanToken(typeof parsed.token === "string" ? parsed.token : undefined);
+    const files = readdirSync2(sessionDir).filter((file) => file.endsWith(".jsonl")).sort().reverse();
+    return files[0] ? resolve2(sessionDir, files[0]) : null;
   } catch {
     return null;
   }
 }
-function readLocalConnectionFallbackToken(projectRoot) {
-  return readGitHubBearerTokenForRemote(projectRoot) ?? cleanToken(process.env.RIG_GITHUB_TOKEN) ?? readStoredGitHubAuthToken(projectRoot);
-}
-async function ensureServerForCli(projectRoot) {
+function readSessionRunEntries(sessionPath) {
+  if (!sessionPath || !existsSync2(sessionPath))
+    return [];
+  let raw;
   try {
-    const selected = resolveSelectedConnection(projectRoot);
-    if (selected?.connection.kind === "remote") {
-      reportServerPhase(`Connecting to ${selected.alias}\u2026`);
-      const authToken = readGitHubBearerTokenForRemote(projectRoot);
-      const serverProjectRoot = selected.serverProjectRoot ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
-      return {
-        baseUrl: selected.connection.baseUrl,
-        authToken,
-        connectionKind: "remote",
-        serverProjectRoot
-      };
-    }
-    reportServerPhase("Starting local Rig server\u2026");
-    const connection = await ensureLocalRigServerConnection(projectRoot);
-    return {
-      baseUrl: connection.baseUrl,
-      authToken: connection.authToken ?? readLocalConnectionFallbackToken(projectRoot),
-      connectionKind: "local",
-      serverProjectRoot: resolve2(projectRoot)
-    };
-  } catch (error) {
-    if (error instanceof Error) {
-      throw new CliError(error.message, 1);
+    raw = readFileSync2(sessionPath, "utf8");
+  } catch {
+    return [];
+  }
+  const entries = [];
+  for (const line of raw.split(`
+`)) {
+    if (!line.trim())
+      continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      continue;
     }
-    throw error;
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      continue;
+    entries.push({
+      type: "type" in parsed && typeof parsed.type === "string" ? parsed.type : "",
+      ..."customType" in parsed && typeof parsed.customType === "string" ? { customType: parsed.customType } : {},
+      ..."data" in parsed ? { data: parsed.data } : {}
+    });
   }
+  return entries;
 }
-async function backfillRemoteServerProjectRoot(projectRoot, baseUrl, authToken) {
-  const repo = readRepoConnection(projectRoot);
-  const slug = repo?.project?.trim();
-  if (!slug)
+function recordFromProjection(runId, projection, presence) {
+  const record = projection.record;
+  const status = projection.status ?? (presence.stale ? "stale" : presence.live ? "running" : "unknown");
+  const taskId = stringOrNull(record.taskId) ?? presence.fallbackTaskId ?? null;
+  const title = stringOrNull(record.title) ?? stringOrNull(presence.title) ?? (taskId ? `Run ${taskId}` : `Rig run ${runId}`);
+  return {
+    runId,
+    taskId,
+    title,
+    status,
+    source: presence.source,
+    live: presence.live,
+    stale: presence.stale,
+    startedAt: stringOrNull(record.startedAt) ?? presence.startedAt ?? null,
+    updatedAt: stringOrNull(record.updatedAt) ?? presence.updatedAt ?? projection.lastEventAt ?? null,
+    completedAt: stringOrNull(record.completedAt),
+    joinLink: presence.joinLink ?? null,
+    webLink: presence.webLink ?? null,
+    relayUrl: presence.relayUrl ?? null,
+    sessionPath: stringOrNull(record.sessionPath) ?? presence.sessionPath ?? null,
+    prUrl: stringOrNull(record.prUrl),
+    worktreePath: stringOrNull(record.worktreePath),
+    pendingApprovals: projection.pendingApprovals.length,
+    pendingInputs: projection.pendingUserInputs.length,
+    steeringCount: projection.steeringCount,
+    stallCount: projection.stallCount,
+    errorSummary: summarizeUsefulRunError(projection),
+    projection
+  };
+}
+function recordFromLiveCollab(collab) {
+  const runId = collab.sessionId;
+  const sessionPath = stringOrNull(collab.sessionPath);
+  const projection = sessionPath ? foldRunSessionEntries(readSessionRunEntries(sessionPath), runId) : EMPTY_PROJECTION;
+  return recordFromProjection(runId, projection, {
+    source: sessionPath ? "local" : "remote",
+    live: !collab.stale,
+    stale: Boolean(collab.stale),
+    title: collab.title,
+    joinLink: stringOrNull(collab.joinLink),
