@h-rig/core 0.0.6-alpha.18 → 0.0.6-alpha.181

package/dist/src/runtime-provisioning-env.js

@@ -0,0 +1,217 @@
+// @bun
+// packages/core/src/runtime-provisioning-env.ts
+import { delimiter, resolve as resolve2 } from "path";
+
+// packages/core/src/runtime-paths.ts
+import { existsSync, readdirSync, realpathSync } from "fs";
+import { resolve } from "path";
+function uniq(values) {
+  return [...new Set(values)];
+}
+function resolveBunBinaryPath() {
+  const explicit = normalizeExecutablePath(process.env.RIG_BUN_PATH?.trim());
+  if (explicit) {
+    return explicit;
+  }
+  const pathBun = normalizeExecutablePath(Bun.which("bun")?.trim());
+  if (pathBun && !looksLikeRuntimeGateway(pathBun)) {
+    return pathBun;
+  }
+  const home = process.env.HOME?.trim();
+  const fallbackCandidates = [
+    home ? resolve(home, ".bun/bin/bun") : "",
+    "/opt/homebrew/bin/bun",
+    "/usr/local/bin/bun",
+    "/usr/bin/bun"
+  ];
+  for (const candidate of fallbackCandidates) {
+    const normalized = normalizeExecutablePath(candidate);
+    if (normalized) {
+      return normalized;
+    }
+  }
+  const execPath = normalizeExecutablePath(process.execPath?.trim());
+  if (execPath && !looksLikeRuntimeGateway(execPath)) {
+    return execPath;
+  }
+  throw new Error("bun not found in PATH");
+}
+function resolveClaudeBinaryPath() {
+  const explicit = normalizeExecutablePath(process.env.RIG_CLAUDE_PATH?.trim());
+  if (explicit) {
+    return explicit;
+  }
+  const pathClaude = normalizeExecutablePath(Bun.which("claude")?.trim());
+  if (pathClaude && !looksLikeRuntimeGateway(pathClaude)) {
+    return pathClaude;
+  }
+  const home = process.env.HOME?.trim();
+  const fallbackCandidates = [
+    home ? resolve(home, ".local/bin/claude") : "",
+    home ? resolve(home, ".local/share/claude/local/claude") : "",
+    "/opt/homebrew/bin/claude",
+    "/usr/local/bin/claude",
+    "/usr/bin/claude"
+  ];
+  for (const candidate of fallbackCandidates) {
+    const normalized = normalizeExecutablePath(candidate);
+    if (normalized) {
+      return normalized;
+    }
+  }
+  throw new Error("claude not found in PATH");
+}
+function resolveBunInstallDir(bunBinaryPath = resolveBunBinaryPath()) {
+  return resolve(bunBinaryPath, "../..");
+}
+function resolveClaudeInstallDir() {
+  const realPath = resolveClaudeBinaryPath();
+  return resolve(realPath, "..");
+}
+function resolveNodeInstallDir() {
+  const preferredNode = resolvePreferredNodeBinary();
+  if (!preferredNode)
+    return null;
+  const explicitNode = process.env.RIG_NODE_BIN?.trim();
+  if (explicitNode && resolve(explicitNode) === resolve(preferredNode)) {
+    return preferredNode.endsWith("/bin/node") ? resolve(preferredNode, "../..") : resolve(preferredNode, "..");
+  }
+  try {
+    const realPath = realpathSync(preferredNode);
+    if (realPath.endsWith("/bin/node")) {
+      return resolve(realPath, "../..");
+    }
+    return resolve(realPath, "..");
+  } catch {
+    return resolve(preferredNode, "..");
+  }
+}
+function resolvePreferredNodeBinary() {
+  const candidates = [];
+  const envNode = process.env.RIG_NODE_BIN?.trim();
+  if (envNode) {
+    const explicit = resolve(envNode);
+    if (existsSync(explicit)) {
+      return explicit;
+    }
+  }
+  const nvmBin = process.env.NVM_BIN?.trim();
+  if (nvmBin) {
+    candidates.push(resolve(nvmBin, "node"));
+  }
+  const home = process.env.HOME?.trim();
+  if (home) {
+    const nvmVersionsDir = resolve(home, ".nvm/versions/node");
+    if (existsSync(nvmVersionsDir)) {
+      try {
