@h-rig/harness-plugin 0.0.6-alpha.186

package/dist/src/profile-command.d.ts

@@ -0,0 +1,3 @@
+import type { RuntimeCliContext } from "@rig/core/config";
+import { type CommandOutcome } from "@rig/contracts";
+export declare function executeProfile(context: RuntimeCliContext, args: string[]): Promise<CommandOutcome>;

package/dist/src/profile-command.js

@@ -0,0 +1,79 @@
+// @bun
+// packages/harness-plugin/src/profile-command.ts
+import { CliError, requireNoExtraArgs, takeOption } from "@rig/std-shared/cli-args";
+import { HARNESS_PROFILE_STATE } from "@rig/contracts";
+import { defineCapability } from "@rig/core/capability";
+import { loadCapabilityForRoot } from "@rig/core/capability-loaders";
+import { withMutedConsole } from "@rig/std-shared/cli-muted-console";
+var HarnessProfileStateCap = defineCapability(HARNESS_PROFILE_STATE);
+async function profileState(projectRoot) {
+  const service = await loadCapabilityForRoot(projectRoot, HarnessProfileStateCap);
+  if (!service) {
+    throw new CliError("Harness profile state capability unavailable: load @rig/harness-plugin (standard bundle).", 2);
+  }
+  return service;
+}
+var DEFAULT_AGENT_PROFILE = {
+  model: "pi",
+  runtime: "pi",
+  agent_plugin: "pi",
+  updated_at: new Date().toISOString()
+};
+var AGENT_PROFILE_FILE = "agent-profile.json";
+async function showProfile(projectRoot) {
+  const state = await profileState(projectRoot);
+  const profile = { ...DEFAULT_AGENT_PROFILE, ...state.readHarnessStateJson(projectRoot, AGENT_PROFILE_FILE), model: "pi", runtime: "pi", agent_plugin: "pi" };
+  console.log("Execution Profile:");
+  console.log(`  model:        ${profile.model}`);
+  console.log(`  runtime:      ${profile.runtime}`);
+  console.log(`  plugin:       ${profile.agent_plugin}`);
+}
+async function setProfile(projectRoot, options) {
+  const invalid = [options.model, options.runtime, options.plugin, options.preset].filter((value) => typeof value === "string" && value.trim().length > 0 && value.trim() !== "pi");
+  if (invalid.length > 0) {
+    throw new CliError("Only the Pi runtime profile is supported by this Rig substrate.", 1, {
+      hint: 'Omit --model/--runtime/--plugin/--preset or pass "pi" explicitly.'
+    });
+  }
+  const state = await profileState(projectRoot);
+  state.writeHarnessStateJson(projectRoot, AGENT_PROFILE_FILE, { ...DEFAULT_AGENT_PROFILE, updated_at: new Date().toISOString() });
+  await showProfile(projectRoot);
+}
+async function executeProfile(context, args) {
+  const [command = "show", ...rest] = args;
+  switch (command) {
+    case "show":
+      requireNoExtraArgs(rest, "rig profile show");
+      await withMutedConsole(context.outputMode === "json", () => showProfile(context.projectRoot));
+      return { ok: true, group: "profile", command };
+    case "set": {
+      let pending = rest;
+      const presetResult = takeOption(pending, "--preset");
+      pending = presetResult.rest;
+      const modelResult = takeOption(pending, "--model");
+      pending = modelResult.rest;
+      const runtimeResult = takeOption(pending, "--runtime");
+      pending = runtimeResult.rest;
+      const pluginResult = takeOption(pending, "--plugin");
+      pending = pluginResult.rest;
+      requireNoExtraArgs(pending, "rig profile set [--model ...] [--runtime ...] [--plugin ...]");
+      if (!presetResult.value && !modelResult.value && !runtimeResult.value && !pluginResult.value && rest.length === 0) {
+        throw new CliError("Provide at least one of --model, --runtime, or --plugin.", 1, {
+          hint: "Example: `rig profile set --model pi`. See current values with `rig profile show`."
+        });
+      }
+      await withMutedConsole(context.outputMode === "json", () => setProfile(context.projectRoot, {
+        ...modelResult.value !== undefined ? { model: modelResult.value } : {},
+        ...runtimeResult.value !== undefined ? { runtime: runtimeResult.value } : {},
+        ...pluginResult.value !== undefined ? { plugin: pluginResult.value } : {},
+        ...presetResult.value !== undefined ? { preset: presetResult.value } : {}
+      }));
+      return { ok: true, group: "profile", command, details: { lockedTo: "pi" } };
+    }
+    default:
+      throw new CliError(`Unknown profile command: ${command}`, 1, { hint: "Run `rig profile --help` \u2014 commands are show|set." });
+  }
+}
+export {
+  executeProfile
+};

