@h-rig/provider-plugin 0.0.6-alpha.157 → 0.0.6-alpha.158

package/dist/src/agent-harness/rig-agent.js

@@ -0,0 +1,1244 @@
+#!/usr/bin/env bun
+// @bun
+
+// packages/provider-plugin/src/agent-harness/rig-agent.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, resolve as resolve3 } from "path";
+import { readBuildConfig } from "@rig/core/build-time-config";
+
+// packages/provider-plugin/src/agent-harness/controlled-bash.ts
+import { existsSync } from "fs";
+import { resolve } from "path";
+import { resolveRigLayout } from "@rig/core/layout";
+function controlledBashCandidates(projectRoot) {
+  const layout = resolveRigLayout(projectRoot);
+  const candidates = [
+    process.env.RIG_CONTROLLED_BASH_BIN?.trim() || "",
+    resolve(layout.binDir, "controlled-bash"),
+    Bun.which("controlled-bash") || ""
+  ];
+  return candidates.filter((candidate) => Boolean(candidate));
+}
+function resolveControlledBash(projectRoot) {
+  for (const candidate of controlledBashCandidates(projectRoot)) {
+    if (existsSync(candidate))
+      return candidate;
+  }
+  return null;
+}
+async function runControlledBash(args, options) {
+  const projectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || process.env.PROJECT_RIG_ROOT?.trim() || process.env.RIG_TASK_WORKSPACE?.trim() || process.cwd() || options.projectRootFallbackDir;
+  const controlled = resolveControlledBash(projectRoot);
+  if (!controlled) {
+    console.error("[rig-agent] controlled-bash entrypoint unavailable; refusing to run an unguarded shell.");
+    return 126;
+  }
+  const command = [controlled, ...args];
+  const child = Bun.spawn(command, {
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit",
+    cwd: process.cwd(),
+    env: {
+      ...process.env,
+      PROJECT_RIG_ROOT: projectRoot,
+      RIG_BASH_ACTIVE: "1"
+    }
+  });
+  return await child.exited;
+}
+
+// packages/provider-plugin/src/agent-harness/rig-agent.ts
+import { COMPLETION_VERIFICATION_CAPABILITY, MEMORY } from "@rig/contracts";
+import { defineCapability as defineCapability4 } from "@rig/core/capability";
+import { buildProjectPluginHost, loadCapabilityForRoot as loadCapabilityForRoot2 } from "@rig/core/capability-loaders";
+import { resolveCheckoutRoot as resolveMonorepoRoot } from "@rig/core/checkout-root";
+
+// packages/provider-plugin/src/agent-harness/agent-mode.ts
+function looksLikeShellInvocation(args, mode = process.env.RIG_AGENT_MODE) {
+  if (mode === "shell") {
+    return true;
+  }
+  if (mode === "agent") {
+    return false;
+  }
+  if (args.length === 0) {
+    return false;
+  }
+  const first = args[0];
+  if (!first) {
+    return false;
+  }
+  const bashLikeFlags = new Set([
+    "-c",
+    "-lc",
+    "-l",
+    "-i",
+    "-s",
+    "--login",
+    "--noprofile",
+    "--norc",
+    "--posix",
+    "--rcfile",
+    "--init-file",
+    "--restricted",
+    "--debug",
+    "--debugger",
+    "--verbose",
+    "--wordexp",
+    "--dump-strings",
+    "--dump-po-strings",
+    "--help"
+  ]);
+  if (bashLikeFlags.has(first)) {
+    return true;
+  }
+  if (!first.startsWith("-")) {
+    return first.endsWith(".sh");
+  }
+  return false;
+}
+
+// packages/provider-plugin/src/agent-harness/rig-agent.ts
+import { browserEnvFromContext, loadRuntimeContext as loadRuntimeContext2, loadRuntimeContextFromEnv } from "@rig/core/runtime-context";
+import { loadDotEnvSecrets, resolveRuntimeSecrets } from "@rig/core/baked-secrets";
+import { RuntimeEventBus } from "@rig/core/runtime-events";
+
+// packages/provider-plugin/src/agent-harness/git-ops.ts
+import { LIFECYCLE_GIT_AGENT } from "@rig/contracts";
+import { defineCapability } from "@rig/core/capability";
+import { buildPluginHostContext } from "@rig/core/plugin-host-context";
+import { loadCapabilityForRoot } from "@rig/core/capability-loaders";
+var LifecycleGitAgentCap = defineCapability(LIFECYCLE_GIT_AGENT);
+var hostContextByRoot = new Map;
+async function ensureHostContext(projectRoot) {
+  let cached = hostContextByRoot.get(projectRoot);
+  if (!cached) {
+    cached = buildPluginHostContext(projectRoot);
+    hostContextByRoot.set(projectRoot, cached);
+  }
+  await cached;
+}
+async function loadLifecycleGit(projectRoot) {
+  await ensureHostContext(projectRoot);
+  const git = await loadCapabilityForRoot(projectRoot, LifecycleGitAgentCap);
+  if (!git) {
+    throw new Error("lifecycle git capability unavailable: load @rig/bundle-default-lifecycle (default bundle) before running rig-agent git commands.");
+  }
+  return git;
+}
+
+// packages/provider-plugin/src/agent-harness/rig-agent.ts
+import {
+  setProfile,
+  setReviewProfile,
+  showProfile,
+  showReviewProfile
+} from "@rig/core/profile-ops";
+
+// packages/provider-plugin/src/agent-harness/repo-ops.ts
+import { existsSync as existsSync2, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "fs";
+import { basename, dirname, resolve as resolve2 } from "path";
+import { loadRuntimeContext } from "@rig/core/runtime-context";
+import {
+  MANAGED_REPO_SERVICE_CAPABILITY,
+  TASK_DATA_SERVICE_CAPABILITY
+} from "@rig/contracts";
+import { defineCapability as defineCapability2 } from "@rig/core/capability";
