@h-rig/runtime 0.0.6-alpha.0 → 0.0.6-alpha.10

package/dist/src/control-plane/native/harness-cli.js

@@ -1198,8 +1198,8 @@ function githubStatusFor(issue) {
   return "open";
 }
 function selectedGitHubEnv() {
-  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() ?? "";
-  return { GH_TOKEN: token, GITHUB_TOKEN: token };
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
 }
 function ghSpawnOptions() {
   return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };
@@ -5983,12 +5983,12 @@ var TASK_ARTIFACT_STAGE_FALLBACK = new Set([
   "task-result.json",
   "validation-summary.json"
 ]);
-function resolveHostRigBinDir(root) {
-  return resolve24(root, ".rig", "bin");
-}
 function isRuntimeGatewayGitPath(candidate) {
   return /\/\.rig\/bin\/git$/.test(candidate.replace(/\\/g, "/"));
 }
+function isRuntimeGatewayGhPath(candidate) {
+  return /\/\.rig\/bin\/gh$/.test(candidate.replace(/\\/g, "/"));
+}
 function resolveOptionalMonorepoRoot(projectRoot) {
   const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
   if (runtimeWorkspace && existsSync21(resolve24(runtimeWorkspace, ".git"))) {
@@ -6023,6 +6023,9 @@ function resolveGitBinary(projectRoot) {
   }
   return "git";
 }
+function escapeRegExp2(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 function safeCurrentTaskId(projectRoot) {
   try {
     const taskId = currentTaskId(projectRoot);
@@ -6181,17 +6184,15 @@ function gitOpenPr(options) {
   const target = options.target || (taskId ? "monorepo" : "project");
   let repoRoot = options.projectRoot;
   let repoLabel = "project-rig";
-  let defaultBase = process.env.RIG_PR_BASE_PROJECT || "main";
+  const envBase = target === "monorepo" ? process.env.RIG_PR_BASE_MONOREPO?.trim() || "" : process.env.RIG_PR_BASE_PROJECT?.trim() || "";
   if (target === "monorepo") {
     repoRoot = resolveOptionalMonorepoRoot(options.projectRoot) || resolveMonorepoRoot2(options.projectRoot);
     repoLabel = "monorepo";
-    defaultBase = process.env.RIG_PR_BASE_MONOREPO || "main";
     if (taskId) {
       gitSyncBranch(options.projectRoot, taskId, "monorepo");
     }
   } else if (taskId) {
     gitSyncBranch(options.projectRoot, taskId, "project");
-    defaultBase = inferProjectBase(options.projectRoot, defaultBase);
   }
   if (!existsSync21(resolve24(repoRoot, ".git"))) {
     throw new Error(`Repository not available for open-pr target ${target}: ${repoRoot}`);
@@ -6200,9 +6201,9 @@ function gitOpenPr(options) {
   if (!branch || branch === "HEAD") {
     throw new Error(`Cannot open PR from detached HEAD in ${repoLabel}. Checkout a branch first.`);
   }
-  const base = options.base || defaultBase;
   const repoNameWithOwner = resolveRepoNameWithOwner(options.projectRoot, repoRoot);
   const networkRemote = resolveNetworkRemoteName(options.projectRoot, repoRoot, repoNameWithOwner);
+  const base = options.base || envBase || inferRepositoryDefaultBase(options.projectRoot, repoRoot, repoNameWithOwner, networkRemote, target === "project" ? inferProjectBase(options.projectRoot, "main") : "main");
   refreshRemoteBaseRef(options.projectRoot, repoRoot, base);
   let reviewer = (options.reviewer || "").trim();
   let reviewerSource = reviewer ? "flag" : undefined;
@@ -6238,6 +6239,7 @@ function gitOpenPr(options) {
     "",
     "## Task",
     `- beads: ${taskId || "n/a"}`,
+    ...defaultPrRunLines(taskId, repoNameWithOwner),
     "",
     "## Review",
     "- Completion verification will run validation, verifier review, and PR policy checks.",
@@ -6329,6 +6331,29 @@ function gitOpenPr(options) {
   }
   return result;
 }
+function defaultPrRunLines(taskId, repoNameWithOwner) {
+  const lines = [];
+  const runId = process.env.RIG_SERVER_RUN_ID?.trim();
+  if (runId) {
+    lines.push(`- Run: ${runId}`);
+  }
+  const closeout = defaultPrCloseoutLine(taskId, repoNameWithOwner);
+  if (closeout) {
+    lines.push(`- ${closeout}`);
+  }
+  return lines;
+}
+function defaultPrCloseoutLine(taskId, repoNameWithOwner) {
+  const sourceIssueId = loadRuntimeContextFromEnv()?.sourceTask?.sourceIssueId;
+  if (sourceIssueId) {
+    const match = sourceIssueId.match(/^([^#]+)#(\d+)$/);
+    if (match) {
+      const [, sourceRepo, issueNumber] = match;
+      return sourceRepo.toLowerCase() === repoNameWithOwner.toLowerCase() ? `Closes #${issueNumber}` : `Closes ${sourceRepo}#${issueNumber}`;
+    }
+  }
+  return /^\d+$/.test(taskId) ? `Closes #${taskId}` : "";
+}
 function readPrViewState(gh, repoRoot, repoNameWithOwner, prUrl) {
   const view = runCapture2(withGhRepo([
     gh,