package/dist/src/profile-state.d.ts

@@ -0,0 +1,7 @@
+import type { HarnessProfileStateService } from "@rig/contracts";
+type JsonObject = object;
+export declare function harnessStateJsonPath(projectRoot: string, filename: string): string;
+export declare function readHarnessStateJson<T extends JsonObject>(projectRoot: string, filename: string): Partial<T> | null;
+export declare function writeHarnessStateJson<T extends JsonObject>(projectRoot: string, filename: string, value: T): string;
+export declare const harnessProfileStateService: HarnessProfileStateService;
+export {};

package/dist/src/profile-state.js

@@ -0,0 +1,39 @@
+// @bun
+// packages/harness-plugin/src/profile-state.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { resolve } from "path";
+import { resolveHarnessPaths } from "@rig/core/harness-paths";
+function harnessStateJsonPath(projectRoot, filename) {
+  return resolve(resolveHarnessPaths(projectRoot).stateDir, filename);
+}
+function readHarnessStateJson(projectRoot, filename) {
+  const path = harnessStateJsonPath(projectRoot, filename);
+  if (!existsSync(path)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf-8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function writeHarnessStateJson(projectRoot, filename, value) {
+  const paths = resolveHarnessPaths(projectRoot);
+  mkdirSync(paths.stateDir, { recursive: true });
+  const path = resolve(paths.stateDir, filename);
+  writeFileSync(path, `${JSON.stringify(value, null, 2)}
+`, "utf-8");
+  return path;
+}
+var harnessProfileStateService = {
+  harnessStateJsonPath,
+  readHarnessStateJson,
+  writeHarnessStateJson
+};
+export {
+  writeHarnessStateJson,
+  readHarnessStateJson,
+  harnessStateJsonPath,
+  harnessProfileStateService
+};

package/dist/src/rig-task-run-skill.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Return the rig-task-run skill body (markdown without frontmatter).
+ *
+ * The file is shipped at `packages/runtime/skills/rig-task-run.md`. We search
+ * a few paths so it resolves whether the caller is running from monorepo
+ * source, from a sibling import, or via the published @rig/runtime exports.
+ */
+export declare function loadRigTaskRunSkillBody(): string;

package/dist/src/rig-task-run-skill.js

@@ -0,0 +1,39 @@
+// @bun
+// packages/harness-plugin/src/rig-task-run-skill.ts
+import { existsSync, readFileSync } from "fs";
+import { dirname, resolve } from "path";
+import { fileURLToPath } from "url";
+var SKILL_FILENAME = "rig-task-run.md";
+var FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;
+var cachedBody = null;
+function loadRigTaskRunSkillBody() {
+  if (cachedBody !== null) {
+    return cachedBody;
+  }
+  const path = resolveSkillPath();
+  if (!path) {
+    cachedBody = "";
+    return cachedBody;
+  }
+  const raw = readFileSync(path, "utf-8");
+  const match = raw.match(FRONTMATTER_RE);
+  cachedBody = (match ? match[2] ?? raw : raw).trim();
+  return cachedBody;
+}
+function resolveSkillPath() {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const candidates = [
+    resolve(here, "..", "skills", SKILL_FILENAME),
+    resolve(here, "..", "..", "skills", SKILL_FILENAME),
+    resolve(here, "..", "..", "..", "skills", SKILL_FILENAME)
+  ];
+  for (const candidate of candidates) {
+    if (existsSync(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+export {
+  loadRigTaskRunSkillBody
+};