+import { getInstalledCapability, requireInstalledCapability } from "@rig/core/capability-loaders";
+import { resolveHarnessPaths } from "@rig/core/harness-paths";
+var ManagedRepoCap = defineCapability2(MANAGED_REPO_SERVICE_CAPABILITY);
+var getManagedRepoService = () => getInstalledCapability(ManagedRepoCap);
+var TaskDataCap = defineCapability2(TASK_DATA_SERVICE_CAPABILITY);
+var taskData = () => requireInstalledCapability(TaskDataCap, "task-data capability unavailable: load @rig/task-sources-plugin (default bundle) before resolving task repos.");
+function runCapture(command, cwd, env) {
+  const result = Bun.spawnSync(command, {
+    cwd,
+    env: env ? { ...process.env, ...env } : process.env,
+    stdout: "pipe",
+    stderr: "pipe",
+    stdin: "ignore"
+  });
+  return {
+    exitCode: result.exitCode,
+    stdout: result.stdout.toString(),
+    stderr: result.stderr.toString()
+  };
+}
+function readJsonFile(path, fallback) {
+  if (!existsSync2(path))
+    return fallback;
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return fallback;
+  }
+}
+function nowIso() {
+  return new Date().toISOString();
+}
+function managedRepoEntries() {
+  return getManagedRepoService()?.listManagedRepoEntries() ?? [];
+}
+function requireManagedRepoService() {
+  const service = getManagedRepoService();
+  if (!service) {
+    throw new Error("managed-repo service not installed: configure @rig/repos-plugin in rig.config to use managed-repo operations.");
+  }
+  return service;
+}
+function primaryManagedRepoId() {
+  const entries = managedRepoEntries();
+  return entries.length > 0 ? entries[0].id : null;
+}
+function primaryManagedRepoAlias() {
+  const entries = managedRepoEntries();
+  return entries.length > 0 ? entries[0].alias : null;
+}
+function repoEnsure(projectRoot, taskId) {
+  const monorepo = ensureMonorepoReady(projectRoot);
+  const resolvedTask = taskId || taskData().currentTaskId(projectRoot);
+  if (!resolvedTask) {
+    if (monorepo) {
+      const alias = primaryManagedRepoAlias();
+      if (alias) {
+        persistBaselinePins(projectRoot, { [alias]: monorepo.headCommit });
+      }
+    }
+    console.log("No active task. Refreshed baseline repo pins.");
+    return;
+  }
+  const pins = resolvedPins(projectRoot, resolvedTask);
+  applyPins(projectRoot, pins);
+  verifyPins(projectRoot, pins);
+}
+function repoPins(projectRoot, taskId) {
+  const resolvedTask = taskId || taskData().currentTaskId(projectRoot);
+  if (!resolvedTask) {
+    return {};
+  }
+  return resolvedPins(projectRoot, resolvedTask);
+}
+function repoVerify(projectRoot, taskId) {
+  const resolvedTask = taskId || taskData().currentTaskId(projectRoot);
+  if (!resolvedTask) {
+    console.log("No active task. Nothing to verify.");
+    return true;
+  }
+  const pins = resolvedPins(projectRoot, resolvedTask);
+  return verifyPins(projectRoot, pins);
+}
+function repoDiscover(projectRoot, taskId) {
+  const resolvedTask = taskId || taskData().currentTaskId(projectRoot);
+  if (!resolvedTask) {
+    return {};
+  }
+  const explicit = explicitPins(projectRoot, resolvedTask);
+  if (Object.keys(explicit).length > 0) {
+    return explicit;
+  }
+  return discoverPins(projectRoot, resolvedTask);
+}
+function repoBaseline(projectRoot, refresh = false) {
+  const paths = resolveRepoDiscoveryPaths(projectRoot);
+  if (!refresh && existsSync2(paths.baseRepoPinsPath)) {
+    const baseline = readJsonFile(paths.baseRepoPinsPath, { recorded_at: nowIso(), repos: {} });
+    return baseline.repos || {};
+  }
+  const id = primaryManagedRepoId();
+  if (!id) {
+    return persistBaselinePins(projectRoot, {});
+  }
+  const synced = requireManagedRepoService().syncManagedRepo(projectRoot, id);
+  const alias = primaryManagedRepoAlias() ?? id;
+  return persistBaselinePins(projectRoot, { [alias]: synced.headCommit });
+}
+function ensureMonorepoReady(projectRoot) {
+  const id = primaryManagedRepoId();
+  if (!id) {
+    return null;
+  }
+  const synced = requireManagedRepoService().syncManagedRepo(projectRoot, id);
+  const sha = synced.headCommit.slice(0, 7);
+  console.log(`Monorepo ready: ${synced.layout.alias}@${sha}`);
+  return synced;
+}
+function persistBaselinePins(projectRoot, repos) {
+  const paths = resolveRepoDiscoveryPaths(projectRoot);
+  mkdirSync(resolve2(paths.baseRepoPinsPath, ".."), { recursive: true });
+  writeFileSync(paths.baseRepoPinsPath, `${JSON.stringify({ recorded_at: nowIso(), repos }, null, 2)}
+`, "utf-8");
+  return repos;
+}
+function resolvedPins(projectRoot, taskId) {
+  const explicit = explicitPins(projectRoot, taskId);
+  if (Object.keys(explicit).length > 0) {
+    return explicit;
+  }
+  return discoverPins(projectRoot, taskId);
+}
+function explicitPins(projectRoot, taskId) {
+  const repoPins2 = readRepoDiscoveryTaskConfig(projectRoot)[taskId]?.repo_pins || {};
+  const normalized = {};
+  const validAliases = new Set(managedRepoEntries().map((e) => e.alias));
+  for (const [key, value] of Object.entries(repoPins2)) {
+    if (!value) {
+      continue;
+    }
+    if (validAliases.size > 0 && !validAliases.has(key)) {
