@h-rig/provider-plugin 0.0.6-alpha.157 → 0.0.6-alpha.158

package/dist/src/agent-harness/agent-wrapper.js

@@ -0,0 +1,916 @@
+#!/usr/bin/env bun
+// @bun
+
+// packages/provider-plugin/src/agent-harness/agent-wrapper.ts
+import { createRequire } from "module";
+import { resolve as resolve2 } from "path";
+import { existsSync as existsSync2, mkdirSync, writeFileSync } from "fs";
+import { assertPathInsideRoot, safePathSegment, taskRuntimeId } from "@rig/core/safe-identifiers";
+import {
+  ISOLATION_BACKEND,
+  TASK_DATA_SERVICE_CAPABILITY
+} from "@rig/contracts";
+import { defineCapability } from "@rig/core/capability";
+import { requireCapabilityForRoot } from "@rig/core/capability-loaders";
+import { loadRuntimeContextFromEnv } from "@rig/core/runtime-context";
+import { resolveCheckoutRoot as resolveMonorepoRoot } from "@rig/core/checkout-root";
+
+// packages/provider-plugin/src/agent-harness/runtime-snapshot-config.ts
+import { existsSync, readFileSync } from "fs";
+import { resolve } from "path";
+var DEFAULT_RUNTIME_SNAPSHOT = { enabled: true };
+function loadRuntimeSnapshotConfig(projectRoot) {
+  const configPath = resolve(projectRoot, "rig/policy/policy.json");
+  if (!existsSync(configPath))
+    return { ...DEFAULT_RUNTIME_SNAPSHOT };
+  try {
+    const parsed = JSON.parse(readFileSync(configPath, "utf8"));
+    const runtimeSnapshot = parsed.runtime_snapshot;
+    if (runtimeSnapshot && typeof runtimeSnapshot === "object" && !Array.isArray(runtimeSnapshot)) {
+      const enabled = runtimeSnapshot.enabled;
+      if (typeof enabled === "boolean")
+        return { enabled };
+    }
+  } catch {
+    return { ...DEFAULT_RUNTIME_SNAPSHOT };
+  }
+  return { ...DEFAULT_RUNTIME_SNAPSHOT };
+}
+
+// packages/provider-plugin/src/agent-harness/agent-wrapper.ts
+import { buildPluginHostContext } from "@rig/core/plugin-host-context";
+var taskDataServiceByRoot = new Map;
+function resolveTaskDataService(projectRoot) {
+  let cached = taskDataServiceByRoot.get(projectRoot);
+  if (!cached) {
+    cached = requireCapabilityForRoot(projectRoot, defineCapability(TASK_DATA_SERVICE_CAPABILITY), `No TASK_DATA_SERVICE capability is registered for project root "${projectRoot}". ` + "Install @rig/task-sources-plugin (it ships in the default bundle) so the agent " + "executor can resolve task-state reads and lifecycle updates.");
+    taskDataServiceByRoot.set(projectRoot, cached);
+  }
+  return cached;
+}
+var requireFromRuntime = createRequire(import.meta.url);
+async function finalizeRuntimeSnapshot(snapshotSidecar, providerCommand, exitCode, context) {
+  try {
+    await snapshotSidecar.finalize(providerCommand, exitCode);
+    return { ok: true };
+  } catch (error) {
+    emitWrapperEvent("runtime.snapshot.finalize.failed", {
+      runtimeId: context.runtimeId,
+      taskId: context.taskId,
+      exitCode,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    console.error(`[rig-agent] Snapshot finalize failed for ${context.taskId}: ${error instanceof Error ? error.message : String(error)}`);
+    if (exitCode !== 0) {
+      throw error;
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    return { ok: false, snapshotMissing: true, error: message };
+  }
+}
+async function startOptionalRuntimeSnapshotSidecar(runtime, startSidecar) {
+  try {
+    return await startSidecar(runtime, { instanceId: `${runtime.id}-wrapper` });
+  } catch (error) {
+    emitWrapperEvent("runtime.snapshot.start.failed", {
+      runtimeId: runtime.id,
+      taskId: runtime.taskId,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    console.error(`[rig-agent] Runtime snapshotting unavailable for ${runtime.taskId}: ${error instanceof Error ? error.message : String(error)}`);
+    return null;
+  }
+}
+async function runAgentWrapper(options = {}) {
+  const projectRoot = resolve2(options.projectRoot || process.env.PROJECT_RIG_ROOT || process.cwd());
+  const monorepoRoot = resolveMonorepoRoot(projectRoot);
+  const argv = options.argv || process.argv.slice(2);
+  if (argv.length === 0 || argv[0] === "--version" || argv[0] === "--help" || argv[0] === "help") {
+    console.log("[rig-agent] dispatch ready");
+    return 0;
+  }
+  const taskId = await resolveTaskId(projectRoot, monorepoRoot);
+  if (!taskId) {
+    console.error("[rig-agent] No active task ID found (checked env, session, beads).");