package/dist/src/runtime-instructions.d.ts

@@ -0,0 +1,4 @@
+export type RuntimeInstructionProvider = "pi";
+export declare function normalizeRuntimeInstructionProvider(_value: string | undefined | null): RuntimeInstructionProvider;
+export declare function buildProviderTaskRunInstructionLines(_provider: RuntimeInstructionProvider): string[];
+export declare function buildProviderRuntimeContextLines(_provider: RuntimeInstructionProvider): string[];

package/dist/src/runtime-instructions.js

@@ -0,0 +1,26 @@
+// @bun
+// packages/harness-plugin/src/runtime-instructions.ts
+function normalizeRuntimeInstructionProvider(_value) {
+  return "pi";
+}
+function buildProviderTaskRunInstructionLines(_provider) {
+  return [
+    "Use Pi's built-in `read`, `write`, `edit`, and `bash` tools from the isolated Rig task worktree.",
+    "Keep file writes inside the scoped task workspace unless Rig explicitly tells you a path is host/project metadata.",
+    "Prefer `read`, `write`, and `edit` over shell one-liners whenever those tools fit.",
+    "When shell access is needed, keep commands narrow and bounded; avoid repo-wide searches without an explicit path and output cap."
+  ];
+}
+function buildProviderRuntimeContextLines(_provider) {
+  return [
+    "Pi runs from the isolated Rig task worktree with its built-in `read`, `write`, `edit`, and `bash` tools enabled.",
+    "Keep writes scoped to the task workspace unless Rig-provided instructions name an explicit metadata path.",
+    "Prefer Pi file tools over shell one-liners for file reads and edits.",
+    "Keep shell commands narrow and bounded; cap broad searches before widening."
+  ];
+}
+export {
+  normalizeRuntimeInstructionProvider,
+  buildProviderTaskRunInstructionLines,
+  buildProviderRuntimeContextLines
+};

package/dist/src/runtime-secrets.d.ts

@@ -0,0 +1,6 @@
+import type { RuntimeSecrets, RuntimeSecretsService } from "@rig/contracts";
+export declare const BAKED_RUNTIME_SECRETS: RuntimeSecrets;
+export declare function resolveRuntimeSecrets(env: Record<string, string | undefined>, baked?: RuntimeSecrets): RuntimeSecrets;
+export declare function loadDotEnvSecrets(projectRoot: string, env?: Record<string, string | undefined>): RuntimeSecrets;
+export declare function secretDefinesFromEnv(env?: Record<string, string | undefined>, projectRoot?: string): Record<string, string>;
+export declare const runtimeSecretsService: RuntimeSecretsService;