+      throw new Error(`Unsupported repo pin key for ${taskId}: ${key}. Known aliases: ${[...validAliases].join(", ") || "(none registered)"}`);
+    }
+    const existing = normalized[key];
+    if (existing && existing !== value) {
+      throw new Error(`Conflicting explicit repo pins for ${key}: ${existing} vs ${value}`);
+    }
+    normalized[key] = value;
+  }
+  return normalized;
+}
+function taskDependencies(projectRoot, taskId) {
+  return taskData().taskDependencyIds(projectRoot, taskId);
+}
+function discoverPins(projectRoot, taskId) {
+  const deps = taskDependencies(projectRoot, taskId);
+  if (deps.length === 0) {
+    return repoBaseline(projectRoot, true);
+  }
+  const paths = resolveRepoDiscoveryPaths(projectRoot);
+  const state = readJsonFile(paths.taskRepoCommitsPath, {});
+  const pinKeys = managedRepoEntries().map((e) => e.alias);
+  if (pinKeys.length === 0) {
+    return {};
+  }
+  const discovered = {};
+  for (const key of pinKeys) {
+    const commits = new Set;
+    for (const dep of deps) {
+      const fromState = state[dep]?.repos?.[key];
+      if (fromState) {
+        commits.add(fromState);
+      }
+      const fromArtifact = readPinFromArtifact(projectRoot, dep, key);
+      if (fromArtifact) {
+        commits.add(fromArtifact);
+      }
+    }
+    if (commits.size > 1) {
+      const values = [...commits].join(`
+  - `);
+      throw new Error(`Conflicting discovered pins for ${key} from dependency graph of ${taskId}:
+  - ${values}`);
+    }
+    if (commits.size === 1) {
+      discovered[key] = [...commits][0];
+    }
+  }
+  return discovered;
+}
+function readRepoDiscoveryTaskConfig(projectRoot) {
+  try {
+    return taskData().readSourceTaskConfig(projectRoot);
+  } catch {
+    return taskData().readTaskConfig(projectRoot);
+  }
+}
+function resolveRepoDiscoveryPaths(projectRoot) {
+  const monorepoRoot = requireManagedRepoService().resolveMonorepoRepoLayout(projectRoot).checkoutRoot;
+  const explicitHostProjectRoot = (process.env.RIG_HOST_PROJECT_ROOT || "").trim();
+  const normalizedProjectRoot = resolve2(projectRoot);
+  const hostProjectRoot = explicitHostProjectRoot && shouldUseHostProjectStateRoot(normalizedProjectRoot) ? explicitHostProjectRoot : normalizedProjectRoot;
+  const stateDir = resolve2(hostProjectRoot, ".rig", "state");
+  return {
+    monorepoRoot,
+    taskRepoCommitsPath: resolve2(stateDir, "task-repo-commits.json"),
+    baseRepoPinsPath: resolve2(stateDir, "base-repo-pins.json")
+  };
+}
+function shouldUseHostProjectStateRoot(projectRoot) {
+  const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (runtimeWorkspace && resolve2(runtimeWorkspace) === projectRoot) {
+    return true;
+  }
+  return basename(dirname(projectRoot)) === ".worktrees";
+}
+function readPinFromArtifact(projectRoot, depTask, repoKey) {
+  const snapshot = resolve2(taskData().artifactDirForId(projectRoot, depTask), "git-state.txt");
+  if (!existsSync2(snapshot)) {
+    return "";
+  }
+  const content = readFileSync(snapshot, "utf-8");
+  const chunk = content.split(/\r?\n/);
+  let inSection = false;
+  for (const line of chunk) {
+    if (line.startsWith("## ")) {
+      inSection = line.startsWith(`## ${repoKey}`);
+      continue;
+    }
+    if (!inSection) {
+      continue;
+    }
+    if (line.startsWith("head:")) {
+      return line.replace(/^head:\s*/, "").trim();
+    }
+  }
+  return "";
+}
+function repoPath(projectRoot, key) {
+  const managed = getManagedRepoService()?.resolveManagedRepoLayoutByAlias(projectRoot, key) ?? null;
+  if (managed) {
+    return managed.checkoutRoot;
+  }
+  return key.startsWith("/") ? key : resolve2(projectRoot, key);
+}
+function applyPins(projectRoot, pins) {
+  for (const [key, commit] of Object.entries(pins)) {
+    const path = repoPath(projectRoot, key);
+    if (!existsSync2(resolve2(path, ".git"))) {
+      throw new Error(`Repo for pin not available: ${key} (${path})`);
+    }
+    let hasCommit = runGitCapture(["git", "-C", path, "cat-file", "-e", `${commit}^{commit}`], projectRoot).exitCode === 0;
+    if (!hasCommit) {
+      runGitCapture(["git", "-C", path, "fetch", "--all", "--tags", "--prune"], projectRoot);
+      hasCommit = runGitCapture(["git", "-C", path, "cat-file", "-e", `${commit}^{commit}`], projectRoot).exitCode === 0;
+    }
+    if (!hasCommit) {
+      throw new Error(`Commit not found for ${key}: ${commit}`);
+    }
+    const current = runGitCapture(["git", "-C", path, "rev-parse", "HEAD"], projectRoot).stdout.trim();
+    if (current === commit) {
+      console.log(`Repo pin: ${key} already at ${commit}`);
+      continue;
+    }
+    const branch = runGitCapture(["git", "-C", path, "rev-parse", "--abbrev-ref", "HEAD"], projectRoot).stdout.trim();
+    const checkout = branch.startsWith("rig/") ? runGitCapture(["git", "-C", path, "reset", "--hard", commit], projectRoot) : runGitCapture(["git", "-C", path, "checkout", "--detach", commit], projectRoot);
+    if (checkout.exitCode !== 0) {
+      throw new Error(`Failed to apply repo pin ${key} -> ${commit}:
+${checkout.stderr || checkout.stdout}`);
+    }
+    console.log(`Repo pin: ${key} -> ${commit}`);
+  }
+}
