@h-rig/runtime 0.0.6-alpha.0

package/dist/src/index.js

@@ -0,0 +1,1633 @@
+// @bun
+// packages/runtime/src/events.ts
+import { appendFile, mkdir } from "fs/promises";
+import { randomUUID } from "crypto";
+import { dirname as dirname2, resolve as resolve2 } from "path";
+
+// packages/runtime/src/layout.ts
+import { existsSync } from "fs";
+import { basename, dirname, resolve } from "path";
+var RIG_DEFINITION_DIRNAME = "rig";
+var RIG_STATE_DIRNAME = ".rig";
+var RIG_ARTIFACTS_DIRNAME = "artifacts";
+function resolveNearestRigProjectRoot(startDir) {
+  let current = resolve(startDir);
+  let fallbackCandidate = null;
+  let projectCandidate = null;
+  for (;; ) {
+    const hasDefinition = existsSync(resolve(current, RIG_DEFINITION_DIRNAME));
+    const hasState = existsSync(resolve(current, RIG_STATE_DIRNAME));
+    const hasConfig = existsSync(resolve(current, "rig.config.ts")) || existsSync(resolve(current, "rig.config.json"));
+    const hasControlPlane = existsSync(resolve(current, "packages", "cli", "bin", "rig.ts")) || existsSync(resolve(current, "packages", "server"));
+    if (hasDefinition || hasState || hasConfig) {
+      fallbackCandidate = current;
+      if (hasControlPlane) {
+        projectCandidate = current;
+      }
+    }
+    const parent = resolve(current, "..");
+    if (parent === current) {
+      return projectCandidate ?? fallbackCandidate ?? resolve(startDir);
+    }
+    current = parent;
+  }
+}
+function resolveMonorepoRoot(projectRoot) {
+  const normalizedProjectRoot = resolve(projectRoot);
+  const explicit = process.env.MONOREPO_ROOT?.trim();
+  if (explicit) {
+    const explicitRoot = resolve(explicit);
+    const explicitParent = dirname(explicitRoot);
+    if (basename(explicitParent) === ".worktrees") {
+      const owner = dirname(explicitParent);
+      const ownerHasGit = existsSync(resolve(owner, ".git"));
+      const ownerHasTaskConfig = existsSync(resolve(owner, ".rig", "task-config.json"));
+      const ownerHasRigConfig = existsSync(resolve(owner, "rig.config.ts"));
+      if (ownerHasGit && (ownerHasTaskConfig || ownerHasRigConfig)) {
+        return owner;
+      }
+      throw new Error(`MONOREPO_ROOT points to worktree ${explicitRoot}, but the owner checkout is incomplete at ${owner}.`);
+    }
+    if (!existsSync(resolve(explicitRoot, ".git"))) {
+      throw new Error(`MONOREPO_ROOT points to ${explicitRoot}, but no git checkout was found there.`);
+    }
+    const hasTaskConfig = existsSync(resolve(explicitRoot, ".rig", "task-config.json"));
+    const hasRigConfig = existsSync(resolve(explicitRoot, "rig.config.ts"));
+    if (!hasTaskConfig && !hasRigConfig) {
+      throw new Error(`MONOREPO_ROOT points to ${explicitRoot}, but neither .rig/task-config.json nor rig.config.ts exists there.`);
+    }
+    return explicitRoot;
+  }
+  const projectParent = dirname(normalizedProjectRoot);
+  if (basename(projectParent) === ".worktrees") {
+    const worktreeOwner = dirname(projectParent);
+    const ownerHasGit = existsSync(resolve(worktreeOwner, ".git"));
+    const ownerHasTaskConfig = existsSync(resolve(worktreeOwner, ".rig", "task-config.json"));
+    const ownerHasRigConfig = existsSync(resolve(worktreeOwner, "rig.config.ts"));
+    if (ownerHasGit && (ownerHasTaskConfig || ownerHasRigConfig)) {
+      return worktreeOwner;
+    }
+  }
+  return normalizedProjectRoot;
+}
+function resolveRuntimeWorkspaceLayout(workspaceDir) {
+  const root = resolve(workspaceDir);
+  const rigRoot = resolve(root, ".rig");
+  const logsDir = resolve(rigRoot, "logs");
+  const stateDir = resolve(rigRoot, "state");
+  const runtimeDir = resolve(rigRoot, "runtime");
+  const binDir = resolve(rigRoot, "bin");
+  return {
+    workspaceDir: root,
+    rigRoot,
+    stateDir,
+    logsDir,
+    artifactsRoot: resolve(root, RIG_ARTIFACTS_DIRNAME),
+    runtimeDir,
+    homeDir: resolve(rigRoot, "home"),
+    tmpDir: resolve(rigRoot, "tmp"),
+    cacheDir: resolve(rigRoot, "cache"),
+    sessionDir: resolve(rigRoot, "session"),
+    binDir,
+    distDir: resolve(rigRoot, "dist"),
+    pluginBinDir: resolve(binDir, "plugins"),
+    contextPath: resolve(rigRoot, "runtime-context.json"),
+    controlPlaneEventsFile: resolve(logsDir, "control-plane.events.jsonl")
+  };
+}
+function resolveActiveRuntimeWorkspaceRoot(monorepoRoot) {
+  const explicit = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (!explicit) {
+    throw new Error("No active runtime workspace. Set RIG_TASK_WORKSPACE or provision a task runtime first.");
+  }
+  return resolve(explicit);
+}
+function resolveRigLayout(projectRoot) {
+  const monorepoRoot = resolveMonorepoRoot(projectRoot);
+  const definitionRoot = resolve(projectRoot, RIG_DEFINITION_DIRNAME);
+  const runtimeWorkspaceRoot = resolveActiveRuntimeWorkspaceRoot(monorepoRoot);
+  const runtimeLayout = resolveRuntimeWorkspaceLayout(runtimeWorkspaceRoot);
+  const policyDir = resolve(definitionRoot, "policy");
+  return {
+    projectRoot,
+    monorepoRoot,
+    definitionRoot,
+    runtimeWorkspaceRoot,
+    stateRoot: runtimeLayout.rigRoot,
+    artifactsRoot: runtimeLayout.artifactsRoot,
+    configPath: resolve(definitionRoot, "config.sh"),
+    taskConfigPath: resolve(runtimeWorkspaceRoot, ".rig", "task-config.json"),
+    policyDir,
+    policyFile: resolve(policyDir, "policy.json"),
+    pluginsDir: resolve(definitionRoot, "plugins"),
+    hooksDir: resolve(definitionRoot, "hooks"),
+    toolsDir: resolve(definitionRoot, "tools"),
+    templatesDir: resolve(definitionRoot, "templates"),
+    validationDir: resolve(definitionRoot, "validation"),
+    stateDir: runtimeLayout.stateDir,
+    logsDir: runtimeLayout.logsDir,
+    notificationsDir: resolve(definitionRoot, "notifications"),
+    runtimeDir: runtimeLayout.runtimeDir,
+    distDir: runtimeLayout.distDir,
+    binDir: runtimeLayout.binDir,
+    pluginBinDir: runtimeLayout.pluginBinDir,
+    keybindingsPath: resolve(definitionRoot, "keybindings.json"),
+    controlPlaneEventsFile: runtimeLayout.controlPlaneEventsFile
+  };
+}
+
+// packages/runtime/src/events.ts
+async function appendEvent(eventsFile, event) {
+  await mkdir(dirname2(eventsFile), { recursive: true });
+  await appendFile(eventsFile, `${JSON.stringify(event)}
+`, "utf-8");
+}
+function createEvent(runId, type, payload) {
+  return {
+    id: randomUUID(),
+    runId,
+    timestamp: new Date().toISOString(),
+    type,
+    payload
+  };
+}
+
+class RuntimeEventBus {
+  runId;
+  eventsFile;
+  memoryEvents = [];
+  constructor(options) {
+    this.runId = options.runId || randomUUID();
+    this.eventsFile = options.eventsFile ?? resolveRigLayout(options.projectRoot).controlPlaneEventsFile;
+  }
+  getRunId() {
+    return this.runId;
+  }
+  getEventsFile() {
+    return this.eventsFile;
+  }
+  getMemoryEvents() {
+    return [...this.memoryEvents];
+  }
+  async attachRuntimeBus(runtimeBus) {
+    if (runtimeBus.getEventsFile() === this.eventsFile) {
+      return;
+    }
+    for (const event of this.memoryEvents) {
+      await runtimeBus.ingest(event);
+    }
+  }
+  async attachRuntimeWorkspace(projectRoot) {
+    const runtimeBus = new RuntimeEventBus({ projectRoot, runId: this.runId });
+    await this.attachRuntimeBus(runtimeBus);
+    return runtimeBus;
+  }
+  async ingest(event) {
+    this.memoryEvents.push(event);
+    await appendEvent(this.eventsFile, event);
+  }
+  async emit(type, payload) {
