@h-rig/harness-plugin 0.0.6-alpha.186

package/dist/src/plugin.js

@@ -0,0 +1,4486 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = import.meta.require;
+
+// packages/harness-plugin/src/agent-harness/controlled-bash.ts
+import { existsSync } from "fs";
+import { resolve } from "path";
+import { resolveRigLayout } from "@rig/core/layout";
+function controlledBashCandidates(projectRoot) {
+  const layout = resolveRigLayout(projectRoot);
+  const candidates = [
+    process.env.RIG_CONTROLLED_BASH_BIN?.trim() || "",
+    resolve(layout.binDir, "controlled-bash"),
+    Bun.which("controlled-bash") || ""
+  ];
+  return candidates.filter((candidate) => Boolean(candidate));
+}
+function resolveControlledBash(projectRoot) {
+  for (const candidate of controlledBashCandidates(projectRoot)) {
+    if (existsSync(candidate))
+      return candidate;
+  }
+  return null;
+}
+async function runControlledBash(args, options) {
+  const projectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || process.env.PROJECT_RIG_ROOT?.trim() || process.env.RIG_TASK_WORKSPACE?.trim() || process.cwd() || options.projectRootFallbackDir;
+  const controlled = resolveControlledBash(projectRoot);
+  if (!controlled) {
+    console.error("[rig-agent] controlled-bash entrypoint unavailable; refusing to run an unguarded shell.");
+    return 126;
+  }
+  const command = [controlled, ...args];
+  const child = Bun.spawn(command, {
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit",
+    cwd: process.cwd(),
+    env: {
+      ...process.env,
+      PROJECT_RIG_ROOT: projectRoot,
+      RIG_BASH_ACTIVE: "1"
+    }
+  });
+  return await child.exited;
+}
+var init_controlled_bash = () => {};
+
+// packages/harness-plugin/src/agent-harness/agent-mode.ts
+function looksLikeShellInvocation(args, mode = process.env.RIG_AGENT_MODE) {
+  if (mode === "shell") {
+    return true;
+  }
+  if (mode === "agent") {
+    return false;
+  }
+  if (args.length === 0) {
+    return false;
+  }
+  const first = args[0];
+  if (!first) {
+    return false;
+  }
+  const bashLikeFlags = new Set([
+    "-c",
+    "-lc",
+    "-l",
+    "-i",
+    "-s",
+    "--login",
+    "--noprofile",
+    "--norc",
+    "--posix",
+    "--rcfile",
+    "--init-file",
+    "--restricted",
+    "--debug",
+    "--debugger",
+    "--verbose",
+    "--wordexp",
+    "--dump-strings",
+    "--dump-po-strings",
+    "--help"
+  ]);
+  if (bashLikeFlags.has(first)) {
+    return true;
+  }
+  if (!first.startsWith("-")) {
+    return first.endsWith(".sh");
+  }
+  return false;
+}
+
+// packages/harness-plugin/src/runtime-secrets.ts
+var exports_runtime_secrets = {};
+__export(exports_runtime_secrets, {
+  secretDefinesFromEnv: () => secretDefinesFromEnv,
+  runtimeSecretsService: () => runtimeSecretsService,
+  resolveRuntimeSecrets: () => resolveRuntimeSecrets,
+  loadDotEnvSecrets: () => loadDotEnvSecrets,
+  BAKED_RUNTIME_SECRETS: () => BAKED_RUNTIME_SECRETS
+});
+import { loadDotEnvValues, resolveRuntimeConfigValues } from "@rig/core/baked-secrets";
+function resolveRuntimeSecrets(env, baked = BAKED_RUNTIME_SECRETS) {
+  return resolveRuntimeConfigValues(env, RUNTIME_SECRET_KEYS, baked);
+}
+function loadDotEnvSecrets(projectRoot, env = process.env) {
+  return loadDotEnvValues(projectRoot, RUNTIME_SECRET_KEYS, env);
+}
+function secretDefinesFromEnv(env = process.env, projectRoot) {
+  const dotenvSecrets = projectRoot ? loadDotEnvSecrets(projectRoot, env) : {};
+  const resolved = resolveRuntimeSecrets(env, {
+    ...BAKED_RUNTIME_SECRETS,
+    ...dotenvSecrets
+  });
+  return {
+    RIG_BAKED_ANTHROPIC_API_KEY: resolved.ANTHROPIC_API_KEY || "",
+    RIG_BAKED_OPENAI_API_KEY: resolved.OPENAI_API_KEY || "",
+    RIG_BAKED_OPENROUTER_API_KEY: resolved.OPENROUTER_API_KEY || "",
+    RIG_BAKED_AI_REVIEW_MODE: resolved.AI_REVIEW_MODE || "",
+    RIG_BAKED_AI_REVIEW_PROVIDER: resolved.AI_REVIEW_PROVIDER || "",
+    RIG_BAKED_GITHUB_TOKEN: resolved.GITHUB_TOKEN || resolved.GH_TOKEN || "",
+    RIG_BAKED_GITHUB_SSH_KEY: resolved.GITHUB_SSH_KEY || "",
+    RIG_BAKED_AWS_ACCESS_KEY_ID: resolved.AWS_ACCESS_KEY_ID || "",
+    RIG_BAKED_AWS_SECRET_ACCESS_KEY: resolved.AWS_SECRET_ACCESS_KEY || "",
+    RIG_BAKED_AWS_REGION: resolved.AWS_REGION || "",
+    RIG_BAKED_LINEAR_API_KEY: resolved.LINEAR_API_KEY || "",
+    RIG_BAKED_LINEAR_WEBHOOK_SECRET: resolved.LINEAR_WEBHOOK_SECRET || ""
+  };
+}
+var BAKED_RUNTIME_SECRETS, RUNTIME_SECRET_KEYS, runtimeSecretsService;
+var init_runtime_secrets = __esm(() => {
+  BAKED_RUNTIME_SECRETS = {
+    ANTHROPIC_API_KEY: typeof RIG_BAKED_ANTHROPIC_API_KEY !== "undefined" ? RIG_BAKED_ANTHROPIC_API_KEY : "",
+    OPENAI_API_KEY: typeof RIG_BAKED_OPENAI_API_KEY !== "undefined" ? RIG_BAKED_OPENAI_API_KEY : "",
+    OPENROUTER_API_KEY: typeof RIG_BAKED_OPENROUTER_API_KEY !== "undefined" ? RIG_BAKED_OPENROUTER_API_KEY : "",
+    AI_REVIEW_MODE: typeof RIG_BAKED_AI_REVIEW_MODE !== "undefined" ? RIG_BAKED_AI_REVIEW_MODE : "",
+    AI_REVIEW_PROVIDER: typeof RIG_BAKED_AI_REVIEW_PROVIDER !== "undefined" ? RIG_BAKED_AI_REVIEW_PROVIDER : "",
+    GH_TOKEN: typeof RIG_BAKED_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GITHUB_TOKEN : "",
+    GITHUB_TOKEN: typeof RIG_BAKED_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GITHUB_TOKEN : "",
+    GITHUB_SSH_KEY: typeof RIG_BAKED_GITHUB_SSH_KEY !== "undefined" ? RIG_BAKED_GITHUB_SSH_KEY : "",
+    AWS_ACCESS_KEY_ID: typeof RIG_BAKED_AWS_ACCESS_KEY_ID !== "undefined" ? RIG_BAKED_AWS_ACCESS_KEY_ID : "",
+    AWS_SECRET_ACCESS_KEY: typeof RIG_BAKED_AWS_SECRET_ACCESS_KEY !== "undefined" ? RIG_BAKED_AWS_SECRET_ACCESS_KEY : "",
+    AWS_REGION: typeof RIG_BAKED_AWS_REGION !== "undefined" ? RIG_BAKED_AWS_REGION : "",
+    LINEAR_API_KEY: typeof RIG_BAKED_LINEAR_API_KEY !== "undefined" ? RIG_BAKED_LINEAR_API_KEY : "",
+    LINEAR_WEBHOOK_SECRET: typeof RIG_BAKED_LINEAR_WEBHOOK_SECRET !== "undefined" ? RIG_BAKED_LINEAR_WEBHOOK_SECRET : ""
+  };
+  RUNTIME_SECRET_KEYS = Object.keys(BAKED_RUNTIME_SECRETS);
+  runtimeSecretsService = {
+    resolveRuntimeSecrets,
+    loadDotEnvSecrets,
+    secretDefinesFromEnv
+  };
+});
+
+// packages/harness-plugin/src/agent-harness/git-ops.ts
+import { LIFECYCLE_GIT_AGENT } from "@rig/contracts";
+import { defineCapability } from "@rig/core/capability";
+import { buildPluginHostContext } from "@rig/core/plugin-host-context";
+import { loadCapabilityForRoot } from "@rig/core/capability-loaders";
+async function ensureHostContext(projectRoot) {
+  let cached = hostContextByRoot.get(projectRoot);
+  if (!cached) {
+    cached = buildPluginHostContext(projectRoot);
+    hostContextByRoot.set(projectRoot, cached);
+  }
+  await cached;
+}
+async function loadLifecycleGit(projectRoot) {
+  await ensureHostContext(projectRoot);
+  const git = await loadCapabilityForRoot(projectRoot, LifecycleGitAgentCap);
+  if (!git) {
+    throw new Error("lifecycle git capability unavailable: load @rig/lifecycle-plugin (default bundle) before running rig-agent git commands.");
+  }
+  return git;
+}
+var LifecycleGitAgentCap, hostContextByRoot;
+var init_git_ops = __esm(() => {
+  LifecycleGitAgentCap = defineCapability(LIFECYCLE_GIT_AGENT);
+  hostContextByRoot = new Map;
+});
+
+// packages/harness-plugin/src/profile-state.ts
+var exports_profile_state = {};
+__export(exports_profile_state, {
+  writeHarnessStateJson: () => writeHarnessStateJson,
+  readHarnessStateJson: () => readHarnessStateJson,
+  harnessStateJsonPath: () => harnessStateJsonPath,
+  harnessProfileStateService: () => harnessProfileStateService
+});
+import { existsSync as existsSync2, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { resolve as resolve2 } from "path";
+import { resolveHarnessPaths } from "@rig/core/harness-paths";
+function harnessStateJsonPath(projectRoot, filename) {
+  return resolve2(resolveHarnessPaths(projectRoot).stateDir, filename);
+}
+function readHarnessStateJson(projectRoot, filename) {
+  const path = harnessStateJsonPath(projectRoot, filename);
+  if (!existsSync2(path)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf-8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function writeHarnessStateJson(projectRoot, filename, value) {
+  const paths = resolveHarnessPaths(projectRoot);
+  mkdirSync(paths.stateDir, { recursive: true });
+  const path = resolve2(paths.stateDir, filename);
+  writeFileSync(path, `${JSON.stringify(value, null, 2)}
+`, "utf-8");
+  return path;
+}
+var harnessProfileStateService;
+var init_profile_state = __esm(() => {
+  harnessProfileStateService = {
+    harnessStateJsonPath,
+    readHarnessStateJson,
+    writeHarnessStateJson
+  };
+});
+
+// packages/harness-plugin/src/agent-harness/repo-ops.ts
+import {
+  REPO_OPERATIONS_CAPABILITY
+} from "@rig/contracts";
+import { defineCapability as defineCapability2 } from "@rig/core/capability";
+import { requireInstalledCapability } from "@rig/core/capability-loaders";
+function repoOperations() {
+  return requireInstalledCapability(RepoOperationsCap, "repo operations capability unavailable: load @rig/repos-plugin before using provider harness repo operations.");
+}
+function repoEnsure(projectRoot, taskId) {
+  repoOperations().repoEnsure(projectRoot, taskId);
+}
+function repoPins(projectRoot, taskId) {
+  return repoOperations().repoPins(projectRoot, taskId);
+}
+function repoVerify(projectRoot, taskId) {
+  return repoOperations().repoVerify(projectRoot, taskId);
+}
+function repoDiscover(projectRoot, taskId) {
+  return repoOperations().repoDiscover(projectRoot, taskId);
+}
+function repoBaseline(projectRoot, refresh = false) {
+  return repoOperations().repoBaseline(projectRoot, refresh);
+}
+var RepoOperationsCap;
+var init_repo_ops = __esm(() => {
+  RepoOperationsCap = defineCapability2(REPO_OPERATIONS_CAPABILITY);
+});
+
+// packages/harness-plugin/src/agent-harness/task-data.ts
+import { basename } from "path";
+import {
+  REPO_CHANGE_SET,
+  TASK_ARTIFACTS,
+  TASK_STATE_STORE,
+  TASK_SOURCE_CONFIG_PROJECTION
+} from "@rig/contracts";
+import { defineCapability as defineCapability3 } from "@rig/core/capability";
+import { requireInstalledCapability as requireInstalledCapability2 } from "@rig/core/capability-loaders";
+function stateStore() {
+  return requireInstalledCapability2(TaskStateStoreCap, "task state store capability unavailable: load @rig/tasks-plugin (default bundle) before running the provider agent harness.");
+}
+function artifacts() {
+  return requireInstalledCapability2(TaskArtifactsCap, "task artifacts capability unavailable: load @rig/tasks-plugin (default bundle) before running the provider agent harness.");
+}
+function taskSourceConfigProjection() {
+  return requireInstalledCapability2(TaskSourceConfigProjectionCap, "task source config projection capability unavailable: load @rig/tasks-plugin (default bundle) before reading validation descriptions.");
+}
+function repoChangeSet() {
+  return requireInstalledCapability2(RepoChangeSetCap, "repo change-set capability unavailable: load @rig/repos-plugin (default bundle) before reading task file changes.");
+}
+function currentTaskId(projectRoot) {
+  return stateStore().readCurrentTaskId(projectRoot) ?? "";
+}
+function readTaskConfig(projectRoot) {
+  return stateStore().readTaskConfig(projectRoot);
+}
+function readSourceTaskConfig(projectRoot) {
+  return stateStore().readSourceTaskConfig(projectRoot);
+}
+function readValidationDescriptions(projectRoot) {
+  return taskSourceConfigProjection().readSourceValidationDescriptions(projectRoot);
+}
+function lookupTask(_projectRoot, input) {
+  return input;
+}
+function artifactDirForId(projectRoot, id) {
+  return artifacts().artifactDir({ projectRoot, taskId: id });
+}
+function readStringList(candidate) {
+  return Array.isArray(candidate) ? candidate.filter((entry) => typeof entry === "string") : [];
+}
+function firstStringList(...candidates) {
+  for (const candidate of candidates) {
+    const values = readStringList(candidate);
+    if (values.length > 0)
+      return values;
+  }
+  return [];
+}
+function unique(values) {
+  return Array.from(new Set(values));
+}
+function readTaskEntry(projectRoot, taskId) {
+  try {
+    return readTaskConfig(projectRoot)[taskId] ?? readSourceTaskConfig(projectRoot)[taskId] ?? null;
+  } catch {
+    return null;
+  }
+}
+function taskDependencyIds(projectRoot, taskId) {
+  const entry = readTaskEntry(projectRoot, taskId);
+  if (!entry)
+    return [];
+  const record = entry;
+  return unique(firstStringList(record.deps, record.dependencies, record.validation_deps, record.validationDeps)).filter((id) => id !== taskId);
+}
+function taskScopePatterns(projectRoot, taskId) {
+  const entry = readTaskEntry(projectRoot, taskId);
+  return entry ? readStringList(entry.scope) : [];
+}
+function syncRepoChangeSetPaths(result, operation) {
+  if (result && typeof result.then === "function") {
+    throw new Error(`repo change-set ${operation} returned a Promise; lifecycle task adapter requires a synchronous provider.`);
+  }
+  return unique(result.map((entry) => entry.path).filter(Boolean));
+}
+function changedFilesForTask(projectRoot, taskId, scoped) {
+  return syncRepoChangeSetPaths(repoChangeSet().changedFiles({ projectRoot, selector: { kind: "task", taskId, scoped } }), "changedFiles");
+}
+function pendingFilesForTask(projectRoot, taskId, scoped) {
+  return syncRepoChangeSetPaths(repoChangeSet().pendingFiles({ projectRoot, selector: { kind: "task", taskId, scoped } }), "pendingFiles");
+}
+function taskLookup(projectRoot, id) {
+  const result = lookupTask(projectRoot, id);
+  if (!result)
+    throw new Error(`Not found: ${id}`);
+  return result;
+}
+function taskConfigEntryToRecord(id, entry, source) {
+  const record = entry;
+  const deps = firstStringList(record.deps, record.dependencies, record.validation_deps, record.validationDeps);
+  return {
+    id,
+    deps,
+    status: typeof entry.status === "string" ? entry.status : "open",
+    source,
+    ...typeof entry.title === "string" ? { title: entry.title } : {},
+    ...typeof entry.description === "string" ? { description: entry.description } : {},
+    ...typeof entry.acceptance_criteria === "string" ? { acceptanceCriteria: entry.acceptance_criteria } : {},
+    ...Array.isArray(entry.scope) ? { scope: entry.scope } : {},
+    ...Array.isArray(entry.validation) ? { validation: entry.validation } : {},
+    ...typeof entry.role === "string" ? { role: entry.role } : {},
+    ...entry.browser ? { browser: entry.browser } : {},
+    ...entry.repo_pins ? { repo_pins: entry.repo_pins } : {},
+    ...entry.criticality ? { criticality: entry.criticality } : {},
+    ...typeof entry.queue_weight === "number" ? { queue_weight: entry.queue_weight } : {},
+    ...entry.creates_repo !== undefined ? { creates_repo: entry.creates_repo } : {},
+    ...entry.auto_synced !== undefined ? { auto_synced: entry.auto_synced } : {}
+  };
+}
+async function taskInfo(projectRoot, taskId, deprecatedRuntimeProviderOverride) {
+  const activeTask = taskId || currentTaskId(projectRoot);
+  if (!activeTask)
+    throw new Error("No active task.");
+  const entry = readTaskEntry(projectRoot, activeTask);
+  if (!entry)
+    throw new Error(`Not found: ${activeTask}`);
+  process.stdout.write(`${JSON.stringify(taskConfigEntryToRecord(activeTask, entry, "task-config"), null, 2)}
+`);
+}
+async function taskDeps(projectRoot, taskId) {
+  const activeTask = taskId || currentTaskId(projectRoot);
+  if (!activeTask)
+    throw new Error("No active task.");
+  const deps = taskDependencyIds(projectRoot, activeTask);
+  if (deps.length > 0)
+    process.stdout.write(`${deps.join(`
+`)}
+`);
+}
+function taskStatus(projectRoot) {
+  let tasks = [];
+  try {
+    tasks = Object.entries(readSourceTaskConfig(projectRoot)).map(([id, entry]) => taskConfigEntryToRecord(id, entry, "source-task-config"));
+  } catch {
+    tasks = Object.entries(readTaskConfig(projectRoot)).map(([id, entry]) => taskConfigEntryToRecord(id, entry, "legacy-task-config"));
+  }
+  const counts = tasks.reduce((acc, task) => {
+    const key = typeof task.status === "string" && task.status.length > 0 ? task.status : "open";
+    acc[key] = (acc[key] ?? 0) + 1;
+    return acc;
+  }, {});
+  console.log(`=== Project Rig Progress ===
+`);
+  console.log(`Total tasks: ${tasks.length}`);
+  for (const status of Object.keys(counts).sort())
+    console.log(`  ${status}: ${counts[status]}`);
+}
+async function taskScope(projectRoot, expandFiles, taskId) {
+  const activeTask = taskId || currentTaskId(projectRoot);
+  if (!activeTask)
+    throw new Error("No active task.");
+  const scopes = taskScopePatterns(projectRoot, activeTask);
+  if (scopes.length > 0)
+    process.stdout.write(`${scopes.join(`
+`)}
+`);
+}
+async function taskRecord(projectRoot, type, text, taskId) {
+  const activeTask = taskId || currentTaskId(projectRoot);
+  if (!activeTask)
+    throw new Error("No active task.");
+  const timestamp = new Date().toISOString();
+  if (type === "decision") {
+    const artifactService = artifacts();
+    const filename = "decision-log.md";
+    const existingNames = await artifactNames(artifactService, { projectRoot, taskId: activeTask });
+    const existing = existingNames.has(filename) ? (await artifactService.readArtifact({
+      projectRoot,
+      taskId: activeTask,
+      filename,
+      maxBytes: Number.MAX_SAFE_INTEGER
+    })).contents : "";
+    const result2 = await artifactService.writeArtifact({
+      projectRoot,
+      taskId: activeTask,
+      filename,
+      content: `${existing}
+### ${timestamp}
+
+${text}
+
+`
+    });
+    console.log(`Decision recorded for ${activeTask}.`);
+    return;
+  }
+  const result = stateStore().recordFailedApproach({ projectRoot, taskId: activeTask, text, timestamp });
+  console.log(result.message);
+}
+function taskArtifactDir(projectRoot, taskId) {
+  return artifacts().artifactDir({ projectRoot, ...taskId !== undefined ? { taskId } : {} });
+}
+async function taskArtifactWrite(projectRoot, filename, content, taskId) {
+  const result = await artifacts().writeArtifact({
+    projectRoot,
+    filename,
+    content,
+    ...taskId !== undefined ? { taskId } : {}
+  });
+  console.log(`Wrote: ${result.path}`);
+}
+async function taskArtifactRead(projectRoot, filename, options = {}) {
+  return artifacts().readArtifact({
+    projectRoot,
+    filename,
+    ...options.taskId !== undefined ? { taskId: options.taskId } : {},
+    ...options.maxBytes !== undefined ? { maxBytes: options.maxBytes } : {}
+  });
+}
+async function taskArtifacts(projectRoot, taskId) {
+  const activeTask = taskId || currentTaskId(projectRoot);
+  if (!activeTask)
+    throw new Error("No active task.");
+  const artifactService = artifacts();
+  const ref = { projectRoot, taskId: activeTask };
+  const artifactDir = artifactService.artifactDir(ref);
+  await artifactService.writeArtifact({
+    ...ref,
+    filename: "changed-files.txt",
+    content: `${changedFilesForTask(projectRoot, activeTask, true).join(`
+`)}
+`
+  });
+  const existingNames = await artifactNames(artifactService, ref);
+  if (!existingNames.has("task-result.json")) {
+    await artifactService.writeArtifact({
+      ...ref,
+      filename: "task-result.json",
+      content: `${JSON.stringify({ task_id: activeTask, status: "completed", summary: "TODO: Write a one-line summary of what you did", completed_at: new Date().toISOString() }, null, 2)}
+`
+    });
+  }
+  for (const [filename, content] of [
+    ["decision-log.md", `# Decision Log: ${activeTask}
+
+Record key decisions here using: rig-agent record decision "..."