+        const versionDirs = readdirSync(nvmVersionsDir).map((entry) => entry.trim()).filter((entry) => /^v\d+\.\d+\.\d+$/.test(entry)).sort((a, b) => Bun.semver.order(b.replace(/^v/, ""), a.replace(/^v/, "")));
+        for (const versionDir of versionDirs) {
+          candidates.push(resolve(nvmVersionsDir, versionDir, "bin/node"));
+        }
+      } catch {}
+    }
+  }
+  const whichNode = Bun.which("node");
+  if (whichNode) {
+    candidates.push(whichNode);
+  }
+  const deduped = uniq(candidates.map((candidate) => resolve(candidate)));
+  const existing = deduped.filter((candidate) => existsSync(candidate));
+  if (existing.length === 0) {
+    return null;
+  }
+  const stable = existing.find((candidate) => {
+    const major = inferNodeMajor(candidate);
+    return typeof major === "number" && major >= 18 && major <= 24;
+  });
+  if (stable) {
+    return stable;
+  }
+  return existing[0] ?? null;
+}
+function inferNodeMajor(nodeBinaryPath) {
+  const normalized = resolve(nodeBinaryPath).replace(/\\/g, "/");
+  const match = normalized.match(/(?:^|\/)(?:node-)?v?(\d+)\.\d+\.\d+(?:\/|$)/);
+  if (!match) {
+    return null;
+  }
+  const major = Number.parseInt(match[1], 10);
+  return Number.isFinite(major) ? major : null;
+}
+function normalizeExecutablePath(candidate) {
+  if (!candidate) {
+    return "";
+  }
+  const normalized = resolve(candidate);
+  if (!existsSync(normalized)) {
+    return "";
+  }
+  try {
+    return realpathSync(normalized);
+  } catch {
+    return normalized;
+  }
+}
+function looksLikeRuntimeGateway(candidate) {
+  const normalized = resolve(candidate).replace(/\\/g, "/");
+  return normalized.includes("/.rig/bin/") || normalized.endsWith("/rig-shell") || normalized.endsWith("/rig-agent");
+}
+
+// packages/core/src/runtime-provisioning-env.ts
+function runtimeProvisioningEnv(baseEnv = process.env) {
+  const env = { ...baseEnv };
+  const realBash = baseEnv.RIG_REAL_BASH?.trim() || "/bin/bash";
+  const bunBinary = baseEnv.RIG_BUN_PATH?.trim() || resolveBunBinaryPath();
+  const bunDir = resolveBunInstallDir(bunBinary);
+  const claudeBinary = baseEnv.RIG_CLAUDE_PATH?.trim() || (() => {
+    try {
+      return resolveClaudeBinaryPath();
+    } catch {
+      return "";
+    }
+  })();
+  const claudeDir = claudeBinary ? (() => {
+    try {
+      return resolveClaudeInstallDir();
+    } catch {
+      return resolve2(claudeBinary, "..");
+    }
+  })() : "";
+  const nodeDir = resolveNodeInstallDir();
+  const realHome = baseEnv.HOME?.trim();
+  const inheritedPath = (baseEnv.PATH ?? "").split(delimiter).map((entry) => entry.trim()).filter(Boolean).filter((entry) => !entry.endsWith("/.rig/bin") && !entry.endsWith("/rig/tools"));
+  const pathEntries = [
+    `${bunDir}/bin`,
+    claudeDir,
+    nodeDir ? `${nodeDir}/bin` : "",
+    realHome ? resolve2(realHome, ".local/bin") : "",
+    realHome ? resolve2(realHome, ".cargo/bin") : "",
+    ...inheritedPath,
+    "/usr/local/bin",
+    "/usr/local/sbin",
+    "/opt/homebrew/bin",
+    "/opt/homebrew/sbin",
+    "/usr/bin",
+    "/bin",
+    "/usr/sbin",
+    "/sbin"
+  ].filter(Boolean);
+  env.BASH = realBash;
+  env.SHELL = baseEnv.SHELL?.trim() || realBash;
+  env.PATH = [...new Set(pathEntries)].join(delimiter);
+  env.RIG_BUN_PATH = bunBinary;
+  if (claudeBinary) {
+    env.RIG_CLAUDE_PATH = claudeBinary;
+  }
+  env.PYTHON = env.PYTHON?.trim() || "python3";
+  const nodeGypPath = Bun.which("node-gyp");
+  if (nodeGypPath) {
+    env.npm_config_node_gyp = nodeGypPath;
+  }
+  delete env.RIG_BASH_ACTIVE;
+  delete env.RIG_BASH_MODE;
+  return env;
+}
+export {
+  runtimeProvisioningEnv
+};

