@h-rig/cli 0.0.6-alpha.90 → 0.0.6-alpha.92

package/dist/src/commands/setup.js

@@ -2,8 +2,8 @@
 var __require = import.meta.require;
 
 // packages/cli/src/commands/setup.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync2, readdirSync, writeFileSync as writeFileSync2 } from "fs";
-import { resolve as resolve6 } from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readdirSync, writeFileSync as writeFileSync2 } from "fs";
+import { resolve as resolve5 } from "path";
 
 // packages/cli/src/runner.ts
 import { EventBus } from "@rig/runtime/control-plane/runtime/events";
@@ -85,7 +85,7 @@ async function loadRigConfigOrNull(projectRoot) {
 
 // packages/cli/src/commands/_paths.ts
 import { resolve } from "path";
-import { resolveMonorepoRoot } from "@rig/runtime/control-plane/native/utils";
+import { resolveMonorepoRoot } from "@rig/runtime/layout";
 function resolveControlPlaneMonorepoRoot(projectRoot) {
   return resolveMonorepoRoot(projectRoot);
 }
@@ -106,11 +106,10 @@ function resolveControlPlaneDefinitionRoot(projectRoot) {
 }
 
 // packages/cli/src/commands/_pi-install.ts
-import { existsSync, readFileSync, rmSync } from "fs";
+import { existsSync } from "fs";
 import { homedir } from "os";
 import { resolve as resolve2 } from "path";
 var PI_RIG_PACKAGE_NAME = "@h-rig/pi-rig";
-var LEGACY_PI_RIG_PACKAGE_NAME = "@rig/pi-rig";
 async function defaultCommandRunner(command, options = {}) {
   const proc = Bun.spawn(command, { cwd: options.cwd, stdout: "pipe", stderr: "pipe" });
   const [stdout, stderr, exitCode] = await Promise.all([
@@ -129,7 +128,7 @@ function resolvePiHomeDir(inputHomeDir) {
 function piListContainsPiRig(output) {
   return output.split(/\r?\n/).some((line) => {
     const normalized = line.trim();
-    return normalized.includes(PI_RIG_PACKAGE_NAME) || normalized.includes(LEGACY_PI_RIG_PACKAGE_NAME) || /(?:^|[\\/])packages[\\/]pi-rig(?:$|\s)/.test(normalized);
+    return normalized.includes(PI_RIG_PACKAGE_NAME) || /(?:^|[\\/])packages[\\/]pi-rig(?:$|\s)/.test(normalized);
   });
 }
 async function safeRun(runner, command, options) {
@@ -149,27 +148,25 @@ async function checkPiRigInstall(input = {}) {
       piRig: { ok: true, label: "pi-rig global extension", detail: extensionPath }
     };
   }
-  const exists = input.exists ?? existsSync;
   const runner = input.commandRunner ?? defaultCommandRunner;
   const piResult = await safeRun(runner, ["pi", "--version"]);
   const piListResult = piResult.exitCode === 0 ? await safeRun(runner, ["pi", "list"]) : { exitCode: 1, stdout: "", stderr: "" };
-  const listedPiRig = piListResult.exitCode === 0 && piListContainsPiRig(`${piListResult.stdout}
+  const hasPiRig = piListResult.exitCode === 0 && piListContainsPiRig(`${piListResult.stdout}
 ${piListResult.stderr}`);
-  const legacyBridge = exists(resolve2(extensionPath, "index.ts"));
-  const hasPiRig = listedPiRig;
+  const hasLegacyBridgeScaffold = !hasPiRig && (input.exists ?? existsSync)(extensionPath);
   return {
     extensionPath,
     pi: {
       ok: piResult.exitCode === 0,
       label: "pi",
       detail: (piResult.stdout || piResult.stderr).trim() || undefined,
-      hint: piResult.exitCode === 0 ? undefined : "Install Pi or run `rig init --yes` to install/update the Pi runtime."
+      hint: piResult.exitCode === 0 ? undefined : "Install Pi/OMP manually or set RIG_PI_INSTALL_COMMAND before verifying with bare `rig` / Cockpit \u2192 Doctor."
     },
     piRig: {
       ok: hasPiRig,
       label: "pi-rig global extension",
-      detail: hasPiRig ? piListResult.stdout.trim() || PI_RIG_PACKAGE_NAME : legacyBridge ? `${extensionPath} (legacy bridge; reinstall required)` : undefined,
-      hint: hasPiRig ? undefined : "Run `rig init --yes` to install/enable the global pi-rig package with `pi install`."