+    webLink: stringOrNull(collab.webLink),
+    relayUrl: stringOrNull(collab.relayUrl),
+    sessionPath,
+    startedAt: stringOrNull(collab.startedAt),
+    updatedAt: stringOrNull(collab.updatedAt)
+  });
+}
+function recordFromRuntime(runtime) {
+  const sessionPath = newestSessionFile(runtime.sessionDir ?? "");
+  if (!sessionPath)
     return null;
+  const projection = foldRunSessionEntries(readSessionRunEntries(sessionPath), runtime.id);
+  if (projection.lastSeq === 0)
+    return null;
+  return recordFromProjection(sessionIdFromSessionFile2(sessionPath) ?? runtime.id, projection, {
+    source: "local",
+    live: false,
+    stale: false,
+    sessionPath,
+    fallbackTaskId: stringOrNull(runtime.taskId)
+  });
+}
+function sortByRecency(records) {
+  return [...records].sort((a, b) => {
+    const at = Date.parse(b.updatedAt ?? b.startedAt ?? "") || 0;
+    const bt = Date.parse(a.updatedAt ?? a.startedAt ?? "") || 0;
+    return at - bt;
+  });
+}
+async function listRunProjections(projectRoot, filter = {}) {
+  const byRunId = new Map;
+  let live = [];
   try {
-    const response = await fetch(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`, {
-      headers: mergeHeaders(undefined, authToken)
-    });
-    if (!response.ok)
-      return null;
-    const payload = await response.json();
-    const project = payload.project && typeof payload.project === "object" && !Array.isArray(payload.project) ? payload.project : null;
-    const checkouts = Array.isArray(project?.checkouts) ? project.checkouts : [];
-    const latestCheckout = [...checkouts].reverse().find((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry) && typeof entry.path === "string"));
-    const path = typeof latestCheckout?.path === "string" && latestCheckout.path.trim() ? latestCheckout.path.trim() : null;
-    if (path)
-      writeRepoServerProjectRoot(projectRoot, path);
-    return path;
+    live = await listActiveRunCollab(filter);
   } catch {
-    return null;
+    live = [];
+  }
+  for (const collab of live) {
+    const record = recordFromLiveCollab(collab);
+    byRunId.set(record.runId, record);
+  }
+  let runtimes = [];
+  try {
+    runtimes = await listAgentRuntimes2(projectRoot);
+  } catch {
+    runtimes = [];
   }
+  for (const runtime of runtimes) {
+    const record = recordFromRuntime(runtime);
+    if (!record)
+      continue;
+    const sessionId = sessionIdFromSessionFile2(record.sessionPath);
+    const liveMatch = sessionId ? byRunId.get(sessionId) : undefined;
+    if (liveMatch) {
+      if (liveMatch.source === "remote" || !liveMatch.sessionPath) {
+        byRunId.set(liveMatch.runId, { ...liveMatch, sessionPath: record.sessionPath, source: "local" });
+      }
+      continue;
+    }
+    if (byRunId.has(runtime.id))
+      continue;
+    byRunId.set(record.runId, record);
+  }
+  return sortByRecency([...byRunId.values()]);
+}
+async function getRunProjection(projectRoot, runId, filter = {}) {
+  const runs = await listRunProjections(projectRoot, filter);
+  return runs.find((run) => run.runId === runId) ?? runs.find((run) => run.runId.startsWith(runId)) ?? runs.find((run) => run.taskId === runId) ?? null;
 }
-function mergeHeaders(headers, authToken) {
-  const merged = new Headers(headers);
-  if (authToken) {
-    merged.set("authorization", `Bearer ${authToken}`);
+
+// packages/cli/src/commands/inspect.ts
+var INSPECT_USAGE = "rig inspect <logs|artifact|artifacts|run-logs|runs|failures|graph|audit|diff>";
+function printInspectHelp() {
+  console.log([
+    `Usage: ${INSPECT_USAGE}`,
+    "",
+    "Commands:",
+    "  logs --task <id>              Print log lines from the latest projected run for a task.",
+    "  artifact --task <id> --file <name>",
+    "                                Preview a single task artifact.",
+    "  artifacts --task <id>         List task artifacts.",
+    "  run-logs --run <id>           Print log lines from a run journal.",
+    "  runs                          List all projected runs.",
+    "  diff --task <id>              List files changed by a task.",
+    "  graph [--task <id>]           Print the task dependency graph.",
+    "  failures --task <id>          Summarize failed runs, closeout failures, and journal anomalies.",
+    "  audit                         Controlled-command audit is not readable yet in this CLI."
