@h-rig/repos-plugin 0.0.6-alpha.156 → 0.0.6-alpha.158

package/dist/src/plugin.js

@@ -1,19 +1,8 @@
 // @bun
-var __defProp = Object.defineProperty;
-var __returnValue = (v) => v;
-function __exportSetter(name, newValue) {
-  this[name] = __returnValue.bind(null, newValue);
-}
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, {
-      get: all[name],
-      enumerable: true,
-      configurable: true,
-      set: __exportSetter.bind(all, name)
-    });
-};
-var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+// packages/repos-plugin/src/plugin.ts
+import { definePlugin } from "@rig/core/config";
+import { defineCapability as defineCapability2 } from "@rig/core/capability";
+import { MANAGED_REPO_SERVICE_CAPABILITY, REPO_OPERATIONS_CAPABILITY } from "@rig/contracts";
 
 // packages/repos-plugin/src/registry.ts
 function createRepoRegistry(entries) {
@@ -29,6 +18,7 @@ function createRepoRegistry(entries) {
     list: () => ordered
   };
 }
+var MANAGED_REPOS = new Map;
 function setManagedRepos(entries) {
   const next = new Map;
   for (const e of entries) {
@@ -66,19 +56,15 @@ function repoRegistrationToManagedEntry(reg) {
     alias: reg.defaultPath ?? reg.id,
     defaultBranch: reg.defaultBranch,
     defaultRemoteUrl: reg.url,
-    remoteEnvVar: reg.remoteEnvVar,
-    checkoutEnvVar: reg.checkoutEnvVar
+    ...reg.remoteEnvVar !== undefined ? { remoteEnvVar: reg.remoteEnvVar } : {},
+    ...reg.checkoutEnvVar !== undefined ? { checkoutEnvVar: reg.checkoutEnvVar } : {}
   };
 }
-var MANAGED_REPOS;
-var init_registry = __esm(() => {
-  MANAGED_REPOS = new Map;
-});
 
 // packages/repos-plugin/src/layout.ts
 import { existsSync } from "fs";
 import { basename, dirname, join, resolve } from "path";
-import { resolveMonorepoRoot } from "@rig/runtime/layout";
+import { resolveMonorepoRoot } from "@rig/core/layout";
 function resolveRepoStateDir(projectRoot) {
   const normalizedProjectRoot = resolve(projectRoot);
   const projectParent = dirname(normalizedProjectRoot);
@@ -129,12 +115,18 @@ function resolveMonorepoRepoLayout(projectRoot) {
   const primary = entries[0];
   return resolveManagedRepoLayout(projectRoot, primary.id);
 }
-var init_layout = __esm(() => {
-  init_registry();
-});
+
+// packages/repos-plugin/src/mirror/refresh.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, realpathSync as realpathSync2, rmSync } from "fs";
+import { resolve as resolve3 } from "path";
+
+// packages/repos-plugin/src/mirror/bootstrap.ts
+import { existsSync as existsSync2, mkdirSync, realpathSync } from "fs";
+import { resolve as resolve2 } from "path";
 
 // packages/repos-plugin/src/mirror/state.ts
-import { readAuthorityProjectStateJson, writeAuthorityProjectStateJson } from "@rig/runtime/control-plane/json-files";
+import { readAuthorityProjectStateJson, writeAuthorityProjectStateJson } from "@rig/core/json-files";
+var STATE_VERSION = 1;
 function defaultMirrorState(projectRoot, repoId) {
   const layout = resolveManagedRepoLayout(projectRoot, repoId);
   return {
@@ -160,14 +152,8 @@ function writeManagedRepoMirrorState(projectRoot, repoId, patch) {
   writeAuthorityProjectStateJson(projectRoot, layout.mirrorStateRelativePath, next);
   return next;
 }
-var STATE_VERSION = 1;
-var init_state = __esm(() => {
-  init_layout();
-});
 
 // packages/repos-plugin/src/mirror/bootstrap.ts
-import { existsSync as existsSync2, mkdirSync, realpathSync } from "fs";
-import { resolve as resolve2 } from "path";
 function nowIso() {
   return new Date().toISOString();
 }
@@ -266,15 +252,8 @@ function ensureManagedRepoMirror(projectRoot, repoId) {
   });
   return layout;
 }
-var init_bootstrap = __esm(() => {
-  init_registry();
-  init_layout();
-  init_state();
-});
 