+      detail: hasPiRig ? piListResult.stdout.trim() || PI_RIG_PACKAGE_NAME : hasLegacyBridgeScaffold ? `legacy bridge scaffold at ${extensionPath}` : undefined,
+      hint: hasPiRig ? undefined : `Install the Rig OMP extension with \`pi install ${PI_RIG_PACKAGE_NAME}\`, then verify with bare \`rig\` / Cockpit \u2192 Doctor.`
     }
   };
 }
@@ -179,23 +176,13 @@ async function buildPiSetupChecks(input = {}) {
 }
 
 // packages/cli/src/commands/_doctor-checks.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
-import { resolve as resolve5 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve4 } from "path";
 import { isSupportedBunVersion, MIN_SUPPORTED_BUN_VERSION } from "@rig/runtime/control-plane/setup-version";
 
 // packages/cli/src/commands/_connection-state.ts
-import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { homedir as homedir2 } from "os";
+import { existsSync as existsSync2, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { dirname, resolve as resolve3 } from "path";
-function resolveGlobalConnectionsPath(env = process.env) {
-  const explicit = env.RIG_CONNECTIONS_FILE?.trim();
-  if (explicit)
-    return resolve3(explicit);
-  const stateDir = env.RIG_GLOBAL_STATE_DIR?.trim();
-  if (stateDir)
-    return resolve3(stateDir, "connections.json");
-  return resolve3(homedir2(), ".rig", "connections.json");
-}
 function resolveRepoConnectionPath(projectRoot) {
   return resolve3(projectRoot, ".rig", "state", "connection.json");
 }
@@ -203,45 +190,11 @@ function readJsonFile(path) {
   if (!existsSync2(path))
     return null;
   try {
-    return JSON.parse(readFileSync2(path, "utf8"));
+    return JSON.parse(readFileSync(path, "utf8"));
   } catch (error) {
     throw new CliError(`Invalid Rig connection state at ${path}: ${error instanceof Error ? error.message : String(error)}`, 1, { hint: "Fix or delete that file, then re-select a server with `rig server use <alias|local>`." });
   }
 }
-function writeJsonFile(path, value) {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(value, null, 2)}
-`, "utf8");
-}
-function normalizeConnection(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    return null;
-  const record = value;
-  if (record.kind === "local")
-    return { kind: "local", mode: "auto" };
-  if (record.kind === "remote" && typeof record.baseUrl === "string" && record.baseUrl.trim()) {
-    const baseUrl = record.baseUrl.trim().replace(/\/+$/, "");
-    return { kind: "remote", baseUrl };
-  }
-  return null;
-}
-function readGlobalConnections(options = {}) {
-  const path = resolveGlobalConnectionsPath(options.env ?? process.env);
-  const payload = readJsonFile(path);
-  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
-    return { connections: {} };
-  }
-  const rawConnections = payload.connections;
-  const connections = {};
-  if (rawConnections && typeof rawConnections === "object" && !Array.isArray(rawConnections)) {
-    for (const [alias, raw] of Object.entries(rawConnections)) {
-      const connection = normalizeConnection(raw);
-      if (connection)
-        connections[alias] = connection;
-    }
-  }
-  return { connections };
-}
 function readRepoConnection(projectRoot) {
   const payload = readJsonFile(resolveRepoConnectionPath(projectRoot));
   if (!payload || typeof payload !== "object" || Array.isArray(payload))
@@ -254,247 +207,68 @@ function readRepoConnection(projectRoot) {
     selected,
     project: typeof record.project === "string" ? record.project : undefined,
     linkedAt: typeof record.linkedAt === "string" ? record.linkedAt : undefined,
-    serverProjectRoot: typeof record.serverProjectRoot === "string" && record.serverProjectRoot.trim() ? record.serverProjectRoot.trim() : undefined
+    serverProjectRoot: typeof record.serverProjectRoot === "string" && record.serverProjectRoot.trim() ? record.serverProjectRoot.trim() : undefined,
+    serverProjectRootAlias: typeof record.serverProjectRootAlias === "string" && record.serverProjectRootAlias.trim() ? record.serverProjectRootAlias.trim() : undefined,
+    serverProjectRootBaseUrl: typeof record.serverProjectRootBaseUrl === "string" && record.serverProjectRootBaseUrl.trim() ? record.serverProjectRootBaseUrl.trim().replace(/\/+$/, "") : undefined
   };
 }
-function writeRepoConnection(projectRoot, state) {
-  writeJsonFile(resolveRepoConnectionPath(projectRoot), state);
-}
-function resolveSelectedConnection(projectRoot, options = {}) {
-  const repo = readRepoConnection(projectRoot);
-  if (!repo)
-    return null;
-  if (repo.selected === "local")
-    return { alias: "local", connection: { kind: "local", mode: "auto" }, serverProjectRoot: repo.serverProjectRoot };
-  const global = readGlobalConnections(options);
-  const connection = global.connections[repo.selected];
-  if (!connection) {
-    throw new CliError(`Selected Rig server "${repo.selected}" was not found. Run \`rig server list\` or \`rig server use local\`.`, 1);
-  }
-  return { alias: repo.selected, connection, serverProjectRoot: repo.serverProjectRoot };
-}
-function writeRepoServerProjectRoot(projectRoot, serverProjectRoot) {
-  const repo = readRepoConnection(projectRoot);