+    console.error("[rig-agent] Refusing to run unsandboxed. Ensure task runtime/session injection is active.");
+    return 1;
+  }
+  const provider = resolveProvider();
+  await printTaskContext(monorepoRoot, taskId);
+  let runtime;
+  let isolationBackend;
+  try {
+    emitWrapperEvent("runtime.provision.started", {
+      projectRoot,
+      taskId,
+      mode: "worktree"
+    });
+    isolationBackend = await requireCapabilityForRoot(projectRoot, defineCapability(ISOLATION_BACKEND), `No ISOLATION_BACKEND capability is registered for project root "${projectRoot}". ` + "Install @rig/isolation-plugin (it ships in the default bundle) so runtime provisioning can resolve a backend.");
+    const taskRecordReader = taskRecordReaderFromEnv(taskId);
+    runtime = await isolationBackend.ensureAgentRuntime({
+      projectRoot,
+      id: taskRuntimeId(taskId),
+      taskId,
+      mode: "worktree",
+      provider,
+      ...taskRecordReader ? { taskRecordReader } : {},
+      preserveTaskArtifacts: process.env.RIG_RUN_RESUME === "1" || process.env.RIG_RUNTIME_ARTIFACT_CLEANUP === "preserve"
+    });
+    emitWrapperEvent("runtime.provision.completed", {
+      runtimeId: runtime.id,
+      taskId,
+      workspaceDir: runtime.workspaceDir,
+      sessionDir: runtime.sessionDir,
+      logsDir: runtime.logsDir,
+      stateDir: runtime.stateDir,
+      contextFile: runtime.contextFile,
+      snapshotManaged: true
+    });
+  } catch (error) {
+    emitWrapperEvent("runtime.provision.failed", {
+      taskId,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    console.error(`[rig-agent] Failed to provision runtime: ${error}`);
+    return 1;
+  }
+  try {
+    await waitForDirtyBaselineReady(runtime, taskId);
+  } catch (error) {
+    emitWrapperEvent("runtime.baseline.failed", {
+      runtimeId: runtime.id,
+      taskId,
+      workspaceDir: runtime.workspaceDir,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    console.error(`[rig-agent] Failed to apply selected baseline before provider launch: ${error}`);
+    return 1;
+  }
+  const providerArgs = buildProviderArgs(provider, runtime, argv);
+  const providerCommand = [providerBinary(provider), ...providerArgs];
+  emitWrapperEvent("provider.launch", {
+    provider,
+    runtimeId: runtime.id,
+    taskId,
+    workspaceDir: runtime.workspaceDir,
+    command: providerCommand
+  });
+  const env = await isolationBackend.runtimeEnv(projectRoot, runtime);
+  const bypassOuterRuntimeSandbox = shouldBypassProviderSandboxOnPlatform(provider, process.platform);
+  if (provider === "pi") {
+    env.PI_CODING_AGENT_DIR = resolve2(runtime.homeDir, ".pi", "agent");
+    env.PI_CODING_AGENT_SESSION_DIR = runtime.sessionDir;
+  }
+  env.RIG_RUNTIME_SANDBOX = process.env.RIG_RUNTIME_SANDBOX?.trim() || "enforce";
+  const snapshotEnabled = loadRuntimeSnapshotConfig(projectRoot).enabled;
+  const snapshotSidecar = snapshotEnabled ? await startOptionalRuntimeSnapshotSidecar(runtime, (rt, opts) => isolationBackend.startRuntimeSnapshotSidecar(rt, opts)) : null;
+  let exitCode = 1;
+  let snapshotFinalizeResult = { ok: true };
+  try {
+    const command = bypassOuterRuntimeSandbox ? providerCommand : (await isolationBackend.wrapRuntimeSandbox({
+      projectRoot,
+      runtime: {
+        id: runtime.id,
+        mode: runtime.mode,
+        rootDir: runtime.rootDir,
+        workspaceDir: runtime.workspaceDir,
+        binDir: runtime.binDir,
+        homeDir: runtime.homeDir,
+        tmpDir: runtime.tmpDir,
+        cacheDir: runtime.cacheDir,
+        stateDir: runtime.stateDir,
+        sessionDir: runtime.sessionDir,
+        claudeHomeDir: runtime.claudeHomeDir
+      },
+      command: providerCommand
+    })).command;
+    if (isPiRpcArgs(providerArgs)) {
+      const prompt = await readProcessStdin();
+      const runId = process.env.RIG_SERVER_RUN_ID?.trim();
+      exitCode = await runPiRpcProviderFallback({
+        command,
+        cwd: runtime.workspaceDir,
+        env,
+        prompt,
+        ...runId ? { runId } : {},
+        sessionName: runId ? `Rig ${runId}` : `Rig ${runtime.taskId}`
+      });
+    } else {
+      const proc = Bun.spawn(command, {
+        cwd: runtime.workspaceDir,
+        env,
+        stdin: "inherit",
+        stdout: "inherit",
+        stderr: "inherit"
+      });
+      exitCode = await proc.exited;
+    }
+    if (snapshotSidecar) {