+`],
+    ["next-actions.md", `# Next Actions: ${activeTask}
+
+- TODO: Replace this scaffold with real content before completion
+`]
+  ]) {
+    if (!existingNames.has(filename)) {
+      await artifactService.writeArtifact({ ...ref, filename, content });
+    }
+  }
+  console.log(`Artifacts at: ${artifactDir}/`);
+}
+async function artifactNames(artifactService, ref) {
+  const entries = await artifactService.listArtifacts(ref);
+  return new Set(entries.filter((entry) => entry.kind === "file").map((entry) => basename(entry.path)));
+}
+function taskData() {
+  return {
+    currentTaskId,
+    readTaskConfig,
+    readSourceTaskConfig,
+    readValidationDescriptions,
+    lookupTask,
+    taskLookup,
+    artifactDirForId,
+    taskInfo,
+    taskDeps,
+    taskStatus,
+    taskScope,
+    taskRecord,
+    taskArtifacts,
+    taskArtifactDir,
+    taskArtifactWrite,
+    taskArtifactRead,
+    taskDependencyIds,
+    changedFilesForTask,
+    pendingFilesForTask
+  };
+}
+var RepoChangeSetCap, TaskArtifactsCap, TaskStateStoreCap, TaskSourceConfigProjectionCap;
+var init_task_data = __esm(() => {
+  RepoChangeSetCap = defineCapability3(REPO_CHANGE_SET);
+  TaskArtifactsCap = defineCapability3(TASK_ARTIFACTS);
+  TaskStateStoreCap = defineCapability3(TASK_STATE_STORE);
+  TaskSourceConfigProjectionCap = defineCapability3(TASK_SOURCE_CONFIG_PROJECTION);
+});
+
+// packages/harness-plugin/src/agent-harness/task-ops.ts
+import { LIFECYCLE_VERIFICATION_SERVICE } from "@rig/contracts";
+import { defineServiceCapability } from "@rig/core/capability";
+import { buildPluginHostContext as buildPluginHostContext2 } from "@rig/core/plugin-host-context";
+async function ensureHostContext2(projectRoot) {
+  let cached = hostContextByRoot2.get(projectRoot);
+  if (!cached) {
+    cached = buildPluginHostContext2(projectRoot);
+    hostContextByRoot2.set(projectRoot, cached);
+  }
+  return cached;
+}
+function taskArtifactDir2(projectRoot, taskId) {
+  return taskData().taskArtifactDir(projectRoot, taskId);
+}
+function taskArtifacts2(projectRoot, taskId) {
+  return taskData().taskArtifacts(projectRoot, taskId);
+}
+function taskArtifactWrite2(projectRoot, filename, content, taskId) {
+  return taskData().taskArtifactWrite(projectRoot, filename, content, taskId);
+}
+function taskDeps2(projectRoot, taskId) {
+  return taskData().taskDeps(projectRoot, taskId);
+}
+function taskInfo2(projectRoot, taskId) {
+  return taskData().taskInfo(projectRoot, taskId);
+}
+function taskLookup2(projectRoot, id) {
+  return taskData().taskLookup(projectRoot, id);
+}
+function taskRecord2(projectRoot, type, text, taskId) {
+  return taskData().taskRecord(projectRoot, type, text, taskId);
+}
+function taskScope2(projectRoot, expandFiles, taskId) {
+  return taskData().taskScope(projectRoot, expandFiles, taskId);
+}
+function taskStatus2(projectRoot) {
+  taskData().taskStatus(projectRoot);
+}
+async function taskValidate(projectRoot, taskId, validatorRegistry) {
+  const hostCtx = await ensureHostContext2(projectRoot);
+  const verification = hostCtx ? await LifecycleVerificationServiceCap.resolveService(hostCtx.pluginHost) : null;
+  const validate = verification ? verification.validate : null;
+  if (!validate) {
+    throw new Error("task validation capability unavailable: load @rig/lifecycle-plugin (default bundle) before running rig-agent validate.");
+  }
+  return validate({
+    projectRoot,
+    ...taskId !== undefined ? { taskId } : {},
+    ...validatorRegistry !== undefined ? { validatorRegistry } : hostCtx?.validatorRegistry !== undefined ? { validatorRegistry: hostCtx.validatorRegistry } : {}
+  });
+}
+var LifecycleVerificationServiceCap, hostContextByRoot2;
+var init_task_ops = __esm(() => {
+  init_task_data();
+  LifecycleVerificationServiceCap = defineServiceCapability(LIFECYCLE_VERIFICATION_SERVICE);
+  hostContextByRoot2 = new Map;
+});
+
+// packages/harness-plugin/src/agent-harness/rig-agent.ts
+var exports_rig_agent = {};
+__export(exports_rig_agent, {
+  looksLikeShellInvocation: () => looksLikeShellInvocation
+});
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname, resolve as resolve3 } from "path";
+import { readBuildConfig } from "@rig/core/build-time-config";
+import { LIFECYCLE_VERIFICATION_SERVICE as LIFECYCLE_VERIFICATION_SERVICE2, MEMORY } from "@rig/contracts";
+import { defineCapability as defineCapability4, defineServiceCapability as defineServiceCapability2 } from "@rig/core/capability";
+import { buildProjectPluginHost, loadCapabilityForRoot as loadCapabilityForRoot2 } from "@rig/core/capability-loaders";
+import { resolveCheckoutRoot as resolveMonorepoRoot } from "@rig/core/checkout-root";
+import { browserEnvFromContext, loadRuntimeContext, loadRuntimeContextFromEnv } from "@rig/core/runtime-context";
+import { RuntimeEventBus } from "@rig/core/runtime-events";
+function getContext() {
+  if (cachedContext !== undefined)
+    return cachedContext;
+  cachedContext = loadRuntimeContextFromEnv() ?? inferRuntimeContext();
+  return cachedContext;
+}
+function getEventBus() {
+  if (cachedEventBus !== undefined) {
+    return cachedEventBus ?? undefined;
+  }
+  const ctx = getContext();
+  if (!ctx) {
+    cachedEventBus = null;
+    return;
+  }
+  const runId = ctx.runtimeId || BAKED_RUNTIME_ID || "";
+  cachedEventBus = new RuntimeEventBus({
+    projectRoot: ctx.workspaceDir,
+    ...runId ? { runId } : {}
+  });
+  return cachedEventBus;
+}
+function inferRuntimeContext() {
+  for (const candidate of runtimeContextCandidates()) {
+    if (!candidate || !existsSync3(candidate)) {
+      continue;
+    }
+    try {
+      process.env.RIG_RUNTIME_CONTEXT_FILE = candidate;
+      return loadRuntimeContext(candidate);
+    } catch {}
+  }
+  return null;
+}
+function runtimeContextCandidates() {
+  const cwd = process.cwd();
+  const candidates = [
+    resolve3(cwd, "..", "runtime-context.json"),
+    resolve3(cwd, ".rig", "runtime-context.json")
+  ];
+  const argv1 = process.argv[1]?.trim();
+  if (argv1) {
+    candidates.push(resolve3(argv1, "..", "..", "runtime-context.json"));
+  }
+  if (BAKED_BINARY_PATH) {
+    candidates.push(resolve3(BAKED_BINARY_PATH, "..", "..", "runtime-context.json"));
+  }
+  return Array.from(new Set(candidates));
+}
+function sha256Hex(input) {
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(input);
+  return hasher.digest("hex");
+}
+function ensureRuntimeKnownHosts(runtimeHome) {
+  const sshDir = resolve3(runtimeHome, ".ssh");
+  const knownHostsPath = resolve3(sshDir, "known_hosts");
+  if (!existsSync3(sshDir)) {
+    mkdirSync2(sshDir, { recursive: true });
+  }
+  const existing = existsSync3(knownHostsPath) ? readFileSync2(knownHostsPath, "utf-8") : "";
+  const existingLines = new Set(existing.split(/\r?\n/).map((line) => line.trim()).filter(Boolean));
+  const missing = GITHUB_KNOWN_HOSTS.filter((line) => !existingLines.has(line));
+  if (missing.length === 0) {
+    return knownHostsPath;
+  }
+  try {
+    for (const line of missing) {
+      existingLines.add(line);
+    }
+    writeFileSync2(knownHostsPath, `${Array.from(existingLines).join(`
+`)}
+`, { mode: 420 });
+  } catch (err) {
+    const hint = existsSync3(knownHostsPath) ? "" : " \u2014 known_hosts is missing; git SSH operations may fail";
+    console.warn(`[rig-agent] Could not update ${knownHostsPath}: ${err instanceof Error ? err.message : String(err)}${hint}`);
+  }
+  return knownHostsPath;
+}
+function hydrateRuntimeProcessEnv(ctx) {
+  if (!ctx) {
+    return;
+  }
+  const contextFile = process.env.RIG_RUNTIME_CONTEXT_FILE?.trim() || inferRuntimeContextFileFromWorkspace(ctx.workspaceDir);
+  if (!contextFile) {
+    return;
+  }
+  process.env.RIG_RUNTIME_CONTEXT_FILE = contextFile;
+  const runtimeRoot = dirname(resolve3(contextFile));
+  const runtimeHome = resolve3(runtimeRoot, "home");
+  const runtimeTmp = resolve3(runtimeRoot, "tmp");
+  const runtimeCache = resolve3(runtimeRoot, "cache");
+  const runtimeBin = resolve3(runtimeRoot, "bin");
+  const runtimeWorkspaceBin = resolve3(ctx.workspaceDir, ".rig", "bin");
+  const runtimeTools = resolve3(ctx.workspaceDir, "rig", "tools");
+  if (ctx.hostProjectRoot) {
+    process.env.PROJECT_RIG_ROOT = ctx.hostProjectRoot;
+  }
+  process.env.RIG_TASK_ID = ctx.taskId;
+  process.env.RIG_TASK_WORKSPACE = ctx.workspaceDir;
+  process.env.RIG_STATE_DIR = ctx.stateDir;
+  process.env.RIG_LOGS_DIR = ctx.logsDir;
+  process.env.RIG_SESSION_FILE = ctx.sessionFile;
+  process.env.RIG_RUNTIME_HOME = runtimeRoot;
+  if (!process.env.RIG_HOST_PROJECT_ROOT && ctx.hostProjectRoot) {
+    process.env.RIG_HOST_PROJECT_ROOT = ctx.hostProjectRoot;
+  }
+  for (const [key, value] of Object.entries(browserEnvFromContext(ctx.browser))) {
+    process.env[key] = value;
+  }
+  if (existsSync3(runtimeHome)) {
+    process.env.HOME = runtimeHome;
+  }
+  if (existsSync3(runtimeTmp)) {
+    process.env.TMPDIR = runtimeTmp;
+  }
+  if (existsSync3(runtimeCache)) {
+    process.env.XDG_CACHE_HOME = runtimeCache;
+  }
+  const workspaceSecrets = loadDotEnvSecrets(ctx.workspaceDir, process.env);
+  const hostWorkspaceSecrets = ctx.hostProjectRoot && ctx.hostProjectRoot !== ctx.workspaceDir ? loadDotEnvSecrets(ctx.hostProjectRoot, process.env) : {};
+  const resolvedSecrets = resolveRuntimeSecrets(process.env, {
+    ...hostWorkspaceSecrets,
+    ...workspaceSecrets
+  });
+  for (const [key, value] of Object.entries(resolvedSecrets)) {
+    if (value && !process.env[key]) {
+      process.env[key] = value;
+    }
+  }
+  if (!process.env.GITHUB_TOKEN && process.env.GH_TOKEN) {
+    process.env.GITHUB_TOKEN = process.env.GH_TOKEN;
+  }
+  if (!process.env.GH_TOKEN && process.env.GITHUB_TOKEN) {
+    process.env.GH_TOKEN = process.env.GITHUB_TOKEN;
+  }
+  const currentPath = process.env.PATH || "";
+  const pathEntries = currentPath.split(":").filter(Boolean);
+  for (const entry of [runtimeBin, runtimeWorkspaceBin, runtimeTools, "/usr/bin", "/bin", "/usr/sbin", "/sbin"]) {
+    if (existsSync3(entry) && !pathEntries.includes(entry)) {
+      pathEntries.unshift(entry);
+    }
+  }
+  process.env.PATH = pathEntries.join(":");
+  if (!process.env.RIG_GIT_BIN) {
+    const runtimeGit = resolve3(runtimeBin, "git");
+    process.env.RIG_GIT_BIN = existsSync3(runtimeGit) ? runtimeGit : Bun.which("git") || "/usr/bin/git";
+  }
+  const knownHosts = ensureRuntimeKnownHosts(runtimeHome);
+  const agentKey = resolve3(runtimeHome, ".ssh", "rig-agent-key");
+  const sshParts = [
+    "ssh",
+    `-o UserKnownHostsFile="${knownHosts}"`,
+    "-o StrictHostKeyChecking=yes",
+    "-F /dev/null"
+  ];
+  if (existsSync3(agentKey)) {
+    sshParts.splice(1, 0, `-i "${agentKey}"`, "-o IdentitiesOnly=yes");
+  }
+  process.env.GIT_SSH_COMMAND = sshParts.join(" ");
+}
+function inferRuntimeContextFileFromWorkspace(workspaceDir) {
+  const candidate = resolve3(workspaceDir, "..", "runtime-context.json");
+  return existsSync3(candidate) ? candidate : "";
+}
+function parseEnvOrDefault(value, allowed, fallback) {
+  if (!value) {
+    return fallback;
+  }
+  return allowed.includes(value) ? value : fallback;
+}
+function loadProfile(projectRoot) {
+  const parsed = readHarnessStateJson(projectRoot, AGENT_PROFILE_FILE);
+  return {
+    ...DEFAULT_AGENT_PROFILE,
+    updated_at: typeof parsed?.updated_at === "string" ? parsed.updated_at : new Date().toISOString()
+  };
+}
+function showProfile(projectRoot, compact = false) {
+  const profile = loadProfile(projectRoot);
+  if (compact) {
+    console.log(`model=${profile.model} runtime=${profile.runtime} plugin=${profile.agent_plugin}`);
+    return;
+  }
+  console.log("Execution Profile:");
+  console.log(`  model:        ${profile.model}`);
+  console.log(`  runtime:      ${profile.runtime}`);
+  console.log(`  plugin:       ${profile.agent_plugin}`);
+}
+function setProfile(projectRoot, options) {
+  const invalid = [options.model, options.runtime, options.plugin, options.preset].filter((value) => typeof value === "string" && value.trim().length > 0 && value.trim() !== "pi");
+  if (invalid.length > 0) {
+    throw new Error("Only the Pi runtime profile is supported by this Rig substrate.");
+  }
+  writeHarnessStateJson(projectRoot, AGENT_PROFILE_FILE, {
+    ...DEFAULT_AGENT_PROFILE,
+    updated_at: new Date().toISOString()
+  });
+  showProfile(projectRoot, false);
+}
+function loadReviewProfile(projectRoot) {
+  const parsed = readHarnessStateJson(projectRoot, REVIEW_PROFILE_FILE);
+  const mode = parsed?.mode;
+  const provider = parsed?.provider;
+  return {
+    mode: mode === "off" || mode === "advisory" || mode === "required" ? mode : DEFAULT_REVIEW_MODE,
+    provider: provider === "github" ? provider : DEFAULT_REVIEW_PROVIDER,
+    updated_at: typeof parsed?.updated_at === "string" ? parsed.updated_at : new Date().toISOString()
+  };
+}
+function showReviewProfile(projectRoot) {
+  const profile = loadReviewProfile(projectRoot);
+  console.log("AI Review Profile:");
+  console.log(`  mode:      ${profile.mode}`);
+  console.log(`  provider:  ${profile.provider}`);
+  console.log(`  file:      ${harnessStateJsonPath(projectRoot, REVIEW_PROFILE_FILE)}`);
+}
+function setReviewProfile(projectRoot, mode, provider) {
+  if (mode !== "off" && mode !== "advisory" && mode !== "required") {
+    throw new Error(`Invalid mode: ${mode}. Use off|advisory|required.`);
+  }
+  const resolvedProvider = provider || DEFAULT_REVIEW_PROVIDER;
+  if (resolvedProvider !== "github") {
+    throw new Error(`Invalid provider: ${resolvedProvider}. Supported: github.`);
+  }
+  writeHarnessStateJson(projectRoot, REVIEW_PROFILE_FILE, {
+    mode,
+    provider: resolvedProvider,
+    updated_at: new Date().toISOString()
+  });
+  showReviewProfile(projectRoot);
+}
+async function main() {
+  const args = process.argv.slice(2);
+  hydrateRuntimeProcessEnv(getContext());
+  if (isVersionProbe(args)) {
+    await printVersion();
+    return;
+  }
+  if (args[0] === "internal") {
+    await runInternal(args.slice(1));
+    return;
+  }
+  const ctx = getContext();
+  if (!BAKED_PROJECT_ROOT && !ctx) {
+    console.error("[rig-agent] Runtime binary is missing baked task context and no runtime context file found.");
+    console.error("[rig-agent] Set RIG_RUNTIME_CONTEXT_FILE or use the compiled host dispatch binary.");
+    process.exit(1);
+  }
+  await verifyRuntimeManifest();
+  const commandResult = await runAgentCommand(args);
+  if (commandResult !== undefined) {
+    process.exit(commandResult);
+  }
+  if (looksLikeShellInvocation(args)) {
+    const code = await runControlledBash(args, { projectRootFallbackDir: import.meta.dir });
+    process.exit(code);
+  }
+  console.error(`[rig-agent] Unknown command: ${args[0] || "(none)"}. Run 'rig-agent help' for usage.`);
+  process.exit(1);
+}
+function isVersionProbe(args) {
+  if (args.length !== 1) {
+    return false;
+  }
+  return args[0] === "--version" || args[0] === "-v" || args[0] === "version";
+}
+async function printVersion() {
+  const probe = await Bun.$`claude --version`.cwd(process.cwd()).env(process.env).quiet().nothrow();
+  if (probe.exitCode === 0) {
+    const output = probe.stdout.toString().trim();
+    if (output) {
+      console.log(output);
+      return;
+    }
+  }
+  console.log("rig-agent 1.0.0");
+}
+async function runAgentCommand(args) {
+  const [command, ...rest] = args;
+  if (!command || !TASK_COMMANDS.has(command)) {
+    return;
+  }
+  const ctx = getContext();
+  const projectRoot = ctx?.workspaceDir || BAKED_PROJECT_ROOT || "";
+  const taskId = ctx?.taskId || BAKED_TASK_ID || "";
+  if (!projectRoot) {
+    console.error("[rig-agent] No project root baked in.");
+    return 1;
+  }
+  if (!taskId) {
+    console.error("[rig-agent] No task ID baked in.");
+    return 1;
+  }
+  try {
+    switch (command) {
+      case "info":
+        await taskInfo2(projectRoot, taskId);
+        return 0;
+      case "scope":
+        await taskScope2(projectRoot, rest.includes("--files"), taskId);
+        return 0;
+      case "deps":
+        await taskDeps2(projectRoot, taskId);
+        return 0;
+      case "status":
+        taskStatus2(projectRoot);
+        return 0;
+      case "artifacts":
+        await taskArtifacts2(projectRoot, taskId);
+        return 0;
+      case "artifact-dir":
+        console.log(taskArtifactDir2(projectRoot, taskId));
+        return 0;
+      case "project-root":
+        console.log(projectRoot);
+        return 0;
+      case "monorepo-root":
+        console.log(resolveMonorepoRoot(projectRoot));
+        return 0;
+      case "artifact-write": {
+        const filename = rest[0];
+        if (!filename) {
+          console.error(`Usage: rig-agent artifact-write <filename> [--file <path>]
+` + `  Reads content from stdin (or --file), writes to the active task artifact dir.