-  if (!repo)
-    return;
-  writeRepoConnection(projectRoot, { ...repo, serverProjectRoot });
-}
 
-// packages/cli/src/commands/_server-client.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { resolve as resolve4 } from "path";
-import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
+// packages/cli/src/commands/_inprocess-services.ts
+import {
+  beginGitHubDeviceFlow,
+  checkGitHubRepoPermissions,
+  createGitHubAuthStore,
+  listGitHubProjects,
+  pollGitHubDeviceFlow,
+  resolveGitHubAuthStatus,
+  resolveProjectStatusField,
+  saveGitHubTokenForProject
+} from "@rig/runtime/control-plane/github/index";
 var scopedGitHubBearerTokens = new Map;
-var serverPhaseListener = null;
-function setServerPhaseListener(listener) {
-  const previous = serverPhaseListener;
-  serverPhaseListener = listener;
-  return previous;
-}
-function reportServerPhase(label) {
-  serverPhaseListener?.(label);
-}
 function cleanToken(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
 }
-function readPrivateRemoteSessionToken(projectRoot) {
-  const path = resolve4(projectRoot, ".rig", "state", "github-auth.json");
-  if (!existsSync3(path))
-    return null;
-  try {
-    const parsed = JSON.parse(readFileSync3(path, "utf8"));
-    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
-  } catch {
-    return null;
-  }
-}
-function readGitHubBearerTokenForRemote(projectRoot) {
-  const scopedKey = resolve4(projectRoot);
-  if (scopedGitHubBearerTokens.has(scopedKey))
-    return scopedGitHubBearerTokens.get(scopedKey) ?? null;
-  const privateSession = readPrivateRemoteSessionToken(projectRoot);
-  if (privateSession)
-    return privateSession;
-  return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
-}
-function readStoredGitHubAuthToken(projectRoot) {
-  const path = resolve4(projectRoot, ".rig", "state", "github-auth.json");
-  if (!existsSync3(path))
-    return null;
-  try {
-    const parsed = JSON.parse(readFileSync3(path, "utf8"));
-    return cleanToken(typeof parsed.token === "string" ? parsed.token : undefined);
-  } catch {
-    return null;
-  }
-}
-function readLocalConnectionFallbackToken(projectRoot) {
-  return readGitHubBearerTokenForRemote(projectRoot) ?? cleanToken(process.env.RIG_GITHUB_TOKEN) ?? readStoredGitHubAuthToken(projectRoot);
-}
-async function ensureServerForCli(projectRoot) {
-  try {
-    const selected = resolveSelectedConnection(projectRoot);
-    if (selected?.connection.kind === "remote") {
-      reportServerPhase(`Connecting to ${selected.alias}\u2026`);
-      const authToken = readGitHubBearerTokenForRemote(projectRoot);
-      const serverProjectRoot = selected.serverProjectRoot ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
-      return {
-        baseUrl: selected.connection.baseUrl,
-        authToken,
-        connectionKind: "remote",
-        serverProjectRoot
-      };
-    }
-    reportServerPhase("Starting local Rig server\u2026");
-    const connection = await ensureLocalRigServerConnection(projectRoot);
-    return {
-      baseUrl: connection.baseUrl,
-      authToken: connection.authToken ?? readLocalConnectionFallbackToken(projectRoot),
-      connectionKind: "local",
-      serverProjectRoot: resolve4(projectRoot)
-    };
-  } catch (error) {
-    if (error instanceof Error) {
-      throw new CliError(error.message, 1);
-    }
-    throw error;
-  }
-}
-async function backfillRemoteServerProjectRoot(projectRoot, baseUrl, authToken) {
-  const repo = readRepoConnection(projectRoot);
-  const slug = repo?.project?.trim();
-  if (!slug)
-    return null;
-  try {
-    const response = await fetch(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`, {
-      headers: mergeHeaders(undefined, authToken)
+function cleanString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function oauthClientId() {
+  return cleanToken(process.env.RIG_GITHUB_OAUTH_CLIENT_ID);
+}
+async function getGitHubAuthStatusInProcess(context) {
+  return { ok: true, ...resolveGitHubAuthStatus({ projectRoot: context.projectRoot, oauthConfigured: Boolean(oauthClientId()) }) };
+}
+async function requestGitHubAuthJsonInProcess(context, pathname, init = {}) {
+  const method = (init.method ?? "GET").toUpperCase();
+  if (pathname === "/api/github/auth/status")
+    return getGitHubAuthStatusInProcess(context);
+  if (pathname === "/api/github/repo/permissions") {
+    return checkGitHubRepoPermissions({ projectRoot: context.projectRoot, oauthConfigured: Boolean(oauthClientId()) });
+  }
+  if (pathname === "/api/github/auth/device/start" && method === "POST") {
+    const clientId = oauthClientId();
+    if (!clientId)
+      return { ok: false, oauthConfigured: false, error: "RIG_GITHUB_OAUTH_CLIENT_ID is not configured." };
+    const body = init.body ? JSON.parse(String(init.body)) : {};
+    return beginGitHubDeviceFlow({
+      projectRoot: context.projectRoot,
+      clientId,
+      scope: cleanString(body.scope) ?? undefined,
+      selectedRepo: cleanString(body.repoSlug)
     });
-    if (!response.ok)
-      return null;
-    const payload = await response.json();
