@h-rig/core 0.0.6-alpha.17 → 0.0.6-alpha.170

package/dist/src/agent-role-registry.d.ts

@@ -0,0 +1,4 @@
+import type { AgentRoleRegistration, AgentRoleRegistry } from "@rig/contracts";
+export declare function createAgentRoleRegistry(pluginRoles: readonly AgentRoleRegistration[], configOverrides?: Record<string, {
+    model?: string;
+}>): AgentRoleRegistry;

package/dist/src/agent-role-registry.js

@@ -0,0 +1,27 @@
+// @bun
+// packages/core/src/agent-role-registry.ts
+function createAgentRoleRegistry(pluginRoles, configOverrides) {
+  const map = new Map;
+  for (const r of pluginRoles) {
+    if (map.has(r.id))
+      throw new Error(`agent role already registered: ${r.id}`);
+    const override = configOverrides?.[r.id];
+    const model = override?.model ?? r.defaultModel;
+    if (!model) {
+      throw new Error(`agent role "${r.id}" has no model \u2014 provide defaultModel in plugin or model in config.runtime.agentRoles.${r.id}`);
+    }
+    map.set(r.id, { ...r, model });
+  }
+  return {
+    resolve(id) {
+      const r = map.get(id);
+      if (!r)
+        throw new Error(`agent role not registered: ${id}`);
+      return r;
+    },
+    list: () => Array.from(map.values())
+  };
+}
+export {
+  createAgentRoleRegistry
+};

package/dist/src/authority-paths.d.ts

@@ -0,0 +1,15 @@
+export type AuthorityPaths = {
+    projectRoot: string;
+    harnessRoot: string;
+    runsDir: string;
+    remoteDir: string;
+    stateDir: string;
+    remoteEndpointsPath: string;
+    remoteSecretsPath: string;
+};
+export declare function normalizeOptionalString(value: string | undefined | null): string | null;
+export declare function normalizeOptionalBoolean(value: string | undefined | null, fallback: boolean): boolean;
+export declare function resolveAuthorityPaths(projectRoot: string): AuthorityPaths;
+export declare function resolveAuthorityStateRoot(projectRoot: string): string;
+export declare function resolveAuthorityStateDir(projectRoot: string): string;
+export declare function resolveAuthorityProjectStateDir(projectRoot: string): string;

package/dist/src/authority-paths.js

@@ -0,0 +1,80 @@
+// @bun
+// packages/core/src/authority-paths.ts
+import { existsSync } from "fs";
+import { dirname, resolve } from "path";
+function normalizeOptionalString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+function normalizeOptionalBoolean(value, fallback) {
+  if (typeof value !== "string") {
+    return fallback;
+  }
+  const normalized = value.trim().toLowerCase();
+  if (["1", "true", "yes", "on"].includes(normalized)) {
+    return true;
+  }
+  if (["0", "false", "no", "off"].includes(normalized)) {
+    return false;
+  }
+  return fallback;
+}
+function resolveAuthorityPaths(projectRoot) {
+  const normalizedRoot = resolve(projectRoot);
+  const stateRoot = resolveAuthorityStateRoot(normalizedRoot);
+  const stateDir = resolveAuthorityStateDir(normalizedRoot);
+  return {
+    projectRoot: normalizedRoot,
+    harnessRoot: resolve(normalizedRoot, "rig"),
+    runsDir: resolve(stateRoot, "runs"),
+    remoteDir: resolve(stateRoot, "remote"),
+    stateDir,
+    remoteEndpointsPath: resolve(stateRoot, "remote", "endpoints.toml"),
+    remoteSecretsPath: resolve(stateDir, "remote-secrets.toml")
+  };
+}
+function resolveAuthorityStateRoot(projectRoot) {
+  const normalizedRoot = resolve(projectRoot);
+  const taskWorkspace = normalizeOptionalString(process.env.RIG_TASK_WORKSPACE);
+  if (taskWorkspace) {
+    return resolve(taskWorkspace, ".rig");
+  }
+  const stateDir = normalizeOptionalString(process.env.RIG_STATE_DIR);
+  if (stateDir) {
+    return dirname(resolve(stateDir));
+  }
+  const logsDir = normalizeOptionalString(process.env.RIG_LOGS_DIR);
+  if (logsDir) {
+    return dirname(resolve(logsDir));
+  }
+  const sessionFile = normalizeOptionalString(process.env.RIG_SESSION_FILE);
+  if (sessionFile) {
+    return dirname(dirname(resolve(sessionFile)));
+  }
+  const projectStateRoot = resolve(normalizedRoot, ".rig");
+  if (existsSync(projectStateRoot)) {
+    return projectStateRoot;
+  }
+  return resolve(normalizedRoot, ".rig");
+}
+function resolveAuthorityStateDir(projectRoot) {
+  const explicit = normalizeOptionalString(process.env.RIG_STATE_DIR);
+  if (explicit) {
+    return resolve(explicit);
+  }
+  return resolve(resolveAuthorityStateRoot(projectRoot), "state");
+}
+function resolveAuthorityProjectStateDir(projectRoot) {
+  const explicit = normalizeOptionalString(process.env.RIG_STATE_DIR);
+  if (explicit) {
+    return resolve(explicit);
+  }
+  return resolve(resolve(projectRoot), ".rig", "state");
+}
+export {
+  resolveAuthorityStateRoot,
+  resolveAuthorityStateDir,
+  resolveAuthorityProjectStateDir,
+  resolveAuthorityPaths,
+  normalizeOptionalString,
+  normalizeOptionalBoolean
+};

