@h-rig/runtime 0.0.6-alpha.0

package/dist/src/control-plane/native/git-ops.js

@@ -0,0 +1,2860 @@
+// @bun
+// packages/runtime/src/control-plane/native/git-ops.ts
+import { existsSync as existsSync9, lstatSync, mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname7, isAbsolute as isAbsolute2, resolve as resolve11 } from "path";
+import { fileURLToPath } from "url";
+
+// packages/runtime/src/control-plane/runtime/baked-secrets.ts
+import { existsSync, readFileSync } from "fs";
+import { resolve } from "path";
+var BAKED_RUNTIME_SECRETS = {
+  ANTHROPIC_API_KEY: typeof RIG_BAKED_ANTHROPIC_API_KEY !== "undefined" ? RIG_BAKED_ANTHROPIC_API_KEY : "",
+  OPENAI_API_KEY: typeof RIG_BAKED_OPENAI_API_KEY !== "undefined" ? RIG_BAKED_OPENAI_API_KEY : "",
+  OPENROUTER_API_KEY: typeof RIG_BAKED_OPENROUTER_API_KEY !== "undefined" ? RIG_BAKED_OPENROUTER_API_KEY : "",
+  AI_REVIEW_MODE: typeof RIG_BAKED_AI_REVIEW_MODE !== "undefined" ? RIG_BAKED_AI_REVIEW_MODE : "",
+  AI_REVIEW_PROVIDER: typeof RIG_BAKED_AI_REVIEW_PROVIDER !== "undefined" ? RIG_BAKED_AI_REVIEW_PROVIDER : "",
+  GREPTILE_API_BASE: typeof RIG_BAKED_GREPTILE_API_BASE !== "undefined" ? RIG_BAKED_GREPTILE_API_BASE : "",
+  GREPTILE_REMOTE: typeof RIG_BAKED_GREPTILE_REMOTE !== "undefined" ? RIG_BAKED_GREPTILE_REMOTE : "",
+  GREPTILE_REPOSITORY: typeof RIG_BAKED_GREPTILE_REPOSITORY !== "undefined" ? RIG_BAKED_GREPTILE_REPOSITORY : "",
+  GREPTILE_CONTEXT_BRANCH: typeof RIG_BAKED_GREPTILE_CONTEXT_BRANCH !== "undefined" ? RIG_BAKED_GREPTILE_CONTEXT_BRANCH : "",
+  GREPTILE_DEFAULT_BRANCH: typeof RIG_BAKED_GREPTILE_DEFAULT_BRANCH !== "undefined" ? RIG_BAKED_GREPTILE_DEFAULT_BRANCH : "",
+  GREPTILE_API_KEY: typeof RIG_BAKED_GREPTILE_API_KEY !== "undefined" ? RIG_BAKED_GREPTILE_API_KEY : "",
+  GREPTILE_GITHUB_TOKEN: typeof RIG_BAKED_GREPTILE_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GREPTILE_GITHUB_TOKEN : "",
+  GREPTILE_POLL_ATTEMPTS: typeof RIG_BAKED_GREPTILE_POLL_ATTEMPTS !== "undefined" ? RIG_BAKED_GREPTILE_POLL_ATTEMPTS : "",
+  GREPTILE_POLL_INTERVAL_MS: typeof RIG_BAKED_GREPTILE_POLL_INTERVAL_MS !== "undefined" ? RIG_BAKED_GREPTILE_POLL_INTERVAL_MS : "",
+  GH_TOKEN: typeof RIG_BAKED_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GITHUB_TOKEN : "",
+  GITHUB_TOKEN: typeof RIG_BAKED_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GITHUB_TOKEN : "",
+  GITHUB_SSH_KEY: typeof RIG_BAKED_GITHUB_SSH_KEY !== "undefined" ? RIG_BAKED_GITHUB_SSH_KEY : "",
+  AWS_ACCESS_KEY_ID: typeof RIG_BAKED_AWS_ACCESS_KEY_ID !== "undefined" ? RIG_BAKED_AWS_ACCESS_KEY_ID : "",
+  AWS_SECRET_ACCESS_KEY: typeof RIG_BAKED_AWS_SECRET_ACCESS_KEY !== "undefined" ? RIG_BAKED_AWS_SECRET_ACCESS_KEY : "",
+  AWS_REGION: typeof RIG_BAKED_AWS_REGION !== "undefined" ? RIG_BAKED_AWS_REGION : "",
+  LINEAR_API_KEY: typeof RIG_BAKED_LINEAR_API_KEY !== "undefined" ? RIG_BAKED_LINEAR_API_KEY : "",
+  LINEAR_WEBHOOK_SECRET: typeof RIG_BAKED_LINEAR_WEBHOOK_SECRET !== "undefined" ? RIG_BAKED_LINEAR_WEBHOOK_SECRET : ""
+};
+function resolveRuntimeSecrets(env, baked = BAKED_RUNTIME_SECRETS) {
+  const resolved = {};
+  const keys = new Set([
+    ...Object.keys(BAKED_RUNTIME_SECRETS),
+    ...Object.keys(baked)
+  ]);
+  for (const key of keys) {
+    const envValue = env[key]?.trim();
+    const bakedValue = baked[key]?.trim();
+    if (envValue) {
+      resolved[key] = envValue;
+    } else if (bakedValue) {
+      resolved[key] = bakedValue;
+    }
+  }
+  return resolved;
+}
+function loadDotEnvSecrets(projectRoot, env = process.env) {
+  const dotenvPath = resolve(projectRoot, ".env");
+  if (!existsSync(dotenvPath)) {
+    return {};
+  }
+  const parsed = {};
+  const lines = readFileSync(dotenvPath, "utf-8").split(/\r?\n/);
+  for (const rawLine of lines) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) {
+      continue;
+    }
+    const exportMatch = line.match(/^(?:export\s+)?([A-Z0-9_]+)\s*=\s*(.*)$/);
+    if (!exportMatch) {
+      continue;
+    }
+    const key = exportMatch[1];
+    if (!(key in BAKED_RUNTIME_SECRETS)) {
+      continue;
+    }
+    const value = expandShellValue(exportMatch[2] ?? "", { ...env, ...parsed });
+    if (value) {
+      parsed[key] = value;
+    }
+  }
+  return parsed;
+}
+function expandShellValue(rawValue, env) {
+  let value = rawValue.trim();
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    value = value.slice(1, -1);
+  }
+  return value.replace(/\$\{([A-Z0-9_]+)(:-([^}]*))?\}/g, (_match, name, _defaultGroup, fallback) => {
+    const envValue = env[name]?.trim();
+    if (envValue) {
+      return envValue;
+    }
+    return fallback ?? "";
+  });
+}
+
+// packages/runtime/src/control-plane/runtime/context.ts
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { dirname, resolve as resolve2 } from "path";
+var RUNTIME_CONTEXT_ENV = "RIG_RUNTIME_CONTEXT_FILE";
+var runtimeContextStringFields = [
+  "runtimeId",
+  "taskId",
+  "role",
+  "workspaceDir",
+  "stateDir",
+  "logsDir",
+  "sessionDir",
+  "sessionFile",
+  "policyFile",
+  "binDir",
+  "createdAt"
+];
+var runtimeContextArrayFields = ["scopes", "validation"];
+var runtimeContextOptionalStringFields = [
+  "artifactRoot",
+  "hostProjectRoot",
+  "monorepoMainRoot",
+  "monorepoBaseRef",
+  "monorepoBaseCommit"
+];
+function loadRuntimeContext(path) {
+  const absPath = resolve2(path);
+  if (!existsSync2(absPath)) {
+    throw new Error(`RuntimeTaskContext file not found: ${absPath}`);
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync2(absPath, "utf8"));
+  } catch (err) {
+    throw new Error(`Failed to parse RuntimeTaskContext at ${absPath}: ${String(err)}`);
+  }
+  if (typeof raw !== "object" || raw === null) {
+    throw new Error(`RuntimeTaskContext at ${absPath} is not an object`);
+  }
+  const obj = raw;
+  for (const field of runtimeContextStringFields) {
+    if (typeof obj[field] !== "string" || obj[field].length === 0) {
+      throw new Error(`RuntimeTaskContext field "${field}" must be a non-empty string (at ${absPath})`);
+    }
+  }
+  for (const field of runtimeContextArrayFields) {
+    if (!Array.isArray(obj[field])) {
+      throw new Error(`RuntimeTaskContext field "${field}" must be an array (at ${absPath})`);
+    }
+    if (!obj[field].every((entry) => typeof entry === "string")) {
+      throw new Error(`RuntimeTaskContext field "${field}" must be a string[] (at ${absPath})`);
+    }
+  }
+  for (const field of runtimeContextOptionalStringFields) {
+    if (field in obj && obj[field] !== undefined && typeof obj[field] !== "string") {
+      throw new Error(`RuntimeTaskContext field "${field}" must be a string when present (at ${absPath})`);
+    }
+  }
+  if (obj.browser !== undefined) {
+    if (typeof obj.browser !== "object" || obj.browser === null || Array.isArray(obj.browser)) {
+      throw new Error(`RuntimeTaskContext field "browser" must be an object when present (at ${absPath})`);
+    }
+    const browser = obj.browser;
+    for (const field of [
+      "preset",
+      "mode",
+      "stateDir",
+      "defaultProfile",
+      "effectiveProfile",
+      "defaultAttachUrl",
+      "effectiveAttachUrl",
+      "launchHelper",
+      "checkHelper",
+      "attachInfoHelper",
+      "e2eHelper",
+      "resetProfileHelper"
+    ]) {
+      if (typeof browser[field] !== "string" || browser[field].length === 0) {
+        throw new Error(`RuntimeTaskContext field "browser.${field}" must be a non-empty string (at ${absPath})`);
+      }
+    }
+    for (const field of ["devCommand", "launchCommand", "checkCommand", "e2eCommand"]) {
+      if (browser[field] !== undefined && typeof browser[field] !== "string") {
+        throw new Error(`RuntimeTaskContext field "browser.${field}" must be a string when present (at ${absPath})`);
+      }
+    }
+    if (typeof browser.required !== "boolean") {
+      throw new Error(`RuntimeTaskContext field "browser.required" must be a boolean (at ${absPath})`);
+    }
+  }
+  if (obj.memory !== undefined) {
+    if (typeof obj.memory !== "object" || obj.memory === null || Array.isArray(obj.memory)) {
+      throw new Error(`RuntimeTaskContext field "memory" must be an object when present (at ${absPath})`);
+    }
+    const memory = obj.memory;
+    for (const field of ["canonicalPath", "canonicalRef", "canonicalBaseOid", "hydratedPath"]) {
+      if (typeof memory[field] !== "string" || memory[field].length === 0) {
+        throw new Error(`RuntimeTaskContext field "memory.${field}" must be a non-empty string (at ${absPath})`);
+      }
+    }
+    if (typeof memory.createdFresh !== "boolean") {
+      throw new Error(`RuntimeTaskContext field "memory.createdFresh" must be a boolean (at ${absPath})`);
+    }
+    if (typeof memory.retrieval !== "object" || memory.retrieval === null || Array.isArray(memory.retrieval)) {
+      throw new Error(`RuntimeTaskContext field "memory.retrieval" must be an object (at ${absPath})`);
+    }
+    const retrieval = memory.retrieval;
+    for (const field of ["topK", "lexicalWeight", "vectorWeight", "recencyWeight", "confidenceWeight"]) {
+      if (typeof retrieval[field] !== "number" || Number.isNaN(retrieval[field])) {
+        throw new Error(`RuntimeTaskContext field "memory.retrieval.${field}" must be a number (at ${absPath})`);
+      }
+    }
+  }
+  if (obj.initialDirtyFiles !== undefined) {
+    if (typeof obj.initialDirtyFiles !== "object" || obj.initialDirtyFiles === null || Array.isArray(obj.initialDirtyFiles)) {
+      throw new Error(`RuntimeTaskContext field "initialDirtyFiles" must be an object when present (at ${absPath})`);
+    }
+    const dirtyFiles = obj.initialDirtyFiles;
+    for (const key of ["project", "monorepo"]) {
+      if (dirtyFiles[key] === undefined) {
+        continue;
+      }
+      if (!Array.isArray(dirtyFiles[key]) || !dirtyFiles[key].every((entry) => typeof entry === "string")) {
+        throw new Error(`RuntimeTaskContext field "initialDirtyFiles.${key}" must be a string[] when present (at ${absPath})`);
+      }
+    }
+  }
+  if (obj.initialHeadCommits !== undefined) {
+    if (typeof obj.initialHeadCommits !== "object" || obj.initialHeadCommits === null || Array.isArray(obj.initialHeadCommits)) {
+      throw new Error(`RuntimeTaskContext field "initialHeadCommits" must be an object when present (at ${absPath})`);
+    }
+    const headCommits = obj.initialHeadCommits;
+    for (const key of ["project", "monorepo"]) {
+      if (headCommits[key] === undefined) {
+        continue;
+      }
+      if (typeof headCommits[key] !== "string") {
+        throw new Error(`RuntimeTaskContext field "initialHeadCommits.${key}" must be a string when present (at ${absPath})`);
+      }
+    }
+  }
+  return obj;
+}
+function loadRuntimeContextFromEnv(env = process.env) {
+  const contextFile = env[RUNTIME_CONTEXT_ENV];
+  if (contextFile) {
+    return loadRuntimeContext(contextFile);
+  }
+  const inferred = findRuntimeContextFile(process.cwd());
+  if (!inferred) {
+    return null;
+  }
+  return loadRuntimeContext(inferred);
+}
+function findRuntimeContextFile(startPath) {
+  let current = resolve2(startPath);
+  while (true) {
+    const candidate = resolve2(current, "runtime-context.json");
+    if (existsSync2(candidate) && isAgentRuntimeContextPath(candidate)) {
+      return candidate;
+    }
+    const parent = dirname(current);
+    if (parent === current) {
+      return "";
+    }
+    current = parent;
+  }
+}
+function isAgentRuntimeContextPath(path) {
+  const normalized = path.replace(/\\/g, "/");
+  return /\/\.rig\/runtime-context\.json$/.test(normalized);
+}
+
+// packages/runtime/src/control-plane/native/task-ops.ts
+import { appendFileSync, existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
+import { resolve as resolve10 } from "path";
+
+// packages/runtime/src/build-time-config.ts
+function normalizeBuildConfig(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return {};
+  }
+  return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string"));
+}
+function readBuildConfig() {
+  if (typeof __RIG_BUILD_CONFIG__ !== "undefined") {
+    return normalizeBuildConfig(__RIG_BUILD_CONFIG__);
+  }
+  const raw = process.env.RIG_BUILD_CONFIG_JSON?.trim();
+  if (!raw) {
+    return {};
+  }
+  try {
+    return normalizeBuildConfig(JSON.parse(raw));
+  } catch {
+    return {};
+  }
+}
+
+// packages/runtime/src/control-plane/runtime/tooling/shell.ts
+import { tmpdir } from "os";
+import { basename, dirname as dirname2, resolve as resolve3 } from "path";
+var sharedNativeShellOutputDir = resolve3(tmpdir(), "rig-native");
+var sharedNativeShellOutputPath = resolve3(sharedNativeShellOutputDir, `rig-shell-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+// packages/runtime/src/control-plane/runtime/tooling/file-tools.ts
+import { tmpdir as tmpdir2 } from "os";
+import { basename as basename2, dirname as dirname3, resolve as resolve4 } from "path";
+var sharedNativeToolsOutputDir = resolve4(tmpdir2(), "rig-native");
+var sharedNativeToolsOutputPath = resolve4(sharedNativeToolsOutputDir, `rig-tools-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+// packages/runtime/src/control-plane/plugin-host-context.ts
+import { createPluginHost } from "@rig/core";
+import { loadConfig } from "@rig/core/load-config";
+
+// packages/runtime/src/control-plane/repos/registry.ts
+var MANAGED_REPOS = new Map;
+
+// packages/runtime/src/control-plane/native/scope-rules.ts
+var activeRules = null;
+function getScopeRules() {
+  return activeRules;
+}
+
+// packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
+var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
+
+// packages/runtime/src/control-plane/native/task-state.ts
+import { existsSync as existsSync7, readFileSync as readFileSync5, readdirSync, statSync as statSync2, writeFileSync as writeFileSync3 } from "fs";
+import { basename as basename4, resolve as resolve9 } from "path";
+
+// packages/runtime/src/control-plane/state-sync/types.ts
+var CANONICAL_TASK_LIFECYCLE_STATUSES = new Set([
+  "draft",
+  "open",
+  "ready",
+  "queued",
+  "in_progress",
+  "under_review",
+  "blocked",
+  "completed",
+  "cancelled"
+]);
+// packages/runtime/src/control-plane/native/git-native.ts