-    const project = payload.project && typeof payload.project === "object" && !Array.isArray(payload.project) ? payload.project : null;
-    const checkouts = Array.isArray(project?.checkouts) ? project.checkouts : [];
-    const latestCheckout = [...checkouts].reverse().find((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry) && typeof entry.path === "string"));
-    const path = typeof latestCheckout?.path === "string" && latestCheckout.path.trim() ? latestCheckout.path.trim() : null;
-    if (path)
-      writeRepoServerProjectRoot(projectRoot, path);
-    return path;
-  } catch {
-    return null;
   }
-}
-function mergeHeaders(headers, authToken) {
-  const merged = new Headers(headers);
-  if (authToken) {
-    merged.set("authorization", `Bearer ${authToken}`);
+  if (pathname === "/api/github/auth/device/poll" && method === "POST") {
+    const clientId = oauthClientId();
+    if (!clientId)
+      return { ok: false, oauthConfigured: false, error: "RIG_GITHUB_OAUTH_CLIENT_ID is not configured." };
+    const body = init.body ? JSON.parse(String(init.body)) : {};
+    const pollId = cleanString(body.pollId);
+    if (!pollId)
+      return { ok: false, status: "error", error: "pollId is required" };
+    return pollGitHubDeviceFlow({ projectRoot: context.projectRoot, clientId, pollId, selectedRepo: cleanString(body.repoSlug) });
   }
-  return merged;
+  throw new Error(`No in-process GitHub auth API for ${method} ${pathname}`);
 }
-function diagnosticMessage(payload) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
-    return null;
-  const record = payload;
-  const diagnostics = Array.isArray(record.diagnostics) ? record.diagnostics : [];
-  const messages = diagnostics.flatMap((entry) => {
-    if (!entry || typeof entry !== "object" || Array.isArray(entry))
-      return [];
-    const diagnostic = entry;
-    const kind = typeof diagnostic.kind === "string" ? diagnostic.kind : "task-source";
-    const message = typeof diagnostic.message === "string" ? diagnostic.message : null;
-    return message ? [`${kind}: ${message}`] : [];
-  });
-  return messages.length > 0 ? messages.join("; ") : null;
-}
-var serverReachabilityCache = new Map;
-async function probeServerReachability(baseUrl, authToken) {
-  try {
-    const response = await fetch(`${baseUrl.replace(/\/+$/, "")}/api/server/status`, {
-      headers: mergeHeaders(undefined, authToken),
-      signal: AbortSignal.timeout(1500)
-    });
-    return response.ok;
-  } catch {
-    return false;
-  }
-}
-function cachedServerReachability(projectRoot, baseUrl, authToken) {
-  const key = resolve4(projectRoot);
-  const cached = serverReachabilityCache.get(key);
-  if (cached)
-    return cached;
-  const probe = probeServerReachability(baseUrl, authToken);
-  serverReachabilityCache.set(key, probe);
-  return probe;
-}
-function describeSelectedServer(projectRoot, server) {
-  try {
-    const selected = resolveSelectedConnection(projectRoot);
-    if (selected) {
-      return {
-        alias: selected.alias,
-        target: selected.connection.kind === "remote" ? selected.connection.baseUrl : server.baseUrl
-      };
-    }
-  } catch {}
-  return { alias: server.connectionKind === "remote" ? "remote" : "local", target: server.baseUrl };
-}
-async function buildServerFailureContext(projectRoot, server) {
-  const { alias, target } = describeSelectedServer(projectRoot, server);
-  const reachable = await cachedServerReachability(projectRoot, server.baseUrl, server.authToken);
-  const reachability = reachable ? "server is reachable" : "server is unreachable";
-  return {
-    contextLine: `Currently connected to: ${alias} at ${target} (${reachability}).`,
-    hint: "Check the selected server with `rig server status`, or switch with `rig server use <alias|local>`."
-  };
-}
-async function requestServerJson(context, pathname, init = {}) {
-  const server = await ensureServerForCli(context.projectRoot);
-  const headers = mergeHeaders(init.headers, server.authToken);
-  if (server.serverProjectRoot)
-    headers.set("x-rig-project-root", server.serverProjectRoot);
-  reportServerPhase(`${(init.method ?? "GET").toUpperCase()} ${pathname.split("?")[0]}\u2026`);
-  let response;
-  try {
-    response = await fetch(`${server.baseUrl}${pathname}`, {
-      ...init,
-      headers
-    });
-  } catch (error) {
-    const failure = await buildServerFailureContext(context.projectRoot, server);
-    throw new CliError(`Rig server request failed: ${error instanceof Error ? error.message : String(error)}
-${failure.contextLine}`, 1, { hint: failure.hint });
-  }
-  const text = await response.text();
-  const payload = text.trim().length > 0 ? (() => {
-    try {
-      return JSON.parse(text);
-    } catch {
-      return null;
-    }
-  })() : null;
-  if (!response.ok) {
-    const diagnostics = diagnosticMessage(payload);
-    const rawDetail = diagnostics ?? (text || response.statusText);
-    const detail = diagnostics ? rawDetail : rawDetail.split(`
-`).map((line) => line.trim()).find((line) => line.length > 0)?.slice(0, 200) ?? response.statusText;
-    const failure = await buildServerFailureContext(context.projectRoot, server);