package/dist/src/runtime-runner-context.d.ts

@@ -0,0 +1,12 @@
+import type { CommandExecutionResult, HarnessEventType, OutputMode, PolicyMode } from "@rig/contracts";
+import type { EventBusLike } from "./runtime-events";
+export type RunnerContext = {
+    projectRoot: string;
+    dryRun: boolean;
+    outputMode: OutputMode;
+    runId: string;
+    policyMode?: PolicyMode;
+    eventBus: EventBusLike;
+    emitEvent: <TPayload extends Record<string, unknown>>(type: HarnessEventType, payload: TPayload) => Promise<void>;
+    runCommand: (parts: string[]) => Promise<CommandExecutionResult>;
+};

package/dist/src/runtime-runner-context.js

@@ -0,0 +1 @@
+// @bun

package/dist/src/safe-identifiers.d.ts

@@ -0,0 +1,44 @@
+export type SafePathSegment = string & {
+    readonly __rigSafePathSegment: unique symbol;
+};
+export type SafeGitRefComponent = string & {
+    readonly __rigSafeGitRefComponent: unique symbol;
+};
+export type SafeRunId = string & {
+    readonly __rigSafeRunId: unique symbol;
+};
+/**
+ * Convert an external/display identifier into one deterministic filesystem
+ * segment. The original identifier remains available for UI/source APIs; this
+ * value is only for paths and receives a hash suffix to avoid slug collisions.
+ */
+export declare function safePathSegment(value: string, options?: {
+    fallback?: string;
+    maxLength?: number;
+}): SafePathSegment;
+/**
+ * Derive the canonical runtime id for a task. Floor-neutral because it is shared
+ * by the isolation plugin (provisioning) AND the runtime substrate (agent-wrapper,
+ * task-runtime-start hook) — a `safePathSegment`-based id derive with no domain deps.
+ */
+export declare function taskRuntimeId(taskId: string): string;
+/**
+ * Mint an ephemeral, unique agent/runtime id. Floor-neutral (shared by the
+ * isolation plugin and the runtime substrate's queue) — a random suffix derive.
+ */
+export declare function agentId(prefix?: string): string;
+/**
+ * Convert an arbitrary external identifier into a single git ref component.
+ * This is for constructed refs such as `rig/<component>`, not for accepting an
+ * operator-supplied complete branch name.
+ */
+export declare function safeGitRefComponent(value: string, options?: {
+    fallback?: string;
+    maxLength?: number;
+}): SafeGitRefComponent;
+export declare function isSafeRunId(value: string): boolean;
+export declare function assertSafeRunId(value: string): SafeRunId;
+export declare function isSafeGitBranchName(value: string): boolean;
+export declare function assertSafeGitBranchName(value: string, label?: string): string;
+export declare function isPathInsideRoot(root: string, candidate: string): boolean;
+export declare function assertPathInsideRoot(root: string, candidate: string, label?: string): string;