@@ -6479,32 +6504,19 @@ function resolveGithubCliBinary(projectRoot) {
   if (explicit) {
     candidates.add(explicit);
   }
+  for (const candidate of ["/usr/bin/gh", "/opt/homebrew/bin/gh", "/usr/local/bin/gh"]) {
+    candidates.add(candidate);
+  }
   const explicitPathEntries = (process.env.PATH || "").split(":").map((entry) => entry.trim()).filter(Boolean);
   for (const entry of explicitPathEntries) {
     candidates.add(resolve24(entry, "gh"));
   }
-  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim();
-  if (hostProjectRoot) {
-    candidates.add(resolve24(resolveHostRigBinDir(hostProjectRoot), "gh"));
-  }
-  candidates.add(resolve24(resolveHostRigBinDir(projectRoot), "gh"));
-  const runtimeContext = loadRuntimeContextFromEnv();
-  if (runtimeContext?.binDir) {
-    candidates.add(resolve24(runtimeContext.binDir, "gh"));
-  }
-  const runtimeHome = process.env.RIG_RUNTIME_HOME?.trim();
-  if (runtimeHome) {
-    candidates.add(resolve24(runtimeHome, "bin", "gh"));
-  }
-  for (const candidate of ["/opt/homebrew/bin/gh", "/usr/local/bin/gh", "/usr/bin/gh"]) {
-    candidates.add(candidate);
-  }
   const bunResolved = Bun.which("gh");
   if (bunResolved) {
     candidates.add(bunResolved);
   }
   for (const candidate of candidates) {
-    if (candidate && existsSync21(candidate)) {
+    if (candidate && existsSync21(candidate) && !isRuntimeGatewayGhPath(candidate)) {
       return candidate;
     }
   }
@@ -6653,6 +6665,32 @@ function withGhRepo(command, repoNameWithOwner) {
   }
   return [command[0], command[1], command[2], ...ghRepoArgs(repoNameWithOwner), ...command.slice(3)];
 }
+function inferRepositoryDefaultBase(projectRoot, repoRoot, repoNameWithOwner, remoteName, fallback) {
+  const remote = remoteName || "origin";
+  const symbolic = runCapture2(gitCmd(projectRoot, repoRoot, "symbolic-ref", "--short", `refs/remotes/${remote}/HEAD`), projectRoot);
+  if (symbolic.exitCode === 0) {
+    const ref = symbolic.stdout.trim().replace(new RegExp(`^${escapeRegExp2(remote)}/`), "");
+    if (ref && ref !== "HEAD") {
+      return ref;
+    }
+  }
+  const lsRemote = runCapture2(gitCmd(projectRoot, repoRoot, "ls-remote", "--symref", remote, "HEAD"), projectRoot);
+  if (lsRemote.exitCode === 0) {
+    const match = lsRemote.stdout.match(/^ref:\s+refs\/heads\/([^\t\r\n]+)\s+HEAD/m);
+    if (match?.[1]) {
+      return match[1];
+    }
+  }
+  const gh = resolveGithubCliBinary(projectRoot);
+  if (gh && repoNameWithOwner) {
+    const api = runCapture2(withGhRepo([gh, "repo", "view", "--json", "defaultBranchRef", "--jq", ".defaultBranchRef.name"], repoNameWithOwner), repoRoot);
+    const branch = api.exitCode === 0 ? api.stdout.trim() : "";
+    if (branch) {
+      return branch;
+    }
+  }
+  return fallback;
+}
 function inferProjectBase(projectRoot, fallback) {
   const containing = runCapture2(gitCmd(projectRoot, projectRoot, "branch", "-r", "--contains", "HEAD"), projectRoot);
   if (containing.exitCode !== 0) {
@@ -7034,6 +7072,10 @@ function runtimeGitEnv(projectRoot) {
     }
     env[key] = value;
   }
+  const rigGithubToken = process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  if (rigGithubToken && !env.GITHUB_TOKEN && !env.GH_TOKEN) {
+    env.GITHUB_TOKEN = rigGithubToken;
+  }
   if (!env.GITHUB_TOKEN && env.GH_TOKEN) {
     env.GITHUB_TOKEN = env.GH_TOKEN;
   }
@@ -7057,6 +7099,13 @@ function runtimeGitEnv(projectRoot) {
   if (!env.GH_TOKEN && env.GITHUB_TOKEN) {
     env.GH_TOKEN = env.GITHUB_TOKEN;
   }
+  const gitHubToken = env.GITHUB_TOKEN || env.GH_TOKEN || env.RIG_GITHUB_TOKEN || rigGithubToken;
+  if (gitHubToken) {
+    env.RIG_GITHUB_TOKEN = gitHubToken;
+    env.GITHUB_TOKEN = env.GITHUB_TOKEN || gitHubToken;
+    env.GH_TOKEN = env.GH_TOKEN || gitHubToken;
+    applyGitHubCredentialHelperEnv(env);
+  }
   if (runtimeKnownHosts && existsSync21(runtimeKnownHosts)) {
     const sshParts = [
       "ssh",
@@ -7073,6 +7122,14 @@ function runtimeGitEnv(projectRoot) {
   }
   return Object.keys(env).length > 0 ? env : undefined;
 }
+function applyGitHubCredentialHelperEnv(env) {
+  env.GIT_TERMINAL_PROMPT = "0";
+  env.GIT_CONFIG_COUNT = "2";
+  env.GIT_CONFIG_KEY_0 = "credential.helper";
+  env.GIT_CONFIG_VALUE_0 = "";
+  env.GIT_CONFIG_KEY_1 = "credential.helper";
+  env.GIT_CONFIG_VALUE_1 = '!f() { test "$1" = get || exit 0; token="${GITHUB_TOKEN:-${GH_TOKEN:-${RIG_GITHUB_TOKEN:-}}}"; test -n "$token" || exit 0; echo username=x-access-token; echo password="$token"; }; f';
+}
 function loadPersistedRuntimeSecrets(runtimeRoot) {
   if (!runtimeRoot) {
     return {};