+function verifyPins(projectRoot, pins) {
+  let ok = true;
+  for (const [key, expected] of Object.entries(pins)) {
+    const path = repoPath(projectRoot, key);
+    if (!existsSync2(resolve2(path, ".git"))) {
+      console.error(`ERROR: repo missing during pin verification: ${key}`);
+      ok = false;
+      continue;
+    }
+    const current = runGitCapture(["git", "-C", path, "rev-parse", "HEAD"], projectRoot).stdout.trim();
+    if (current === expected) {
+      console.log(`Repo verify: ${key} at ${current}`);
+    } else {
+      console.error(`ERROR: repo pin mismatch for ${key}: expected ${expected}, got ${current}`);
+      ok = false;
+    }
+  }
+  return ok;
+}
+function runGitCapture(command, projectRoot) {
+  return runCapture(command, projectRoot, resolveRuntimeGitEnv());
+}
+function resolveRuntimeGitEnv() {
+  if (process.env.GIT_SSH_COMMAND?.trim()) {
+    return {
+      HOME: process.env.HOME ?? "",
+      GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND
+    };
+  }
+  const runtimeRoot = process.env.RIG_RUNTIME_HOME?.trim() || (process.env.RIG_RUNTIME_CONTEXT_FILE?.trim() ? resolve2(process.env.RIG_RUNTIME_CONTEXT_FILE, "..") : inferRuntimeRootFromWorkspace(process.cwd()));
+  const runtimeHome = runtimeRoot ? resolve2(runtimeRoot, "home") : process.env.HOME?.trim() || "";
+  if (!runtimeHome) {
+    return;
+  }
+  const knownHostsPath = resolve2(runtimeHome, ".ssh", "known_hosts");
+  if (!existsSync2(knownHostsPath)) {
+    return { HOME: runtimeHome };
+  }
+  const agentSshKey = resolve2(runtimeHome, ".ssh", "rig-agent-key");
+  const sshParts = [
+    "ssh",
+    `-o UserKnownHostsFile="${knownHostsPath}"`,
+    "-o StrictHostKeyChecking=yes",
+    "-F /dev/null"
+  ];
+  if (existsSync2(agentSshKey)) {
+    sshParts.splice(1, 0, `-i "${agentSshKey}"`, "-o IdentitiesOnly=yes");
+  }
+  return {
+    HOME: runtimeHome,
+    GIT_SSH_COMMAND: sshParts.join(" ")
+  };
+}
+function inferRuntimeRootFromWorkspace(cwd) {
+  const contextPath = findRuntimeContextFile(cwd);
+  if (!contextPath || !existsSync2(contextPath)) {
+    return "";
+  }
+  try {
+    loadRuntimeContext(contextPath);
+    return resolve2(contextPath, "..");
+  } catch {
+    return "";
+  }
+}
+function findRuntimeContextFile(startPath) {
+  let current = resolve2(startPath);
+  while (true) {
+    const candidate = resolve2(current, "runtime-context.json");
+    if (existsSync2(candidate)) {
+      return candidate;
+    }
+    const parent = resolve2(current, "..");
+    if (parent === current) {
+      return "";
+    }
+    current = parent;
+  }
+}
+
+// packages/provider-plugin/src/agent-harness/task-data.ts
+import { TASK_DATA_SERVICE_CAPABILITY as TASK_DATA_SERVICE_CAPABILITY2 } from "@rig/contracts";
+import { defineCapability as defineCapability3 } from "@rig/core/capability";
+import { requireInstalledCapability as requireInstalledCapability2 } from "@rig/core/capability-loaders";
+var TaskDataCap2 = defineCapability3(TASK_DATA_SERVICE_CAPABILITY2);
+function taskData2() {
+  return requireInstalledCapability2(TaskDataCap2, "task-data capability unavailable: load @rig/task-sources-plugin (default bundle) before running the provider agent harness.");
+}
+
+// packages/provider-plugin/src/agent-harness/task-ops.ts
+function taskArtifactDir(projectRoot, taskId) {
+  return taskData2().taskArtifactDir(projectRoot, taskId);
+}
+function taskArtifacts(projectRoot, taskId) {
+  taskData2().taskArtifacts(projectRoot, taskId);
+}
+function taskArtifactWrite(projectRoot, filename, content, taskId) {
+  taskData2().taskArtifactWrite(projectRoot, filename, content, taskId);
+}
+function taskDeps(projectRoot, taskId) {
+  return taskData2().taskDeps(projectRoot, taskId);
+}
+function taskInfo(projectRoot, taskId) {
+  return taskData2().taskInfo(projectRoot, taskId);
+}
+function taskLookup(projectRoot, id) {
+  return taskData2().taskLookup(projectRoot, id);
+}
+function taskRecord(projectRoot, type, text, taskId) {
+  taskData2().taskRecord(projectRoot, type, text, taskId);
+}
+function taskScope(projectRoot, expandFiles, taskId) {
+  return taskData2().taskScope(projectRoot, expandFiles, taskId);
+}
+function taskStatus(projectRoot) {
+  taskData2().taskStatus(projectRoot);
+}
+function taskValidate(projectRoot, taskId, validatorRegistry) {
+  return taskData2().taskValidate(projectRoot, taskId, validatorRegistry);
+}
+
+// packages/provider-plugin/src/agent-harness/rig-agent.ts
+var BUILD_CONFIG = readBuildConfig();
+var BAKED_BINARY_PATH = BUILD_CONFIG.AGENT_BINARY_PATH ?? "";
+var BAKED_MANIFEST_PATH = BUILD_CONFIG.AGENT_MANIFEST_PATH ?? "";
+var BAKED_PROJECT_ROOT = BUILD_CONFIG.AGENT_PROJECT_ROOT ?? "";
+var BAKED_RUNTIME_ID = BUILD_CONFIG.AGENT_RUNTIME_ID ?? "";
+var BAKED_TASK_ID = BUILD_CONFIG.AGENT_TASK_ID ?? "";
+var BAKED_SCOPE_HASH = BUILD_CONFIG.AGENT_SCOPE_HASH ?? "";
+var BAKED_INFO_OUTPUT = BUILD_CONFIG.AGENT_INFO_OUTPUT ?? "";
+var BAKED_DEPS_OUTPUT = BUILD_CONFIG.AGENT_DEPS_OUTPUT ?? "";
+var BAKED_STATUS_OUTPUT = BUILD_CONFIG.AGENT_STATUS_OUTPUT ?? "";
+var BAKED_GIT_BRANCH = BUILD_CONFIG.AGENT_GIT_BRANCH ?? "";
+var BAKED_BASE_COMMIT = BUILD_CONFIG.AGENT_BASE_COMMIT ?? "";