+    const event = createEvent(this.runId, type, payload);
+    await this.ingest(event);
+    return event;
+  }
+}
+
+class GeneralCliEventBus {
+  runId;
+  eventsFile;
+  memoryEvents = [];
+  runtimeBuses = new Map;
+  constructor(options) {
+    this.runId = options.runId || randomUUID();
+    this.eventsFile = options.eventsFile ?? resolve2(options.projectRoot, ".rig", "logs", "control-plane.events.jsonl");
+  }
+  getRunId() {
+    return this.runId;
+  }
+  getEventsFile() {
+    return this.eventsFile;
+  }
+  getMemoryEvents() {
+    return [...this.memoryEvents];
+  }
+  async attachRuntimeBus(runtimeBus) {
+    const key = runtimeBus.getEventsFile();
+    if (this.runtimeBuses.has(key)) {
+      return;
+    }
+    this.runtimeBuses.set(key, runtimeBus);
+    for (const event of this.memoryEvents) {
+      await runtimeBus.ingest(event);
+    }
+  }
+  async attachRuntimeWorkspace(projectRoot) {
+    const runtimeBus = new RuntimeEventBus({ projectRoot, runId: this.runId });
+    await this.attachRuntimeBus(runtimeBus);
+    return runtimeBus;
+  }
+  async emit(type, payload) {
+    const event = createEvent(this.runId, type, payload);
+    this.memoryEvents.push(event);
+    await appendEvent(this.eventsFile, event);
+    await Promise.all(Array.from(this.runtimeBuses.values()).map((bus) => bus.ingest(event)));
+    return event;
+  }
+}
+// packages/runtime/src/baked-secrets.ts
+import { existsSync as existsSync2, readFileSync } from "fs";
+import { resolve as resolve3 } from "path";
+var BAKED_RUNTIME_SECRETS = {
+  ANTHROPIC_API_KEY: typeof RIG_BAKED_ANTHROPIC_API_KEY !== "undefined" ? RIG_BAKED_ANTHROPIC_API_KEY : "",
+  OPENAI_API_KEY: typeof RIG_BAKED_OPENAI_API_KEY !== "undefined" ? RIG_BAKED_OPENAI_API_KEY : "",
+  OPENROUTER_API_KEY: typeof RIG_BAKED_OPENROUTER_API_KEY !== "undefined" ? RIG_BAKED_OPENROUTER_API_KEY : "",
+  AI_REVIEW_MODE: typeof RIG_BAKED_AI_REVIEW_MODE !== "undefined" ? RIG_BAKED_AI_REVIEW_MODE : "",
+  AI_REVIEW_PROVIDER: typeof RIG_BAKED_AI_REVIEW_PROVIDER !== "undefined" ? RIG_BAKED_AI_REVIEW_PROVIDER : "",
+  GREPTILE_API_BASE: typeof RIG_BAKED_GREPTILE_API_BASE !== "undefined" ? RIG_BAKED_GREPTILE_API_BASE : "",
+  GREPTILE_REMOTE: typeof RIG_BAKED_GREPTILE_REMOTE !== "undefined" ? RIG_BAKED_GREPTILE_REMOTE : "",
+  GREPTILE_REPOSITORY: typeof RIG_BAKED_GREPTILE_REPOSITORY !== "undefined" ? RIG_BAKED_GREPTILE_REPOSITORY : "",
+  GREPTILE_CONTEXT_BRANCH: typeof RIG_BAKED_GREPTILE_CONTEXT_BRANCH !== "undefined" ? RIG_BAKED_GREPTILE_CONTEXT_BRANCH : "",
+  GREPTILE_DEFAULT_BRANCH: typeof RIG_BAKED_GREPTILE_DEFAULT_BRANCH !== "undefined" ? RIG_BAKED_GREPTILE_DEFAULT_BRANCH : "",
+  GREPTILE_API_KEY: typeof RIG_BAKED_GREPTILE_API_KEY !== "undefined" ? RIG_BAKED_GREPTILE_API_KEY : "",
+  GREPTILE_GITHUB_TOKEN: typeof RIG_BAKED_GREPTILE_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GREPTILE_GITHUB_TOKEN : "",
+  GREPTILE_POLL_ATTEMPTS: typeof RIG_BAKED_GREPTILE_POLL_ATTEMPTS !== "undefined" ? RIG_BAKED_GREPTILE_POLL_ATTEMPTS : "",
+  GREPTILE_POLL_INTERVAL_MS: typeof RIG_BAKED_GREPTILE_POLL_INTERVAL_MS !== "undefined" ? RIG_BAKED_GREPTILE_POLL_INTERVAL_MS : "",
+  GH_TOKEN: typeof RIG_BAKED_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GITHUB_TOKEN : "",
+  GITHUB_TOKEN: typeof RIG_BAKED_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GITHUB_TOKEN : "",
+  GITHUB_SSH_KEY: typeof RIG_BAKED_GITHUB_SSH_KEY !== "undefined" ? RIG_BAKED_GITHUB_SSH_KEY : "",
+  AWS_ACCESS_KEY_ID: typeof RIG_BAKED_AWS_ACCESS_KEY_ID !== "undefined" ? RIG_BAKED_AWS_ACCESS_KEY_ID : "",
+  AWS_SECRET_ACCESS_KEY: typeof RIG_BAKED_AWS_SECRET_ACCESS_KEY !== "undefined" ? RIG_BAKED_AWS_SECRET_ACCESS_KEY : "",
+  AWS_REGION: typeof RIG_BAKED_AWS_REGION !== "undefined" ? RIG_BAKED_AWS_REGION : "",
+  LINEAR_API_KEY: typeof RIG_BAKED_LINEAR_API_KEY !== "undefined" ? RIG_BAKED_LINEAR_API_KEY : "",
+  LINEAR_WEBHOOK_SECRET: typeof RIG_BAKED_LINEAR_WEBHOOK_SECRET !== "undefined" ? RIG_BAKED_LINEAR_WEBHOOK_SECRET : ""
+};
+function resolveRuntimeSecrets(env, baked = BAKED_RUNTIME_SECRETS) {
+  const resolved = {};
+  const keys = new Set([
+    ...Object.keys(BAKED_RUNTIME_SECRETS),
+    ...Object.keys(baked)
+  ]);
+  for (const key of keys) {
+    const envValue = env[key]?.trim();
+    const bakedValue = baked[key]?.trim();
+    if (envValue) {
+      resolved[key] = envValue;
+    } else if (bakedValue) {
+      resolved[key] = bakedValue;
+    }
+  }
+  return resolved;
+}
+function loadDotEnvSecrets(projectRoot, env = process.env) {
+  const dotenvPath = resolve3(projectRoot, ".env");
+  if (!existsSync2(dotenvPath)) {
+    return {};
+  }
+  const parsed = {};
+  const lines = readFileSync(dotenvPath, "utf-8").split(/\r?\n/);
+  for (const rawLine of lines) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) {
+      continue;
+    }
+    const exportMatch = line.match(/^(?:export\s+)?([A-Z0-9_]+)\s*=\s*(.*)$/);
+    if (!exportMatch) {
+      continue;
+    }
+    const key = exportMatch[1];
+    if (!(key in BAKED_RUNTIME_SECRETS)) {
+      continue;
+    }
+    const value = expandShellValue(exportMatch[2] ?? "", { ...env, ...parsed });
+    if (value) {
+      parsed[key] = value;
+    }
+  }
+  return parsed;
+}
+function secretDefinesFromEnv(env = process.env, projectRoot) {
+  const dotenvSecrets = projectRoot ? loadDotEnvSecrets(projectRoot, env) : {};
+  const resolved = resolveRuntimeSecrets(env, {
+    ...BAKED_RUNTIME_SECRETS,
+    ...dotenvSecrets
+  });
+  return {
+    RIG_BAKED_ANTHROPIC_API_KEY: resolved.ANTHROPIC_API_KEY || "",
+    RIG_BAKED_OPENAI_API_KEY: resolved.OPENAI_API_KEY || "",
+    RIG_BAKED_OPENROUTER_API_KEY: resolved.OPENROUTER_API_KEY || "",
+    RIG_BAKED_AI_REVIEW_MODE: resolved.AI_REVIEW_MODE || "",
+    RIG_BAKED_AI_REVIEW_PROVIDER: resolved.AI_REVIEW_PROVIDER || "",
+    RIG_BAKED_GREPTILE_API_BASE: resolved.GREPTILE_API_BASE || "",
+    RIG_BAKED_GREPTILE_REMOTE: resolved.GREPTILE_REMOTE || "",
+    RIG_BAKED_GREPTILE_REPOSITORY: resolved.GREPTILE_REPOSITORY || "",
+    RIG_BAKED_GREPTILE_CONTEXT_BRANCH: resolved.GREPTILE_CONTEXT_BRANCH || "",
+    RIG_BAKED_GREPTILE_DEFAULT_BRANCH: resolved.GREPTILE_DEFAULT_BRANCH || "",
+    RIG_BAKED_GREPTILE_API_KEY: resolved.GREPTILE_API_KEY || "",
+    RIG_BAKED_GREPTILE_GITHUB_TOKEN: resolved.GREPTILE_GITHUB_TOKEN || "",
+    RIG_BAKED_GREPTILE_POLL_ATTEMPTS: resolved.GREPTILE_POLL_ATTEMPTS || "",
+    RIG_BAKED_GREPTILE_POLL_INTERVAL_MS: resolved.GREPTILE_POLL_INTERVAL_MS || "",
+    RIG_BAKED_GITHUB_TOKEN: resolved.GITHUB_TOKEN || resolved.GH_TOKEN || "",
+    RIG_BAKED_GITHUB_SSH_KEY: resolved.GITHUB_SSH_KEY || "",
+    RIG_BAKED_AWS_ACCESS_KEY_ID: resolved.AWS_ACCESS_KEY_ID || "",
+    RIG_BAKED_AWS_SECRET_ACCESS_KEY: resolved.AWS_SECRET_ACCESS_KEY || "",
+    RIG_BAKED_AWS_REGION: resolved.AWS_REGION || "",
+    RIG_BAKED_LINEAR_API_KEY: resolved.LINEAR_API_KEY || "",
+    RIG_BAKED_LINEAR_WEBHOOK_SECRET: resolved.LINEAR_WEBHOOK_SECRET || ""
+  };
+}
+function expandShellValue(rawValue, env) {
+  let value = rawValue.trim();
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    value = value.slice(1, -1);
+  }
+  return value.replace(/\$\{([A-Z0-9_]+)(:-([^}]*))?\}/g, (_match, name, _defaultGroup, fallback) => {
+    const envValue = env[name]?.trim();
+    if (envValue) {
+      return envValue;
+    }
+    return fallback ?? "";
+  });
+}
+// packages/runtime/src/control-plane/runtime/context.ts