+import { chmodSync, copyFileSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { dirname as dirname4, isAbsolute, resolve as resolve5 } from "path";
+import { createHash } from "crypto";
+var sharedGitNativeOutputDir = resolve5(tmpdir3(), "rig-native");
+var sharedGitNativeOutputPath = resolve5(sharedGitNativeOutputDir, `rig-git-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+var trackerCommandUsageProbe = "usage: rig-git fetch-ref <repo-path> <remote> <branch>";
+function temporaryGitBinaryOutputPath(outputPath) {
+  const suffix = process.platform === "win32" ? ".exe" : "";
+  return resolve5(dirname4(outputPath), `.rig-git-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}${suffix}`);
+}
+function publishGitBinary(tempOutputPath, outputPath) {
+  try {
+    renameSync(tempOutputPath, outputPath);
+  } catch (error) {
+    if (process.platform === "win32" && existsSync3(outputPath)) {
+      rmSync(outputPath, { force: true });
+      renameSync(tempOutputPath, outputPath);
+      return;
+    }
+    throw error;
+  }
+}
+function runtimeRigGitFileName() {
+  return `rig-git${process.platform === "win32" ? ".exe" : ""}`;
+}
+function rigGitSourceCandidates() {
+  const execDir = process.execPath?.trim() ? dirname4(process.execPath.trim()) : "";
+  const cwd = process.cwd()?.trim() || "";
+  const projectRoot = process.env.PROJECT_RIG_ROOT?.trim() || "";
+  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || "";
+  const moduleRelativeSource = resolve5(import.meta.dir, "../../../native/rig-git.zig");
+  return [...new Set([
+    process.env.RIG_NATIVE_GIT_SOURCE?.trim() || "",
+    moduleRelativeSource,
+    projectRoot ? resolve5(projectRoot, "packages/runtime/native/rig-git.zig") : "",
+    hostProjectRoot ? resolve5(hostProjectRoot, "packages/runtime/native/rig-git.zig") : "",
+    cwd ? resolve5(cwd, "packages/runtime/native/rig-git.zig") : "",
+    execDir ? resolve5(execDir, "..", "..", "packages/runtime/native/rig-git.zig") : "",
+    execDir ? resolve5(execDir, "..", "native", "rig-git.zig") : ""
+  ].filter(Boolean))];
+}
+function nativePackageBinaryCandidates(fromDir, fileName) {
+  const candidates = [];
+  let cursor = resolve5(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    candidates.push(resolve5(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve5(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve5(cursor, "native", fileName), resolve5(cursor, "native", "bin", fileName));
+    const parent = dirname4(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
+  }
+  return candidates;
+}
+function rigGitBinaryCandidates() {
+  const execDir = process.execPath?.trim() ? dirname4(process.execPath.trim()) : "";
+  const fileName = runtimeRigGitFileName();
+  const explicit = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
+  return [...new Set([
+    explicit,
+    ...nativePackageBinaryCandidates(import.meta.dir, fileName),
+    execDir ? resolve5(execDir, fileName) : "",
+    execDir ? resolve5(execDir, "..", fileName) : "",
+    execDir ? resolve5(execDir, "..", "bin", fileName) : "",
+    sharedGitNativeOutputPath
+  ].filter(Boolean))];
+}
+function resolveGitSourcePath() {
+  for (const candidate of rigGitSourceCandidates()) {
+    if (candidate && existsSync3(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function resolveGitBinaryPath() {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return null;
+  }
+  for (const candidate of rigGitBinaryCandidates()) {
+    if (candidate && existsSync3(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function preferredGitBinaryOutputPath() {
+  const explicit = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
+  return explicit || sharedGitNativeOutputPath;
+}
+function binarySupportsTrackerCommandsSync(binaryPath) {
+  try {
+    const probe = Bun.spawnSync([binaryPath, "fetch-ref", "."], {
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const stdout = probe.stdout.toString().trim();
+    const stderr = probe.stderr.toString().trim();
+    if (stdout.includes('"error":"unknown command"')) {
+      return false;
+    }
+    return probe.exitCode === 2 && stderr.includes(trackerCommandUsageProbe);
+  } catch {
+    return false;
+  }
+}
+function nativeBuildManifestPath(outputPath) {
+  return `${outputPath}.build-manifest.json`;
+}
+function hasMatchingNativeBuildManifestSync(manifestPath, buildKey) {
+  if (!existsSync3(manifestPath)) {
+    return false;
+  }
+  try {
+    const manifest = JSON.parse(readFileSync3(manifestPath, "utf8"));
+    return manifest.version === 1 && manifest.buildKey === buildKey;
+  } catch {
+    return false;
+  }
+}
+function sha256FileSync(path) {
+  return createHash("sha256").update(readFileSync3(path)).digest("hex");
+}
+function ensureRigGitBinaryPathSync(outputPath = preferredGitBinaryOutputPath()) {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    throw new Error("Zig native git is disabled via RIG_DISABLE_ZIG_NATIVE=1");
+  }
+  const sourcePath = resolveGitSourcePath();
+  if (!sourcePath) {
+    const binaryPath = resolveGitBinaryPath();
+    if (binaryPath) {
+      return binaryPath;
+    }
+    throw new Error("rig-git.zig source file not found.");
+  }
+  const zigBinary = Bun.which("zig");
+  if (!zigBinary) {
+    throw new Error("zig is required to build native Rig git tools.");
+  }
+  mkdirSync2(dirname4(outputPath), { recursive: true });
+  const sourceDigest = sha256FileSync(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    zigBinary,
+    platform: process.platform,
+    arch: process.arch,
+    sourcePath,
+    sourceDigest
+  });
+  const manifestPath = nativeBuildManifestPath(outputPath);
+  const needsBuild = !existsSync3(outputPath) || !hasMatchingNativeBuildManifestSync(manifestPath, buildKey) || !binarySupportsTrackerCommandsSync(outputPath);
+  if (!needsBuild) {
+    chmodSync(outputPath, 493);
+    return outputPath;
+  }
+  const tempOutputPath = temporaryGitBinaryOutputPath(outputPath);
+  const build = Bun.spawnSync([
+    zigBinary,
+    "build-exe",
+    sourcePath,
+    "-O",
+    "ReleaseFast",
+    `-femit-bin=${tempOutputPath}`
+  ], {
+    cwd: dirname4(sourcePath),
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  if (build.exitCode !== 0 || !existsSync3(tempOutputPath)) {
+    const stderr = build.stderr.toString().trim();
+    const stdout = build.stdout.toString().trim();
+    const details = [stderr, stdout].filter(Boolean).join(`
+`);
+    throw new Error(`Failed to build native Rig git tools: ${details || `zig exited with code ${build.exitCode}`}`);
+  }
+  chmodSync(tempOutputPath, 493);
+  if (existsSync3(outputPath) && hasMatchingNativeBuildManifestSync(manifestPath, buildKey)) {
+    rmSync(tempOutputPath, { force: true });
+    chmodSync(outputPath, 493);
+    return outputPath;
+  }
+  publishGitBinary(tempOutputPath, outputPath);
+  if (!binarySupportsTrackerCommandsSync(outputPath)) {
+    rmSync(outputPath, { force: true });
+    throw new Error("Failed to build native Rig git tools: tracker command probe failed");
+  }
+  writeFileSync2(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`, "utf8");
+  return outputPath;
+}
+function runGitNative(command, args) {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return { ok: false, error: "rig-git native disabled" };
+  }
+  const trackerCommand = command === "fetch-ref" || command === "read-blob-at-ref" || command === "write-tree-commit" || command === "push-ref-with-lease";
+  let binaryPath = null;
+  if (trackerCommand) {
+    try {
+      binaryPath = ensureRigGitBinaryPathSync(preferredGitBinaryOutputPath());
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (message.includes("rig-git.zig source file not found")) {
+        return { ok: false, error: "rig-git binary not found" };
+      }
+      return { ok: false, error: message };
+    }
+  } else {
+    const explicitBinaryPath = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
+    binaryPath = explicitBinaryPath && existsSync3(explicitBinaryPath) ? explicitBinaryPath : !explicitBinaryPath ? resolveGitBinaryPath() : null;
+    if (!binaryPath) {
+      try {
+        binaryPath = ensureRigGitBinaryPathSync(preferredGitBinaryOutputPath());
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (message.includes("rig-git.zig source file not found")) {
+          return { ok: false, error: "rig-git binary not found" };
+        }
+        return { ok: false, error: message };
+      }
+    }
+  }
+  try {
+    const proc = Bun.spawnSync([binaryPath, command, ...args], {
+      stdout: "pipe",
+      stderr: "pipe",
+      env: process.env
+    });
+    if (proc.exitCode !== 0) {
+      const stdoutText = proc.stdout.toString().trim();
+      if (stdoutText) {
+        try {
+          const parsed = JSON.parse(stdoutText);
+          if (!parsed.ok) {
+            return parsed;
+          }
+        } catch {}
+      }
+      const errText = proc.stderr.toString().trim() || `exit code ${proc.exitCode}`;
+      return { ok: false, error: errText };
+    }
+    const output = proc.stdout.toString().trim();
+    return JSON.parse(output);
+  } catch (err) {
+    return { ok: false, error: String(err) };
+  }
+}
+function nativeBranchName(repoPath) {
+  const result = runGitNative("branch-name", [repoPath]);
+  if (!result.ok)
+    return null;
+  if ("value" in result && typeof result.value === "string")
+    return result.value;
+  return null;
+}
+function nativeHeadOid(repoPath) {
+  const result = runGitNative("head-oid", [repoPath]);
+  if (!result.ok)
+    return null;
+  if ("value" in result && typeof result.value === "string")
+    return result.value;
+  return null;
+}
+function nativeChangeCount(repoPath) {
+  const result = runGitNative("change-count", [repoPath]);
+  if (!result.ok)
+    return null;
+  if ("count" in result && typeof result.count === "number")
+    return result.count;
+  return null;
+}
+function nativePendingFiles(repoPath) {
+  const result = runGitNative("pending-files", [repoPath]);
+  if (!result.ok)
+    return null;
+  if ("files" in result && Array.isArray(result.files)) {
+    return result.files.map((f) => ({ path: f.path, status: f.status }));
+  }
+  return null;
+}
+function nativeFileHasChanges(repoPath, filePath) {
+  const result = runGitNative("file-has-changes", [repoPath, filePath]);
+  if (!result.ok)
+    return null;
+  if ("has_changes" in result && typeof result.has_changes === "boolean")
+    return result.has_changes;
+  return null;
+}
+
+// packages/runtime/src/control-plane/native/utils.ts
+import { ptr as ptr2 } from "bun:ffi";
+import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
+import { resolve as resolve8 } from "path";
+
+// packages/runtime/src/layout.ts
+import { existsSync as existsSync4 } from "fs";
+import { basename as basename3, dirname as dirname5, resolve as resolve6 } from "path";
+var RIG_DEFINITION_DIRNAME = "rig";
+var RIG_ARTIFACTS_DIRNAME = "artifacts";
+function resolveMonorepoRoot(projectRoot) {
+  const normalizedProjectRoot = resolve6(projectRoot);
+  const explicit = process.env.MONOREPO_ROOT?.trim();
+  if (explicit) {
+    const explicitRoot = resolve6(explicit);
+    const explicitParent = dirname5(explicitRoot);
+    if (basename3(explicitParent) === ".worktrees") {
+      const owner = dirname5(explicitParent);
+      const ownerHasGit = existsSync4(resolve6(owner, ".git"));
+      const ownerHasTaskConfig = existsSync4(resolve6(owner, ".rig", "task-config.json"));
+      const ownerHasRigConfig = existsSync4(resolve6(owner, "rig.config.ts"));
+      if (ownerHasGit && (ownerHasTaskConfig || ownerHasRigConfig)) {
+        return owner;
+      }
+      throw new Error(`MONOREPO_ROOT points to worktree ${explicitRoot}, but the owner checkout is incomplete at ${owner}.`);
+    }
+    if (!existsSync4(resolve6(explicitRoot, ".git"))) {
+      throw new Error(`MONOREPO_ROOT points to ${explicitRoot}, but no git checkout was found there.`);
+    }
+    const hasTaskConfig = existsSync4(resolve6(explicitRoot, ".rig", "task-config.json"));
+    const hasRigConfig = existsSync4(resolve6(explicitRoot, "rig.config.ts"));
+    if (!hasTaskConfig && !hasRigConfig) {
+      throw new Error(`MONOREPO_ROOT points to ${explicitRoot}, but neither .rig/task-config.json nor rig.config.ts exists there.`);
+    }
+    return explicitRoot;
+  }
+  const projectParent = dirname5(normalizedProjectRoot);
+  if (basename3(projectParent) === ".worktrees") {
+    const worktreeOwner = dirname5(projectParent);
+    const ownerHasGit = existsSync4(resolve6(worktreeOwner, ".git"));
+    const ownerHasTaskConfig = existsSync4(resolve6(worktreeOwner, ".rig", "task-config.json"));
+    const ownerHasRigConfig = existsSync4(resolve6(worktreeOwner, "rig.config.ts"));
+    if (ownerHasGit && (ownerHasTaskConfig || ownerHasRigConfig)) {
+      return worktreeOwner;
+    }
+  }
+  return normalizedProjectRoot;
+}
+function resolveRuntimeWorkspaceLayout(workspaceDir) {
+  const root = resolve6(workspaceDir);
+  const rigRoot = resolve6(root, ".rig");
+  const logsDir = resolve6(rigRoot, "logs");
+  const stateDir = resolve6(rigRoot, "state");
+  const runtimeDir = resolve6(rigRoot, "runtime");
+  const binDir = resolve6(rigRoot, "bin");
+  return {
+    workspaceDir: root,
+    rigRoot,
+    stateDir,
+    logsDir,
+    artifactsRoot: resolve6(root, RIG_ARTIFACTS_DIRNAME),
+    runtimeDir,
+    homeDir: resolve6(rigRoot, "home"),
+    tmpDir: resolve6(rigRoot, "tmp"),
+    cacheDir: resolve6(rigRoot, "cache"),
+    sessionDir: resolve6(rigRoot, "session"),
+    binDir,
+    distDir: resolve6(rigRoot, "dist"),
+    pluginBinDir: resolve6(binDir, "plugins"),
+    contextPath: resolve6(rigRoot, "runtime-context.json"),
+    controlPlaneEventsFile: resolve6(logsDir, "control-plane.events.jsonl")
+  };
+}
+function resolveActiveRuntimeWorkspaceRoot(monorepoRoot) {
+  const explicit = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (!explicit) {
+    throw new Error("No active runtime workspace. Set RIG_TASK_WORKSPACE or provision a task runtime first.");
+  }
+  return resolve6(explicit);
+}
+function resolveRigLayout(projectRoot) {
+  const monorepoRoot = resolveMonorepoRoot(projectRoot);
+  const definitionRoot = resolve6(projectRoot, RIG_DEFINITION_DIRNAME);