package/dist/src/control-plane/native/pr-automation.js

@@ -104,6 +104,44 @@ function parsePrChecks(value) {
     }];
   });
 }
+function parsePrViewStatusCheckRollup(value) {
+  if (!value?.trim())
+    return [];
+  try {
+    const parsed = JSON.parse(value);
+    const rollup = Array.isArray(parsed.statusCheckRollup) ? parsed.statusCheckRollup : [];
+    return rollup.flatMap((entry) => {
+      if (!entry || typeof entry !== "object")
+        return [];
+      const record = entry;
+      const name = typeof record.name === "string" ? record.name : "";
+      if (!name.trim())
+        return [];
+      return [{
+        name,
+        status: typeof record.status === "string" ? record.status : null,
+        state: typeof record.state === "string" ? record.state : null,
+        conclusion: typeof record.conclusion === "string" ? record.conclusion : null,
+        detailsUrl: typeof record.detailsUrl === "string" ? record.detailsUrl : typeof record.link === "string" ? record.link : null
+      }];
+    });
+  } catch {
+    return [];
+  }
+}
+async function readPrChecks(input) {
+  const checks = await input.command(["pr", "checks", input.prUrl, "--json", "name,state,link"], input.cwd ? { cwd: input.cwd } : undefined);
+  if (checks.exitCode === 0) {
+    return parsePrChecks(checks.stdout);
+  }
+  const combined = `${checks.stderr ?? ""}
+${checks.stdout ?? ""}`;
+  if (!/unknown flag.*--json|unknown flag: --json|unknown shorthand flag/i.test(combined)) {
+    throw new Error(`gh pr checks ${input.prUrl} --json name,state,link failed (${checks.exitCode}): ${checks.stderr ?? checks.stdout ?? ""}`.trim());
+  }
+  const view = await runChecked(input.command, ["pr", "view", input.prUrl, "--json", "statusCheckRollup"], input.cwd, "gh");
+  return parsePrViewStatusCheckRollup(view.stdout);
+}
 function parsePrViewReviewThreads(value) {
   if (!value?.trim())
     return [];
@@ -164,6 +202,30 @@ function normalizePrUrl(stdout) {
     throw new Error("gh pr create did not return a PR URL");
   return url;
 }
+async function ensureExistingPrBodyHasRigMarkers(input) {
+  const view = await input.command(["pr", "view", input.prUrl, "--json", "body"], input.cwd ? { cwd: input.cwd } : undefined);
+  if (view.exitCode !== 0) {
+    throw new Error(`gh pr view ${input.prUrl} --json body failed (${view.exitCode}): ${view.stderr ?? view.stdout ?? ""}`.trim());
+  }
+  let currentBody = "";
+  try {
+    const parsed = JSON.parse(view.stdout ?? "{}");
+    currentBody = typeof parsed.body === "string" ? parsed.body : "";
+  } catch {
+    currentBody = "";
+  }
+  const requiredBlocks = input.body.split(/\n{2,}/).map((block) => block.trim()).filter((block) => /^Run: /i.test(block) || /^Closes #\d+/i.test(block));
+  const missing = requiredBlocks.filter((block) => !currentBody.includes(block));
+  if (missing.length === 0)
+    return;
+  const nextBody = [currentBody.trim(), ...missing].filter(Boolean).join(`
+
+`);
+  const edit = await input.command(["pr", "edit", input.prUrl, "--body", nextBody], input.cwd ? { cwd: input.cwd } : undefined);
+  if (edit.exitCode !== 0) {
+    throw new Error(`gh pr edit ${input.prUrl} --body failed (${edit.exitCode}): ${edit.stderr ?? edit.stdout ?? ""}`.trim());
+  }
+}
 async function runChecked(command, args, cwd, label = "gh") {
   const result = await command(args, cwd ? { cwd } : undefined);
   if (result.exitCode !== 0) {
@@ -188,27 +250,33 @@ function statusPathFromShortLine(line) {
   }
   return renamedPath;
 }
+function isRuntimeCommitExcludedPath(path) {
+  const normalized = path.replace(/^\.\/+/, "").replace(/\/+$/, "");