+if (BAKED_BINARY_PATH) {
+  const binaryDir = dirname2(BAKED_BINARY_PATH);
+  const currentPath = process.env.PATH || "";
+  const pathEntries = currentPath.split(":").filter(Boolean);
+  if (!pathEntries.includes(binaryDir)) {
+    process.env.PATH = currentPath ? `${binaryDir}:${currentPath}` : binaryDir;
+  }
+}
+var cachedContext;
+var cachedEventBus;
+function getContext() {
+  if (cachedContext !== undefined)
+    return cachedContext;
+  cachedContext = loadRuntimeContextFromEnv() ?? inferRuntimeContext();
+  return cachedContext;
+}
+function getEventBus() {
+  if (cachedEventBus !== undefined) {
+    return cachedEventBus ?? undefined;
+  }
+  const ctx = getContext();
+  if (!ctx) {
+    cachedEventBus = null;
+    return;
+  }
+  const runId = ctx.runtimeId || BAKED_RUNTIME_ID || "";
+  cachedEventBus = new RuntimeEventBus({
+    projectRoot: ctx.workspaceDir,
+    ...runId ? { runId } : {}
+  });
+  return cachedEventBus;
+}
+function inferRuntimeContext() {
+  for (const candidate of runtimeContextCandidates()) {
+    if (!candidate || !existsSync3(candidate)) {
+      continue;
+    }
+    try {
+      process.env.RIG_RUNTIME_CONTEXT_FILE = candidate;
+      return loadRuntimeContext2(candidate);
+    } catch {}
+  }
+  return null;
+}
+function runtimeContextCandidates() {
+  const cwd = process.cwd();
+  const candidates = [
+    resolve3(cwd, "..", "runtime-context.json"),
+    resolve3(cwd, ".rig", "runtime-context.json")
+  ];
+  const argv1 = process.argv[1]?.trim();
+  if (argv1) {
+    candidates.push(resolve3(argv1, "..", "..", "runtime-context.json"));
+  }
+  if (BAKED_BINARY_PATH) {
+    candidates.push(resolve3(BAKED_BINARY_PATH, "..", "..", "runtime-context.json"));
+  }
+  return Array.from(new Set(candidates));
+}
+function sha256Hex(input) {
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(input);
+  return hasher.digest("hex");
+}
+var GITHUB_KNOWN_HOSTS = [
+  "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl",
+  "github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=",
+  "github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk="
+];
+function ensureRuntimeKnownHosts(runtimeHome) {
+  const sshDir = resolve3(runtimeHome, ".ssh");
+  const knownHostsPath = resolve3(sshDir, "known_hosts");
+  if (!existsSync3(sshDir)) {
+    mkdirSync2(sshDir, { recursive: true });
+  }
+  const existing = existsSync3(knownHostsPath) ? readFileSync2(knownHostsPath, "utf-8") : "";
+  const existingLines = new Set(existing.split(/\r?\n/).map((line) => line.trim()).filter(Boolean));
+  const missing = GITHUB_KNOWN_HOSTS.filter((line) => !existingLines.has(line));
+  if (missing.length === 0) {
+    return knownHostsPath;
+  }
+  try {
+    for (const line of missing) {
+      existingLines.add(line);
+    }
+    writeFileSync2(knownHostsPath, `${Array.from(existingLines).join(`
+`)}
+`, { mode: 420 });
+  } catch (err) {
+    const hint = existsSync3(knownHostsPath) ? "" : " \u2014 known_hosts is missing; git SSH operations may fail";
+    console.warn(`[rig-agent] Could not update ${knownHostsPath}: ${err instanceof Error ? err.message : String(err)}${hint}`);
+  }
+  return knownHostsPath;
+}
+function hydrateRuntimeProcessEnv(ctx) {
+  if (!ctx) {
+    return;
+  }
+  const contextFile = process.env.RIG_RUNTIME_CONTEXT_FILE?.trim() || inferRuntimeContextFileFromWorkspace(ctx.workspaceDir);
+  if (!contextFile) {
+    return;
+  }
+  process.env.RIG_RUNTIME_CONTEXT_FILE = contextFile;
+  const runtimeRoot = dirname2(resolve3(contextFile));
+  const runtimeHome = resolve3(runtimeRoot, "home");
+  const runtimeTmp = resolve3(runtimeRoot, "tmp");
+  const runtimeCache = resolve3(runtimeRoot, "cache");
+  const runtimeBin = resolve3(runtimeRoot, "bin");
+  const runtimeWorkspaceBin = resolve3(ctx.workspaceDir, ".rig", "bin");
+  const runtimeTools = resolve3(ctx.workspaceDir, "rig", "tools");
+  if (ctx.hostProjectRoot) {
+    process.env.PROJECT_RIG_ROOT = ctx.hostProjectRoot;
+  }
+  process.env.RIG_TASK_ID = ctx.taskId;
+  process.env.RIG_TASK_WORKSPACE = ctx.workspaceDir;
+  process.env.RIG_STATE_DIR = ctx.stateDir;
+  process.env.RIG_LOGS_DIR = ctx.logsDir;
+  process.env.RIG_SESSION_FILE = ctx.sessionFile;
+  process.env.RIG_RUNTIME_HOME = runtimeRoot;
+  if (!process.env.RIG_HOST_PROJECT_ROOT && ctx.hostProjectRoot) {
+    process.env.RIG_HOST_PROJECT_ROOT = ctx.hostProjectRoot;
+  }
+  for (const [key, value] of Object.entries(browserEnvFromContext(ctx.browser))) {
+    process.env[key] = value;
+  }
+  if (existsSync3(runtimeHome)) {
+    process.env.HOME = runtimeHome;
+  }
+  if (existsSync3(runtimeTmp)) {
+    process.env.TMPDIR = runtimeTmp;
+  }
+  if (existsSync3(runtimeCache)) {
+    process.env.XDG_CACHE_HOME = runtimeCache;
+  }
+  const workspaceSecrets = loadDotEnvSecrets(ctx.workspaceDir, process.env);
+  const hostWorkspaceSecrets = ctx.hostProjectRoot && ctx.hostProjectRoot !== ctx.workspaceDir ? loadDotEnvSecrets(ctx.hostProjectRoot, process.env) : {};
+  const resolvedSecrets = resolveRuntimeSecrets(process.env, {
+    ...hostWorkspaceSecrets,
+    ...workspaceSecrets
+  });