+` + "  Example: echo '...' | rig-agent artifact-write collection-audit.md");
+          return 1;
+        }
+        let content;
+        const fileIdx = rest.indexOf("--file");
+        const inputFile = fileIdx !== -1 ? rest[fileIdx + 1] : undefined;
+        if (inputFile) {
+          content = readFileSync2(resolve3(projectRoot, inputFile), "utf-8");
+        } else {
+          const chunks = [];
+          for await (const chunk of process.stdin) {
+            chunks.push(Buffer.from(chunk));
+          }
+          content = Buffer.concat(chunks).toString("utf-8");
+        }
+        await taskArtifactWrite2(projectRoot, filename, content, taskId);
+        return 0;
+      }
+      case "validate": {
+        const passed = await taskValidate(projectRoot, taskId);
+        return passed ? 0 : 1;
+      }
+      case "completion-verification":
+      case "completition-verification":
+        return await runCompletionVerification(projectRoot);
+      case "lookup": {
+        if (rest.length !== 1) {
+          console.error("Usage: rig-agent lookup <task-id-or-source-id>");
+          return 1;
+        }
+        const lookupId = rest[0];
+        if (!lookupId) {
+          console.error("Usage: rig-agent lookup <task-id-or-source-id>");
+          return 1;
+        }
+        console.log(taskLookup2(projectRoot, lookupId));
+        return 0;
+      }
+      case "record": {
+        if (rest.length < 2) {
+          console.error("Usage: rig-agent record <decision|failure> <text>");
+          return 1;
+        }
+        const type = rest[0];
+        if (type !== "decision" && type !== "failure") {
+          console.error("Usage: rig-agent record <decision|failure> <text>");
+          return 1;
+        }
+        await taskRecord2(projectRoot, type, rest.slice(1).join(" "), taskId);
+        return 0;
+      }
+      case "memory": {
+        const memoryService = await loadCapabilityForRoot2(projectRoot, defineCapability4(MEMORY));
+        if (!memoryService) {
+          console.error("[rig-agent] Shared memory requires the @rig/memory-plugin plugin in rig.config.");
+          return 1;
+        }
+        const eventBus = getEventBus();
+        console.log(await memoryService.executeMemoryCommand({
+          projectRoot,
+          taskId,
+          runtimeContext: ctx,
+          args: rest,
+          ...eventBus ? { eventBus } : {}
+        }));
+        return 0;
+      }
+      case "git": {
+        const capabilityRoot = ctx?.hostProjectRoot || BAKED_PROJECT_ROOT || projectRoot;
+        await runGitCommand(projectRoot, taskId, rest, capabilityRoot);
+        return 0;
+      }
+      case "repo":
+      case "repo-sync":
+        runRepoSyncCommand(projectRoot, taskId, rest);
+        return 0;
+      case "profile":
+        runProfileCommand(projectRoot, rest);
+        return 0;
+      case "review":
+        runReviewCommand(projectRoot, rest);
+        return 0;
+      case "help":
+        printAgentHelp();
+        return 0;
+      default:
+        return;
+    }
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    return 1;
+  }
+}
+async function runGitCommand(projectRoot, bakedTaskId, args, capabilityRoot = projectRoot) {
+  const [sub = "status", ...rest] = args;
+  const task = takeOption(rest, "--task");
+  const tid = task.value || bakedTaskId;
+  const flags = task.rest;
+  const git = await loadLifecycleGit(capabilityRoot);
+  switch (sub) {
+    case "status":
+      git.gitStatus(projectRoot, tid);
+      return;
+    case "changed": {
+      const scoped = flags.includes("--scoped");
+      const files = git.gitChanged(projectRoot, tid, scoped);
+      console.log(files.length > 0 ? files.join(`
+`) : "(none)");
+      return;
+    }
+    case "preflight": {
+      const strict = flags.includes("--strict");
+      const ok = git.gitPreflight(projectRoot, tid, strict);
+      if (!ok)
+        throw new Error("Git preflight failed.");
+      return;
+    }
+    case "sync-branch":
+    case "ensure-branch":
+      git.gitSyncBranch(projectRoot, tid);
+      return;
+    case "commit": {
+      const target = takeOption(flags, "--target");
+      const message = takeOption(target.rest, "--message");
+      const allowEmpty = message.rest.includes("--allow-empty");
+      const scoped = git.shouldScopeGitCommit(message.rest, Boolean(tid));
+      git.gitCommit({
+        projectRoot,
+        taskId: tid,
+        target: target.value || "monorepo",
+        allowEmpty,
+        scoped,
+        ...message.value ? { message: message.value } : {}
+      });
+      return;
+    }
+    case "snapshot": {
+      const output = takeOption(flags, "--output");
+      const file = git.gitSnapshot(projectRoot, tid, output.value);
+      console.log(`Snapshot written: ${file}`);
+      return;
+    }
+    case "open-pr": {
+      const target = takeOption(flags, "--target");
+      const reviewer = takeOption(target.rest, "--reviewer");
+      const base = takeOption(reviewer.rest, "--base");
+      const title = takeOption(base.rest, "--title");
+      const body = takeOption(title.rest, "--body");
+      const draft = body.rest.includes("--draft");
+      const result = git.gitOpenPr({
+        projectRoot,
+        taskId: tid,
+        ...target.value ? { target: target.value } : {},
+        ...reviewer.value ? { reviewer: reviewer.value } : {},
+        ...base.value ? { base: base.value } : {},
+        ...title.value ? { title: title.value } : {},
+        ...body.value ? { body: body.value } : {},
+        draft
+      });
+      console.log(`PR ready (${result.repoLabel}): ${result.url}`);
+      console.log(`Reviewer assigned: ${result.reviewer} (${result.reviewerSource})`);
+      return;
+    }
+    default:
+      throw new Error(`Unknown git subcommand: ${sub}. Try: status, changed, preflight, sync-branch, commit, snapshot, open-pr`);
+  }
+}
+function runRepoSyncCommand(projectRoot, bakedTaskId, args) {
+  const [sub = "ensure", ...rest] = args;
+  const task = takeOption(rest, "--task");
+  const tid = task.value || bakedTaskId;
+  switch (sub) {
+    case "sync":
+    case "ensure":
+      repoEnsure(projectRoot, tid);
+      return;
+    case "pins": {
+      const pins = repoPins(projectRoot, tid);
+      printPins(pins);
+      return;
+    }
+    case "verify": {
+      const ok = repoVerify(projectRoot, tid);
+      if (!ok)
+        throw new Error("Repo pin verification failed.");
+      return;
+    }
+    case "discover": {
+      const pins = repoDiscover(projectRoot, tid);
+      printPins(pins);
+      return;
+    }
+    case "baseline": {
+      const refresh = task.rest.includes("--refresh");
+      const pins = repoBaseline(projectRoot, refresh);
+      printPins(pins);
+      return;
+    }
+    default:
+      throw new Error(`Unknown repo subcommand: ${sub}. Try: sync, ensure, pins, verify, discover, baseline`);
+  }
+}
+function runProfileCommand(projectRoot, args) {
+  const [sub = "show", ...rest] = args;
+  if (sub === "show") {
+    showProfile(projectRoot, rest.includes("--compact"));
+    return;
+  }
+  if (sub === "set") {
+    const first = rest[0];
+    if (first === "claude-code" || first === "codex-cli" || first === "codex-app-server") {
+      setProfile(projectRoot, { preset: first });
+      return;
+    }
+    const model = takeOption(rest, "--model");
+    const runtime = takeOption(model.rest, "--runtime");
+    const plugin = takeOption(runtime.rest, "--plugin");
+    setProfile(projectRoot, {
+      ...model.value ? { model: model.value } : {},
+      ...runtime.value ? { runtime: runtime.value } : {},
+      ...plugin.value ? { plugin: plugin.value } : {}
+    });
+    return;
+  }
+  throw new Error(`Unknown profile subcommand: ${sub}. Try: show, set`);
+}
+function runReviewCommand(projectRoot, args) {
+  const [sub = "show", ...rest] = args;
+  if (sub === "show") {
+    showReviewProfile(projectRoot);
+    return;
+  }
+  if (sub === "set") {
+    const mode = rest[0];
+    if (!mode) {
+      throw new Error("Usage: rig-agent review set <off|advisory|required> [--provider github]");
+    }
+    const provider = takeOption(rest.slice(1), "--provider");
+    setReviewProfile(projectRoot, mode, provider.value);
+    return;
+  }
+  throw new Error(`Unknown review subcommand: ${sub}. Try: show, set`);
+}
+function takeOption(args, option) {
+  const rest = [];
+  let value;
+  for (let i = 0;i < args.length; i += 1) {
+    const current = args[i];
+    if (current === option) {
+      const next = args[i + 1];
+      if (!next || next.startsWith("-")) {
+        throw new Error(`Missing value for ${option}`);
+      }
+      value = next;
+      i += 1;
+      continue;
+    }
+    if (current !== undefined) {
+      rest.push(current);
+    }
+  }
+  return { value, rest };
+}
+function printPins(pins) {
+  if (Object.keys(pins).length === 0) {
+    console.log("(none)");
+    return;
+  }
+  for (const [key, value] of Object.entries(pins)) {
+    console.log(`${key}	${value}`);
+  }
+}
+function printAgentHelp() {
+  console.log(`rig-agent \u2014 CLI for Project Rig agents
+
+ORIENTATION:
+  rig-agent info              Your task, role, scope, deps \u2014 start here
+  rig-agent scope [--files]   Scope globs; --files expands to file list
+  rig-agent deps              Read dependency artifacts (decisions, next-actions)
+  rig-agent lookup <id>       Validate a task/source ID
+  rig-agent status            Epic/task progress overview
+
+EXECUTION:
+  rig-agent validate          Run validation commands for your task
+  rig-agent record decision "..."  Record an architectural decision
+  rig-agent record failure "..."   Record a failed approach (cross-session only \u2014 not re-read in this session)
+  rig-agent memory observe ...     Promote a shared memory immediately
+  rig-agent memory recall [query]  Recall relevant shared memories
+  rig-agent git status        Task-aware git status
+  rig-agent git changed       Changed files (--scoped for scope-filtered)
+  rig-agent git commit        Task-aware commit (--target monorepo|project|both)
+  rig-agent git snapshot      Capture worktree state
+  rig-agent git sync-branch   Ensure task branch exists
+  rig-agent git open-pr       Create PR for task changes
+  rig-agent repo sync         Ensure monorepo checkout + task repo pins
+  rig-agent profile show      Show runtime profile
+  rig-agent review show       Show AI review gate settings
+
+COMPLETION:
+  rig-agent artifacts                   Scaffold completion artifacts (templates)
+  rig-agent artifact-dir                Print absolute artifact directory path
+  rig-agent project-root                Print absolute task worktree root
+  rig-agent monorepo-root               Print absolute monorepo root in the task worktree
+  rig-agent artifact-write <filename>   Write artifact from stdin
+  rig-agent completion-verification     Run final validation/review gate
+  rig-agent completition-verification   Alias for the same final gate
+
+WORKFLOW:
+  1. rig-agent info            Understand your assignment
+  2. rig-agent deps            Read what prior tasks decided
+  3. rig-agent repo sync         Align monorepo checkout + repo pins
+  4. (do your work)
+  5. rig-agent record decision "chose X because Y"
+  6. rig-agent validate        Check your work
+  7. rig-agent artifacts       Scaffold completion artifacts
+  8. rig-agent artifact-write collection-audit.md  (write custom artifacts)
+  9. rig-agent completion-verification
+`);
+}
+async function runCompletionVerification(projectRoot) {
+  const host = await buildProjectPluginHost(projectRoot);
+  const verification = host ? await defineServiceCapability2(LIFECYCLE_VERIFICATION_SERVICE2).resolveService(host) : null;
+  if (!verification) {
+    console.error("[rig-agent] Completion verification requires the @rig/lifecycle-plugin plugin in rig.config.");
+    return 1;
+  }
+  const { ok } = await verification.verifyCompletion({ projectRoot });
+  return ok ? 0 : 1;
+}
+async function runInternal(args) {
+  const [command = "", ...rest] = args;
+  if (command === "shell") {
+    const code = await runControlledBash(rest, { projectRootFallbackDir: import.meta.dir });
+    process.exit(code);
+  }
+  if (command === "manifest-verify") {
+    await verifyRuntimeManifest();
+    console.log("manifest: ok");
+    return;
+  }
+  throw new Error("Unknown internal command. Use `rig-agent internal shell <bash-args...>` or `rig-agent internal manifest-verify`.");
+}
+async function verifyRuntimeManifest() {
+  if (getContext()) {
+    return;
+  }
+  const manifestPath = BAKED_MANIFEST_PATH;
+  if (!manifestPath) {
+    return;
+  }
+  if (!existsSync3(manifestPath)) {
+    throw new Error(`[rig-agent] Runtime manifest missing: ${manifestPath}`);
+  }
+  let manifest;
+  try {
+    manifest = await Bun.file(manifestPath).json();
+  } catch (error) {
+    throw new Error(`[rig-agent] Failed to parse runtime manifest at ${manifestPath}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  assertMatch("taskId", BAKED_TASK_ID, manifest.taskId);
+  assertMatch("runtimeId", BAKED_RUNTIME_ID, manifest.runtimeId);
+  assertMatch("scopeHash", BAKED_SCOPE_HASH, manifest.scopeHash);
+  const manifestBinaryPath = manifest.binary?.path || BAKED_BINARY_PATH || process.execPath;
+  const expectedHash = manifest.binary?.sha256 || "";
+  if (!manifestBinaryPath || !expectedHash) {
+    throw new Error(`[rig-agent] Runtime manifest is missing binary hash data (${manifestPath}).`);
+  }
+  if (!existsSync3(manifestBinaryPath)) {
+    throw new Error(`[rig-agent] Runtime binary not found at ${manifestBinaryPath}.`);
+  }
+  const actualHash = sha256Hex(readFileSync2(resolve3(manifestBinaryPath)));
+  if (actualHash !== expectedHash) {
+    throw new Error(`[rig-agent] Runtime manifest mismatch for binary hash.
+` + `expected=${expectedHash}
+` + `actual=${actualHash}
+` + `path=${manifestBinaryPath}`);
+  }
+}
+function assertMatch(name, expected, actual) {
+  if (!expected && !actual) {
+    return;
+  }
+  if (expected !== (actual || "")) {
+    throw new Error(`[rig-agent] Runtime manifest mismatch for ${name}: expected='${expected}' actual='${actual || ""}'.`);
+  }
+}
+var BUILD_CONFIG, BAKED_BINARY_PATH, BAKED_MANIFEST_PATH, BAKED_PROJECT_ROOT, BAKED_RUNTIME_ID, BAKED_TASK_ID, BAKED_SCOPE_HASH, BAKED_INFO_OUTPUT, BAKED_DEPS_OUTPUT, BAKED_STATUS_OUTPUT, BAKED_GIT_BRANCH, BAKED_BASE_COMMIT, cachedContext, cachedEventBus, GITHUB_KNOWN_HOSTS, AGENT_PROFILE_FILE = "agent-profile.json", REVIEW_PROFILE_FILE = "review-profile.json", DEFAULT_AGENT_PROFILE, DEFAULT_REVIEW_MODE, DEFAULT_REVIEW_PROVIDER, TASK_COMMANDS;
+var init_rig_agent = __esm(() => {
+  init_controlled_bash();
+  init_runtime_secrets();
+  init_git_ops();
+  init_profile_state();
+  init_repo_ops();
+  init_task_ops();
+  BUILD_CONFIG = readBuildConfig();
+  BAKED_BINARY_PATH = BUILD_CONFIG.AGENT_BINARY_PATH ?? "";
+  BAKED_MANIFEST_PATH = BUILD_CONFIG.AGENT_MANIFEST_PATH ?? "";
+  BAKED_PROJECT_ROOT = BUILD_CONFIG.AGENT_PROJECT_ROOT ?? "";
+  BAKED_RUNTIME_ID = BUILD_CONFIG.AGENT_RUNTIME_ID ?? "";
+  BAKED_TASK_ID = BUILD_CONFIG.AGENT_TASK_ID ?? "";
+  BAKED_SCOPE_HASH = BUILD_CONFIG.AGENT_SCOPE_HASH ?? "";
+  BAKED_INFO_OUTPUT = BUILD_CONFIG.AGENT_INFO_OUTPUT ?? "";
+  BAKED_DEPS_OUTPUT = BUILD_CONFIG.AGENT_DEPS_OUTPUT ?? "";
+  BAKED_STATUS_OUTPUT = BUILD_CONFIG.AGENT_STATUS_OUTPUT ?? "";
+  BAKED_GIT_BRANCH = BUILD_CONFIG.AGENT_GIT_BRANCH ?? "";
+  BAKED_BASE_COMMIT = BUILD_CONFIG.AGENT_BASE_COMMIT ?? "";
+  if (BAKED_BINARY_PATH) {
+    const binaryDir = dirname(BAKED_BINARY_PATH);
+    const currentPath = process.env.PATH || "";
+    const pathEntries = currentPath.split(":").filter(Boolean);
+    if (!pathEntries.includes(binaryDir)) {
+      process.env.PATH = currentPath ? `${binaryDir}:${currentPath}` : binaryDir;
+    }
+  }
+  GITHUB_KNOWN_HOSTS = [
+    "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl",
+    "github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=",
+    "github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk="
+  ];
+  DEFAULT_AGENT_PROFILE = { model: "pi", runtime: "pi", agent_plugin: "pi" };
+  DEFAULT_REVIEW_MODE = parseEnvOrDefault(process.env.AI_REVIEW_MODE, ["off", "advisory", "required"], "advisory");
+  DEFAULT_REVIEW_PROVIDER = parseEnvOrDefault(process.env.AI_REVIEW_PROVIDER, ["github"], "github");
+  TASK_COMMANDS = new Set([
+    "info",
+    "scope",
+    "deps",
+    "status",
+    "artifacts",
+    "artifact-dir",
+    "artifact-write",
+    "project-root",
+    "monorepo-root",
+    "validate",
+    "lookup",
+    "record",
+    "help",
+    "completion-verification",
+    "completition-verification",
+    "git",
+    "repo",
+    "repo-sync",
+    "profile",
+    "review",
+    "memory"
+  ]);
+  main().catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  });
+});
+
+// packages/harness-plugin/src/agent-harness/rig-agent-entrypoint.ts
+var exports_rig_agent_entrypoint = {};
+__export(exports_rig_agent_entrypoint, {
+  runRigAgentEntrypoint: () => runRigAgentEntrypoint
+});
+import { adopt } from "@rig/core/kernel-entrypoint";
+async function runRigAgentEntrypoint() {
+  await adopt(undefined, { entrypoint: "rig-agent" });
+  await Promise.resolve().then(() => (init_rig_agent(), exports_rig_agent));
+}
+var init_rig_agent_entrypoint = () => {};
+
+// packages/harness-plugin/src/agent-harness/runtime-snapshot-config.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { resolve as resolve4 } from "path";
+function loadRuntimeSnapshotConfig(projectRoot) {
+  const configPath = resolve4(projectRoot, "rig/policy/policy.json");
+  if (!existsSync4(configPath))
+    return { ...DEFAULT_RUNTIME_SNAPSHOT };
+  try {
+    const parsed = JSON.parse(readFileSync3(configPath, "utf8"));
+    const runtimeSnapshot = parsed.runtime_snapshot;
+    if (runtimeSnapshot && typeof runtimeSnapshot === "object" && !Array.isArray(runtimeSnapshot)) {
+      const enabled = runtimeSnapshot.enabled;
+      if (typeof enabled === "boolean")
+        return { enabled };
+    }
+  } catch {
+    return { ...DEFAULT_RUNTIME_SNAPSHOT };
+  }
+  return { ...DEFAULT_RUNTIME_SNAPSHOT };
+}
+var DEFAULT_RUNTIME_SNAPSHOT;
+var init_runtime_snapshot_config = __esm(() => {
+  DEFAULT_RUNTIME_SNAPSHOT = { enabled: true };
+});
+
+// packages/harness-plugin/src/agent-harness/agent-wrapper.ts
+var exports_agent_wrapper = {};
+__export(exports_agent_wrapper, {
+  startOptionalRuntimeSnapshotSidecar: () => startOptionalRuntimeSnapshotSidecar,
+  shouldBypassProviderSandboxOnPlatform: () => shouldBypassProviderSandboxOnPlatform,
+  runPiRpcProviderFallback: () => runPiRpcProviderFallback,
+  runPiRpcProvider: () => runPiRpcProvider,
+  runAgentWrapper: () => runAgentWrapper,
+  resolveRuntimeHandoffPath: () => resolveRuntimeHandoffPath,
+  resolveProvider: () => resolveProvider,
+  resolveOuterSandboxBypass: () => resolveOuterSandboxBypass,
+  resolveFinalProviderExitCode: () => resolveFinalProviderExitCode,
+  recordSnapshotMissingTaskSourceEvidence: () => recordSnapshotMissingTaskSourceEvidence,
+  recordRuntimeHandoff: () => recordRuntimeHandoff,
+  isTaskClosed: () => isTaskClosed,
+  finalizeRuntimeSnapshot: () => finalizeRuntimeSnapshot,
+  buildProviderArgs: () => buildProviderArgs
+});
+import { createRequire } from "module";
+import { resolve as resolve5 } from "path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
+import { assertPathInsideRoot, safePathSegment, taskRuntimeId } from "@rig/core/safe-identifiers";
+import {
+  ISOLATION_BACKEND,
+  TASK_SOURCE_REFLECTION,
+  TASK_STATE_STORE as TASK_STATE_STORE2,
+  TASK_TERMINAL_STATE
+} from "@rig/contracts";
+import { defineCapability as defineCapability5 } from "@rig/core/capability";
+import { loadCapabilityForRoot as loadCapabilityForRoot3, requireCapabilityForRoot } from "@rig/core/capability-loaders";
+function resolveTaskSourceReflection(projectRoot) {
+  let cached = taskSourceReflectionByRoot.get(projectRoot);
+  if (!cached) {
+    cached = loadCapabilityForRoot3(projectRoot, TaskSourceReflectionCap);
+    taskSourceReflectionByRoot.set(projectRoot, cached);
+  }
+  return cached;
+}
+function resolveTaskTerminalState(projectRoot) {
+  let cached = taskTerminalStateByRoot.get(projectRoot);
+  if (!cached) {
+    cached = requireCapabilityForRoot(projectRoot, TaskTerminalStateCap, `No TASK_TERMINAL_STATE capability is registered for project root "${projectRoot}". ` + "Install @rig/lifecycle-plugin (it ships in the default bundle) so the agent executor can resolve task terminal state.");
+    taskTerminalStateByRoot.set(projectRoot, cached);
+  }
+  return cached;
+}
+function resolveTaskStateStore(projectRoot) {
+  let cached = taskStateStoreByRoot.get(projectRoot);
+  if (!cached) {
+    cached = requireCapabilityForRoot(projectRoot, TaskStateStoreCap2, `No TASK_STATE_STORE capability is registered for project root "${projectRoot}". ` + "Install @rig/tasks-plugin (it ships in the default bundle) so the agent executor can resolve task-state reads.");
+    taskStateStoreByRoot.set(projectRoot, cached);
+  }
+  return cached;
+}
+async function finalizeRuntimeSnapshot(snapshotSidecar, providerCommand, exitCode, context) {
+  try {
+    await snapshotSidecar.finalize(providerCommand, exitCode);
+    return { ok: true };
+  } catch (error) {
+    emitWrapperEvent("runtime.snapshot.finalize.failed", {
+      runtimeId: context.runtimeId,
+      taskId: context.taskId,
+      exitCode,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    console.error(`[rig-agent] Snapshot finalize failed for ${context.taskId}: ${error instanceof Error ? error.message : String(error)}`);
+    if (exitCode !== 0) {
+      throw error;
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    return { ok: false, snapshotMissing: true, error: message };
+  }
+}
+async function startOptionalRuntimeSnapshotSidecar(runtime, startSidecar) {
+  try {
+    return await startSidecar(runtime, { instanceId: `${runtime.id}-wrapper` });
+  } catch (error) {
+    emitWrapperEvent("runtime.snapshot.start.failed", {
+      runtimeId: runtime.id,
+      taskId: runtime.taskId,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    console.error(`[rig-agent] Runtime snapshotting unavailable for ${runtime.taskId}: ${error instanceof Error ? error.message : String(error)}`);
+    return null;
+  }
+}
+async function runAgentWrapper(options = {}) {
+  const projectRoot = resolve5(options.projectRoot || process.env.PROJECT_RIG_ROOT || process.cwd());
+  const argv = options.argv || process.argv.slice(2);
+  if (argv.length === 0 || argv[0] === "--version" || argv[0] === "--help" || argv[0] === "help") {
+    console.log("[rig-agent] dispatch ready");
+    return 0;
+  }
+  const taskId = await resolveTaskId(projectRoot);
+  if (!taskId) {
+    console.error("[rig-agent] No active task ID found (checked env, runtime path, task-state current task).");
+    console.error("[rig-agent] Refusing to run unsandboxed. Ensure task runtime/session injection is active.");
+    return 1;
+  }
+  const provider = resolveProvider();
+  await printTaskContext(projectRoot, taskId);
+  let runtime;
+  let isolationBackend;
+  try {
+    emitWrapperEvent("runtime.provision.started", {
+      projectRoot,
+      taskId,
+      mode: "worktree"
+    });
+    isolationBackend = await requireCapabilityForRoot(projectRoot, defineCapability5(ISOLATION_BACKEND), `No ISOLATION_BACKEND capability is registered for project root "${projectRoot}". ` + "Install @rig/isolation-plugin (it ships in the default bundle) so runtime provisioning can resolve a backend.");
+    const taskRecordReader = await taskRecordReaderFromState(projectRoot);