+  return RIG_RUNTIME_COMMIT_EXCLUDES.some((excluded) => normalized === excluded || normalized.startsWith(`${excluded}/`));
+}
+function committableRunChangePaths(statusText) {
+  const seen = new Set;
+  const paths = [];
+  for (const line of statusText.split(/\r?\n/)) {
+    const path = statusPathFromShortLine(line);
+    if (!path || isRuntimeCommitExcludedPath(path) || seen.has(path))
+      continue;
+    seen.add(path);
+    paths.push(path);
+  }
+  return paths;
+}
 function hasCommittableRunChanges(statusText) {
-  return statusText.split(/\r?\n/).map((line) => statusPathFromShortLine(line)).filter(Boolean).some((path) => !RIG_RUNTIME_COMMIT_EXCLUDES.some((excluded) => path === excluded || path.startsWith(`${excluded}/`)));
+  return committableRunChangePaths(statusText).length > 0;
 }
 async function commitRunChanges(input) {
-  const status = await runChecked(input.command, ["status", "--short"], input.cwd, "git");
+  const status = await runChecked(input.command, ["status", "--short", "--untracked-files=all"], input.cwd, "git");
   const statusText = status.stdout ?? "";
-  if (!statusText.trim() || !hasCommittableRunChanges(statusText)) {
+  const committablePaths = committableRunChangePaths(statusText);
+  if (!statusText.trim() || committablePaths.length === 0) {
     return { committed: false, status: statusText };
   }
-  await runChecked(input.command, [
-    "add",
-    "-A",
-    "--",
-    ".",
-    ":(exclude).rig",
-    ":(exclude).rig/**",
-    ":(exclude)artifacts",
-    ":(exclude)artifacts/**",
-    ":(exclude)node_modules",
-    ":(exclude)node_modules/**"
-  ], input.cwd, "git");
+  await runChecked(input.command, ["add", "-A", "--", ...committablePaths], input.cwd, "git");
   const staged = await input.command(["diff", "--cached", "--quiet"], { cwd: input.cwd });
   if (staged.exitCode === 0) {
     return { committed: false, status: statusText };
@@ -284,7 +352,7 @@ async function runRepoDefaultMerge(input) {
 }
 async function runPrAutomation(input) {
   const prConfig = input.config?.pr ?? {};
-  if (prConfig.mode === "off") {
+  if (prConfig.mode === "off" || prConfig.mode === "ask") {
     return { status: "skipped", iterations: 0, actionableFeedback: [] };
   }
   const body = buildPrAutomationBody({
@@ -314,12 +382,15 @@ ${createResult.stdout ?? ""}`) : null;
     throw new Error(`gh ${createArgs.join(" ")} failed (${createResult.exitCode}): ${createResult.stderr ?? createResult.stdout ?? ""}`.trim());
   }
   const prUrl = existingPrUrl ?? normalizePrUrl(createResult.stdout);
+  if (existingPrUrl) {
+    await ensureExistingPrBodyHasRigMarkers({ prUrl, body, command: input.command, cwd: input.projectRoot });
+  }
   await input.lifecycle?.onPrOpened?.({ prUrl });
   const { maxPrFixIterations } = resolvePrAutomationLimits(input.config);
   let latestFeedback = [];
   for (let iteration = 1;iteration <= maxPrFixIterations; iteration += 1) {
     await input.lifecycle?.onReviewCiStarted?.({ prUrl, iteration });
-    const checks = prConfig.watchChecks === false ? [] : parsePrChecks((await runChecked(input.command, ["pr", "checks", prUrl, "--json", "name,state,link"], input.projectRoot)).stdout);
+    const checks = prConfig.watchChecks === false ? [] : await readPrChecks({ prUrl, command: input.command, cwd: input.projectRoot });
     const reviewThreads = prConfig.autoFixReview === false ? [] : parsePrViewReviewThreads((await runChecked(input.command, ["pr", "view", prUrl, "--json", "reviewDecision,reviews"], input.projectRoot)).stdout);
     latestFeedback = collectActionablePrFeedback({
       checks,