-    throw new CliError(`Rig server request failed (${response.status}): ${detail}
-${failure.contextLine}`, 1, { hint: failure.hint });
-  }
-  return payload;
-}
-var RESUMABLE_RUN_STATUSES = new Set([
-  "created",
-  "preparing",
-  "running",
-  "validating",
-  "reviewing",
-  "stopped",
-  "failed",
-  "needs-attention",
-  "needs_attention"
-]);
 
 // packages/cli/src/commands/_doctor-checks.ts
 function check(id, label, status, detail, remediation) {
@@ -515,31 +289,14 @@ function isAuthenticated(payload) {
   const record = payload;
   return record.signedIn === true || record.authenticated === true || record.status === "authenticated" || record.ok === true && typeof record.login === "string" && record.login.trim().length > 0;
 }
-function repoSlugFromConfig(config) {
-  const project = config?.project;
-  if (project && typeof project === "object" && !Array.isArray(project)) {
-    const record = project;
-    if (typeof record.repo === "string" && /^([^/\s]+)\/([^/\s]+)$/.test(record.repo))
-      return record.repo;
-    if (typeof record.name === "string" && /^([^/\s]+)\/([^/\s]+)$/.test(record.name))
-      return record.name;
-  }
-  const taskSource = config?.taskSource;
-  if (taskSource && typeof taskSource === "object" && !Array.isArray(taskSource)) {
-    const source = taskSource;
-    if (typeof source.owner === "string" && typeof source.repo === "string")
-      return `${source.owner}/${source.repo}`;
-  }
-  return null;
-}
 function loadFallbackConfig(projectRoot) {
   const candidates = ["rig.config.ts", "rig.config.mts", "rig.config.json"];
   for (const name of candidates) {
-    const path = resolve5(projectRoot, name);
-    if (!existsSync4(path))
+    const path = resolve4(projectRoot, name);
+    if (!existsSync3(path))
       continue;
     try {
-      const source = readFileSync4(path, "utf8");
+      const source = readFileSync2(path, "utf8");
       if (name.endsWith(".json"))
         return JSON.parse(source);
       const owner = source.match(/owner\s*:\s*["']([^"']+)["']/)?.[1];
@@ -558,14 +315,11 @@ function loadFallbackConfig(projectRoot) {
   }
   return null;
 }
-function projectStatusSlug(projectRoot, config) {
-  return readRepoConnection(projectRoot)?.project ?? repoSlugFromConfig(config);
-}
 function githubProjectsCheck(config) {
   const github = config?.github;
   const projects = github?.projects;
   if (!projects?.enabled) {
-    return check("github-projects", "GitHub Projects status sync", "warn", "disabled or not configured", "Run `rig init --github-project <project>` or configure github.projects when Project status sync should be authoritative.");
+    return check("github-projects", "GitHub Projects status sync", "warn", "disabled or not configured", "Current OMP flow does not require GitHub Projects status sync; configure github.projects manually when Project status sync should be authoritative.");
   }
   if (projects.projectId && projects.statusFieldId) {
     return check("github-projects", "GitHub Projects status sync", "pass", `project ${projects.projectId}`);
@@ -590,16 +344,6 @@ function permissionAllowsPr(payload) {
   }
   return null;
 }
-function labelsReady(payload) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
-    return null;
-  const record = payload;
-  if (record.ok === true || record.ready === true || record.labelsReady === true)
-    return true;
-  if (record.ok === false || record.ready === false || record.labelsReady === false)
-    return false;
-  return null;
-}
 function prMergeCheck(config) {
   const pr = config?.pr;
   const merge = config?.merge;
@@ -613,7 +357,7 @@ async function runRigDoctorChecks(options) {
   const checks = [];
   const which = options.which ?? ((binary) => Bun.which(binary));
   const bunVersion = options.bunVersion ?? Bun.version;
-  const request = options.requestJson ?? ((pathname, init) => requestServerJson({ projectRoot }, pathname, init));
+  const request = options.requestJson ?? ((pathname, init) => requestGitHubAuthJsonInProcess({ projectRoot }, pathname, init));
   const loadConfig = options.loadConfig ?? loadRigConfigOrNull;
   const progress = options.onProgress ?? (() => {});
   progress("Checking local toolchain\u2026");
@@ -621,78 +365,26 @@ async function runRigDoctorChecks(options) {
   progress("Loading rig.config\u2026");
   const loadedConfig = await loadConfig(projectRoot).catch(() => null);
   const config = loadedConfig ?? loadFallbackConfig(projectRoot);
-  const hasConfigFile = ["rig.config.ts", "rig.config.mts", "rig.config.json"].some((name) => existsSync4(resolve5(projectRoot, name)));
-  checks.push(config ? check("config", "rig.config loadable", "pass") : check("config", "rig.config loadable", hasConfigFile ? "fail" : "fail", hasConfigFile ? "config file exists but failed to load" : "missing rig.config.ts/json", "Run `rig init` or fix the config error."));
+  const hasConfigFile = ["rig.config.ts", "rig.config.mts", "rig.config.json"].some((name) => existsSync3(resolve4(projectRoot, name)));
+  checks.push(config ? check("config", "rig.config loadable", "pass") : check("config", "rig.config loadable", hasConfigFile ? "fail" : "fail", hasConfigFile ? "config file exists but failed to load" : "missing rig.config.ts/json", "Create/fix rig.config.ts or use the OMP cockpit Start tab to scaffold one."));