package/dist/src/runtime-secrets.js

@@ -0,0 +1,58 @@
+// @bun
+// packages/harness-plugin/src/runtime-secrets.ts
+import { loadDotEnvValues, resolveRuntimeConfigValues } from "@rig/core/baked-secrets";
+var BAKED_RUNTIME_SECRETS = {
+  ANTHROPIC_API_KEY: typeof RIG_BAKED_ANTHROPIC_API_KEY !== "undefined" ? RIG_BAKED_ANTHROPIC_API_KEY : "",
+  OPENAI_API_KEY: typeof RIG_BAKED_OPENAI_API_KEY !== "undefined" ? RIG_BAKED_OPENAI_API_KEY : "",
+  OPENROUTER_API_KEY: typeof RIG_BAKED_OPENROUTER_API_KEY !== "undefined" ? RIG_BAKED_OPENROUTER_API_KEY : "",
+  AI_REVIEW_MODE: typeof RIG_BAKED_AI_REVIEW_MODE !== "undefined" ? RIG_BAKED_AI_REVIEW_MODE : "",
+  AI_REVIEW_PROVIDER: typeof RIG_BAKED_AI_REVIEW_PROVIDER !== "undefined" ? RIG_BAKED_AI_REVIEW_PROVIDER : "",
+  GH_TOKEN: typeof RIG_BAKED_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GITHUB_TOKEN : "",
+  GITHUB_TOKEN: typeof RIG_BAKED_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GITHUB_TOKEN : "",
+  GITHUB_SSH_KEY: typeof RIG_BAKED_GITHUB_SSH_KEY !== "undefined" ? RIG_BAKED_GITHUB_SSH_KEY : "",
+  AWS_ACCESS_KEY_ID: typeof RIG_BAKED_AWS_ACCESS_KEY_ID !== "undefined" ? RIG_BAKED_AWS_ACCESS_KEY_ID : "",
+  AWS_SECRET_ACCESS_KEY: typeof RIG_BAKED_AWS_SECRET_ACCESS_KEY !== "undefined" ? RIG_BAKED_AWS_SECRET_ACCESS_KEY : "",
+  AWS_REGION: typeof RIG_BAKED_AWS_REGION !== "undefined" ? RIG_BAKED_AWS_REGION : "",
+  LINEAR_API_KEY: typeof RIG_BAKED_LINEAR_API_KEY !== "undefined" ? RIG_BAKED_LINEAR_API_KEY : "",
+  LINEAR_WEBHOOK_SECRET: typeof RIG_BAKED_LINEAR_WEBHOOK_SECRET !== "undefined" ? RIG_BAKED_LINEAR_WEBHOOK_SECRET : ""
+};
+var RUNTIME_SECRET_KEYS = Object.keys(BAKED_RUNTIME_SECRETS);
+function resolveRuntimeSecrets(env, baked = BAKED_RUNTIME_SECRETS) {
+  return resolveRuntimeConfigValues(env, RUNTIME_SECRET_KEYS, baked);
+}
+function loadDotEnvSecrets(projectRoot, env = process.env) {
+  return loadDotEnvValues(projectRoot, RUNTIME_SECRET_KEYS, env);
+}
+function secretDefinesFromEnv(env = process.env, projectRoot) {
+  const dotenvSecrets = projectRoot ? loadDotEnvSecrets(projectRoot, env) : {};
+  const resolved = resolveRuntimeSecrets(env, {
+    ...BAKED_RUNTIME_SECRETS,
+    ...dotenvSecrets
+  });
+  return {
+    RIG_BAKED_ANTHROPIC_API_KEY: resolved.ANTHROPIC_API_KEY || "",
+    RIG_BAKED_OPENAI_API_KEY: resolved.OPENAI_API_KEY || "",
+    RIG_BAKED_OPENROUTER_API_KEY: resolved.OPENROUTER_API_KEY || "",
+    RIG_BAKED_AI_REVIEW_MODE: resolved.AI_REVIEW_MODE || "",
+    RIG_BAKED_AI_REVIEW_PROVIDER: resolved.AI_REVIEW_PROVIDER || "",
+    RIG_BAKED_GITHUB_TOKEN: resolved.GITHUB_TOKEN || resolved.GH_TOKEN || "",
+    RIG_BAKED_GITHUB_SSH_KEY: resolved.GITHUB_SSH_KEY || "",
+    RIG_BAKED_AWS_ACCESS_KEY_ID: resolved.AWS_ACCESS_KEY_ID || "",
+    RIG_BAKED_AWS_SECRET_ACCESS_KEY: resolved.AWS_SECRET_ACCESS_KEY || "",
+    RIG_BAKED_AWS_REGION: resolved.AWS_REGION || "",
+    RIG_BAKED_LINEAR_API_KEY: resolved.LINEAR_API_KEY || "",
+    RIG_BAKED_LINEAR_WEBHOOK_SECRET: resolved.LINEAR_WEBHOOK_SECRET || ""
+  };
+}
+var runtimeSecretsService = {
+  resolveRuntimeSecrets,
+  loadDotEnvSecrets,
+  secretDefinesFromEnv
+};
+export {
+  secretDefinesFromEnv,
+  runtimeSecretsService,
+  resolveRuntimeSecrets,
+  loadDotEnvSecrets,
+  BAKED_RUNTIME_SECRETS
+};

