@h-rig/harness-plugin 0.0.6-alpha.186

package/dist/src/agent-harness/rig-agent.js

@@ -0,0 +1,1324 @@
+#!/usr/bin/env bun
+// @bun
+
+// packages/harness-plugin/src/agent-harness/rig-agent.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname, resolve as resolve3 } from "path";
+import { readBuildConfig } from "@rig/core/build-time-config";
+
+// packages/harness-plugin/src/agent-harness/controlled-bash.ts
+import { existsSync } from "fs";
+import { resolve } from "path";
+import { resolveRigLayout } from "@rig/core/layout";
+function controlledBashCandidates(projectRoot) {
+  const layout = resolveRigLayout(projectRoot);
+  const candidates = [
+    process.env.RIG_CONTROLLED_BASH_BIN?.trim() || "",
+    resolve(layout.binDir, "controlled-bash"),
+    Bun.which("controlled-bash") || ""
+  ];
+  return candidates.filter((candidate) => Boolean(candidate));
+}
+function resolveControlledBash(projectRoot) {
+  for (const candidate of controlledBashCandidates(projectRoot)) {
+    if (existsSync(candidate))
+      return candidate;
+  }
+  return null;
+}
+async function runControlledBash(args, options) {
+  const projectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || process.env.PROJECT_RIG_ROOT?.trim() || process.env.RIG_TASK_WORKSPACE?.trim() || process.cwd() || options.projectRootFallbackDir;
+  const controlled = resolveControlledBash(projectRoot);
+  if (!controlled) {
+    console.error("[rig-agent] controlled-bash entrypoint unavailable; refusing to run an unguarded shell.");
+    return 126;
+  }
+  const command = [controlled, ...args];
+  const child = Bun.spawn(command, {
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit",
+    cwd: process.cwd(),
+    env: {
+      ...process.env,
+      PROJECT_RIG_ROOT: projectRoot,
+      RIG_BASH_ACTIVE: "1"
+    }
+  });
+  return await child.exited;
+}
+
+// packages/harness-plugin/src/agent-harness/rig-agent.ts
+import { LIFECYCLE_VERIFICATION_SERVICE as LIFECYCLE_VERIFICATION_SERVICE2, MEMORY } from "@rig/contracts";
+import { defineCapability as defineCapability4, defineServiceCapability as defineServiceCapability2 } from "@rig/core/capability";
+import { buildProjectPluginHost, loadCapabilityForRoot as loadCapabilityForRoot2 } from "@rig/core/capability-loaders";
+import { resolveCheckoutRoot as resolveMonorepoRoot } from "@rig/core/checkout-root";
+
+// packages/harness-plugin/src/agent-harness/agent-mode.ts
+function looksLikeShellInvocation(args, mode = process.env.RIG_AGENT_MODE) {
+  if (mode === "shell") {
+    return true;
+  }
+  if (mode === "agent") {
+    return false;
+  }
+  if (args.length === 0) {
+    return false;
+  }
+  const first = args[0];
+  if (!first) {
+    return false;
+  }
+  const bashLikeFlags = new Set([
+    "-c",
+    "-lc",
+    "-l",
+    "-i",
+    "-s",
+    "--login",
+    "--noprofile",
+    "--norc",
+    "--posix",
+    "--rcfile",
+    "--init-file",
+    "--restricted",
+    "--debug",
+    "--debugger",
+    "--verbose",
+    "--wordexp",
+    "--dump-strings",
+    "--dump-po-strings",
+    "--help"
+  ]);
+  if (bashLikeFlags.has(first)) {
+    return true;
+  }
+  if (!first.startsWith("-")) {
+    return first.endsWith(".sh");
+  }
+  return false;
+}
+
+// packages/harness-plugin/src/agent-harness/rig-agent.ts
+import { browserEnvFromContext, loadRuntimeContext, loadRuntimeContextFromEnv } from "@rig/core/runtime-context";
+
+// packages/harness-plugin/src/runtime-secrets.ts
+import { loadDotEnvValues, resolveRuntimeConfigValues } from "@rig/core/baked-secrets";
+var BAKED_RUNTIME_SECRETS = {
+  ANTHROPIC_API_KEY: typeof RIG_BAKED_ANTHROPIC_API_KEY !== "undefined" ? RIG_BAKED_ANTHROPIC_API_KEY : "",
+  OPENAI_API_KEY: typeof RIG_BAKED_OPENAI_API_KEY !== "undefined" ? RIG_BAKED_OPENAI_API_KEY : "",
+  OPENROUTER_API_KEY: typeof RIG_BAKED_OPENROUTER_API_KEY !== "undefined" ? RIG_BAKED_OPENROUTER_API_KEY : "",
+  AI_REVIEW_MODE: typeof RIG_BAKED_AI_REVIEW_MODE !== "undefined" ? RIG_BAKED_AI_REVIEW_MODE : "",
+  AI_REVIEW_PROVIDER: typeof RIG_BAKED_AI_REVIEW_PROVIDER !== "undefined" ? RIG_BAKED_AI_REVIEW_PROVIDER : "",
+  GH_TOKEN: typeof RIG_BAKED_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GITHUB_TOKEN : "",
+  GITHUB_TOKEN: typeof RIG_BAKED_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GITHUB_TOKEN : "",
+  GITHUB_SSH_KEY: typeof RIG_BAKED_GITHUB_SSH_KEY !== "undefined" ? RIG_BAKED_GITHUB_SSH_KEY : "",
+  AWS_ACCESS_KEY_ID: typeof RIG_BAKED_AWS_ACCESS_KEY_ID !== "undefined" ? RIG_BAKED_AWS_ACCESS_KEY_ID : "",
+  AWS_SECRET_ACCESS_KEY: typeof RIG_BAKED_AWS_SECRET_ACCESS_KEY !== "undefined" ? RIG_BAKED_AWS_SECRET_ACCESS_KEY : "",
+  AWS_REGION: typeof RIG_BAKED_AWS_REGION !== "undefined" ? RIG_BAKED_AWS_REGION : "",
+  LINEAR_API_KEY: typeof RIG_BAKED_LINEAR_API_KEY !== "undefined" ? RIG_BAKED_LINEAR_API_KEY : "",
+  LINEAR_WEBHOOK_SECRET: typeof RIG_BAKED_LINEAR_WEBHOOK_SECRET !== "undefined" ? RIG_BAKED_LINEAR_WEBHOOK_SECRET : ""
+};
+var RUNTIME_SECRET_KEYS = Object.keys(BAKED_RUNTIME_SECRETS);
+function resolveRuntimeSecrets(env, baked = BAKED_RUNTIME_SECRETS) {
+  return resolveRuntimeConfigValues(env, RUNTIME_SECRET_KEYS, baked);
+}
+function loadDotEnvSecrets(projectRoot, env = process.env) {
+  return loadDotEnvValues(projectRoot, RUNTIME_SECRET_KEYS, env);
+}
+
+// packages/harness-plugin/src/agent-harness/rig-agent.ts
+import { RuntimeEventBus } from "@rig/core/runtime-events";
+
+// packages/harness-plugin/src/agent-harness/git-ops.ts
+import { LIFECYCLE_GIT_AGENT } from "@rig/contracts";
+import { defineCapability } from "@rig/core/capability";
+import { buildPluginHostContext } from "@rig/core/plugin-host-context";
+import { loadCapabilityForRoot } from "@rig/core/capability-loaders";
+var LifecycleGitAgentCap = defineCapability(LIFECYCLE_GIT_AGENT);
+var hostContextByRoot = new Map;
+async function ensureHostContext(projectRoot) {
+  let cached = hostContextByRoot.get(projectRoot);
+  if (!cached) {
+    cached = buildPluginHostContext(projectRoot);
+    hostContextByRoot.set(projectRoot, cached);
+  }
+  await cached;
+}
+async function loadLifecycleGit(projectRoot) {
+  await ensureHostContext(projectRoot);
+  const git = await loadCapabilityForRoot(projectRoot, LifecycleGitAgentCap);
+  if (!git) {