package/dist/src/safe-identifiers.js

@@ -0,0 +1,96 @@
+// @bun
+// packages/core/src/safe-identifiers.ts
+import { createHash, randomUUID } from "crypto";
+import { isAbsolute, relative, resolve } from "path";
+var MAX_SEGMENT_LENGTH = 80;
+var MAX_RUN_ID_LENGTH = 128;
+function hashSuffix(value, length = 10) {
+  return createHash("sha256").update(value).digest("hex").slice(0, length);
+}
+function asciiSlug(value, fallback) {
+  return value.normalize("NFKD").replace(/[\u0300-\u036f]/g, "").trim().replace(/[^A-Za-z0-9._-]+/g, "-").replace(/[.]{2,}/g, ".").replace(/^[.-]+|[.-]+$/g, "") || fallback;
+}
+function trimWithHash(base, original, maxLength) {
+  const suffix = hashSuffix(original);
+  const prefixLength = Math.max(1, maxLength - suffix.length - 1);
+  const prefix = base.slice(0, prefixLength).replace(/[.-]+$/g, "") || "id";
+  return `${prefix}-${suffix}`;
+}
+function safePathSegment(value, options = {}) {
+  const original = String(value);
+  const trimmed = original.trim();
+  const fallback = asciiSlug(options.fallback ?? "id", "id");
+  const slug = asciiSlug(original, fallback);
+  const maxLength = Math.max(24, Math.trunc(options.maxLength ?? MAX_SEGMENT_LENGTH));
+  if (trimmed === slug && slug.length <= maxLength && /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(slug) && slug !== "." && slug !== "..") {
+    return slug;
+  }
+  return trimWithHash(slug, original, maxLength);
+}
+function taskRuntimeId(taskId) {
+  return `task-${safePathSegment(taskId, { fallback: "task", maxLength: 72 })}`;
+}
+function agentId(prefix = "agent") {
+  return `${prefix}-${randomUUID().slice(0, 8)}`;
+}
+function safeGitRefComponent(value, options = {}) {
+  const segment = safePathSegment(value, { fallback: options.fallback ?? "ref", maxLength: options.maxLength ?? MAX_SEGMENT_LENGTH });
+  const safe = String(segment).replace(/\.lock$/i, "-lock").replace(/@\{/g, "-").replace(/^[.-]+|[.-]+$/g, "") || `ref-${hashSuffix(value)}`;
+  return safe.slice(0, Math.max(24, Math.trunc(options.maxLength ?? MAX_SEGMENT_LENGTH)));
+}
+function isSafeRunId(value) {
+  const trimmed = value.trim();
+  return trimmed.length > 0 && trimmed.length <= MAX_RUN_ID_LENGTH && trimmed !== "." && trimmed !== ".." && !trimmed.startsWith("-") && !trimmed.includes("/") && !trimmed.includes("\\") && !trimmed.includes("\x00") && !/[\x00-\x1F\x7F]/.test(trimmed) && /^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(trimmed);
+}
+function assertSafeRunId(value) {
+  if (!isSafeRunId(value)) {
+    throw new Error("Invalid runId: expected a single safe identifier segment.");
+  }
+  return value.trim();
+}
+function isSafeGitBranchName(value) {
+  const ref = value.trim();
+  if (!ref || ref.length > 255)
+    return false;
+  if (ref.startsWith("-") || ref.startsWith("/") || ref.endsWith("/") || ref.endsWith("."))
+    return false;
+  if (ref.includes("..") || ref.includes("@{") || ref.includes("\\") || ref.includes("//"))
+    return false;
+  if (/[\x00-\x20\x7F~^:?*[\]]/.test(ref))
+    return false;
+  if (ref.split("/").some((part) => !part || part === "." || part === ".." || part.startsWith(".") || part.endsWith(".lock")))
+    return false;
+  return true;
+}
+function assertSafeGitBranchName(value, label = "git branch") {
+  const ref = value.trim();
+  if (!isSafeGitBranchName(ref)) {
+    throw new Error(`${label} is not a safe git branch name.`);
+  }
+  return ref;
+}
+function isPathInsideRoot(root, candidate) {
+  const safeRoot = resolve(root);
+  const resolvedCandidate = resolve(candidate);
+  const relativeToRoot = relative(safeRoot, resolvedCandidate);
+  return relativeToRoot === "" || !relativeToRoot.startsWith("..") && !isAbsolute(relativeToRoot);
+}
+function assertPathInsideRoot(root, candidate, label = "path") {
+  const resolvedCandidate = resolve(candidate);
+  if (!isPathInsideRoot(root, resolvedCandidate)) {
+    throw new Error(`${label} escapes root.`);
+  }
+  return resolvedCandidate;
+}
+export {
+  taskRuntimeId,
+  safePathSegment,
+  safeGitRefComponent,
+  isSafeRunId,
+  isSafeGitBranchName,
+  isPathInsideRoot,
+  assertSafeRunId,
+  assertSafeGitBranchName,
+  assertPathInsideRoot,
+  agentId
+};