+      snapshotFinalizeResult = await finalizeRuntimeSnapshot(snapshotSidecar, providerCommand, exitCode, {
+        runtimeId: runtime.id,
+        taskId
+      });
+    }
+  } catch (error) {
+    if (snapshotSidecar) {
+      await snapshotSidecar.cancel();
+    }
+    throw error;
+  }
+  const serverManagedRun = Boolean(process.env.RIG_SERVER_RUN_ID?.trim());
+  const taskClosed = await isTaskClosed(monorepoRoot, taskId);
+  const finalExitCode = resolveFinalProviderExitCode({
+    providerExitCode: exitCode,
+    taskClosed,
+    serverManagedRun
+  });
+  const snapshotMissing = !snapshotFinalizeResult.ok;
+  const handoffRequired = exitCode !== 0 || snapshotMissing || !taskClosed && !serverManagedRun;
+  emitWrapperEvent("provider.completed", {
+    provider,
+    runtimeId: runtime.id,
+    taskId,
+    exitCode: finalExitCode,
+    providerExitCode: exitCode,
+    taskClosed,
+    serverManagedRun,
+    handoffRequired,
+    snapshotMissing,
+    ...!snapshotFinalizeResult.ok ? { snapshotFinalizeError: snapshotFinalizeResult.error } : {}
+  });
+  if (handoffRequired) {
+    recordRuntimeHandoff(projectRoot, runtime, taskId, exitCode, {
+      snapshotMissing,
+      snapshotFinalizeError: snapshotFinalizeResult.ok ? null : snapshotFinalizeResult.error
+    });
+    if (!snapshotFinalizeResult.ok) {
+      await recordSnapshotMissingTaskSourceEvidence(projectRoot, taskId, runtime, snapshotFinalizeResult.error);
+    }
+  }
+  return finalExitCode;
+}
+function parseJsonRecord(line) {
+  try {
+    const parsed = JSON.parse(line);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function readProcessStdin() {
+  if (process.stdin.isTTY)
+    return "";
+  return await new Promise((resolveRead) => {
+    let data = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+      data += String(chunk);
+    });
+    process.stdin.on("end", () => resolveRead(data));
+    process.stdin.resume();
+  });
+}
+async function pumpReadableLines(stream, onLine) {
+  if (!stream)
+    return;
+  const reader = stream.getReader();
+  const decoder = new TextDecoder;
+  let buffer = "";
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      buffer += decoder.decode(value, { stream: true });
+      const parts = buffer.split(/\r?\n/);
+      buffer = parts.pop() ?? "";
+      for (const part of parts)
+        onLine(part);
+    }
+    buffer += decoder.decode();
+    if (buffer)
+      onLine(buffer);
+  } finally {
+    reader.releaseLock();
+  }
+}
+function isBlockingPiRpcUiRequest(record) {
+  if (record.type !== "extension_ui_request")
+    return false;
+  return record.method === "select" || record.method === "confirm" || record.method === "input" || record.method === "editor";
+}
+function writeRpcCommand(stdin, command) {
+  stdin.write(`${JSON.stringify(command)}
+`);
+}
+function joinUrl(baseUrl, pathname) {
+  return `${baseUrl.replace(/\/+$/, "")}${pathname.startsWith("/") ? pathname : `/${pathname}`}`;
+}
+async function readQueuedSteeringFromServer(input) {
+  if (!input.serverUrl || !input.runId)
+    return [];
+  const headers = {};
+  if (input.authToken)
+    headers.authorization = `Bearer ${input.authToken}`;
+  if (input.projectRoot)
+    headers["x-rig-project-root"] = input.projectRoot;
+  const response = await fetch(joinUrl(input.serverUrl, `/api/runs/${encodeURIComponent(input.runId)}/steering?ack=1`), { headers });
+  if (!response.ok) {
+    throw new Error(`steering read rejected (${response.status}) at ${input.serverUrl}`);
+  }
+  const payload = await response.json().catch(() => null);
+  const messages = payload && typeof payload === "object" && !Array.isArray(payload) ? payload.messages : null;
+  return Array.isArray(messages) ? messages.filter((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry))) : [];
+}
+function steeringMessageText(entry) {
+  const message = typeof entry.message === "string" ? entry.message.trim() : "";
+  return message || null;
+}
+function isPiRpcArgs(args) {
+  return cliOptionValue(args, "--mode") === "rpc";
+}
+async function runPiRpcProviderFallback(input) {
+  const stdout = input.stdout ?? process.stdout;
+  const stderr = input.stderr ?? process.stderr;
+  const proc = Bun.spawn(input.command, {
+    cwd: input.cwd,
+    env: input.env,
+    stdin: "pipe",
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  let sawAgentEnd = false;
+  let promptError = null;