+    throw new Error("lifecycle git capability unavailable: load @rig/lifecycle-plugin (default bundle) before running rig-agent git commands.");
+  }
+  return git;
+}
+
+// packages/harness-plugin/src/profile-state.ts
+import { existsSync as existsSync2, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { resolve as resolve2 } from "path";
+import { resolveHarnessPaths } from "@rig/core/harness-paths";
+function harnessStateJsonPath(projectRoot, filename) {
+  return resolve2(resolveHarnessPaths(projectRoot).stateDir, filename);
+}
+function readHarnessStateJson(projectRoot, filename) {
+  const path = harnessStateJsonPath(projectRoot, filename);
+  if (!existsSync2(path)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf-8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function writeHarnessStateJson(projectRoot, filename, value) {
+  const paths = resolveHarnessPaths(projectRoot);
+  mkdirSync(paths.stateDir, { recursive: true });
+  const path = resolve2(paths.stateDir, filename);
+  writeFileSync(path, `${JSON.stringify(value, null, 2)}
+`, "utf-8");
+  return path;
+}
+
+// packages/harness-plugin/src/agent-harness/repo-ops.ts
+import {
+  REPO_OPERATIONS_CAPABILITY
+} from "@rig/contracts";
+import { defineCapability as defineCapability2 } from "@rig/core/capability";
+import { requireInstalledCapability } from "@rig/core/capability-loaders";
+var RepoOperationsCap = defineCapability2(REPO_OPERATIONS_CAPABILITY);
+function repoOperations() {
+  return requireInstalledCapability(RepoOperationsCap, "repo operations capability unavailable: load @rig/repos-plugin before using provider harness repo operations.");
+}
+function repoEnsure(projectRoot, taskId) {
+  repoOperations().repoEnsure(projectRoot, taskId);
+}
+function repoPins(projectRoot, taskId) {
+  return repoOperations().repoPins(projectRoot, taskId);
+}
+function repoVerify(projectRoot, taskId) {
+  return repoOperations().repoVerify(projectRoot, taskId);
+}
+function repoDiscover(projectRoot, taskId) {
+  return repoOperations().repoDiscover(projectRoot, taskId);
+}
+function repoBaseline(projectRoot, refresh = false) {
+  return repoOperations().repoBaseline(projectRoot, refresh);
+}
+
+// packages/harness-plugin/src/agent-harness/task-ops.ts
+import { LIFECYCLE_VERIFICATION_SERVICE } from "@rig/contracts";
+import { defineServiceCapability } from "@rig/core/capability";
+import { buildPluginHostContext as buildPluginHostContext2 } from "@rig/core/plugin-host-context";
+
+// packages/harness-plugin/src/agent-harness/task-data.ts
+import { basename } from "path";
+import {
+  REPO_CHANGE_SET,
+  TASK_ARTIFACTS,
+  TASK_STATE_STORE,
+  TASK_SOURCE_CONFIG_PROJECTION
+} from "@rig/contracts";
+import { defineCapability as defineCapability3 } from "@rig/core/capability";
+import { requireInstalledCapability as requireInstalledCapability2 } from "@rig/core/capability-loaders";
+var RepoChangeSetCap = defineCapability3(REPO_CHANGE_SET);
+var TaskArtifactsCap = defineCapability3(TASK_ARTIFACTS);
+var TaskStateStoreCap = defineCapability3(TASK_STATE_STORE);
+var TaskSourceConfigProjectionCap = defineCapability3(TASK_SOURCE_CONFIG_PROJECTION);
+function stateStore() {
+  return requireInstalledCapability2(TaskStateStoreCap, "task state store capability unavailable: load @rig/tasks-plugin (default bundle) before running the provider agent harness.");
+}
+function artifacts() {
+  return requireInstalledCapability2(TaskArtifactsCap, "task artifacts capability unavailable: load @rig/tasks-plugin (default bundle) before running the provider agent harness.");
+}
+function taskSourceConfigProjection() {
+  return requireInstalledCapability2(TaskSourceConfigProjectionCap, "task source config projection capability unavailable: load @rig/tasks-plugin (default bundle) before reading validation descriptions.");
+}
+function repoChangeSet() {
+  return requireInstalledCapability2(RepoChangeSetCap, "repo change-set capability unavailable: load @rig/repos-plugin (default bundle) before reading task file changes.");
+}
+function currentTaskId(projectRoot) {
+  return stateStore().readCurrentTaskId(projectRoot) ?? "";
+}
+function readTaskConfig(projectRoot) {
+  return stateStore().readTaskConfig(projectRoot);
+}
+function readSourceTaskConfig(projectRoot) {
+  return stateStore().readSourceTaskConfig(projectRoot);
+}
+function readValidationDescriptions(projectRoot) {
+  return taskSourceConfigProjection().readSourceValidationDescriptions(projectRoot);
+}
+function lookupTask(_projectRoot, input) {
+  return input;
+}
+function artifactDirForId(projectRoot, id) {
+  return artifacts().artifactDir({ projectRoot, taskId: id });
+}
+function readStringList(candidate) {
+  return Array.isArray(candidate) ? candidate.filter((entry) => typeof entry === "string") : [];
+}
+function firstStringList(...candidates) {
+  for (const candidate of candidates) {
+    const values = readStringList(candidate);
+    if (values.length > 0)
+      return values;
+  }
+  return [];
+}
+function unique(values) {
+  return Array.from(new Set(values));
+}
+function readTaskEntry(projectRoot, taskId) {
+  try {
+    return readTaskConfig(projectRoot)[taskId] ?? readSourceTaskConfig(projectRoot)[taskId] ?? null;
+  } catch {
+    return null;
+  }
+}
+function taskDependencyIds(projectRoot, taskId) {
+  const entry = readTaskEntry(projectRoot, taskId);
+  if (!entry)
+    return [];
+  const record = entry;
+  return unique(firstStringList(record.deps, record.dependencies, record.validation_deps, record.validationDeps)).filter((id) => id !== taskId);
+}
+function taskScopePatterns(projectRoot, taskId) {
+  const entry = readTaskEntry(projectRoot, taskId);
+  return entry ? readStringList(entry.scope) : [];
+}
+function syncRepoChangeSetPaths(result, operation) {
+  if (result && typeof result.then === "function") {
+    throw new Error(`repo change-set ${operation} returned a Promise; lifecycle task adapter requires a synchronous provider.`);
+  }
+  return unique(result.map((entry) => entry.path).filter(Boolean));
+}
+function changedFilesForTask(projectRoot, taskId, scoped) {
+  return syncRepoChangeSetPaths(repoChangeSet().changedFiles({ projectRoot, selector: { kind: "task", taskId, scoped } }), "changedFiles");
+}
+function pendingFilesForTask(projectRoot, taskId, scoped) {