package/dist/src/service.d.ts

@@ -0,0 +1,14 @@
+/**
+ * service.ts — the concrete agent-harness instruction service the runtime port
+ * resolves and consumes.
+ *
+ * CONFIG-LIGHT: this module top-level-imports the instruction-builder impl. It
+ * is loaded LAZILY by the capability `run()` in plugin.ts
+ * (`(await import("./service")).svc`), so merely evaluating rig.config.ts never
+ * drags the provider impl into scope.
+ */
+import type { RuntimeInstructionService } from "@rig/contracts";
+/** The concrete agent-harness instruction service the runtime port resolves. */
+export declare const svc: RuntimeInstructionService;
+/** Back-compat alias. */
+export declare const runtimeInstructionService: RuntimeInstructionService;

package/dist/src/service.js

@@ -0,0 +1,33 @@
+// @bun
+// packages/harness-plugin/src/runtime-instructions.ts
+function normalizeRuntimeInstructionProvider(_value) {
+  return "pi";
+}
+function buildProviderTaskRunInstructionLines(_provider) {
+  return [
+    "Use Pi's built-in `read`, `write`, `edit`, and `bash` tools from the isolated Rig task worktree.",
+    "Keep file writes inside the scoped task workspace unless Rig explicitly tells you a path is host/project metadata.",
+    "Prefer `read`, `write`, and `edit` over shell one-liners whenever those tools fit.",
+    "When shell access is needed, keep commands narrow and bounded; avoid repo-wide searches without an explicit path and output cap."
+  ];
+}
+function buildProviderRuntimeContextLines(_provider) {
+  return [
+    "Pi runs from the isolated Rig task worktree with its built-in `read`, `write`, `edit`, and `bash` tools enabled.",
+    "Keep writes scoped to the task workspace unless Rig-provided instructions name an explicit metadata path.",
+    "Prefer Pi file tools over shell one-liners for file reads and edits.",
+    "Keep shell commands narrow and bounded; cap broad searches before widening."
+  ];
+}
+
+// packages/harness-plugin/src/service.ts
+var svc = {
+  normalizeProvider: normalizeRuntimeInstructionProvider,
+  buildTaskRunInstructionLines: buildProviderTaskRunInstructionLines,
+  buildRuntimeContextLines: buildProviderRuntimeContextLines
+};
+var runtimeInstructionService = svc;
+export {
+  svc,
+  runtimeInstructionService
+};

package/dist/src/session-asset-materializer-service.d.ts

@@ -0,0 +1,13 @@
+import type { SessionAssetMaterializerService } from "@rig/contracts";
+/**
+ * Provider-owned implementation of the SESSION_ASSET_MATERIALIZER capability.
+ *
+ * This is the logic that previously lived inline in the runtime's
+ * `plugin-host-context`: extract plugin-contributed skills + config-declared Pi
+ * packages from the loaded rig.config and materialize them into the workspace's
+ * `.pi/` directory. It moved here (provider domain) so the plugin-host assembler
+ * in @rig/core can trigger materialization through the capability seam without a
+ * floor->plugin import. Every step is non-fatal — a write failure logs and
+ * continues so it can never deadlock harness boot.
+ */
+export declare const sessionAssetMaterializer: SessionAssetMaterializerService;