+  ].join(`
+`));
+}
+function asRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function firstString2(record, keys) {
+  for (const key of keys) {
+    const value = record[key];
+    if (typeof value === "string" && value.trim().length > 0) {
+      return value;
+    }
   }
-  return merged;
+  return null;
 }
-function diagnosticMessage(payload) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+function stringifyLogPayload(value) {
+  if (typeof value === "string")
+    return value;
+  if (typeof value === "number" || typeof value === "boolean")
+    return String(value);
+  const record = asRecord(value);
+  if (!record)
     return null;
-  const record = payload;
-  const diagnostics = Array.isArray(record.diagnostics) ? record.diagnostics : [];
-  const messages = diagnostics.flatMap((entry) => {
-    if (!entry || typeof entry !== "object" || Array.isArray(entry))
-      return [];
-    const diagnostic = entry;
-    const kind = typeof diagnostic.kind === "string" ? diagnostic.kind : "task-source";
-    const message = typeof diagnostic.message === "string" ? diagnostic.message : null;
-    return message ? [`${kind}: ${message}`] : [];
-  });
-  return messages.length > 0 ? messages.join("; ") : null;
-}
-var serverReachabilityCache = new Map;
-async function probeServerReachability(baseUrl, authToken) {
+  const direct = firstString2(record, ["line", "message", "text", "content", "output", "summary", "detail"]);
+  if (direct)
+    return direct;
   try {
-    const response = await fetch(`${baseUrl.replace(/\/+$/, "")}/api/server/status`, {
-      headers: mergeHeaders(undefined, authToken),
-      signal: AbortSignal.timeout(1500)
-    });
-    return response.ok;
+    return JSON.stringify(record);
   } catch {
-    return false;
+    return String(record);
   }
 }
-function cachedServerReachability(projectRoot, baseUrl, authToken) {
-  const key = resolve2(projectRoot);
-  const cached = serverReachabilityCache.get(key);
-  if (cached)
-    return cached;
-  const probe = probeServerReachability(baseUrl, authToken);
-  serverReachabilityCache.set(key, probe);
-  return probe;
-}
-function describeSelectedServer(projectRoot, server) {
-  try {
-    const selected = resolveSelectedConnection(projectRoot);
-    if (selected) {
-      return {
-        alias: selected.alias,
-        target: selected.connection.kind === "remote" ? selected.connection.baseUrl : server.baseUrl
-      };
+function logLineFromValue(value) {
+  const record = asRecord(value);
+  if (!record)
+    return stringifyLogPayload(value);
+  const direct = firstString2(record, ["line", "message", "text", "content", "output", "summary", "detail"]);
+  if (direct)
+    return direct;
+  if ("payload" in record)
+    return stringifyLogPayload(record.payload);
+  if ("data" in record)
+    return stringifyLogPayload(record.data);
+  return stringifyLogPayload(record);
+}
+function logLineFromSessionEntry(entry) {
+  if (entry.type !== "custom" || entry.customType !== RIG_RUN_LOG_ENTRY)
+    return null;
+  return logLineFromValue(entry.data);
+}
+function logLinesFromProjection(projection) {
+  const projected = projection;
+  const lines = [];
+  for (const key of ["logs", "logEntries", "journalLogs", "runLogs"]) {
+    const entries = projected[key];
+    if (!Array.isArray(entries))
+      continue;
+    for (const entry of entries) {
+      const line = logLineFromValue(entry);
+      if (line !== null)
+        lines.push(line);
     }
-  } catch {}
-  return { alias: server.connectionKind === "remote" ? "remote" : "local", target: server.baseUrl };
+  }
+  return lines;
 }
-async function buildServerFailureContext(projectRoot, server) {
-  const { alias, target } = describeSelectedServer(projectRoot, server);
-  const reachable = await cachedServerReachability(projectRoot, server.baseUrl, server.authToken);
-  const reachability = reachable ? "server is reachable" : "server is unreachable";
+function toRunLike(run) {
   return {
-    contextLine: `Currently connected to: ${alias} at ${target} (${reachability}).`,
-    hint: "Check the selected server with `rig server status`, or switch with `rig server use <alias|local>`."
+    runId: run.runId,
+    taskId: run.taskId,
+    title: run.title,
+    status: run.status,
+    source: run.source,
+    live: run.live,
+    stale: run.stale,
+    startedAt: run.startedAt,
+    updatedAt: run.updatedAt,
+    completedAt: run.completedAt,
+    joinLink: run.joinLink,
+    prUrl: run.prUrl,
+    pendingApprovals: run.pendingApprovals,
+    pendingInputs: run.pendingInputs,
+    steeringCount: run.steeringCount,
+    stallCount: run.stallCount
   };
 }
-async function requestServerJson(context, pathname, init = {}) {
-  const server = await ensureServerForCli(context.projectRoot);
-  const headers = mergeHeaders(init.headers, server.authToken);
-  if (server.serverProjectRoot)
-    headers.set("x-rig-project-root", server.serverProjectRoot);
-  reportServerPhase(`${(init.method ?? "GET").toUpperCase()} ${pathname.split("?")[0]}\u2026`);
-  let response;
-  try {
-    response = await fetch(`${server.baseUrl}${pathname}`, {
-      ...init,
-      headers
+function requireRunId(value, usage) {
+  if (!value || !value.trim()) {
+    throw new CliError(`${usage} requires a run id.`, 2, { hint: "Run `rig inspect runs` to find run ids." });
+  }
+  return value.trim();
+}
+async function executeLogs(context, args, deps) {
+  const taskResult = takeOption(args, "--task");
+  requireNoExtraArgs(taskResult.rest, "rig inspect logs --task <id>");
+  const taskId = requireTask(taskResult.value, "rig inspect logs --task <id>");
+  const projection = await (deps.getRunProjection ?? getRunProjection)(context.projectRoot, taskId);
+  if (!projection) {
+    throw new CliError(`No projected runs found for task ${taskId}.`, 1, {
+      hint: "Run `rig run list` to confirm the run journal is discoverable."