+  let stdinOpen = true;
+  let steeringPollStopped = false;
+  const closeStdin = () => {
+    if (!stdinOpen)
+      return;
+    stdinOpen = false;
+    try {
+      steeringPollStopped = true;
+      proc.stdin.end();
+    } catch {}
+  };
+  const send = (command) => {
+    if (!stdinOpen)
+      return;
+    try {
+      writeRpcCommand(proc.stdin, command);
+    } catch (error) {
+      promptError ??= error instanceof Error ? error.message : String(error);
+    }
+  };
+  const forwardSigterm = () => {
+    try {
+      proc.kill("SIGTERM");
+    } catch {}
+  };
+  process.once("SIGTERM", forwardSigterm);
+  const pollSteering = async () => {
+    const serverUrl = input.env.RIG_SERVER_URL || input.env.RIG_SERVER_BASE_URL;
+    const authToken = input.env.RIG_AUTH_TOKEN || input.env.RIG_SERVER_AUTH_TOKEN;
+    const projectRoot = input.env.PROJECT_RIG_ROOT || input.env.RIG_HOST_PROJECT_ROOT || process.env.PROJECT_RIG_ROOT;
+    let lastReportedPollError = null;
+    while (!steeringPollStopped && stdinOpen) {
+      try {
+        const messages = await readQueuedSteeringFromServer({
+          ...serverUrl ? { serverUrl } : {},
+          ...authToken ? { authToken } : {},
+          ...input.runId ? { runId: input.runId } : {},
+          ...projectRoot ? { projectRoot } : {}
+        });
+        lastReportedPollError = null;
+        for (const message of messages) {
+          const text = steeringMessageText(message);
+          if (!text || !stdinOpen)
+            continue;
+          send({
+            id: typeof message.id === "string" ? `rig_steer_${message.id}` : `rig_steer_${Date.now()}`,
+            type: "prompt",
+            message: text,
+            streamingBehavior: "steer"
+          });
+          emitWrapperEvent("pi.rpc.steering.delivered", {
+            runId: input.runId ?? null,
+            steeringId: typeof message.id === "string" ? message.id : null,
+            actor: typeof message.actor === "string" ? message.actor : "operator",
+            message: text
+          });
+        }
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (message !== lastReportedPollError) {
+          lastReportedPollError = message;
+          emitWrapperEvent("pi.rpc.steering.poll.failed", {
+            runId: input.runId ?? null,
+            error: message
+          });
+        }
+      }
+      await sleep(1000);
+    }
+  };
+  const stdoutPump = pumpReadableLines(proc.stdout, (line) => {
+    stdout.write(`${line}
+`);
+    const record = parseJsonRecord(line.trim());
+    if (!record)
+      return;
+    if (record.type === "agent_end") {
+      sawAgentEnd = true;
+      closeStdin();
+      return;
+    }
+    if (record.type === "response" && record.command === "prompt" && record.success === false) {
+      promptError = typeof record.error === "string" ? record.error : "Pi RPC prompt failed.";
+      closeStdin();
+      return;
+    }
+    if (isBlockingPiRpcUiRequest(record)) {
+      const id = typeof record.id === "string" ? record.id : "";
+      if (id) {
+        send({ type: "extension_ui_response", id, cancelled: true });
+        emitWrapperEvent("pi.rpc.extension_ui.cancelled", {
+          id,
+          method: record.method,
+          reason: "noninteractive Rig worker RPC session"
+        });
+      }
+    }
+  });
+  const stderrPump = pumpReadableLines(proc.stderr, (line) => {
+    stderr.write(`${line}
+`);
+  });
+  if (input.sessionName?.trim()) {
+    send({ id: "rig_set_session_name", type: "set_session_name", name: input.sessionName.trim() });
+  }
+  const steeringPollPromise = pollSteering();
+  if (input.prompt.trim()) {
+    send({ id: "rig_initial_prompt", type: "prompt", message: input.prompt });
+    emitWrapperEvent("pi.rpc.prompt.sent", {
+      runId: input.runId ?? null,
+      kind: "initial",
+      bytes: Buffer.byteLength(input.prompt)
+    });
+  } else {
+    closeStdin();
+  }
+  const exitCode = await proc.exited;
+  process.off("SIGTERM", forwardSigterm);
+  steeringPollStopped = true;
+  await Promise.all([stdoutPump, stderrPump, steeringPollPromise]);
+  if (promptError) {
+    stderr.write(`[rig-agent] Pi RPC prompt failed: ${promptError}
+`);
+    return exitCode === 0 ? 1 : exitCode;
+  }
+  if (input.prompt.trim() && !sawAgentEnd && exitCode === 0) {
+    stderr.write(`[rig-agent] Pi RPC exited before emitting agent_end.