 // packages/repos-plugin/src/mirror/refresh.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, realpathSync as realpathSync2, rmSync } from "fs";
-import { resolve as resolve3 } from "path";
 function nowIso2() {
   return new Date().toISOString();
 }
@@ -398,50 +377,516 @@ function syncManagedRepo(projectRoot, repoId) {
   }
   return { layout, headCommit };
 }
-var init_refresh = __esm(() => {
-  init_bootstrap();
-  init_state();
-});
 
 // packages/repos-plugin/src/service.ts
-var exports_service = {};
-__export(exports_service, {
-  svc: () => svc,
-  managedRepoService: () => managedRepoService
-});
-var managedRepoService, svc;
-var init_service = __esm(() => {
-  init_registry();
-  init_layout();
-  init_refresh();
-  managedRepoService = {
-    setManagedRepos,
-    listManagedRepoEntries,
-    resolveManagedRepoIdByAlias,
-    repoRegistrationToManagedEntry,
-    createRepoRegistry,
-    resolveManagedRepoLayoutByAlias,
-    resolveMonorepoRepoLayout,
-    syncManagedRepo
+var managedRepoService = {
+  setManagedRepos,
+  listManagedRepoEntries,
+  resolveManagedRepoIdByAlias,
+  repoRegistrationToManagedEntry,
+  createRepoRegistry,
+  resolveManagedRepoLayoutByAlias,
+  resolveMonorepoRepoLayout,
+  syncManagedRepo
+};
+var svc = managedRepoService;
+
+// packages/repos-plugin/src/repo-operations.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync, readdirSync, rmSync as rmSync2, writeFileSync } from "fs";
+import { basename as basename2, dirname as dirname2, resolve as resolve4 } from "path";
+import { CliError, TASK_DATA_SERVICE_CAPABILITY } from "@rig/contracts";
+import { defineCapability } from "@rig/core/capability";
+import { requireInstalledCapability } from "@rig/core/capability-loaders";
+import { loadRuntimeContext } from "@rig/core/runtime-context";
+import { resolveHarnessPaths } from "@rig/core/harness-paths";
+import { nowIso as nowIso3, readJsonFile, runCapture } from "@rig/core/exec";
+var TaskDataCap = defineCapability(TASK_DATA_SERVICE_CAPABILITY);
+var taskData = () => requireInstalledCapability(TaskDataCap, "task-data capability unavailable: load @rig/task-sources-plugin (default bundle) before resolving task repos.");
+function managedRepoEntries() {
+  return managedRepoService.listManagedRepoEntries();
+}
+function primaryManagedRepoId() {
+  const entries = managedRepoEntries();
+  return entries.length > 0 ? entries[0].id : null;
+}
+function primaryManagedRepoAlias() {
+  const entries = managedRepoEntries();
+  return entries.length > 0 ? entries[0].alias : null;
+}
+function ensureMonorepoReady(projectRoot) {
+  const id = primaryManagedRepoId();
+  if (!id) {
+    return null;
+  }
+  const synced = managedRepoService.syncManagedRepo(projectRoot, id);
+  const sha = synced.headCommit.slice(0, 7);
+  console.log(`Monorepo ready: ${synced.layout.alias}@${sha}`);
+  return synced;
+}
+function repoEnsure(projectRoot, taskId) {
+  const monorepo = ensureMonorepoReady(projectRoot);
+  const resolvedTask = taskId || taskData().currentTaskId(projectRoot);
+  if (!resolvedTask) {
+    if (monorepo) {
+      const alias = primaryManagedRepoAlias();
+      if (alias) {
+        persistBaselinePins(projectRoot, { [alias]: monorepo.headCommit });
+      }
+    }
+    console.log("No active task. Refreshed baseline repo pins.");
+    return;
+  }
+  const pins = resolvedPins(projectRoot, resolvedTask);
+  applyPins(projectRoot, pins);
+  verifyPins(projectRoot, pins);
+}
+function repoPins(projectRoot, taskId) {
+  const resolvedTask = taskId || taskData().currentTaskId(projectRoot);
+  if (!resolvedTask) {
+    return {};
+  }
+  return resolvedPins(projectRoot, resolvedTask);
+}
+function repoVerify(projectRoot, taskId) {
+  const resolvedTask = taskId || taskData().currentTaskId(projectRoot);
+  if (!resolvedTask) {
+    console.log("No active task. Nothing to verify.");
+    return true;
+  }
+  const pins = resolvedPins(projectRoot, resolvedTask);
+  return verifyPins(projectRoot, pins);
+}
+function repoDiscover(projectRoot, taskId) {