+  for (const [key, value] of Object.entries(resolvedSecrets)) {
+    if (value && !process.env[key]) {
+      process.env[key] = value;
+    }
+  }
+  if (!process.env.GITHUB_TOKEN && process.env.GH_TOKEN) {
+    process.env.GITHUB_TOKEN = process.env.GH_TOKEN;
+  }
+  if (!process.env.GH_TOKEN && process.env.GITHUB_TOKEN) {
+    process.env.GH_TOKEN = process.env.GITHUB_TOKEN;
+  }
+  if (!process.env.GREPTILE_GITHUB_TOKEN && process.env.GITHUB_TOKEN) {
+    process.env.GREPTILE_GITHUB_TOKEN = process.env.GITHUB_TOKEN;
+  }
+  const currentPath = process.env.PATH || "";
+  const pathEntries = currentPath.split(":").filter(Boolean);
+  for (const entry of [runtimeBin, runtimeWorkspaceBin, runtimeTools, "/usr/bin", "/bin", "/usr/sbin", "/sbin"]) {
+    if (existsSync3(entry) && !pathEntries.includes(entry)) {
+      pathEntries.unshift(entry);
+    }
+  }
+  process.env.PATH = pathEntries.join(":");
+  if (!process.env.RIG_GIT_BIN) {
+    const runtimeGit = resolve3(runtimeBin, "git");
+    process.env.RIG_GIT_BIN = existsSync3(runtimeGit) ? runtimeGit : Bun.which("git") || "/usr/bin/git";
+  }
+  const knownHosts = ensureRuntimeKnownHosts(runtimeHome);
+  const agentKey = resolve3(runtimeHome, ".ssh", "rig-agent-key");
+  const sshParts = [
+    "ssh",
+    `-o UserKnownHostsFile="${knownHosts}"`,
+    "-o StrictHostKeyChecking=yes",
+    "-F /dev/null"
+  ];
+  if (existsSync3(agentKey)) {
+    sshParts.splice(1, 0, `-i "${agentKey}"`, "-o IdentitiesOnly=yes");
+  }
+  process.env.GIT_SSH_COMMAND = sshParts.join(" ");
+}
+function inferRuntimeContextFileFromWorkspace(workspaceDir) {
+  const candidate = resolve3(workspaceDir, "..", "runtime-context.json");
+  return existsSync3(candidate) ? candidate : "";
+}
+async function main() {
+  const args = process.argv.slice(2);
+  hydrateRuntimeProcessEnv(getContext());
+  if (isVersionProbe(args)) {
+    await printVersion();
+    return;
+  }
+  if (args[0] === "internal") {
+    await runInternal(args.slice(1));
+    return;
+  }
+  const ctx = getContext();
+  if (!BAKED_PROJECT_ROOT && !ctx) {
+    console.error("[rig-agent] Runtime binary is missing baked task context and no runtime context file found.");
+    console.error("[rig-agent] Set RIG_RUNTIME_CONTEXT_FILE or use the compiled host dispatch binary.");
+    process.exit(1);
+  }
+  await verifyRuntimeManifest();
+  const commandResult = await runAgentCommand(args);
+  if (commandResult !== undefined) {
+    process.exit(commandResult);
+  }
+  if (looksLikeShellInvocation(args)) {
+    const code = await runControlledBash(args, { projectRootFallbackDir: import.meta.dir });
+    process.exit(code);
+  }
+  console.error(`[rig-agent] Unknown command: ${args[0] || "(none)"}. Run 'rig-agent help' for usage.`);
+  process.exit(1);
+}
+function isVersionProbe(args) {
+  if (args.length !== 1) {
+    return false;
+  }
+  return args[0] === "--version" || args[0] === "-v" || args[0] === "version";
+}
+async function printVersion() {
+  const probe = await Bun.$`claude --version`.cwd(process.cwd()).env(process.env).quiet().nothrow();
+  if (probe.exitCode === 0) {
+    const output = probe.stdout.toString().trim();
+    if (output) {
+      console.log(output);
+      return;
+    }
+  }
+  console.log("rig-agent 1.0.0");
+}
+var TASK_COMMANDS = new Set([
+  "info",
+  "scope",
+  "deps",
+  "status",
+  "artifacts",
+  "artifact-dir",
+  "artifact-write",
+  "project-root",
+  "monorepo-root",
+  "validate",
+  "lookup",
+  "record",
+  "help",
+  "completion-verification",
+  "completition-verification",
+  "git",
+  "repo",
+  "repo-sync",
+  "profile",
+  "review",
+  "memory"
+]);
+async function runAgentCommand(args) {
+  const [command, ...rest] = args;
+  if (!command || !TASK_COMMANDS.has(command)) {
+    return;
+  }
+  const ctx = getContext();
+  const projectRoot = ctx?.workspaceDir || BAKED_PROJECT_ROOT || "";
+  const taskId = ctx?.taskId || BAKED_TASK_ID || "";
+  if (!projectRoot) {
+    console.error("[rig-agent] No project root baked in.");
+    return 1;
+  }
+  if (!taskId) {
+    console.error("[rig-agent] No task ID baked in.");
+    return 1;
+  }
+  try {
+    switch (command) {
+      case "info":
+        await taskInfo(projectRoot, taskId);
+        return 0;
+      case "scope":
+        await taskScope(projectRoot, rest.includes("--files"), taskId);
+        return 0;
+      case "deps":
+        await taskDeps(projectRoot, taskId);
+        return 0;
+      case "status":
+        taskStatus(projectRoot);
+        return 0;
+      case "artifacts":
+        taskArtifacts(projectRoot, taskId);
+        return 0;
+      case "artifact-dir":
+        console.log(taskArtifactDir(projectRoot, taskId));
+        return 0;
+      case "project-root":
+        console.log(projectRoot);
+        return 0;
+      case "monorepo-root":
+        console.log(resolveMonorepoRoot(projectRoot));
+        return 0;
+      case "artifact-write": {
+        const filename = rest[0];
+        if (!filename) {
+          console.error(`Usage: rig-agent artifact-write <filename> [--file <path>]
+` + `  Reads content from stdin (or --file), writes to the active task artifact dir.