+  const runtimeWorkspaceRoot = resolveActiveRuntimeWorkspaceRoot(monorepoRoot);
+  const runtimeLayout = resolveRuntimeWorkspaceLayout(runtimeWorkspaceRoot);
+  const policyDir = resolve6(definitionRoot, "policy");
+  return {
+    projectRoot,
+    monorepoRoot,
+    definitionRoot,
+    runtimeWorkspaceRoot,
+    stateRoot: runtimeLayout.rigRoot,
+    artifactsRoot: runtimeLayout.artifactsRoot,
+    configPath: resolve6(definitionRoot, "config.sh"),
+    taskConfigPath: resolve6(runtimeWorkspaceRoot, ".rig", "task-config.json"),
+    policyDir,
+    policyFile: resolve6(policyDir, "policy.json"),
+    pluginsDir: resolve6(definitionRoot, "plugins"),
+    hooksDir: resolve6(definitionRoot, "hooks"),
+    toolsDir: resolve6(definitionRoot, "tools"),
+    templatesDir: resolve6(definitionRoot, "templates"),
+    validationDir: resolve6(definitionRoot, "validation"),
+    stateDir: runtimeLayout.stateDir,
+    logsDir: runtimeLayout.logsDir,
+    notificationsDir: resolve6(definitionRoot, "notifications"),
+    runtimeDir: runtimeLayout.runtimeDir,
+    distDir: runtimeLayout.distDir,
+    binDir: runtimeLayout.binDir,
+    pluginBinDir: runtimeLayout.pluginBinDir,
+    keybindingsPath: resolve6(definitionRoot, "keybindings.json"),
+    controlPlaneEventsFile: runtimeLayout.controlPlaneEventsFile
+  };
+}
+
+// packages/runtime/src/control-plane/native/runtime-native.ts
+import { dlopen, ptr, suffix, toBuffer } from "bun:ffi";
+import { copyFileSync as copyFileSync2, existsSync as existsSync5, mkdirSync as mkdirSync3, renameSync as renameSync2, rmSync as rmSync2, statSync } from "fs";
+import { tmpdir as tmpdir4 } from "os";
+import { dirname as dirname6, resolve as resolve7 } from "path";
+var sharedNativeRuntimeOutputDir = resolve7(tmpdir4(), "rig-native");
+var sharedNativeRuntimeOutputPath = resolve7(sharedNativeRuntimeOutputDir, `runtime-native-${process.platform}-${process.arch}.${suffix}`);
+var colocatedNativeRuntimeFileName = `runtime-native.${suffix}`;
+var nativeRuntimeLibrary = await loadNativeRuntimeLibrary();
+function requireNativeRuntimeLibrary(feature) {
+  if (!nativeRuntimeLibrary) {
+    throw new Error(`Native Zig runtime is required for ${feature}`);
+  }
+  return nativeRuntimeLibrary;
+}
+async function ensureNativeRuntimeLibraryPath(outputPath = sharedNativeRuntimeOutputPath, options = {}) {
+  if (await buildNativeRuntimeLibrary(outputPath, options)) {
+    return outputPath;
+  }
+  return !options.force && existsSync5(outputPath) ? outputPath : null;
+}
+async function loadNativeRuntimeLibrary() {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return null;
+  }
+  for (const candidate of nativeRuntimeLibraryCandidates()) {
+    if (!candidate || !existsSync5(candidate)) {
+      continue;
+    }
+    const loaded = tryDlopenNativeRuntimeLibrary(candidate);
+    if (loaded) {
+      return loaded;
+    }
+  }
+  const builtLibraryPath = await ensureNativeRuntimeLibraryPath(sharedNativeRuntimeOutputPath, { force: true });
+  if (!builtLibraryPath) {
+    return null;
+  }
+  return tryDlopenNativeRuntimeLibrary(builtLibraryPath);
+}
+function nativePackageLibraryCandidates(fromDir, names) {
+  const candidates = [];
+  let cursor = resolve7(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    for (const name of names) {
+      candidates.push(resolve7(cursor, "native", `${process.platform}-${process.arch}`, name), resolve7(cursor, "native", `${process.platform}-${process.arch}`, "lib", name), resolve7(cursor, "native", name), resolve7(cursor, "native", "lib", name));
+    }
+    const parent = dirname6(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
+  }
+  return candidates;
+}
+function nativeRuntimeLibraryCandidates() {
+  const explicit = process.env.RIG_NATIVE_RUNTIME_LIB?.trim() || "";
+  const execDir = process.execPath?.trim() ? dirname6(process.execPath.trim()) : "";
+  const platformSpecific = `runtime-native-${process.platform}-${process.arch}.${suffix}`;
+  return [...new Set([
+    explicit,
+    ...nativePackageLibraryCandidates(import.meta.dir, [colocatedNativeRuntimeFileName, platformSpecific]),
+    execDir ? resolve7(execDir, colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve7(execDir, platformSpecific) : "",
+    execDir ? resolve7(execDir, "..", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve7(execDir, "..", platformSpecific) : "",
+    execDir ? resolve7(execDir, "lib", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve7(execDir, "..", "lib", colocatedNativeRuntimeFileName) : "",
+    sharedNativeRuntimeOutputPath
+  ].filter(Boolean))];
+}
+function resolveNativeRuntimeSourcePath() {
+  const explicit = process.env.RIG_NATIVE_RUNTIME_SOURCE?.trim();
+  if (explicit && existsSync5(explicit)) {
+    return explicit;
+  }
+  const bundled = resolve7(import.meta.dir, "../../../native/snapshot.zig");
+  return existsSync5(bundled) ? bundled : null;
+}
+async function buildNativeRuntimeLibrary(outputPath, options = {}) {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return false;
+  }
+  const zigBinary = Bun.which("zig");
+  const sourcePath = resolveNativeRuntimeSourcePath();
+  if (!zigBinary || !sourcePath) {
+    return false;
+  }
+  const tempOutputPath = `${outputPath}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
+  try {
+    mkdirSync3(dirname6(outputPath), { recursive: true });
+    const needsBuild = options.force === true || !existsSync5(outputPath) || statSync(sourcePath).mtimeMs > statSync(outputPath).mtimeMs;
+    if (!needsBuild) {
+      return true;
+    }
+    const build = Bun.spawn([
+      zigBinary,
+      "build-lib",
+      sourcePath,
+      "-dynamic",
+      "-O",
+      "ReleaseFast",
+      `-femit-bin=${tempOutputPath}`
+    ], {
+      cwd: import.meta.dir,
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const exitCode = await build.exited;
+    if (exitCode !== 0 || !existsSync5(tempOutputPath)) {
+      rmSync2(tempOutputPath, { force: true });
+      return false;
+    }
+    renameSync2(tempOutputPath, outputPath);
+    return true;
+  } catch {
+    rmSync2(tempOutputPath, { force: true });
+    return false;
+  }
+}
+function tryDlopenNativeRuntimeLibrary(outputPath) {
+  try {
+    return dlopen(outputPath, {
+      rig_scope_match: {
+        args: ["ptr", "ptr"],
+        returns: "u8"
+      },
+      snapshot_capture: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_delta: {
+        args: ["ptr", "ptr"],
+        returns: "ptr"
+      },
+      snapshot_store_delta: {
+        args: ["ptr", "ptr", "ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_inspect_delta: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_apply_delta: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_release: {
+        args: ["ptr"],
+        returns: "void"
+      },
+      runtime_hash_file: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_hash_tree: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_prepare_paths: {
+        args: ["ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_link_dependency_layer: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_scan_worktrees: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      }
+    });
+  } catch {
+    return null;
+  }
+}
+
+// packages/runtime/src/control-plane/native/utils.ts
+function resolveMonorepoRoot2(projectRoot) {
+  return resolveMonorepoRoot(projectRoot);
+}
+var nativeScopeMatcher = null;
+var scopeRegexCache = new Map;
+function runCapture(command, cwd, env) {
+  const result = Bun.spawnSync(command, {
+    cwd,
+    env: env ? { ...process.env, ...env } : process.env,
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  return {
+    exitCode: result.exitCode,
+    stdout: result.stdout.toString(),
+    stderr: result.stderr.toString()
+  };
+}
+function readJsonFile(path, fallback) {
+  if (!existsSync6(path)) {
+    return fallback;
+  }
+  try {
+    return JSON.parse(readFileSync4(path, "utf-8"));
+  } catch {
+    return fallback;
+  }
+}
+function nowIso() {
+  return new Date().toISOString();
+}
+function unique(values) {
+  return [...new Set(values)];
+}
+function resolveHarnessPaths(projectRoot) {
+  const hasRuntimeWorkspace = Boolean(process.env.RIG_TASK_WORKSPACE?.trim());
+  const monorepoRoot = resolveMonorepoRoot2(projectRoot);
+  const harnessRoot = resolve8(projectRoot, "rig");
+  const stateRoot = resolve8(projectRoot, ".rig");
+  const layout = hasRuntimeWorkspace ? resolveRigLayout(projectRoot) : null;
+  const stateDir = layout?.stateDir ?? resolve8(stateRoot, "state");
+  const logsDir = layout?.logsDir ?? resolve8(stateRoot, "logs");
+  const artifactsDir = layout?.artifactsRoot ?? resolve8(monorepoRoot, "artifacts");
+  const taskConfigPath = layout?.taskConfigPath ?? resolve8(monorepoRoot, ".rig", "task-config.json");
+  const binDir = layout?.binDir ?? resolve8(stateRoot, "bin");
+  return {
+    harnessRoot,
+    stateDir: process.env.RIG_STATE_DIR || stateDir,
+    artifactsDir,
+    logsDir: process.env.RIG_LOGS_DIR || logsDir,
+    binDir,
+    hooksDir: resolve8(harnessRoot, "hooks"),
+    validationDir: resolve8(harnessRoot, "validation"),
+    taskConfigPath,
+    sessionPath: process.env.RIG_SESSION_FILE || resolve8(stateRoot, "session", "session.json"),
+    monorepoRoot,
+    tsApiTestsDir: process.env.TS_API_TESTS_DIR || resolve8(monorepoRoot, "TSAPITests"),
+    taskRepoCommitsPath: resolve8(stateDir, "task-repo-commits.json"),
+    baseRepoPinsPath: resolve8(stateDir, "base-repo-pins.json"),
+    failedApproachesPath: resolve8(stateDir, "failed_approaches.md"),
+    agentProfilePath: resolve8(stateDir, "agent-profile.json"),
+    reviewProfilePath: resolve8(stateDir, "review-profile.json")
+  };
+}
+function normalizeRelativeScopePath(inputPath) {
+  let normalized = inputPath.replace(/^\.\//, "");
+  const rules = getScopeRules();
+  if (rules?.stripPrefixes) {
+    for (const prefix of rules.stripPrefixes) {
+      if (normalized.startsWith(prefix)) {
+        normalized = normalized.slice(prefix.length);
+      }
+    }
+  }
+  return normalized;
+}
+function normalizePathToScope(projectRoot, monorepoRoot, inputPath) {
+  let normalized = inputPath.replace(/^\.\//, "");
+  if (normalized.startsWith(projectRoot + "/")) {
+    normalized = normalized.slice(projectRoot.length + 1);
+  }
+  if (normalized.startsWith(monorepoRoot + "/")) {
+    normalized = normalized.slice(monorepoRoot.length + 1);
+  }
+  return normalizeRelativeScopePath(normalized);
+}
+function scopeMatches(path, scopes) {
+  const matcher = getNativeScopeMatcher();
+  const pathVariants = unique([path, normalizeRelativeScopePath(path)]);
+  for (const scope of scopes) {
+    const scopeVariants = unique([scope, normalizeRelativeScopePath(scope)]);
+    for (const candidatePath of pathVariants) {
+      for (const candidateScope of scopeVariants) {
+        if (candidatePath === candidateScope) {
+          return true;
+        }
+        if (matcher.match(candidateScope, candidatePath)) {
+          return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+function getNativeScopeMatcher() {
+  if (nativeScopeMatcher) {
+    return nativeScopeMatcher;
+  }
+  nativeScopeMatcher = createNativeScopeMatcher();
+  return nativeScopeMatcher;
+}
+function createNativeScopeMatcher() {
+  const library = requireNativeRuntimeLibrary("scope matching");
+  return {
+    match: (pattern, path) => {
+      const patternBuffer = Buffer.from(`${pattern}\x00`);
+      const pathBuffer = Buffer.from(`${path}\x00`);
+      return library.symbols.rig_scope_match(Number(ptr2(patternBuffer)), Number(ptr2(pathBuffer))) !== 0;
+    }
+  };
+}
+// packages/runtime/src/control-plane/state-sync/reconcile.ts
+var STALE_CLAIM_MS = 24 * 60 * 60 * 1000;
+// packages/runtime/src/control-plane/native/task-state.ts
+function readTaskConfig(projectRoot) {
+  const raw = readJsonFile(resolveTaskConfigPath(projectRoot), {});
+  return stripTaskConfigMetadata(raw);
+}
+function readSourceTaskConfig(projectRoot) {
+  const raw = readAndSyncSourceTaskConfig(projectRoot);
+  return stripTaskConfigMetadata(raw);
+}
+function currentTaskId(projectRoot) {
+  const fromEnv = (process.env.RIG_TASK_ID || "").trim();
+  if (fromEnv) {
+    return fromEnv;
+  }
+  const runtimeId = (process.env.RIG_TASK_RUNTIME_ID || "").trim();
+  if (runtimeId.startsWith("task-") && runtimeId.length > "task-".length) {
+    return runtimeId.slice("task-".length);
+  }
+  const workspace = (process.env.RIG_TASK_WORKSPACE || "").trim();
+  const inferredFromWorkspace = inferTaskIdFromRuntimePath(workspace);
+  if (inferredFromWorkspace) {
+    return inferredFromWorkspace;
+  }
+  const inferredFromCwd = inferTaskIdFromRuntimePath(process.cwd());
+  if (inferredFromCwd) {
+    return inferredFromCwd;
+  }
+  try {
+    const paths = resolveHarnessPaths(projectRoot);
+    const session = readJsonFile(paths.sessionPath, {});
+    return session.activeTaskIds?.[0] || "";
+  } catch {
+    return "";
+  }
+}
+function stripTaskConfigMetadata(raw) {
+  const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
+  return tasks;
+}
+function coerceValidationDescriptions(candidate) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
+    return {};
+  }
+  const descriptions = {};
+  for (const [key, value] of Object.entries(candidate)) {
+    if (typeof value === "string" && value.length > 0) {
+      descriptions[key] = value;
+    }
+  }
+  return descriptions;
+}
+function readValidationDescriptionsFromMeta(meta) {
+  if (!meta || typeof meta !== "object" || Array.isArray(meta)) {
+    return;
+  }
+  return meta.validation_descriptions;
+}
+function inferTaskIdFromRuntimePath(path) {
+  if (!path) {
+    return "";
+  }
+  const match = path.match(/\/\.rig\/runtime\/agents\/task-([^/]+)\/worktree(?:\/|$)/) || path.match(/\/\.worktrees\/([^/]+)(?:\/|$)/);
+  const candidate = match?.[1] || "";
+  return candidate.startsWith("bd-") ? candidate : "";
+}
+function lookupTask(projectRoot, input) {
+  if (!input) {
+    return "";
+  }
+  if (!input.startsWith("bd-")) {
+    return input;
+  }
+  try {
+    const taskConfig2 = readTaskConfig(projectRoot);
+    if (taskConfig2[input]) {
+      return input;
+    }
+  } catch {}
+  const taskConfig = readSourceTaskConfig(projectRoot);
+  return taskConfig[input] ? input : "";