package/dist/src/control-plane/native/run-ops.js

@@ -2713,11 +2713,13 @@ function runStatus(projectRoot, runtimeContext) {
     recentRuns: runs.slice(0, 10)
   };
 }
-async function runResume(projectRoot, runtimeContext) {
-  const resumable = listAuthorityRuns(projectRoot).map((entry) => readAuthorityRun(projectRoot, entry.runId)).filter((run2) => Boolean(run2)).filter((run2) => run2.mode === "local" && (run2.status === "stopped" || run2.status === "failed" || run2.status === "created")).sort((left, right) => String(right.updatedAt ?? "").localeCompare(String(left.updatedAt ?? "")));
-  const run = resumable[0];
+function latestLocalRunForResume(projectRoot) {
+  return listAuthorityRuns(projectRoot).map((entry) => readAuthorityRun(projectRoot, entry.runId)).filter((run) => Boolean(run)).filter((run) => run.mode === "local" && ["created", "preparing", "running", "validating", "reviewing", "stopped", "failed", "needs_attention"].includes(String(run.status ?? ""))).sort((left, right) => String(right.updatedAt ?? "").localeCompare(String(left.updatedAt ?? "")))[0] ?? null;
+}
+async function submitRunResumeRequest(projectRoot, input) {
+  const run = latestLocalRunForResume(projectRoot);
   if (!run) {
-    throw new RemoteCliError("RIG_RUN_NOTHING_TO_RESUME", "No stopped local run is available to resume.", 2);
+    throw new RemoteCliError(input.failureCode, input.nothingMessage, 2);
   }
   const server = await ensureServerForRuns(projectRoot);
   const response = await fetch(`${server.baseUrl}/api/runs/resume`, {
@@ -2726,14 +2728,28 @@ async function runResume(projectRoot, runtimeContext) {
       "content-type": "application/json",
       ...server.authToken ? { authorization: `Bearer ${server.authToken}` } : {}
     },
-    body: JSON.stringify({ runId: run.runId, createdAt: new Date().toISOString() })
+    body: JSON.stringify({ runId: run.runId, createdAt: new Date().toISOString(), restart: input.restart })
   });
   if (!response.ok) {
     const text = await response.text();
-    throw new RemoteCliError("RIG_RUN_RESUME_FAILED", text || response.statusText, 1, { runId: run.runId });
+    throw new RemoteCliError(input.restart ? "RIG_RUN_RESTART_FAILED" : "RIG_RUN_RESUME_FAILED", text || response.statusText, 1, { runId: run.runId });
   }
   return { runId: run.runId };
 }
+async function runResume(projectRoot, runtimeContext) {
+  return submitRunResumeRequest(projectRoot, {
+    restart: false,
+    failureCode: "RIG_RUN_NOTHING_TO_RESUME",
+    nothingMessage: "No resumable local run is available."
+  });
+}
+async function runRestart(projectRoot, runtimeContext) {
+  return submitRunResumeRequest(projectRoot, {
+    restart: true,
+    failureCode: "RIG_RUN_NOTHING_TO_RESTART",
+    nothingMessage: "No local run is available to restart."
+  });
+}
 async function runStop(projectRoot) {
   const activeRuns = listAuthorityRuns(projectRoot).map((entry) => readAuthorityRun(projectRoot, entry.runId)).filter((run) => Boolean(run)).filter((run) => run.mode === "local" && ACTIVE_RUN_STATUSES.has(String(run.status ?? "")));
   if (activeRuns.length === 0) {
@@ -3267,6 +3283,7 @@ export {
   runStop,
   runStatus,
   runResume,
+  runRestart,
   resolvePreferredShellBinary,
   resolveLocalControlBinarySourceRoot,
   resolveDefaultEpic,