+`);
+    return 1;
+  }
+  return exitCode;
+}
+var runPiRpcProvider = runPiRpcProviderFallback;
+function resolveFinalProviderExitCode(input) {
+  if (input.providerExitCode !== 0) {
+    return input.providerExitCode;
+  }
+  if (input.taskClosed || input.serverManagedRun) {
+    return 0;
+  }
+  return 0;
+}
+function shouldBypassProviderSandboxOnPlatform(provider, platform) {
+  if (platform !== "darwin") {
+    return false;
+  }
+  return provider === "pi";
+}
+function buildProviderArgs(_provider, _runtime, argv) {
+  const piArgs = argv.filter((arg) => arg !== "__rig_pi_session_daemon__");
+  const piProvider = cliOptionValue(piArgs, "--provider") || process.env.RIG_PI_PROVIDER?.trim() || "openai-codex";
+  if (!hasCliOption(piArgs, "--provider")) {
+    piArgs.unshift(piProvider);
+    piArgs.unshift("--provider");
+  }
+  const model = cliOptionValue(piArgs, "--model") || process.env.RIG_PI_MODEL?.trim() || "gpt-5.5";
+  if (hasCliOption(piArgs, "--model")) {
+    rewriteCliOptionValue(piArgs, "--model", normalizePiModelForProvider(model, piProvider));
+  } else {
+    piArgs.unshift(normalizePiModelForProvider(model, piProvider));
+    piArgs.unshift("--model");
+  }
+  if (!hasCliOption(piArgs, "--mode")) {
+    piArgs.push("--mode", process.env.RIG_PI_TRANSPORT?.trim() === "print" ? "json" : "rpc");
+    if (process.env.RIG_PI_TRANSPORT?.trim() === "print" && !hasCliOption(piArgs, "--print")) {
+      piArgs.push("--print");
+    }
+  }
+  return piArgs;
+}
+function taskRecordReaderFromEnv(taskId) {
+  const raw = process.env.RIG_SOURCE_TASK_JSON?.trim();
+  if (!raw) {
+    return;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return;
+    }
+    const task = parsed;
+    if (typeof task.id !== "string" || task.id !== taskId) {
+      return;
+    }
+    return {
+      async listTasks() {
+        return [task];
+      },
+      async getTask(id) {
+        return id === task.id ? task : null;
+      }
+    };
+  } catch {
+    return;
+  }
+}
+async function runBeadsJson(projectRoot, args) {
+  const output = await Bun.$`br --no-db ${args} --json`.cwd(projectRoot).quiet().nothrow();
+  if (output.exitCode !== 0) {
+    return null;
+  }
+  try {
+    return await output.json();
+  } catch {
+    return null;
+  }
+}
+function resolveProvider() {
+  return "pi";
+}
+function hasCliOption(argv, option) {
+  return argv.some((arg) => arg === option || arg.startsWith(`${option}=`));
+}
+function cliOptionValue(argv, option) {
+  for (let index = 0;index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === option) {
+      const next = argv[index + 1];
+      return next && !next.startsWith("--") ? next : undefined;
+    }
+    if (arg?.startsWith(`${option}=`)) {
+      return arg.slice(option.length + 1);
+    }
+  }
+  return;
+}
+function rewriteCliOptionValue(argv, option, value) {
+  for (let index = 0;index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === option && argv[index + 1] && !argv[index + 1].startsWith("--")) {
+      argv[index + 1] = value;
+      return;
+    }
+    if (arg?.startsWith(`${option}=`)) {
+      argv[index] = `${option}=${value}`;
+      return;
+    }
+  }
+}
+function normalizePiModelForProvider(model, provider) {
+  if (provider === "openrouter" && model === "openai-codex/gpt-5.5") {
+    return "openai/gpt-5.5";
+  }
+  return model;
+}
+function resolveFromShellPath(binary) {
+  const resolved = Bun.spawnSync(["sh", "-lc", `command -v ${binary}`], {
+    stdout: "pipe",
+    stderr: "ignore",
+    stdin: "ignore",
+    env: process.env
+  });
+  if (resolved.exitCode !== 0)
+    return null;
+  const path = resolved.stdout.toString().trim().split(/\r?\n/)[0]?.trim();
+  return path || null;
+}
+function resolveBundledPiBinary() {
+  try {
+    const packageJson = requireFromRuntime.resolve("@oh-my-pi/pi-coding-agent/package.json");
+    const binaryPath = resolve2(packageJson, "..", "dist", "cli.js");
+    return existsSync2(binaryPath) ? binaryPath : null;
+  } catch {
+    return null;
+  }
+}
+function providerBinary(_provider) {
+  return process.env.RIG_PI_BINARY?.trim() || resolveBundledPiBinary() || resolveFromShellPath("pi") || Bun.which("pi") || "pi";
+}
+function emitWrapperEvent(type, payload) {
+  console.log(`__RIG_WRAPPER_EVENT__${JSON.stringify({ type, payload, at: new Date().toISOString() })}`);