package/dist/src/scope-rules.d.ts

@@ -0,0 +1,4 @@
+import type { ScopeNormalizationRules } from "@rig/contracts";
+export declare function setScopeRules(rules: ScopeNormalizationRules | undefined | null): void;
+export declare function getScopeRules(): ScopeNormalizationRules | null;
+export declare function clearScopeRules(): void;

package/dist/src/scope-rules.js

@@ -0,0 +1,21 @@
+// @bun
+// packages/core/src/scope-rules.ts
+var SCOPE_RULES_KEY = Symbol.for("rig.scope-normalization-rules");
+function scopeRulesState() {
+  const global = globalThis;
+  return global[SCOPE_RULES_KEY] ??= { rules: null };
+}
+function setScopeRules(rules) {
+  scopeRulesState().rules = rules ?? null;
+}
+function getScopeRules() {
+  return scopeRulesState().rules;
+}
+function clearScopeRules() {
+  scopeRulesState().rules = null;
+}
+export {
+  setScopeRules,
+  getScopeRules,
+  clearScopeRules
+};

package/dist/src/server-paths.d.ts

@@ -0,0 +1,22 @@
+export { normalizeOptionalString, normalizeOptionalBoolean, resolveAuthorityPaths, resolveAuthorityStateRoot, resolveAuthorityStateDir, resolveAuthorityProjectStateDir, } from "./authority-paths";
+export type { AuthorityPaths } from "./authority-paths";
+export type RigStatePaths = {
+    readonly stateRoot: string;
+    readonly stateDir: string;
+    readonly logsDir: string;
+    readonly controlPlaneEventsFile: string;
+    readonly notificationsFile: string;
+    readonly keybindingsPath: string;
+};
+declare function isPathWithin(root: string, candidate: string): boolean;
+export declare function resolveRigStatePaths(projectRoot: string): RigStatePaths;
+export declare function resolveRigProjectRoot(input?: {
+    readonly envProjectRoot?: string | null;
+    readonly cwd?: string;
+    readonly fallbackRoot?: string;
+}): string;
+export declare function resolveAuthorityRuntimeDir(projectRoot: string): string;
+export declare function listAuthorityRunRoots(projectRoot: string): string[];
+export declare function listAuthorityRuntimeAgentsRoots(projectRoot: string): string[];
+export declare function resolveAuthorityRunDir(projectRoot: string, runId: string): string;
+export { isPathWithin };