+    runtime = await isolationBackend.ensureAgentRuntime({
+      projectRoot,
+      id: taskRuntimeId(taskId),
+      taskId,
+      mode: "worktree",
+      provider,
+      ...taskRecordReader ? { taskRecordReader } : {},
+      preserveTaskArtifacts: process.env.RIG_RUN_RESUME === "1" || process.env.RIG_RUNTIME_ARTIFACT_CLEANUP === "preserve"
+    });
+    emitWrapperEvent("runtime.provision.completed", {
+      runtimeId: runtime.id,
+      taskId,
+      workspaceDir: runtime.workspaceDir,
+      sessionDir: runtime.sessionDir,
+      logsDir: runtime.logsDir,
+      stateDir: runtime.stateDir,
+      contextFile: runtime.contextFile,
+      snapshotManaged: true
+    });
+  } catch (error) {
+    emitWrapperEvent("runtime.provision.failed", {
+      taskId,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    console.error(`[rig-agent] Failed to provision runtime: ${error}`);
+    return 1;
+  }
+  try {
+    await waitForDirtyBaselineReady(runtime, taskId);
+  } catch (error) {
+    emitWrapperEvent("runtime.baseline.failed", {
+      runtimeId: runtime.id,
+      taskId,
+      workspaceDir: runtime.workspaceDir,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    console.error(`[rig-agent] Failed to apply selected baseline before provider launch: ${error}`);
+    return 1;
+  }
+  const providerArgs = buildProviderArgs(provider, runtime, argv);
+  const providerCommand = [providerBinary(provider), ...providerArgs];
+  emitWrapperEvent("provider.launch", {
+    provider,
+    runtimeId: runtime.id,
+    taskId,
+    workspaceDir: runtime.workspaceDir,
+    command: providerCommand
+  });
+  const env = await isolationBackend.runtimeEnv(projectRoot, runtime);
+  const bypassOuterRuntimeSandbox = resolveOuterSandboxBypass(provider, process.platform, process.env.RIG_RUNTIME_SANDBOX?.trim());
+  if (provider === "pi") {
+    env.PI_CODING_AGENT_DIR = resolve5(runtime.homeDir, ".pi", "agent");
+    env.PI_CODING_AGENT_SESSION_DIR = runtime.sessionDir;
+  }
+  env.RIG_RUNTIME_SANDBOX = process.env.RIG_RUNTIME_SANDBOX?.trim() || "enforce";
+  const snapshotEnabled = loadRuntimeSnapshotConfig(projectRoot).enabled;
+  const snapshotSidecar = snapshotEnabled ? await startOptionalRuntimeSnapshotSidecar(runtime, (rt, opts) => isolationBackend.startRuntimeSnapshotSidecar(rt, opts)) : null;
+  let exitCode = 1;
+  let snapshotFinalizeResult = { ok: true };
+  try {
+    const command = bypassOuterRuntimeSandbox ? providerCommand : (await isolationBackend.wrapRuntimeSandbox({
+      projectRoot,
+      runtime: {
+        id: runtime.id,
+        mode: runtime.mode,
+        rootDir: runtime.rootDir,
+        workspaceDir: runtime.workspaceDir,
+        binDir: runtime.binDir,
+        homeDir: runtime.homeDir,
+        tmpDir: runtime.tmpDir,
+        cacheDir: runtime.cacheDir,
+        stateDir: runtime.stateDir,
+        sessionDir: runtime.sessionDir,
+        claudeHomeDir: runtime.claudeHomeDir
+      },
+      command: providerCommand
+    })).command;
+    if (isPiRpcArgs(providerArgs)) {
+      const prompt = await readProcessStdin();
+      const runId = process.env.RIG_SERVER_RUN_ID?.trim();
+      exitCode = await runPiRpcProviderFallback({
+        command,
+        cwd: runtime.workspaceDir,
+        env,
+        prompt,
+        ...runId ? { runId } : {},
+        sessionName: runId ? `Rig ${runId}` : `Rig ${runtime.taskId}`
+      });
+    } else {
+      const proc = Bun.spawn(command, {
+        cwd: runtime.workspaceDir,
+        env,
+        stdin: "inherit",
+        stdout: "inherit",
+        stderr: "inherit"
+      });
+      exitCode = await proc.exited;
+    }
+    if (snapshotSidecar) {
+      snapshotFinalizeResult = await finalizeRuntimeSnapshot(snapshotSidecar, providerCommand, exitCode, {
+        runtimeId: runtime.id,
+        taskId
+      });
+    }
+  } catch (error) {
+    if (snapshotSidecar) {
+      await snapshotSidecar.cancel();
+    }
+    throw error;
+  }
+  const serverManagedRun = Boolean(process.env.RIG_SERVER_RUN_ID?.trim());
+  const taskClosed = await isTaskClosed(projectRoot, taskId);
+  const finalExitCode = resolveFinalProviderExitCode({
+    providerExitCode: exitCode,
+    taskClosed,
+    serverManagedRun
+  });
+  const snapshotMissing = !snapshotFinalizeResult.ok;
+  const handoffRequired = exitCode !== 0 || snapshotMissing || !taskClosed && !serverManagedRun;
+  emitWrapperEvent("provider.completed", {
+    provider,
+    runtimeId: runtime.id,
+    taskId,
+    exitCode: finalExitCode,
+    providerExitCode: exitCode,
+    taskClosed,
+    serverManagedRun,
+    handoffRequired,
+    snapshotMissing,
+    ...!snapshotFinalizeResult.ok ? { snapshotFinalizeError: snapshotFinalizeResult.error } : {}
+  });
+  if (handoffRequired) {
+    recordRuntimeHandoff(projectRoot, runtime, taskId, exitCode, {
+      snapshotMissing,
+      snapshotFinalizeError: snapshotFinalizeResult.ok ? null : snapshotFinalizeResult.error
+    });
+    if (!snapshotFinalizeResult.ok) {
+      await recordSnapshotMissingTaskSourceEvidence(projectRoot, taskId, runtime, snapshotFinalizeResult.error);
+    }
+  }
+  return finalExitCode;
+}
+function parseJsonRecord(line) {
+  try {
+    const parsed = JSON.parse(line);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function readProcessStdin() {
+  if (process.stdin.isTTY)
+    return "";
+  return await new Promise((resolveRead) => {
+    let data = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+      data += String(chunk);
+    });
+    process.stdin.on("end", () => resolveRead(data));
+    process.stdin.resume();
+  });
+}
+async function pumpReadableLines(stream, onLine) {
+  if (!stream)
+    return;
+  const reader = stream.getReader();
+  const decoder = new TextDecoder;
+  let buffer = "";
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      buffer += decoder.decode(value, { stream: true });
+      const parts = buffer.split(/\r?\n/);
+      buffer = parts.pop() ?? "";
+      for (const part of parts)
+        onLine(part);
+    }
+    buffer += decoder.decode();
+    if (buffer)
+      onLine(buffer);
+  } finally {
+    reader.releaseLock();
+  }
+}
+function isBlockingPiRpcUiRequest(record) {
+  if (record.type !== "extension_ui_request")
+    return false;
+  return record.method === "select" || record.method === "confirm" || record.method === "input" || record.method === "editor";
+}
+function writeRpcCommand(stdin, command) {
+  stdin.write(`${JSON.stringify(command)}
+`);
+}
+function joinUrl(baseUrl, pathname) {
+  return `${baseUrl.replace(/\/+$/, "")}${pathname.startsWith("/") ? pathname : `/${pathname}`}`;
+}
+async function readQueuedSteeringFromServer(input) {
+  if (!input.serverUrl || !input.runId)
+    return [];
+  const headers = {};
+  if (input.authToken)
+    headers.authorization = `Bearer ${input.authToken}`;
+  if (input.projectRoot)
+    headers["x-rig-project-root"] = input.projectRoot;
+  const response = await fetch(joinUrl(input.serverUrl, `/api/runs/${encodeURIComponent(input.runId)}/steering?ack=1`), { headers });
+  if (!response.ok) {
+    throw new Error(`steering read rejected (${response.status}) at ${input.serverUrl}`);
+  }
+  const payload = await response.json().catch(() => null);
+  const messages = payload && typeof payload === "object" && !Array.isArray(payload) ? payload.messages : null;
+  return Array.isArray(messages) ? messages.filter((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry))) : [];
+}
+function steeringMessageText(entry) {
+  const message = typeof entry.message === "string" ? entry.message.trim() : "";
+  return message || null;
+}
+function isPiRpcArgs(args) {
+  return cliOptionValue(args, "--mode") === "rpc";
+}
+async function runPiRpcProviderFallback(input) {
+  const stdout = input.stdout ?? process.stdout;
+  const stderr = input.stderr ?? process.stderr;
+  const proc = Bun.spawn(input.command, {
+    cwd: input.cwd,
+    env: input.env,
+    stdin: "pipe",
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  let sawAgentEnd = false;
+  let promptError = null;
+  let stdinOpen = true;
+  let steeringPollStopped = false;
+  const closeStdin = () => {
+    if (!stdinOpen)
+      return;
+    stdinOpen = false;
+    try {
+      steeringPollStopped = true;
+      proc.stdin.end();
+    } catch {}
+  };
+  const send = (command) => {
+    if (!stdinOpen)
+      return;
+    try {
+      writeRpcCommand(proc.stdin, command);
+    } catch (error) {
+      promptError ??= error instanceof Error ? error.message : String(error);
+    }
+  };
+  const forwardSigterm = () => {
+    try {
+      proc.kill("SIGTERM");
+    } catch {}
+  };
+  process.once("SIGTERM", forwardSigterm);
+  const pollSteering = async () => {
+    const serverUrl = input.env.RIG_SERVER_URL || input.env.RIG_SERVER_BASE_URL;
+    const authToken = input.env.RIG_AUTH_TOKEN || input.env.RIG_SERVER_AUTH_TOKEN;
+    const projectRoot = input.env.PROJECT_RIG_ROOT || input.env.RIG_HOST_PROJECT_ROOT || process.env.PROJECT_RIG_ROOT;
+    let lastReportedPollError = null;
+    while (!steeringPollStopped && stdinOpen) {
+      try {
+        const messages = await readQueuedSteeringFromServer({
+          ...serverUrl ? { serverUrl } : {},
+          ...authToken ? { authToken } : {},
+          ...input.runId ? { runId: input.runId } : {},
+          ...projectRoot ? { projectRoot } : {}
+        });
+        lastReportedPollError = null;
+        for (const message of messages) {
+          const text = steeringMessageText(message);
+          if (!text || !stdinOpen)
+            continue;
+          send({
+            id: typeof message.id === "string" ? `rig_steer_${message.id}` : `rig_steer_${Date.now()}`,
+            type: "prompt",
+            message: text,
+            streamingBehavior: "steer"
+          });
+          emitWrapperEvent("pi.rpc.steering.delivered", {
+            runId: input.runId ?? null,
+            steeringId: typeof message.id === "string" ? message.id : null,
+            actor: typeof message.actor === "string" ? message.actor : "operator",
+            message: text
+          });
+        }
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (message !== lastReportedPollError) {
+          lastReportedPollError = message;
+          emitWrapperEvent("pi.rpc.steering.poll.failed", {
+            runId: input.runId ?? null,
+            error: message
+          });
+        }
+      }
+      await sleep(1000);
+    }
+  };
+  const stdoutPump = pumpReadableLines(proc.stdout, (line) => {
+    stdout.write(`${line}
+`);
+    const record = parseJsonRecord(line.trim());
+    if (!record)
+      return;
+    if (record.type === "agent_end") {
+      sawAgentEnd = true;
+      closeStdin();
+      return;
+    }
+    if (record.type === "response" && record.command === "prompt" && record.success === false) {
+      promptError = typeof record.error === "string" ? record.error : "Pi RPC prompt failed.";
+      closeStdin();
+      return;
+    }
+    if (isBlockingPiRpcUiRequest(record)) {
+      const id = typeof record.id === "string" ? record.id : "";
+      if (id) {
+        send({ type: "extension_ui_response", id, cancelled: true });
+        emitWrapperEvent("pi.rpc.extension_ui.cancelled", {
+          id,
+          method: record.method,
+          reason: "noninteractive Rig worker RPC session"
+        });
+      }
+    }
+  });
+  const stderrPump = pumpReadableLines(proc.stderr, (line) => {
+    stderr.write(`${line}
+`);
+  });
+  if (input.sessionName?.trim()) {
+    send({ id: "rig_set_session_name", type: "set_session_name", name: input.sessionName.trim() });
+  }
+  const steeringPollPromise = pollSteering();
+  if (input.prompt.trim()) {
+    send({ id: "rig_initial_prompt", type: "prompt", message: input.prompt });
+    emitWrapperEvent("pi.rpc.prompt.sent", {
+      runId: input.runId ?? null,
+      kind: "initial",
+      bytes: Buffer.byteLength(input.prompt)
+    });
+  } else {
+    closeStdin();
+  }
+  const exitCode = await proc.exited;
+  process.off("SIGTERM", forwardSigterm);
+  steeringPollStopped = true;
+  await Promise.all([stdoutPump, stderrPump, steeringPollPromise]);
+  if (promptError) {
+    stderr.write(`[rig-agent] Pi RPC prompt failed: ${promptError}
+`);
+    return exitCode === 0 ? 1 : exitCode;
+  }
+  if (input.prompt.trim() && !sawAgentEnd && exitCode === 0) {
+    stderr.write(`[rig-agent] Pi RPC exited before emitting agent_end.
+`);
+    return 1;
+  }
+  return exitCode;
+}
+function resolveFinalProviderExitCode(input) {
+  if (input.providerExitCode !== 0) {
+    return input.providerExitCode;
+  }
+  if (input.taskClosed || input.serverManagedRun) {
+    return 0;
+  }
+  return 0;
+}
+function shouldBypassProviderSandboxOnPlatform(provider, platform) {
+  if (platform !== "darwin") {
+    return false;
+  }
+  return provider === "pi";
+}
+function resolveOuterSandboxBypass(provider, platform, explicitSandboxSetting) {
+  if (explicitSandboxSetting === "enforce")
+    return false;
+  return shouldBypassProviderSandboxOnPlatform(provider, platform);
+}
+function buildProviderArgs(_provider, _runtime, argv) {
+  const piArgs = argv.filter((arg) => arg !== "__rig_pi_session_daemon__");
+  const piProvider = cliOptionValue(piArgs, "--provider") || process.env.RIG_PI_PROVIDER?.trim() || "openai-codex";
+  if (!hasCliOption(piArgs, "--provider")) {
+    piArgs.unshift(piProvider);
+    piArgs.unshift("--provider");
+  }
+  const model = cliOptionValue(piArgs, "--model") || process.env.RIG_PI_MODEL?.trim() || "gpt-5.5";
+  if (hasCliOption(piArgs, "--model")) {
+    rewriteCliOptionValue(piArgs, "--model", normalizePiModelForProvider(model, piProvider));
+  } else {
+    piArgs.unshift(normalizePiModelForProvider(model, piProvider));
+    piArgs.unshift("--model");
+  }
+  if (!hasCliOption(piArgs, "--mode")) {
+    piArgs.push("--mode", process.env.RIG_PI_TRANSPORT?.trim() === "print" ? "json" : "rpc");
+    if (process.env.RIG_PI_TRANSPORT?.trim() === "print" && !hasCliOption(piArgs, "--print")) {
+      piArgs.push("--print");
+    }
+  }
+  return piArgs;
+}
+function readStringList2(candidate) {
+  return Array.isArray(candidate) ? candidate.filter((entry) => typeof entry === "string") : [];
+}
+function firstStringList2(...candidates) {
+  for (const candidate of candidates) {
+    const values = readStringList2(candidate);
+    if (values.length > 0)
+      return values;
+  }
+  return [];
+}
+function taskConfigEntryToRecord2(id, entry, source) {
+  const record = entry;
+  return {
+    id,
+    deps: firstStringList2(record.deps, record.dependencies, record.validation_deps, record.validationDeps),
+    status: typeof entry.status === "string" && entry.status.trim().length > 0 ? entry.status : "open",
+    source,
+    ...typeof entry.title === "string" ? { title: entry.title } : {},
+    ...typeof entry.description === "string" ? { description: entry.description } : {},
+    ...typeof entry.acceptance_criteria === "string" ? { acceptanceCriteria: entry.acceptance_criteria } : {},
+    ...typeof record.acceptanceCriteria === "string" ? { acceptanceCriteria: record.acceptanceCriteria } : {},
+    ...Array.isArray(entry.scope) ? { scope: entry.scope } : {},
+    ...Array.isArray(entry.validation) ? { validation: entry.validation } : {},
+    ...typeof entry.role === "string" ? { role: entry.role } : {}
+  };
+}
+async function taskRecordReaderFromState(projectRoot) {
+  const store = await resolveTaskStateStore(projectRoot);
+  return {
+    async listTasks() {
+      const sourceRecords = Object.entries(store.readSourceTaskConfig(projectRoot)).map(([id, entry]) => taskConfigEntryToRecord2(id, entry, "source-task-config"));
+      const sourceIds = new Set(sourceRecords.map((task) => task.id));
+      const legacyRecords = Object.entries(store.readTaskConfig(projectRoot)).filter(([id]) => !sourceIds.has(id)).map(([id, entry]) => taskConfigEntryToRecord2(id, entry, "legacy-task-config"));
+      return [...sourceRecords, ...legacyRecords];
+    },
+    async getTask(id) {
+      const sourceEntry = store.readSourceTaskConfig(projectRoot)[id];
+      if (sourceEntry)
+        return taskConfigEntryToRecord2(id, sourceEntry, "source-task-config");
+      const legacyEntry = store.readTaskConfig(projectRoot)[id];
+      return legacyEntry ? taskConfigEntryToRecord2(id, legacyEntry, "legacy-task-config") : null;
+    }
+  };
+}
+function resolveProvider() {
+  return "pi";
+}
+function hasCliOption(argv, option) {
+  return argv.some((arg) => arg === option || arg.startsWith(`${option}=`));
+}
+function cliOptionValue(argv, option) {
+  for (let index = 0;index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === option) {
+      const next = argv[index + 1];
+      return next && !next.startsWith("--") ? next : undefined;
+    }
+    if (arg?.startsWith(`${option}=`)) {
+      return arg.slice(option.length + 1);
+    }
+  }
+  return;
+}
+function rewriteCliOptionValue(argv, option, value) {
+  for (let index = 0;index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === option && argv[index + 1] && !argv[index + 1].startsWith("--")) {
+      argv[index + 1] = value;
+      return;
+    }
+    if (arg?.startsWith(`${option}=`)) {
+      argv[index] = `${option}=${value}`;
+      return;
+    }
+  }
+}
+function normalizePiModelForProvider(model, provider) {
+  if (provider === "openrouter" && model === "openai-codex/gpt-5.5") {
+    return "openai/gpt-5.5";
+  }
+  return model;
+}
+function resolveFromShellPath(binary) {
+  const resolved = Bun.spawnSync(["sh", "-lc", `command -v ${binary}`], {
+    stdout: "pipe",
+    stderr: "ignore",
+    stdin: "ignore",
+    env: process.env
+  });
+  if (resolved.exitCode !== 0)
+    return null;
+  const path = resolved.stdout.toString().trim().split(/\r?\n/)[0]?.trim();
+  return path || null;
+}
+function resolveBundledPiBinary() {
+  try {
+    const packageJson = requireFromRuntime.resolve("@oh-my-pi/pi-coding-agent/package.json");
+    const binaryPath = resolve5(packageJson, "..", "dist", "cli.js");
+    return existsSync5(binaryPath) ? binaryPath : null;
+  } catch {
+    return null;
+  }
+}
+function providerBinary(_provider) {
+  return process.env.RIG_PI_BINARY?.trim() || resolveBundledPiBinary() || resolveFromShellPath("pi") || Bun.which("pi") || "pi";
+}
+function emitWrapperEvent(type, payload) {
+  console.log(`__RIG_WRAPPER_EVENT__${JSON.stringify({ type, payload, at: new Date().toISOString() })}`);
+}
+function sleep(ms) {
+  return new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
+}
+async function waitForDirtyBaselineReady(runtime, taskId) {
+  const readyFile = process.env.RIG_DIRTY_BASELINE_READY_FILE?.trim();
+  if (process.env.RIG_BASELINE_MODE !== "dirty-snapshot" || !readyFile)
+    return;
+  const timeoutMs = Number.parseInt(process.env.RIG_DIRTY_BASELINE_TIMEOUT_MS ?? "30000", 10);
+  const deadline = Date.now() + (Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : 30000);
+  emitWrapperEvent("runtime.baseline.waiting", {
+    runtimeId: runtime.id,
+    taskId,
+    workspaceDir: runtime.workspaceDir,
+    readyFile
+  });
+  while (!existsSync5(readyFile)) {
+    if (Date.now() >= deadline) {
+      throw new Error(`Timed out waiting for dirty baseline ready file: ${readyFile}`);
+    }
+    await sleep(50);
+  }
+  emitWrapperEvent("runtime.baseline.completed", {
+    runtimeId: runtime.id,
+    taskId,
+    workspaceDir: runtime.workspaceDir,
+    readyFile
+  });
+}
+function inferTaskIdFromRuntimePath(path) {
+  if (!path)
+    return "";
+  const match = path.match(/\/\.rig\/runtime\/agents\/task-([^/]+)\/worktree(?:\/|$)/) || path.match(/\/\.worktrees\/([^/]+)(?:\/|$)/);
+  return match?.[1] || "";
+}
+function taskIdFromProviderRuntimeEnv() {
+  const explicit = process.env.RIG_TASK_ID?.trim();
+  if (explicit)
+    return explicit;
+  const runtimeId = process.env.RIG_TASK_RUNTIME_ID?.trim();
+  if (runtimeId?.startsWith("task-") && runtimeId.length > "task-".length) {
+    return runtimeId.slice("task-".length);
+  }
+  return inferTaskIdFromRuntimePath(process.env.RIG_TASK_WORKSPACE?.trim()) || inferTaskIdFromRuntimePath(process.cwd());
+}
+async function resolveTaskId(projectRoot) {
+  const fromRuntime = taskIdFromProviderRuntimeEnv();
+  if (fromRuntime) {
+    return fromRuntime;
+  }
+  const fromState = (await resolveTaskStateStore(projectRoot)).readCurrentTaskId(projectRoot) ?? "";
+  return fromState;
+}
+async function isTaskClosed(projectRoot, taskId) {
+  return (await resolveTaskTerminalState(projectRoot)).isTaskTerminal({ projectRoot, taskId });
+}
+async function recordSnapshotMissingTaskSourceEvidence(projectRoot, taskId, runtime, snapshotFinalizeError) {
+  try {
+    const reflection = await resolveTaskSourceReflection(projectRoot);
+    if (!reflection) {
+      throw new Error("task source reflection capability unavailable");
+    }
+    const result = await reflection.reflectTaskSourceStatus({
+      projectRoot,
+      taskId,
+      runId: process.env.RIG_SERVER_RUN_ID || "(unknown)",
+      commentStatus: "snapshot-missing",
+      summary: "Rig runtime completed, but the after-snapshot finalize failed. Closeout evidence is degraded until the runtime workspace is inspected directly.",
+      runtimeWorkspace: runtime.workspaceDir,
+      logsDir: runtime.logsDir,
+      sessionDir: runtime.sessionDir,
+      errorText: snapshotFinalizeError
+    });
+    if (result?.updated) {
+      return;
+    }
+    throw new Error(result ? "no source-aware task source is configured" : "task source update capability unavailable");
+  } catch (error) {
+    console.error(`[rig-agent] Failed to record snapshot-missing evidence for ${taskId}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function resolveRuntimeHandoffPath(hostProjectRoot, taskId, timestampMs = Date.now()) {
+  const handoffDir = resolve5(hostProjectRoot, ".rig/runtime/handoffs");
+  const safeTaskId = safePathSegment(taskId, { fallback: "task", maxLength: 96 });
+  return assertPathInsideRoot(handoffDir, resolve5(handoffDir, `${safeTaskId}-${timestampMs}.json`), "runtime handoff path");
+}
+function recordRuntimeHandoff(hostProjectRoot, runtime, taskId, exitCode, options = {}) {
+  const handoffDir = resolve5(hostProjectRoot, ".rig/runtime/handoffs");
+  mkdirSync3(handoffDir, { recursive: true });
+  const handoffPath = resolveRuntimeHandoffPath(hostProjectRoot, taskId);
+  const snapshotMissing = options.snapshotMissing === true;
+  const handoff = {
+    taskId,
+    runtimeId: runtime.id,
+    runtimeMode: runtime.mode,
+    workspaceDir: runtime.workspaceDir,
+    logsDir: runtime.logsDir,
+    sessionDir: runtime.sessionDir,
+    exitCode,
+    degraded: snapshotMissing,
+    snapshotMissing,
+    snapshotFinalizeError: options.snapshotFinalizeError ?? null,
+    recordedAt: new Date().toISOString(),
+    message: snapshotMissing ? "Runtime completed but the after-snapshot finalize failed; closeout evidence is degraded until the runtime workspace is inspected directly." : "Completion verification did not finish in this run. Open or refresh the PR from the runtime workspace for verifier review, or rerun completion verification once the workspace is ready.",
+    nextSteps: snapshotMissing ? [
+      `cd ${runtime.workspaceDir}`,
+      "inspect the runtime workspace directly before relying on closeout evidence",
+      `rig-agent git status --task ${taskId}`
+    ] : [
+      `cd ${runtime.workspaceDir}`,
+      `rig-agent git status --task ${taskId}`,
+      `rig-agent completion-verification`,
+      `rig-agent git open-pr --task ${taskId}`
+    ]
+  };
+  writeFileSync3(handoffPath, `${JSON.stringify(handoff, null, 2)}
+`, "utf-8");
+  if (snapshotMissing) {