package/dist/src/baked-secrets.d.ts

@@ -0,0 +1,6 @@
+export type RuntimeSecretKey = "ANTHROPIC_API_KEY" | "OPENAI_API_KEY" | "OPENROUTER_API_KEY" | "AI_REVIEW_MODE" | "AI_REVIEW_PROVIDER" | "GREPTILE_API_BASE" | "GREPTILE_REMOTE" | "GREPTILE_REPOSITORY" | "GREPTILE_CONTEXT_BRANCH" | "GREPTILE_DEFAULT_BRANCH" | "GREPTILE_API_KEY" | "GREPTILE_GITHUB_TOKEN" | "GREPTILE_POLL_ATTEMPTS" | "GREPTILE_POLL_INTERVAL_MS" | "GH_TOKEN" | "GITHUB_TOKEN" | "GITHUB_SSH_KEY" | "AWS_ACCESS_KEY_ID" | "AWS_SECRET_ACCESS_KEY" | "AWS_REGION" | "LINEAR_API_KEY" | "LINEAR_WEBHOOK_SECRET";
+export type RuntimeSecrets = Partial<Record<RuntimeSecretKey, string>>;
+export declare const BAKED_RUNTIME_SECRETS: RuntimeSecrets;
+export declare function resolveRuntimeSecrets(env: Record<string, string | undefined>, baked?: RuntimeSecrets): RuntimeSecrets;
+export declare function loadDotEnvSecrets(projectRoot: string, env?: Record<string, string | undefined>): RuntimeSecrets;
+export declare function secretDefinesFromEnv(env?: Record<string, string | undefined>, projectRoot?: string): Record<string, string>;