+` + "  Example: echo '...' | rig-agent artifact-write collection-audit.md");
+          return 1;
+        }
+        let content;
+        const fileIdx = rest.indexOf("--file");
+        const inputFile = fileIdx !== -1 ? rest[fileIdx + 1] : undefined;
+        if (inputFile) {
+          content = readFileSync2(resolve3(projectRoot, inputFile), "utf-8");
+        } else {
+          const chunks = [];
+          for await (const chunk of process.stdin) {
+            chunks.push(Buffer.from(chunk));
+          }
+          content = Buffer.concat(chunks).toString("utf-8");
+        }
+        taskArtifactWrite(projectRoot, filename, content, taskId);
+        return 0;
+      }
+      case "validate": {
+        const passed = await taskValidate(projectRoot, taskId);
+        return passed ? 0 : 1;
+      }
+      case "completion-verification":
+      case "completition-verification":
+        return await runCompletionVerification(projectRoot);
+      case "lookup": {
+        if (rest.length !== 1) {
+          console.error("Usage: rig-agent lookup <beads-id>");
+          return 1;
+        }
+        const lookupId = rest[0];
+        if (!lookupId) {
+          console.error("Usage: rig-agent lookup <beads-id>");
+          return 1;
+        }
+        console.log(taskLookup(projectRoot, lookupId));
+        return 0;
+      }
+      case "record": {
+        if (rest.length < 2) {
+          console.error("Usage: rig-agent record <decision|failure> <text>");
+          return 1;
+        }
+        const type = rest[0];
+        if (type !== "decision" && type !== "failure") {
+          console.error("Usage: rig-agent record <decision|failure> <text>");
+          return 1;
+        }
+        taskRecord(projectRoot, type, rest.slice(1).join(" "), taskId);
+        return 0;
+      }
+      case "memory": {
+        const memoryService = await loadCapabilityForRoot2(projectRoot, defineCapability4(MEMORY));
+        if (!memoryService) {
+          console.error("[rig-agent] Shared memory requires the @rig/memory-plugin plugin in rig.config.");
+          return 1;
+        }
+        const eventBus = getEventBus();
+        console.log(await memoryService.executeMemoryCommand({
+          projectRoot,
+          taskId,
+          runtimeContext: ctx,
+          args: rest,
+          ...eventBus ? { eventBus } : {}
+        }));
+        return 0;
+      }
+      case "git":
+        await runGitCommand(projectRoot, taskId, rest);
+        return 0;
+      case "repo":
+      case "repo-sync":
+        runRepoSyncCommand(projectRoot, taskId, rest);
+        return 0;
+      case "profile":
+        runProfileCommand(projectRoot, rest);
+        return 0;
+      case "review":
+        runReviewCommand(projectRoot, rest);
+        return 0;
+      case "help":
+        printAgentHelp();
+        return 0;
+      default:
+        return;
+    }
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    return 1;
+  }
+}
+async function runGitCommand(projectRoot, bakedTaskId, args) {
+  const [sub = "status", ...rest] = args;
+  const task = takeOption(rest, "--task");
+  const tid = task.value || bakedTaskId;
+  const flags = task.rest;
+  const git = await loadLifecycleGit(projectRoot);
+  switch (sub) {
+    case "status":
+      git.gitStatus(projectRoot, tid);
+      return;
+    case "changed": {
+      const scoped = flags.includes("--scoped");
+      const files = git.gitChanged(projectRoot, tid, scoped);
+      console.log(files.length > 0 ? files.join(`
+`) : "(none)");
+      return;
+    }
+    case "preflight": {
+      const strict = flags.includes("--strict");
+      const ok = git.gitPreflight(projectRoot, tid, strict);
+      if (!ok)
+        throw new Error("Git preflight failed.");
+      return;
+    }
+    case "sync-branch":
+    case "ensure-branch":
+      git.gitSyncBranch(projectRoot, tid);
+      return;
+    case "commit": {
+      const target = takeOption(flags, "--target");
+      const message = takeOption(target.rest, "--message");
+      const allowEmpty = message.rest.includes("--allow-empty");
+      const scoped = git.shouldScopeGitCommit(message.rest, Boolean(tid));
+      git.gitCommit({
+        projectRoot,
+        taskId: tid,
+        target: target.value || "monorepo",
+        allowEmpty,
+        scoped,
+        ...message.value ? { message: message.value } : {}
+      });
+      return;
+    }
+    case "snapshot": {
+      const output = takeOption(flags, "--output");
+      const file = git.gitSnapshot(projectRoot, tid, output.value);
+      console.log(`Snapshot written: ${file}`);
+      return;
+    }
+    case "open-pr": {
+      const target = takeOption(flags, "--target");
+      const reviewer = takeOption(target.rest, "--reviewer");
+      const base = takeOption(reviewer.rest, "--base");
+      const title = takeOption(base.rest, "--title");
+      const body = takeOption(title.rest, "--body");
+      const draft = body.rest.includes("--draft");
+      const result = git.gitOpenPr({
+        projectRoot,
+        taskId: tid,
+        ...target.value ? { target: target.value } : {},
+        ...reviewer.value ? { reviewer: reviewer.value } : {},
+        ...base.value ? { base: base.value } : {},
+        ...title.value ? { title: title.value } : {},
+        ...body.value ? { body: body.value } : {},
+        draft
+      });
+      console.log(`PR ready (${result.repoLabel}): ${result.url}`);
+      console.log(`Reviewer assigned: ${result.reviewer} (${result.reviewerSource})`);
+      return;
+    }
+    default:
+      throw new Error(`Unknown git subcommand: ${sub}. Try: status, changed, preflight, sync-branch, commit, snapshot, open-pr`);
+  }
+}
+function runRepoSyncCommand(projectRoot, bakedTaskId, args) {
+  const [sub = "ensure", ...rest] = args;
+  const task = takeOption(rest, "--task");
+  const tid = task.value || bakedTaskId;
+  switch (sub) {
+    case "sync":
+    case "ensure":
+      repoEnsure(projectRoot, tid);
+      return;
+    case "pins": {
+      const pins = repoPins(projectRoot, tid);
+      printPins(pins);
+      return;
+    }
+    case "verify": {
+      const ok = repoVerify(projectRoot, tid);
+      if (!ok)
+        throw new Error("Repo pin verification failed.");
+      return;
+    }
+    case "discover": {
+      const pins = repoDiscover(projectRoot, tid);
+      printPins(pins);
+      return;
+    }
+    case "baseline": {
+      const refresh = task.rest.includes("--refresh");
+      const pins = repoBaseline(projectRoot, refresh);
+      printPins(pins);
+      return;
+    }
+    default:
+      throw new Error(`Unknown repo subcommand: ${sub}. Try: sync, ensure, pins, verify, discover, baseline`);
+  }
+}
+function runProfileCommand(projectRoot, args) {
+  const [sub = "show", ...rest] = args;
+  if (sub === "show") {
+    showProfile(projectRoot, rest.includes("--compact"));
+    return;
+  }
+  if (sub === "set") {
+    const first = rest[0];
+    if (first === "claude-code" || first === "codex-cli" || first === "codex-app-server") {