package/dist/src/control-plane/native/task-ops.js

@@ -1089,8 +1089,8 @@ function githubStatusFor(issue) {
   return "open";
 }
 function selectedGitHubEnv() {
-  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() ?? "";
-  return { GH_TOKEN: token, GITHUB_TOKEN: token };
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
 }
 function ghSpawnOptions() {
   return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };

package/dist/src/control-plane/native/validator.js

@@ -1354,8 +1354,8 @@ function githubStatusFor(issue) {
   return "open";
 }
 function selectedGitHubEnv() {
-  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() ?? "";
-  return { GH_TOKEN: token, GITHUB_TOKEN: token };
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
 }
 function ghSpawnOptions() {
   return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };

package/dist/src/control-plane/native/verifier.js

@@ -977,8 +977,8 @@ function githubStatusFor(issue) {
   return "open";
 }
 function selectedGitHubEnv() {
-  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() ?? "";
-  return { GH_TOKEN: token, GITHUB_TOKEN: token };
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
 }
 function ghSpawnOptions() {
   return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };

package/dist/src/control-plane/runtime/index.js

@@ -3848,8 +3848,8 @@ function githubStatusFor(issue) {
   return "open";
 }
 function selectedGitHubEnv() {
-  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() ?? "";
-  return { GH_TOKEN: token, GITHUB_TOKEN: token };
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
 }
 function ghSpawnOptions() {
   return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };
@@ -6154,20 +6154,23 @@ function hashProjectPath(workspaceDir) {
 }
 function resolveGithubCliBinaryPath() {
   const explicit = process.env.RIG_GH_BIN?.trim();
-  if (explicit && existsSync24(explicit)) {
+  if (explicit && existsSync24(explicit) && !isRuntimeGatewayGhPath(explicit)) {
     return explicit;
   }
-  const bunResolved = Bun.which("gh");
-  if (bunResolved && existsSync24(bunResolved)) {
-    return bunResolved;
-  }
-  for (const candidate of ["/opt/homebrew/bin/gh", "/usr/local/bin/gh", "/usr/bin/gh"]) {
+  for (const candidate of ["/usr/bin/gh", "/opt/homebrew/bin/gh", "/usr/local/bin/gh"]) {
     if (existsSync24(candidate)) {
       return candidate;
     }
   }
+  const bunResolved = Bun.which("gh");
+  if (bunResolved && existsSync24(bunResolved) && !isRuntimeGatewayGhPath(bunResolved)) {
+    return bunResolved;
+  }
   return "";
 }
+function isRuntimeGatewayGhPath(candidate) {
+  return /\/\.rig\/bin\/gh$/.test(candidate.replace(/\\/g, "/"));
+}
 async function resolveGithubCliAuthToken(ghBinary = "") {
   const gh = ghBinary || resolveGithubCliBinaryPath();
   if (!gh) {
@@ -6268,6 +6271,8 @@ async function runtimeEnv(projectRoot, runtime) {
     XDG_CACHE_HOME: runtime.cacheDir,