     });
-  } catch (error) {
-    const failure = await buildServerFailureContext(context.projectRoot, server);
-    throw new CliError(`Rig server request failed: ${error instanceof Error ? error.message : String(error)}
-${failure.contextLine}`, 1, { hint: failure.hint });
   }
-  const text = await response.text();
-  const payload = text.trim().length > 0 ? (() => {
-    try {
-      return JSON.parse(text);
-    } catch {
-      return null;
-    }
-  })() : null;
-  if (!response.ok) {
-    const diagnostics = diagnosticMessage(payload);
-    const rawDetail = diagnostics ?? (text || response.statusText);
-    const detail = diagnostics ? rawDetail : rawDetail.split(`
-`).map((line) => line.trim()).find((line) => line.length > 0)?.slice(0, 200) ?? response.statusText;
-    const failure = await buildServerFailureContext(context.projectRoot, server);
-    throw new CliError(`Rig server request failed (${response.status}): ${detail}
-${failure.contextLine}`, 1, { hint: failure.hint });
-  }
-  return payload;
-}
-async function listRunsViaServer(context, options = {}) {
-  const url = new URL("http://rig.local/api/runs");
-  if (options.limit !== undefined)
-    url.searchParams.set("limit", String(options.limit));
-  const payload = await requestServerJson(context, `${url.pathname}${url.search}`);
-  const runs = Array.isArray(payload) ? payload : payload && typeof payload === "object" && !Array.isArray(payload) && Array.isArray(payload.runs) ? payload.runs : [];
-  return runs.filter((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry)));
-}
-async function getRunLogsViaServer(context, runId, options = {}) {
-  const url = new URL(`http://rig.local/api/runs/${encodeURIComponent(runId)}/logs`);
-  if (options.limit !== undefined)
-    url.searchParams.set("limit", String(options.limit));
-  if (options.cursor)
-    url.searchParams.set("cursor", options.cursor);
-  const payload = await requestServerJson(context, `${url.pathname}${url.search}`);
-  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : { entries: [] };
-}
-var RESUMABLE_RUN_STATUSES = new Set([
-  "created",
-  "preparing",
-  "running",
-  "validating",
-  "reviewing",
-  "stopped",
-  "failed",
-  "needs-attention",
-  "needs_attention"
-]);
-
-// packages/cli/src/commands/_async-ui.ts
-import pc from "picocolors";
-
-// packages/cli/src/commands/_spinner.ts
-var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
-function createTtySpinner(input) {
-  const output = input.output ?? process.stdout;
-  const isTty = output.isTTY === true;
-  const frames = input.frames && input.frames.length > 0 ? input.frames : SPINNER_FRAMES;
-  let label = input.label;
-  let frame = 0;
-  let paused = false;
-  let stopped = false;
-  let lastPrintedLabel = "";
-  const render = () => {
-    if (stopped || paused)
-      return;
-    if (!isTty) {
-      if (label !== lastPrintedLabel) {
-        output.write(`${label}
-`);
-        lastPrintedLabel = label;
-      }
-      return;
+  const projectedLines = logLinesFromProjection(projection.projection);
+  const sessionLines = projectedLines.length > 0 ? [] : (deps.readSessionRunEntries ?? readSessionRunEntries)(projection.sessionPath).map(logLineFromSessionEntry).filter((line) => line !== null);
+  const lines = projectedLines.length > 0 ? projectedLines : sessionLines;
+  if (context.outputMode === "json") {
+    console.log(JSON.stringify({ taskId, runId: projection.runId, lines }, null, 2));
+  } else if (lines.length === 0) {
+    console.log(`No log entries found for task ${taskId}.`);
+  } else {
+    for (const line of lines)
+      console.log(line);
+  }
+  return { ok: true, group: "inspect", command: "logs", details: { taskId, runId: projection.runId, count: lines.length } };
+}
+async function executeArtifact(context, args, deps) {
+  const taskResult = takeOption(args, "--task");
+  const fileResult = takeOption(taskResult.rest, "--file");
+  requireNoExtraArgs(fileResult.rest, "rig inspect artifact --task <id> --file <name>");
+  const taskId = requireTask(taskResult.value, "rig inspect artifact --task <id> --file <name>");
+  const filename = fileResult.value?.trim();
+  if (!filename) {
+    throw new CliError("rig inspect artifact --task <id> --file <name> requires an artifact file name.", 2);
+  }
+  const preview = await (deps.taskArtifactRead ?? taskArtifactRead)(context.projectRoot, filename, {
+    taskId,
+    maxBytes: 64 * 1024
+  });
+  if (context.outputMode === "json") {
+    console.log(JSON.stringify({ taskId, file: filename, ...preview }, null, 2));
+  } else {
+    console.log(preview.contents);
+    if (preview.truncated) {