+  const resolvedTask = taskId || taskData().currentTaskId(projectRoot);
+  if (!resolvedTask) {
+    return {};
+  }
+  const explicit = explicitPins(projectRoot, resolvedTask);
+  if (Object.keys(explicit).length > 0) {
+    return explicit;
+  }
+  return discoverPins(projectRoot, resolvedTask);
+}
+function repoBaseline(projectRoot, refresh = false) {
+  const paths = resolveRepoDiscoveryPaths(projectRoot);
+  if (!refresh && existsSync4(paths.baseRepoPinsPath)) {
+    const baseline = readJsonFile(paths.baseRepoPinsPath, { recorded_at: nowIso3(), repos: {} });
+    return baseline.repos || {};
+  }
+  const id = primaryManagedRepoId();
+  if (!id) {
+    return persistBaselinePins(projectRoot, {});
+  }
+  const synced = managedRepoService.syncManagedRepo(projectRoot, id);
+  const alias = primaryManagedRepoAlias() ?? id;
+  return persistBaselinePins(projectRoot, { [alias]: synced.headCommit });
+}
+function resetBaseline(projectRoot, keepTaskStatus) {
+  const paths = resolveHarnessPaths(projectRoot);
+  const label = primaryManagedRepoAlias() ?? "monorepo";
+  resetRepoToOriginMain(projectRoot, paths.monorepoRoot, label);
+  deleteBranches(projectRoot, paths.monorepoRoot, label, "rig/*");
+  deleteBranches(projectRoot, projectRoot, "project-rig", "codex/*");
+  repoBaseline(projectRoot, true);
+  console.log("OK: refreshed baseline repo pins");
+  if (!keepTaskStatus) {
+    reopenClosedTasks(projectRoot);
+  } else {
+    console.log("INFO: task status unchanged (--keep-task-status)");
+  }
+  clearDirectory(paths.artifactsDir, ".gitkeep");
+  clearDirectory(paths.logsDir, ".gitkeep");
+  for (const stateFile of ["hook_trips.log", "task-repo-commits.json", "current-task-id.txt"]) {
+    rmSync2(resolve4(paths.stateDir, stateFile), { force: true });
+  }
+  console.log("OK: cleared harness artifacts/logs/runtime state");
+  console.log("");
+  console.log("Baseline reset complete.");
+}
+function persistBaselinePins(projectRoot, repos) {
+  const paths = resolveRepoDiscoveryPaths(projectRoot);
+  mkdirSync3(resolve4(paths.baseRepoPinsPath, ".."), { recursive: true });
+  writeFileSync(paths.baseRepoPinsPath, `${JSON.stringify({ recorded_at: nowIso3(), repos }, null, 2)}
+`, "utf-8");
+  return repos;
+}
+function resetRepoToOriginMain(projectRoot, repoPath, label) {
+  if (!existsSync4(resolve4(repoPath, ".git"))) {
+    console.log(`WARN: ${label} repo missing at ${repoPath}, skipping reset.`);
+    return;
+  }
+  runGitCapture(["git", "-C", repoPath, "fetch", "origin", "main"], projectRoot);
+  const hasMain = runGitCapture(["git", "-C", repoPath, "show-ref", "--verify", "--quiet", "refs/heads/main"], projectRoot).exitCode === 0;
+  if (hasMain) {
+    runGitCapture(["git", "-C", repoPath, "checkout", "main"], projectRoot);
+  } else {
+    runGitCapture(["git", "-C", repoPath, "checkout", "-B", "main", "origin/main"], projectRoot);
+  }
+  const resetResult = runGitCapture(["git", "-C", repoPath, "reset", "--hard", "origin/main"], projectRoot);
+  if (resetResult.exitCode !== 0) {
+    throw new Error(`Failed to reset ${label} to origin/main:
+${resetResult.stderr || resetResult.stdout}`);
+  }
+  runGitCapture(["git", "-C", repoPath, "clean", "-fd"], projectRoot);
+  const head = runGitCapture(["git", "-C", repoPath, "rev-parse", "--short", "HEAD"], projectRoot).stdout.trim();
+  console.log(`OK: ${label} reset to origin/main (${head})`);
+}
+function deleteBranches(projectRoot, repoPath, label, pattern) {
+  if (!existsSync4(resolve4(repoPath, ".git"))) {
+    return;
+  }
+  const listed = runGitCapture(["git", "-C", repoPath, "for-each-ref", `refs/heads/${pattern}`, "--format=%(refname:short)"], projectRoot).stdout.split(/\r?\n/).filter(Boolean);
+  let deleted = 0;
+  for (const branch of listed) {
+    runGitCapture(["git", "-C", repoPath, "branch", "-D", branch], projectRoot);
+    deleted += 1;
+  }
+  console.log(`OK: ${label} deleted ${deleted} branch(es) matching ${pattern}`);
+}
+function reopenClosedTasks(projectRoot) {
+  const paths = resolveHarnessPaths(projectRoot);