package/dist/src/server-paths.js

@@ -0,0 +1,219 @@
+// @bun
+// packages/core/src/server-paths.ts
+import { existsSync as existsSync3 } from "fs";
+import { dirname as dirname3, resolve as resolve3, relative } from "path";
+
+// packages/core/src/layout.ts
+import {
+  RIG_DEFINITION_DIRNAME,
+  RIG_STATE_DIRNAME
+} from "@rig/contracts";
+
+// packages/core/src/checkout-root.ts
+import { dirname, resolve } from "path";
+import { existsSync } from "fs";
+function findNearestGitCheckoutRoot(startDir) {
+  let current = resolve(startDir);
+  for (;; ) {
+    if (existsSync(resolve(current, ".git")))
+      return current;
+    const parent = dirname(current);
+    if (parent === current)
+      return null;
+    current = parent;
+  }
+}
+function resolveCheckoutRoot(projectRoot) {
+  const normalizedProjectRoot = resolve(projectRoot);
+  const explicit = process.env.MONOREPO_ROOT?.trim();
+  if (explicit) {
+    const explicitRoot = resolve(explicit);
+    const gitRoot = findNearestGitCheckoutRoot(explicitRoot);
+    if (gitRoot)
+      return gitRoot;
+    throw new Error(`MONOREPO_ROOT points to ${explicitRoot}, but no git checkout was found there or above it.`);
+  }
+  return findNearestGitCheckoutRoot(normalizedProjectRoot) ?? normalizedProjectRoot;
+}
+
+// packages/core/src/layout.ts
+var resolveMonorepoRoot = resolveCheckoutRoot;
+
+// packages/core/src/safe-identifiers.ts
+var MAX_RUN_ID_LENGTH = 128;
+function isSafeRunId(value) {
+  const trimmed = value.trim();
+  return trimmed.length > 0 && trimmed.length <= MAX_RUN_ID_LENGTH && trimmed !== "." && trimmed !== ".." && !trimmed.startsWith("-") && !trimmed.includes("/") && !trimmed.includes("\\") && !trimmed.includes("\x00") && !/[\x00-\x1F\x7F]/.test(trimmed) && /^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(trimmed);
+}
+function assertSafeRunId(value) {
+  if (!isSafeRunId(value)) {
+    throw new Error("Invalid runId: expected a single safe identifier segment.");
+  }
+  return value.trim();
+}
+
+// packages/core/src/authority-paths.ts
+import { existsSync as existsSync2 } from "fs";
+import { dirname as dirname2, resolve as resolve2 } from "path";
+function normalizeOptionalString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+function normalizeOptionalBoolean(value, fallback) {
+  if (typeof value !== "string") {
+    return fallback;
+  }
+  const normalized = value.trim().toLowerCase();
+  if (["1", "true", "yes", "on"].includes(normalized)) {
+    return true;
+  }
+  if (["0", "false", "no", "off"].includes(normalized)) {
+    return false;
+  }
+  return fallback;
+}
+function resolveAuthorityPaths(projectRoot) {
+  const normalizedRoot = resolve2(projectRoot);
+  const stateRoot = resolveAuthorityStateRoot(normalizedRoot);
+  const stateDir = resolveAuthorityStateDir(normalizedRoot);
+  return {
+    projectRoot: normalizedRoot,
+    harnessRoot: resolve2(normalizedRoot, "rig"),
+    runsDir: resolve2(stateRoot, "runs"),
+    remoteDir: resolve2(stateRoot, "remote"),
+    stateDir,
+    remoteEndpointsPath: resolve2(stateRoot, "remote", "endpoints.toml"),
+    remoteSecretsPath: resolve2(stateDir, "remote-secrets.toml")
+  };
+}
+function resolveAuthorityStateRoot(projectRoot) {
+  const normalizedRoot = resolve2(projectRoot);
+  const taskWorkspace = normalizeOptionalString(process.env.RIG_TASK_WORKSPACE);
+  if (taskWorkspace) {
+    return resolve2(taskWorkspace, ".rig");
+  }
+  const stateDir = normalizeOptionalString(process.env.RIG_STATE_DIR);
+  if (stateDir) {
+    return dirname2(resolve2(stateDir));
+  }
+  const logsDir = normalizeOptionalString(process.env.RIG_LOGS_DIR);
+  if (logsDir) {
+    return dirname2(resolve2(logsDir));
+  }
+  const sessionFile = normalizeOptionalString(process.env.RIG_SESSION_FILE);
+  if (sessionFile) {
+    return dirname2(dirname2(resolve2(sessionFile)));
+  }
+  const projectStateRoot = resolve2(normalizedRoot, ".rig");
+  if (existsSync2(projectStateRoot)) {
+    return projectStateRoot;
+  }
+  return resolve2(normalizedRoot, ".rig");
+}
+function resolveAuthorityStateDir(projectRoot) {
+  const explicit = normalizeOptionalString(process.env.RIG_STATE_DIR);