+}
+function artifactDirForId(projectRoot, id) {
+  const workspaceDir = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (workspaceDir) {
+    const worktreeArtifacts = resolve9(workspaceDir, "artifacts", id);
+    if (existsSync7(worktreeArtifacts) || existsSync7(resolve9(workspaceDir, "artifacts"))) {
+      return worktreeArtifacts;
+    }
+  }
+  try {
+    const paths = resolveHarnessPaths(projectRoot);
+    return resolve9(paths.artifactsDir, id);
+  } catch {
+    return resolve9(resolveMonorepoRoot2(projectRoot), "artifacts", id);
+  }
+}
+function resolveTaskConfigPath(projectRoot) {
+  const paths = resolveHarnessPaths(projectRoot);
+  if (existsSync7(paths.taskConfigPath)) {
+    return paths.taskConfigPath;
+  }
+  for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
+    if (existsSync7(candidate)) {
+      return candidate;
+    }
+  }
+  throw new Error(`Task config missing at ${paths.taskConfigPath}.`);
+}
+function findSourceTaskConfigPath(projectRoot) {
+  for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
+    if (existsSync7(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+var FILE_TASK_PATTERN = /\.(task\.)?json$/;
+function readAndSyncSourceTaskConfig(projectRoot) {
+  const sourcePath = findSourceTaskConfigPath(projectRoot);
+  const raw = sourcePath ? readJsonFile(sourcePath, {}) : readConfiguredFileTaskConfig(projectRoot);
+  const synced = synchronizeTaskConfigWithTracker(projectRoot, raw);
+  if (sourcePath && synced.updated) {
+    try {
+      writeFileSync3(sourcePath, `${JSON.stringify(synced.config, null, 2)}
+`, "utf-8");
+    } catch {}
+  }
+  return synced.config;
+}
+function synchronizeTaskConfigWithTracker(projectRoot, rawConfig) {
+  const issues = readSourceIssueRecords(projectRoot);
+  if (issues.length === 0) {
+    return { config: rawConfig, updated: false };
+  }
+  const taskConfig = stripTaskConfigMetadata(rawConfig);
+  const mergedConfig = { ...taskConfig };
+  const validationDescriptions = coerceValidationDescriptions(rawConfig.validation_descriptions);
+  const metaValidationDescriptions = coerceValidationDescriptions(readValidationDescriptionsFromMeta(rawConfig._meta));
+  let updated = false;
+  for (const issue of issues) {
+    if (issue.issueType !== "task") {
+      continue;
+    }
+    if (mergedConfig[issue.id] && !shouldRefreshAutoSyncedTaskConfigEntry(mergedConfig[issue.id])) {
+      continue;
+    }
+    mergedConfig[issue.id] = buildAutoSyncedTaskConfigEntry(issue);
+    updated = true;
+  }
+  return {
+    config: {
+      ...mergedConfig,
+      ...Object.keys(validationDescriptions).length > 0 ? { validation_descriptions: validationDescriptions } : {},
+      ...Object.keys(metaValidationDescriptions).length > 0 ? { _meta: { validation_descriptions: metaValidationDescriptions } } : {}
+    },
+    updated
+  };
+}
+function shouldRefreshAutoSyncedTaskConfigEntry(entry) {
+  if (!entry || typeof entry !== "object") {
+    return false;
+  }
+  const candidate = entry;
+  if (!candidate.auto_synced) {
+    return false;
+  }
+  if (!Array.isArray(candidate.scope) || candidate.scope.length === 0) {
+    return true;
+  }
+  if (candidate.scope.some((glob) => typeof glob !== "string" || glob.trim().length === 0)) {
+    return true;
+  }
+  return !candidate.role;
+}
+function readSourceIssueRecords(projectRoot) {
+  const issuesPath = resolve9(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
+  if (!existsSync7(issuesPath)) {
+    return [];
+  }
+  const records = [];
+  for (const line of readFileSync5(issuesPath, "utf-8").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(trimmed);
+      const id = typeof parsed.id === "string" ? parsed.id.trim() : "";
+      if (!id) {
+        continue;
+      }
+      records.push({
+        id,
+        title: typeof parsed.title === "string" ? parsed.title.trim() : "",
+        issueType: typeof parsed.issue_type === "string" ? parsed.issue_type.trim() : null,
+        labels: Array.isArray(parsed.labels) ? parsed.labels.filter((label) => typeof label === "string") : []
+      });
+    } catch {}
+  }
+  return records;
+}
+function buildAutoSyncedTaskConfigEntry(issue) {
+  return {
+    auto_synced: true,
+    role: inferAutoSyncedTaskRole(issue),
+    scope: inferAutoSyncedTaskScope(issue),
+    validation: []
+  };
+}
+function inferAutoSyncedTaskRole(issue) {
+  for (const label of issue.labels) {
+    if (label === "role:architect")
+      return "architect";
+    if (label === "role:extractor")
+      return "extractor";
+    if (label === "role:mechanic")
+      return "mechanic";
+    if (label === "role:verifier")
+      return "verifier";
+  }
+  if (/\bDESIGN\b/i.test(issue.title)) {
+    return "architect";
+  }
+  if (/\bInitialize\b/i.test(issue.title)) {
+    return "mechanic";
+  }
+  return "extractor";
+}
+function inferAutoSyncedTaskScope(issue) {
+  return [`artifacts/${issue.id}/**`];
+}
+function readConfiguredFileTaskConfig(projectRoot) {
+  const sourcePath = readConfiguredFilesTaskSourcePath(projectRoot);
+  if (!sourcePath) {
+    return {};
+  }
+  const directory = resolve9(projectRoot, sourcePath);
+  if (!existsSync7(directory)) {
+    return {};
+  }
+  const config = {};
+  for (const name of readdirSync(directory)) {
+    if (!FILE_TASK_PATTERN.test(name))
+      continue;
+    const file = resolve9(directory, name);
+    try {
+      if (!statSync2(file).isFile())
+        continue;
+      const raw = JSON.parse(readFileSync5(file, "utf8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        continue;
+      const record = raw;
+      const inferredId = basename4(name).replace(FILE_TASK_PATTERN, "");
+      const id = typeof record.id === "string" && record.id.trim().length > 0 ? record.id.trim() : inferredId;
+      config[id] = fileTaskToConfigEntry(record, { kind: "files", path: sourcePath });
+    } catch {}
+  }
+  return config;
+}
+function fileTaskToConfigEntry(task, source) {
+  const labels = Array.isArray(task.labels) ? task.labels.filter((label) => typeof label === "string") : [];
+  const scope = firstStringList(task.scope, labels.filter((label) => label.startsWith("scope:")).map((label) => label.slice("scope:".length)));
+  const validation = firstStringList(task.validation, task.validators, labels.filter((label) => label.startsWith("validator:")).map((label) => label.slice("validator:".length)));
+  const roleLabel = labels.find((label) => label.startsWith("role:"));
+  const role = typeof task.role === "string" && task.role.trim().length > 0 ? task.role.trim() : roleLabel ? roleLabel.slice("role:".length) : undefined;
+  return {
+    auto_synced: true,
+    ...typeof task.title === "string" ? { title: task.title } : {},
+    ...typeof task.status === "string" ? { status: task.status } : {},
+    ...typeof task.description === "string" ? { description: task.description } : {},
+    ...typeof task.acceptance_criteria === "string" ? { acceptance_criteria: task.acceptance_criteria } : typeof task.acceptanceCriteria === "string" ? { acceptance_criteria: task.acceptanceCriteria } : {},
+    ...role ? { role } : {},
+    ...scope.length > 0 ? { scope } : {},
+    ...validation.length > 0 ? { validation } : {},
+    _rig: { taskSource: source }
+  };
+}
+function firstStringList(...candidates) {
+  for (const candidate of candidates) {
+    if (!Array.isArray(candidate)) {
+      continue;
+    }
+    const list = candidate.filter((entry) => typeof entry === "string" && entry.trim().length > 0);
+    if (list.length > 0) {
+      return list;
+    }
+  }
+  return [];
+}
+function readConfiguredFilesTaskSourcePath(projectRoot) {
+  const jsonPath = resolve9(projectRoot, "rig.config.json");
+  if (existsSync7(jsonPath)) {
+    try {
+      const parsed = JSON.parse(readFileSync5(jsonPath, "utf8"));
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        const taskSource = parsed.taskSource;
+        if (taskSource && typeof taskSource === "object" && !Array.isArray(taskSource)) {
+          const record = taskSource;
+          return record.kind === "files" && typeof record.path === "string" ? record.path : null;
+        }
+      }
+    } catch {
+      return null;
+    }
+  }
+  const tsPath = resolve9(projectRoot, "rig.config.ts");
+  if (!existsSync7(tsPath)) {
+    return null;
+  }
+  try {
+    const source = readFileSync5(tsPath, "utf8");
+    const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
+    const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
+    if (kind !== "files") {
+      return null;
+    }
+    return taskSourceBlock.match(/path\s*:\s*["']([^"']+)["']/)?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+function sourceTaskConfigCandidates(projectRoot) {
+  const runtimeContext = loadRuntimeContextFromEnv();
+  return [
+    runtimeContext?.monorepoMainRoot ? resolve9(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
+    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve9(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
+    resolve9(resolveMonorepoRoot2(projectRoot), ".rig", "task-config.json")
+  ].filter(Boolean);
+}
+
+// packages/runtime/src/binary-run.ts
+var runtimeBinaryBuildQueue = Promise.resolve();
+// packages/runtime/src/control-plane/provider/runtime-instructions.ts
+var CLAUDE_ROUTER_TOOL_NAMES = [
+  "`mcp__rig_runtime_tools__read`",
+  "`mcp__rig_runtime_tools__write`",
+  "`mcp__rig_runtime_tools__edit`",
+  "`mcp__rig_runtime_tools__glob`",
+  "`mcp__rig_runtime_tools__grep`"
+].join(", ");
+var CODEX_DYNAMIC_TOOL_NAMES = [
+  "`shell`",
+  "`read`",
+  "`write`",
+  "`edit`",
+  "`glob`",
+  "`grep`"
+].join(", ");
+
+// packages/runtime/src/control-plane/native/task-ops.ts
+var BUILD_CONFIG = readBuildConfig();
+var BAKED_INFO_OUTPUT = BUILD_CONFIG.AGENT_INFO_OUTPUT ?? "";
+var BAKED_DEPS_OUTPUT = BUILD_CONFIG.AGENT_DEPS_OUTPUT ?? "";
+var BAKED_STATUS_OUTPUT = BUILD_CONFIG.AGENT_STATUS_OUTPUT ?? "";
+var REOPENABLE_TASK_STATUSES = new Set(["completed", "cancelled", "blocked"]);
+function hasRuntimeWorkspace() {
+  return Boolean(process.env.RIG_TASK_WORKSPACE?.trim());
+}
+function readTaskConfigForInvocation(projectRoot) {
+  return hasRuntimeWorkspace() ? readTaskConfig(projectRoot) : readSourceTaskConfig(projectRoot);
+}
+var GENERATED_TASK_ARTIFACT_FILES = new Set([
+  "changed-files.txt",
+  "decision-log.md",
+  "next-actions.md",
+  "task-result.json",
+  "validation-summary.json",
+  "review-feedback.md",
+  "review-state.json",
+  "review-status.txt",
+  "review-greptile-raw.json",
+  "pr-state.json",
+  "git-state.txt"
+]);
+function collectTaskChangedFiles(projectRoot, taskId, includeCommitted) {
+  const paths = resolveHarnessPaths(projectRoot);
+  const monorepoRepoRoot = resolveTaskMonorepoRoot(projectRoot);
+  const files = [];
+  const projectBaseline = resolveRuntimeDirtyBaseline(projectRoot, projectRoot);
+  const monorepoBaseline = resolveRuntimeDirtyBaseline(projectRoot, monorepoRepoRoot);
+  for (const [repo, prefix] of [
+    [projectRoot, ""],
+    [monorepoRepoRoot, ""]
+  ]) {
+    if (!existsSync8(resolve10(repo, ".git"))) {
+      continue;
+    }
+    if (includeCommitted && repo === monorepoRepoRoot) {
+      for (const line of collectCommittedMonorepoFiles(projectRoot, repo)) {
+        files.push(`${prefix}${line}`);
+      }
+    }
+    const baseline = repo === paths.monorepoRoot ? monorepoBaseline : projectBaseline;
+    for (const line of collectWorkingTreeFiles(projectRoot, repo, baseline)) {
+      files.push(`${prefix}${line}`);
+    }
+  }
+  const uniqueFiles = unique(files).map((file) => normalizeChangedFilePath(file)).filter(Boolean);
+  return filterTaskChangedFiles(projectRoot, taskId, uniqueFiles, false);
+}
+function filterTaskChangedFiles(projectRoot, taskId, files, scoped) {
+  const uniqueFiles = unique(files).map((file) => normalizeChangedFilePath(file)).filter(Boolean);
+  if (!taskId) {
+    return unique(uniqueFiles).sort();
+  }
+  const filteredFiles = unique(uniqueFiles).filter((file) => !isGeneratedTaskChangePath(taskId, file));
+  if (!scoped) {
+    return filteredFiles.sort();
+  }
+  const paths = resolveHarnessPaths(projectRoot);
+  const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
+  const scopes = readTaskConfigForInvocation(projectRoot)[taskId]?.scope || [];
+  if (scopes.length === 0) {
+    return [];
+  }
+  return filteredFiles.filter((file) => {
+    const normalized = normalizePathToScope(projectRoot, monorepoRoot || paths.monorepoRoot, file);
+    return scopeMatches(file, scopes) || scopeMatches(normalized, scopes);
+  }).sort();
+}
+function resolveTaskMonorepoRoot(projectRoot) {
+  const runtimeWorkspace = loadRuntimeContextFromEnv()?.workspaceDir || process.env.RIG_TASK_WORKSPACE?.trim();
+  if (runtimeWorkspace && existsSync8(resolve10(runtimeWorkspace, ".git"))) {
+    return resolve10(runtimeWorkspace);
+  }
+  return resolveHarnessPaths(projectRoot).monorepoRoot;
+}
+function collectCommittedMonorepoFiles(projectRoot, repo) {
+  const initialHeadCommit = resolveRuntimeInitialHeadCommit(projectRoot, repo);
+  if (initialHeadCommit) {
+    const result = runCapture(["git", "-C", repo, "diff", "--name-only", `${initialHeadCommit}..HEAD`], projectRoot);
+    if (result.exitCode === 0) {
+      return result.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+    }
+  }
+  const baseCommit = resolveMonorepoBaseCommit(projectRoot, repo);
+  if (!baseCommit) {
+    return [];
+  }
+  for (const revision of [`${baseCommit}...HEAD`, `${baseCommit}..HEAD`]) {
+    const result = runCapture(["git", "-C", repo, "diff", "--name-only", revision], projectRoot);
+    if (result.exitCode === 0) {
+      return result.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+    }
+  }
+  return [];
+}
+function resolveRuntimeInitialHeadCommit(projectRoot, repo) {
+  const runtimeContext = loadRuntimeContextFromEnv();
+  if (runtimeContext?.initialHeadCommits?.monorepo?.trim()) {
+    const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
+    if (resolve10(monorepoRoot) === resolve10(repo)) {
+      return runtimeContext.initialHeadCommits.monorepo.trim();
+    }
+  }
+  return "";
+}
+function resolveMonorepoBaseCommit(projectRoot, repo) {
+  const runtimeContext = loadRuntimeContextFromEnv();