+      console.log(`
+[truncated at ${preview.maxBytes} bytes; artifact is ${preview.sizeBytes} bytes]`);
     }
-    frame = (frame + 1) % frames.length;
-    const glyph = frames[frame] ?? frames[0] ?? "";
-    output.write(`\r\x1B[2K${input.styleFrame ? input.styleFrame(glyph) : glyph} ${label}`);
-  };
-  const clearLine = () => {
-    if (isTty)
-      output.write("\r\x1B[2K");
-  };
-  render();
-  const timer = isTty ? setInterval(render, input.intervalMs ?? 120) : null;
+  }
   return {
-    setLabel(next) {
-      label = next;
-      render();
-    },
-    pause() {
-      paused = true;
-      clearLine();
-    },
-    resume() {
-      if (stopped)
-        return;
-      paused = false;
-      render();
-    },
-    stop(finalLine) {
-      if (stopped)
-        return;
-      stopped = true;
-      if (timer)
-        clearInterval(timer);
-      clearLine();
-      if (finalLine)
-        output.write(`${finalLine}
-`);
-    }
+    ok: true,
+    group: "inspect",
+    command: "artifact",
+    details: { taskId, file: filename, ...preview }
   };
 }
-
-// packages/cli/src/app/theme.ts
-var RIG_PALETTE = {
-  ink: "#f2f3f6",
-  ink2: "#aeb0ba",
-  ink3: "#6c6e79",
-  ink4: "#44464f",
-  accent: "#ccff4d",
-  accentDim: "#a9d63f",
-  cyan: "#56d8ff",
-  red: "#ff5d5d",
-  yellow: "#ffd24d"
-};
-function hexToRgb(hex) {
-  const value = hex.replace("#", "");
-  return [
-    Number.parseInt(value.slice(0, 2), 16),
-    Number.parseInt(value.slice(2, 4), 16),
-    Number.parseInt(value.slice(4, 6), 16)
-  ];
-}
-function fg(hex) {
-  const [r, g, b] = hexToRgb(hex);
-  return (text) => `\x1B[38;2;${r};${g};${b}m${text}\x1B[39m`;
-}
-var ink = fg(RIG_PALETTE.ink);
-var ink2 = fg(RIG_PALETTE.ink2);
-var ink3 = fg(RIG_PALETTE.ink3);
-var ink4 = fg(RIG_PALETTE.ink4);
-var accent = fg(RIG_PALETTE.accent);
-var accentDim = fg(RIG_PALETTE.accentDim);
-var cyan = fg(RIG_PALETTE.cyan);
-var red = fg(RIG_PALETTE.red);
-var yellow = fg(RIG_PALETTE.yellow);
-function bold(text) {
-  return `\x1B[1m${text}\x1B[22m`;
-}
-var DRONE_ART = [
-  "  .-=-.                   .-=-.   ",
-  " ( !!! )                 ( !!! )  ",
-  "  '-=-'._               _.'-=-'   ",
-  "        '._           _.'         ",
-  "           '=$$$$$$$=.'           ",
-  "          =$$$$$$$$$$$=           ",
-  "         $$$@@@@@@@@@@$$$         ",
-  "        $$$@@        @@$$$        ",
-  "        $$@    ?     @$$$         ",
-  "        $$$@   '-'   @$$$         ",
-  "        $$$@@        @@$$$        ",
-  "         $$$@@@@@@@@@@$$$         ",
-  "          =$$$$$$$$$$$=           ",
-  "           '=$$$$$$$=.'           ",
-  "        _.'           '._         ",
-  "  .-=-.'                 '.-=-.   ",
-  " ( !!! )                 ( !!! )  ",
-  "  '-=-'                   '-=-'   "
-];
-var EYE_FRAMES = ["@", "o", "."];
-var DRONE_WIDTH = DRONE_ART[0].length;
-var DRONE_HEIGHT = DRONE_ART.length;
-var MICRO_BLADES = ["---", "\\\\\\", "|||", "///"];
-function microDroneFrame(tick) {
-  const blade = MICRO_BLADES[tick % MICRO_BLADES.length];
-  const eye = EYE_FRAMES[Math.floor(tick / 2) % EYE_FRAMES.length];
-  return `(${blade})${eye}(${blade})`;
-}
-var MICRO_DRONE_FRAMES = Array.from({ length: 12 }, (_, index) => microDroneFrame(index));
-function renderMicroDroneFrame(tick) {
-  const blade = MICRO_BLADES[tick % MICRO_BLADES.length];
-  const eye = EYE_FRAMES[Math.floor(tick / 2) % EYE_FRAMES.length];
-  return `${ink4("(")}${cyan(blade)}${ink4(")")}${bold(accent(eye))}${ink4("(")}${cyan(blade)}${ink4(")")}`;
-}
-
-// packages/cli/src/commands/_async-ui.ts
-var DONE_SYMBOL = pc.green("\u25C7");
-var FAIL_SYMBOL = pc.red("\u25A0");
-var activeUpdate = null;
-async function withSpinner(label, work, options = {}) {
-  if (options.outputMode === "json") {
-    return work(() => {});
-  }
-  if (activeUpdate) {
-    const outer = activeUpdate;
-    outer(label);
-    return work(outer);
-  }
-  const output = options.output ?? process.stderr;
-  const isTty = output.isTTY === true;
-  let lastLabel = label;
-  if (!isTty) {
-    output.write(`${label}
-`);
-    const update2 = (next) => {
-      lastLabel = next;
-    };
-    activeUpdate = update2;
-    const previousListener2 = setServerPhaseListener(update2);
-    try {
-      return await work(update2);
-    } finally {
-      activeUpdate = null;
-      setServerPhaseListener(previousListener2);
+async function executeRunLogs(context, args, deps) {
+  const runResult = takeOption(args, "--run");
+  requireNoExtraArgs(runResult.rest, "rig inspect run-logs --run <id>");
+  const runId = requireRunId(runResult.value, "rig inspect run-logs --run <id>");