+  if (explicit) {
+    return resolve2(explicit);
+  }
+  return resolve2(resolveAuthorityStateRoot(projectRoot), "state");
+}
+function resolveAuthorityProjectStateDir(projectRoot) {
+  const explicit = normalizeOptionalString(process.env.RIG_STATE_DIR);
+  if (explicit) {
+    return resolve2(explicit);
+  }
+  return resolve2(resolve2(projectRoot), ".rig", "state");
+}
+
+// packages/core/src/server-paths.ts
+function isPathWithin(root, candidate) {
+  const relativePath = relative(root, candidate);
+  return relativePath === "" || !relativePath.startsWith("..") && !relativePath.startsWith("/") && !relativePath.startsWith("\\");
+}
+function uniquePaths(paths) {
+  const seen = new Set;
+  const result = [];
+  for (const value of paths) {
+    const normalized = normalizeOptionalString(value);
+    if (!normalized || seen.has(normalized))
+      continue;
+    seen.add(normalized);
+    result.push(normalized);
+  }
+  return result;
+}
+function resolveRigStatePaths(projectRoot) {
+  const taskWorkspace = normalizeOptionalString(process.env.RIG_TASK_WORKSPACE);
+  const explicitStateDir = normalizeOptionalString(process.env.RIG_STATE_DIR);
+  const explicitLogsDir = normalizeOptionalString(process.env.RIG_LOGS_DIR);
+  const explicitSessionFile = normalizeOptionalString(process.env.RIG_SESSION_FILE);
+  const hostStateRoot = resolve3(projectRoot, ".rig");
+  const monorepoRoot = resolveMonorepoRoot(projectRoot);
+  const monorepoStateRoot = resolve3(monorepoRoot, ".rig");
+  const stateRoot = taskWorkspace ? resolve3(taskWorkspace, ".rig") : explicitStateDir ? dirname3(resolve3(explicitStateDir)) : explicitLogsDir ? dirname3(resolve3(explicitLogsDir)) : explicitSessionFile ? dirname3(dirname3(resolve3(explicitSessionFile))) : existsSync3(hostStateRoot) ? hostStateRoot : monorepoStateRoot;
+  const stateDir = explicitStateDir ? resolve3(explicitStateDir) : resolve3(stateRoot, "state");
+  const logsDir = explicitLogsDir ? resolve3(explicitLogsDir) : resolve3(stateRoot, "logs");
+  return {
+    stateRoot,
+    stateDir,
+    logsDir,
+    controlPlaneEventsFile: resolve3(logsDir, "control-plane.events.jsonl"),
+    notificationsFile: resolve3(projectRoot, "rig", "notifications", "targets.json"),
+    keybindingsPath: resolve3(projectRoot, "rig", "keybindings.json")
+  };
+}
+function resolveRigProjectRoot(input) {
+  if (input?.envProjectRoot) {
+    return input.envProjectRoot;
+  }
+  const cwd = input?.cwd ?? process.cwd();
+  const fallbackRoot = input?.fallbackRoot ?? cwd;
+  const candidates = [cwd, fallbackRoot];
+  for (const candidate of candidates) {
+    if (existsSync3(resolve3(candidate, RIG_DEFINITION_DIRNAME))) {
+      return candidate;
+    }
+  }
+  return fallbackRoot;
+}
+function resolveAuthorityRuntimeDir(projectRoot) {
+  return resolve3(resolveAuthorityStateRoot(projectRoot), "runtime");
+}
+function listAuthorityRunRoots(projectRoot) {
+  const normalizedRoot = resolve3(projectRoot);
+  const monorepoRoot = resolveMonorepoRoot(normalizedRoot);
+  return uniquePaths([
+    resolve3(resolveAuthorityStateRoot(normalizedRoot), "runs"),
+    resolve3(monorepoRoot, ".rig", "runs")
+  ]);
+}
+function listAuthorityRuntimeAgentsRoots(projectRoot) {
+  return uniquePaths([
+    resolve3(resolveAuthorityRuntimeDir(projectRoot), "agents")
+  ]);
+}
+function resolveAuthorityRunDir(projectRoot, runId) {
+  const safeRunId = assertSafeRunId(runId);
+  const roots = listAuthorityRunRoots(projectRoot);
+  for (const runsDir of roots) {
+    const candidate = resolve3(runsDir, safeRunId);
+    if (existsSync3(candidate)) {
+      return candidate;
+    }
+  }
+  return resolve3(roots[0] ?? resolveAuthorityPaths(projectRoot).runsDir, safeRunId);
+}
+export {
+  resolveRigStatePaths,
+  resolveRigProjectRoot,
+  resolveAuthorityStateRoot,
+  resolveAuthorityStateDir,
+  resolveAuthorityRuntimeDir,
+  resolveAuthorityRunDir,
+  resolveAuthorityProjectStateDir,
+  resolveAuthorityPaths,
+  normalizeOptionalString,
+  normalizeOptionalBoolean,
+  listAuthorityRuntimeAgentsRoots,
+  listAuthorityRunRoots,
+  isPathWithin
+};