package/dist/src/baked-secrets.js

@@ -0,0 +1,121 @@
+// @bun
+// packages/core/src/baked-secrets.ts
+import { existsSync, readFileSync } from "fs";
+import { resolve } from "path";
+var BAKED_RUNTIME_SECRETS = {
+  ANTHROPIC_API_KEY: typeof RIG_BAKED_ANTHROPIC_API_KEY !== "undefined" ? RIG_BAKED_ANTHROPIC_API_KEY : "",
+  OPENAI_API_KEY: typeof RIG_BAKED_OPENAI_API_KEY !== "undefined" ? RIG_BAKED_OPENAI_API_KEY : "",
+  OPENROUTER_API_KEY: typeof RIG_BAKED_OPENROUTER_API_KEY !== "undefined" ? RIG_BAKED_OPENROUTER_API_KEY : "",
+  AI_REVIEW_MODE: typeof RIG_BAKED_AI_REVIEW_MODE !== "undefined" ? RIG_BAKED_AI_REVIEW_MODE : "",
+  AI_REVIEW_PROVIDER: typeof RIG_BAKED_AI_REVIEW_PROVIDER !== "undefined" ? RIG_BAKED_AI_REVIEW_PROVIDER : "",
+  GREPTILE_API_BASE: typeof RIG_BAKED_GREPTILE_API_BASE !== "undefined" ? RIG_BAKED_GREPTILE_API_BASE : "",
+  GREPTILE_REMOTE: typeof RIG_BAKED_GREPTILE_REMOTE !== "undefined" ? RIG_BAKED_GREPTILE_REMOTE : "",
+  GREPTILE_REPOSITORY: typeof RIG_BAKED_GREPTILE_REPOSITORY !== "undefined" ? RIG_BAKED_GREPTILE_REPOSITORY : "",
+  GREPTILE_CONTEXT_BRANCH: typeof RIG_BAKED_GREPTILE_CONTEXT_BRANCH !== "undefined" ? RIG_BAKED_GREPTILE_CONTEXT_BRANCH : "",
+  GREPTILE_DEFAULT_BRANCH: typeof RIG_BAKED_GREPTILE_DEFAULT_BRANCH !== "undefined" ? RIG_BAKED_GREPTILE_DEFAULT_BRANCH : "",
+  GREPTILE_API_KEY: typeof RIG_BAKED_GREPTILE_API_KEY !== "undefined" ? RIG_BAKED_GREPTILE_API_KEY : "",
+  GREPTILE_GITHUB_TOKEN: typeof RIG_BAKED_GREPTILE_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GREPTILE_GITHUB_TOKEN : "",
+  GREPTILE_POLL_ATTEMPTS: typeof RIG_BAKED_GREPTILE_POLL_ATTEMPTS !== "undefined" ? RIG_BAKED_GREPTILE_POLL_ATTEMPTS : "",
+  GREPTILE_POLL_INTERVAL_MS: typeof RIG_BAKED_GREPTILE_POLL_INTERVAL_MS !== "undefined" ? RIG_BAKED_GREPTILE_POLL_INTERVAL_MS : "",
+  GH_TOKEN: typeof RIG_BAKED_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GITHUB_TOKEN : "",
+  GITHUB_TOKEN: typeof RIG_BAKED_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GITHUB_TOKEN : "",
+  GITHUB_SSH_KEY: typeof RIG_BAKED_GITHUB_SSH_KEY !== "undefined" ? RIG_BAKED_GITHUB_SSH_KEY : "",
+  AWS_ACCESS_KEY_ID: typeof RIG_BAKED_AWS_ACCESS_KEY_ID !== "undefined" ? RIG_BAKED_AWS_ACCESS_KEY_ID : "",
+  AWS_SECRET_ACCESS_KEY: typeof RIG_BAKED_AWS_SECRET_ACCESS_KEY !== "undefined" ? RIG_BAKED_AWS_SECRET_ACCESS_KEY : "",
+  AWS_REGION: typeof RIG_BAKED_AWS_REGION !== "undefined" ? RIG_BAKED_AWS_REGION : "",
+  LINEAR_API_KEY: typeof RIG_BAKED_LINEAR_API_KEY !== "undefined" ? RIG_BAKED_LINEAR_API_KEY : "",
+  LINEAR_WEBHOOK_SECRET: typeof RIG_BAKED_LINEAR_WEBHOOK_SECRET !== "undefined" ? RIG_BAKED_LINEAR_WEBHOOK_SECRET : ""
+};
+function resolveRuntimeSecrets(env, baked = BAKED_RUNTIME_SECRETS) {
+  const resolved = {};
+  const keys = new Set([
+    ...Object.keys(BAKED_RUNTIME_SECRETS),
+    ...Object.keys(baked)
+  ]);
+  for (const key of keys) {
+    const envValue = env[key]?.trim();
+    const bakedValue = baked[key]?.trim();
+    if (envValue) {
+      resolved[key] = envValue;
+    } else if (bakedValue) {