+  const projection = await (deps.getRunProjection ?? getRunProjection)(context.projectRoot, runId);
+  if (!projection) {
+    throw new CliError(`Run not found: ${runId}`, 2, { hint: "Run `rig inspect runs` to see runs." });
+  }
+  const sessionLines = (deps.readSessionRunEntries ?? readSessionRunEntries)(projection.sessionPath).map(logLineFromSessionEntry).filter((line) => line !== null);
+  const lines = sessionLines.length > 0 ? sessionLines : logLinesFromProjection(projection.projection);
+  if (context.outputMode === "json") {
+    console.log(JSON.stringify({ runId: projection.runId, taskId: projection.taskId, lines }, null, 2));
+  } else if (lines.length === 0) {
+    console.log(`No log entries found for run ${projection.runId}.`);
+  } else {
+    for (const line of lines)
+      console.log(line);
+  }
+  return { ok: true, group: "inspect", command: "run-logs", details: { runId: projection.runId, taskId: projection.taskId, count: lines.length } };
+}
+async function executeRuns(context, args, deps) {
+  requireNoExtraArgs(args, "rig inspect runs");
+  const runs = await (deps.listRunProjections ?? listRunProjections)(context.projectRoot);
+  const formatted = runs.map(toRunLike);
+  if (context.outputMode === "text") {
+    printFormattedOutput(formatRunList(formatted));
+  }
+  return { ok: true, group: "inspect", command: "runs", details: { runs: formatted } };
+}
+async function executeArtifacts(context, args, deps) {
+  const taskResult = takeOption(args, "--task");
+  requireNoExtraArgs(taskResult.rest, "rig inspect artifacts --task <id>");
+  const taskId = requireTask(taskResult.value, "rig inspect artifacts --task <id>");
+  await (deps.taskArtifacts ?? taskArtifacts)(context.projectRoot, taskId);
+  return { ok: true, group: "inspect", command: "artifacts", details: { taskId } };
+}
+async function executeDiff(context, args, deps) {
+  const taskResult = takeOption(args, "--task");
+  requireNoExtraArgs(taskResult.rest, "rig inspect diff --task <id>");
+  const taskId = requireTask(taskResult.value, "rig inspect diff --task <id>");
+  const files = (deps.changedFilesForTask ?? changedFilesForTask)(context.projectRoot, taskId, true);
+  if (context.outputMode === "json") {
+    console.log(JSON.stringify({ taskId, files }, null, 2));
+  } else {
+    for (const file of files)
+      console.log(file);
+  }
+  return { ok: true, group: "inspect", command: "diff", details: { taskId, files } };
+}
+async function executeGraph(context, args, deps) {
+  const taskResult = takeOption(args, "--task");
+  requireNoExtraArgs(taskResult.rest, "rig inspect graph [--task <id>]");
+  await (deps.taskDeps ?? taskDeps)(context.projectRoot, taskResult.value);
+  return { ok: true, group: "inspect", command: "graph", details: { taskId: taskResult.value ?? null } };
+}
+function summarizeProjectionFailures(run) {
+  const failures = [];
+  const projection = run.projection;
+  if (run.status === "failed" || projection.status === "failed") {
+    failures.push(`${run.runId}: run status failed`);
+  }
+  for (const phase of projection.closeoutPhases) {
+    if (phase.outcome === "failed") {
+      failures.push(`${run.runId}: closeout ${phase.phase} failed${phase.detail ? ` \u2014 ${phase.detail}` : ""}`);
     }
   }
-  const spinner = createTtySpinner({
-    label,
-    output,
-    frames: MICRO_DRONE_FRAMES,
-    styleFrame: (frame) => renderMicroDroneFrame(Math.max(0, MICRO_DRONE_FRAMES.indexOf(frame)))
-  });
-  const update = (next) => {
-    lastLabel = next;
-    spinner.setLabel(next);
-  };
-  activeUpdate = update;
-  const previousListener = setServerPhaseListener(update);
+  for (const anomaly of projection.anomalies) {
+    failures.push(`${run.runId}: anomaly ${anomaly.kind}${anomaly.detail ? ` \u2014 ${anomaly.detail}` : ""}`);
+  }
+  return failures;
+}
+async function runsForTask(context, taskId, deps) {
+  const listRuns = deps.listRunProjections ?? listRunProjections;
   try {
-    const result = await work(update);
-    spinner.stop(options.doneLabel ? `${DONE_SYMBOL} ${options.doneLabel}` : undefined);
-    return result;
-  } catch (error) {
-    spinner.stop(`${FAIL_SYMBOL} ${lastLabel}`);
-    throw error;
-  } finally {
-    activeUpdate = null;
-    setServerPhaseListener(previousListener);
+    const runs = await listRuns(context.projectRoot);
+    const filtered = runs.filter((run2) => run2.taskId === taskId || run2.runId === taskId);
+    if (filtered.length > 0)
+      return filtered;
+  } catch {}
+  const run = await (deps.getRunProjection ?? getRunProjection)(context.projectRoot, taskId);
+  return run ? [run] : [];
+}