+}
+function sleep(ms) {
+  return new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
+}
+async function waitForDirtyBaselineReady(runtime, taskId) {
+  const readyFile = process.env.RIG_DIRTY_BASELINE_READY_FILE?.trim();
+  if (process.env.RIG_BASELINE_MODE !== "dirty-snapshot" || !readyFile)
+    return;
+  const timeoutMs = Number.parseInt(process.env.RIG_DIRTY_BASELINE_TIMEOUT_MS ?? "30000", 10);
+  const deadline = Date.now() + (Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : 30000);
+  emitWrapperEvent("runtime.baseline.waiting", {
+    runtimeId: runtime.id,
+    taskId,
+    workspaceDir: runtime.workspaceDir,
+    readyFile
+  });
+  while (!existsSync2(readyFile)) {
+    if (Date.now() >= deadline) {
+      throw new Error(`Timed out waiting for dirty baseline ready file: ${readyFile}`);
+    }
+    await sleep(50);
+  }
+  emitWrapperEvent("runtime.baseline.completed", {
+    runtimeId: runtime.id,
+    taskId,
+    workspaceDir: runtime.workspaceDir,
+    readyFile
+  });
+}
+async function resolveTaskId(projectRoot, monorepoRoot) {
+  if (process.env.RIG_TASK_ID) {
+    return process.env.RIG_TASK_ID;
+  }
+  const fromState = (await resolveTaskDataService(projectRoot)).currentTaskId(projectRoot);
+  if (fromState) {
+    return fromState;
+  }
+  return resolveTaskFromBeads(monorepoRoot);
+}
+async function resolveTaskFromBeads(projectRoot, readBeadsJson = runBeadsJson) {
+  const inProgress = await readBeadsJson(projectRoot, ["list", "--status", "in_progress"]);
+  if (inProgress) {
+    const task = inProgress.find((t) => t.issue_type === "task");
+    if (task?.id) {
+      return task.id;
+    }
+  }
+  const ready = await readBeadsJson(projectRoot, ["ready"]);
+  if (ready) {
+    const task = ready.find((t) => t.issue_type === "task");
+    if (task?.id) {
+      return task.id;
+    }
+  }
+  return "";
+}
+async function isTaskClosed(projectRoot, taskId, readBeadsJson = runBeadsJson) {
+  const pluginStatus = await readPluginTaskStatus(projectRoot, taskId);
+  if (isTerminalTaskStatus(pluginStatus)) {
+    return true;
+  }
+  const parsed = await readBeadsJson(projectRoot, ["show", taskId]);
+  const record = Array.isArray(parsed) ? parsed[0] : parsed;
+  if (record && typeof record === "object" && !Array.isArray(record)) {
+    return isTerminalTaskStatus(record.status);
+  }
+  return false;
+}
+function isTerminalTaskStatus(status) {
+  return status === "closed" || status === "CLOSED" || status === "completed" || status === "cancelled" || status === "blocked";
+}
+async function readPluginTaskStatus(projectRoot, taskId) {
+  const taskData = await resolveTaskDataService(projectRoot);
+  try {
+    const ctx = await buildPluginHostContext(projectRoot);
+    const [source] = ctx?.taskSourceRegistry.list() ?? [];
+    if (!source?.get) {
+      return taskData.readSourceAwareTaskStatus(projectRoot, taskId);
+    }
+    return (await source.get(taskId))?.status ?? taskData.readSourceAwareTaskStatus(projectRoot, taskId);
+  } catch {
+    return taskData.readSourceAwareTaskStatus(projectRoot, taskId);
+  }
+}
+async function recordSnapshotMissingTaskSourceEvidence(projectRoot, taskId, runtime, snapshotFinalizeError) {
+  const taskData = await resolveTaskDataService(projectRoot);
+  const comment = taskData.buildTaskRunLifecycleComment({
+    runId: process.env.RIG_SERVER_RUN_ID || "(unknown)",
+    status: "snapshot-missing",
+    summary: "Rig runtime completed, but the after-snapshot finalize failed. Closeout evidence is degraded until the runtime workspace is inspected directly.",
+    runtimeWorkspace: runtime.workspaceDir,
+    logsDir: runtime.logsDir,
+    sessionDir: runtime.sessionDir,
+    errorText: snapshotFinalizeError
+  });
+  try {
+    const result = await taskData.updateConfiguredTaskSourceTask(projectRoot, {
+      taskId,
+      update: { comment }
+    });
+    if (result.updated) {
+      return;
+    }
+    throw new Error(result.source === "plugin" || result.sourceKind ? `configured task source${result.sourceKind ? ` (${result.sourceKind})` : ""} does not support comment updates` : "no source-aware task source is configured");
+  } catch (error) {
+    let fallbackUpdated = false;
+    try {
+      const sourceIssueId = loadRuntimeContextFromEnv()?.sourceTask?.sourceIssueId;