+  if (runtimeContext?.monorepoBaseCommit?.trim()) {
+    const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
+    if (resolve10(monorepoRoot) === resolve10(repo)) {
+      return runtimeContext.monorepoBaseCommit.trim();
+    }
+  }
+  return "";
+}
+function collectWorkingTreeFiles(projectRoot, repo, baseline) {
+  const files = new Set;
+  for (const args of [
+    ["diff", "--name-only"],
+    ["diff", "--cached", "--name-only"],
+    ["ls-files", "--others", "--exclude-standard"]
+  ]) {
+    const result = runCapture(["git", "-C", repo, ...args], projectRoot);
+    if (result.exitCode !== 0) {
+      continue;
+    }
+    for (const line of result.stdout.split(/\r?\n/)) {
+      const normalized = normalizeChangedFilePath(line);
+      if (!normalized || baseline.has(normalized)) {
+        continue;
+      }
+      files.add(normalized);
+    }
+  }
+  return [...files].sort();
+}
+function resolveRuntimeDirtyBaseline(projectRoot, repo) {
+  const runtimeContext = loadRuntimeContextFromEnv();
+  const dirtyFiles = runtimeContext?.initialDirtyFiles;
+  if (!dirtyFiles) {
+    return new Set;
+  }
+  const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
+  const selected = resolve10(repo) === resolve10(monorepoRoot) ? dirtyFiles.monorepo : resolve10(repo) === resolve10(projectRoot) ? dirtyFiles.project : undefined;
+  return new Set((selected || []).map((file) => normalizeChangedFilePath(file)).filter(Boolean));
+}
+function normalizeChangedFilePath(file) {
+  return file.trim().replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function isGeneratedTaskChangePath(taskId, file) {
+  const normalized = normalizeChangedFilePath(file);
+  if (!normalized) {
+    return true;
+  }
+  if (normalized.startsWith(".rig/") || normalized.startsWith(".beads/")) {
+    return true;
+  }
+  const taskArtifactPrefix = `artifacts/${taskId}/`;
+  if (!normalized.startsWith(taskArtifactPrefix)) {
+    return false;
+  }
+  const artifactRelativePath = normalized.slice(taskArtifactPrefix.length);
+  return GENERATED_TASK_ARTIFACT_FILES.has(artifactRelativePath) || artifactRelativePath.startsWith("runtime-snapshots/");
+}
+function changedFilesForTask(projectRoot, taskId, scoped) {
+  return filterTaskChangedFiles(projectRoot, taskId, collectTaskChangedFiles(projectRoot, taskId, true), scoped);
+}
+
+// packages/runtime/src/control-plane/native/git-ops.ts
+var TASK_RUNTIME_STAGE_EXCLUDES = [
+  ".rig/bin/**",
+  ".rig/cache/**",
+  ".rig/home/**",
+  ".rig/logs/**",
+  ".rig/runtime/**",
+  ".rig/session/**",
+  ".rig/state/**",
+  ".rig/runtime-context.json"
+];
+var GENERATED_STAGE_EXCLUDES = ["artifacts/*/runtime-snapshots/**"];
+var TASK_ARTIFACT_STAGE_FALLBACK = new Set([
+  "changed-files.txt",
+  "contract-changes.md",
+  "decision-log.md",
+  "git-state.txt",
+  "next-actions.md",
+  "pr-state.json",
+  "task-result.json",
+  "validation-summary.json"
+]);
+function resolveHostRigBinDir(root) {
+  return resolve11(root, ".rig", "bin");
+}
+function isRuntimeGatewayGitPath(candidate) {
+  return /\/\.rig\/bin\/git$/.test(candidate.replace(/\\/g, "/"));
+}
+function resolveOptionalMonorepoRoot(projectRoot) {
+  const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (runtimeWorkspace && existsSync9(resolve11(runtimeWorkspace, ".git"))) {
+    return resolve11(runtimeWorkspace);
+  }
+  try {
+    return resolveMonorepoRoot2(projectRoot);
+  } catch {
+    return null;
+  }
+}
+function resolveGitBinary(projectRoot) {
+  const candidates = new Set;
+  const explicit = process.env.RIG_GIT_BIN?.trim();
+  if (explicit) {
+    candidates.add(explicit);
+  }
+  for (const candidate of ["/usr/bin/git", "/opt/homebrew/bin/git", "/usr/local/bin/git"]) {
+    candidates.add(candidate);
+  }
+  const bunResolved = Bun.which("git");
+  if (bunResolved && !isRuntimeGatewayGitPath(bunResolved)) {
+    candidates.add(bunResolved);
+  }
+  for (const candidate of candidates) {
+    if (!candidate || isRuntimeGatewayGitPath(candidate)) {
+      continue;
+    }
+    if (existsSync9(candidate)) {
+      return candidate;
+    }
+  }
+  return "git";
+}
+function safeCurrentTaskId(projectRoot) {
+  try {
+    const taskId = currentTaskId(projectRoot);
+    return /^bd-[a-z0-9-]+$/.test(taskId) ? taskId : "";
+  } catch {
+    return "";
+  }
+}
+function gitCmd(projectRoot, repoRoot, ...args) {
+  return [resolveGitBinary(projectRoot), "-C", repoRoot, ...args];
+}
+function shouldScopeGitCommit(args, hasTaskContext) {
+  if (!hasTaskContext) {
+    return false;
+  }
+  return !args.includes("--all") && !args.includes("--unscoped");
+}
+function gitStatus(projectRoot, taskId) {
+  const monorepoRoot = resolveOptionalMonorepoRoot(projectRoot);
+  const resolvedTask = taskId || safeCurrentTaskId(projectRoot);
+  const expected = resolvedTask ? `rig/${resolveTaskBranchId(projectRoot, resolvedTask)}` : "";
+  console.log("=== Git Flow Status ===");
+  if (resolvedTask) {
+    console.log(`Task: ${resolvedTask}`);
+    console.log(`Expected monorepo branch: ${expected}`);
+  } else {
+    console.log("Task: (none active)");
+  }
+  console.log("");
+  printRepoStatus(projectRoot, "project-rig", projectRoot, "");
+  const monorepoPath = monorepoRoot || resolveMonorepoRoot2(projectRoot);
+  if (monorepoPath !== projectRoot) {
+    printRepoStatus(projectRoot, "monorepo", monorepoPath, expected);
+  }
+}
+function gitChanged(projectRoot, taskId, scoped) {
+  if (scoped) {
+    const resolvedTask = taskId || currentTaskId(projectRoot);
+    if (!resolvedTask) {
+      throw new Error("No task specified and no active task in session. Use --task or omit --scoped.");
+    }
+    return changedFilesForTask(projectRoot, resolvedTask, true);
+  }
+  return changedFilesForTask(projectRoot, taskId || currentTaskId(projectRoot) || "", false);
+}
+function gitPreflight(projectRoot, taskId, strict) {
+  const monorepoRoot = resolveOptionalMonorepoRoot(projectRoot);
+  const resolvedTask = taskId || safeCurrentTaskId(projectRoot);
+  const expected = resolvedTask ? `rig/${resolveTaskBranchId(projectRoot, resolvedTask)}` : "";
+  console.log("=== Git Flow Preflight ===");
+  let issues = 0;
+  if (!existsSync9(resolve11(projectRoot, ".git"))) {
+    console.log(`ERROR: project root is not a git repo (${projectRoot})`);
+    issues += 1;
+  }
+  if (monorepoRoot && existsSync9(resolve11(monorepoRoot, ".git"))) {
+    const monoBranch = branchName(projectRoot, monorepoRoot);
+    if (expected && monoBranch !== expected) {
+      console.log(`WARN: monorepo branch is ${monoBranch}, expected ${expected} for task ${resolvedTask}`);
+      if (strict) {
+        issues += 1;
+      }
+    }
+    const monoChanges = changeCount(projectRoot, monorepoRoot);
+    if (monoChanges > 0 && !monoBranch.startsWith("rig/")) {
+      console.log(`WARN: monorepo has uncommitted changes on non-rig branch (${monoBranch})`);
+      issues += 1;
+    }
+  } else {
+    console.log(`WARN: monorepo repo unavailable.`);
+  }
+  const projectChanges = changeCount(projectRoot, projectRoot);
+  if (projectChanges > 0) {
+    console.log(`INFO: project-rig has ${projectChanges} changed file(s).`);
+  }
+  if (issues > 0) {
+    console.log(`Preflight: ${issues} issue(s) detected.`);
+    return false;
+  }
+  console.log("Preflight: OK");
+  return true;
+}
+function gitSyncBranch(projectRoot, taskId, targetRepo = "monorepo") {
+  const resolvedTask = taskId || safeCurrentTaskId(projectRoot);
+  if (!resolvedTask) {
+    throw new Error("No task specified and no active task in session.");
+  }
+  const repoRoot = targetRepo === "monorepo" ? resolveOptionalMonorepoRoot(projectRoot) || resolveMonorepoRoot2(projectRoot) : projectRoot;
+  const repoLabel = targetRepo === "monorepo" ? "Monorepo" : "Project";
+  if (!existsSync9(resolve11(repoRoot, ".git"))) {
+    throw new Error(`${repoLabel} repo not found at ${repoRoot}`);
+  }
+  const branchId = resolveTaskBranchId(projectRoot, resolvedTask);
+  const branchTarget = `rig/${branchId}`;
+  const current = branchName(projectRoot, repoRoot);
+  if (current === branchTarget) {
+    console.log(`${repoLabel} branch: already on ${branchTarget}`);
+    return;
+  }
+  const hasBranch = runCapture2(gitCmd(projectRoot, repoRoot, "show-ref", "--verify", "--quiet", `refs/heads/${branchTarget}`), projectRoot).exitCode === 0;
+  const cmd = hasBranch && current === "HEAD" ? gitCmd(projectRoot, repoRoot, "checkout", "-B", branchTarget) : hasBranch ? gitCmd(projectRoot, repoRoot, "checkout", branchTarget) : gitCmd(projectRoot, repoRoot, "checkout", "-b", branchTarget);
+  const checkout = runCapture2(cmd, projectRoot);
+  if (checkout.exitCode !== 0) {
+    throw new Error(`Failed to sync ${repoLabel.toLowerCase()} branch: ${checkout.stderr || checkout.stdout}`);
+  }
+  const action = hasBranch && current === "HEAD" ? "reset" : hasBranch ? "checked out" : "created";
+  console.log(`${repoLabel} branch: ${action} ${branchTarget}`);
+}
+function gitCommit(options) {
+  const { projectRoot } = options;
+  const resolvedTask = options.taskId || safeCurrentTaskId(projectRoot);
+  const baseMessage = options.message || (resolvedTask ? `rig: ${resolvedTask}` : "rig: harness update");
+  const changedFilesManifest = resolvedTask && options.scoped === true ? refreshChangedFilesManifest(projectRoot, resolvedTask) : "";
+  const changedFiles = resolvedTask && options.scoped === true ? readChangedFilesManifest(projectRoot, resolvedTask) : resolvedTask ? changedFilesForTask(projectRoot, resolvedTask, false) : [];
+  if (options.target === "project" || options.target === "both") {
+    if (resolvedTask) {
+      gitSyncBranch(projectRoot, resolvedTask, "project");
+    }
+    const projectFiles = resolveScopedStageFilesForRepo(projectRoot, projectRoot, resolvedTask, changedFiles);
+    commitRepo(projectRoot, projectRoot, "project-rig", options.target === "both" ? `${baseMessage} [harness]` : baseMessage, options.allowEmpty, options.scoped === true, projectFiles, changedFilesManifest);
+  }
+  if (options.target === "monorepo" || options.target === "both") {
+    const monorepoRoot = resolveOptionalMonorepoRoot(projectRoot) || resolveMonorepoRoot2(projectRoot);
+    if (resolvedTask) {
+      gitSyncBranch(projectRoot, resolvedTask, "monorepo");
+    }
+    const monorepoFiles = resolveScopedStageFilesForRepo(projectRoot, monorepoRoot, resolvedTask, changedFiles);
+    commitRepo(projectRoot, monorepoRoot, "monorepo", options.target === "both" ? `${baseMessage} [monorepo]` : baseMessage, options.allowEmpty, options.scoped === true, monorepoFiles, changedFilesManifest);
+  }
+}
+function gitSnapshot(projectRoot, taskId, outputPath) {
+  const monorepoRoot = resolveOptionalMonorepoRoot(projectRoot);
+  const resolvedTask = taskId || safeCurrentTaskId(projectRoot);
+  const output = outputPath || (resolvedTask ? resolveArtifactSnapshot(projectRoot, resolvedTask) : resolve11(resolve11(projectRoot, ".rig", "state"), "git-state.txt"));
+  mkdirSync5(dirname7(output), { recursive: true });
+  const lines = ["# Git Snapshot", `timestamp: ${nowIso()}`];
+  if (resolvedTask) {
+    lines.push(`task: ${resolvedTask}`);
+  }
+  lines.push("");
+  lines.push(...snapshotRepo(projectRoot, "project-rig", projectRoot));
+  if (monorepoRoot && monorepoRoot !== projectRoot) {
+    lines.push(...snapshotRepo(projectRoot, "monorepo", monorepoRoot));
+  }
+  writeFileSync5(output, `${lines.join(`
+`)}
+`, "utf-8");
+  return output;
+}
+function gitOpenPr(options) {
+  const gh = resolveGithubCliBinary(options.projectRoot);
+  if (!gh) {
+    throw new Error("gh CLI is required for open-pr. Install and authenticate with: gh auth login");
+  }
+  const taskId = options.taskId || safeCurrentTaskId(options.projectRoot);
+  const target = options.target || (taskId ? "monorepo" : "project");
+  let repoRoot = options.projectRoot;
+  let repoLabel = "project-rig";
+  let defaultBase = process.env.RIG_PR_BASE_PROJECT || "main";
+  if (target === "monorepo") {
+    repoRoot = resolveOptionalMonorepoRoot(options.projectRoot) || resolveMonorepoRoot2(options.projectRoot);
+    repoLabel = "monorepo";
+    defaultBase = process.env.RIG_PR_BASE_MONOREPO || "main";
+    if (taskId) {
+      gitSyncBranch(options.projectRoot, taskId, "monorepo");
+    }
+  } else if (taskId) {
+    gitSyncBranch(options.projectRoot, taskId, "project");
+    defaultBase = inferProjectBase(options.projectRoot, defaultBase);
+  }
+  if (!existsSync9(resolve11(repoRoot, ".git"))) {
+    throw new Error(`Repository not available for open-pr target ${target}: ${repoRoot}`);
+  }
+  const branch = branchName(options.projectRoot, repoRoot);
+  if (!branch || branch === "HEAD") {
+    throw new Error(`Cannot open PR from detached HEAD in ${repoLabel}. Checkout a branch first.`);
+  }
+  const base = options.base || defaultBase;
+  const repoNameWithOwner = resolveRepoNameWithOwner(options.projectRoot, repoRoot);
+  const networkRemote = resolveNetworkRemoteName(options.projectRoot, repoRoot, repoNameWithOwner);
+  refreshRemoteBaseRef(options.projectRoot, repoRoot, base);
+  let reviewer = (options.reviewer || "").trim();
+  let reviewerSource = reviewer ? "flag" : undefined;
+  if (!reviewer && taskId) {
+    reviewer = defaultReviewerForTask(options.projectRoot, taskId);
+    if (reviewer) {
+      reviewerSource = "task-config";
+    }
+  }
+  if (!reviewer) {
+    reviewer = inferReviewerFromChangedFiles(options.projectRoot, repoRoot, base, branch);
+    if (reviewer) {
+      reviewerSource = "changed-files";
+    }
+  }
+  if (!reviewer) {
+    reviewer = (process.env.RIG_PR_REVIEWER || "").trim();
+    if (reviewer) {
+      reviewerSource = "env";
+    }
+  }
+  let title = options.title || "";
+  if (!title) {
+    if (taskId) {
+      title = `rig: ${taskId}`;
+    } else {
+      title = `rig: update ${branch}`;
+    }
+  }
+  const body = options.body || [
+    "## Summary",
+    "- Automated task output prepared in isolated runtime.",
+    "",
+    "## Task",
+    `- beads: ${taskId || "n/a"}`,
+    "",
+    "## Review",
+    "- Completion verification will run validation, verifier review, and PR policy checks.",
+    "- When repository policy allows it, Rig enables GitHub auto-merge after approval."