+  const issuesPath = resolve4(paths.monorepoRoot, ".beads/issues.jsonl");
+  if (!existsSync4(issuesPath)) {
+    console.log("WARN: .beads/issues.jsonl not found, skipping task reopen.");
+    return;
+  }
+  const content = readFileSync(issuesPath, "utf-8");
+  const closed = [];
+  for (const line of content.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    try {
+      const issue = JSON.parse(trimmed);
+      const normalizedStatus = taskData().normalizeTaskLifecycleStatus(issue.status);
+      if (issue.issue_type === "task" && issue.id && (normalizedStatus === "completed" || normalizedStatus === "cancelled" || normalizedStatus === "blocked")) {
+        closed.push(issue.id);
+      }
+    } catch {}
+  }
+  if (closed.length === 0) {
+    console.log("OK: no terminal tasks to reopen");
+    return;
+  }
+  for (const id of closed) {
+    const update = runCapture(["br", "--no-db", "update", id, "--status", "open"], paths.monorepoRoot);
+    if (update.exitCode === 0) {
+      console.log(`OK: reopened task ${id}`);
+    } else {
+      console.log(`WARN: failed to reopen task ${id}`);
+    }
+  }
+}
+function clearDirectory(dir, keepName) {
+  if (!existsSync4(dir)) {
+    return;
+  }
+  for (const entry of readdirSync(dir)) {
+    if (entry === keepName) {
+      continue;
+    }
+    rmSync2(resolve4(dir, entry), { recursive: true, force: true });
+  }
+}
+function resolvedPins(projectRoot, taskId) {
+  const explicit = explicitPins(projectRoot, taskId);
+  if (Object.keys(explicit).length > 0) {
+    return explicit;
+  }
+  return discoverPins(projectRoot, taskId);
+}
+function explicitPins(projectRoot, taskId) {
+  const repoPins2 = readRepoDiscoveryTaskConfig(projectRoot)[taskId]?.repo_pins || {};
+  const normalized = {};
+  const validAliases = new Set(managedRepoEntries().map((e) => e.alias));
+  for (const [key, value] of Object.entries(repoPins2)) {
+    if (!value) {
+      continue;
+    }
+    if (validAliases.size > 0 && !validAliases.has(key)) {
+      throw new Error(`Unsupported repo pin key for ${taskId}: ${key}. Known aliases: ${[...validAliases].join(", ") || "(none registered)"}`);
+    }
+    const existing = normalized[key];
+    if (existing && existing !== value) {
+      throw new Error(`Conflicting explicit repo pins for ${key}: ${existing} vs ${value}`);
+    }
+    normalized[key] = value;
+  }
+  return normalized;
+}
+function taskDependencies(projectRoot, taskId) {
+  return taskData().taskDependencyIds(projectRoot, taskId);
+}
+function discoverPins(projectRoot, taskId) {
+  const deps = taskDependencies(projectRoot, taskId);
+  if (deps.length === 0) {
+    return repoBaseline(projectRoot, true);
+  }
+  const paths = resolveRepoDiscoveryPaths(projectRoot);
+  const state = readJsonFile(paths.taskRepoCommitsPath, {});
+  const pinKeys = managedRepoEntries().map((e) => e.alias);
+  if (pinKeys.length === 0) {
+    return {};
+  }
+  const discovered = {};
+  for (const key of pinKeys) {
+    const commits = new Set;
+    for (const dep of deps) {
+      const fromState = state[dep]?.repos?.[key];
+      if (fromState) {
+        commits.add(fromState);
+      }
+      const fromArtifact = readPinFromArtifact(projectRoot, dep, key);
+      if (fromArtifact) {
+        commits.add(fromArtifact);
+      }
+    }
+    if (commits.size > 1) {
+      const values = [...commits].join(`
+  - `);
+      throw new Error(`Conflicting discovered pins for ${key} from dependency graph of ${taskId}:
+  - ${values}`);
+    }
+    if (commits.size === 1) {
+      discovered[key] = [...commits][0];
+    }
+  }
+  return discovered;
+}
+function readRepoDiscoveryTaskConfig(projectRoot) {
+  try {
+    return taskData().readSourceTaskConfig(projectRoot);
+  } catch {
+    return taskData().readTaskConfig(projectRoot);
+  }
+}
+function resolveRepoDiscoveryPaths(projectRoot) {
+  const monorepoRoot = managedRepoService.resolveMonorepoRepoLayout(projectRoot).checkoutRoot;
+  const explicitHostProjectRoot = (process.env.RIG_HOST_PROJECT_ROOT || "").trim();