+async function executeFailures(context, args, deps) {
+  const taskResult = takeOption(args, "--task");
+  requireNoExtraArgs(taskResult.rest, "rig inspect failures --task <id>");
+  const taskId = requireTask(taskResult.value, "rig inspect failures --task <id>");
+  const runs = await runsForTask(context, taskId, deps);
+  const failures = runs.flatMap(summarizeProjectionFailures);
+  if (context.outputMode === "json") {
+    console.log(JSON.stringify({ taskId, failures }, null, 2));
+  } else if (failures.length === 0) {
+    console.log(`No failures recorded for task ${taskId}.`);
+  } else {
+    for (const failure of failures)
+      console.log(failure);
   }
+  return { ok: true, group: "inspect", command: "failures", details: { taskId, count: failures.length } };
 }
-
-// packages/cli/src/commands/inspect.ts
-async function executeInspect(context, args) {
+function executeAudit(args) {
+  requireNoExtraArgs(args, "rig inspect audit");
+  throw new CliError("rig inspect audit cannot read the controlled-command audit trail yet: current code only writes audit JSONL and exposes no supported reader API.", 2, { hint: "Use the OMP session history for operator audit context until a controlled-bash audit reader is added." });
+}
+async function executeInspect(context, args, deps = {}) {
   const [command = "failures", ...rest] = args;
+  if (command === "--help" || command === "-h" || command === "help") {
+    printInspectHelp();
+    return { ok: true, group: "inspect", command: "help" };
+  }
   switch (command) {
-    case "logs": {
-      const { value: task, rest: remaining } = takeOption(rest, "--task");
-      requireNoExtraArgs(remaining, "rig inspect logs --task <task-id>");
-      const requiredTask = requireTask(task, "rig inspect logs --task <task-id>");
-      const latestRun = listAuthorityRuns(context.projectRoot).map((entry) => readAuthorityRun(context.projectRoot, entry.runId)).filter((run) => Boolean(run)).filter((run) => run.taskId === requiredTask).sort((left, right) => String(right.updatedAt ?? "").localeCompare(String(left.updatedAt ?? "")))[0];
-      if (!latestRun) {
-        const fallback = await withSpinner(`Finding runs for ${requiredTask} on the server\u2026`, async (update) => {
-          const serverRuns = await listRunsViaServer(context, { limit: 200 }).catch(() => []);
-          const serverRun = serverRuns.filter((run) => String(run.taskId ?? "") === requiredTask).sort((left, right) => String(right.updatedAt ?? "").localeCompare(String(left.updatedAt ?? "")))[0];
-          if (!serverRun || typeof serverRun.runId !== "string")
-            return null;
-          update(`Reading logs for run ${serverRun.runId}\u2026`);
-          const page = await getRunLogsViaServer(context, serverRun.runId, { limit: 500 });
-          return { runId: serverRun.runId, page };
-        }, { outputMode: context.outputMode });
-        if (!fallback) {
-          throw new CliError(`No runs found for ${requiredTask} (local or on the selected server).`, 1, { hint: "Start one with `rig task run --task <id>`, or check `rig run list`." });
-        }
-        const entries = Array.isArray(fallback.page.entries) ? fallback.page.entries : [];
-        if (context.outputMode === "text") {
-          for (const entry of entries) {
-            const record = entry && typeof entry === "object" ? entry : {};
-            const title = String(record.title ?? "");
-            const detail = String(record.detail ?? "");
-            console.log([title, detail].filter(Boolean).join(" \u2014 "));
-          }
-          if (entries.length === 0)
-            console.log(`(no log entries for run ${fallback.runId})`);
-        }
-        return { ok: true, group: "inspect", command, details: { task: requiredTask, runId: fallback.runId, source: "server", entries } };
-      }
-      const logsPath = resolve3(resolveAuthorityRunDir(context.projectRoot, latestRun.runId), "logs.jsonl");
-      if (!existsSync3(logsPath)) {
-        throw new CliError(`No logs found for run ${latestRun.runId}.`, 1, { hint: `Try \`rig run show ${latestRun.runId}\` or \`rig run replay ${latestRun.runId}\`.` });
-      }
-      await context.runCommand(["cat", logsPath]);
-      return { ok: true, group: "inspect", command, details: { task: requiredTask, runId: latestRun.runId } };
-    }
-    case "artifacts": {
-      const { value: task, rest: remaining } = takeOption(rest, "--task");
-      requireNoExtraArgs(remaining, "rig inspect artifacts --task <task-id>");
-      const requiredTask = requireTask(task, "rig inspect artifacts --task <task-id>");