   const taskSourceKind = config?.taskSource?.kind;
   checks.push(taskSourceKind ? check("task-source", "task source configured", "pass", taskSourceKind) : check("task-source", "task source configured", "fail", "missing taskSource", "Configure taskSource in rig.config.ts."));
   const repo = readRepoConnection(projectRoot);
-  checks.push(repo ? check("project-link", "repo selected Rig server", repo.project ? "pass" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : ""}`, "Run `rig init --yes --repo owner/repo` to link this checkout to a GitHub repo slug.") : check("project-link", "repo selected Rig server", "fail", "missing .rig/state/connection.json", "Run `rig init` or `rig server use <alias|local>`."));
-  const selected = (() => {
-    try {
-      return resolveSelectedConnection(projectRoot);
-    } catch {
-      return null;
-    }
-  })();
-  checks.push(selected ? check("connection", "selected server connection", "pass", selected.connection.kind === "remote" ? selected.connection.baseUrl : "local auto") : check("connection", "selected server", repo ? "fail" : "warn", repo ? "selected alias is missing" : "will auto-start local server", repo ? "Run `rig server list` and `rig server use <alias|local>`." : undefined));
-  let server = null;
+  checks.push(repo ? check("project-link", "repo selected for local setup", repo.project ? "pass" : "warn", `${repo.selected}${repo.project ? ` -> ${repo.project}` : ""}`, "Run `rig init --repo owner/repo` if this project should use GitHub Issues.") : check("project-link", "repo selected for local setup", "warn", "missing .rig/state/connection.json", "Current UX can run without this compatibility file; `rig init` recreates it for GitHub-backed projects."));
   try {
-    progress("Connecting to the selected Rig server\u2026");
-    server = await (options.resolveServer ?? ensureServerForCli)(projectRoot);
-    checks.push(check("server", "Rig server reachable", "pass", `${server.connectionKind} ${server.baseUrl}`));
+    progress("Checking GitHub auth\u2026");
+    const auth = await request("/api/github/auth/status");
+    checks.push(isAuthenticated(auth) ? check("github-auth", "GitHub auth", "pass") : check("github-auth", "GitHub auth", "fail", "not authenticated", "Run `rig github auth import-gh` or `rig github auth token --token <token>`."));
   } catch (error) {
-    checks.push(check("server", "Rig server reachable", "fail", errorMessage(error), "Start the local Rig server or fix the selected remote connection."));
+    checks.push(check("github-auth", "GitHub auth", "fail", errorMessage(error), "Authenticate GitHub through Rig."));
   }
-  if (server || options.requestJson) {
-    try {
-      progress("Checking server status\u2026");
-      const status = await request("/api/server/status");
-      checks.push(check("server-status", "server project status", "pass", JSON.stringify(status).slice(0, 180)));
-    } catch (error) {
-      checks.push(check("server-status", "server project status", "fail", errorMessage(error), "Run `rig doctor` after the selected server is reachable."));
-    }
-    try {
-      progress("Checking GitHub auth\u2026");
-      const auth = await request("/api/github/auth/status");
-      checks.push(isAuthenticated(auth) ? check("github-auth", "GitHub auth", "pass") : check("github-auth", "GitHub auth", "fail", "not authenticated", "Run `rig github auth import-gh` or `rig github auth token --token <token>`."));
-    } catch (error) {
-      checks.push(check("github-auth", "GitHub auth", "fail", errorMessage(error), "Authenticate GitHub through Rig and ensure the server exposes auth status."));
-    }
-    try {
-      progress("Checking GitHub repo permissions\u2026");
-      const permissions = await request("/api/github/repo/permissions");
-      const allowed = permissionAllowsPr(permissions);
-      checks.push(allowed === true ? check("github-repo-permissions", "GitHub repo PR permissions", "pass", JSON.stringify(permissions).slice(0, 180)) : allowed === false ? check("github-repo-permissions", "GitHub repo PR permissions", "fail", JSON.stringify(permissions).slice(0, 180), "Grant the selected GitHub token permission to push branches, open PRs, and merge according to repo rules.") : check("github-repo-permissions", "GitHub repo PR permissions", "warn", JSON.stringify(permissions).slice(0, 180), "Confirm the selected token can push branches and open PRs."));
-    } catch (error) {
-      checks.push(check("github-repo-permissions", "GitHub repo PR permissions", "warn", errorMessage(error), "Ensure the server exposes repo permission checks and the token can open PRs."));
-    }
-    try {
-      progress("Checking GitHub issue labels\u2026");
-      const labels = await request("/api/workspace/task-labels");
-      const ready = labelsReady(labels);
-      checks.push(ready === false ? check("task-labels", "GitHub issue labels", "fail", JSON.stringify(labels).slice(0, 180), "Let Rig create required labels or create the configured lifecycle labels manually.") : check("task-labels", "GitHub issue labels", ready === true ? "pass" : "warn", JSON.stringify(labels).slice(0, 180), "Confirm required Rig lifecycle labels exist."));