+    console.log(`[rig-agent] Runtime after-snapshot missing for ${taskId}; degraded handoff saved: ${handoffPath}`);
+    console.log(`[rig-agent] Inspect runtime workspace before relying on closeout evidence: ${runtime.workspaceDir}`);
+  } else {
+    console.log(`[rig-agent] Completion verification paused for ${taskId}.`);
+    console.log(`[rig-agent] Runtime handoff saved: ${handoffPath}`);
+    console.log(`[rig-agent] Review and open PR from runtime workspace: ${runtime.workspaceDir}`);
+  }
+}
+async function printTaskContext(projectRoot, taskId) {
+  const context = await readTaskContextFromState(projectRoot, taskId);
+  const description = asNonEmptyString(context.description);
+  const acceptanceCriteria = firstNonEmpty(context.acceptanceCriteria, context.acceptance_criteria);
+  if (context.title) {
+    console.log(`[rig-agent] Task ${taskId}: ${context.title}`);
+  } else {
+    console.log(`[rig-agent] Task ${taskId}`);
+  }
+  if (description) {
+    console.log("[rig-agent] Description:");
+    for (const line of description.split(/\r?\n/)) {
+      console.log(`[rig-agent]   ${line}`);
+    }
+  } else {
+    console.log("[rig-agent] Description: (not set in task-state/source config)");
+  }
+  if (acceptanceCriteria) {
+    console.log("[rig-agent] Acceptance Criteria:");
+    for (const line of acceptanceCriteria.split(/\r?\n/)) {
+      console.log(`[rig-agent]   ${line}`);
+    }
+  }
+}
+async function readTaskContextFromState(projectRoot, taskId) {
+  const store = await resolveTaskStateStore(projectRoot);
+  const entry = store.readSourceTaskConfig(projectRoot)[taskId] ?? store.readTaskConfig(projectRoot)[taskId] ?? null;
+  if (!entry)
+    return {};
+  const record = entry;
+  return {
+    title: asNonEmptyString(record.title),
+    description: asNonEmptyString(record.description),
+    acceptance_criteria: asNonEmptyString(record.acceptance_criteria),
+    acceptanceCriteria: asNonEmptyString(record.acceptanceCriteria)
+  };
+}
+function asNonEmptyString(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function firstNonEmpty(...values) {
+  for (const value of values) {
+    if (typeof value === "string" && value.trim()) {
+      return value.trim();
+    }
+  }
+  return "";
+}
+var TaskStateStoreCap2, taskStateStoreByRoot, TaskSourceReflectionCap, taskSourceReflectionByRoot, TaskTerminalStateCap, taskTerminalStateByRoot, requireFromRuntime, runPiRpcProvider;
+var init_agent_wrapper = __esm(() => {
+  init_runtime_snapshot_config();
+  TaskStateStoreCap2 = defineCapability5(TASK_STATE_STORE2);
+  taskStateStoreByRoot = new Map;
+  TaskSourceReflectionCap = defineCapability5(TASK_SOURCE_REFLECTION);
+  taskSourceReflectionByRoot = new Map;
+  TaskTerminalStateCap = defineCapability5(TASK_TERMINAL_STATE);
+  taskTerminalStateByRoot = new Map;
+  requireFromRuntime = createRequire(import.meta.url);
+  runPiRpcProvider = runPiRpcProviderFallback;
+  if (false) {}
+});
+
+// packages/harness-plugin/src/tooling/browser-tool-entrypoint.ts
+var exports_browser_tool_entrypoint = {};
+import { existsSync as existsSync6, rmSync } from "fs";
+import { basename as basename2, dirname as dirname2, resolve as resolve6 } from "path";
+import { loadRuntimeContext as loadRuntimeContext2 } from "@rig/core/runtime-context";
+function currentCommand() {
+  return basename2(process.argv[1] || "");
+}
+function runtimeContextPath() {
+  const explicit = process.env.RIG_RUNTIME_CONTEXT_FILE?.trim();
+  if (explicit) {
+    return explicit;
+  }
+  return resolve6(dirname2(resolve6(process.argv[1] || "")), "..", "runtime-context.json");
+}
+function loadBrowserContext() {
+  const contextPath = runtimeContextPath();
+  if (!existsSync6(contextPath)) {
+    throw new Error(`Runtime context file not found for ${currentCommand()}: ${contextPath}`);
+  }
+  const runtimeContext = loadRuntimeContext2(contextPath);
+  if (!runtimeContext.browser?.required) {
+    throw new Error(`No browser contract is configured for ${runtimeContext.taskId}.`);
+  }
+  if (!runtimeContext.hostProjectRoot) {
+    throw new Error(`Runtime browser command ${currentCommand()} requires hostProjectRoot in runtime context.`);
+  }
+  return {
+    browser: runtimeContext.browser,
+    hostProjectRoot: runtimeContext.hostProjectRoot
+  };
+}
+async function runConfiguredCommand(command, browser, hostProjectRoot) {
+  if (!command) {
+    throw new Error(`No backing command is configured for ${currentCommand()}.`);
+  }
+  const attachUrl = new URL(browser.effectiveAttachUrl);
+  const child = Bun.spawn({
+    cmd: ["/bin/bash", "-lc", command],
+    cwd: hostProjectRoot,
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit",
+    env: {
+      ...process.env,
+      RIG_STATE_DIR: browser.stateDir,
+      T3CODE_STATE_DIR: browser.stateDir,
+      RIG_BROWSER_PROFILE: browser.effectiveProfile,
+      RIG_BROWSER_REMOTE_DEBUGGING_PORT: attachUrl.port,
+      RIG_BROWSER_ATTACH_URL: browser.effectiveAttachUrl
+    }
+  });
+  return await child.exited;
+}
+function printAttachInfo(browser, hostProjectRoot) {
+  const payload = {
+    preset: browser.preset,
+    mode: browser.mode,
+    stateDir: browser.stateDir,
+    hostProjectRoot,
+    defaultProfile: browser.defaultProfile,
+    effectiveProfile: browser.effectiveProfile,
+    defaultAttachUrl: browser.defaultAttachUrl,
+    effectiveAttachUrl: browser.effectiveAttachUrl,
+    launchHelper: browser.launchHelper,
+    checkHelper: browser.checkHelper,
+    attachInfoHelper: browser.attachInfoHelper,
+    e2eHelper: browser.e2eHelper,
+    resetProfileHelper: browser.resetProfileHelper,
+    devCommand: browser.devCommand,
+    launchCommand: browser.launchCommand,
+    checkCommand: browser.checkCommand,
+    e2eCommand: browser.e2eCommand
+  };
+  if (process.argv.includes("--json")) {
+    console.log(JSON.stringify(payload, null, 2));
+    return;
+  }
+  console.log("Rig Browser");
+  console.log(`  Preset: ${browser.preset}`);
+  console.log(`  Mode: ${browser.mode}`);
+  console.log(`  State dir: ${browser.stateDir}`);
+  console.log(`  Default profile: ${browser.defaultProfile}`);
+  console.log(`  Effective profile: ${browser.effectiveProfile}`);
+  console.log(`  Default attach URL: ${browser.defaultAttachUrl}`);
+  console.log(`  Effective attach URL: ${browser.effectiveAttachUrl}`);
+  console.log(`  Launch helper: ${browser.launchHelper}${browser.devCommand ? " [--dev]" : ""}`);
+  console.log(`  Check helper: ${browser.checkHelper}`);
+  console.log(`  E2E helper: ${browser.e2eHelper}`);
+  console.log(`  Reset helper: ${browser.resetProfileHelper}`);
+}
+function resetProfile(browser) {
+  const profileRoot = resolve6(browser.stateDir, "browser", "profiles", browser.effectiveProfile);
+  rmSync(profileRoot, { recursive: true, force: true });
+  console.log(`Removed Rig Browser profile: ${profileRoot}`);
+}
+async function main2() {
+  const { browser, hostProjectRoot } = loadBrowserContext();
+  const command = currentCommand();
+  if (command === browser.attachInfoHelper) {
+    printAttachInfo(browser, hostProjectRoot);
+    return;
+  }
+  if (command === browser.resetProfileHelper) {
+    resetProfile(browser);
+    return;
+  }
+  if (command === browser.launchHelper) {
+    const launchCommand = process.argv.includes("--dev") ? browser.devCommand : browser.launchCommand;
+    process.exit(await runConfiguredCommand(launchCommand, browser, hostProjectRoot));
+  }
+  if (command === browser.checkHelper) {
+    process.exit(await runConfiguredCommand(browser.checkCommand, browser, hostProjectRoot));
+  }
+  if (command === browser.e2eHelper) {
+    process.exit(await runConfiguredCommand(browser.e2eCommand ?? browser.checkCommand, browser, hostProjectRoot));
+  }
+  throw new Error(`Unknown Rig Browser helper: ${command}`);
+}
+var init_browser_tool_entrypoint = __esm(() => {
+  main2().catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  });
+});
+
+// packages/harness-plugin/src/tooling/claude-router.ts
+var exports_claude_router = {};
+__export(exports_claude_router, {
+  writeClaudeRuntimeToolRouterConfig: () => writeClaudeRuntimeToolRouterConfig,
+  runClaudeToolRouterServer: () => runClaudeToolRouterServer,
+  invokeRuntimeTool: () => invokeRuntimeTool,
+  codexRuntimeToolCliArgs: () => codexRuntimeToolCliArgs,
+  claudeRuntimeToolCliArgs: () => claudeRuntimeToolCliArgs,
+  CLAUDE_ROUTER_TOOL_DEFINITIONS: () => CLAUDE_ROUTER_TOOL_DEFINITIONS,
+  CLAUDE_ROUTER_SERVER_NAME: () => CLAUDE_ROUTER_SERVER_NAME,
+  CLAUDE_DISABLED_FILE_TOOLS: () => CLAUDE_DISABLED_FILE_TOOLS
+});
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, statSync, writeFileSync as writeFileSync4 } from "fs";
+import { resolve as resolve7 } from "path";
+import { createInterface } from "readline";
+function claudeRuntimeToolCliArgs(configPath) {
+  return [
+    "--disallowedTools",
+    CLAUDE_DISABLED_FILE_TOOLS.join(","),
+    "--mcp-config",
+    configPath
+  ];
+}
+function buildRuntimeToolRouterServerConfig(options) {
+  return {
+    type: "stdio",
+    command: resolve7(options.binDir, "rig-tool-router"),
+    args: [],
+    env: {
+      RIG_RUNTIME_CONTEXT_FILE: options.contextFile,
+      RIG_RUNTIME_BIN_DIR: options.binDir
+    }
+  };
+}
+function escapeTomlString(value) {
+  return value.replaceAll("\\", "\\\\").replaceAll('"', "\\\"");
+}
+function tomlString(value) {
+  return `"${escapeTomlString(value)}"`;
+}
+function tomlStringArray(values) {
+  return `[${values.map((value) => tomlString(value)).join(", ")}]`;
+}
+function tomlInlineTable(entries) {
+  return `{ ${Object.entries(entries).map(([key, value]) => `${key} = ${tomlString(value)}`).join(", ")} }`;
+}
+function codexRuntimeToolCliArgs(options) {
+  const serverConfig = buildRuntimeToolRouterServerConfig(options);
+  return [
+    "-a",
+    "never",
+    "-c",
+    `mcp_servers.${CLAUDE_ROUTER_SERVER_NAME}.command=${tomlString(serverConfig.command)}`,
+    "-c",
+    `mcp_servers.${CLAUDE_ROUTER_SERVER_NAME}.args=${tomlStringArray(serverConfig.args)}`,
+    "-c",
+    `mcp_servers.${CLAUDE_ROUTER_SERVER_NAME}.env=${tomlInlineTable(serverConfig.env)}`
+  ];
+}
+function writeClaudeRuntimeToolRouterConfig(options) {
+  const configPath = resolve7(options.stateDir, "claude-runtime-tools.mcp.json");
+  mkdirSync4(options.stateDir, { recursive: true });
+  const payload = {
+    mcpServers: {
+      [CLAUDE_ROUTER_SERVER_NAME]: buildRuntimeToolRouterServerConfig(options)
+    }
+  };
+  writeFileSync4(configPath, `${JSON.stringify(payload, null, 2)}
+`, "utf-8");
+  return configPath;
+}
+async function runClaudeToolRouterServer() {
+  const lineReader = createInterface({
+    input: process.stdin,
+    crlfDelay: Infinity
+  });
+  const inFlightToolCalls = new Set;
+  const trackToolCall = (call) => {
+    inFlightToolCalls.add(call);
+    call.finally(() => inFlightToolCalls.delete(call)).catch((err) => {
+      console.warn("[claude-router] in-flight tool call failure:", err);
+    });
+  };
+  for await (const line of lineReader) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    let request;
+    try {
+      request = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    if (!request.method) {
+      continue;
+    }
+    if (request.method === "notifications/initialized") {
+      continue;
+    }
+    if (request.method === "initialize") {
+      writeMessage({
+        jsonrpc: "2.0",
+        id: request.id ?? null,
+        result: {
+          protocolVersion: "2024-11-05",
+          capabilities: {
+            tools: {}
+          },
+          serverInfo: {
+            name: CLAUDE_ROUTER_SERVER_NAME,
+            version: ROUTER_VERSION
+          }
+        }
+      });
+      continue;
+    }
+    if (request.method === "ping") {
+      writeMessage({
+        jsonrpc: "2.0",
+        id: request.id ?? null,
+        result: {}
+      });
+      continue;
+    }
+    if (request.method === "tools/list") {
+      writeMessage({
+        jsonrpc: "2.0",
+        id: request.id ?? null,
+        result: {
+          tools: CLAUDE_ROUTER_TOOL_DEFINITIONS
+        }
+      });
+      continue;
+    }
+    if (request.method === "tools/call") {
+      const toolName = typeof request.params?.name === "string" ? request.params.name : "";
+      const args = isRecord(request.params?.arguments) ? request.params.arguments : {};
+      const requestId = request.id ?? null;
+      const toolCall = (async () => {
+        try {
+          const result = await invokeRuntimeTool(toolName, args);
+          writeMessage({
+            jsonrpc: "2.0",
+            id: requestId,
+            result
+          });
+        } catch (error) {
+          writeMessage({
+            jsonrpc: "2.0",
+            id: requestId,
+            error: {
+              code: -32603,
+              message: error instanceof Error ? error.message : String(error)
+            }
+          });
+        }
+      })();
+      trackToolCall(toolCall);
+      continue;
+    }
+    writeMessage({
+      jsonrpc: "2.0",
+      id: request.id ?? null,
+      error: {
+        code: -32601,
+        message: `Unsupported method: ${request.method}`
+      }
+    });
+  }
+  if (inFlightToolCalls.size > 0) {
+    await Promise.allSettled(Array.from(inFlightToolCalls));
+  }
+}
+async function invokeRuntimeTool(toolName, args, options = {}) {
+  if (toolName === "shell") {
+    return invokeRuntimeShellTool(args, options);
+  }
+  const invocationEnv = options.env ?? process.env;
+  const binaryPath = resolveRuntimeToolBinary(toolName, invocationEnv);
+  if (!binaryPath) {
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Unknown Rig runtime tool: ${toolName}`
+        }
+      ],
+      isError: true
+    };
+  }
+  const proc = Bun.spawn([binaryPath], {
+    stdin: "pipe",
+    stdout: "pipe",
+    stderr: "pipe",
+    env: invocationEnv
+  });
+  const requestBody = `${JSON.stringify(args)}
+`;
+  if (proc.stdin) {
+    await proc.stdin.write(requestBody);
+    await proc.stdin.end();
+  }
+  const [exitCode, stdout, stderr] = await Promise.all([
+    proc.exited,
+    readBunProcessPipe(proc.stdout),
+    readBunProcessPipe(proc.stderr)
+  ]);
+  if (exitCode !== 0) {
+    const text = [stdout.trim(), stderr.trim()].filter(Boolean).join(`
+`) || `Tool ${toolName} exited with code ${exitCode}`;
+    return {
+      content: [{ type: "text", text }],
+      isError: true
+    };
+  }
+  let payload;
+  try {
+    payload = JSON.parse(stdout);
+  } catch {
+    return {
+      content: [{ type: "text", text: stdout.trim() || `(empty output from ${toolName})` }],
+      isError: false
+    };
+  }
+  if (payload.ok === false) {
+    return {
+      content: [{ type: "text", text: String(payload.message ?? `Tool ${toolName} failed`) }],
+      structuredContent: payload,
+      isError: true
+    };
+  }
+  return {
+    content: [{ type: "text", text: renderToolText(toolName, payload) }],
+    structuredContent: payload,
+    isError: false
+  };
+}
+async function readBunProcessPipe(pipe) {
+  if (typeof pipe === "number" || !pipe) {
+    return "";
+  }
+  return new Response(pipe).text();
+}
+function resolveRuntimeToolBinary(toolName, env) {
+  const binDir = env.RIG_RUNTIME_BIN_DIR?.trim() || "";
+  if (!binDir) {
+    return "";
+  }
+  const mapping = {
+    read: "rig-read",
+    write: "rig-write",
+    edit: "rig-edit",
+    glob: "rig-glob",
+    grep: "rig-grep"
+  };
+  const executable = mapping[toolName];
+  return executable ? resolve7(binDir, executable) : "";
+}
+function renderToolText(toolName, payload) {
+  if (toolName === "shell") {
+    const command = typeof payload.command === "string" ? payload.command : "(unknown command)";
+    const stdout = typeof payload.stdout === "string" ? payload.stdout.trim() : "";
+    const stderr = typeof payload.stderr === "string" ? payload.stderr.trim() : "";
+    const exitCode = typeof payload.exit_code === "number" ? payload.exit_code : null;
+    const output = [stdout, stderr].filter(Boolean).join(`
+`);
+    const summary = exitCode === null ? command : `${command}
+
+exit_code=${String(exitCode)}`;
+    return output ? `${summary}
+
+${output}` : summary;
+  }
+  if (toolName === "read") {
+    const path = typeof payload.path === "string" ? payload.path : "(unknown path)";
+    const content = typeof payload.content === "string" ? payload.content : "";
+    const truncated = payload.truncated === true ? `
+
+[truncated]` : "";
+    return `${path}
+
+${content}${truncated}`;
+  }
+  if (toolName === "glob") {
+    const matches = Array.isArray(payload.matches) ? payload.matches.filter((value) => typeof value === "string") : [];
+    return matches.length > 0 ? matches.join(`
+`) : "(no matches)";
+  }
+  if (toolName === "grep") {
+    const matches = Array.isArray(payload.matches) ? payload.matches.filter(isRecord) : [];
+    if (matches.length === 0) {
+      return "(no matches)";
+    }
+    return matches.map((match) => `${String(match.path ?? "(unknown)")}:${String(match.line_number ?? "?")}: ${String(match.line ?? "")}`).join(`
+`);
+  }
+  if (toolName === "write") {
+    return `Wrote ${String(payload.bytes_written ?? 0)} bytes to ${String(payload.path ?? "(unknown path)")}.`;
+  }
+  if (toolName === "edit") {
+    return `Edited ${String(payload.path ?? "(unknown path)")}; replacements: ${String(payload.replacements ?? 0)}.`;
+  }
+  return JSON.stringify(payload, null, 2);
+}
+async function invokeRuntimeShellTool(args, options = {}) {
+  const command = typeof args.command === "string" ? args.command.trim() : "";
+  if (!command) {
+    return {
+      content: [{ type: "text", text: "Missing required shell `command` string." }],
+      isError: true
+    };
+  }
+  const invocationEnv = options.env ?? process.env;
+  const shellName = args.shell === "sh" ? "sh" : args.shell === "zsh" ? "zsh" : "bash";
+  const shellBinary = resolveRuntimeShellBinary(shellName, invocationEnv);
+  if (!shellBinary) {
+    return {
+      content: [{ type: "text", text: `Missing Rig runtime shell binary for ${shellName}.` }],
+      isError: true
+    };
+  }
+  const workspaceRoot = resolve7(invocationEnv.RIG_TASK_WORKSPACE?.trim() || process.cwd());
+  const requestedWorkdir = typeof args.workdir === "string" ? args.workdir.trim() : "";
+  const workdir = requestedWorkdir ? resolveWithinWorkspace(workspaceRoot, requestedWorkdir) : workspaceRoot;
+  if (!existsSync7(workdir)) {
+    return {
+      content: [{
+        type: "text",
+        text: `Shell workdir does not exist inside the task workspace: ${requestedWorkdir || "."}`
+      }],
+      isError: true
+    };
+  }
+  try {
+    if (!statSync(workdir).isDirectory()) {
+      return {
+        content: [{
+          type: "text",
+          text: `Shell workdir is not a directory inside the task workspace: ${requestedWorkdir || "."}`
+        }],
+        isError: true
+      };
+    }
+  } catch (error) {
+    return {
+      content: [{
+        type: "text",
+        text: error instanceof Error ? error.message : String(error)
+      }],
+      isError: true
+    };
+  }
+  let proc = null;
+  try {
+    proc = Bun.spawn([shellBinary, shellName === "bash" ? "-lc" : "-c", command], {
+      cwd: workdir,
+      env: invocationEnv,
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+  } catch (error) {
+    return {
+      content: [{
+        type: "text",
+        text: error instanceof Error ? error.message : String(error)
+      }],
+      isError: true
+    };
+  }
+  const [exitCode, stdout, stderr] = await Promise.all([
+    proc.exited,
+    readBunProcessPipe(proc.stdout),
+    readBunProcessPipe(proc.stderr)
+  ]);
+  const payload = {
+    ok: exitCode === 0,
+    shell: shellName,
+    cwd: workdir,
+    command,
+    stdout,
+    stderr,
+    exit_code: exitCode
+  };
+  return {
+    content: [{ type: "text", text: renderToolText("shell", payload) }],
+    structuredContent: payload,
+    isError: exitCode !== 0
+  };
+}
+function resolveRuntimeShellBinary(shellName, env) {
+  const binDir = env.RIG_RUNTIME_BIN_DIR?.trim() || "";
+  return binDir ? resolve7(binDir, shellName) : "";
+}
+function resolveWithinWorkspace(workspaceRoot, target) {
+  const resolvedTarget = resolve7(workspaceRoot, normalizeWorkspaceRelativeTarget(target));
+  const normalizedWorkspace = workspaceRoot.endsWith("/") ? workspaceRoot : `${workspaceRoot}/`;
+  const normalizedTarget = resolvedTarget.endsWith("/") ? resolvedTarget : `${resolvedTarget}/`;
+  if (resolvedTarget === workspaceRoot || normalizedTarget.startsWith(normalizedWorkspace)) {
+    return resolvedTarget;
+  }
+  throw new Error(`Shell workdir must stay inside the task workspace: ${target}`);
+}
+function normalizeWorkspaceRelativeTarget(target) {
+  const trimmed = target.trim();
+  if (!trimmed) {
+    return ".";
+  }
+  if (trimmed === "$MONOREPO_ROOT" || trimmed === "$RIG_TASK_WORKSPACE") {
+    return ".";
+  }
+  if (trimmed.startsWith("$MONOREPO_ROOT/")) {
+    return trimmed.slice("$MONOREPO_ROOT/".length);
+  }
+  if (trimmed.startsWith("$RIG_TASK_WORKSPACE/")) {
+    return trimmed.slice("$RIG_TASK_WORKSPACE/".length);
+  }
+  if (trimmed === "repos/spliter-monorepo") {
+    return ".";
+  }
+  if (trimmed.startsWith("repos/spliter-monorepo/")) {
+    return trimmed.slice("repos/spliter-monorepo/".length);
+  }
+  return trimmed;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function writeMessage(payload) {
+  process.stdout.write(`${JSON.stringify(payload)}
+`);
+}
+var CLAUDE_ROUTER_SERVER_NAME = "rig_runtime_tools", CLAUDE_DISABLED_FILE_TOOLS, ROUTER_VERSION = "0.1.0", CLAUDE_ROUTER_TOOL_DEFINITIONS;
+var init_claude_router = __esm(async () => {
+  CLAUDE_DISABLED_FILE_TOOLS = [
+    "Read",
+    "Edit",
+    "Write",
+    "NotebookEdit",
+    "Glob",
+    "Grep"
+  ];
+  CLAUDE_ROUTER_TOOL_DEFINITIONS = [
+    {
+      name: "read",
+      description: "Read a UTF-8 file from the current Rig task worktree, the outer control-plane repo ($PROJECT_RIG_ROOT), or the host monorepo checkout ($MONOREPO_MAIN_ROOT).",
+      inputSchema: {
+        type: "object",
+        properties: {
+          path: { type: "string", description: "Absolute or workspace-relative file path." },
+          offset: { type: "integer", minimum: 0 },
+          limit: { type: "integer", minimum: 1, maximum: 2097152 }
+        },
+        required: ["path"],
+        additionalProperties: false
+      }
+    },
+    {
+      name: "write",
+      description: "Write UTF-8 content to a file inside the current Rig task workspace only.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          path: { type: "string", description: "Absolute or workspace-relative file path." },
+          content: { type: "string" },
+          create_parents: { type: "boolean" }
+        },
+        required: ["path", "content"],
+        additionalProperties: false
+      }
+    },
+    {
+      name: "edit",
+      description: "Replace one or more exact string occurrences in a UTF-8 file inside the current Rig task workspace only.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          path: { type: "string", description: "Absolute or workspace-relative file path." },
+          old_string: { type: "string" },
+          new_string: { type: "string" },
+          replace_all: { type: "boolean" }
+        },
+        required: ["path", "old_string", "new_string"],
+        additionalProperties: false
+      }
+    },
+    {
+      name: "glob",
+      description: "Search files using a glob pattern across the current task worktree, $PROJECT_RIG_ROOT, or $MONOREPO_MAIN_ROOT.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          pattern: { type: "string" },
+          path: { type: "string", description: "Optional workspace-relative search root." },