+  ].join(`
+`);
+  const preCheck = runCapture2(withGhRepo([gh, "pr", "list", "--state", "merged", "--head", branch, "--json", "url,mergedAt", "--jq", ".[0]"], repoNameWithOwner), repoRoot);
+  const preCheckEntry = preCheck.exitCode === 0 ? preCheck.stdout.trim() : "";
+  if (preCheckEntry && preCheckEntry !== "null" && currentHeadMatchesMergedBase(options.projectRoot, repoRoot, base, networkRemote)) {
+    const mergedPr = JSON.parse(preCheckEntry);
+    console.log(`Branch ${branch} was already merged: ${mergedPr.url}`);
+    const result2 = { url: mergedPr.url, target, repoLabel, branch, base };
+    if (taskId)
+      writePrMetadata(options.projectRoot, taskId, result2);
+    return result2;
+  }
+  const pushArgs = gitCmd(options.projectRoot, repoRoot, "push", "-u", networkRemote, branch);
+  const fetchResult = runCapture2(gitCmd(options.projectRoot, repoRoot, "fetch", networkRemote, branch), repoRoot);
+  if (fetchResult.exitCode === 0) {
+    const remoteAhead = runCapture2(gitCmd(options.projectRoot, repoRoot, "log", "--oneline", `HEAD..${networkRemote}/${branch}`), repoRoot);
+    if (remoteAhead.exitCode === 0 && remoteAhead.stdout.trim()) {
+      console.log(`Remote branch has diverged \u2014 force pushing task-owned branch ${branch} with --force-with-lease...`);
+      pushArgs.splice(4, 0, "--force-with-lease");
+    }
+  }
+  runOrThrow(options.projectRoot, pushArgs, `Failed to push branch ${branch} in ${repoLabel}`);
+  const existing = runCapture2(withGhRepo([gh, "pr", "list", "--state", "open", "--head", branch, "--json", "url", "--jq", ".[0].url"], repoNameWithOwner), repoRoot);
+  const existingUrl = existing.exitCode === 0 ? existing.stdout.trim() : "";
+  if (!existingUrl || existingUrl === "null") {
+    const merged = runCapture2(withGhRepo([gh, "pr", "list", "--state", "merged", "--head", branch, "--json", "url,mergedAt", "--jq", ".[0]"], repoNameWithOwner), repoRoot);
+    const mergedEntry = merged.exitCode === 0 ? merged.stdout.trim() : "";
+    if (mergedEntry && mergedEntry !== "null" && currentHeadMatchesMergedBase(options.projectRoot, repoRoot, base, networkRemote)) {
+      const mergedPr = JSON.parse(mergedEntry);
+      console.log(`Branch ${branch} was already merged: ${mergedPr.url}`);
+      const result2 = { url: mergedPr.url, target, repoLabel, branch, base };
+      if (taskId)
+        writePrMetadata(options.projectRoot, taskId, result2);
+      return result2;
+    }
+  }
+  let prUrl = "";
+  if (existingUrl && existingUrl !== "null") {
+    prUrl = existingUrl;
+  } else {
+    const createArgs = [
+      gh,
+      "pr",
+      "create",
+      ...ghRepoArgs(repoNameWithOwner),
+      "--base",
+      base,
+      "--head",
+      branch,
+      "--title",
+      title,
+      "--body",
+      body
+    ];
+    if (options.draft) {
+      createArgs.push("--draft");
+    }
+    const created = runCapture2(createArgs, repoRoot);
+    if (created.exitCode !== 0) {
+      throw new Error(`Failed to create PR in ${repoLabel}: ${created.stderr || created.stdout}`);
+    }
+    prUrl = created.stdout.trim();
+  }
+  if (!prUrl) {
+    throw new Error(`Failed to resolve PR URL for branch ${branch}.`);
+  }
+  assertPrHasNoGitConflicts(readPrViewState(gh, repoRoot, repoNameWithOwner, prUrl), repoLabel, base);
+  if (reviewer) {
+    const edit = runCapture2(withGhRepo([gh, "pr", "edit", prUrl, "--add-reviewer", reviewer], repoNameWithOwner), repoRoot);
+    if (edit.exitCode !== 0) {
+      throw new Error(`Failed to assign reviewer '${reviewer}': ${edit.stderr || edit.stdout}`);
+    }
+  }
+  const result = {
+    url: prUrl,
+    reviewer,
+    reviewerSource,
+    target,
+    repoLabel,
+    branch,
+    base
+  };
+  if (taskId) {
+    writePrMetadata(options.projectRoot, taskId, result);
+  }
+  return result;
+}
+function resolveTaskBranchRef(projectRoot, taskId) {
+  return `rig/${resolveTaskBranchId(projectRoot, taskId)}`;
+}
+function readPrViewState(gh, repoRoot, repoNameWithOwner, prUrl) {
+  const view = runCapture2(withGhRepo([
+    gh,
+    "pr",
+    "view",
+    prUrl,
+    "--json",
+    "state,isDraft,url,mergedAt,autoMergeRequest,mergeable,mergeStateStatus,reviewDecision,headRefOid,statusCheckRollup",
+    "--jq",
+    "."
+  ], repoNameWithOwner), repoRoot);
+  if (view.exitCode !== 0) {
+    throw new Error(`Failed to inspect PR ${prUrl}: ${view.stderr || view.stdout}`);
+  }
+  try {
+    const parsed = JSON.parse(view.stdout);
+    return {
+      state: parsed.state || "OPEN",
+      isDraft: parsed.isDraft === true,
+      url: typeof parsed.url === "string" ? parsed.url : prUrl,
+      mergedAt: typeof parsed.mergedAt === "string" ? parsed.mergedAt : null,
+      autoMergeRequest: parsed.autoMergeRequest ?? null,
+      mergeable: typeof parsed.mergeable === "string" ? parsed.mergeable : "",
+      mergeStateStatus: typeof parsed.mergeStateStatus === "string" ? parsed.mergeStateStatus : "",
+      reviewDecision: typeof parsed.reviewDecision === "string" ? parsed.reviewDecision : "",
+      headRefOid: typeof parsed.headRefOid === "string" ? parsed.headRefOid : null,
+      statusCheckRollup: Array.isArray(parsed.statusCheckRollup) ? parsed.statusCheckRollup : []
+    };
+  } catch {
+    return {
+      state: "OPEN",
+      isDraft: false,
+      url: prUrl,
+      mergedAt: null,
+      autoMergeRequest: null,
+      mergeable: "",
+      mergeStateStatus: "",
+      reviewDecision: "",
+      headRefOid: null,
+      statusCheckRollup: []
+    };
+  }
+}
+function hasSatisfiedStatusChecks(prState) {
+  if (prState.statusCheckRollup.length === 0) {
+    return false;
+  }
+  return prState.statusCheckRollup.every((entry) => {
+    if (entry.__typename === "CheckRun") {
+      const status = entry.status?.toUpperCase() || "";
+      const conclusion = entry.conclusion?.toUpperCase() || "";
+      return status === "COMPLETED" && (conclusion === "SUCCESS" || conclusion === "SKIPPED" || conclusion === "NEUTRAL");
+    }
+    if (entry.__typename === "StatusContext") {
+      return (entry.state?.toUpperCase() || "") === "SUCCESS";
+    }
+    return false;
+  });
+}
+function canAdminMergeApprovedPr(prState) {
+  return prState.state === "OPEN" && prState.autoMergeRequest !== null && prState.mergeable.toUpperCase() === "MERGEABLE" && prState.reviewDecision.toUpperCase() === "APPROVED" && hasSatisfiedStatusChecks(prState);
+}
+function gitMergePr(options) {
+  const gh = resolveGithubCliBinary(options.projectRoot);
+  if (!gh) {
+    throw new Error("gh CLI is required for merge-pr. Install and authenticate with: gh auth login");
+  }
+  const repoRoot = resolveRepoRoot(options.projectRoot, options.pr.target);
+  const repoNameWithOwner = resolveRepoNameWithOwner(options.projectRoot, repoRoot);
+  if (!existsSync9(resolve11(repoRoot, ".git"))) {
+    throw new Error(`Repository not available for merge-pr target ${options.pr.target}: ${repoRoot}`);
+  }
+  const prState = readPrViewState(gh, repoRoot, repoNameWithOwner, options.pr.url);
+  const state = prState.state;
+  const isDraft = prState.isDraft;
+  assertPrHasNoGitConflicts(prState, options.pr.repoLabel, options.pr.base);
+  if (state === "MERGED") {
+    console.log(`PR already merged (${options.pr.repoLabel}): ${options.pr.url}`);
+    return { status: "already-merged", url: options.pr.url };
+  }
+  if (state !== "OPEN") {
+    throw new Error(`Cannot auto-merge PR ${options.pr.url}: state is ${state}.`);
+  }
+  if (isDraft) {
+    throw new Error(`Cannot auto-merge draft PR ${options.pr.url}.`);
+  }
+  const mergeArgs = withGhRepo([gh, "pr", "merge", options.pr.url], repoNameWithOwner);
+  const method = options.method || "squash";
+  mergeArgs.push(method === "merge" ? "--merge" : method === "rebase" ? "--rebase" : "--squash");
+  if (options.deleteBranch !== false) {
+    mergeArgs.push("--delete-branch");
+  }
+  const autoMergeArgs = [...mergeArgs, "--auto"];
+  const autoMerge = runCapture2(autoMergeArgs, repoRoot);
+  if (autoMerge.exitCode === 0) {
+    const postAutoMergeState = readPrViewState(gh, repoRoot, repoNameWithOwner, options.pr.url);
+    if (postAutoMergeState.state === "MERGED" || postAutoMergeState.mergedAt) {
+      console.log(`Merged PR (${options.pr.repoLabel}): ${options.pr.url}`);
+      return { status: "merged", url: options.pr.url };
+    }
+    if (postAutoMergeState.state === "OPEN" && postAutoMergeState.autoMergeRequest) {
+      if (canAdminMergeApprovedPr(postAutoMergeState)) {
+        const adminMergeArgs = [...mergeArgs];
+        if (postAutoMergeState.headRefOid) {
+          adminMergeArgs.push("--match-head-commit", postAutoMergeState.headRefOid);
+        }
+        adminMergeArgs.push("--admin");
+        const adminMerge = runCapture2(adminMergeArgs, repoRoot);
+        if (adminMerge.exitCode === 0) {
+          const postAdminMergeState = readPrViewState(gh, repoRoot, repoNameWithOwner, options.pr.url);
+          if (postAdminMergeState.state === "MERGED" || postAdminMergeState.mergedAt) {
+            console.log(`Merged PR (${options.pr.repoLabel}) with admin fallback: ${options.pr.url}`);
+            return { status: "merged", url: options.pr.url };
+          }
+          throw new Error(`Admin merge command succeeded for PR ${options.pr.url} in ${options.pr.repoLabel}, but GitHub still reports it open.`);
+        }
+        const adminMergeMessage = `${adminMerge.stderr}
+${adminMerge.stdout}`.trim();
+        if (!/admin|administrator|permission|not permitted|not allowed/i.test(adminMergeMessage)) {
+          throw new Error(`Failed to admin-merge PR ${options.pr.url} in ${options.pr.repoLabel}: ${adminMergeMessage}`);
+        }
+      }
+      console.log(`Auto-merge enabled (${options.pr.repoLabel}): ${options.pr.url}`);
+      return { status: "auto-merge-enabled", url: options.pr.url };
+    }
+    throw new Error(`Auto-merge command succeeded for PR ${options.pr.url} in ${options.pr.repoLabel}, but GitHub did not report a merged or auto-merge-enabled state.`);
+  }
+  const autoMergeMessage = `${autoMerge.stderr}
+${autoMerge.stdout}`.trim();
+  const autoMergeUnsupported = /auto.?merge.*(not enabled|not allowed|disabled|unsupported)|enablePullRequestAutoMerge|Auto merge is not allowed/i.test(autoMergeMessage);
+  if (!autoMergeUnsupported) {
+    throw new Error(`Failed to auto-merge PR ${options.pr.url} in ${options.pr.repoLabel}: ${autoMergeMessage}`);
+  }
+  runOrThrow(options.projectRoot, mergeArgs, `Failed to merge PR ${options.pr.url} in ${options.pr.repoLabel}`);
+  console.log(`Merged PR (${options.pr.repoLabel}): ${options.pr.url}`);
+  return { status: "merged", url: options.pr.url };
+}
+function assertPrHasNoGitConflicts(prState, repoLabel, baseRef) {
+  const mergeable = prState.mergeable.toUpperCase();
+  const mergeStateStatus = prState.mergeStateStatus.toUpperCase();
+  if (mergeable === "CONFLICTING" || mergeStateStatus === "DIRTY") {
+    throw new Error(`PR ${prState.url || "unknown"} conflicts with ${baseRef} in ${repoLabel} (mergeable=${prState.mergeable || "unknown"}, mergeStateStatus=${prState.mergeStateStatus || "unknown"}). Rebase or merge ${baseRef} and resolve conflicts before completion-verification.`);
+  }
+}
+function writePrMetadata(projectRoot, taskId, result) {
+  const dir = artifactDirForId(projectRoot, taskId);
+  mkdirSync5(dir, { recursive: true });
+  const path = resolve11(dir, "pr-state.json");
+  let prs = {};
+  if (existsSync9(path)) {
+    try {
+      const parsed = JSON.parse(readFileSync7(path, "utf-8"));
+      if (parsed && typeof parsed === "object" && parsed.prs && typeof parsed.prs === "object") {
+        prs = parsed.prs;
+      }
+    } catch {
+      prs = {};
+    }
+  }
+  prs[result.target] = result;
+  const primary = prs.monorepo || prs.project;
+  const artifact = {
+    task_id: taskId,
+    prs,
+    ...primary || {},
+    updated_at: nowIso()
+  };
+  writeFileSync5(path, `${JSON.stringify(artifact, null, 2)}
+`, "utf-8");
+}
+function readPrMetadata(projectRoot, taskId) {
+  const path = resolve11(artifactDirForId(projectRoot, taskId), "pr-state.json");
+  if (!existsSync9(path)) {
+    return [];
+  }
+  try {
+    const parsed = JSON.parse(readFileSync7(path, "utf-8"));
+    if (!parsed || typeof parsed !== "object") {
+      return [];
+    }
+    if (parsed.prs && typeof parsed.prs === "object") {
+      return Object.values(parsed.prs).filter(isGitOpenPrResult);
+    }
+    return isGitOpenPrResult(parsed) ? [parsed] : [];
+  } catch {
+    return [];