     XDG_STATE_HOME: runtime.stateDir,
     RIG_AGENT_ID: runtime.id,
+    ...process.env.RIG_RUN_ID?.trim() ? { RIG_RUN_ID: process.env.RIG_RUN_ID.trim() } : {},
+    ...process.env.RIG_SERVER_RUN_ID?.trim() ? { RIG_SERVER_RUN_ID: process.env.RIG_SERVER_RUN_ID.trim() } : {},
     RIG_TASK_ID: runtime.taskId,
     RIG_TASK_RUNTIME_ID: runtime.id,
     RIG_TASK_WORKSPACE: runtime.workspaceDir,
@@ -6331,6 +6336,10 @@ async function runtimeEnv(projectRoot, runtime) {
       env[key] = value;
     }
   }
+  const rigGithubToken = process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  if (rigGithubToken && !env.GITHUB_TOKEN && !env.GH_TOKEN) {
+    env.GITHUB_TOKEN = rigGithubToken;
+  }
   const fallbackGithubToken = !env.GITHUB_TOKEN && !env.GH_TOKEN ? await resolveGithubCliAuthToken(hostGhBinary) : "";
   if (fallbackGithubToken) {
     env.GITHUB_TOKEN = fallbackGithubToken;
@@ -6341,6 +6350,13 @@ async function runtimeEnv(projectRoot, runtime) {
   if (!env.GH_TOKEN && env.GITHUB_TOKEN) {
     env.GH_TOKEN = env.GITHUB_TOKEN;
   }
+  const gitHubToken = env.GITHUB_TOKEN || env.GH_TOKEN || rigGithubToken;
+  if (gitHubToken) {
+    env.RIG_GITHUB_TOKEN = gitHubToken;
+    env.GITHUB_TOKEN = env.GITHUB_TOKEN || gitHubToken;
+    env.GH_TOKEN = env.GH_TOKEN || gitHubToken;
+    applyGitHubCredentialHelperEnv(env);
+  }
   if (!env.GREPTILE_GITHUB_TOKEN && env.GITHUB_TOKEN) {
     env.GREPTILE_GITHUB_TOKEN = env.GITHUB_TOKEN;
   }
@@ -6436,12 +6452,21 @@ async function materializeRuntimeCertBundle(runtime) {
   }
   return targetPath;
 }
+function applyGitHubCredentialHelperEnv(env) {
+  env.GIT_TERMINAL_PROMPT = "0";
+  env.GIT_CONFIG_COUNT = "2";
+  env.GIT_CONFIG_KEY_0 = "credential.helper";
+  env.GIT_CONFIG_VALUE_0 = "";
+  env.GIT_CONFIG_KEY_1 = "credential.helper";
+  env.GIT_CONFIG_VALUE_1 = '!f() { test "$1" = get || exit 0; token="${GITHUB_TOKEN:-${GH_TOKEN:-${RIG_GITHUB_TOKEN:-}}}"; test -n "$token" || exit 0; echo username=x-access-token; echo password="$token"; }; f';
+}
 function persistRuntimeSecrets(runtimeRoot, env) {
   const secretsPath = resolve27(runtimeRoot, "runtime-secrets.json");
   const persisted = {};
   for (const key of [
     "GITHUB_TOKEN",
     "GH_TOKEN",
+    "RIG_GITHUB_TOKEN",
     "GREPTILE_GITHUB_TOKEN",
     "GREPTILE_API_KEY",
     "AI_REVIEW_MODE",
@@ -8091,7 +8116,11 @@ async function ensureAgentRuntime(options) {
   mkdirSync18(runtime.binDir, { recursive: true });
   mkdirSync18(workspaceLayout.distDir, { recursive: true });
   prepareRuntimeWorkspace(options.projectRoot, workspaceDir);
-  await resetEphemeralTaskArtifacts(workspaceDir, options.taskId);
+  if (options.preserveTaskArtifacts) {
+    console.log(`[rig-agent] Preserving runtime task artifacts for resume of ${options.taskId}.`);
+  } else {
+    await resetEphemeralTaskArtifacts(workspaceDir, options.taskId);
+  }
   const ctx = {
     runtimeId: options.id,
     taskId: options.taskId,