+  const normalizedProjectRoot = resolve4(projectRoot);
+  const hostProjectRoot = explicitHostProjectRoot && shouldUseHostProjectStateRoot(normalizedProjectRoot) ? explicitHostProjectRoot : normalizedProjectRoot;
+  const stateDir = resolve4(hostProjectRoot, ".rig", "state");
+  return {
+    monorepoRoot,
+    taskRepoCommitsPath: resolve4(stateDir, "task-repo-commits.json"),
+    baseRepoPinsPath: resolve4(stateDir, "base-repo-pins.json")
   };
-  svc = managedRepoService;
-});
+}
+function shouldUseHostProjectStateRoot(projectRoot) {
+  const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (runtimeWorkspace && resolve4(runtimeWorkspace) === projectRoot) {
+    return true;
+  }
+  return basename2(dirname2(projectRoot)) === ".worktrees";
+}
+function readPinFromArtifact(projectRoot, depTask, repoKey) {
+  const snapshot = resolve4(taskData().artifactDirForId(projectRoot, depTask), "git-state.txt");
+  if (!existsSync4(snapshot)) {
+    return "";
+  }
+  const content = readFileSync(snapshot, "utf-8");
+  const chunk = content.split(/\r?\n/);
+  let inSection = false;
+  for (const line of chunk) {
+    if (line.startsWith("## ")) {
+      inSection = line.startsWith(`## ${repoKey}`);
+      continue;
+    }
+    if (!inSection) {
+      continue;
+    }
+    if (line.startsWith("head:")) {
+      return line.replace(/^head:\s*/, "").trim();
+    }
+  }
+  return "";
+}
+function repoPath(projectRoot, key) {
+  const managed = managedRepoService.resolveManagedRepoLayoutByAlias(projectRoot, key);
+  if (managed) {
+    return managed.checkoutRoot;
+  }
+  return key.startsWith("/") ? key : resolve4(projectRoot, key);
+}
+function applyPins(projectRoot, pins) {
+  for (const [key, commit] of Object.entries(pins)) {
+    const path = repoPath(projectRoot, key);
+    if (!existsSync4(resolve4(path, ".git"))) {
+      throw new Error(`Repo for pin not available: ${key} (${path})`);
+    }
+    let hasCommit = runGitCapture(["git", "-C", path, "cat-file", "-e", `${commit}^{commit}`], projectRoot).exitCode === 0;
+    if (!hasCommit) {
+      runGitCapture(["git", "-C", path, "fetch", "--all", "--tags", "--prune"], projectRoot);
+      hasCommit = runGitCapture(["git", "-C", path, "cat-file", "-e", `${commit}^{commit}`], projectRoot).exitCode === 0;
+    }
+    if (!hasCommit) {
+      throw new Error(`Commit not found for ${key}: ${commit}`);
+    }
+    const current = runGitCapture(["git", "-C", path, "rev-parse", "HEAD"], projectRoot).stdout.trim();
+    if (current === commit) {
+      console.log(`Repo pin: ${key} already at ${commit}`);
+      continue;
+    }
+    const branch = runGitCapture(["git", "-C", path, "rev-parse", "--abbrev-ref", "HEAD"], projectRoot).stdout.trim();
+    const checkout = branch.startsWith("rig/") ? runGitCapture(["git", "-C", path, "reset", "--hard", commit], projectRoot) : runGitCapture(["git", "-C", path, "checkout", "--detach", commit], projectRoot);
+    if (checkout.exitCode !== 0) {
+      throw new Error(`Failed to apply repo pin ${key} -> ${commit}:
+${checkout.stderr || checkout.stdout}`);
+    }
+    console.log(`Repo pin: ${key} -> ${commit}`);
+  }
+}
+function verifyPins(projectRoot, pins) {
+  let ok = true;
+  for (const [key, expected] of Object.entries(pins)) {
+    const path = repoPath(projectRoot, key);
+    if (!existsSync4(resolve4(path, ".git"))) {
+      console.error(`ERROR: repo missing during pin verification: ${key}`);
+      ok = false;
+      continue;
+    }
+    const current = runGitCapture(["git", "-C", path, "rev-parse", "HEAD"], projectRoot).stdout.trim();
+    if (current === expected) {
+      console.log(`Repo verify: ${key} at ${current}`);
+    } else {
+      console.error(`ERROR: repo pin mismatch for ${key}: expected ${expected}, got ${current}`);
+      ok = false;
+    }
+  }
+  return ok;
+}
+function runGitCapture(command, projectRoot) {
+  return runCapture(command, projectRoot, resolveRuntimeGitEnv());
+}
+function resolveRuntimeGitEnv() {