+  }
+}
+function resolveArtifactSnapshot(projectRoot, taskId) {
+  const artifactDir = resolve11(resolveHarnessPaths(projectRoot).artifactsDir, taskId);
+  return resolve11(artifactDir, "git-state.txt");
+}
+function isGitOpenPrResult(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return false;
+  }
+  const record = value;
+  return typeof record.url === "string" && typeof record.branch === "string" && typeof record.base === "string" && (record.target === "project" || record.target === "monorepo") && typeof record.repoLabel === "string";
+}
+function resolveRepoRoot(projectRoot, target) {
+  return target === "monorepo" ? resolveOptionalMonorepoRoot(projectRoot) || resolveMonorepoRoot2(projectRoot) : projectRoot;
+}
+function ensureFullGitHistory(projectRoot, repoRoot, remoteName = "origin") {
+  const shallow = runCapture2(gitCmd(projectRoot, repoRoot, "rev-parse", "--is-shallow-repository"), projectRoot);
+  if (shallow.exitCode !== 0 || shallow.stdout.trim() !== "true") {
+    return;
+  }
+  const unshallow = runCapture2(gitCmd(projectRoot, repoRoot, "fetch", "--unshallow", "--tags", remoteName), projectRoot);
+  if (unshallow.exitCode === 0) {
+    return;
+  }
+  const output = `${unshallow.stderr}
+${unshallow.stdout}`.trim();
+  if (/--unshallow on a complete repository|does not make sense/i.test(output)) {
+    return;
+  }
+  throw new Error(`Failed to expand git history for ${repoRoot}: ${output}`);
+}
+function refreshRemoteBaseRef(projectRoot, repoRoot, baseRef, repoNameWithOwner = "") {
+  const remoteName = resolveNetworkRemoteName(projectRoot, repoRoot, repoNameWithOwner || resolveRepoNameWithOwner(projectRoot, repoRoot));
+  const remoteUrl = runCapture2(gitCmd(projectRoot, repoRoot, "remote", "get-url", remoteName), projectRoot);
+  if (remoteUrl.exitCode !== 0) {
+    return "";
+  }
+  ensureFullGitHistory(projectRoot, repoRoot, remoteName);
+  const fetch2 = runCapture2(gitCmd(projectRoot, repoRoot, "fetch", "--prune", "--tags", remoteName, `+refs/heads/${baseRef}:refs/remotes/${remoteName}/${baseRef}`), projectRoot);
+  if (fetch2.exitCode !== 0) {
+    throw new Error(`Failed to refresh ${remoteName}/${baseRef} at ${repoRoot}: ${fetch2.stderr || fetch2.stdout}`);
+  }
+  return remoteName;
+}
+function currentHeadMatchesMergedBase(projectRoot, repoRoot, baseRef, remoteName = "origin") {
+  const activeRemote = refreshRemoteBaseRef(projectRoot, repoRoot, baseRef) || remoteName;
+  const remoteBase = `${activeRemote}/${baseRef}`;
+  const hasRemoteBase = runCapture2(gitCmd(projectRoot, repoRoot, "rev-parse", "--verify", "--quiet", remoteBase), repoRoot).exitCode === 0;
+  const targetRef = hasRemoteBase ? remoteBase : baseRef;
+  if (runCapture2(gitCmd(projectRoot, repoRoot, "merge-base", "--is-ancestor", "HEAD", targetRef), repoRoot).exitCode === 0) {
+    return true;
+  }
+  return runCapture2(gitCmd(projectRoot, repoRoot, "diff", "--quiet", "HEAD", targetRef, "--"), repoRoot).exitCode === 0;
+}
+function resolveGithubCliBinary(projectRoot) {
+  const candidates = new Set;
+  const explicit = process.env.RIG_GH_BIN?.trim();
+  if (explicit) {
+    candidates.add(explicit);
+  }
+  const explicitPathEntries = (process.env.PATH || "").split(":").map((entry) => entry.trim()).filter(Boolean);
+  for (const entry of explicitPathEntries) {
+    candidates.add(resolve11(entry, "gh"));
+  }
+  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim();
+  if (hostProjectRoot) {
+    candidates.add(resolve11(resolveHostRigBinDir(hostProjectRoot), "gh"));
+  }
+  candidates.add(resolve11(resolveHostRigBinDir(projectRoot), "gh"));
+  const runtimeContext = loadRuntimeContextFromEnv();
+  if (runtimeContext?.binDir) {
+    candidates.add(resolve11(runtimeContext.binDir, "gh"));
+  }
+  const runtimeHome = process.env.RIG_RUNTIME_HOME?.trim();
+  if (runtimeHome) {
+    candidates.add(resolve11(runtimeHome, "bin", "gh"));
+  }
+  for (const candidate of ["/opt/homebrew/bin/gh", "/usr/local/bin/gh", "/usr/bin/gh"]) {
+    candidates.add(candidate);
+  }
+  const bunResolved = Bun.which("gh");
+  if (bunResolved) {
+    candidates.add(bunResolved);
+  }
+  for (const candidate of candidates) {
+    if (candidate && existsSync9(candidate)) {
+      return candidate;
+    }
+  }
+  return "";
+}
+function defaultReviewerForTask(projectRoot, taskId) {
+  if (!taskId) {
+    return "";
+  }
+  const entry = readTaskConfig(projectRoot)[taskId];
+  const reviewer = entry?.reviewer;
+  if (typeof reviewer === "string" && reviewer.trim()) {
+    return reviewer.trim();
+  }
+  const responsibleReviewer = entry?.responsible_reviewer;
+  if (typeof responsibleReviewer === "string" && responsibleReviewer.trim()) {
+    return responsibleReviewer.trim();
+  }
+  return "";
+}
+function resolveRepoNameWithOwner(projectRoot, repoRoot) {
+  const explicit = normalizeGithubRepoNameWithOwner(process.env.GH_REPO || "");
+  if (explicit) {
+    return explicit;
+  }
+  const visited = new Set;
+  return resolveGithubRepoNameWithOwnerFromGitRoot(projectRoot, repoRoot, repoRoot, visited);
+}
+function resolveGithubRepoNameWithOwnerFromGitRoot(projectRoot, gitRoot, cwd, visited) {
+  const normalizedGitRoot = resolve11(gitRoot);
+  if (visited.has(normalizedGitRoot)) {
+    return "";
+  }
+  visited.add(normalizedGitRoot);
+  const remotes = listGitRemotes(projectRoot, gitRoot, cwd);
+  for (const remote of remotes) {
+    const urls = listGitRemoteUrls(projectRoot, gitRoot, cwd, remote);
+    for (const url of urls) {
+      const direct = normalizeGithubRepoNameWithOwner(url);
+      if (direct) {
+        return direct;
+      }
+      const localGitRoot = resolveLocalGitRemoteRoot(url, gitRoot);
+      if (!localGitRoot) {
+        continue;
+      }
+      const viaMirror = resolveGithubRepoNameWithOwnerFromGitRoot(projectRoot, localGitRoot, cwd, visited);
+      if (viaMirror) {
+        return viaMirror;
+      }
+    }
+  }
+  return "";
+}
+function listGitRemotes(projectRoot, gitRoot, cwd) {
+  const result = gitQuery(projectRoot, gitRoot, cwd, "remote");
+  if (result.exitCode !== 0) {
+    return [];
+  }
+  return result.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+}
+function listGitRemoteUrls(projectRoot, gitRoot, cwd, remote) {
+  const result = gitQuery(projectRoot, gitRoot, cwd, "remote", "get-url", "--all", remote);
+  if (result.exitCode !== 0) {
+    return [];
+  }
+  return result.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+}
+function resolveNetworkRemoteName(projectRoot, repoRoot, repoNameWithOwner) {
+  const remotes = listGitRemotes(projectRoot, repoRoot, repoRoot);
+  if (remotes.length === 0) {
+    return "origin";
+  }
+  if (!repoNameWithOwner) {
+    return remotes.includes("origin") ? "origin" : remotes[0];
+  }
+  const expectedRepo = normalizeGithubRepoNameWithOwner(repoNameWithOwner).toLowerCase();
+  let directMatch = "";
+  for (const remote of remotes) {
+    const urls = listGitRemoteUrls(projectRoot, repoRoot, repoRoot, remote);
+    for (const url of urls) {
+      const direct = normalizeGithubRepoNameWithOwner(url);
+      if (direct && direct.toLowerCase() === expectedRepo) {
+        if (remote === "github") {
+          return remote;
+        }
+        if (!directMatch) {
+          directMatch = remote;
+        }
+      }
+    }
+  }
+  if (remotes.includes("github")) {
+    return "github";
+  }
+  if (directMatch) {
+    return directMatch;
+  }
+  return remotes.includes("origin") ? "origin" : remotes[0];
+}
+function gitQuery(projectRoot, gitRoot, cwd, ...args) {
+  const gitArgs = existsSync9(resolve11(gitRoot, ".git")) ? gitCmd(projectRoot, gitRoot, ...args) : [resolveGitBinary(projectRoot), "--git-dir", gitRoot, ...args];
+  return runCapture2(gitArgs, cwd, projectRoot);
+}
+function resolveLocalGitRemoteRoot(remoteUrl, gitRoot) {
+  const normalized = remoteUrl.trim();
+  if (!normalized) {
+    return "";
+  }
+  let candidate = normalized;
+  if (normalized.startsWith("file://")) {
+    try {
+      candidate = fileURLToPath(normalized);
+    } catch {
+      return "";
+    }
+  } else if (/^[a-z][a-z0-9+.-]*:\/\//i.test(normalized) || /^[^@]+@[^:]+:.+$/.test(normalized)) {
+    return "";
+  } else if (!isAbsolute2(normalized)) {
+    candidate = resolve11(gitRoot, normalized);
+  }
+  return existsSync9(candidate) ? candidate : "";
+}
+function normalizeGithubRepoNameWithOwner(value) {
+  const normalized = value.trim();
+  if (!normalized) {
+    return "";
+  }
+  const scpMatch = normalized.match(/^(?:ssh:\/\/)?git@github\.com[:/](.+?)(?:\.git)?$/i);
+  if (scpMatch?.[1]) {
+    return scpMatch[1].replace(/^\/+|\/+$/g, "");
+  }
+  const httpMatch = normalized.match(/^https?:\/\/github\.com\/(.+?)(?:\.git)?(?:\/)?$/i);
+  if (httpMatch?.[1]) {
+    return httpMatch[1].replace(/^\/+|\/+$/g, "");
+  }
+  const bareMatch = normalized.match(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/);
+  return bareMatch ? bareMatch[0] : "";
+}
+function ghRepoArgs(repoNameWithOwner) {
+  return repoNameWithOwner ? ["-R", repoNameWithOwner] : [];
+}
+function withGhRepo(command, repoNameWithOwner) {
+  if (!repoNameWithOwner || command.length < 3) {
+    return command;
+  }
+  return [command[0], command[1], command[2], ...ghRepoArgs(repoNameWithOwner), ...command.slice(3)];
+}
+function inferProjectBase(projectRoot, fallback) {
+  const containing = runCapture2(gitCmd(projectRoot, projectRoot, "branch", "-r", "--contains", "HEAD"), projectRoot);
+  if (containing.exitCode !== 0) {
+    return fallback;
+  }
+  const candidates = containing.stdout.split(/\r?\n/).map((line) => line.replace(/^\*/, "").trim()).filter(Boolean).map((line) => line.replace(/^origin\//, "")).filter((line) => line !== "HEAD" && !line.startsWith("rig/"));
+  return candidates[0] || fallback;
+}
+function currentGithubLogin(repoRoot) {
+  const gh = resolveGithubCliBinary(repoRoot);
+  if (!gh) {
+    return "";
+  }
+  const result = runCapture2([gh, "api", "user", "--jq", ".login"], repoRoot);
+  return result.exitCode === 0 ? result.stdout.trim() : "";
+}
+function collectPrChangedFiles(projectRoot, repoRoot, baseRef, branchRef) {
+  const repoNameWithOwner = resolveRepoNameWithOwner(projectRoot, repoRoot);
+  const remoteName = refreshRemoteBaseRef(projectRoot, repoRoot, baseRef, repoNameWithOwner);
+  const hasRemoteBase = remoteName ? runCapture2(gitCmd(projectRoot, repoRoot, "rev-parse", "--verify", "--quiet", `${remoteName}/${baseRef}`), projectRoot).exitCode === 0 : false;
+  const hasLocalBase = runCapture2(gitCmd(projectRoot, repoRoot, "rev-parse", "--verify", "--quiet", baseRef), projectRoot).exitCode === 0;
+  let changed = "";
+  if (hasRemoteBase) {
+    changed = runCapture2(gitCmd(projectRoot, repoRoot, "diff", "--name-only", `${remoteName}/${baseRef}...${branchRef}`), projectRoot).stdout;
+  } else if (hasLocalBase) {
+    changed = runCapture2(gitCmd(projectRoot, repoRoot, "diff", "--name-only", `${baseRef}...${branchRef}`), projectRoot).stdout;
+  } else {
+    const fallback = runCapture2(gitCmd(projectRoot, repoRoot, "diff", "--name-only", `HEAD~1..${branchRef}`), projectRoot);
+    changed = fallback.exitCode === 0 ? fallback.stdout : runCapture2(gitCmd(projectRoot, repoRoot, "diff", "--name-only"), projectRoot).stdout;
+  }
+  return changed.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).slice(0, 60);
+}
+function inferReviewerFromChangedFiles(projectRoot, repoRoot, baseRef, branchRef) {
+  const repoNameWithOwner = resolveRepoNameWithOwner(projectRoot, repoRoot);
+  if (!repoNameWithOwner) {
+    return "";
+  }
+  const actorLogin = currentGithubLogin(repoRoot);
+  const changedFiles = collectPrChangedFiles(projectRoot, repoRoot, baseRef, branchRef);
+  if (changedFiles.length === 0) {
+    return "";
+  }
+  const counts = new Map;
+  for (const path of changedFiles) {
+    const result = runCapture2([
+      resolveGithubCliBinary(repoRoot) || "gh",
+      "api",
+      `repos/${repoNameWithOwner}/commits`,
+      "-f",
+      `path=${path}`,
+      "-f",
+      `sha=${baseRef}`,
+      "-f",
+      "per_page=1",
+      "--jq",
+      ".[0].author.login // empty"
+    ], repoRoot);
+    const author = result.exitCode === 0 ? result.stdout.trim() : "";
+    if (!author || author === actorLogin) {
+      continue;
+    }
+    counts.set(author, (counts.get(author) || 0) + 1);
+  }
+  let best = "";
+  let max = -1;
+  for (const [author, count] of counts.entries()) {
+    if (count > max || count === max && author < best) {