+  return syncRepoChangeSetPaths(repoChangeSet().pendingFiles({ projectRoot, selector: { kind: "task", taskId, scoped } }), "pendingFiles");
+}
+function taskLookup(projectRoot, id) {
+  const result = lookupTask(projectRoot, id);
+  if (!result)
+    throw new Error(`Not found: ${id}`);
+  return result;
+}
+function taskConfigEntryToRecord(id, entry, source) {
+  const record = entry;
+  const deps = firstStringList(record.deps, record.dependencies, record.validation_deps, record.validationDeps);
+  return {
+    id,
+    deps,
+    status: typeof entry.status === "string" ? entry.status : "open",
+    source,
+    ...typeof entry.title === "string" ? { title: entry.title } : {},
+    ...typeof entry.description === "string" ? { description: entry.description } : {},
+    ...typeof entry.acceptance_criteria === "string" ? { acceptanceCriteria: entry.acceptance_criteria } : {},
+    ...Array.isArray(entry.scope) ? { scope: entry.scope } : {},
+    ...Array.isArray(entry.validation) ? { validation: entry.validation } : {},
+    ...typeof entry.role === "string" ? { role: entry.role } : {},
+    ...entry.browser ? { browser: entry.browser } : {},
+    ...entry.repo_pins ? { repo_pins: entry.repo_pins } : {},
+    ...entry.criticality ? { criticality: entry.criticality } : {},
+    ...typeof entry.queue_weight === "number" ? { queue_weight: entry.queue_weight } : {},
+    ...entry.creates_repo !== undefined ? { creates_repo: entry.creates_repo } : {},
+    ...entry.auto_synced !== undefined ? { auto_synced: entry.auto_synced } : {}
+  };
+}
+async function taskInfo(projectRoot, taskId, deprecatedRuntimeProviderOverride) {
+  const activeTask = taskId || currentTaskId(projectRoot);
+  if (!activeTask)
+    throw new Error("No active task.");
+  const entry = readTaskEntry(projectRoot, activeTask);
+  if (!entry)
+    throw new Error(`Not found: ${activeTask}`);
+  process.stdout.write(`${JSON.stringify(taskConfigEntryToRecord(activeTask, entry, "task-config"), null, 2)}
+`);
+}
+async function taskDeps(projectRoot, taskId) {
+  const activeTask = taskId || currentTaskId(projectRoot);
+  if (!activeTask)
+    throw new Error("No active task.");
+  const deps = taskDependencyIds(projectRoot, activeTask);
+  if (deps.length > 0)
+    process.stdout.write(`${deps.join(`
+`)}
+`);
+}
+function taskStatus(projectRoot) {
+  let tasks = [];
+  try {
+    tasks = Object.entries(readSourceTaskConfig(projectRoot)).map(([id, entry]) => taskConfigEntryToRecord(id, entry, "source-task-config"));
+  } catch {
+    tasks = Object.entries(readTaskConfig(projectRoot)).map(([id, entry]) => taskConfigEntryToRecord(id, entry, "legacy-task-config"));
+  }
+  const counts = tasks.reduce((acc, task) => {
+    const key = typeof task.status === "string" && task.status.length > 0 ? task.status : "open";
+    acc[key] = (acc[key] ?? 0) + 1;
+    return acc;
+  }, {});
+  console.log(`=== Project Rig Progress ===
+`);
+  console.log(`Total tasks: ${tasks.length}`);
+  for (const status of Object.keys(counts).sort())
+    console.log(`  ${status}: ${counts[status]}`);
+}
+async function taskScope(projectRoot, expandFiles, taskId) {
+  const activeTask = taskId || currentTaskId(projectRoot);
+  if (!activeTask)
+    throw new Error("No active task.");
+  const scopes = taskScopePatterns(projectRoot, activeTask);
+  if (scopes.length > 0)
+    process.stdout.write(`${scopes.join(`
+`)}
+`);
+}
+async function taskRecord(projectRoot, type, text, taskId) {
+  const activeTask = taskId || currentTaskId(projectRoot);
+  if (!activeTask)
+    throw new Error("No active task.");
+  const timestamp = new Date().toISOString();
+  if (type === "decision") {
+    const artifactService = artifacts();
+    const filename = "decision-log.md";
+    const existingNames = await artifactNames(artifactService, { projectRoot, taskId: activeTask });
+    const existing = existingNames.has(filename) ? (await artifactService.readArtifact({
+      projectRoot,
+      taskId: activeTask,
+      filename,
+      maxBytes: Number.MAX_SAFE_INTEGER
+    })).contents : "";
+    const result2 = await artifactService.writeArtifact({
+      projectRoot,
+      taskId: activeTask,
+      filename,
+      content: `${existing}
+### ${timestamp}
+
+${text}
+
+`
+    });
+    console.log(`Decision recorded for ${activeTask}.`);
+    return;
+  }
+  const result = stateStore().recordFailedApproach({ projectRoot, taskId: activeTask, text, timestamp });
+  console.log(result.message);
+}
+function taskArtifactDir(projectRoot, taskId) {
+  return artifacts().artifactDir({ projectRoot, ...taskId !== undefined ? { taskId } : {} });
+}
+async function taskArtifactWrite(projectRoot, filename, content, taskId) {
+  const result = await artifacts().writeArtifact({
+    projectRoot,
+    filename,
+    content,
+    ...taskId !== undefined ? { taskId } : {}
+  });
+  console.log(`Wrote: ${result.path}`);
+}
+async function taskArtifactRead(projectRoot, filename, options = {}) {
+  return artifacts().readArtifact({
+    projectRoot,
+    filename,
+    ...options.taskId !== undefined ? { taskId: options.taskId } : {},
+    ...options.maxBytes !== undefined ? { maxBytes: options.maxBytes } : {}
+  });
+}
+async function taskArtifacts(projectRoot, taskId) {
+  const activeTask = taskId || currentTaskId(projectRoot);
+  if (!activeTask)
+    throw new Error("No active task.");
+  const artifactService = artifacts();
+  const ref = { projectRoot, taskId: activeTask };
+  const artifactDir = artifactService.artifactDir(ref);
+  await artifactService.writeArtifact({
+    ...ref,
+    filename: "changed-files.txt",
+    content: `${changedFilesForTask(projectRoot, activeTask, true).join(`
+`)}
+`
+  });
+  const existingNames = await artifactNames(artifactService, ref);
+  if (!existingNames.has("task-result.json")) {
+    await artifactService.writeArtifact({
+      ...ref,
+      filename: "task-result.json",
+      content: `${JSON.stringify({ task_id: activeTask, status: "completed", summary: "TODO: Write a one-line summary of what you did", completed_at: new Date().toISOString() }, null, 2)}
+`
+    });
+  }
+  for (const [filename, content] of [
+    ["decision-log.md", `# Decision Log: ${activeTask}
+
+Record key decisions here using: rig-agent record decision "..."