+  if (process.env.GIT_SSH_COMMAND?.trim()) {
+    return {
+      HOME: process.env.HOME ?? "",
+      GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND
+    };
+  }
+  const runtimeRoot = process.env.RIG_RUNTIME_HOME?.trim() || (process.env.RIG_RUNTIME_CONTEXT_FILE?.trim() ? resolve4(process.env.RIG_RUNTIME_CONTEXT_FILE, "..") : inferRuntimeRootFromWorkspace(process.cwd()));
+  const runtimeHome = runtimeRoot ? resolve4(runtimeRoot, "home") : process.env.HOME?.trim() || "";
+  if (!runtimeHome) {
+    return;
+  }
+  const knownHostsPath = resolve4(runtimeHome, ".ssh", "known_hosts");
+  if (!existsSync4(knownHostsPath)) {
+    return { HOME: runtimeHome };
+  }
+  const agentSshKey = resolve4(runtimeHome, ".ssh", "rig-agent-key");
+  const sshParts = [
+    "ssh",
+    `-o UserKnownHostsFile="${knownHostsPath}"`,
+    "-o StrictHostKeyChecking=yes",
+    "-F /dev/null"
+  ];
+  if (existsSync4(agentSshKey)) {
+    sshParts.splice(1, 0, `-i "${agentSshKey}"`, "-o IdentitiesOnly=yes");
+  }
+  return {
+    HOME: runtimeHome,
+    GIT_SSH_COMMAND: sshParts.join(" ")
+  };
+}
+function inferRuntimeRootFromWorkspace(cwd) {
+  const contextPath = findRuntimeContextFile(cwd);
+  if (!contextPath || !existsSync4(contextPath)) {
+    return "";
+  }
+  try {
+    loadRuntimeContext(contextPath);
+    return resolve4(contextPath, "..");
+  } catch {
+    return "";
+  }
+}
+function findRuntimeContextFile(startPath) {
+  let current = resolve4(startPath);
+  while (true) {
+    const candidate = resolve4(current, "runtime-context.json");
+    if (existsSync4(candidate)) {
+      return candidate;
+    }
+    const parent = resolve4(current, "..");
+    if (parent === current) {
+      return "";
+    }
+    current = parent;
+  }
+}
+function runGit3(projectRoot, args, failureSummary) {
+  const result = runCapture(["git", ...args], projectRoot);
+  if (result.exitCode !== 0) {
+    const details = result.stderr.trim() || result.stdout.trim() || "unknown git failure";
+    throw new CliError(`${failureSummary}: ${details}`, 2);
+  }
+  return result.stdout.trim();
+}
+async function ensureProjectMainFreshBeforeRun(options) {
+  if (options.disabled) {
+    return { status: "disabled" };
+  }
+  const defaultSync = (projectRoot) => {
+    for (const entry of managedRepoEntries()) {
+      managedRepoService.syncManagedRepo(projectRoot, entry.id);
+    }
+  };
+  await (options.syncMonorepo ?? defaultSync)(options.projectRoot);
+  runGit3(options.projectRoot, ["fetch", "origin", "main"], "Failed to fetch origin/main");
+  const branch = runGit3(options.projectRoot, ["rev-parse", "--abbrev-ref", "HEAD"], "Failed to read current branch");
+  if (branch !== "main") {
+    return { status: "skipped_not_main", branch };
+  }
+  const countsText = runGit3(options.projectRoot, ["rev-list", "--left-right", "--count", "main...origin/main"], "Failed to compare local main to origin/main");
+  const [localAheadRaw, remoteAheadRaw] = countsText.split(/\s+/);
+  const localAhead = Number.parseInt(localAheadRaw || "0", 10);
+  const remoteAhead = Number.parseInt(remoteAheadRaw || "0", 10);
+  if (!Number.isFinite(localAhead) || !Number.isFinite(remoteAhead)) {
+    throw new CliError(`Failed to compare local main to origin/main: unexpected rev-list output "${countsText}"`, 2);
+  }
+  if (remoteAhead === 0) {
+    if (localAhead > 0) {
+      return { status: "local_ahead", localAhead };
+    }
+    return { status: "up_to_date" };
+  }
+  if (localAhead > 0) {
+    throw new CliError("Local main has diverged from origin/main. Resolve the branch state manually or rerun with --skip-project-sync.", 2);
+  }
+  runGit3(options.projectRoot, ["merge", "--ff-only", "origin/main"], "Failed to fast-forward local main to origin/main");
+  await options.runBootstrap();
+  return { status: "updated", remoteAhead };
+}
+var repoOperationsService = {
+  repoEnsure,
+  repoPins,
+  repoVerify,
+  repoDiscover,
+  repoBaseline,
+  resetBaseline,
+  ensureProjectMainFreshBeforeRun
+};
+var repoOps = repoOperationsService;
 