+import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { dirname as dirname3, resolve as resolve4 } from "path";
+var RUNTIME_CONTEXT_ENV = "RIG_RUNTIME_CONTEXT_FILE";
+var runtimeContextStringFields = [
+  "runtimeId",
+  "taskId",
+  "role",
+  "workspaceDir",
+  "stateDir",
+  "logsDir",
+  "sessionDir",
+  "sessionFile",
+  "policyFile",
+  "binDir",
+  "createdAt"
+];
+var runtimeContextArrayFields = ["scopes", "validation"];
+var runtimeContextOptionalStringFields = [
+  "artifactRoot",
+  "hostProjectRoot",
+  "monorepoMainRoot",
+  "monorepoBaseRef",
+  "monorepoBaseCommit"
+];
+function writeRuntimeContext(path, ctx) {
+  const absPath = resolve4(path);
+  const dir = dirname3(absPath);
+  if (!existsSync3(dir)) {
+    mkdirSync(dir, { recursive: true });
+  }
+  writeFileSync(absPath, JSON.stringify(ctx, null, 2), "utf8");
+}
+function loadRuntimeContext(path) {
+  const absPath = resolve4(path);
+  if (!existsSync3(absPath)) {
+    throw new Error(`RuntimeTaskContext file not found: ${absPath}`);
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync2(absPath, "utf8"));
+  } catch (err) {
+    throw new Error(`Failed to parse RuntimeTaskContext at ${absPath}: ${String(err)}`);
+  }
+  if (typeof raw !== "object" || raw === null) {
+    throw new Error(`RuntimeTaskContext at ${absPath} is not an object`);
+  }
+  const obj = raw;
+  for (const field of runtimeContextStringFields) {
+    if (typeof obj[field] !== "string" || obj[field].length === 0) {
+      throw new Error(`RuntimeTaskContext field "${field}" must be a non-empty string (at ${absPath})`);
+    }
+  }
+  for (const field of runtimeContextArrayFields) {
+    if (!Array.isArray(obj[field])) {
+      throw new Error(`RuntimeTaskContext field "${field}" must be an array (at ${absPath})`);
+    }
+    if (!obj[field].every((entry) => typeof entry === "string")) {
+      throw new Error(`RuntimeTaskContext field "${field}" must be a string[] (at ${absPath})`);
+    }
+  }
+  for (const field of runtimeContextOptionalStringFields) {
+    if (field in obj && obj[field] !== undefined && typeof obj[field] !== "string") {
+      throw new Error(`RuntimeTaskContext field "${field}" must be a string when present (at ${absPath})`);
+    }
+  }
+  if (obj.browser !== undefined) {
+    if (typeof obj.browser !== "object" || obj.browser === null || Array.isArray(obj.browser)) {
+      throw new Error(`RuntimeTaskContext field "browser" must be an object when present (at ${absPath})`);
+    }
+    const browser = obj.browser;
+    for (const field of [
+      "preset",
+      "mode",
+      "stateDir",
+      "defaultProfile",
+      "effectiveProfile",
+      "defaultAttachUrl",
+      "effectiveAttachUrl",
+      "launchHelper",
+      "checkHelper",
+      "attachInfoHelper",
+      "e2eHelper",
+      "resetProfileHelper"
+    ]) {
+      if (typeof browser[field] !== "string" || browser[field].length === 0) {
+        throw new Error(`RuntimeTaskContext field "browser.${field}" must be a non-empty string (at ${absPath})`);
+      }
+    }
+    for (const field of ["devCommand", "launchCommand", "checkCommand", "e2eCommand"]) {
+      if (browser[field] !== undefined && typeof browser[field] !== "string") {
+        throw new Error(`RuntimeTaskContext field "browser.${field}" must be a string when present (at ${absPath})`);
+      }
+    }
+    if (typeof browser.required !== "boolean") {
+      throw new Error(`RuntimeTaskContext field "browser.required" must be a boolean (at ${absPath})`);
+    }
+  }
+  if (obj.memory !== undefined) {
+    if (typeof obj.memory !== "object" || obj.memory === null || Array.isArray(obj.memory)) {
+      throw new Error(`RuntimeTaskContext field "memory" must be an object when present (at ${absPath})`);
+    }
+    const memory = obj.memory;
+    for (const field of ["canonicalPath", "canonicalRef", "canonicalBaseOid", "hydratedPath"]) {
+      if (typeof memory[field] !== "string" || memory[field].length === 0) {
+        throw new Error(`RuntimeTaskContext field "memory.${field}" must be a non-empty string (at ${absPath})`);
+      }
+    }
+    if (typeof memory.createdFresh !== "boolean") {
+      throw new Error(`RuntimeTaskContext field "memory.createdFresh" must be a boolean (at ${absPath})`);
+    }
+    if (typeof memory.retrieval !== "object" || memory.retrieval === null || Array.isArray(memory.retrieval)) {
+      throw new Error(`RuntimeTaskContext field "memory.retrieval" must be an object (at ${absPath})`);
+    }
+    const retrieval = memory.retrieval;
+    for (const field of ["topK", "lexicalWeight", "vectorWeight", "recencyWeight", "confidenceWeight"]) {
+      if (typeof retrieval[field] !== "number" || Number.isNaN(retrieval[field])) {
+        throw new Error(`RuntimeTaskContext field "memory.retrieval.${field}" must be a number (at ${absPath})`);
+      }
+    }
+  }
+  if (obj.initialDirtyFiles !== undefined) {
+    if (typeof obj.initialDirtyFiles !== "object" || obj.initialDirtyFiles === null || Array.isArray(obj.initialDirtyFiles)) {
+      throw new Error(`RuntimeTaskContext field "initialDirtyFiles" must be an object when present (at ${absPath})`);
+    }
+    const dirtyFiles = obj.initialDirtyFiles;
+    for (const key of ["project", "monorepo"]) {
+      if (dirtyFiles[key] === undefined) {
+        continue;
+      }
+      if (!Array.isArray(dirtyFiles[key]) || !dirtyFiles[key].every((entry) => typeof entry === "string")) {
+        throw new Error(`RuntimeTaskContext field "initialDirtyFiles.${key}" must be a string[] when present (at ${absPath})`);
+      }
+    }
+  }
+  if (obj.initialHeadCommits !== undefined) {
+    if (typeof obj.initialHeadCommits !== "object" || obj.initialHeadCommits === null || Array.isArray(obj.initialHeadCommits)) {
+      throw new Error(`RuntimeTaskContext field "initialHeadCommits" must be an object when present (at ${absPath})`);
+    }
+    const headCommits = obj.initialHeadCommits;
+    for (const key of ["project", "monorepo"]) {
+      if (headCommits[key] === undefined) {
+        continue;
+      }
+      if (typeof headCommits[key] !== "string") {
+        throw new Error(`RuntimeTaskContext field "initialHeadCommits.${key}" must be a string when present (at ${absPath})`);
+      }
+    }
+  }
+  return obj;
+}
+function loadRuntimeContextFromEnv(env = process.env) {
+  const contextFile = env[RUNTIME_CONTEXT_ENV];
+  if (contextFile) {
+    return loadRuntimeContext(contextFile);
+  }
+  const inferred = findRuntimeContextFile(process.cwd());
+  if (!inferred) {
+    return null;
+  }
+  return loadRuntimeContext(inferred);
+}
+function findRuntimeContextFile(startPath) {
+  let current = resolve4(startPath);
+  while (true) {
+    const candidate = resolve4(current, "runtime-context.json");
+    if (existsSync3(candidate) && isAgentRuntimeContextPath(candidate)) {
+      return candidate;
+    }
+    const parent = dirname3(current);
+    if (parent === current) {
+      return "";
+    }
+    current = parent;
+  }
+}
+function isAgentRuntimeContextPath(path) {
+  const normalized = path.replace(/\\/g, "/");
+  return /\/\.rig\/runtime-context\.json$/.test(normalized);
+}
+// packages/runtime/src/local-server.ts
+import { spawn } from "child_process";
+import { closeSync, existsSync as existsSync4, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync3, unlinkSync } from "fs";
+import { resolve as resolve5 } from "path";