+`],
+    ["next-actions.md", `# Next Actions: ${activeTask}
+
+- TODO: Replace this scaffold with real content before completion
+`]
+  ]) {
+    if (!existingNames.has(filename)) {
+      await artifactService.writeArtifact({ ...ref, filename, content });
+    }
+  }
+  console.log(`Artifacts at: ${artifactDir}/`);
+}
+async function artifactNames(artifactService, ref) {
+  const entries = await artifactService.listArtifacts(ref);
+  return new Set(entries.filter((entry) => entry.kind === "file").map((entry) => basename(entry.path)));
+}
+function taskData() {
+  return {
+    currentTaskId,
+    readTaskConfig,
+    readSourceTaskConfig,
+    readValidationDescriptions,
+    lookupTask,
+    taskLookup,
+    artifactDirForId,
+    taskInfo,
+    taskDeps,
+    taskStatus,
+    taskScope,
+    taskRecord,
+    taskArtifacts,
+    taskArtifactDir,
+    taskArtifactWrite,
+    taskArtifactRead,
+    taskDependencyIds,
+    changedFilesForTask,
+    pendingFilesForTask
+  };
+}
+
+// packages/harness-plugin/src/agent-harness/task-ops.ts
+var LifecycleVerificationServiceCap = defineServiceCapability(LIFECYCLE_VERIFICATION_SERVICE);
+var hostContextByRoot2 = new Map;
+async function ensureHostContext2(projectRoot) {
+  let cached = hostContextByRoot2.get(projectRoot);
+  if (!cached) {
+    cached = buildPluginHostContext2(projectRoot);
+    hostContextByRoot2.set(projectRoot, cached);
+  }
+  return cached;
+}
+function taskArtifactDir2(projectRoot, taskId) {
+  return taskData().taskArtifactDir(projectRoot, taskId);
+}
+function taskArtifacts2(projectRoot, taskId) {
+  return taskData().taskArtifacts(projectRoot, taskId);
+}
+function taskArtifactWrite2(projectRoot, filename, content, taskId) {
+  return taskData().taskArtifactWrite(projectRoot, filename, content, taskId);
+}
+function taskDeps2(projectRoot, taskId) {
+  return taskData().taskDeps(projectRoot, taskId);
+}
+function taskInfo2(projectRoot, taskId) {
+  return taskData().taskInfo(projectRoot, taskId);
+}
+function taskLookup2(projectRoot, id) {
+  return taskData().taskLookup(projectRoot, id);
+}
+function taskRecord2(projectRoot, type, text, taskId) {
+  return taskData().taskRecord(projectRoot, type, text, taskId);
+}
+function taskScope2(projectRoot, expandFiles, taskId) {
+  return taskData().taskScope(projectRoot, expandFiles, taskId);
+}
+function taskStatus2(projectRoot) {
+  taskData().taskStatus(projectRoot);
+}
+async function taskValidate(projectRoot, taskId, validatorRegistry) {
+  const hostCtx = await ensureHostContext2(projectRoot);
+  const verification = hostCtx ? await LifecycleVerificationServiceCap.resolveService(hostCtx.pluginHost) : null;
+  const validate = verification ? verification.validate : null;
+  if (!validate) {
+    throw new Error("task validation capability unavailable: load @rig/lifecycle-plugin (default bundle) before running rig-agent validate.");
+  }
+  return validate({
+    projectRoot,
+    ...taskId !== undefined ? { taskId } : {},
+    ...validatorRegistry !== undefined ? { validatorRegistry } : hostCtx?.validatorRegistry !== undefined ? { validatorRegistry: hostCtx.validatorRegistry } : {}
+  });
+}
+
+// packages/harness-plugin/src/agent-harness/rig-agent.ts
+var BUILD_CONFIG = readBuildConfig();
+var BAKED_BINARY_PATH = BUILD_CONFIG.AGENT_BINARY_PATH ?? "";
+var BAKED_MANIFEST_PATH = BUILD_CONFIG.AGENT_MANIFEST_PATH ?? "";
+var BAKED_PROJECT_ROOT = BUILD_CONFIG.AGENT_PROJECT_ROOT ?? "";
+var BAKED_RUNTIME_ID = BUILD_CONFIG.AGENT_RUNTIME_ID ?? "";
+var BAKED_TASK_ID = BUILD_CONFIG.AGENT_TASK_ID ?? "";
+var BAKED_SCOPE_HASH = BUILD_CONFIG.AGENT_SCOPE_HASH ?? "";
+var BAKED_INFO_OUTPUT = BUILD_CONFIG.AGENT_INFO_OUTPUT ?? "";
+var BAKED_DEPS_OUTPUT = BUILD_CONFIG.AGENT_DEPS_OUTPUT ?? "";
+var BAKED_STATUS_OUTPUT = BUILD_CONFIG.AGENT_STATUS_OUTPUT ?? "";
+var BAKED_GIT_BRANCH = BUILD_CONFIG.AGENT_GIT_BRANCH ?? "";
+var BAKED_BASE_COMMIT = BUILD_CONFIG.AGENT_BASE_COMMIT ?? "";
+if (BAKED_BINARY_PATH) {
+  const binaryDir = dirname(BAKED_BINARY_PATH);
+  const currentPath = process.env.PATH || "";
+  const pathEntries = currentPath.split(":").filter(Boolean);
+  if (!pathEntries.includes(binaryDir)) {
+    process.env.PATH = currentPath ? `${binaryDir}:${currentPath}` : binaryDir;
+  }
+}
+var cachedContext;
+var cachedEventBus;
+function getContext() {
+  if (cachedContext !== undefined)
+    return cachedContext;
+  cachedContext = loadRuntimeContextFromEnv() ?? inferRuntimeContext();
+  return cachedContext;
+}
+function getEventBus() {
+  if (cachedEventBus !== undefined) {
+    return cachedEventBus ?? undefined;
+  }
+  const ctx = getContext();
+  if (!ctx) {
+    cachedEventBus = null;
+    return;
+  }
+  const runId = ctx.runtimeId || BAKED_RUNTIME_ID || "";
+  cachedEventBus = new RuntimeEventBus({
+    projectRoot: ctx.workspaceDir,
+    ...runId ? { runId } : {}
+  });
+  return cachedEventBus;
+}
+function inferRuntimeContext() {
+  for (const candidate of runtimeContextCandidates()) {
+    if (!candidate || !existsSync3(candidate)) {
+      continue;
+    }
+    try {
+      process.env.RIG_RUNTIME_CONTEXT_FILE = candidate;
+      return loadRuntimeContext(candidate);
+    } catch {}
+  }
+  return null;
+}
+function runtimeContextCandidates() {
+  const cwd = process.cwd();
+  const candidates = [
+    resolve3(cwd, "..", "runtime-context.json"),
+    resolve3(cwd, ".rig", "runtime-context.json")
+  ];
+  const argv1 = process.argv[1]?.trim();
+  if (argv1) {
+    candidates.push(resolve3(argv1, "..", "..", "runtime-context.json"));
+  }
+  if (BAKED_BINARY_PATH) {
+    candidates.push(resolve3(BAKED_BINARY_PATH, "..", "..", "runtime-context.json"));
+  }
+  return Array.from(new Set(candidates));
+}
+function sha256Hex(input) {