 // packages/repos-plugin/src/plugin.ts
-import { definePlugin } from "@rig/core/config";
-import { MANAGED_REPO_SERVICE_CAPABILITY_ID } from "@rig/contracts";
 var REPOS_PLUGIN_NAME = "@rig/repos-plugin";
+var ManagedRepoCap = defineCapability2(MANAGED_REPO_SERVICE_CAPABILITY);
+var RepoOperationsCap = defineCapability2(REPO_OPERATIONS_CAPABILITY);
 var reposPlugin = definePlugin({
   name: REPOS_PLUGIN_NAME,
   version: "0.0.0-alpha.1",
   contributes: {
     capabilities: [
-      {
-        id: MANAGED_REPO_SERVICE_CAPABILITY_ID,
+      ManagedRepoCap.provide(svc, {
         title: "Managed repositories",
-        description: "Registry, on-disk layout, and mirror/sync for plugin-contributed managed repos.",
-        run: async () => (await Promise.resolve().then(() => (init_service(), exports_service))).svc
-      }
+        description: "Registry, on-disk layout, and mirror/sync for plugin-contributed managed repos."
+      }),
+      RepoOperationsCap.provide(repoOps, {
+        title: "Repository operations",
+        description: "Task repo pinning, baseline reset, and project-main pre-run sync."
+      })
     ]
   }
 });

package/dist/src/registry.js

@@ -60,8 +60,8 @@ function repoRegistrationToManagedEntry(reg) {
     alias: reg.defaultPath ?? reg.id,
     defaultBranch: reg.defaultBranch,
     defaultRemoteUrl: reg.url,
-    remoteEnvVar: reg.remoteEnvVar,
-    checkoutEnvVar: reg.checkoutEnvVar
+    ...reg.remoteEnvVar !== undefined ? { remoteEnvVar: reg.remoteEnvVar } : {},
+    ...reg.checkoutEnvVar !== undefined ? { checkoutEnvVar: reg.checkoutEnvVar } : {}
   };
 }
 export {

package/dist/src/repo-operations.d.ts

@@ -0,0 +1,3 @@
+import type { RepoOperationsService } from "@rig/contracts";
+export declare const repoOperationsService: RepoOperationsService;
+export declare const repoOps: RepoOperationsService;