+function parsePublishedRigServerState(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return null;
+  }
+  const candidate = value;
+  if (typeof candidate.pid !== "number" || !Number.isInteger(candidate.pid) || candidate.pid <= 0 || typeof candidate.host !== "string" || candidate.host.trim().length === 0 || typeof candidate.port !== "number" || !Number.isInteger(candidate.port) || candidate.port < 1 || candidate.port > 65535 || candidate.authToken !== null && candidate.authToken !== undefined && typeof candidate.authToken !== "string" || typeof candidate.startedAt !== "string" || candidate.startedAt.trim().length === 0) {
+    return null;
+  }
+  return {
+    pid: candidate.pid,
+    host: candidate.host,
+    port: candidate.port,
+    authToken: candidate.authToken ?? null,
+    startedAt: candidate.startedAt
+  };
+}
+function resolveRigServerLogPath(projectRoot) {
+  return resolve5(resolveRigServerPaths(projectRoot).logsDir, "rig-server.bootstrap.log");
+}
+function resolvePublishedRigServerStatePath(projectRoot) {
+  return resolve5(resolveRigServerPaths(projectRoot).stateDir, "rig-server.json");
+}
+function resolveRigServerPaths(projectRoot) {
+  const taskWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
+  const explicitStateDir = process.env.RIG_STATE_DIR?.trim();
+  const explicitLogsDir = process.env.RIG_LOGS_DIR?.trim();
+  const explicitSessionFile = process.env.RIG_SESSION_FILE?.trim();
+  const hostStateRoot = resolve5(projectRoot, ".rig");
+  const monorepoStateRoot = resolve5(resolveMonorepoRoot(projectRoot), ".rig");
+  const stateRoot = taskWorkspace ? resolve5(taskWorkspace, ".rig") : explicitStateDir ? resolve5(explicitStateDir, "..") : explicitLogsDir ? resolve5(explicitLogsDir, "..") : explicitSessionFile ? resolve5(explicitSessionFile, "..", "..") : existsSync4(hostStateRoot) ? hostStateRoot : monorepoStateRoot;
+  return {
+    stateDir: explicitStateDir ? resolve5(explicitStateDir) : resolve5(stateRoot, "state"),
+    logsDir: explicitLogsDir ? resolve5(explicitLogsDir) : resolve5(stateRoot, "logs")
+  };
+}
+async function readPublishedRigServerState(projectRoot) {
+  return readPublishedRigServerStateSync(projectRoot);
+}
+function readPublishedRigServerStateSync(projectRoot) {
+  const filePath = resolvePublishedRigServerStatePath(projectRoot);
+  if (!existsSync4(filePath)) {
+    return null;
+  }
+  try {
+    const rawState = readFileSync3(filePath, "utf8");
+    return parsePublishedRigServerState(JSON.parse(rawState));
+  } catch {
+    return null;
+  }
+}
+function clearPublishedRigServerState(projectRoot) {
+  const filePath = resolvePublishedRigServerStatePath(projectRoot);
+  try {
+    unlinkSync(filePath);
+  } catch {}
+}
+function toLocalServerConnection(published) {
+  const baseUrl = `http://${published.host}:${published.port}`;
+  const wsUrl = new URL(`ws://${published.host}:${published.port}`);
+  if (published.authToken) {
+    wsUrl.searchParams.set("token", published.authToken);
+  }
+  return {
+    baseUrl,
+    wsUrl: wsUrl.toString(),
+    host: published.host,
+    port: published.port,
+    authToken: published.authToken
+  };
+}
+async function waitForServerHealthy(baseUrl, authToken, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  const healthUrl = new URL(`${baseUrl}/health`);
+  if (authToken !== null) {
+    healthUrl.searchParams.set("token", authToken);
+  }
+  while (Date.now() < deadline) {
+    try {
+      const response = await fetch(healthUrl.toString());
+      if (response.ok) {
+        return true;
+      }
+    } catch {}
+    await Bun.sleep(150);
+  }
+  return false;
+}
+async function waitForPublishedServer(projectRoot, authToken, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const published = await readPublishedRigServerState(projectRoot);
+    if (published && published.authToken === authToken) {
+      const connection = toLocalServerConnection(published);
+      if (await waitForServerHealthy(connection.baseUrl, connection.authToken, 500)) {
+        return published;
+      }
+    }
+    await Bun.sleep(250);
+  }
+  return null;
+}
+async function ensureLocalRigServerConnection(projectRoot, options = {}) {
+  const published = await readPublishedRigServerState(projectRoot);
+  if (published) {
+    const connection = toLocalServerConnection(published);
+    if (await waitForServerHealthy(connection.baseUrl, connection.authToken, 1500)) {
+      return connection;
+    }
+  }
+  const host = options.host ?? "127.0.0.1";
+  const startupTimeoutMs = options.startupTimeoutMs ?? 15000;
+  const authToken = Buffer.from(crypto.getRandomValues(new Uint8Array(24))).toString("hex");
+  const workspaceRoot = resolve5(import.meta.dir, "../../..");
+  const bootstrapLogPath = resolveRigServerLogPath(projectRoot);
+  mkdirSync2(resolveRigServerPaths(projectRoot).logsDir, { recursive: true });
+  const bootstrapLogFd = openSync(bootstrapLogPath, "w");
+  clearPublishedRigServerState(projectRoot);
+  const child = spawn("bun", [
+    "run",
+    "packages/server/src/server.ts",
+    "start",
+    "--host",
+    host,
+    "--port",
+    "0",
+    "--auth-token",
+    authToken
+  ], {
+    cwd: workspaceRoot,
+    env: {
+      ...process.env,
+      PROJECT_RIG_ROOT: projectRoot
+    },
+    detached: true,
+    stdio: ["ignore", bootstrapLogFd, bootstrapLogFd]
+  });
+  closeSync(bootstrapLogFd);
+  child.unref();
+  const ready = await waitForPublishedServer(projectRoot, authToken, startupTimeoutMs);
+  if (!ready) {
+    child.kill();
+    const bootstrapLog = existsSync4(bootstrapLogPath) ? readFileSync3(bootstrapLogPath, "utf8").trim() : "";
+    const diagnostics = bootstrapLog ? ` Startup log (${bootstrapLogPath}):
+${bootstrapLog}` : ` No bootstrap log was written.`;
+    throw new Error(`Timed out waiting for the local Rig server to start.${diagnostics}`);
+  }
+  return toLocalServerConnection(ready);
+}
+// packages/runtime/src/binary-run.ts
+import { spawn as nodeSpawn } from "child_process";
+import { chmodSync, cpSync, existsSync as existsSync5, mkdirSync as mkdirSync3, renameSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { basename as basename2, dirname as dirname4, resolve as resolve6 } from "path";
+import { fileURLToPath } from "url";
+import { drainMicrotasks, gcAndSweep } from "bun:jsc";
+var runtimeBinaryAssetEntries = [
+  "hooks",
+  "lib",
+  "tools",
+  "templates",
+  "policy",
+  "plugins",
+  "config.sh",
+  "task-config.json"
+];
+var runtimeBinaryBuildQueue = Promise.resolve();
+function isRuntimeBinaryAssetEntry(value) {
+  return runtimeBinaryAssetEntries.includes(value);
+}
+function createRuntimeBinaryBuildManifest(input) {
+  return {
+    name: input.name ?? "project-rig-harness",
+    builtAt: input.builtAt ?? new Date().toISOString(),
+    gitHead: input.gitHead ?? "unknown",
+    bunVersion: input.bunVersion,
+    binaries: { ...input.binaries },
+    runtimeAssets: [...input.runtimeAssets ?? runtimeBinaryAssetEntries]
+  };
+}
+async function buildRuntimeBinary(options) {
+  return runSerializedRuntimeBinaryBuild(async () => {
+    const resolved = resolveRuntimeBinaryBuildOptions(options);
+    runBestEffortBuildGc();
+    const manifestPath = runtimeBinaryCacheManifestPath(resolved.outputPath);
+    const buildKey = createRuntimeBinaryBuildKey({
+      entrypoint: resolved.entrypoint,
+      define: resolved.define,
+      env: resolved.env
+    });