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(input);
+  return hasher.digest("hex");
+}
+var GITHUB_KNOWN_HOSTS = [
+  "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl",
+  "github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=",
+  "github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk="
+];
+function ensureRuntimeKnownHosts(runtimeHome) {
+  const sshDir = resolve3(runtimeHome, ".ssh");
+  const knownHostsPath = resolve3(sshDir, "known_hosts");
+  if (!existsSync3(sshDir)) {
+    mkdirSync2(sshDir, { recursive: true });
+  }
+  const existing = existsSync3(knownHostsPath) ? readFileSync2(knownHostsPath, "utf-8") : "";
+  const existingLines = new Set(existing.split(/\r?\n/).map((line) => line.trim()).filter(Boolean));
+  const missing = GITHUB_KNOWN_HOSTS.filter((line) => !existingLines.has(line));
+  if (missing.length === 0) {
+    return knownHostsPath;
+  }
+  try {
+    for (const line of missing) {
+      existingLines.add(line);
+    }
+    writeFileSync2(knownHostsPath, `${Array.from(existingLines).join(`
+`)}
+`, { mode: 420 });
+  } catch (err) {
+    const hint = existsSync3(knownHostsPath) ? "" : " \u2014 known_hosts is missing; git SSH operations may fail";
+    console.warn(`[rig-agent] Could not update ${knownHostsPath}: ${err instanceof Error ? err.message : String(err)}${hint}`);
+  }
+  return knownHostsPath;
+}
+function hydrateRuntimeProcessEnv(ctx) {
+  if (!ctx) {
+    return;
+  }
+  const contextFile = process.env.RIG_RUNTIME_CONTEXT_FILE?.trim() || inferRuntimeContextFileFromWorkspace(ctx.workspaceDir);
+  if (!contextFile) {
+    return;
+  }
+  process.env.RIG_RUNTIME_CONTEXT_FILE = contextFile;
+  const runtimeRoot = dirname(resolve3(contextFile));
+  const runtimeHome = resolve3(runtimeRoot, "home");
+  const runtimeTmp = resolve3(runtimeRoot, "tmp");
+  const runtimeCache = resolve3(runtimeRoot, "cache");
+  const runtimeBin = resolve3(runtimeRoot, "bin");
+  const runtimeWorkspaceBin = resolve3(ctx.workspaceDir, ".rig", "bin");
+  const runtimeTools = resolve3(ctx.workspaceDir, "rig", "tools");
+  if (ctx.hostProjectRoot) {
+    process.env.PROJECT_RIG_ROOT = ctx.hostProjectRoot;
+  }
+  process.env.RIG_TASK_ID = ctx.taskId;
+  process.env.RIG_TASK_WORKSPACE = ctx.workspaceDir;
+  process.env.RIG_STATE_DIR = ctx.stateDir;
+  process.env.RIG_LOGS_DIR = ctx.logsDir;
+  process.env.RIG_SESSION_FILE = ctx.sessionFile;
+  process.env.RIG_RUNTIME_HOME = runtimeRoot;
+  if (!process.env.RIG_HOST_PROJECT_ROOT && ctx.hostProjectRoot) {
+    process.env.RIG_HOST_PROJECT_ROOT = ctx.hostProjectRoot;
+  }
+  for (const [key, value] of Object.entries(browserEnvFromContext(ctx.browser))) {
+    process.env[key] = value;
+  }
+  if (existsSync3(runtimeHome)) {
+    process.env.HOME = runtimeHome;
+  }
+  if (existsSync3(runtimeTmp)) {
+    process.env.TMPDIR = runtimeTmp;
+  }
+  if (existsSync3(runtimeCache)) {
+    process.env.XDG_CACHE_HOME = runtimeCache;
+  }
+  const workspaceSecrets = loadDotEnvSecrets(ctx.workspaceDir, process.env);
+  const hostWorkspaceSecrets = ctx.hostProjectRoot && ctx.hostProjectRoot !== ctx.workspaceDir ? loadDotEnvSecrets(ctx.hostProjectRoot, process.env) : {};
+  const resolvedSecrets = resolveRuntimeSecrets(process.env, {
+    ...hostWorkspaceSecrets,
+    ...workspaceSecrets
+  });
+  for (const [key, value] of Object.entries(resolvedSecrets)) {
+    if (value && !process.env[key]) {
+      process.env[key] = value;
+    }
+  }
+  if (!process.env.GITHUB_TOKEN && process.env.GH_TOKEN) {
+    process.env.GITHUB_TOKEN = process.env.GH_TOKEN;
+  }
+  if (!process.env.GH_TOKEN && process.env.GITHUB_TOKEN) {
+    process.env.GH_TOKEN = process.env.GITHUB_TOKEN;
+  }
+  const currentPath = process.env.PATH || "";
+  const pathEntries = currentPath.split(":").filter(Boolean);
+  for (const entry of [runtimeBin, runtimeWorkspaceBin, runtimeTools, "/usr/bin", "/bin", "/usr/sbin", "/sbin"]) {
+    if (existsSync3(entry) && !pathEntries.includes(entry)) {
+      pathEntries.unshift(entry);
+    }
+  }
+  process.env.PATH = pathEntries.join(":");
+  if (!process.env.RIG_GIT_BIN) {
+    const runtimeGit = resolve3(runtimeBin, "git");
+    process.env.RIG_GIT_BIN = existsSync3(runtimeGit) ? runtimeGit : Bun.which("git") || "/usr/bin/git";
+  }
+  const knownHosts = ensureRuntimeKnownHosts(runtimeHome);
+  const agentKey = resolve3(runtimeHome, ".ssh", "rig-agent-key");
+  const sshParts = [
+    "ssh",
+    `-o UserKnownHostsFile="${knownHosts}"`,
+    "-o StrictHostKeyChecking=yes",
+    "-F /dev/null"
+  ];
+  if (existsSync3(agentKey)) {
+    sshParts.splice(1, 0, `-i "${agentKey}"`, "-o IdentitiesOnly=yes");
+  }
+  process.env.GIT_SSH_COMMAND = sshParts.join(" ");
+}
+function inferRuntimeContextFileFromWorkspace(workspaceDir) {
+  const candidate = resolve3(workspaceDir, "..", "runtime-context.json");
+  return existsSync3(candidate) ? candidate : "";
+}
+var AGENT_PROFILE_FILE = "agent-profile.json";
+var REVIEW_PROFILE_FILE = "review-profile.json";
+var DEFAULT_AGENT_PROFILE = { model: "pi", runtime: "pi", agent_plugin: "pi" };
+var DEFAULT_REVIEW_MODE = parseEnvOrDefault(process.env.AI_REVIEW_MODE, ["off", "advisory", "required"], "advisory");
+var DEFAULT_REVIEW_PROVIDER = parseEnvOrDefault(process.env.AI_REVIEW_PROVIDER, ["github"], "github");
+function parseEnvOrDefault(value, allowed, fallback) {
+  if (!value) {
+    return fallback;
+  }
+  return allowed.includes(value) ? value : fallback;
+}
+function loadProfile(projectRoot) {
+  const parsed = readHarnessStateJson(projectRoot, AGENT_PROFILE_FILE);
+  return {
+    ...DEFAULT_AGENT_PROFILE,
+    updated_at: typeof parsed?.updated_at === "string" ? parsed.updated_at : new Date().toISOString()
+  };
+}
+function showProfile(projectRoot, compact = false) {