package/dist/src/session-asset-materializer-service.js

@@ -0,0 +1,164 @@
+// @bun
+// packages/harness-plugin/src/session-asset-materializer-service.ts
+import { existsSync as existsSync3 } from "fs";
+import { resolve as resolvePath } from "path";
+
+// packages/harness-plugin/src/skill-materializer.ts
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "fs";
+import { resolve } from "path";
+var MARKER_FILENAME = ".rig-plugin";
+var FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;
+function parseFrontmatter(raw) {
+  const m = raw.match(FRONTMATTER_RE);
+  if (!m) {
+    return { meta: {}, body: raw };
+  }
+  const yaml = m[1] ?? "";
+  const body = m[2] ?? "";
+  const meta = {};
+  for (const line of yaml.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#"))
+      continue;
+    const idx = trimmed.indexOf(":");
+    if (idx === -1)
+      continue;
+    const key = trimmed.slice(0, idx).trim();
+    let value = trimmed.slice(idx + 1).trim();
+    if (typeof value === "string") {
+      const s = value;
+      if (s.startsWith('"') && s.endsWith('"') || s.startsWith("'") && s.endsWith("'")) {
+        value = s.slice(1, -1);
+      } else if (s === "true")
+        value = true;
+      else if (s === "false")
+        value = false;
+      else if (/^-?\d+$/.test(s))
+        value = parseInt(s, 10);
+      else if (/^-?\d+\.\d+$/.test(s))
+        value = parseFloat(s);
+    }
+    meta[key] = value;
+  }
+  return { meta, body };
+}
+function assertValidSkillFrontmatter(path, raw) {
+  const { meta } = parseFrontmatter(raw);
+  if (typeof meta.name !== "string") {
+    throw new Error(`SKILL.md missing required field "name": ${path}`);
+  }
+}
+function skillDirName(id) {
+  return id.replace(/[^a-zA-Z0-9._-]+/g, "-");
+}
+async function materializeSkills(projectRoot, entries) {
+  const skillsRoot = resolve(projectRoot, ".pi", "skills");
+  if (existsSync(skillsRoot)) {
+    for (const name of readdirSync(skillsRoot)) {
+      const dir = resolve(skillsRoot, name);
+      if (existsSync(resolve(dir, MARKER_FILENAME))) {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    }
+  }
+  const written = [];
+  for (const { pluginName, skill } of entries) {
+    const sourcePath = resolve(projectRoot, skill.path);
+    if (!existsSync(sourcePath)) {
+      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${sourcePath} does not exist`);
+      continue;
+    }
+    let body;
+    try {
+      body = readFileSync(sourcePath, "utf-8");
+      assertValidSkillFrontmatter(sourcePath, body);
+    } catch (err) {
+      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${err instanceof Error ? err.message : err}`);
+      continue;
+    }
+    const dir = resolve(skillsRoot, skillDirName(skill.id));
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(resolve(dir, "SKILL.md"), body, "utf-8");
+    writeFileSync(resolve(dir, MARKER_FILENAME), `${JSON.stringify({ plugin: pluginName, skillId: skill.id }, null, 2)}
+`, "utf-8");
+    written.push({ id: skill.id, pluginName, directory: dir });
+  }
+  return written;
+}
+
+// packages/harness-plugin/src/pi-settings-materializer.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname, resolve as resolve2 } from "path";
+var SETTINGS_RELATIVE_PATH = ".pi/settings.json";
+var MANAGED_RECORD_RELATIVE_PATH = ".rig/state/pi-managed-packages.json";
+function readJson(path, fallback) {
+  if (!existsSync2(path))
+    return fallback;
+  try {
+    return JSON.parse(readFileSync2(path, "utf-8"));
+  } catch {
+    return fallback;
+  }
+}
+function packageKey(entry) {
+  if (typeof entry === "string")
+    return entry;
+  if (entry && typeof entry === "object" && typeof entry.source === "string") {
+    return entry.source;
+  }
+  return JSON.stringify(entry);
+}
+function materializePiPackages(projectRoot, declaredPackages) {
+  const settingsPath = resolve2(projectRoot, SETTINGS_RELATIVE_PATH);
+  const managedRecordPath = resolve2(projectRoot, MANAGED_RECORD_RELATIVE_PATH);
+  const settings = readJson(settingsPath, {});
+  const previouslyManaged = new Set(readJson(managedRecordPath, []));
+  const existing = Array.isArray(settings.packages) ? settings.packages : [];
+  const operatorEntries = existing.filter((entry) => !previouslyManaged.has(packageKey(entry)));
+  const operatorKeys = new Set(operatorEntries.map(packageKey));
+  const managedToAdd = declaredPackages.filter((pkg) => !operatorKeys.has(pkg));
+  const nextPackages = [...operatorEntries, ...managedToAdd];
+  if (nextPackages.length > 0 || existsSync2(settingsPath)) {
+    const nextSettings = { ...settings };
+    if (nextPackages.length > 0) {
+      nextSettings.packages = nextPackages;
+    } else {
+      delete nextSettings.packages;
+    }
+    mkdirSync2(dirname(settingsPath), { recursive: true });
+    writeFileSync2(settingsPath, `${JSON.stringify(nextSettings, null, 2)}
+`, "utf-8");
+  }
+  mkdirSync2(dirname(managedRecordPath), { recursive: true });
+  writeFileSync2(managedRecordPath, `${JSON.stringify(managedToAdd, null, 2)}
+`, "utf-8");
+  return { settingsPath, packages: managedToAdd };
+}
+
+// packages/harness-plugin/src/session-asset-materializer-service.ts
+var sessionAssetMaterializer = {
+  async materializeSessionAssets(projectRoot, config) {
+    try {
+      const skillEntries = config.plugins.flatMap((plugin) => (plugin.contributes?.skills ?? []).map((skill) => ({
+        pluginName: plugin.name,
+        skill
+      })));
+      if (skillEntries.length > 0) {
+        await materializeSkills(projectRoot, skillEntries);
+      }
+    } catch (err) {
+      console.warn(`[session-assets] skill materialization failed: ${err instanceof Error ? err.message : err}`);
+    }
+    try {
+      const piPackages = config.runtime?.pi?.packages ?? [];
+      if (piPackages.length > 0 || existsSync3(resolvePath(projectRoot, ".rig/state/pi-managed-packages.json"))) {
+        materializePiPackages(projectRoot, piPackages);
+      }
+    } catch (err) {
+      console.warn(`[session-assets] Pi package materialization failed: ${err instanceof Error ? err.message : err}`);
+    }
+  }
+};
+export {
+  sessionAssetMaterializer
+};