+      fallbackUpdated = taskData.updateGithubIssueTaskBySourceIssueId(sourceIssueId, taskId, { comment });
+      fallbackUpdated = taskData.updateSourceAwareTaskConfigTask(projectRoot, taskId, { comment }) || fallbackUpdated;
+    } catch (fallbackError) {
+      console.error(`[rig-agent] Snapshot-missing compatibility comment also failed for ${taskId}: ${fallbackError instanceof Error ? fallbackError.message : String(fallbackError)}`);
+    }
+    const message = `[rig-agent] Failed to record snapshot-missing evidence for ${taskId}${fallbackUpdated ? "; applied source-aware compatibility comment" : ""}: ${error instanceof Error ? error.message : String(error)}`;
+    if (fallbackUpdated) {
+      console.log(message);
+    } else {
+      console.error(message);
+    }
+  }
+}
+async function updateTaskSourceAfterRun(projectRoot, taskId, runtime) {
+  const taskData = await resolveTaskDataService(projectRoot);
+  const comment = taskData.buildTaskRunLifecycleComment({
+    runId: process.env.RIG_SERVER_RUN_ID || "(unknown)",
+    status: "completed",
+    summary: "Rig task run completed; source closeout waits for approved PR merge.",
+    runtimeWorkspace: runtime.workspaceDir,
+    logsDir: runtime.logsDir,
+    sessionDir: runtime.sessionDir
+  });
+  try {
+    const result = await taskData.updateConfiguredTaskSourceTask(projectRoot, {
+      taskId,
+      update: { status: "completed", comment }
+    });
+    if (result.updated) {
+      return;
+    }
+    throw new Error(result.source === "plugin" || result.sourceKind ? `configured task source${result.sourceKind ? ` (${result.sourceKind})` : ""} does not support lifecycle updates` : "no source-aware task source is configured");
+  } catch (error) {
+    let fallbackUpdated = false;
+    try {
+      const sourceIssueId = loadRuntimeContextFromEnv()?.sourceTask?.sourceIssueId;
+      fallbackUpdated = taskData.updateGithubIssueTaskBySourceIssueId(sourceIssueId, taskId, { status: "completed", comment });
+      fallbackUpdated = taskData.updateSourceAwareTaskConfigTask(projectRoot, taskId, { status: "completed", comment }) || fallbackUpdated;
+    } catch (fallbackError) {
+      console.error(`[rig-agent] Source-aware compatibility update also failed for ${taskId}: ${fallbackError instanceof Error ? fallbackError.message : String(fallbackError)}`);
+    }
+    const message = `[rig-agent] Failed to update task source for ${taskId}${fallbackUpdated ? "; applied source-aware compatibility update" : ""}: ${error instanceof Error ? error.message : String(error)}`;
+    if (fallbackUpdated) {
+      console.log(message);
+    } else {
+      console.error(message);
+    }
+  }
+}
+function resolveRuntimeHandoffPath(hostProjectRoot, taskId, timestampMs = Date.now()) {
+  const handoffDir = resolve2(hostProjectRoot, ".rig/runtime/handoffs");
+  const safeTaskId = safePathSegment(taskId, { fallback: "task", maxLength: 96 });
+  return assertPathInsideRoot(handoffDir, resolve2(handoffDir, `${safeTaskId}-${timestampMs}.json`), "runtime handoff path");
+}
+function recordRuntimeHandoff(hostProjectRoot, runtime, taskId, exitCode, options = {}) {
+  const handoffDir = resolve2(hostProjectRoot, ".rig/runtime/handoffs");
+  mkdirSync(handoffDir, { recursive: true });
+  const handoffPath = resolveRuntimeHandoffPath(hostProjectRoot, taskId);
+  const snapshotMissing = options.snapshotMissing === true;
+  const handoff = {
+    taskId,
+    runtimeId: runtime.id,
+    runtimeMode: runtime.mode,
+    workspaceDir: runtime.workspaceDir,
+    logsDir: runtime.logsDir,
+    sessionDir: runtime.sessionDir,
+    exitCode,
+    degraded: snapshotMissing,
+    snapshotMissing,
+    snapshotFinalizeError: options.snapshotFinalizeError ?? null,
+    recordedAt: new Date().toISOString(),
+    message: snapshotMissing ? "Runtime completed but the after-snapshot finalize failed; closeout evidence is degraded until the runtime workspace is inspected directly." : "Completion verification did not finish in this run. Open or refresh the PR from the runtime workspace for verifier review, or rerun completion verification once the workspace is ready.",
+    nextSteps: snapshotMissing ? [
+      `cd ${runtime.workspaceDir}`,
+      "inspect the runtime workspace directly before relying on closeout evidence",