package/dist/src/setup-version.d.ts

@@ -0,0 +1,3 @@
+export declare const MIN_SUPPORTED_BUN_VERSION = "1.3.11";
+export declare function normalizeSemverCore(version: string): string;
+export declare function isSupportedBunVersion(version: string): boolean;

package/dist/src/setup-version.js

@@ -0,0 +1,14 @@
+// @bun
+// packages/core/src/setup-version.ts
+var MIN_SUPPORTED_BUN_VERSION = "1.3.11";
+function normalizeSemverCore(version) {
+  return version.replace(/^v/, "").split("-")[0]?.split("+")[0] ?? version;
+}
+function isSupportedBunVersion(version) {
+  return Bun.semver.order(normalizeSemverCore(version), MIN_SUPPORTED_BUN_VERSION) >= 0;
+}
+export {
+  normalizeSemverCore,
+  isSupportedBunVersion,
+  MIN_SUPPORTED_BUN_VERSION
+};

package/dist/src/task-record-reader.d.ts

@@ -0,0 +1,3 @@
+import type { TaskRecord, TaskRecordReader } from "@rig/contracts";
+export type { TaskRecordReader };
+export declare function findTaskById(reader: TaskRecordReader, id: string): Promise<TaskRecord | null>;

package/dist/src/task-record-reader.js

@@ -0,0 +1,9 @@
+// @bun
+// packages/core/src/task-record-reader.ts
+async function findTaskById(reader, id) {
+  const tasks = await reader.listTasks();
+  return tasks.find((task) => task.id === id) ?? null;
+}
+export {
+  findTaskById
+};