+      resolved[key] = bakedValue;
+    }
+  }
+  return resolved;
+}
+function loadDotEnvSecrets(projectRoot, env = process.env) {
+  const dotenvPath = resolve(projectRoot, ".env");
+  if (!existsSync(dotenvPath)) {
+    return {};
+  }
+  const parsed = {};
+  const lines = readFileSync(dotenvPath, "utf-8").split(/\r?\n/);
+  for (const rawLine of lines) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) {
+      continue;
+    }
+    const exportMatch = line.match(/^(?:export\s+)?([A-Z0-9_]+)\s*=\s*(.*)$/);
+    if (!exportMatch) {
+      continue;
+    }
+    const key = exportMatch[1];
+    if (!(key in BAKED_RUNTIME_SECRETS)) {
+      continue;
+    }
+    const value = expandShellValue(exportMatch[2] ?? "", { ...env, ...parsed });
+    if (value) {
+      parsed[key] = value;
+    }
+  }
+  return parsed;
+}
+function secretDefinesFromEnv(env = process.env, projectRoot) {
+  const dotenvSecrets = projectRoot ? loadDotEnvSecrets(projectRoot, env) : {};
+  const resolved = resolveRuntimeSecrets(env, {
+    ...BAKED_RUNTIME_SECRETS,
+    ...dotenvSecrets
+  });
+  return {
+    RIG_BAKED_ANTHROPIC_API_KEY: resolved.ANTHROPIC_API_KEY || "",
+    RIG_BAKED_OPENAI_API_KEY: resolved.OPENAI_API_KEY || "",
+    RIG_BAKED_OPENROUTER_API_KEY: resolved.OPENROUTER_API_KEY || "",
+    RIG_BAKED_AI_REVIEW_MODE: resolved.AI_REVIEW_MODE || "",
+    RIG_BAKED_AI_REVIEW_PROVIDER: resolved.AI_REVIEW_PROVIDER || "",
+    RIG_BAKED_GREPTILE_API_BASE: resolved.GREPTILE_API_BASE || "",
+    RIG_BAKED_GREPTILE_REMOTE: resolved.GREPTILE_REMOTE || "",
+    RIG_BAKED_GREPTILE_REPOSITORY: resolved.GREPTILE_REPOSITORY || "",
+    RIG_BAKED_GREPTILE_CONTEXT_BRANCH: resolved.GREPTILE_CONTEXT_BRANCH || "",
+    RIG_BAKED_GREPTILE_DEFAULT_BRANCH: resolved.GREPTILE_DEFAULT_BRANCH || "",
+    RIG_BAKED_GREPTILE_API_KEY: resolved.GREPTILE_API_KEY || "",
+    RIG_BAKED_GREPTILE_GITHUB_TOKEN: resolved.GREPTILE_GITHUB_TOKEN || "",
+    RIG_BAKED_GREPTILE_POLL_ATTEMPTS: resolved.GREPTILE_POLL_ATTEMPTS || "",
+    RIG_BAKED_GREPTILE_POLL_INTERVAL_MS: resolved.GREPTILE_POLL_INTERVAL_MS || "",
+    RIG_BAKED_GITHUB_TOKEN: resolved.GITHUB_TOKEN || resolved.GH_TOKEN || "",
+    RIG_BAKED_GITHUB_SSH_KEY: resolved.GITHUB_SSH_KEY || "",
+    RIG_BAKED_AWS_ACCESS_KEY_ID: resolved.AWS_ACCESS_KEY_ID || "",
+    RIG_BAKED_AWS_SECRET_ACCESS_KEY: resolved.AWS_SECRET_ACCESS_KEY || "",
+    RIG_BAKED_AWS_REGION: resolved.AWS_REGION || "",
+    RIG_BAKED_LINEAR_API_KEY: resolved.LINEAR_API_KEY || "",
+    RIG_BAKED_LINEAR_WEBHOOK_SECRET: resolved.LINEAR_WEBHOOK_SECRET || ""
+  };
+}
+function expandShellValue(rawValue, env) {
+  let value = rawValue.trim();
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    value = value.slice(1, -1);
+  }
+  return value.replace(/\$\{([A-Z0-9_]+)(:-([^}]*))?\}/g, (_match, name, _defaultGroup, fallback) => {
+    const envValue = env[name]?.trim();
+    if (envValue) {
+      return envValue;
+    }
+    return fallback ?? "";
+  });
+}
+export {
+  secretDefinesFromEnv,
+  resolveRuntimeSecrets,
+  loadDotEnvSecrets,
+  BAKED_RUNTIME_SECRETS
+};