+      `rig git status --task ${taskId}`
+    ] : [
+      `cd ${runtime.workspaceDir}`,
+      `rig git status --task ${taskId}`,
+      `rig completion-verification --task ${taskId}`,
+      `rig git open-pr --task ${taskId}`
+    ]
+  };
+  writeFileSync(handoffPath, `${JSON.stringify(handoff, null, 2)}
+`, "utf-8");
+  if (snapshotMissing) {
+    console.log(`[rig-agent] Runtime after-snapshot missing for ${taskId}; degraded handoff saved: ${handoffPath}`);
+    console.log(`[rig-agent] Inspect runtime workspace before relying on closeout evidence: ${runtime.workspaceDir}`);
+  } else {
+    console.log(`[rig-agent] Completion verification paused for ${taskId}.`);
+    console.log(`[rig-agent] Runtime handoff saved: ${handoffPath}`);
+    console.log(`[rig-agent] Review and open PR from runtime workspace: ${runtime.workspaceDir}`);
+  }
+}
+async function printTaskContext(projectRoot, taskId) {
+  const metadata = await readTaskMetadata(projectRoot, taskId);
+  const configHints = await readTaskConfigHints(projectRoot, taskId);
+  const description = firstNonEmpty(metadata?.description, configHints.description);
+  const acceptanceCriteria = firstNonEmpty(metadata?.acceptanceCriteria, configHints.acceptanceCriteria);
+  if (metadata?.title) {
+    console.log(`[rig-agent] Task ${taskId}: ${metadata.title}`);
+  } else {
+    console.log(`[rig-agent] Task ${taskId}`);
+  }
+  if (description) {
+    console.log("[rig-agent] Description:");
+    for (const line of description.split(/\r?\n/)) {
+      console.log(`[rig-agent]   ${line}`);
+    }
+  } else {
+    console.log(`[rig-agent] Description: (not set; use \`br update ${taskId} --description "..."\`)`);
+  }
+  if (acceptanceCriteria) {
+    console.log("[rig-agent] Acceptance Criteria:");
+    for (const line of acceptanceCriteria.split(/\r?\n/)) {
+      console.log(`[rig-agent]   ${line}`);
+    }
+  }
+}
+async function readTaskMetadata(taskRoot, taskId) {
+  const parsed = await runBeadsJson(taskRoot, ["show", taskId]);
+  if (!parsed) {
+    return null;
+  }
+  const record = Array.isArray(parsed) ? parsed[0] : parsed;
+  if (!record || typeof record !== "object" || Array.isArray(record)) {
+    return null;
+  }
+  const value = record;
+  return {
+    title: asNonEmptyString(value.title),
+    description: asNonEmptyString(value.description),
+    acceptanceCriteria: firstNonEmpty(asNonEmptyString(value.acceptance_criteria), asNonEmptyString(value.acceptanceCriteria))
+  };
+}
+async function readTaskConfigHints(taskRoot, taskId) {
+  const runtimeContext = loadRuntimeContextFromEnv();
+  const candidates = [
+    runtimeContext?.monorepoMainRoot ? resolve2(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
+    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve2(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
+    resolve2(taskRoot, ".rig", "task-config.json"),
+    resolve2(taskRoot, "rig", "task-config.json")
+  ].filter(Boolean);
+  for (const configPath of candidates) {
+    if (!existsSync2(configPath)) {
+      continue;
+    }
+    try {
+      const config = await Bun.file(configPath).json();
+      const entry = config[taskId] || {};
+      return {
+        description: asNonEmptyString(entry.description),
+        acceptanceCriteria: asNonEmptyString(entry.acceptance_criteria)
+      };
+    } catch {
+      continue;
+    }
+  }
+  return { description: "", acceptanceCriteria: "" };
+}
+function asNonEmptyString(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function firstNonEmpty(...values) {
+  for (const value of values) {
+    if (typeof value === "string" && value.trim()) {
+      return value.trim();
+    }
+  }
+  return "";
+}
+if (import.meta.main) {
+  runAgentWrapper().then((code) => process.exit(code)).catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  });
+}
+export {
+  updateTaskSourceAfterRun,
+  startOptionalRuntimeSnapshotSidecar,
+  shouldBypassProviderSandboxOnPlatform,
+  runPiRpcProviderFallback,
+  runPiRpcProvider,
+  runAgentWrapper,
+  resolveTaskFromBeads,
+  resolveRuntimeHandoffPath,
+  resolveProvider,
+  resolveFinalProviderExitCode,
+  recordSnapshotMissingTaskSourceEvidence,
+  recordRuntimeHandoff,
+  isTaskClosed,
+  finalizeRuntimeSnapshot,
+  buildProviderArgs
+};