+    if (await isRuntimeBinaryBuildFresh({ outputPath: resolved.outputPath, manifestPath, buildKey })) {
+      return;
+    }
+    if (shouldUseRuntimeBinaryBuildWorker()) {
+      await buildRuntimeBinaryViaWorker(resolved);
+    } else {
+      await buildRuntimeBinaryInProcess(resolved, { manifestPath, buildKey });
+    }
+    runBestEffortBuildGc();
+  });
+}
+async function buildRuntimeBinaryInProcess(options, manifest) {
+  const tempBuildDir = resolve6(dirname4(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  const tempOutputPath = resolve6(tempBuildDir, basename2(options.outputPath));
+  mkdirSync3(tempBuildDir, { recursive: true });
+  await withTemporaryEnv({
+    ...options.env,
+    ...options.define ? { RIG_BUILD_CONFIG_JSON: JSON.stringify(options.define) } : {}
+  }, async () => withTemporaryCwd(tempBuildDir, async () => {
+    const buildResult = await Bun.build({
+      entrypoints: [options.entrypoint],
+      compile: {
+        target: currentCompileTarget(),
+        outfile: tempOutputPath
+      },
+      target: "bun",
+      format: "esm",
+      minify: true,
+      bytecode: true,
+      metafile: true,
+      define: options.define ? {
+        __RIG_BUILD_CONFIG__: JSON.stringify(options.define)
+      } : undefined
+    });
+    if (!buildResult.success) {
+      const details = buildResult.logs.map((log) => [log.message, log.position?.file ? `${log.position.file}:${log.position.line}:${log.position.column}` : ""].filter(Boolean).join(" ")).filter(Boolean).join(`
+`);
+      throw new Error(`Failed to build ${options.entrypoint}: ${details || "Bun.build() returned errors"}`);
+    }
+    if (!existsSync5(tempOutputPath)) {
+      const emitted = buildResult.outputs.map((output) => output.path).join(", ") || "(none)";
+      throw new Error(`Failed to build ${options.entrypoint}: Bun.build() did not emit ${tempOutputPath}. Emitted: ${emitted}`);
+    }
+    renameSync(tempOutputPath, options.outputPath);
+    chmodSync(options.outputPath, 493);
+    if (manifest) {
+      await writeRuntimeBinaryCacheManifest({
+        manifestPath: manifest.manifestPath,
+        buildKey: manifest.buildKey,
+        cwd: tempBuildDir,
+        metafile: buildResult.metafile
+      });
+    }
+  })).finally(() => {
+    rmSync(tempBuildDir, { recursive: true, force: true });
+  });
+}
+function runBestEffortBuildGc() {
+  try {
+    drainMicrotasks();
+  } catch {}
+  try {
+    gcAndSweep();
+  } catch {}
+}
+function runtimeBinaryCacheManifestPath(outputPath) {
+  return `${outputPath}.build-manifest.json`;
+}
+function resolveRuntimeBinaryBuildOptions(options) {
+  return {
+    ...options,
+    entrypoint: resolve6(options.cwd, options.sourcePath),
+    outputPath: resolve6(options.outputPath)
+  };
+}
+function shouldUseRuntimeBinaryBuildWorker() {
+  if (process.env.RIG_RUNTIME_BUILD_WORKER === "1") {
+    return false;
+  }
+  if (process.env.RIG_RUNTIME_BUILD_IN_PROCESS === "1") {
+    return false;
+  }
+  return true;
+}
+async function buildRuntimeBinaryViaWorker(options) {
+  const workerSourcePath = resolveRuntimeBinaryBuildWorkerSourcePath(options);
+  if (!workerSourcePath || !existsSync5(workerSourcePath)) {
+    await buildRuntimeBinaryInProcess(options, {
+      manifestPath: runtimeBinaryCacheManifestPath(options.outputPath),
+      buildKey: createRuntimeBinaryBuildKey({
+        entrypoint: options.entrypoint,
+        define: options.define,
+        env: options.env
+      })
+    });
+    return;
+  }
+  const payloadPath = createRuntimeBinaryBuildWorkerPayloadPath(options.outputPath);
+  const bunCli = resolveRuntimeBinaryBuildWorkerInvocation();
+  await Bun.write(payloadPath, `${JSON.stringify(options)}
+`);
+  const build = Bun.spawn([bunCli.command, workerSourcePath, payloadPath], {
+    cwd: options.cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: {
+      ...process.env,
+      ...options.env,
+      ...bunCli.env,
+      RIG_RUNTIME_BUILD_WORKER: "1"
+    }
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    build.exited,
+    new Response(build.stdout).text(),
+    new Response(build.stderr).text()
+  ]);
+  rmSync(payloadPath, { force: true });
+  if (exitCode !== 0) {
+    throw new Error(`Failed to build ${options.entrypoint}: ${(stderr || stdout || `worker exited ${exitCode}`).trim()}`);
+  }
+}
+function createRuntimeBinaryBuildWorkerPayloadPath(outputPath) {
+  return resolve6(dirname4(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
+}
+function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
+  const envRoots = [
+    options.cwd?.trim(),
+    process.env.RIG_HOST_PROJECT_ROOT?.trim(),
+    process.env.PROJECT_RIG_ROOT?.trim()
+  ].filter(Boolean);
+  for (const root of envRoots) {
+    const candidate = resolve6(root, "packages/runtime/src/binary-build-worker.ts");
+    if (existsSync5(candidate)) {
+      return candidate;
+    }
+  }
+  const localCandidate = resolve6(import.meta.dir, "binary-build-worker.ts");
+  return existsSync5(localCandidate) ? localCandidate : null;
+}
+function resolveRuntimeBinaryBuildWorkerInvocation() {
+  const bunPath = Bun.which("bun");
+  if (bunPath) {
+    return { command: bunPath, env: {} };
+  }
+  if (process.execPath?.trim()) {
+    return {
+      command: process.execPath,
+      env: { BUN_BE_BUN: "1" }
+    };
+  }
+  throw new Error("bun is required to run the runtime binary build worker.");
+}
+function currentCompileTarget() {
+  if (process.platform === "darwin") {
+    return process.arch === "arm64" ? "bun-darwin-arm64" : "bun-darwin-x64";
+  }
+  if (process.platform === "linux") {
+    return process.arch === "arm64" ? "bun-linux-arm64" : "bun-linux-x64";
+  }
+  return "bun-windows-x64";
+}
+function createRuntimeBinaryBuildKey(input) {
+  return JSON.stringify({
+    version: 1,
+    bunVersion: Bun.version,
+    platform: process.platform,
+    arch: process.arch,
+    entrypoint: input.entrypoint,
+    define: sortRecord(input.define),
+    env: sortRecord(input.env)
+  });
+}
+async function isRuntimeBinaryBuildFresh(input) {
+  if (!existsSync5(input.outputPath) || !existsSync5(input.manifestPath)) {
+    return false;
+  }
+  let manifest = null;
+  try {
+    manifest = await Bun.file(input.manifestPath).json();
+  } catch {
+    return false;
+  }
+  if (!manifest || manifest.version !== 1 || manifest.buildKey !== input.buildKey) {
+    return false;
+  }
+  for (const [filePath, expectedDigest] of Object.entries(manifest.inputs || {})) {
+    if (!existsSync5(filePath)) {
+      return false;
+    }
+    if (await sha256File(filePath) !== expectedDigest) {
+      return false;
+    }
+  }
+  return true;
+}
+async function writeRuntimeBinaryCacheManifest(input) {
+  const inputs = {};
+  for (const inputPath of Object.keys(input.metafile?.inputs || {}).sort()) {
+    const normalized = normalizeBuildInputPath(input.cwd, inputPath);
+    if (!normalized || !existsSync5(normalized)) {
+      continue;
+    }
+    inputs[normalized] = await sha256File(normalized);
+  }
+  const manifest = {
+    version: 1,
+    buildKey: input.buildKey,
+    inputs
+  };
+  await Bun.write(input.manifestPath, `${JSON.stringify(manifest, null, 2)}
+`);
+}
+function normalizeBuildInputPath(cwd, inputPath) {
+  if (!inputPath) {
+    return null;
+  }
+  if (inputPath.startsWith("file://")) {
+    return fileURLToPath(inputPath);
+  }
+  if (inputPath.startsWith("<")) {
+    return null;
+  }