+      setProfile(projectRoot, { preset: first });
+      return;
+    }
+    const model = takeOption(rest, "--model");
+    const runtime = takeOption(model.rest, "--runtime");
+    const plugin = takeOption(runtime.rest, "--plugin");
+    setProfile(projectRoot, {
+      ...model.value ? { model: model.value } : {},
+      ...runtime.value ? { runtime: runtime.value } : {},
+      ...plugin.value ? { plugin: plugin.value } : {}
+    });
+    return;
+  }
+  throw new Error(`Unknown profile subcommand: ${sub}. Try: show, set`);
+}
+function runReviewCommand(projectRoot, args) {
+  const [sub = "show", ...rest] = args;
+  if (sub === "show") {
+    showReviewProfile(projectRoot);
+    return;
+  }
+  if (sub === "set") {
+    const mode = rest[0];
+    if (!mode) {
+      throw new Error("Usage: rig-agent review set <off|advisory|required> [--provider github|greptile]");
+    }
+    const provider = takeOption(rest.slice(1), "--provider");
+    setReviewProfile(projectRoot, mode, provider.value);
+    return;
+  }
+  throw new Error(`Unknown review subcommand: ${sub}. Try: show, set`);
+}
+function takeOption(args, option) {
+  const rest = [];
+  let value;
+  for (let i = 0;i < args.length; i += 1) {
+    const current = args[i];
+    if (current === option) {
+      const next = args[i + 1];
+      if (!next || next.startsWith("-")) {
+        throw new Error(`Missing value for ${option}`);
+      }
+      value = next;
+      i += 1;
+      continue;
+    }
+    if (current !== undefined) {
+      rest.push(current);
+    }
+  }
+  return { value, rest };
+}
+function printPins(pins) {
+  if (Object.keys(pins).length === 0) {
+    console.log("(none)");
+    return;
+  }
+  for (const [key, value] of Object.entries(pins)) {
+    console.log(`${key}	${value}`);
+  }
+}
+function printAgentHelp() {
+  console.log(`rig-agent \u2014 CLI for Project Rig agents
+
+ORIENTATION:
+  rig-agent info              Your task, role, scope, deps \u2014 start here
+  rig-agent scope [--files]   Scope globs; --files expands to file list
+  rig-agent deps              Read dependency artifacts (decisions, next-actions)
+  rig-agent lookup <id>       Validate a beads task ID
+  rig-agent status            Epic/task progress overview
+
+EXECUTION:
+  rig-agent validate          Run validation commands for your task
+  rig-agent record decision "..."  Record an architectural decision
+  rig-agent record failure "..."   Record a failed approach (cross-session only \u2014 not re-read in this session)
+  rig-agent memory observe ...     Promote a shared memory immediately
+  rig-agent memory recall [query]  Recall relevant shared memories
+  rig-agent git status        Task-aware git status
+  rig-agent git changed       Changed files (--scoped for scope-filtered)
+  rig-agent git commit        Task-aware commit (--target monorepo|project|both)
+  rig-agent git snapshot      Capture worktree state
+  rig-agent git sync-branch   Ensure task branch exists
+  rig-agent git open-pr       Create PR for task changes
+  rig-agent repo sync         Ensure monorepo checkout + task repo pins
+  rig-agent profile show      Show runtime profile
+  rig-agent review show       Show AI review gate settings
+
+COMPLETION:
+  rig-agent artifacts                   Scaffold completion artifacts (templates)
+  rig-agent artifact-dir                Print absolute artifact directory path
+  rig-agent project-root                Print absolute task worktree root
+  rig-agent monorepo-root               Print absolute monorepo root in the task worktree
+  rig-agent artifact-write <filename>   Write artifact from stdin
+  rig-agent completion-verification     Run final validation/review gate
+  rig-agent completition-verification   Alias for the same final gate
+
+WORKFLOW:
+  1. rig-agent info            Understand your assignment
+  2. rig-agent deps            Read what prior tasks decided
+  3. rig-agent repo sync         Align monorepo checkout + repo pins
+  4. (do your work)
+  5. rig-agent record decision "chose X because Y"
+  6. rig-agent validate        Check your work
+  7. rig-agent artifacts       Scaffold completion artifacts
+  8. rig-agent artifact-write collection-audit.md  (write custom artifacts)
+  9. rig-agent completion-verification
+`);
+}
+async function runCompletionVerification(projectRoot) {
+  const host = await buildProjectPluginHost(projectRoot);
+  const run = host ? await defineCapability4(COMPLETION_VERIFICATION_CAPABILITY).resolve(host) : null;
+  if (!run) {
+    console.error("[rig-agent] Completion verification requires the @rig/bundle-default-lifecycle plugin in rig.config.");
+    return 1;
+  }
+  const { ok } = await run({ projectRoot });
+  return ok ? 0 : 1;
+}
+async function runInternal(args) {
+  const [command = "", ...rest] = args;
+  if (command === "shell") {
+    const code = await runControlledBash(rest, { projectRootFallbackDir: import.meta.dir });
+    process.exit(code);
+  }
+  if (command === "manifest-verify") {
+    await verifyRuntimeManifest();
+    console.log("manifest: ok");
+    return;
+  }
+  throw new Error("Unknown internal command. Use `rig-agent internal shell <bash-args...>` or `rig-agent internal manifest-verify`.");
+}
+async function verifyRuntimeManifest() {
+  if (getContext()) {
+    return;
+  }
+  const manifestPath = BAKED_MANIFEST_PATH;
+  if (!manifestPath) {
+    return;
+  }
+  if (!existsSync3(manifestPath)) {
+    throw new Error(`[rig-agent] Runtime manifest missing: ${manifestPath}`);
+  }
+  let manifest;
+  try {
+    manifest = await Bun.file(manifestPath).json();
+  } catch (error) {
+    throw new Error(`[rig-agent] Failed to parse runtime manifest at ${manifestPath}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  assertMatch("taskId", BAKED_TASK_ID, manifest.taskId);
+  assertMatch("runtimeId", BAKED_RUNTIME_ID, manifest.runtimeId);
+  assertMatch("scopeHash", BAKED_SCOPE_HASH, manifest.scopeHash);
+  const manifestBinaryPath = manifest.binary?.path || BAKED_BINARY_PATH || process.execPath;
+  const expectedHash = manifest.binary?.sha256 || "";
+  if (!manifestBinaryPath || !expectedHash) {
+    throw new Error(`[rig-agent] Runtime manifest is missing binary hash data (${manifestPath}).`);
+  }
+  if (!existsSync3(manifestBinaryPath)) {
+    throw new Error(`[rig-agent] Runtime binary not found at ${manifestBinaryPath}.`);
+  }
+  const actualHash = sha256Hex(readFileSync2(resolve3(manifestBinaryPath)));
+  if (actualHash !== expectedHash) {
+    throw new Error(`[rig-agent] Runtime manifest mismatch for binary hash.
+` + `expected=${expectedHash}
+` + `actual=${actualHash}
+` + `path=${manifestBinaryPath}`);
+  }
+}
+function assertMatch(name, expected, actual) {
+  if (!expected && !actual) {
+    return;
+  }
+  if (expected !== (actual || "")) {
+    throw new Error(`[rig-agent] Runtime manifest mismatch for ${name}: expected='${expected}' actual='${actual || ""}'.`);
+  }
+}
+main().catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+});
+export {
+  looksLikeShellInvocation
+};