+          include_hidden: { type: "boolean" },
+          max_results: { type: "integer", minimum: 1, maximum: 5000 }
+        },
+        required: ["pattern"],
+        additionalProperties: false
+      }
+    },
+    {
+      name: "grep",
+      description: "Search file contents across the current task worktree, $PROJECT_RIG_ROOT, or $MONOREPO_MAIN_ROOT.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          pattern: { type: "string" },
+          path: { type: "string", description: "Optional workspace-relative search root." },
+          literal: { type: "boolean" },
+          include_hidden: { type: "boolean" },
+          max_results: { type: "integer", minimum: 1, maximum: 500 },
+          glob: { type: "string", description: "Optional file glob filter passed through to ripgrep." }
+        },
+        required: ["pattern"],
+        additionalProperties: false
+      }
+    }
+  ];
+  if (false) {}
+});
+
+// packages/harness-plugin/src/pi-command.ts
+var exports_pi_command = {};
+__export(exports_pi_command, {
+  executePi: () => executePi
+});
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
+import { homedir } from "os";
+import { dirname as dirname3, resolve as resolve8 } from "path";
+import { CliError, requireNoExtraArgs } from "@rig/std-shared/cli-args";
+function settingsPath(root) {
+  return resolve8(root, ".pi", "settings.json");
+}
+function userSettingsPath() {
+  return resolve8(homedir(), ".pi", "agent", "settings.json");
+}
+function readJson(path, fallback) {
+  if (!existsSync8(path))
+    return fallback;
+  try {
+    return JSON.parse(readFileSync4(path, "utf-8"));
+  } catch {
+    return fallback;
+  }
+}
+function packageKey(entry) {
+  if (typeof entry === "string")
+    return entry;
+  if (entry && typeof entry === "object" && typeof entry.source === "string") {
+    return entry.source;
+  }
+  return JSON.stringify(entry);
+}
+function writeSettings(path, settings) {
+  mkdirSync5(dirname3(path), { recursive: true });
+  writeFileSync5(path, `${JSON.stringify(settings, null, 2)}
+`, "utf-8");
+}
+async function searchNpmForPiExtensions(term) {
+  const query = encodeURIComponent(term ? `${term} pi extension` : "pi extension");
+  const url = `https://registry.npmjs.org/-/v1/search?text=${query}&size=20`;
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new CliError(`npm registry search failed (${response.status}).`, 2, { hint: "Check network access to registry.npmjs.org, then retry `rig pi search <term>`." });
+  }
+  const payload = await response.json();
+  const results = [];
+  for (const entry of payload.objects ?? []) {
+    const pkg = entry.package;
+    if (!pkg?.name)
+      continue;
+    const keywords = (pkg.keywords ?? []).map((k) => k.toLowerCase());
+    const piLike = pkg.name.startsWith("pi-") || pkg.name.includes("-pi") || keywords.includes("pi") || keywords.includes("pi-extension") || (pkg.description ?? "").toLowerCase().includes("pi extension") || (pkg.description ?? "").toLowerCase().includes("pi coding agent");
+    if (!piLike)
+      continue;
+    results.push({ name: pkg.name, version: pkg.version ?? "", description: pkg.description ?? "" });
+  }
+  return results;
+}
+async function executePi(context, args) {
+  const [command = "list", ...rest] = args;
+  const projectSettingsPath = settingsPath(context.projectRoot);
+  const managedRecordPath = resolve8(context.projectRoot, ".rig", "state", "pi-managed-packages.json");
+  switch (command) {
+    case "list": {
+      requireNoExtraArgs(rest, "rig pi list");
+      const project = readJson(projectSettingsPath, {});
+      const managed = new Set(readJson(managedRecordPath, []));
+      const user = readJson(userSettingsPath(), {});
+      const projectPackages = (Array.isArray(project.packages) ? project.packages : []).map((entry) => ({
+        source: packageKey(entry),
+        managedByRigConfig: managed.has(packageKey(entry))
+      }));
+      const userPackages = (Array.isArray(user.packages) ? user.packages : []).map(packageKey);
+      if (context.outputMode === "text") {
+        console.log("Project Pi packages (.pi/settings.json):");
+        if (projectPackages.length === 0)
+          console.log("  (none)");
+        for (const pkg of projectPackages) {
+          console.log(`  ${pkg.source}${pkg.managedByRigConfig ? "  [from rig.config runtime.pi.packages]" : ""}`);
+        }
+        console.log("User Pi packages (~/.pi/agent/settings.json):");
+        if (userPackages.length === 0)
+          console.log("  (none)");
+        for (const pkg of userPackages)
+          console.log(`  ${pkg}`);
+        console.log("Add more: `rig pi add <npm-package>` \xB7 discover: `rig pi search <term>`");
+      }
+      return { ok: true, group: "pi", command, details: { projectPackages, userPackages } };
+    }
+    case "add": {
+      const [source, ...extra] = rest;
+      requireNoExtraArgs(extra, "rig pi add <package-source>");
+      if (!source) {
+        throw new CliError("Usage: rig pi add <package-source> (npm name, name@version, or git URL)", 2);
+      }
+      const settings = readJson(projectSettingsPath, {});
+      const packages = Array.isArray(settings.packages) ? settings.packages : [];
+      if (packages.some((entry) => packageKey(entry) === source)) {
+        throw new CliError(`"${source}" is already in ${projectSettingsPath}.`, 2, { hint: "Run `rig pi list` to see installed extensions." });
+      }
+      writeSettings(projectSettingsPath, { ...settings, packages: [...packages, source] });
+      if (context.outputMode === "text") {
+        console.log(`Added ${source} to ${projectSettingsPath}.`);
+        console.log("Pi installs missing packages automatically at the next session start (local and worker).");
+      }
+      return { ok: true, group: "pi", command, details: { source, settingsPath: projectSettingsPath } };
+    }
+    case "remove": {
+      const [source, ...extra] = rest;
+      requireNoExtraArgs(extra, "rig pi remove <package-source>");
+      if (!source) {
+        throw new CliError("Usage: rig pi remove <package-source>", 2);
+      }
+      const managed = new Set(readJson(managedRecordPath, []));
+      if (managed.has(source)) {
+        throw new CliError(`"${source}" is managed by rig.config.ts (runtime.pi.packages); remove it there instead.`, 2);
+      }
+      const settings = readJson(projectSettingsPath, {});
+      const packages = Array.isArray(settings.packages) ? settings.packages : [];
+      const next = packages.filter((entry) => packageKey(entry) !== source);
+      if (next.length === packages.length) {
+        throw new CliError(`"${source}" is not in ${projectSettingsPath}.`, 2, { hint: "Run `rig pi list` to see what is installed, then `rig pi remove <source>` with an exact entry." });
+      }
+      const nextSettings = { ...settings };
+      if (next.length > 0)
+        nextSettings.packages = next;
+      else
+        delete nextSettings.packages;
+      writeSettings(projectSettingsPath, nextSettings);
+      if (context.outputMode === "text") {
+        console.log(`Removed ${source} from ${projectSettingsPath}.`);
+      }
+      return { ok: true, group: "pi", command, details: { source } };
+    }
+    case "search": {
+      const term = rest.join(" ").trim();
+      const results = await searchNpmForPiExtensions(term);
+      if (context.outputMode === "text") {
+        if (results.length === 0) {
+          console.log(`No Pi extension packages found on npm${term ? ` for "${term}"` : ""}.`);
+        } else {
+          console.log(`Pi extension packages on npm${term ? ` matching "${term}"` : ""}:`);
+          for (const pkg of results) {
+            console.log(`  ${pkg.name}@${pkg.version}  ${pkg.description.slice(0, 80)}`);
+          }
+          console.log("Install one: `rig pi add <name>`");
+        }
+      }
+      return { ok: true, group: "pi", command, details: { term, results } };
+    }
+    default:
+      throw new CliError(`Unknown pi command: ${command}. Use list|add|remove|search.`, 1, { hint: "Run `rig pi --help` for usage." });
+  }
+}
+var init_pi_command = () => {};
+
+// packages/harness-plugin/src/profile-command.ts
+var exports_profile_command = {};
+__export(exports_profile_command, {
+  executeProfile: () => executeProfile
+});
+import { CliError as CliError2, requireNoExtraArgs as requireNoExtraArgs2, takeOption as takeOption2 } from "@rig/std-shared/cli-args";
+import { HARNESS_PROFILE_STATE } from "@rig/contracts";
+import { defineCapability as defineCapability6 } from "@rig/core/capability";
+import { loadCapabilityForRoot as loadCapabilityForRoot4 } from "@rig/core/capability-loaders";
+import { withMutedConsole } from "@rig/std-shared/cli-muted-console";
+async function profileState(projectRoot) {
+  const service = await loadCapabilityForRoot4(projectRoot, HarnessProfileStateCap);
+  if (!service) {
+    throw new CliError2("Harness profile state capability unavailable: load @rig/harness-plugin (standard bundle).", 2);
+  }
+  return service;
+}
+async function showProfile2(projectRoot) {
+  const state = await profileState(projectRoot);
+  const profile = { ...DEFAULT_AGENT_PROFILE2, ...state.readHarnessStateJson(projectRoot, AGENT_PROFILE_FILE2), model: "pi", runtime: "pi", agent_plugin: "pi" };
+  console.log("Execution Profile:");
+  console.log(`  model:        ${profile.model}`);
+  console.log(`  runtime:      ${profile.runtime}`);
+  console.log(`  plugin:       ${profile.agent_plugin}`);
+}
+async function setProfile2(projectRoot, options) {
+  const invalid = [options.model, options.runtime, options.plugin, options.preset].filter((value) => typeof value === "string" && value.trim().length > 0 && value.trim() !== "pi");
+  if (invalid.length > 0) {
+    throw new CliError2("Only the Pi runtime profile is supported by this Rig substrate.", 1, {
+      hint: 'Omit --model/--runtime/--plugin/--preset or pass "pi" explicitly.'
+    });
+  }
+  const state = await profileState(projectRoot);
+  state.writeHarnessStateJson(projectRoot, AGENT_PROFILE_FILE2, { ...DEFAULT_AGENT_PROFILE2, updated_at: new Date().toISOString() });
+  await showProfile2(projectRoot);
+}
+async function executeProfile(context, args) {
+  const [command = "show", ...rest] = args;
+  switch (command) {
+    case "show":
+      requireNoExtraArgs2(rest, "rig profile show");
+      await withMutedConsole(context.outputMode === "json", () => showProfile2(context.projectRoot));
+      return { ok: true, group: "profile", command };
+    case "set": {
+      let pending = rest;
+      const presetResult = takeOption2(pending, "--preset");
+      pending = presetResult.rest;
+      const modelResult = takeOption2(pending, "--model");
+      pending = modelResult.rest;
+      const runtimeResult = takeOption2(pending, "--runtime");
+      pending = runtimeResult.rest;
+      const pluginResult = takeOption2(pending, "--plugin");
+      pending = pluginResult.rest;
+      requireNoExtraArgs2(pending, "rig profile set [--model ...] [--runtime ...] [--plugin ...]");
+      if (!presetResult.value && !modelResult.value && !runtimeResult.value && !pluginResult.value && rest.length === 0) {
+        throw new CliError2("Provide at least one of --model, --runtime, or --plugin.", 1, {
+          hint: "Example: `rig profile set --model pi`. See current values with `rig profile show`."
+        });
+      }
+      await withMutedConsole(context.outputMode === "json", () => setProfile2(context.projectRoot, {
+        ...modelResult.value !== undefined ? { model: modelResult.value } : {},
+        ...runtimeResult.value !== undefined ? { runtime: runtimeResult.value } : {},
+        ...pluginResult.value !== undefined ? { plugin: pluginResult.value } : {},
+        ...presetResult.value !== undefined ? { preset: presetResult.value } : {}
+      }));
+      return { ok: true, group: "profile", command, details: { lockedTo: "pi" } };
+    }
+    default:
+      throw new CliError2(`Unknown profile command: ${command}`, 1, { hint: "Run `rig profile --help` \u2014 commands are show|set." });
+  }
+}
+var HarnessProfileStateCap, DEFAULT_AGENT_PROFILE2, AGENT_PROFILE_FILE2 = "agent-profile.json";
+var init_profile_command = __esm(() => {
+  HarnessProfileStateCap = defineCapability6(HARNESS_PROFILE_STATE);
+  DEFAULT_AGENT_PROFILE2 = {
+    model: "pi",
+    runtime: "pi",
+    agent_plugin: "pi",
+    updated_at: new Date().toISOString()
+  };
+});
+
+// packages/harness-plugin/src/agent-command.ts
+var exports_agent_command = {};
+__export(exports_agent_command, {
+  executeAgent: () => executeAgent
+});
+import {
+  CliError as CliError3,
+  requireNoExtraArgs as requireNoExtraArgs3,
+  takeFlag,
+  takeOption as takeOption3
+} from "@rig/std-shared/cli-args";
+import { agentId } from "@rig/core/safe-identifiers";
+import { ISOLATION_BACKEND as ISOLATION_BACKEND2, REPO_OPERATIONS_CAPABILITY as REPO_OPERATIONS_CAPABILITY2 } from "@rig/contracts";
+import { defineCapability as defineCapability7 } from "@rig/core/capability";
+import { requireCapabilityForRoot as requireCapabilityForRoot2 } from "@rig/core/capability-loaders";
+import { buildPluginHostContext as buildPluginHostContext3 } from "@rig/core/plugin-host-context";
+import { withMutedConsole as withMutedConsole2 } from "@rig/std-shared/cli-muted-console";
+import { parseEnumOption } from "@rig/std-shared/cli-args";
+async function resolveRepoOperations(projectRoot) {
+  const hostCtx = await buildPluginHostContext3(projectRoot);
+  const repoOps = hostCtx ? await RepoOperationsCap2.resolve(hostCtx.pluginHost) : null;
+  if (!repoOps) {
+    throw new CliError3(`No REPO_OPERATIONS capability is registered for project root "${projectRoot}".`, 2, { hint: "Install @rig/repos-plugin (it ships in the default bundle) before running repo operations." });
+  }
+  return repoOps;
+}
+async function resolveIsolationBackend(projectRoot) {
+  return requireCapabilityForRoot2(projectRoot, defineCapability7(ISOLATION_BACKEND2), `No ISOLATION_BACKEND capability is registered for project root "${projectRoot}". ` + MISSING_ISOLATION_BACKEND_HINT);
+}
+function splitAtDoubleDash(args) {
+  const separatorIndex = args.indexOf("--");
+  if (separatorIndex === -1) {
+    return { options: args, commandParts: [] };
+  }
+  return {
+    options: args.slice(0, separatorIndex),
+    commandParts: args.slice(separatorIndex + 1)
+  };
+}
+async function attachEventBusToProvisionedRuntime(context, workspaceDir) {
+  const previousWorkspace = process.env.RIG_TASK_WORKSPACE;
+  process.env.RIG_TASK_WORKSPACE = workspaceDir;
+  try {
+    await context.eventBus.attachRuntimeWorkspace(context.projectRoot);
+  } finally {
+    if (previousWorkspace === undefined) {
+      delete process.env.RIG_TASK_WORKSPACE;
+    } else {
+      process.env.RIG_TASK_WORKSPACE = previousWorkspace;
+    }
+  }
+}
+async function runProjectMainSyncPreflight(context, options) {
+  if (context.dryRun) {
+    if (context.outputMode === "text" && !options.disabled) {
+      console.log("[dry-run] project-rig pre-run sync check");
+    }
+    return;
+  }
+  const repoOps = await resolveRepoOperations(context.projectRoot);
+  const result = await repoOps.ensureProjectMainFreshBeforeRun({
+    projectRoot: context.projectRoot,
+    disabled: options.disabled,
+    runBootstrap: async () => {
+      const bootstrap = await context.runCommand(["bun", "run", "bootstrap"]);
+      if (bootstrap.exitCode !== 0) {
+        throw new CliError3(bootstrap.stderr || bootstrap.stdout || "bun run bootstrap failed during project pre-run sync", bootstrap.exitCode || 1);
+      }
+    }
+  });
+  if (context.outputMode !== "text") {
+    return;
+  }
+  switch (result.status) {
+    case "disabled":
+      console.log("Project pre-run sync skipped (--skip-project-sync).");
+      break;
+    case "skipped_not_main":
+      console.log(`Project pre-run sync skipped (current branch: ${result.branch}).`);
+      break;
+    case "up_to_date":
+      break;
+    case "local_ahead":
+      console.log(`Project pre-run sync skipped (local main ahead by ${result.localAhead} commit(s)).`);
+      break;
+    case "updated":
+      console.log(`Project pre-run sync updated local main from origin/main (+${result.remoteAhead}) and bootstrapped.`);
+      break;
+  }
+}
+async function executeAgent(context, args) {
+  const [command = "list", ...rest] = args;
+  const backend = await resolveIsolationBackend(context.projectRoot);
+  switch (command) {
+    case "list": {
+      requireNoExtraArgs3(rest, "rig agent list");
+      const runtimes = await backend.listAgentRuntimes(context.projectRoot);
+      if (context.outputMode === "text") {
+        if (runtimes.length === 0) {
+          console.log("No agent runtimes.");
+        } else {
+          for (const runtime of runtimes) {
+            console.log(`${runtime.id} (${runtime.mode}) workspace=${runtime.workspaceDir} created=${runtime.createdAt}`);
+          }
+        }
+      }
+      return { ok: true, group: "agent", command, details: { runtimes } };
+    }
+    case "prepare": {
+      let pending = rest;
+      const idResult = takeOption3(pending, "--id");
+      pending = idResult.rest;
+      const modeResult = takeOption3(pending, "--mode");
+      pending = modeResult.rest;
+      const taskResult = takeOption3(pending, "--task");
+      pending = taskResult.rest;
+      requireNoExtraArgs3(pending, "rig agent prepare --task <id> [--id <id>] [--mode worktree]");
+      const mode = parseEnumOption(modeResult.value, ["worktree"], { fallback: "worktree", label: "isolation mode" });
+      const id = idResult.value || agentId("agent");
+      const taskId = taskResult.value?.trim();
+      if (!taskId) {
+        throw new CliError3("Usage: rig agent prepare --task <id> [--id <id>] [--mode worktree]");
+      }
+      const runtime = await withMutedConsole2(context.outputMode === "json", () => backend.ensureAgentRuntime({
+        projectRoot: context.projectRoot,
+        id,
+        taskId,
+        mode
+      }));
+      await attachEventBusToProvisionedRuntime(context, runtime.workspaceDir);
+      if (context.outputMode === "text") {
+        console.log(`Prepared runtime ${runtime.id} (${runtime.mode})`);
+        console.log(`Workspace: ${runtime.workspaceDir}`);
+      }
+      return { ok: true, group: "agent", command, details: { runtime } };
+    }
+    case "run": {
+      const { options, commandParts } = splitAtDoubleDash(rest);
+      if (commandParts.length === 0) {
+        throw new CliError3("Usage: rig agent run [--id <id>] [--mode worktree] [--skip-project-sync] -- <command...>");
+      }
+      let pending = options;
+      const idResult = takeOption3(pending, "--id");
+      pending = idResult.rest;
+      const modeResult = takeOption3(pending, "--mode");
+      pending = modeResult.rest;
+      const taskResult = takeOption3(pending, "--task");
+      pending = taskResult.rest;
+      const skipProjectSyncResult = takeFlag(pending, "--skip-project-sync");
+      pending = skipProjectSyncResult.rest;
+      requireNoExtraArgs3(pending, "rig agent run --task <id> [--id <id>] [--mode worktree] [--skip-project-sync] -- <command...>");
+      const mode = parseEnumOption(modeResult.value, ["worktree"], { fallback: "worktree", label: "isolation mode" });
+      const id = idResult.value || agentId("agent-run");
+      const taskId = taskResult.value?.trim();
+      if (!taskId) {
+        throw new CliError3("Usage: rig agent run --task <id> [--id <id>] [--mode worktree] [--skip-project-sync] -- <command...>");
+      }
+      await runProjectMainSyncPreflight(context, { disabled: skipProjectSyncResult.value });
+      try {
+        const runtime = await withMutedConsole2(context.outputMode === "json", () => backend.ensureAgentRuntime({
+          projectRoot: context.projectRoot,
+          id,
+          taskId,
+          mode
+        }));
+        await attachEventBusToProvisionedRuntime(context, runtime.workspaceDir);
+        const result = await backend.runInAgentRuntime({
+          projectRoot: context.projectRoot,
+          runtime,
+          command: commandParts,
+          inheritStdio: context.outputMode === "text"
+        });
+        if (result.exitCode !== 0) {
+          throw new CliError3(`Agent runtime command failed (${result.exitCode}) in ${runtime.id}${result.stderr ? `
+${result.stderr.trim()}` : ""}`, result.exitCode);
+        }
+        return {
+          ok: true,
+          group: "agent",
+          command,
+          details: {
+            runtimeId: runtime.id,
+            mode: runtime.mode,
+            command: commandParts,
+            exitCode: result.exitCode,
+            sandboxBackend: result.sandboxBackend,
+            sandboxEnabled: result.sandboxEnabled,
+            stdout: result.stdout,
+            stderr: result.stderr
+          }
+        };
+      } catch (error) {
+        throw error;
+      }
+    }
+    case "cleanup": {
+      let pending = rest;
+      const allResult = takeFlag(pending, "--all");
+      pending = allResult.rest;
+      const idResult = takeOption3(pending, "--id");
+      pending = idResult.rest;
+      requireNoExtraArgs3(pending, "rig agent cleanup (--id <id> | --all)");
+      if (!allResult.value && !idResult.value) {
+        throw new CliError3("Provide --id <id> or --all.", 1, { hint: "Run `rig agent list` to find agent ids." });
+      }
+      const runtimes = await backend.listAgentRuntimes(context.projectRoot);
+      const targets = allResult.value ? runtimes.map((runtime) => runtime.id) : [idResult.value];
+      for (const id of targets) {
+        await backend.cleanupAgentRuntime({
+          projectRoot: context.projectRoot,
+          id
+        });
+      }
+      if (context.outputMode === "text") {
+        console.log(`Cleaned runtimes: ${targets.join(", ")}`);
+      }
+      return {
+        ok: true,
+        group: "agent",
+        command,
+        details: {
+          cleaned: targets,
+          count: targets.length,
+          all: allResult.value
+        }
+      };
+    }
+    default:
+      throw new CliError3(`Unknown agent command: ${command}`, 1, { hint: "Run `rig agent --help` to list agent commands." });
+  }
+}
+var MISSING_ISOLATION_BACKEND_HINT = "Install @rig/isolation-plugin (it ships in the default bundle) so runtime provisioning can resolve a backend.", RepoOperationsCap2;
+var init_agent_command = __esm(() => {
+  RepoOperationsCap2 = defineCapability7(REPO_OPERATIONS_CAPABILITY2);
+});
+
+// packages/harness-plugin/src/runtime-instructions.ts
+function normalizeRuntimeInstructionProvider(_value) {
+  return "pi";
+}
+function buildProviderTaskRunInstructionLines(_provider) {
+  return [
+    "Use Pi's built-in `read`, `write`, `edit`, and `bash` tools from the isolated Rig task worktree.",
+    "Keep file writes inside the scoped task workspace unless Rig explicitly tells you a path is host/project metadata.",
+    "Prefer `read`, `write`, and `edit` over shell one-liners whenever those tools fit.",
+    "When shell access is needed, keep commands narrow and bounded; avoid repo-wide searches without an explicit path and output cap."
+  ];
+}
+function buildProviderRuntimeContextLines(_provider) {
+  return [
+    "Pi runs from the isolated Rig task worktree with its built-in `read`, `write`, `edit`, and `bash` tools enabled.",
+    "Keep writes scoped to the task workspace unless Rig-provided instructions name an explicit metadata path.",
+    "Prefer Pi file tools over shell one-liners for file reads and edits.",
+    "Keep shell commands narrow and bounded; cap broad searches before widening."