+  return resolve6(cwd, inputPath);
+}
+async function sha256File(path) {
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(await Bun.file(path).arrayBuffer());
+  return hasher.digest("hex");
+}
+function sortRecord(value) {
+  if (!value) {
+    return;
+  }
+  return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)));
+}
+async function runSerializedRuntimeBinaryBuild(action) {
+  const previous = runtimeBinaryBuildQueue;
+  let release;
+  runtimeBinaryBuildQueue = new Promise((resolve7) => {
+    release = resolve7;
+  });
+  await previous;
+  try {
+    return await action();
+  } finally {
+    release();
+  }
+}
+async function withTemporaryEnv(env, action) {
+  if (!env) {
+    return action();
+  }
+  const previousValues = new Map;
+  for (const [key, value] of Object.entries(env)) {
+    previousValues.set(key, process.env[key]);
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+  try {
+    return await action();
+  } finally {
+    for (const [key, value] of previousValues.entries()) {
+      if (value === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+  }
+}
+async function withTemporaryCwd(cwd, action) {
+  const previousCwd = process.cwd();
+  process.chdir(cwd);
+  try {
+    return await action();
+  } finally {
+    process.chdir(previousCwd);
+  }
+}
+function copyRuntimeBinaryAssets(options) {
+  const definitionRoot = options.rigDir ?? resolveRigLayout(options.projectRoot).definitionRoot;
+  const runtimeDir = resolve6(options.outputDir, "runtime", "rig");
+  mkdirSync3(runtimeDir, { recursive: true });
+  const copiedEntries = [];
+  for (const entry of options.entries ?? runtimeBinaryAssetEntries) {
+    const source = resolve6(definitionRoot, entry);
+    if (!existsSync5(source)) {
+      continue;
+    }
+    cpSync(source, resolve6(runtimeDir, entry), { recursive: true });
+    copiedEntries.push(entry);
+  }
+  return { copiedEntries, runtimeDir };
+}
+async function launchRuntimeBinary(request) {
+  const options = {
+    cwd: request.cwd,
+    env: request.env ? { ...process.env, ...request.env } : process.env
+  };
+  if (request.timeoutMs !== undefined) {
+    options.timeoutMs = request.timeoutMs;
+  }
+  return spawnProcess(request.binaryPath, request.args, options);
+}
+async function spawnProcess(command, args, options) {
+  const child = nodeSpawn(command, args, {
+    cwd: options.cwd,
+    env: options.env,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  let stdout = "";
+  let stderr = "";
+  child.stdout?.setEncoding("utf8");
+  child.stderr?.setEncoding("utf8");
+  child.stdout?.on("data", (chunk) => {
+    stdout += chunk;
+  });
+  child.stderr?.on("data", (chunk) => {
+    stderr += chunk;
+  });
+  let timedOut = false;
+  let timer;
+  const exitCode = await new Promise((resolveExit, rejectExit) => {
+    if (options.timeoutMs && options.timeoutMs > 0) {
+      timer = setTimeout(() => {
+        timedOut = true;
+        child.kill();
+      }, options.timeoutMs);
+    }
+    child.once("error", rejectExit);
+    child.once("close", (code) => resolveExit(code ?? (timedOut ? 1 : 0)));
+  }).finally(() => {
+    if (timer) {
+      clearTimeout(timer);
+    }
+  });
+  return { exitCode, stdout, stderr, timedOut };
+}
+// packages/runtime/src/plugins.ts
+import { existsSync as existsSync6, readdirSync } from "fs";
+import { basename as basename3, resolve as resolve7 } from "path";
+
+// packages/runtime/src/control-plane/runtime/plugin-mode.ts
+var LEGACY_PLUGIN_SCAN_ENV = "RIG_LEGACY_PLUGIN_SCAN";
+function isLegacyPluginScanEnabled(env = process.env) {
+  const value = env[LEGACY_PLUGIN_SCAN_ENV]?.trim().toLowerCase();
+  return value === "1" || value === "true" || value === "yes" || value === "on";
+}
+
+// packages/runtime/src/plugins.ts
+var runtimeHookPhases = ["beforeCommand", "afterCommand", "onEvent"];
+var PLUGIN_SOURCE_PATTERN = /\.plugin\.(ts|js|mjs|cjs)$/;
+function inferRuntimePluginName(fileName) {
+  return fileName.replace(PLUGIN_SOURCE_PATTERN, "");
+}
+function describeRuntimePluginFiles(filePaths) {
+  return filePaths.filter((filePath) => PLUGIN_SOURCE_PATTERN.test(filePath)).map((filePath) => {
+    const fileName = filePath.split(/[\\/]/).at(-1) ?? filePath;
+    const name = inferRuntimePluginName(fileName);
+    return { name, sourcePath: filePath, binaryName: name };
+  });
+}
+
+class PluginManager {
+  eventBus;
+  context;
+  pluginDir;
+  pluginFiles;
+  pluginNames;
+  localBinDir;
+  imageBinDir;
+  pluginsRequireBinaries;
+  ensureImageBinDir;
+  plugins = null;
+  loadPromise = null;
+  constructor(options) {
+    this.eventBus = options.eventBus;
+    this.context = options.context;
+    this.pluginDir = options.pluginDir;
+    this.pluginFiles = options.pluginFiles;
+    this.pluginNames = options.pluginNames;
+    this.localBinDir = options.localBinDir;
+    this.imageBinDir = options.imageBinDir;
+    this.pluginsRequireBinaries = options.pluginsRequireBinaries;
+    this.ensureImageBinDir = options.ensureImageBinDir;
+  }
+  static async load(options) {
+    const pluginDir = options.pluginDir ?? resolve7(options.projectRoot, "rig", "plugins");
+    const localBinDir = options.localBinDir ?? resolve7(options.projectRoot, "rig", "plugins");
+    const imageBinDir = options.imageBinDir ?? (options.runtimeContext ? resolve7(options.runtimeContext.binDir, "plugins") : "");
+    const legacyPluginScan = options.legacyPluginScan ?? isLegacyPluginScanEnabled(options.env);
+    const pluginFiles = legacyPluginScan ? safeReadDir(pluginDir).filter((entry) => PLUGIN_SOURCE_PATTERN.test(entry)) : [];
+    const pluginNames = pluginFiles.map((file) => inferRuntimePluginName(basename3(file)));
+    const context = {
+      projectRoot: options.projectRoot,
+      runId: options.runId,
+      eventBus: options.eventBus
+    };
+    return new PluginManager({
+      eventBus: options.eventBus,
+      context,
+      pluginDir,
+      pluginFiles,
+      pluginNames,
+      localBinDir,
+      imageBinDir,
+      pluginsRequireBinaries: options.pluginsRequireBinaries ?? true,
+      ensureImageBinDir: options.ensureImageBinDir
+    });
+  }
+  list() {
+    if (this.plugins) {
+      return this.plugins.map((plugin) => ({
+        name: plugin.name,
+        validators: plugin.validators?.map((validator) => validator.id) ?? []
+      }));
+    }
+    return this.pluginNames.map((name) => ({ name, validators: [] }));
+  }
+  async beforeCommand(ctx) {
+    const plugins = await this.ensureLoaded();
+    for (const plugin of plugins) {
+      if (!plugin.beforeCommand)
+        continue;
+      await this.safeInvoke(plugin.name, "beforeCommand", () => plugin.beforeCommand?.(ctx, this.context));
+    }
+  }
+  async afterCommand(result) {
+    const plugins = await this.ensureLoaded();
+    for (const plugin of plugins) {
+      if (!plugin.afterCommand)
+        continue;
+      await this.safeInvoke(plugin.name, "afterCommand", () => plugin.afterCommand?.(result, this.context));
+    }
+  }
+  async onEvent(event) {
+    const plugins = this.plugins;
+    if (!plugins)
+      return;
+    for (const plugin of plugins) {
+      if (!plugin.onEvent)
+        continue;
+      await this.safeInvoke(plugin.name, "onEvent", () => plugin.onEvent?.(event, this.context));
+    }
+  }
+  async runValidators(taskId) {
+    const plugins = await this.ensureLoaded();
+    const results = [];
+    for (const plugin of plugins) {