package/dist/src/build-time-config.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Runtime fallback for build-time config.
+ *
+ * Compiled binaries use `build-time-config.macro.ts` with Bun's macro import
+ * (`with { type: "macro" }`) to inline config constants at build time.
+ *
+ * This module provides the same interface for non-compiled execution paths
+ * (e.g. `bun run`, tests, CLI dev mode) where macro expansion does not run.
+ * It reads from the `__RIG_BUILD_CONFIG__` global (if the compiled binary sets
+ * it) and falls back to the `RIG_BUILD_CONFIG_JSON` environment variable.
+ */
+export declare function readBuildConfig(): Record<string, string>;

package/dist/src/build-time-config.js

@@ -0,0 +1,25 @@
+// @bun
+// packages/core/src/build-time-config.ts
+function normalizeBuildConfig(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return {};
+  }
+  return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string"));
+}
+function readBuildConfig() {
+  if (typeof __RIG_BUILD_CONFIG__ !== "undefined") {
+    return normalizeBuildConfig(__RIG_BUILD_CONFIG__);
+  }
+  const raw = process.env.RIG_BUILD_CONFIG_JSON?.trim();
+  if (!raw) {
+    return {};
+  }
+  try {
+    return normalizeBuildConfig(JSON.parse(raw));
+  } catch {
+    return {};
+  }
+}
+export {
+  readBuildConfig
+};

package/dist/src/build-time-config.macro.d.ts

@@ -0,0 +1 @@
+export declare function readBuildConfig(): Record<string, string>;

package/dist/src/capability-loaders.d.ts

@@ -0,0 +1,51 @@
+/**
+ * capability-loaders.ts — generic project-root capability resolution + a typed
+ * installed-capability holder.
+ *
+ * These are the substrate-neutral helpers that the dissolved
+ * `@rig/runtime/control-plane/*-port` modules used to provide. Each per-capability
+ * port (doctor / memory / isolation / browser / provider-instruction /
+ * managed-repo / lifecycle) collapsed into three things that already exist:
+ *
+ *   1. the capability id + interface in `@rig/contracts` (pure vocab),
+ *   2. the `defineCapability(id)` seam in `@rig/core/capability`, and
+ *   3. these two GENERIC helpers — `loadCapabilityForRoot` /
+ *      `requireCapabilityForRoot` plus an installed-singleton holder.
+ *
+ * Consumers resolve a capability off a project's plugin host (or read a
+ * boot-installed singleton) WITHOUT importing any provider plugin, so no
+ * floor->plugin / cross-plugin import cycle is introduced. The single
+ * `unknown -> T` cast for capability resolution still lives once inside
+ * `defineCapability.resolve`; the holder cast below is the lone exception, kept
+ * local to this typed accessor.
+ */
+import type { Capability } from "./capability";
+import type { PluginHost } from "./plugin-host";
+/**
+ * Build a plugin host from a project's rig.config. Returns null when no config
+ * is loadable (legacy projects) so callers can decide their own fallback.
+ */
+export declare function buildProjectPluginHost(projectRoot: string): Promise<PluginHost | null>;
+/**
+ * Resolve a capability off a project root. Returns null when no config loads or
+ * no plugin provides the capability, so callers degrade gracefully.
+ */
+export declare function loadCapabilityForRoot<T>(projectRoot: string, capability: Capability<T>): Promise<T | null>;
+/**
+ * Resolve a capability off a project root, or throw a precise, actionable error
+ * (`message`) when no provider is registered.
+ */
+export declare function requireCapabilityForRoot<T>(projectRoot: string, capability: Capability<T>, message: string): Promise<T>;
+/** Install a resolved capability impl for synchronous cross-package reads. */
+export declare function installCapability<T>(capability: Capability<T>, impl: T): void;
+/** Clear an installed capability impl (test / reset hook). */
+export declare function clearInstalledCapability<T>(capability: Capability<T>): void;
+/** Read a boot-installed capability impl, or null when none is installed. */
+export declare function getInstalledCapability<T>(capability: Capability<T>): T | null;
+/**
+ * Read a boot-installed capability impl, or throw a precise `message` when none
+ * is installed. For synchronous substrate consumers that resolve a capability
+ * the boot wiring installs once (e.g. task-data) and cannot re-resolve a plugin
+ * host on every call.
+ */
+export declare function requireInstalledCapability<T>(capability: Capability<T>, message: string): T;