+  const profile = loadProfile(projectRoot);
+  if (compact) {
+    console.log(`model=${profile.model} runtime=${profile.runtime} plugin=${profile.agent_plugin}`);
+    return;
+  }
+  console.log("Execution Profile:");
+  console.log(`  model:        ${profile.model}`);
+  console.log(`  runtime:      ${profile.runtime}`);
+  console.log(`  plugin:       ${profile.agent_plugin}`);
+}
+function setProfile(projectRoot, options) {
+  const invalid = [options.model, options.runtime, options.plugin, options.preset].filter((value) => typeof value === "string" && value.trim().length > 0 && value.trim() !== "pi");
+  if (invalid.length > 0) {
+    throw new Error("Only the Pi runtime profile is supported by this Rig substrate.");
+  }
+  writeHarnessStateJson(projectRoot, AGENT_PROFILE_FILE, {
+    ...DEFAULT_AGENT_PROFILE,
+    updated_at: new Date().toISOString()
+  });
+  showProfile(projectRoot, false);
+}
+function loadReviewProfile(projectRoot) {
+  const parsed = readHarnessStateJson(projectRoot, REVIEW_PROFILE_FILE);
+  const mode = parsed?.mode;
+  const provider = parsed?.provider;
+  return {
+    mode: mode === "off" || mode === "advisory" || mode === "required" ? mode : DEFAULT_REVIEW_MODE,
+    provider: provider === "github" ? provider : DEFAULT_REVIEW_PROVIDER,
+    updated_at: typeof parsed?.updated_at === "string" ? parsed.updated_at : new Date().toISOString()
+  };
+}
+function showReviewProfile(projectRoot) {
+  const profile = loadReviewProfile(projectRoot);
+  console.log("AI Review Profile:");
+  console.log(`  mode:      ${profile.mode}`);
+  console.log(`  provider:  ${profile.provider}`);
+  console.log(`  file:      ${harnessStateJsonPath(projectRoot, REVIEW_PROFILE_FILE)}`);
+}
+function setReviewProfile(projectRoot, mode, provider) {
+  if (mode !== "off" && mode !== "advisory" && mode !== "required") {
+    throw new Error(`Invalid mode: ${mode}. Use off|advisory|required.`);
+  }
+  const resolvedProvider = provider || DEFAULT_REVIEW_PROVIDER;
+  if (resolvedProvider !== "github") {
+    throw new Error(`Invalid provider: ${resolvedProvider}. Supported: github.`);
+  }
+  writeHarnessStateJson(projectRoot, REVIEW_PROFILE_FILE, {
+    mode,
+    provider: resolvedProvider,
+    updated_at: new Date().toISOString()
+  });
+  showReviewProfile(projectRoot);
+}
+async function main() {
+  const args = process.argv.slice(2);
+  hydrateRuntimeProcessEnv(getContext());
+  if (isVersionProbe(args)) {
+    await printVersion();
+    return;
+  }
+  if (args[0] === "internal") {
+    await runInternal(args.slice(1));
+    return;
+  }
+  const ctx = getContext();
+  if (!BAKED_PROJECT_ROOT && !ctx) {
+    console.error("[rig-agent] Runtime binary is missing baked task context and no runtime context file found.");
+    console.error("[rig-agent] Set RIG_RUNTIME_CONTEXT_FILE or use the compiled host dispatch binary.");
+    process.exit(1);
+  }
+  await verifyRuntimeManifest();
+  const commandResult = await runAgentCommand(args);
+  if (commandResult !== undefined) {
+    process.exit(commandResult);
+  }
+  if (looksLikeShellInvocation(args)) {
+    const code = await runControlledBash(args, { projectRootFallbackDir: import.meta.dir });
+    process.exit(code);
+  }
+  console.error(`[rig-agent] Unknown command: ${args[0] || "(none)"}. Run 'rig-agent help' for usage.`);
+  process.exit(1);
+}
+function isVersionProbe(args) {
+  if (args.length !== 1) {
+    return false;
+  }
+  return args[0] === "--version" || args[0] === "-v" || args[0] === "version";
+}
+async function printVersion() {
+  const probe = await Bun.$`claude --version`.cwd(process.cwd()).env(process.env).quiet().nothrow();
+  if (probe.exitCode === 0) {
+    const output = probe.stdout.toString().trim();
+    if (output) {
+      console.log(output);
+      return;
+    }
+  }
+  console.log("rig-agent 1.0.0");
+}
+var TASK_COMMANDS = new Set([
+  "info",
+  "scope",
+  "deps",
+  "status",
+  "artifacts",
+  "artifact-dir",
+  "artifact-write",
+  "project-root",
+  "monorepo-root",
+  "validate",
+  "lookup",
+  "record",
+  "help",
+  "completion-verification",
+  "completition-verification",
+  "git",
+  "repo",
+  "repo-sync",
+  "profile",
+  "review",
+  "memory"
+]);
+async function runAgentCommand(args) {
+  const [command, ...rest] = args;
+  if (!command || !TASK_COMMANDS.has(command)) {
+    return;
+  }
+  const ctx = getContext();
+  const projectRoot = ctx?.workspaceDir || BAKED_PROJECT_ROOT || "";
+  const taskId = ctx?.taskId || BAKED_TASK_ID || "";
+  if (!projectRoot) {
+    console.error("[rig-agent] No project root baked in.");
+    return 1;
+  }
+  if (!taskId) {
+    console.error("[rig-agent] No task ID baked in.");
+    return 1;
+  }
+  try {
+    switch (command) {
+      case "info":
+        await taskInfo2(projectRoot, taskId);
+        return 0;
+      case "scope":
+        await taskScope2(projectRoot, rest.includes("--files"), taskId);
+        return 0;
+      case "deps":
+        await taskDeps2(projectRoot, taskId);
+        return 0;
+      case "status":
+        taskStatus2(projectRoot);
+        return 0;
+      case "artifacts":
+        await taskArtifacts2(projectRoot, taskId);
+        return 0;
+      case "artifact-dir":
+        console.log(taskArtifactDir2(projectRoot, taskId));
+        return 0;
+      case "project-root":
+        console.log(projectRoot);
+        return 0;
+      case "monorepo-root":
+        console.log(resolveMonorepoRoot(projectRoot));
+        return 0;
+      case "artifact-write": {
+        const filename = rest[0];
+        if (!filename) {
+          console.error(`Usage: rig-agent artifact-write <filename> [--file <path>]
+` + `  Reads content from stdin (or --file), writes to the active task artifact dir.