+      for (const validator of plugin.validators ?? []) {
+        await this.eventBus.emit("validator.started", {
+          plugin: plugin.name,
+          validator: validator.id,
+          taskId
+        });
+        try {
+          const result = await validator.run({ taskId, projectRoot: this.context.projectRoot }, this.context);
+          results.push(result);
+          await this.eventBus.emit("validator.finished", {
+            plugin: plugin.name,
+            validator: validator.id,
+            taskId,
+            passed: result.passed,
+            summary: result.summary
+          });
+        } catch (error) {
+          const failed = {
+            id: validator.id,
+            passed: false,
+            summary: `${plugin.name}/${validator.id} failed unexpectedly`,
+            details: `${error}`
+          };
+          results.push(failed);
+          await this.eventBus.emit("validator.finished", {
+            plugin: plugin.name,
+            validator: validator.id,
+            taskId,
+            passed: false,
+            summary: failed.summary,
+            details: failed.details
+          });
+        }
+      }
+    }
+    return results;
+  }
+  async ensureLoaded() {
+    if (this.plugins)
+      return this.plugins;
+    if (this.loadPromise)
+      return this.loadPromise;
+    this.loadPromise = this.loadCompiledPlugins();
+    try {
+      this.plugins = await this.loadPromise;
+      return this.plugins;
+    } finally {
+      this.loadPromise = null;
+    }
+  }
+  resolveBinPath(binName) {
+    const candidates = [this.imageBinDir, this.localBinDir].filter(Boolean).map((dir) => resolve7(dir, binName));
+    return candidates.find((candidate) => existsSync6(candidate));
+  }
+  async loadCompiledPlugins() {
+    const plugins = [];
+    for (const file of this.pluginFiles) {
+      const binName = inferRuntimePluginName(basename3(file));
+      let binPath = this.resolveBinPath(binName);
+      if (!binPath && !this.imageBinDir && this.pluginsRequireBinaries && this.ensureImageBinDir) {
+        try {
+          this.imageBinDir = await this.ensureImageBinDir(this.context.projectRoot);
+          binPath = this.resolveBinPath(binName);
+        } catch {}
+      }
+      if (!binPath) {
+        const triedPaths = [this.imageBinDir, this.localBinDir].filter(Boolean).map((dir) => resolve7(dir, binName));
+        const missingError = `Compiled plugin binary not found for '${binName}'. Tried: ${triedPaths.join(", ")}`;
+        await this.eventBus.emit("plugin.error", {
+          file: resolve7(this.pluginDir, file),
+          phase: "load",
+          error: missingError
+        });
+        if (this.pluginsRequireBinaries) {
+          throw new Error(missingError);
+        }
+        plugins.push({ name: binName, validators: [] });
+        await this.eventBus.emit("plugin.loaded", {
+          plugin: binName,
+          file: resolve7(this.pluginDir, file),
+          source: "metadata-only"
+        });
+        continue;
+      }
+      const wrapper = createBinaryPluginWrapper(binName, binPath, this.context.projectRoot);
+      plugins.push(wrapper);
+      await this.eventBus.emit("plugin.loaded", {
+        plugin: wrapper.name,
+        file: binPath,
+        source: "compiled-binary"
+      });
+    }
+    return plugins;
+  }
+  async safeInvoke(pluginName, hook, call) {
+    try {
+      await call();
+    } catch (error) {
+      await this.eventBus.emit("plugin.error", {
+        plugin: pluginName,
+        phase: hook,
+        error: `${error}`
+      });
+    }
+  }
+}
+function createBinaryPluginWrapper(name, binPath, projectRoot) {
+  return {
+    name,
+    validators: [
+      {
+        id: `${name}:compiled`,
+        async run(ctx) {
+          const { exitCode, stdout, stderr } = await launchRuntimeBinary({
+            binaryPath: binPath,
+            args: ["--validate", ctx.taskId, ctx.projectRoot],
+            cwd: projectRoot
+          });
+          if (exitCode !== 0) {
+            return {
+              id: `${name}:compiled`,
+              passed: false,
+              summary: `Plugin binary ${name} exited with code ${exitCode}`,
+              details: stderr || stdout
+            };
+          }
+          try {
+            const results = JSON.parse(stdout.trim());
+            const failed = results.filter((result) => !result.passed);
+            if (failed.length > 0) {
+              return {
+                id: `${name}:compiled`,
+                passed: false,
+                summary: `${failed.length} of ${results.length} validator(s) failed`,
+                details: failed.map((result) => `${result.id}: ${result.summary}`).join(`
+`)
+              };
+            }
+            return {
+              id: `${name}:compiled`,
+              passed: true,
+              summary: `All ${results.length} validator(s) passed`
+            };
+          } catch {
+            return {
+              id: `${name}:compiled`,
+              passed: false,
+              summary: `Failed to parse output from compiled plugin ${name}`,
+              details: stdout.slice(0, 500)
+            };
+          }
+        }
+      }
+    ]
+  };
+}
+function safeReadDir(path) {
+  try {
+    return readdirSync(path, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name).sort();
+  } catch {
+    return [];
+  }
+}
+// packages/runtime/src/agent-mode.ts
+function looksLikeShellInvocation(args, mode = process.env.RIG_AGENT_MODE) {
+  if (mode === "shell") {
+    return true;
+  }
+  if (mode === "agent") {
+    return false;
+  }
+  if (args.length === 0) {
+    return false;
+  }
+  const first = args[0];
+  if (!first) {
+    return false;
+  }
+  const bashLikeFlags = new Set([
+    "-c",
+    "-lc",
+    "-l",
+    "-i",
+    "-s",
+    "--login",
+    "--noprofile",
+    "--norc",
+    "--posix",
+    "--rcfile",
+    "--init-file",
+    "--restricted",
+    "--debug",
+    "--debugger",
+    "--verbose",
+    "--wordexp",
+    "--dump-strings",
+    "--dump-po-strings",
+    "--help"
+  ]);
+  if (bashLikeFlags.has(first)) {
+    return true;
+  }
+  if (!first.startsWith("-")) {
+    return first.endsWith(".sh");
+  }
+  return false;
+}
+// packages/runtime/src/execution.ts
+function assertMatchingIds(bundle, lease) {
+  if (bundle.runId !== lease.runId) {
+    throw new Error(`Remote bundle runId ${bundle.runId} does not match lease runId ${lease.runId}`);
+  }
+  if (bundle.leaseId !== lease.leaseId) {
+    throw new Error(`Remote bundle leaseId ${bundle.leaseId} does not match lease leaseId ${lease.leaseId}`);
+  }
+  if (bundle.workspaceId !== lease.workspaceId) {
+    throw new Error(`Remote bundle workspaceId ${bundle.workspaceId} does not match lease workspaceId ${lease.workspaceId}`);
+  }
+}
+function createRuntimeExecutionSession(args) {
+  assertMatchingIds(args.bundle, args.lease);
+  return {
+    runId: args.bundle.runId,
+    leaseId: args.bundle.leaseId,
+    workspaceId: args.bundle.workspaceId,
+    hostId: args.lease.remoteHostId,
+    runtimeAdapter: args.bundle.runtimeAdapter,
+    runtimeMode: args.bundle.runtimeMode,
+    interactionMode: args.bundle.interactionMode,
+    model: args.bundle.model,
+    prompt: args.bundle.prompt,
+    workspacePath: args.bundle.workspacePath,
+    taskId: args.bundle.taskId,
+    taskTitle: args.bundle.taskTitle,
+    conversationLength: args.bundle.conversation.length,