+  ];
+}
+
+// packages/harness-plugin/src/service.ts
+var exports_service = {};
+__export(exports_service, {
+  svc: () => svc,
+  runtimeInstructionService: () => runtimeInstructionService
+});
+var svc, runtimeInstructionService;
+var init_service = __esm(() => {
+  svc = {
+    normalizeProvider: normalizeRuntimeInstructionProvider,
+    buildTaskRunInstructionLines: buildProviderTaskRunInstructionLines,
+    buildRuntimeContextLines: buildProviderRuntimeContextLines
+  };
+  runtimeInstructionService = svc;
+});
+
+// packages/harness-plugin/src/skill-materializer.ts
+import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync5, readdirSync, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
+import { resolve as resolve9 } from "path";
+function parseFrontmatter(raw) {
+  const m = raw.match(FRONTMATTER_RE);
+  if (!m) {
+    return { meta: {}, body: raw };
+  }
+  const yaml = m[1] ?? "";
+  const body = m[2] ?? "";
+  const meta = {};
+  for (const line of yaml.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#"))
+      continue;
+    const idx = trimmed.indexOf(":");
+    if (idx === -1)
+      continue;
+    const key = trimmed.slice(0, idx).trim();
+    let value = trimmed.slice(idx + 1).trim();
+    if (typeof value === "string") {
+      const s = value;
+      if (s.startsWith('"') && s.endsWith('"') || s.startsWith("'") && s.endsWith("'")) {
+        value = s.slice(1, -1);
+      } else if (s === "true")
+        value = true;
+      else if (s === "false")
+        value = false;
+      else if (/^-?\d+$/.test(s))
+        value = parseInt(s, 10);
+      else if (/^-?\d+\.\d+$/.test(s))
+        value = parseFloat(s);
+    }
+    meta[key] = value;
+  }
+  return { meta, body };
+}
+function assertValidSkillFrontmatter(path, raw) {
+  const { meta } = parseFrontmatter(raw);
+  if (typeof meta.name !== "string") {
+    throw new Error(`SKILL.md missing required field "name": ${path}`);
+  }
+}
+function skillDirName(id) {
+  return id.replace(/[^a-zA-Z0-9._-]+/g, "-");
+}
+async function materializeSkills(projectRoot, entries) {
+  const skillsRoot = resolve9(projectRoot, ".pi", "skills");
+  if (existsSync9(skillsRoot)) {
+    for (const name of readdirSync(skillsRoot)) {
+      const dir = resolve9(skillsRoot, name);
+      if (existsSync9(resolve9(dir, MARKER_FILENAME))) {
+        rmSync2(dir, { recursive: true, force: true });
+      }
+    }
+  }
+  const written = [];
+  for (const { pluginName, skill } of entries) {
+    const sourcePath = resolve9(projectRoot, skill.path);
+    if (!existsSync9(sourcePath)) {
+      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${sourcePath} does not exist`);
+      continue;
+    }
+    let body;
+    try {
+      body = readFileSync5(sourcePath, "utf-8");
+      assertValidSkillFrontmatter(sourcePath, body);
+    } catch (err) {
+      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${err instanceof Error ? err.message : err}`);
+      continue;
+    }
+    const dir = resolve9(skillsRoot, skillDirName(skill.id));
+    mkdirSync6(dir, { recursive: true });
+    writeFileSync6(resolve9(dir, "SKILL.md"), body, "utf-8");
+    writeFileSync6(resolve9(dir, MARKER_FILENAME), `${JSON.stringify({ plugin: pluginName, skillId: skill.id }, null, 2)}
+`, "utf-8");
+    written.push({ id: skill.id, pluginName, directory: dir });
+  }
+  return written;
+}
+var MARKER_FILENAME = ".rig-plugin", FRONTMATTER_RE;
+var init_skill_materializer = __esm(() => {
+  FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;
+});
+
+// packages/harness-plugin/src/pi-settings-materializer.ts
+import { existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname4, resolve as resolve10 } from "path";
+function readJson2(path, fallback) {
+  if (!existsSync10(path))
+    return fallback;
+  try {
+    return JSON.parse(readFileSync6(path, "utf-8"));
+  } catch {
+    return fallback;
+  }
+}
+function packageKey2(entry) {
+  if (typeof entry === "string")
+    return entry;
+  if (entry && typeof entry === "object" && typeof entry.source === "string") {
+    return entry.source;
+  }
+  return JSON.stringify(entry);
+}
+function materializePiPackages(projectRoot, declaredPackages) {
+  const settingsPath2 = resolve10(projectRoot, SETTINGS_RELATIVE_PATH);
+  const managedRecordPath = resolve10(projectRoot, MANAGED_RECORD_RELATIVE_PATH);
+  const settings = readJson2(settingsPath2, {});
+  const previouslyManaged = new Set(readJson2(managedRecordPath, []));
+  const existing = Array.isArray(settings.packages) ? settings.packages : [];
+  const operatorEntries = existing.filter((entry) => !previouslyManaged.has(packageKey2(entry)));
+  const operatorKeys = new Set(operatorEntries.map(packageKey2));
+  const managedToAdd = declaredPackages.filter((pkg) => !operatorKeys.has(pkg));
+  const nextPackages = [...operatorEntries, ...managedToAdd];
+  if (nextPackages.length > 0 || existsSync10(settingsPath2)) {
+    const nextSettings = { ...settings };
+    if (nextPackages.length > 0) {
+      nextSettings.packages = nextPackages;
+    } else {
+      delete nextSettings.packages;
+    }
+    mkdirSync7(dirname4(settingsPath2), { recursive: true });
+    writeFileSync7(settingsPath2, `${JSON.stringify(nextSettings, null, 2)}
+`, "utf-8");
+  }
+  mkdirSync7(dirname4(managedRecordPath), { recursive: true });
+  writeFileSync7(managedRecordPath, `${JSON.stringify(managedToAdd, null, 2)}
+`, "utf-8");
+  return { settingsPath: settingsPath2, packages: managedToAdd };
+}
+var SETTINGS_RELATIVE_PATH = ".pi/settings.json", MANAGED_RECORD_RELATIVE_PATH = ".rig/state/pi-managed-packages.json";
+var init_pi_settings_materializer = () => {};
+
+// packages/harness-plugin/src/session-asset-materializer-service.ts
+var exports_session_asset_materializer_service = {};
+__export(exports_session_asset_materializer_service, {
+  sessionAssetMaterializer: () => sessionAssetMaterializer
+});
+import { existsSync as existsSync11 } from "fs";
+import { resolve as resolvePath } from "path";
+var sessionAssetMaterializer;
+var init_session_asset_materializer_service = __esm(() => {
+  init_skill_materializer();
+  init_pi_settings_materializer();
+  sessionAssetMaterializer = {
+    async materializeSessionAssets(projectRoot, config) {
+      try {
+        const skillEntries = config.plugins.flatMap((plugin) => (plugin.contributes?.skills ?? []).map((skill) => ({
+          pluginName: plugin.name,
+          skill
+        })));
+        if (skillEntries.length > 0) {
+          await materializeSkills(projectRoot, skillEntries);
+        }
+      } catch (err) {
+        console.warn(`[session-assets] skill materialization failed: ${err instanceof Error ? err.message : err}`);
+      }
+      try {
+        const piPackages = config.runtime?.pi?.packages ?? [];
+        if (piPackages.length > 0 || existsSync11(resolvePath(projectRoot, ".rig/state/pi-managed-packages.json"))) {
+          materializePiPackages(projectRoot, piPackages);
+        }
+      } catch (err) {
+        console.warn(`[session-assets] Pi package materialization failed: ${err instanceof Error ? err.message : err}`);
+      }
+    }
+  };
+});
+
+// packages/harness-plugin/src/session-hook-materializer-service.ts
+var exports_session_hook_materializer_service = {};
+__export(exports_session_hook_materializer_service, {
+  sessionHookMaterializer: () => sessionHookMaterializer,
+  materializeSessionHookAdapters: () => materializeSessionHookAdapters,
+  materializeHooks: () => materializeHooks,
+  defaultAgentSessionHookAdapters: () => defaultAgentSessionHookAdapters,
+  createPiNoopSessionHookAdapter: () => createPiNoopSessionHookAdapter,
+  createClaudeCodeSessionHookAdapter: () => createClaudeCodeSessionHookAdapter,
+  applyClaudeCodeSessionHooksToSettings: () => applyClaudeCodeSessionHooksToSettings
+});
+import { existsSync as existsSync12, mkdirSync as mkdirSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname5, resolve as resolve11 } from "path";
+import { buildTypedHookShimCommand } from "@rig/core/hook-materializer";
+function matcherToString(matcher) {
+  if (matcher.kind === "all")
+    return;
+  if (matcher.kind === "tool")
+    return matcher.name;
+  return matcher.pattern;
+}
+function isPluginOwned(cmd) {
+  return typeof cmd[MARKER_PLUGIN] === "string";
+}
+function createPiNoopSessionHookAdapter() {
+  return {
+    id: "pi",
+    materialize() {
+      return {
+        adapterId: "pi",
+        status: "skipped",
+        reason: "Pi sessions do not consume Claude Code settings hooks."
+      };
+    }
+  };
+}
+function createClaudeCodeSessionHookAdapter() {
+  return {
+    id: "claude-code",
+    materialize(projectRoot, entries) {
+      return writeClaudeCodeHookSettings(projectRoot, entries);
+    }
+  };
+}
+function defaultAgentSessionHookAdapters(env = process.env) {
+  if (env.RIG_AGENT_SESSION_HOOK_ADAPTER === "claude-code") {
+    return [createClaudeCodeSessionHookAdapter()];
+  }
+  if (env.RIG_AGENT_SESSION_HOOK_ADAPTER === "pi" || typeof env.PI_CODING_AGENT_SESSION_DIR === "string" && env.PI_CODING_AGENT_SESSION_DIR.trim().length > 0 || env.RIG_RUN_PROCESS === "1") {
+    return [createPiNoopSessionHookAdapter()];
+  }
+  return [createClaudeCodeSessionHookAdapter()];
+}
+function materializeSessionHookAdapters(projectRoot, entries, adapters = defaultAgentSessionHookAdapters()) {
+  return adapters.map((adapter) => adapter.materialize(projectRoot, entries));
+}
+function materializeHooks(projectRoot, entries) {
+  const result = createClaudeCodeSessionHookAdapter().materialize(projectRoot, entries);
+  return result.status === "materialized" ? result.path : resolve11(projectRoot, ".claude", "settings.json");
+}
+function applyClaudeCodeSessionHooksToSettings(existing, entries, projectRoot, options = {}) {
+  const hooks = typeof existing.hooks === "object" && existing.hooks !== null && !Array.isArray(existing.hooks) ? existing.hooks : {};
+  const replacePluginOwned = options.replacePluginOwned ?? true;
+  if (replacePluginOwned) {
+    for (const event of Object.keys(hooks)) {
+      const groups = hooks[event] ?? [];
+      const cleaned = [];
+      for (const group of groups) {
+        const operatorHooks = group.hooks.filter((h) => !isPluginOwned(h));
+        if (operatorHooks.length > 0) {
+          cleaned.push({ ...group, hooks: operatorHooks });
+        }
+      }
+      if (cleaned.length > 0) {
+        hooks[event] = cleaned;
+      } else {
+        delete hooks[event];
+      }
+    }
+  }
+  const materializedEvents = new Set;
+  for (const { pluginName, hook, typed } of entries) {
+    const command = hook.command ?? (typed ? buildTypedHookShimCommand(pluginName, hook, projectRoot) : undefined);
+    if (!command) {
+      continue;
+    }
+    const event = hook.event;
+    materializedEvents.add(event);
+    const matcherString = matcherToString(hook.matcher);
+    const groups = hooks[event] ??= [];
+    let group = groups.find((g) => g.matcher === matcherString);
+    if (!group) {
+      group = matcherString === undefined ? { hooks: [] } : { matcher: matcherString, hooks: [] };
+      groups.push(group);
+    }
+    const alreadyPresent = group.hooks.some((candidate) => candidate[MARKER_PLUGIN] === pluginName && candidate[MARKER_HOOK_ID] === hook.id);
+    if (alreadyPresent) {
+      continue;
+    }
+    group.hooks.push({
+      type: "command",
+      command,
+      [MARKER_PLUGIN]: pluginName,
+      [MARKER_HOOK_ID]: hook.id
+    });
+  }
+  const next = { ...existing };
+  if (Object.keys(hooks).length > 0) {
+    next.hooks = hooks;
+  } else {
+    delete next.hooks;
+  }
+  return { settings: next, events: [...materializedEvents].sort() };
+}
+function writeClaudeCodeHookSettings(projectRoot, entries) {
+  const settingsPath2 = resolve11(projectRoot, ".claude", "settings.json");
+  const existing = existsSync12(settingsPath2) ? safeReadJson(settingsPath2) : {};
+  const { settings, events } = applyClaudeCodeSessionHooksToSettings(existing, entries, projectRoot);
+  mkdirSync8(dirname5(settingsPath2), { recursive: true });
+  writeFileSync8(settingsPath2, `${JSON.stringify(settings, null, 2)}
+`, "utf-8");
+  return {
+    adapterId: "claude-code",
+    status: "materialized",
+    path: settingsPath2,
+    events
+  };
+}
+function safeReadJson(path) {
+  try {
+    return JSON.parse(readFileSync7(path, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+var MARKER_PLUGIN = "_rigPlugin", MARKER_HOOK_ID = "_rigHookId", sessionHookMaterializer;
+var init_session_hook_materializer_service = __esm(() => {
+  sessionHookMaterializer = {
+    materializeSessionHooks(projectRoot, entries) {
+      return materializeSessionHookAdapters(projectRoot, entries, defaultAgentSessionHookAdapters());
+    }
+  };
+});
+
+// packages/harness-plugin/src/tooling/embedded-native-assets.ts
+var embeddedNatives = null;
+
+// packages/harness-plugin/src/tooling/shell-tools.ts
+import { chmodSync, copyFileSync, existsSync as existsSync13, mkdirSync as mkdirSync9 } from "fs";
+import { tmpdir } from "os";
+import { basename as basename3, dirname as dirname6, resolve as resolve12 } from "path";
+import { RUNTIME_SHELL_TOOL_NAMES } from "@rig/contracts";
+import { getNativeExtractor } from "@rig/core/native-extract";
+function runtimeRigShellFileName() {
+  return `rig-shell${process.platform === "win32" ? ".exe" : ""}`;
+}
+async function ensureRigShellBinaryPath(outputPath = sharedNativeShellOutputPath) {
+  const explicitBin = process.env.RIG_NATIVE_SHELL_BIN?.trim();
+  if (explicitBin && existsSync13(explicitBin)) {
+    return explicitBin;
+  }
+  const embedded = extractEmbeddedNative("rig-shell");
+  if (embedded) {
+    return embedded;
+  }
+  const sourcePath = resolveRigShellSourcePath();
+  if (!sourcePath) {
+    const bundledBinary = resolveBundledRigShellBinaryPath();
+    if (bundledBinary) {
+      return bundledBinary;
+    }
+    throw new Error("rig-shell.zig source file not found.");
+  }
+  const zigBinary = Bun.which("zig");
+  if (!zigBinary) {
+    throw new Error("zig is required to build the native Rig shell.");
+  }
+  mkdirSync9(dirname6(outputPath), { recursive: true });
+  const sourceDigest = await sha256File(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    zigBinary,
+    platform: process.platform,
+    arch: process.arch,
+    sourcePath,
+    sourceDigest
+  });
+  const manifestPath = nativeBuildManifestPath(outputPath);
+  const needsBuild = !existsSync13(outputPath) || !await hasMatchingNativeBuildManifest(manifestPath, buildKey);
+  if (!needsBuild) {
+    return outputPath;
+  }
+  const build = Bun.spawn([
+    zigBinary,
+    "build-exe",
+    sourcePath,
+    "-O",
+    "ReleaseFast",
+    `-femit-bin=${outputPath}`
+  ], {
+    cwd: dirname6(sourcePath),
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    build.exited,
+    new Response(build.stdout).text(),
+    new Response(build.stderr).text()
+  ]);
+  if (exitCode !== 0 || !existsSync13(outputPath)) {
+    const details = [stderr.trim(), stdout.trim()].filter(Boolean).join(`
+`);
+    throw new Error(`Failed to build native Rig shell: ${details || `zig exited with code ${exitCode}`}`);
+  }
+  await Bun.write(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`);
+  return outputPath;
+}
+async function materializeRigShellBinary(targetDir) {
+  const sourcePath = await ensureRigShellBinaryPath();
+  const targetPath = resolve12(targetDir, runtimeRigShellFileName());
+  mkdirSync9(targetDir, { recursive: true });
+  const sourceDigest = await sha256File(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    sourcePath,
+    sourceDigest
+  });
+  const needsCopy = !existsSync13(targetPath) || !await hasMatchingNativeBuildManifest(nativeBuildManifestPath(targetPath), buildKey);
+  if (needsCopy) {
+    copyFileSync(sourcePath, targetPath);
+    chmodSync(targetPath, 493);
+    await Bun.write(nativeBuildManifestPath(targetPath), `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`);
+  }
+  return targetPath;
+}
+function resolveRigShellSourcePath() {
+  for (const candidate of rigShellSourceCandidates()) {
+    if (candidate && existsSync13(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function resolveBundledRigShellBinaryPath() {
+  for (const candidate of rigShellBinaryCandidates()) {
+    if (candidate && existsSync13(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function rigShellSourceCandidates() {
+  const execDir = process.execPath?.trim() ? dirname6(process.execPath.trim()) : "";
+  const cwd = process.cwd()?.trim() || "";
+  const projectRoot = process.env.PROJECT_RIG_ROOT?.trim() || "";
+  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || "";
+  return [...new Set([
+    process.env.RIG_NATIVE_SHELL_SOURCE?.trim() || "",
+    cwd ? resolve12(cwd, "packages/harness-plugin/native/rig-shell.zig") : "",
+    projectRoot ? resolve12(projectRoot, "packages/harness-plugin/native/rig-shell.zig") : "",
+    hostProjectRoot ? resolve12(hostProjectRoot, "packages/harness-plugin/native/rig-shell.zig") : "",
+    execDir ? resolve12(execDir, "..", "..", "packages/harness-plugin/native/rig-shell.zig") : "",
+    execDir ? resolve12(execDir, "..", "native", "rig-shell.zig") : "",
+    resolve12(import.meta.dir, "../../native/rig-shell.zig")
+  ].filter(Boolean))];
+}
+function nativePackageBinaryCandidates(fromDir, fileName) {
+  const candidates = [];
+  let cursor = resolve12(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    candidates.push(resolve12(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve12(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve12(cursor, "native", fileName), resolve12(cursor, "native", "bin", fileName));
+    const parent = dirname6(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
+  }
+  return candidates;
+}
+function rigShellBinaryCandidates() {
+  const execDir = process.execPath?.trim() ? dirname6(process.execPath.trim()) : "";
+  const fileName = runtimeRigShellFileName();
+  return [...new Set([
+    process.env.RIG_NATIVE_SHELL_BIN?.trim() || "",
+    ...nativePackageBinaryCandidates(import.meta.dir, fileName),
+    execDir ? resolve12(execDir, fileName) : "",
+    execDir ? resolve12(execDir, "..", fileName) : "",
+    execDir ? resolve12(execDir, "..", "bin", fileName) : ""
+  ].filter(Boolean))];
+}
+function nativeBuildManifestPath(outputPath) {
+  return `${outputPath}.build-manifest.json`;
+}
+async function hasMatchingNativeBuildManifest(manifestPath, buildKey) {
+  if (!existsSync13(manifestPath)) {
+    return false;
+  }
+  try {
+    const manifest = await Bun.file(manifestPath).json();
+    return manifest.version === 1 && manifest.buildKey === buildKey;
+  } catch {
+    return false;
+  }
+}
+async function sha256File(path) {
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(await Bun.file(path).arrayBuffer());
+  return hasher.digest("hex");
+}
+var extractEmbeddedNative, sharedNativeShellOutputDir, sharedNativeShellOutputPath;
+var init_shell_tools = __esm(() => {
+  ({ extractEmbeddedNative } = getNativeExtractor(embeddedNatives));
+  sharedNativeShellOutputDir = resolve12(tmpdir(), "rig-native");
+  sharedNativeShellOutputPath = resolve12(sharedNativeShellOutputDir, `rig-shell-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+});
+
+// packages/harness-plugin/src/tooling/browser-tools.ts
+var exports_browser_tools = {};
+__export(exports_browser_tools, {
+  runtimeBrowserToolNames: () => runtimeBrowserToolNames,
+  runtimeBrowserToolBinaryName: () => runtimeBrowserToolBinaryName,
+  materializeRuntimeBrowserTools: () => materializeRuntimeBrowserTools
+});
+import { existsSync as existsSync14, rmSync as rmSync3, symlinkSync } from "fs";
+import { resolve as resolve13 } from "path";
+import { RUNTIME_BROWSER_TOOL_NAMES } from "@rig/contracts";
+function runtimeBrowserToolBinaryName() {
+  return `rig-browser-tool${process.platform === "win32" ? ".exe" : ""}`;
+}
+function runtimeBrowserToolNames() {
+  return [...RUNTIME_BROWSER_TOOL_NAMES];
+}
+async function materializeRuntimeBrowserTools(targetDir) {
+  const binaryPath = resolve13(targetDir, runtimeBrowserToolBinaryName());
+  for (const tool of runtimeBrowserToolNames()) {
+    const toolPath = resolve13(targetDir, tool);
+    if (existsSync14(toolPath)) {
+      rmSync3(toolPath, { force: true, recursive: true });
+    }
+    symlinkSync(binaryPath, toolPath);
+  }
+  return binaryPath;
+}
+var init_browser_tools = () => {};
+
+// packages/harness-plugin/src/tooling/file-tools.ts
+var exports_file_tools = {};
+__export(exports_file_tools, {
+  runtimeRigToolsFileName: () => runtimeRigToolsFileName,
+  runtimeFileToolNames: () => runtimeFileToolNames,
+  runtimeFileToolBasename: () => runtimeFileToolBasename,
+  materializeRuntimeFileTools: () => materializeRuntimeFileTools,
+  ensureRigToolsBinaryPath: () => ensureRigToolsBinaryPath
+});
+import { chmodSync as chmodSync2, copyFileSync as copyFileSync2, existsSync as existsSync15, mkdirSync as mkdirSync10, rmSync as rmSync4, symlinkSync as symlinkSync2 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { basename as basename4, dirname as dirname7, resolve as resolve14 } from "path";
+import { RUNTIME_FILE_TOOL_NAMES } from "@rig/contracts";
+import { getNativeExtractor as getNativeExtractor2 } from "@rig/core/native-extract";
+function runtimeRigToolsFileName() {
+  return `rig-tools${process.platform === "win32" ? ".exe" : ""}`;
+}
+function runtimeFileToolNames() {
+  return [...RUNTIME_FILE_TOOL_NAMES];
+}
+async function ensureRigToolsBinaryPath(outputPath = sharedNativeToolsOutputPath) {
+  const explicitBin = process.env.RIG_NATIVE_TOOLS_BIN?.trim();
+  if (explicitBin && existsSync15(explicitBin)) {
+    return explicitBin;
+  }
+  const embedded = extractEmbeddedNative2("rig-tools");
+  if (embedded) {
+    return embedded;
+  }
+  const sourcePath = resolveRigToolsSourcePath();
+  if (!sourcePath) {
+    const bundledBinary = resolveBundledRigToolsBinaryPath();
+    if (bundledBinary) {
+      return bundledBinary;
+    }
+    throw new Error("rig-tools.zig source file not found.");
+  }
+  const zigBinary = Bun.which("zig");
+  if (!zigBinary) {
+    throw new Error("zig is required to build native Rig file tools.");
+  }
+  mkdirSync10(dirname7(outputPath), { recursive: true });
+  const sourceDigest = await sha256File2(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    zigBinary,
+    platform: process.platform,
+    arch: process.arch,
+    sourcePath,
+    sourceDigest