+` + "  Example: echo '...' | rig-agent artifact-write collection-audit.md");
+          return 1;
+        }
+        let content;
+        const fileIdx = rest.indexOf("--file");
+        const inputFile = fileIdx !== -1 ? rest[fileIdx + 1] : undefined;
+        if (inputFile) {
+          content = readFileSync2(resolve3(projectRoot, inputFile), "utf-8");
+        } else {
+          const chunks = [];
+          for await (const chunk of process.stdin) {
+            chunks.push(Buffer.from(chunk));
+          }
+          content = Buffer.concat(chunks).toString("utf-8");
+        }
+        await taskArtifactWrite2(projectRoot, filename, content, taskId);
+        return 0;
+      }
+      case "validate": {
+        const passed = await taskValidate(projectRoot, taskId);
+        return passed ? 0 : 1;
+      }
+      case "completion-verification":
+      case "completition-verification":
+        return await runCompletionVerification(projectRoot);
+      case "lookup": {
+        if (rest.length !== 1) {
+          console.error("Usage: rig-agent lookup <task-id-or-source-id>");
+          return 1;
+        }
+        const lookupId = rest[0];
+        if (!lookupId) {
+          console.error("Usage: rig-agent lookup <task-id-or-source-id>");
+          return 1;
+        }
+        console.log(taskLookup2(projectRoot, lookupId));
+        return 0;
+      }
+      case "record": {
+        if (rest.length < 2) {
+          console.error("Usage: rig-agent record <decision|failure> <text>");
+          return 1;
+        }
+        const type = rest[0];
+        if (type !== "decision" && type !== "failure") {
+          console.error("Usage: rig-agent record <decision|failure> <text>");
+          return 1;
+        }
+        await taskRecord2(projectRoot, type, rest.slice(1).join(" "), taskId);
+        return 0;
+      }
+      case "memory": {
+        const memoryService = await loadCapabilityForRoot2(projectRoot, defineCapability4(MEMORY));
+        if (!memoryService) {
+          console.error("[rig-agent] Shared memory requires the @rig/memory-plugin plugin in rig.config.");
+          return 1;
+        }
+        const eventBus = getEventBus();
+        console.log(await memoryService.executeMemoryCommand({
+          projectRoot,
+          taskId,
+          runtimeContext: ctx,
+          args: rest,
+          ...eventBus ? { eventBus } : {}
+        }));
+        return 0;
+      }
+      case "git": {
+        const capabilityRoot = ctx?.hostProjectRoot || BAKED_PROJECT_ROOT || projectRoot;
+        await runGitCommand(projectRoot, taskId, rest, capabilityRoot);
+        return 0;
+      }
+      case "repo":
+      case "repo-sync":
+        runRepoSyncCommand(projectRoot, taskId, rest);
+        return 0;
+      case "profile":
+        runProfileCommand(projectRoot, rest);
+        return 0;
+      case "review":
+        runReviewCommand(projectRoot, rest);
+        return 0;
+      case "help":
+        printAgentHelp();
+        return 0;
+      default:
+        return;
+    }
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    return 1;
+  }
+}
+async function runGitCommand(projectRoot, bakedTaskId, args, capabilityRoot = projectRoot) {
+  const [sub = "status", ...rest] = args;
+  const task = takeOption(rest, "--task");
+  const tid = task.value || bakedTaskId;
+  const flags = task.rest;
+  const git = await loadLifecycleGit(capabilityRoot);
+  switch (sub) {
+    case "status":
+      git.gitStatus(projectRoot, tid);
+      return;
+    case "changed": {
+      const scoped = flags.includes("--scoped");
+      const files = git.gitChanged(projectRoot, tid, scoped);
+      console.log(files.length > 0 ? files.join(`
+`) : "(none)");
+      return;
+    }
+    case "preflight": {
+      const strict = flags.includes("--strict");
+      const ok = git.gitPreflight(projectRoot, tid, strict);
+      if (!ok)
+        throw new Error("Git preflight failed.");
+      return;
+    }
+    case "sync-branch":
+    case "ensure-branch":
+      git.gitSyncBranch(projectRoot, tid);
+      return;
+    case "commit": {
+      const target = takeOption(flags, "--target");
+      const message = takeOption(target.rest, "--message");
+      const allowEmpty = message.rest.includes("--allow-empty");
+      const scoped = git.shouldScopeGitCommit(message.rest, Boolean(tid));
+      git.gitCommit({
+        projectRoot,
+        taskId: tid,
+        target: target.value || "monorepo",
+        allowEmpty,
+        scoped,
+        ...message.value ? { message: message.value } : {}
+      });
+      return;
+    }
+    case "snapshot": {
+      const output = takeOption(flags, "--output");
+      const file = git.gitSnapshot(projectRoot, tid, output.value);
+      console.log(`Snapshot written: ${file}`);
+      return;
+    }
+    case "open-pr": {
+      const target = takeOption(flags, "--target");
+      const reviewer = takeOption(target.rest, "--reviewer");
+      const base = takeOption(reviewer.rest, "--base");
+      const title = takeOption(base.rest, "--title");
+      const body = takeOption(title.rest, "--body");
+      const draft = body.rest.includes("--draft");
+      const result = git.gitOpenPr({
+        projectRoot,
+        taskId: tid,
+        ...target.value ? { target: target.value } : {},
+        ...reviewer.value ? { reviewer: reviewer.value } : {},
+        ...base.value ? { base: base.value } : {},
+        ...title.value ? { title: title.value } : {},
+        ...body.value ? { body: body.value } : {},
+        draft
+      });
+      console.log(`PR ready (${result.repoLabel}): ${result.url}`);
+      console.log(`Reviewer assigned: ${result.reviewer} (${result.reviewerSource})`);
+      return;
+    }
+    default:
+      throw new Error(`Unknown git subcommand: ${sub}. Try: status, changed, preflight, sync-branch, commit, snapshot, open-pr`);
+  }
+}
+function runRepoSyncCommand(projectRoot, bakedTaskId, args) {
+  const [sub = "ensure", ...rest] = args;
+  const task = takeOption(rest, "--task");
+  const tid = task.value || bakedTaskId;
+  switch (sub) {
+    case "sync":
+    case "ensure":
+      repoEnsure(projectRoot, tid);
+      return;
+    case "pins": {
+      const pins = repoPins(projectRoot, tid);
+      printPins(pins);
+      return;
+    }
+    case "verify": {
+      const ok = repoVerify(projectRoot, tid);
+      if (!ok)
+        throw new Error("Repo pin verification failed.");
+      return;
+    }
+    case "discover": {
+      const pins = repoDiscover(projectRoot, tid);
+      printPins(pins);
+      return;
+    }
+    case "baseline": {
+      const refresh = task.rest.includes("--refresh");
+      const pins = repoBaseline(projectRoot, refresh);
+      printPins(pins);
+      return;
+    }
+    default:
+      throw new Error(`Unknown repo subcommand: ${sub}. Try: sync, ensure, pins, verify, discover, baseline`);
+  }
+}
+function runProfileCommand(projectRoot, args) {
+  const [sub = "show", ...rest] = args;
+  if (sub === "show") {
+    showProfile(projectRoot, rest.includes("--compact"));
+    return;
+  }
+  if (sub === "set") {
+    const first = rest[0];