+    startedAt: args.startedAt ?? new Date().toISOString()
+  };
+}
+// packages/runtime/src/control-plane/tasks/task-record-reader.ts
+async function findTaskById(reader, id) {
+  const tasks = await reader.listTasks();
+  return tasks.find((task) => task.id === id) ?? null;
+}
+// packages/runtime/src/control-plane/tasks/plugin-task-source.ts
+class TaskRecordSourceError extends Error {
+  code;
+  projectRoot;
+  sourceId;
+  sourceKind;
+  operation;
+  cause;
+  constructor(input) {
+    super(input.message, { cause: input.cause });
+    this.name = "TaskRecordSourceError";
+    this.code = input.code;
+    this.projectRoot = input.projectRoot;
+    this.operation = input.operation;
+    this.sourceId = input.sourceId ?? null;
+    this.sourceKind = input.sourceKind ?? null;
+    this.cause = input.cause;
+  }
+}
+function createPluginTaskRecordReader(context, options) {
+  const source = selectTaskSource(context.taskSourceRegistry, options);
+  return {
+    async listTasks() {
+      try {
+        return await source.list();
+      } catch (cause) {
+        throw readFailedError(source, options, "list", cause);
+      }
+    },
+    async getTask(id) {
+      try {
+        if (source.get) {
+          return await source.get(id) ?? null;
+        }
+        return findTaskById({
+          listTasks: () => source.list(),
+          getTask: async () => null
+        }, id);
+      } catch (cause) {
+        throw readFailedError(source, options, "get", cause);
+      }
+    }
+  };
+}
+function selectTaskSource(registry, options) {
+  try {
+    if (options.sourceId) {
+      return registry.resolveById(options.sourceId);
+    }
+    if (options.sourceKind) {
+      return registry.resolveByKind(options.sourceKind);
+    }
+    const [source] = registry.list();
+    if (source) {
+      return source;
+    }
+  } catch (cause) {
+    throw new TaskRecordSourceError({
+      code: "TASK_SOURCE_NOT_CONFIGURED",
+      message: taskSourceSelectionMessage(options),
+      projectRoot: options.projectRoot,
+      operation: "select",
+      sourceId: options.sourceId ?? null,
+      sourceKind: options.sourceKind ?? null,
+      cause
+    });
+  }
+  throw new TaskRecordSourceError({
+    code: "TASK_SOURCE_NOT_CONFIGURED",
+    message: taskSourceSelectionMessage(options),
+    projectRoot: options.projectRoot,
+    operation: "select",
+    sourceId: options.sourceId ?? null,
+    sourceKind: options.sourceKind ?? null
+  });
+}
+function taskSourceSelectionMessage(options) {
+  const selector = options.sourceId ? `id "${options.sourceId}"` : options.sourceKind ? `kind "${options.sourceKind}"` : "the configured plugin task source";
+  return `No task source registered for ${selector} in project ${options.projectRoot}. Check rig.config.ts taskSource and loaded plugins.`;
+}
+function readFailedError(source, options, operation, cause) {
+  const causeMessage = cause instanceof Error ? cause.message : String(cause);
+  return new TaskRecordSourceError({
+    code: "TASK_SOURCE_READ_FAILED",
+    message: `Task source ${source.kind} (${source.id}) failed to ${operation} tasks for project ${options.projectRoot}: ${causeMessage}`,
+    projectRoot: options.projectRoot,
+    operation,
+    sourceId: source.id,
+    sourceKind: source.kind,
+    cause
+  });
+}
+// packages/runtime/src/remote-http.ts
+function trimTrailingSlash(value) {
+  return value.endsWith("/") ? value.slice(0, -1) : value;
+}
+function normalizeAuthToken(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+function authHeaders(authToken) {
+  return authToken ? { authorization: `Bearer ${authToken}` } : {};
+}
+async function readJsonResponse(response, endpoint) {
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`Rig runtime request failed for ${endpoint}: ${response.status} ${text}`.trim());
+  }
+  return await response.json();
+}
+async function postJson(fetchImpl, baseUrl, path, body, authToken) {
+  const endpoint = `${trimTrailingSlash(baseUrl)}${path}`;
+  const response = await fetchImpl(endpoint, {
+    method: "POST",
+    headers: { "content-type": "application/json", ...authHeaders(authToken) },
+    body: JSON.stringify(body)
+  });
+  return readJsonResponse(response, endpoint);
+}
+
+class HttpRuntimeHostSession {
+  baseUrl;
+  fetchImpl;
+  authToken;
+  constructor(baseUrl, fetchImpl = fetch, options = {}) {
+    this.baseUrl = baseUrl;
+    this.fetchImpl = fetchImpl;
+    this.authToken = normalizeAuthToken(options.authToken ?? process.env.RIG_SERVER_AUTH_TOKEN ?? process.env.RIG_REMOTE_AUTH_TOKEN);
+  }
+  register(input) {
+    return postJson(this.fetchImpl, this.baseUrl, "/api/remote/hosts/register", input, this.authToken);
+  }
+  heartbeat(input) {
+    return postJson(this.fetchImpl, this.baseUrl, "/api/remote/hosts/heartbeat", input, this.authToken);
+  }
+  claimLease(input) {
+    return postJson(this.fetchImpl, this.baseUrl, "/api/remote/runs/claim", input, this.authToken);
+  }
+}
+
+class HttpRuntimeRunReporter {
+  baseUrl;
+  fetchImpl;
+  authToken;
+  constructor(baseUrl, fetchImpl = fetch, options = {}) {
+    this.baseUrl = baseUrl;
+    this.fetchImpl = fetchImpl;
+    this.authToken = normalizeAuthToken(options.authToken ?? process.env.RIG_SERVER_AUTH_TOKEN ?? process.env.RIG_REMOTE_AUTH_TOKEN);
+  }
+  reportStarted(input) {
+    return postJson(this.fetchImpl, this.baseUrl, "/api/remote/runs/start", input, this.authToken);
+  }
+  reportLog(input) {
+    return postJson(this.fetchImpl, this.baseUrl, "/api/remote/runs/log", input, this.authToken);
+  }
+  reportMessage(input) {
+    return postJson(this.fetchImpl, this.baseUrl, "/api/remote/runs/message", input, this.authToken);
+  }
+  reportCompleted(input) {
+    return postJson(this.fetchImpl, this.baseUrl, "/api/remote/runs/complete", input, this.authToken);
+  }
+  reportFailed(input) {
+    return postJson(this.fetchImpl, this.baseUrl, "/api/remote/runs/fail", input, this.authToken);
+  }
+  reportReleased(input) {
+    return postJson(this.fetchImpl, this.baseUrl, "/api/remote/runs/release", input, this.authToken);
+  }
+  reportArtifact(input) {
+    return postJson(this.fetchImpl, this.baseUrl, "/api/remote/runs/artifact", input, this.authToken);
+  }
+}
+
+// packages/runtime/src/index.ts
+var RIG_RUNTIME_PACKAGE = "@rig/runtime";
+export {
+  writeRuntimeContext,
+  secretDefinesFromEnv,
+  runtimeHookPhases,
+  runtimeContextStringFields,
+  runtimeContextArrayFields,
+  runtimeBinaryAssetEntries,
+  resolveRuntimeSecrets,
+  resolveRigLayout,
+  resolveNearestRigProjectRoot,
+  resolveMonorepoRoot,
+  readPublishedRigServerStateSync,
+  readPublishedRigServerState,
+  looksLikeShellInvocation,
+  loadRuntimeContextFromEnv,
+  loadRuntimeContext,
+  loadDotEnvSecrets,
+  launchRuntimeBinary,
+  isRuntimeBinaryAssetEntry,
+  inferRuntimePluginName,
+  findTaskById,
+  ensureLocalRigServerConnection,
+  describeRuntimePluginFiles,
+  createRuntimeExecutionSession,
+  createRuntimeBinaryBuildManifest,
+  createPluginTaskRecordReader,
+  copyRuntimeBinaryAssets,
+  buildRuntimeBinary,
+  TaskRecordSourceError,
+  RuntimeEventBus,
+  RUNTIME_CONTEXT_ENV,
+  RIG_STATE_DIRNAME,
+  RIG_RUNTIME_PACKAGE,
+  RIG_DEFINITION_DIRNAME,
+  RIG_ARTIFACTS_DIRNAME,
+  PluginManager,
+  HttpRuntimeRunReporter,
+  HttpRuntimeHostSession,
+  GeneralCliEventBus,
+  GeneralCliEventBus as EventBus,
+  BAKED_RUNTIME_SECRETS
+};