-    } catch (error) {
-      checks.push(check("task-labels", "GitHub issue labels", "warn", errorMessage(error), "Run `rig init`/`rig doctor` after label setup is wired on the server."));
-    }
-    try {
-      progress("Checking task projection\u2026");
-      const projection = await request("/api/workspace/task-projection");
-      checks.push(check("task-projection", "task projection", "pass", JSON.stringify(projection).slice(0, 180)));
-    } catch (error) {
-      checks.push(check("task-projection", "task projection", "warn", errorMessage(error), "Refresh task projection with `rig task list` or fix the task source."));
-    }
-    const slug = projectStatusSlug(projectRoot, config);
-    if (slug) {
-      try {
-        progress("Checking server project checkout\u2026");
-        const project = await request(`/api/projects/${encodeURIComponent(slug)}`);
-        checks.push(check("remote-checkout", "server project checkout", "pass", JSON.stringify(project).slice(0, 180)));
-      } catch (error) {
-        checks.push(check("remote-checkout", "server project checkout", "warn", errorMessage(error), "Run `rig init --yes --repo owner/repo` to register/link the server project checkout."));
-      }
-    } else {
-      checks.push(check("remote-checkout", "server project checkout", "warn", "repo slug unknown", "Set project.repo or run `rig init --repo owner/repo`."));
-    }
+  try {
+    progress("Checking GitHub repo permissions\u2026");
+    const permissions = await request("/api/github/repo/permissions");
+    const allowed = permissionAllowsPr(permissions);
+    checks.push(allowed === true ? check("github-repo-permissions", "GitHub repo PR permissions", "pass", JSON.stringify(permissions).slice(0, 180)) : allowed === false ? check("github-repo-permissions", "GitHub repo PR permissions", "fail", JSON.stringify(permissions).slice(0, 180), "Grant the selected GitHub token permission to push branches, open PRs, and merge according to repo rules.") : check("github-repo-permissions", "GitHub repo PR permissions", "warn", JSON.stringify(permissions).slice(0, 180), "Confirm the selected token can push branches and open PRs."));
+  } catch (error) {
+    checks.push(check("github-repo-permissions", "GitHub repo PR permissions", "warn", errorMessage(error), "Ensure the token can open PRs."));
   }
   if (taskSourceKind === "github-issues") {
     checks.push(check("gh", "gh CLI fallback", which("gh") ? "pass" : "warn", which("gh") ?? undefined, "Install gh for local/dev GitHub fallback operations."));
@@ -706,7 +398,7 @@ async function runRigDoctorChecks(options) {
     hint: errorMessage(error)
   }]);
   for (const pi of piChecks) {
-    checks.push(check(pi.label === "pi" ? "pi" : "pi-rig", pi.label, pi.ok ? "pass" : "warn", pi.detail, pi.hint ?? (pi.ok ? undefined : "Run `rig init --yes` to install/update Pi and enable pi-rig.")));
+    checks.push(check(pi.label === "pi" ? "pi" : "pi-rig", pi.label, pi.ok ? "pass" : "warn", pi.detail, pi.hint ?? (pi.ok ? undefined : "Install Pi/OMP and the Rig extension, then use bare `rig` or Cockpit \u2192 Doctor to verify.")));
   }
   return checks;
 }
@@ -757,7 +449,7 @@ function createTtySpinner(input) {
       output.write("\r\x1B[2K");
   };
   render();
-  const timer = isTty ? setInterval(render, input.intervalMs ?? 120) : null;
+  const timer = isTty ? setInterval(render, input.intervalMs ?? 16) : null;
   return {
     setLabel(next) {
       label = next;
@@ -787,90 +479,20 @@ function createTtySpinner(input) {
   };
 }
 
-// packages/cli/src/app/theme.ts
-var RIG_PALETTE = {
-  ink: "#f2f3f6",
-  ink2: "#aeb0ba",
-  ink3: "#6c6e79",
-  ink4: "#44464f",
-  accent: "#ccff4d",
-  accentDim: "#a9d63f",
-  cyan: "#56d8ff",
-  red: "#ff5d5d",
-  yellow: "#ffd24d"
-};
-function hexToRgb(hex) {
-  const value = hex.replace("#", "");
-  return [
-    Number.parseInt(value.slice(0, 2), 16),
-    Number.parseInt(value.slice(2, 4), 16),
-    Number.parseInt(value.slice(4, 6), 16)
-  ];
-}
-function fg(hex) {
-  const [r, g, b] = hexToRgb(hex);
-  return (text) => `\x1B[38;2;${r};${g};${b}m${text}\x1B[39m`;
-}
-var ink = fg(RIG_PALETTE.ink);
-var ink2 = fg(RIG_PALETTE.ink2);
-var ink3 = fg(RIG_PALETTE.ink3);
-var ink4 = fg(RIG_PALETTE.ink4);
-var accent = fg(RIG_PALETTE.accent);
-var accentDim = fg(RIG_PALETTE.accentDim);
-var cyan = fg(RIG_PALETTE.cyan);
-var red = fg(RIG_PALETTE.red);
-var yellow = fg(RIG_PALETTE.yellow);
-function bold(text) {
-  return `\x1B[1m${text}\x1B[22m`;
-}
-var DRONE_ART = [
-  "  .-=-.                   .-=-.   ",
-  " ( !!! )                 ( !!! )  ",
-  "  '-=-'._               _.'-=-'   ",
-  "        '._           _.'         ",
-  "           '=$$$$$$$=.'           ",
-  "          =$$$$$$$$$$$=           ",
-  "         $$$@@@@@@@@@@$$$         ",
-  "        $$$@@        @@$$$        ",
-  "        $$@    ?     @$$$         ",
-  "        $$$@   '-'   @$$$         ",
-  "        $$$@@        @@$$$        ",
-  "         $$$@@@@@@@@@@$$$         ",