+  });
+  const manifestPath = nativeBuildManifestPath2(outputPath);
+  const needsBuild = !existsSync15(outputPath) || !await hasMatchingNativeBuildManifest2(manifestPath, buildKey);
+  if (!needsBuild) {
+    return outputPath;
+  }
+  const build = Bun.spawn([
+    zigBinary,
+    "build-exe",
+    sourcePath,
+    "-O",
+    "ReleaseFast",
+    `-femit-bin=${outputPath}`
+  ], {
+    cwd: dirname7(sourcePath),
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    build.exited,
+    new Response(build.stdout).text(),
+    new Response(build.stderr).text()
+  ]);
+  if (exitCode !== 0 || !existsSync15(outputPath)) {
+    const details = [stderr.trim(), stdout.trim()].filter(Boolean).join(`
+`);
+    throw new Error(`Failed to build native Rig file tools: ${details || `zig exited with code ${exitCode}`}`);
+  }
+  await Bun.write(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`);
+  return outputPath;
+}
+async function materializeRuntimeFileTools(targetDir) {
+  const sourcePath = await ensureRigToolsBinaryPath();
+  const targetPath = resolve14(targetDir, runtimeRigToolsFileName());
+  mkdirSync10(targetDir, { recursive: true });
+  const sourceDigest = await sha256File2(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    sourcePath,
+    sourceDigest
+  });
+  const needsCopy = !existsSync15(targetPath) || !await hasMatchingNativeBuildManifest2(nativeBuildManifestPath2(targetPath), buildKey);
+  if (needsCopy) {
+    copyFileSync2(sourcePath, targetPath);
+    chmodSync2(targetPath, 493);
+    await Bun.write(nativeBuildManifestPath2(targetPath), `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`);
+  }
+  for (const tool of runtimeFileToolNames()) {
+    const toolPath = resolve14(targetDir, tool);
+    if (existsSync15(toolPath)) {
+      rmSync4(toolPath, { force: true, recursive: true });
+    }
+    symlinkSync2(targetPath, toolPath);
+  }
+  return targetPath;
+}
+function resolveRigToolsSourcePath() {
+  for (const candidate of rigToolsSourceCandidates()) {
+    if (candidate && existsSync15(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function resolveBundledRigToolsBinaryPath() {
+  for (const candidate of rigToolsBinaryCandidates()) {
+    if (candidate && existsSync15(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function rigToolsSourceCandidates() {
+  const execDir = process.execPath?.trim() ? dirname7(process.execPath.trim()) : "";
+  const cwd = process.cwd()?.trim() || "";
+  const projectRoot = process.env.PROJECT_RIG_ROOT?.trim() || "";
+  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || "";
+  return [...new Set([
+    process.env.RIG_NATIVE_TOOLS_SOURCE?.trim() || "",
+    cwd ? resolve14(cwd, "packages/harness-plugin/native/rig-tools.zig") : "",
+    projectRoot ? resolve14(projectRoot, "packages/harness-plugin/native/rig-tools.zig") : "",
+    hostProjectRoot ? resolve14(hostProjectRoot, "packages/harness-plugin/native/rig-tools.zig") : "",
+    execDir ? resolve14(execDir, "..", "..", "packages/harness-plugin/native/rig-tools.zig") : "",
+    execDir ? resolve14(execDir, "..", "native", "rig-tools.zig") : "",
+    resolve14(import.meta.dir, "../../native/rig-tools.zig")
+  ].filter(Boolean))];
+}
+function nativePackageBinaryCandidates2(fromDir, fileName) {
+  const candidates = [];
+  let cursor = resolve14(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    candidates.push(resolve14(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve14(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve14(cursor, "native", fileName), resolve14(cursor, "native", "bin", fileName));
+    const parent = dirname7(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
+  }
+  return candidates;
+}
+function rigToolsBinaryCandidates() {
+  const execDir = process.execPath?.trim() ? dirname7(process.execPath.trim()) : "";
+  const fileName = runtimeRigToolsFileName();
+  return [...new Set([
+    process.env.RIG_NATIVE_TOOLS_BIN?.trim() || "",
+    ...nativePackageBinaryCandidates2(import.meta.dir, fileName),
+    execDir ? resolve14(execDir, fileName) : "",
+    execDir ? resolve14(execDir, "..", fileName) : "",
+    execDir ? resolve14(execDir, "..", "bin", fileName) : ""
+  ].filter(Boolean))];
+}
+function runtimeFileToolBasename(path) {
+  return basename4(path);
+}
+function nativeBuildManifestPath2(outputPath) {
+  return `${outputPath}.build-manifest.json`;
+}
+async function hasMatchingNativeBuildManifest2(manifestPath, buildKey) {
+  if (!existsSync15(manifestPath)) {
+    return false;
+  }
+  try {
+    const manifest = await Bun.file(manifestPath).json();
+    return manifest.version === 1 && manifest.buildKey === buildKey;
+  } catch {
+    return false;
+  }
+}
+async function sha256File2(path) {
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(await Bun.file(path).arrayBuffer());
+  return hasher.digest("hex");
+}
+var extractEmbeddedNative2, sharedNativeToolsOutputDir, sharedNativeToolsOutputPath;
+var init_file_tools = __esm(() => {
+  ({ extractEmbeddedNative: extractEmbeddedNative2 } = getNativeExtractor2(embeddedNatives));
+  sharedNativeToolsOutputDir = resolve14(tmpdir2(), "rig-native");
+  sharedNativeToolsOutputPath = resolve14(sharedNativeToolsOutputDir, `rig-tools-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+});
+
+// packages/harness-plugin/src/tooling/gateway.ts
+var exports_gateway = {};
+__export(exports_gateway, {
+  runtimeGatewayToolNames: () => runtimeGatewayToolNames,
+  runtimeFileToolNames: () => runtimeFileToolNames,
+  runtimeBrowserToolNames: () => runtimeBrowserToolNames,
+  materializeRuntimeToolGateway: () => materializeRuntimeToolGateway,
+  materializeRuntimeFileTools: () => materializeRuntimeFileTools,
+  materializeRuntimeBrowserTools: () => materializeRuntimeBrowserTools
+});
+import { existsSync as existsSync16, rmSync as rmSync5, symlinkSync as symlinkSync3 } from "fs";
+import { resolve as resolve15 } from "path";
+import { RUNTIME_SHELL_TOOL_NAMES as RUNTIME_SHELL_TOOL_NAMES2 } from "@rig/contracts";
+function runtimeGatewayToolNames() {
+  return [...RUNTIME_SHELL_TOOL_NAMES2];
+}
+async function materializeRuntimeToolGateway(binDir) {
+  const shellPath = await materializeRigShellBinary(binDir);
+  for (const tool of runtimeGatewayToolNames()) {
+    const toolPath = resolve15(binDir, tool);
+    if (existsSync16(toolPath)) {
+      rmSync5(toolPath, { force: true, recursive: true });
+    }
+    symlinkSync3(shellPath, toolPath);
+  }
+  await materializeRuntimeBrowserTools(binDir);
+  return resolve15(binDir, runtimeRigShellFileName());
+}
+var init_gateway = __esm(() => {
+  init_shell_tools();
+  init_browser_tools();
+  init_browser_tools();
+  init_file_tools();
+});
+
+// packages/harness-plugin/src/tooling/claude-router-binary.ts
+var exports_claude_router_binary = {};
+__export(exports_claude_router_binary, {
+  runtimeClaudeToolRouterFileName: () => runtimeClaudeToolRouterFileName,
+  materializeClaudeToolRouterBinary: () => materializeClaudeToolRouterBinary,
+  ensureClaudeToolRouterBinaryPath: () => ensureClaudeToolRouterBinaryPath
+});
+import { chmodSync as chmodSync3, copyFileSync as copyFileSync3, existsSync as existsSync17, mkdirSync as mkdirSync11, statSync as statSync3 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { dirname as dirname8, resolve as resolve16 } from "path";
+import { getNativeExtractor as getNativeExtractor3 } from "@rig/core/native-extract";
+function runtimeClaudeToolRouterFileName() {
+  return `rig-tool-router${process.platform === "win32" ? ".exe" : ""}`;
+}
+async function requireNativeToolchainRuntimeBinaryBuild(_projectRoot) {
+  const { runtimeBinaryBuildService } = await import("@rig/core/native-toolchain/runtime-binary-build");
+  return runtimeBinaryBuildService;
+}
+async function ensureClaudeToolRouterBinaryPath(projectRoot, outputPath = sharedRouterOutputPath) {
+  const sourcePath = resolve16(projectRoot, "packages/harness-plugin/src/tooling/claude-router.ts");
+  mkdirSync11(dirname8(outputPath), { recursive: true });
+  const needsBuild = !existsSync17(outputPath) || statSync3(sourcePath).mtimeMs > statSync3(outputPath).mtimeMs;
+  if (!needsBuild) {
+    return outputPath;
+  }
+  const service = await requireNativeToolchainRuntimeBinaryBuild(projectRoot);
+  const engine = service.createRuntimeBinaryBuildEngine({ embeddedNatives });
+  await engine.buildRuntimeBinary({
+    sourcePath: "packages/harness-plugin/src/tooling/claude-router.ts",
+    outputPath,
+    cwd: projectRoot
+  });
+  chmodSync3(outputPath, 493);
+  return outputPath;
+}
+async function materializeClaudeToolRouterBinary(projectRoot, targetDir) {
+  if (hasEmbeddedNatives()) {
+    const targetPath2 = resolve16(targetDir, runtimeClaudeToolRouterFileName());
+    const service = await requireNativeToolchainRuntimeBinaryBuild(projectRoot);
+    service.materializeSelfExecRole(targetPath2);
+    return targetPath2;
+  }
+  const sourcePath = await ensureClaudeToolRouterBinaryPath(projectRoot);
+  const targetPath = resolve16(targetDir, runtimeClaudeToolRouterFileName());
+  mkdirSync11(targetDir, { recursive: true });
+  const needsCopy = !existsSync17(targetPath) || statSync3(sourcePath).mtimeMs > statSync3(targetPath).mtimeMs;
+  if (needsCopy) {
+    copyFileSync3(sourcePath, targetPath);
+    chmodSync3(targetPath, 493);
+  }
+  return targetPath;
+}
+var hasEmbeddedNatives, sharedRouterOutputDir, sharedRouterOutputPath;
+var init_claude_router_binary = __esm(() => {
+  ({ hasEmbeddedNatives } = getNativeExtractor3(embeddedNatives));
+  sharedRouterOutputDir = resolve16(tmpdir3(), "rig-native");
+  sharedRouterOutputPath = resolve16(sharedRouterOutputDir, `rig-tool-router-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+});
+
+// packages/harness-plugin/src/plugin.ts
+import { definePlugin } from "@rig/core/config";
+import { defineCapability as defineCapability8 } from "@rig/core/capability";
+import { AGENT_HARNESS, HARNESS_PROFILE_STATE as HARNESS_PROFILE_STATE2, RUNTIME_INSTRUCTION, RUNTIME_SECRETS, SESSION_ASSET_MATERIALIZER, SESSION_HOOK_MATERIALIZER, TOOL_MATERIALIZER } from "@rig/contracts";
+
+// packages/harness-plugin/src/model.ts
+import { Schema } from "effect";
+var CODEX_REASONING_EFFORT_OPTIONS = ["xhigh", "high", "medium", "low"];
+var CodexModelOptions = Schema.Struct({
+  reasoningEffort: Schema.optional(Schema.Literals(CODEX_REASONING_EFFORT_OPTIONS)),
+  fastMode: Schema.optional(Schema.Boolean)
+});
+var ClaudeModelOptions = Schema.Struct({});
+var ProviderModelOptions = Schema.Struct({
+  codex: Schema.optional(CodexModelOptions),
+  claude: Schema.optional(ClaudeModelOptions)
+});
+var MODEL_OPTIONS_BY_PROVIDER = {
+  codex: [
+    { slug: "gpt-5.4", name: "GPT-5.4" },
+    { slug: "gpt-5.3-codex", name: "GPT-5.3 Codex" },
+    { slug: "gpt-5.3-codex-spark", name: "GPT-5.3 Codex Spark" },
+    { slug: "gpt-5.2-codex", name: "GPT-5.2 Codex" },
+    { slug: "gpt-5.2", name: "GPT-5.2" }
+  ],
+  claude: [
+    { slug: "claude-sonnet-4-6", name: "Claude Sonnet 4.6" },
+    { slug: "claude-opus-4-1", name: "Claude Opus 4.1" },
+    { slug: "claude-3-7-sonnet-latest", name: "Claude 3.7 Sonnet" }
+  ]
+};
+var DEFAULT_MODEL_BY_PROVIDER = {
+  codex: "gpt-5.4",
+  claude: "claude-sonnet-4-6"
+};
+var MODEL_SLUG_ALIASES_BY_PROVIDER = {
+  codex: {
+    "5.4": "gpt-5.4",
+    "5.3": "gpt-5.3-codex",
+    "gpt-5.3": "gpt-5.3-codex",
+    "5.3-spark": "gpt-5.3-codex-spark",
+    "gpt-5.3-spark": "gpt-5.3-codex-spark"
+  },
+  claude: {
+    sonnet: "claude-sonnet-4-6",
+    opus: "claude-opus-4-1",
+    "3.7-sonnet": "claude-3-7-sonnet-latest"
+  }
+};
+var REASONING_EFFORT_OPTIONS_BY_PROVIDER = {
+  codex: CODEX_REASONING_EFFORT_OPTIONS,
+  claude: []
+};
+var DEFAULT_REASONING_EFFORT_BY_PROVIDER = {
+  codex: "high",
+  claude: null
+};
+
+// packages/harness-plugin/src/plugin.ts
+var PROVIDER_PLUGIN_NAME = "@rig/harness-plugin";
+var DEFAULT_PROVIDER_KIND = "codex";
+var DEFAULT_RUNTIME_MODE = "full-access";
+var DEFAULT_PROVIDER_INTERACTION_MODE = "default";
+var RuntimeInstructionCap = defineCapability8(RUNTIME_INSTRUCTION);
+var AgentHarnessCap = defineCapability8(AGENT_HARNESS);
+var HarnessProfileStateCap2 = defineCapability8(HARNESS_PROFILE_STATE2);
+var RuntimeSecretsCap = defineCapability8(RUNTIME_SECRETS);
+var SessionAssetMaterializerCap = defineCapability8(SESSION_ASSET_MATERIALIZER);
+var SessionHookMaterializerCap = defineCapability8(SESSION_HOOK_MATERIALIZER);
+var ToolMaterializerCap = defineCapability8(TOOL_MATERIALIZER);
+var PROVIDER_SEED_ENTRYPOINTS = [
+  {
+    id: `${PROVIDER_PLUGIN_NAME}:rig-agent`,
+    basename: "rig-agent",
+    description: "Provider-owned per-runtime Rig agent entrypoint.",
+    run: async (context) => {
+      const args = [...context.argv].slice(2);
+      if (args.length === 0 || args[0] === "--help" || args[0] === "help" || args[0] === "--version" || args[0] === "-V") {
+        console.log("[rig-agent] runtime shim ready");
+        return 0;
+      }
+      const { runRigAgentEntrypoint: runRigAgentEntrypoint2 } = await Promise.resolve().then(() => (init_rig_agent_entrypoint(), exports_rig_agent_entrypoint));
+      await runRigAgentEntrypoint2();
+    }
+  },
+  {
+    id: `${PROVIDER_PLUGIN_NAME}:rig-agent-dispatch`,
+    basename: "rig-agent-dispatch",
+    description: "Provider-owned agent dispatch/provisioning shim.",
+    run: async (context) => {
+      const { runAgentWrapper: runAgentWrapper2 } = await Promise.resolve().then(() => (init_agent_wrapper(), exports_agent_wrapper));
+      const exitCode = await runAgentWrapper2({ argv: [...context.argv].slice(2) });
+      return exitCode;
+    }
+  },
+  {
+    id: `${PROVIDER_PLUGIN_NAME}:rig-browser-tool`,
+    basename: "rig-browser-tool",
+    description: "Provider-owned runtime browser helper shim.",
+    run: async (context) => {
+      const args = [...context.argv].slice(2);
+      if (args.length === 0 || args[0] === "--help" || args[0] === "help" || args[0] === "--version" || args[0] === "-V") {
+        console.log("[rig-browser-tool] runtime shim ready");
+        return 0;
+      }
+      if (context.execPath)
+        process.argv[1] = context.execPath;
+      else if (context.basename)
+        process.argv[1] = context.basename;
+      await Promise.resolve().then(() => (init_browser_tool_entrypoint(), exports_browser_tool_entrypoint));
+    }
+  },
+  {
+    id: `${PROVIDER_PLUGIN_NAME}:rig-tool-router`,
+    basename: "rig-tool-router",
+    description: "Claude-compatible provider tool router sidecar.",
+    run: async () => {
+      const { runClaudeToolRouterServer: runClaudeToolRouterServer2 } = await init_claude_router().then(() => exports_claude_router);
+      await runClaudeToolRouterServer2();
+    }
+  }
+];
+var piCommand = {
+  id: `${PROVIDER_PLUGIN_NAME}:pi`,
+  family: "pi",
+  description: "Inspect Pi/OMP runtime integration.",
+  projectRequired: false,
+  helpDoc: {
+    name: "pi",
+    summary: "Manage Pi extension packages for this project (community extensions from npm/git).",
+    usage: ["rig pi <list|add|remove|search> [args]"],
+    commands: [
+      { command: "list", description: "Show project and user Pi extension packages." },
+      { command: "add <source>", description: "Add an npm/git Pi extension to .pi/settings.json (auto-installs at next session)." },
+      { command: "remove <source>", description: "Remove an operator-added Pi extension." },
+      { command: "search [term]", description: "Discover Pi extension packages on the npm registry." }
+    ],
+    examples: ["rig pi search subagents", "rig pi add pi-subagents", "rig pi list"],
+    next: ["Config-managed extensions: declare `runtime: { pi: { packages: [...] } }` in rig.config.ts \u2014 workers pick them up automatically."],
+    advancedOnly: true
+  },
+  run: async (context, args) => (await Promise.resolve().then(() => (init_pi_command(), exports_pi_command))).executePi(context, [...args])
+};
+var profileCommand = {
+  id: `${PROVIDER_PLUGIN_NAME}:profile`,
+  family: "profile",
+  description: "Manage runtime profile settings.",
+  projectRequired: false,
+  helpDoc: {
+    name: "profile",
+    summary: "Runtime profile/model defaults.",
+    usage: ["rig profile <show|set>"],
+    commands: [
+      { command: "show", description: "Show the active execution profile.", primary: true },
+      { command: "set [--model <model>] [--runtime <runtime>] [--plugin <plugin>]", description: "Set model/runtime/plugin profile defaults.", primary: true }
+    ],
+    advancedOnly: true
+  },
+  run: async (context, args) => (await Promise.resolve().then(() => (init_profile_command(), exports_profile_command))).executeProfile(context, [...args])
+};
+var agentCommand = {
+  id: `${PROVIDER_PLUGIN_NAME}:agent`,
+  family: "agent",
+  description: "Run agent lifecycle helpers.",
+  projectRequired: true,
+  helpDoc: {
+    name: "agent",
+    summary: "Runtime agent workspace helpers.",
+    usage: ["rig agent <list|prepare|run|cleanup>"],
+    commands: [
+      { command: "list", description: "List prepared agent runtimes.", primary: true },
+      { command: "prepare [--id <id>] [--mode <mode>] [--task <task>]", description: "Prepare an isolated agent runtime workspace.", primary: true },
+      { command: "run [--id <id>] [--mode <mode>] [--task <task>] [--skip-project-sync]", description: "Prepare (if needed) and run an agent in its workspace.", primary: true },
+      { command: "cleanup [--all] [--id <id>]", description: "Remove prepared agent workspaces.", primary: true }
+    ],
+    advancedOnly: true
+  },
+  run: async (context, args) => (await Promise.resolve().then(() => (init_agent_command(), exports_agent_command))).executeAgent(context, [...args])
+};
+var providerPlugin = definePlugin({
+  name: PROVIDER_PLUGIN_NAME,
+  version: "0.0.0-alpha.1",
+  effects: {
+    readsFiles: true,
+    writesFiles: true,
+    spawnsProcesses: true,
+    opensNetwork: true,
+    contributesCliCommands: true
+  },
+  contributes: {
+    cliCommands: [piCommand, profileCommand, agentCommand],
+    capabilities: [
+      RuntimeInstructionCap.provide(async () => (await Promise.resolve().then(() => (init_service(), exports_service))).svc, {
+        title: "Agent harness provider instructions",
+        description: "Provide the agent-harness file-tool contract and runtime-context instruction lines."
+      }),
+      RuntimeSecretsCap.provide(async () => (await Promise.resolve().then(() => (init_runtime_secrets(), exports_runtime_secrets))).runtimeSecretsService, {
+        title: "Runtime secrets",
+        description: "Provider-owned runtime/review secret key resolution and baked define materialization."
+      }),
+      HarnessProfileStateCap2.provide(async () => (await Promise.resolve().then(() => (init_profile_state(), exports_profile_state))).harnessProfileStateService, {
+        title: "Harness profile state",
+        description: "Provider-owned execution/review profile state path and JSON persistence."
+      }),
+      AgentHarnessCap.provide(async () => ({
+        resolveAgentWrapperEntrypoint: () => "packages/harness-plugin/src/agent-harness/agent-wrapper.ts",
+        runAgentWrapper: async (input) => {
+          const { runAgentWrapper: runAgentWrapper2 } = await Promise.resolve().then(() => (init_agent_wrapper(), exports_agent_wrapper));
+          return runAgentWrapper2({ argv: [...input.argv] });
+        },
+        runRigAgentEntrypoint: async () => {
+          const { runRigAgentEntrypoint: runRigAgentEntrypoint2 } = await Promise.resolve().then(() => (init_rig_agent_entrypoint(), exports_rig_agent_entrypoint));
+          await runRigAgentEntrypoint2();
+        }
+      }), {
+        title: "Agent harness",
+        description: "Provider-owned Rig agent wrapper and runtime entrypoint service."
+      }),
+      SessionAssetMaterializerCap.provide(async () => (await Promise.resolve().then(() => (init_session_asset_materializer_service(), exports_session_asset_materializer_service))).sessionAssetMaterializer, {
+        title: "Pi session asset materializer",
+        description: "Materialize plugin-contributed Pi skills and config-declared Pi packages into the workspace .pi/ directory."
+      }),
+      SessionHookMaterializerCap.provide(async () => (await Promise.resolve().then(() => (init_session_hook_materializer_service(), exports_session_hook_materializer_service))).sessionHookMaterializer, {
+        title: "Agent session hook materializer",
+        description: "Materialize plugin-contributed hooks into the active provider session host."
+      }),
+      ToolMaterializerCap.provide(async () => {
+        const [gateway, fileTools, claudeRouter, browserTools] = await Promise.all([
+          Promise.resolve().then(() => (init_gateway(), exports_gateway)),
+          Promise.resolve().then(() => (init_file_tools(), exports_file_tools)),
+          Promise.resolve().then(() => (init_claude_router_binary(), exports_claude_router_binary)),
+          Promise.resolve().then(() => (init_browser_tools(), exports_browser_tools))
+        ]);
+        return {
+          materializeRuntimeToolGateway: gateway.materializeRuntimeToolGateway,
+          materializeRuntimeFileTools: fileTools.materializeRuntimeFileTools,
+          materializeClaudeToolRouterBinary: claudeRouter.materializeClaudeToolRouterBinary,
+          materializeRuntimeBrowserTools: browserTools.materializeRuntimeBrowserTools,
+          runtimeBrowserToolBinaryName: browserTools.runtimeBrowserToolBinaryName
+        };
+      }, {
+        title: "Runtime tool materializer",
+        description: "Materializes harness-plugin-owned tool binaries (gateway, file-tools, claude-router, browser-tools) into the runtime bin directory."
+      })
+    ],
+    seedEntrypoints: PROVIDER_SEED_ENTRYPOINTS,
+    config: { defaults: () => ({ runtime: { harness: "pi", mode: "yolo" } }) }
+  }
+});
+function createProviderPlugin() {
+  return providerPlugin;
+}
+var plugin_default = providerPlugin;
+export {
+  providerPlugin,
+  plugin_default as default,
+  createProviderPlugin,
+  REASONING_EFFORT_OPTIONS_BY_PROVIDER,
+  ProviderModelOptions,
+  PROVIDER_PLUGIN_NAME,
+  MODEL_SLUG_ALIASES_BY_PROVIDER,
+  MODEL_OPTIONS_BY_PROVIDER,
+  DEFAULT_RUNTIME_MODE,
+  DEFAULT_REASONING_EFFORT_BY_PROVIDER,
+  DEFAULT_PROVIDER_KIND,
+  DEFAULT_PROVIDER_INTERACTION_MODE,
+  DEFAULT_MODEL_BY_PROVIDER,
+  CodexModelOptions,
+  ClaudeModelOptions,
+  CODEX_REASONING_EFFORT_OPTIONS
+};