package/dist/src/session-hook-materializer-service.d.ts

@@ -0,0 +1,34 @@
+import type { HookEvent, PluginHookEntry, SessionHookMaterializerService } from "@rig/contracts";
+export type SessionHookAdapterResult = {
+    readonly adapterId: "claude-code";
+    readonly status: "materialized";
+    readonly path: string;
+    readonly events: readonly HookEvent[];
+} | {
+    readonly adapterId: "pi";
+    readonly status: "skipped";
+    readonly reason: string;
+};
+export interface AgentSessionHookAdapter {
+    readonly id: "claude-code" | "pi";
+    materialize(projectRoot: string, entries: readonly PluginHookEntry[]): SessionHookAdapterResult;
+}
+export declare function createPiNoopSessionHookAdapter(): AgentSessionHookAdapter;
+export declare function createClaudeCodeSessionHookAdapter(): AgentSessionHookAdapter;
+export type AgentSessionHookAdapterEnv = Record<string, string | undefined>;
+export declare function defaultAgentSessionHookAdapters(env?: AgentSessionHookAdapterEnv): readonly AgentSessionHookAdapter[];
+export declare function materializeSessionHookAdapters(projectRoot: string, entries: readonly PluginHookEntry[], adapters?: readonly AgentSessionHookAdapter[]): readonly SessionHookAdapterResult[];
+/**
+ * Materialize plugin-contributed hooks into `.claude/settings.json` via the
+ * Claude Code session-hook adapter. Kept provider-owned for tests/CLI helpers;
+ * core no longer imports or calls this function.
+ */
+export declare function materializeHooks(projectRoot: string, entries: readonly PluginHookEntry[]): string;
+export type ApplyClaudeCodeSessionHooksOptions = {
+    readonly replacePluginOwned?: boolean;
+};
+export declare function applyClaudeCodeSessionHooksToSettings(existing: Record<string, unknown>, entries: readonly PluginHookEntry[], projectRoot: string, options?: ApplyClaudeCodeSessionHooksOptions): {
+    readonly settings: Record<string, unknown>;
+    readonly events: readonly HookEvent[];
+};
+export declare const sessionHookMaterializer: SessionHookMaterializerService;