-      const artifactRoot = resolveTaskArtifactDirs(context.projectRoot, requiredTask).find((path) => existsSync3(path));
-      if (!artifactRoot) {
-        throw new CliError(`No artifacts found for ${requiredTask}.`, 1, { hint: "Artifacts appear after a run completes; check `rig run list` for run state." });
-      }
-      await context.runCommand(["ls", "-la", artifactRoot]);
-      return { ok: true, group: "inspect", command, details: { task: requiredTask } };
-    }
-    case "artifact": {
-      let previewPending = rest;
-      const task = takeOption(previewPending, "--task");
-      previewPending = task.rest;
-      const file = takeOption(previewPending, "--file");
-      previewPending = file.rest;
-      requireNoExtraArgs(previewPending, "rig inspect artifact --task <task-id> --file <name>");
-      const requiredTask = requireTask(task.value, "rig inspect artifact --task <task-id> --file <name>");
-      if (!file.value) {
-        throw new CliError("Missing --file for rig inspect artifact.", 1, { hint: "List artifact files first: `rig inspect artifacts --task <id>`, then pass one with --file." });
-      }
-      const preview = readTaskArtifactPreview(context.projectRoot, requiredTask, file.value);
-      if (context.outputMode === "text") {
-        console.log(preview.contents);
-        if (preview.truncated) {
-          console.log(`
-[preview truncated at ${preview.maxBytes} bytes of ${preview.sizeBytes}]`);
-        }
-      }
-      return {
-        ok: true,
-        group: "inspect",
-        command,
-        details: {
-          task: requiredTask,
-          fileName: file.value,
-          path: preview.path,
-          sizeBytes: preview.sizeBytes,
-          truncated: preview.truncated,
-          maxBytes: preview.maxBytes,
-          contents: context.outputMode === "json" ? preview.contents : null
-        }
-      };
-    }
-    case "diff": {
-      const { value: task, rest: remaining } = takeOption(rest, "--task");
-      requireNoExtraArgs(remaining, "rig inspect diff [--task <task-id>]");
-      if (task) {
-        const files = await withSpinner(`Computing changed files for ${task}\u2026`, async () => changedFilesForTask(context.projectRoot, task, false), { outputMode: context.outputMode });
-        for (const file of files) {
-          console.log(file);
-        }
-      } else {
-        await context.runCommand(["git", "diff", "--stat"]);
-      }
-      return { ok: true, group: "inspect", command, details: { task: task || null } };
-    }
-    case "failures": {
-      requireNoExtraArgs(rest, "rig inspect failures");
-      const failed = resolveHarnessPaths(context.projectRoot).failedApproachesPath;
-      if (!existsSync3(failed)) {
-        console.log("No failures recorded.");
-      } else {
-        process.stdout.write(readFileSync3(failed, "utf-8"));
-      }
-      return { ok: true, group: "inspect", command };
-    }
+    case "logs":
+      return executeLogs(context, rest, deps);
+    case "artifact":
+      return executeArtifact(context, rest, deps);
+    case "artifacts":
+      return executeArtifacts(context, rest, deps);
+    case "run-logs":
+      return executeRunLogs(context, rest, deps);
+    case "runs":
+      return executeRuns(context, rest, deps);
+    case "diff":
+      return executeDiff(context, rest, deps);
     case "graph":
-      requireNoExtraArgs(rest, "rig inspect graph");
-      {
-        const monorepoRoot = resolveMonorepoRoot(context.projectRoot);
-        const result = runCapture(["br", "--no-db", "list", "--pretty"], monorepoRoot);
-        if (result.exitCode !== 0) {
-          throw new CliError(result.stderr || result.stdout || "Failed to inspect graph");
-        }
-        process.stdout.write(result.stdout);
-      }
-      return { ok: true, group: "inspect", command };
-    case "audit": {
-      requireNoExtraArgs(rest, "rig inspect audit");
-      const auditPath = resolve3(resolveHarnessPaths(context.projectRoot).logsDir, "audit.jsonl");
-      if (!existsSync3(auditPath)) {
-        console.log("No audit log found.");
-      } else {
-        const lines = readFileSync3(auditPath, "utf-8").split(/\r?\n/).filter(Boolean).slice(-20);
-        for (const line of lines) {
-          console.log(line);
-        }
-      }
-      return { ok: true, group: "inspect", command };
-    }
+      return executeGraph(context, rest, deps);
+    case "failures":
+      return executeFailures(context, rest, deps);
+    case "audit":
+      return executeAudit(rest);
     default:
       throw new CliError(`Unknown inspect command: ${command}`, 1, { hint: "Run `rig inspect --help` to list inspect commands." });
   }