-  "          =$$$$$$$$$$$=           ",
-  "           '=$$$$$$$=.'           ",
-  "        _.'           '._         ",
-  "  .-=-.'                 '.-=-.   ",
-  " ( !!! )                 ( !!! )  ",
-  "  '-=-'                   '-=-'   "
-];
-var EYE_FRAMES = ["@", "o", "."];
-var DRONE_WIDTH = DRONE_ART[0].length;
-var DRONE_HEIGHT = DRONE_ART.length;
-var MICRO_BLADES = ["---", "\\\\\\", "|||", "///"];
-function microDroneFrame(tick) {
-  const blade = MICRO_BLADES[tick % MICRO_BLADES.length];
-  const eye = EYE_FRAMES[Math.floor(tick / 2) % EYE_FRAMES.length];
-  return `(${blade})${eye}(${blade})`;
-}
-var MICRO_DRONE_FRAMES = Array.from({ length: 12 }, (_, index) => microDroneFrame(index));
-function renderMicroDroneFrame(tick) {
-  const blade = MICRO_BLADES[tick % MICRO_BLADES.length];
-  const eye = EYE_FRAMES[Math.floor(tick / 2) % EYE_FRAMES.length];
-  return `${ink4("(")}${cyan(blade)}${ink4(")")}${bold(accent(eye))}${ink4("(")}${cyan(blade)}${ink4(")")}`;
-}
-
 // packages/cli/src/commands/_async-ui.ts
+var FRAMES = ["\u25D0", "\u25D3", "\u25D1", "\u25D2"];
 var DONE_SYMBOL = pc.green("\u25C7");
 var FAIL_SYMBOL = pc.red("\u25A0");
 var activeUpdate = null;
 async function withSpinner(label, work, options = {}) {
   if (options.outputMode === "json") {
-    return work(() => {});
+    return work(() => {
+      return;
+    });
   }
   if (activeUpdate) {
-    const outer = activeUpdate;
-    outer(label);
-    return work(outer);
+    activeUpdate(label);
+    return work(activeUpdate);
   }
   const output = options.output ?? process.stderr;
   const isTty = output.isTTY === true;
@@ -882,26 +504,23 @@ async function withSpinner(label, work, options = {}) {
       lastLabel = next;
     };
     activeUpdate = update2;
-    const previousListener2 = setServerPhaseListener(update2);
     try {
       return await work(update2);
     } finally {
       activeUpdate = null;
-      setServerPhaseListener(previousListener2);
     }
   }
   const spinner = createTtySpinner({
     label,
     output,
-    frames: MICRO_DRONE_FRAMES,
-    styleFrame: (frame) => renderMicroDroneFrame(Math.max(0, MICRO_DRONE_FRAMES.indexOf(frame)))
+    frames: FRAMES,
+    styleFrame: (frame) => pc.cyan(frame)
   });
   const update = (next) => {
     lastLabel = next;
     spinner.setLabel(next);
   };
   activeUpdate = update;
-  const previousListener = setServerPhaseListener(update);
   try {
     const result = await work(update);
     spinner.stop(options.doneLabel ? `${DONE_SYMBOL} ${options.doneLabel}` : undefined);
@@ -911,7 +530,6 @@ async function withSpinner(label, work, options = {}) {
     throw error;
   } finally {
     activeUpdate = null;
-    setServerPhaseListener(previousListener);
   }
 }
 
@@ -983,8 +601,8 @@ function runSetupInit(projectRoot) {
   mkdirSync2(stateDir, { recursive: true });
   mkdirSync2(logsDir, { recursive: true });
   mkdirSync2(artifactsDir, { recursive: true });
-  const failuresPath = resolve6(stateDir, "failed_approaches.md");
-  if (!existsSync5(failuresPath)) {
+  const failuresPath = resolve5(stateDir, "failed_approaches.md");
+  if (!existsSync4(failuresPath)) {
     writeFileSync2(failuresPath, `# Failed Approaches
 
 `, "utf-8");
@@ -996,24 +614,24 @@ async function runSetupCheck(projectRoot, outputMode = "text") {
   console.log(formatDoctorChecks(doctorChecks));
   const failures = countDoctorFailures(doctorChecks);
   if (failures > 0) {
-    throw new CliError(`Setup check failed (${failures} failing doctor check${failures === 1 ? "" : "s"}).`, 1, { hint: "Run `rig doctor` for the full check list with remediations." });
+    throw new CliError(`Setup check failed (${failures} failing doctor check${failures === 1 ? "" : "s"}).`, 1, { hint: "Legacy setup diagnostics failed; for current UX run bare `rig` and open Cockpit \u2192 Doctor for remediation details." });
   }
   return doctorChecks;
 }
 async function runSetupPreflight(projectRoot, outputMode = "text") {
   await runSetupCheck(projectRoot, outputMode);
-  const validationRoot = resolve6(resolveControlPlaneDefinitionRoot(projectRoot), "validation");
-  if (existsSync5(validationRoot)) {
+  const validationRoot = resolve5(resolveControlPlaneDefinitionRoot(projectRoot), "validation");
+  if (existsSync4(validationRoot)) {
     const validators = readdirSync(validationRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory());
     for (const validator of validators) {
-      const script = resolve6(validationRoot, validator.name, "validate.sh");
-      if (existsSync5(script)) {
+      const script = resolve5(validationRoot, validator.name, "validate.sh");
+      if (existsSync4(script)) {
         console.log(`OK: validator script ${script}`);
       }
     }
   }
-  const hooksRoot = resolve6(resolveControlPlaneDefinitionRoot(projectRoot), "hooks");
-  if (existsSync5(hooksRoot)) {
+  const hooksRoot = resolve5(resolveControlPlaneDefinitionRoot(projectRoot), "hooks");
+  if (existsSync4(hooksRoot)) {
     const hooks = readdirSync(hooksRoot).filter((name) => name.endsWith(".sh"));
     for (const hook of hooks) {
       console.log(`OK: hook ${hook}`);