package/dist/src/control-plane/runtime/isolation/home.js

@@ -686,20 +686,23 @@ function hashProjectPath(workspaceDir) {
 }
 function resolveGithubCliBinaryPath() {
   const explicit = process.env.RIG_GH_BIN?.trim();
-  if (explicit && existsSync5(explicit)) {
+  if (explicit && existsSync5(explicit) && !isRuntimeGatewayGhPath(explicit)) {
     return explicit;
   }
-  const bunResolved = Bun.which("gh");
-  if (bunResolved && existsSync5(bunResolved)) {
-    return bunResolved;
-  }
-  for (const candidate of ["/opt/homebrew/bin/gh", "/usr/local/bin/gh", "/usr/bin/gh"]) {
+  for (const candidate of ["/usr/bin/gh", "/opt/homebrew/bin/gh", "/usr/local/bin/gh"]) {
     if (existsSync5(candidate)) {
       return candidate;
     }
   }
+  const bunResolved = Bun.which("gh");
+  if (bunResolved && existsSync5(bunResolved) && !isRuntimeGatewayGhPath(bunResolved)) {
+    return bunResolved;
+  }
   return "";
 }
+function isRuntimeGatewayGhPath(candidate) {
+  return /\/\.rig\/bin\/gh$/.test(candidate.replace(/\\/g, "/"));
+}
 async function resolveGithubCliAuthToken(ghBinary = "") {
   const gh = ghBinary || resolveGithubCliBinaryPath();
   if (!gh) {
@@ -800,6 +803,8 @@ async function runtimeEnv(projectRoot, runtime) {
     XDG_CACHE_HOME: runtime.cacheDir,
     XDG_STATE_HOME: runtime.stateDir,
     RIG_AGENT_ID: runtime.id,
+    ...process.env.RIG_RUN_ID?.trim() ? { RIG_RUN_ID: process.env.RIG_RUN_ID.trim() } : {},
+    ...process.env.RIG_SERVER_RUN_ID?.trim() ? { RIG_SERVER_RUN_ID: process.env.RIG_SERVER_RUN_ID.trim() } : {},
     RIG_TASK_ID: runtime.taskId,
     RIG_TASK_RUNTIME_ID: runtime.id,
     RIG_TASK_WORKSPACE: runtime.workspaceDir,
@@ -863,6 +868,10 @@ async function runtimeEnv(projectRoot, runtime) {
       env[key] = value;
     }
   }
+  const rigGithubToken = process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  if (rigGithubToken && !env.GITHUB_TOKEN && !env.GH_TOKEN) {
+    env.GITHUB_TOKEN = rigGithubToken;
+  }
   const fallbackGithubToken = !env.GITHUB_TOKEN && !env.GH_TOKEN ? await resolveGithubCliAuthToken(hostGhBinary) : "";
   if (fallbackGithubToken) {
     env.GITHUB_TOKEN = fallbackGithubToken;
@@ -873,6 +882,13 @@ async function runtimeEnv(projectRoot, runtime) {
   if (!env.GH_TOKEN && env.GITHUB_TOKEN) {
     env.GH_TOKEN = env.GITHUB_TOKEN;
   }
+  const gitHubToken = env.GITHUB_TOKEN || env.GH_TOKEN || rigGithubToken;
+  if (gitHubToken) {
+    env.RIG_GITHUB_TOKEN = gitHubToken;
+    env.GITHUB_TOKEN = env.GITHUB_TOKEN || gitHubToken;
+    env.GH_TOKEN = env.GH_TOKEN || gitHubToken;
+    applyGitHubCredentialHelperEnv(env);
+  }
   if (!env.GREPTILE_GITHUB_TOKEN && env.GITHUB_TOKEN) {
     env.GREPTILE_GITHUB_TOKEN = env.GITHUB_TOKEN;
   }
@@ -968,12 +984,21 @@ async function materializeRuntimeCertBundle(runtime) {
   }
   return targetPath;
 }
+function applyGitHubCredentialHelperEnv(env) {
+  env.GIT_TERMINAL_PROMPT = "0";
+  env.GIT_CONFIG_COUNT = "2";
+  env.GIT_CONFIG_KEY_0 = "credential.helper";
+  env.GIT_CONFIG_VALUE_0 = "";
+  env.GIT_CONFIG_KEY_1 = "credential.helper";
+  env.GIT_CONFIG_VALUE_1 = '!f() { test "$1" = get || exit 0; token="${GITHUB_TOKEN:-${GH_TOKEN:-${RIG_GITHUB_TOKEN:-}}}"; test -n "$token" || exit 0; echo username=x-access-token; echo password="$token"; }; f';
+}
 function persistRuntimeSecrets(runtimeRoot, env) {
   const secretsPath = resolve7(runtimeRoot, "runtime-secrets.json");
   const persisted = {};
   for (const key of [
     "GITHUB_TOKEN",
     "GH_TOKEN",
+    "RIG_GITHUB_TOKEN",
     "GREPTILE_GITHUB_TOKEN",
     "GREPTILE_API_KEY",
     "AI_REVIEW_MODE",