+    if (first === "claude-code" || first === "codex-cli" || first === "codex-app-server") {
+      setProfile(projectRoot, { preset: first });
+      return;
+    }
+    const model = takeOption(rest, "--model");
+    const runtime = takeOption(model.rest, "--runtime");
+    const plugin = takeOption(runtime.rest, "--plugin");
+    setProfile(projectRoot, {
+      ...model.value ? { model: model.value } : {},
+      ...runtime.value ? { runtime: runtime.value } : {},
+      ...plugin.value ? { plugin: plugin.value } : {}
+    });
+    return;
+  }
+  throw new Error(`Unknown profile subcommand: ${sub}. Try: show, set`);
+}
+function runReviewCommand(projectRoot, args) {
+  const [sub = "show", ...rest] = args;
+  if (sub === "show") {
+    showReviewProfile(projectRoot);
+    return;
+  }
+  if (sub === "set") {
+    const mode = rest[0];
+    if (!mode) {
+      throw new Error("Usage: rig-agent review set <off|advisory|required> [--provider github]");
+    }
+    const provider = takeOption(rest.slice(1), "--provider");
+    setReviewProfile(projectRoot, mode, provider.value);
+    return;
+  }
+  throw new Error(`Unknown review subcommand: ${sub}. Try: show, set`);
+}
+function takeOption(args, option) {
+  const rest = [];
+  let value;
+  for (let i = 0;i < args.length; i += 1) {
+    const current = args[i];
+    if (current === option) {
+      const next = args[i + 1];
+      if (!next || next.startsWith("-")) {
+        throw new Error(`Missing value for ${option}`);
+      }
+      value = next;
+      i += 1;
+      continue;
+    }
+    if (current !== undefined) {
+      rest.push(current);
+    }
+  }
+  return { value, rest };
+}
+function printPins(pins) {
+  if (Object.keys(pins).length === 0) {
+    console.log("(none)");
+    return;
+  }
+  for (const [key, value] of Object.entries(pins)) {
+    console.log(`${key}	${value}`);
+  }
+}
+function printAgentHelp() {
+  console.log(`rig-agent \u2014 CLI for Project Rig agents
+
+ORIENTATION:
+  rig-agent info              Your task, role, scope, deps \u2014 start here
+  rig-agent scope [--files]   Scope globs; --files expands to file list
+  rig-agent deps              Read dependency artifacts (decisions, next-actions)
+  rig-agent lookup <id>       Validate a task/source ID
+  rig-agent status            Epic/task progress overview
+
+EXECUTION:
+  rig-agent validate          Run validation commands for your task
+  rig-agent record decision "..."  Record an architectural decision
+  rig-agent record failure "..."   Record a failed approach (cross-session only \u2014 not re-read in this session)
+  rig-agent memory observe ...     Promote a shared memory immediately
+  rig-agent memory recall [query]  Recall relevant shared memories
+  rig-agent git status        Task-aware git status
+  rig-agent git changed       Changed files (--scoped for scope-filtered)
+  rig-agent git commit        Task-aware commit (--target monorepo|project|both)
+  rig-agent git snapshot      Capture worktree state
+  rig-agent git sync-branch   Ensure task branch exists
+  rig-agent git open-pr       Create PR for task changes
+  rig-agent repo sync         Ensure monorepo checkout + task repo pins
+  rig-agent profile show      Show runtime profile
+  rig-agent review show       Show AI review gate settings
+
+COMPLETION:
+  rig-agent artifacts                   Scaffold completion artifacts (templates)
+  rig-agent artifact-dir                Print absolute artifact directory path
+  rig-agent project-root                Print absolute task worktree root
+  rig-agent monorepo-root               Print absolute monorepo root in the task worktree
+  rig-agent artifact-write <filename>   Write artifact from stdin
+  rig-agent completion-verification     Run final validation/review gate
+  rig-agent completition-verification   Alias for the same final gate
+
+WORKFLOW:
+  1. rig-agent info            Understand your assignment
+  2. rig-agent deps            Read what prior tasks decided
+  3. rig-agent repo sync         Align monorepo checkout + repo pins
+  4. (do your work)
+  5. rig-agent record decision "chose X because Y"
+  6. rig-agent validate        Check your work
+  7. rig-agent artifacts       Scaffold completion artifacts
+  8. rig-agent artifact-write collection-audit.md  (write custom artifacts)
+  9. rig-agent completion-verification
+`);
+}
+async function runCompletionVerification(projectRoot) {
+  const host = await buildProjectPluginHost(projectRoot);
+  const verification = host ? await defineServiceCapability2(LIFECYCLE_VERIFICATION_SERVICE2).resolveService(host) : null;
+  if (!verification) {
+    console.error("[rig-agent] Completion verification requires the @rig/lifecycle-plugin plugin in rig.config.");
+    return 1;
+  }
+  const { ok } = await verification.verifyCompletion({ projectRoot });
+  return ok ? 0 : 1;
+}
+async function runInternal(args) {
+  const [command = "", ...rest] = args;
+  if (command === "shell") {
+    const code = await runControlledBash(rest, { projectRootFallbackDir: import.meta.dir });
+    process.exit(code);
+  }
+  if (command === "manifest-verify") {
+    await verifyRuntimeManifest();
+    console.log("manifest: ok");
+    return;
+  }
+  throw new Error("Unknown internal command. Use `rig-agent internal shell <bash-args...>` or `rig-agent internal manifest-verify`.");
+}
+async function verifyRuntimeManifest() {
+  if (getContext()) {
+    return;
+  }
+  const manifestPath = BAKED_MANIFEST_PATH;
+  if (!manifestPath) {
+    return;
+  }
+  if (!existsSync3(manifestPath)) {
+    throw new Error(`[rig-agent] Runtime manifest missing: ${manifestPath}`);
+  }
+  let manifest;
+  try {
+    manifest = await Bun.file(manifestPath).json();
+  } catch (error) {
+    throw new Error(`[rig-agent] Failed to parse runtime manifest at ${manifestPath}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  assertMatch("taskId", BAKED_TASK_ID, manifest.taskId);
+  assertMatch("runtimeId", BAKED_RUNTIME_ID, manifest.runtimeId);
+  assertMatch("scopeHash", BAKED_SCOPE_HASH, manifest.scopeHash);
+  const manifestBinaryPath = manifest.binary?.path || BAKED_BINARY_PATH || process.execPath;
+  const expectedHash = manifest.binary?.sha256 || "";
+  if (!manifestBinaryPath || !expectedHash) {
+    throw new Error(`[rig-agent] Runtime manifest is missing binary hash data (${manifestPath}).`);
+  }
+  if (!existsSync3(manifestBinaryPath)) {
+    throw new Error(`[rig-agent] Runtime binary not found at ${manifestBinaryPath}.`);
+  }
+  const actualHash = sha256Hex(readFileSync2(resolve3(manifestBinaryPath)));
+  if (actualHash !== expectedHash) {
+    throw new Error(`[rig-agent] Runtime manifest mismatch for binary hash.
+` + `expected=${expectedHash}
+` + `actual=${actualHash}
+` + `path=${manifestBinaryPath}`);
+  }
+}
+function assertMatch(name, expected, actual) {
+  if (!expected && !actual) {
+    return;
+  }
+  if (expected !== (actual || "")) {
+    throw new Error(`[rig-agent] Runtime manifest mismatch for ${name}: expected='${expected}' actual='${actual || ""}'.`);
+  }
+}
+main().catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+});
+export {
+  looksLikeShellInvocation
+};