+      best = author;
+      max = count;
+    }
+  }
+  return best;
+}
+function snapshotRepo(projectRoot, label, repo) {
+  if (!existsSync9(resolve11(repo, ".git"))) {
+    return [`## ${label}`, `repo: ${repo}`, "status: unavailable", ""];
+  }
+  const status = runCapture2(gitCmd(projectRoot, repo, "status", "--short"), projectRoot).stdout.trim();
+  const branch = branchName(projectRoot, repo);
+  let head;
+  const nativeHead = nativeHeadOid(repo);
+  if (nativeHead !== null) {
+    head = nativeHead;
+  } else {
+    head = runCapture2(gitCmd(projectRoot, repo, "rev-parse", "HEAD"), projectRoot).stdout.trim();
+  }
+  return [
+    `## ${label}`,
+    `repo: ${repo}`,
+    `branch: ${branch}`,
+    `head: ${head}`,
+    "status:",
+    status || "(clean)",
+    ""
+  ];
+}
+function commitRepo(projectRoot, repo, label, message, allowEmpty, scoped, files, changedFilesManifest) {
+  if (!existsSync9(resolve11(repo, ".git"))) {
+    console.log(`Skipping ${label}: repo not available (${repo})`);
+    return;
+  }
+  const scopedFiles = (files || []).filter(Boolean).filter((file) => !pathResolvesBeyondSymlink(repo, file));
+  const repoChanges = changeCount(projectRoot, repo);
+  if (scopedFiles.length === 0 && repoChanges === 0 && !allowEmpty) {
+    console.log(`Skipping ${label}: no changes to commit.`);
+    return;
+  }
+  const addArgs = buildStageAddArgs(repo, scopedFiles, scoped);
+  if (addArgs) {
+    runOrThrow(projectRoot, gitCmd(projectRoot, repo, ...addArgs), `Failed to stage changes for ${label}`);
+  }
+  const stagedChanges = stagedChangeCount(projectRoot, repo);
+  if (stagedChanges === 0) {
+    if (allowEmpty) {
+      runOrThrow(projectRoot, gitCmd(projectRoot, repo, "commit", "--allow-empty", "-m", message), `Failed to commit ${label}`);
+      console.log(`Committed ${label}: ${message}`);
+      return;
+    }
+    if (scoped && repoChanges > 0) {
+      const manifestHint = changedFilesManifest ? ` Refresh ${changedFilesManifest} and retry, or use --all/--unscoped intentionally.` : "";
+      throw new Error(`Scoped commit for ${label} resolved no stageable files.${manifestHint}`);
+    }
+    console.log(`Skipping ${label}: no stageable changes to commit.`);
+    return;
+  }
+  runOrThrow(projectRoot, gitCmd(projectRoot, repo, "commit", ...allowEmpty ? ["--allow-empty"] : [], "-m", message), `Failed to commit ${label}`);
+  console.log(`Committed ${label}: ${message}`);
+}
+function readChangedFilesManifest(projectRoot, taskId) {
+  const manifestPath = resolve11(artifactDirForId(projectRoot, taskId), "changed-files.txt");
+  if (!existsSync9(manifestPath)) {
+    return [];
+  }
+  const files = readFileSync7(manifestPath, "utf-8").split(/\r?\n/).map((line) => normalizeChangedFilePath2(line)).filter(Boolean);
+  return [...new Set(files)];
+}
+function refreshChangedFilesManifest(projectRoot, taskId) {
+  const manifestPath = resolve11(artifactDirForId(projectRoot, taskId), "changed-files.txt");
+  mkdirSync5(dirname7(manifestPath), { recursive: true });
+  const changedFiles = changedFilesForTask(projectRoot, taskId, true);
+  writeFileSync5(manifestPath, `${changedFiles.join(`
+`)}
+`, "utf-8");
+  return manifestPath;
+}
+function normalizeChangedFilePath2(file) {
+  return file.trim().replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function buildStageAddArgs(repoRoot, files, scoped) {
+  if (files.length > 0) {
+    return ["add", "--", ...files];
+  }
+  if (scoped) {
+    return null;
+  }
+  return ["add", "-A", "--", ".", ...stageExcludePathspecs(repoRoot)];
+}
+function resolveScopedStageFilesForRepo(projectRoot, repoRoot, taskId, files) {
+  const resolvedManifestFiles = resolveScopedFilesForRepo(projectRoot, repoRoot, files);
+  if (resolvedManifestFiles.length > 0 || !taskId) {
+    return resolvedManifestFiles;
+  }
+  return resolveChangedTaskArtifactFiles(projectRoot, repoRoot, taskId);
+}
+function resolveScopedFilesForRepo(projectRoot, repoRoot, files) {
+  const resolvedFiles = [];
+  const seen = new Set;
+  for (const file of files) {
+    const candidate = resolveScopedRepoPath(repoRoot, file);
+    if (!candidate || seen.has(candidate) || pathResolvesBeyondSymlink(repoRoot, candidate)) {
+      continue;
+    }
+    if (!repoHasPathChange(projectRoot, repoRoot, candidate)) {
+      continue;
+    }
+    seen.add(candidate);
+    resolvedFiles.push(candidate);
+  }
+  return resolvedFiles;
+}
+function resolveChangedTaskArtifactFiles(projectRoot, repoRoot, taskId) {
+  const artifactPrefix = `artifacts/${taskId}/`;
+  const resolvedFiles = [];
+  const seen = new Set;
+  for (const file of collectRepoPendingFiles(projectRoot, repoRoot)) {
+    if (!file.startsWith(artifactPrefix)) {
+      continue;
+    }
+    const artifactRelativePath = file.slice(artifactPrefix.length);
+    if (!TASK_ARTIFACT_STAGE_FALLBACK.has(artifactRelativePath)) {
+      continue;
+    }
+    if (seen.has(file) || pathResolvesBeyondSymlink(repoRoot, file)) {
+      continue;
+    }
+    seen.add(file);
+    resolvedFiles.push(file);
+  }
+  return resolvedFiles.sort();
+}
+function collectRepoPendingFiles(projectRoot, repoRoot) {
+  const pending = nativePendingFiles(repoRoot);
+  if (pending !== null) {
+    if (pending.length > 0) {
+      return [...new Set(pending.map((f) => normalizeChangedFilePath2(f.path)).filter(Boolean))].sort();
+    }
+  }
+  const files = new Set;
+  for (const args of [
+    ["diff", "--name-only"],
+    ["diff", "--cached", "--name-only"],
+    ["ls-files", "--others", "--exclude-standard"]
+  ]) {
+    const result = runCapture2(gitCmd(projectRoot, repoRoot, ...args), projectRoot);
+    if (result.exitCode !== 0) {
+      continue;
+    }
+    for (const line of result.stdout.split(/\r?\n/)) {
+      const normalized = normalizeChangedFilePath2(line);
+      if (!normalized) {
+        continue;
+      }
+      files.add(normalized);
+    }
+  }
+  return [...files].sort();
+}
+function resolveScopedRepoPath(repoRoot, file) {
+  const normalized = normalizeChangedFilePath2(file);
+  if (!normalized) {
+    return "";
+  }
+  const rules = getScopeRules();
+  if (rules?.stripPrefixes) {
+    let result = normalized;
+    for (const prefix of rules.stripPrefixes) {
+      if (result.startsWith(prefix)) {
+        result = result.slice(prefix.length);
+      }
+    }
+    return result;
+  }
+  return normalized;
+}
+function repoHasPathChange(projectRoot, repoRoot, relativePath) {
+  const native = nativeFileHasChanges(repoRoot, relativePath);
+  if (native !== null) {
+    return native;
+  }
+  const result = runCapture2(gitCmd(projectRoot, repoRoot, "status", "--short", "--", relativePath), projectRoot);
+  return result.exitCode === 0 && result.stdout.trim().length > 0;
+}
+function stageExcludePathspecs(repoRoot) {
+  const patterns = existsSync9(resolve11(repoRoot, ".rig", "task-config.json")) ? [...TASK_RUNTIME_STAGE_EXCLUDES, ...GENERATED_STAGE_EXCLUDES] : [".rig/**", ...GENERATED_STAGE_EXCLUDES];
+  return patterns.map((pattern) => `:(glob,exclude)${pattern}`);
+}
+function pathResolvesBeyondSymlink(repoRoot, relativePath) {
+  const parts = relativePath.split("/").filter(Boolean);
+  if (parts.length <= 1) {
+    return false;
+  }
+  let current = repoRoot;
+  for (let index = 0;index < parts.length - 1; index += 1) {
+    current = resolve11(current, parts[index]);
+    try {
+      if (lstatSync(current).isSymbolicLink()) {
+        return true;
+      }
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function printRepoStatus(projectRoot, label, repo, expectedBranch) {
+  if (!existsSync9(resolve11(repo, ".git"))) {
+    console.log(`${label}: unavailable (${repo})`);
+    return;
+  }
+  const branch = branchName(projectRoot, repo);
+  const changes = changeCount(projectRoot, repo);
+  console.log(`${label}:`);
+  console.log(`  branch: ${branch || "unknown"}`);
+  console.log(`  changed files: ${changes}`);
+  if (expectedBranch && label !== "project-rig" && branch !== expectedBranch) {
+    console.log(`  warning: branch mismatch (expected ${expectedBranch})`);
+  }
+}
+function resolveTaskBranchId(projectRoot, taskId) {
+  if (/^bd-[a-z0-9-]+$/.test(taskId)) {
+    return taskId;
+  }
+  const normalizedTaskId = lookupTask(projectRoot, taskId);
+  if (normalizedTaskId) {
+    return normalizedTaskId;
+  }
+  const currentTask = currentTaskId(projectRoot);
+  if (currentTask && currentTask === taskId) {
+    return currentTask;
+  }
+  const runtimeIdFromEnv = (process.env.RIG_TASK_RUNTIME_ID || "").trim();
+  if (runtimeIdFromEnv.startsWith("task-") && runtimeIdFromEnv.length > "task-".length) {
+    return runtimeIdFromEnv.slice("task-".length);
+  }
+  try {
+    const runtimeIdFromContext = loadRuntimeContextFromEnv()?.runtimeId || "";
+    if (runtimeIdFromContext.startsWith("task-") && runtimeIdFromContext.length > "task-".length) {
+      return runtimeIdFromContext.slice("task-".length);
+    }
+  } catch {}
+  const artifactDir = artifactDirForId(projectRoot, taskId);
+  if (existsSync9(artifactDir)) {
+    return taskId;
+  }
+  throw new Error(`Unknown task id: ${taskId}`);
+}
+function branchName(projectRoot, repo) {
+  const native = nativeBranchName(repo);
+  if (native !== null) {
+    return native;
+  }
+  return runCapture2(gitCmd(projectRoot, repo, "rev-parse", "--abbrev-ref", "HEAD"), projectRoot).stdout.trim();
+}
+function changeCount(projectRoot, repo) {
+  const native = nativeChangeCount(repo);
+  if (native !== null) {
+    return native;
+  }
+  const status = runCapture2(gitCmd(projectRoot, repo, "status", "--short"), projectRoot).stdout.trim();
+  return status ? status.split(/\r?\n/).filter(Boolean).length : 0;
+}
+function stagedChangeCount(projectRoot, repo) {
+  const staged = runCapture2(gitCmd(projectRoot, repo, "diff", "--cached", "--name-only"), projectRoot).stdout.trim();
+  return staged ? staged.split(/\r?\n/).filter(Boolean).length : 0;
+}
+function runOrThrow(projectRoot, command, errorPrefix) {
+  const result = runCapture2(command, projectRoot);
+  if (result.exitCode !== 0) {
+    throw new Error(`${errorPrefix}:
+${result.stderr || result.stdout}`);
+  }
+}
+function runCapture2(command, cwd, projectRoot = cwd) {
+  return runCapture(command, cwd, runtimeGitEnv(projectRoot));
+}
+function runtimeGitEnv(projectRoot) {
+  const { ctx, runtimeRoot } = resolveRuntimeMetadata(projectRoot);
+  const runtimeHome = runtimeRoot ? resolve11(runtimeRoot, "home") : "";
+  const runtimeTmp = runtimeRoot ? resolve11(runtimeRoot, "tmp") : "";
+  const runtimeCache = runtimeRoot ? resolve11(runtimeRoot, "cache") : "";
+  const runtimeKnownHosts = runtimeHome ? resolve11(runtimeHome, ".ssh", "known_hosts") : "";
+  const runtimeKey = runtimeHome ? resolve11(runtimeHome, ".ssh", "rig-agent-key") : "";
+  const env = {};
+  if (ctx?.workspaceDir) {
+    env.PROJECT_RIG_ROOT = projectRoot;
+    env.RIG_TASK_WORKSPACE = ctx.workspaceDir;
+    env.MONOREPO_ROOT = ctx.workspaceDir;
+    env.MONOREPO_MAIN_ROOT = resolveMonorepoRoot2(projectRoot);
+  } else if (projectRoot) {
+    env.PROJECT_RIG_ROOT = projectRoot;
+  }
+  if (runtimeRoot) {
+    env.RIG_RUNTIME_HOME = runtimeRoot;
+  }
+  if (runtimeHome && existsSync9(runtimeHome)) {
+    env.HOME = runtimeHome;
+    env.OPENSSL_CONF = ensureRuntimeOpenSslConfig(runtimeHome);
+  }
+  if (runtimeTmp && existsSync9(runtimeTmp)) {
+    env.TMPDIR = runtimeTmp;
+  }
+  if (runtimeCache && existsSync9(runtimeCache)) {
+    env.XDG_CACHE_HOME = runtimeCache;
+  }
+  const workspaceSecrets = loadDotEnvSecrets(ctx?.workspaceDir || projectRoot, process.env);
+  for (const [key, value] of Object.entries(resolveRuntimeSecrets(process.env, workspaceSecrets))) {
+    if (key === "GITHUB_SSH_KEY" || !value) {
+      continue;
+    }
+    env[key] = value;
+  }
+  if (!env.GITHUB_TOKEN && env.GH_TOKEN) {
+    env.GITHUB_TOKEN = env.GH_TOKEN;
+  }
+  if (!env.GH_TOKEN && env.GITHUB_TOKEN) {
+    env.GH_TOKEN = env.GITHUB_TOKEN;
+  }
+  if (!env.GREPTILE_GITHUB_TOKEN && env.GITHUB_TOKEN) {
+    env.GREPTILE_GITHUB_TOKEN = env.GITHUB_TOKEN;
+  }
+  const persistedSecrets = loadPersistedRuntimeSecrets(runtimeRoot);
+  for (const [key, value] of Object.entries(persistedSecrets)) {
+    if (!value)
+      continue;
+    if (!env[key]) {
+      env[key] = value;
+    }
+  }
+  if (!env.GITHUB_TOKEN && env.GH_TOKEN) {
+    env.GITHUB_TOKEN = env.GH_TOKEN;
+  }
+  if (!env.GH_TOKEN && env.GITHUB_TOKEN) {
+    env.GH_TOKEN = env.GITHUB_TOKEN;
+  }
+  if (runtimeKnownHosts && existsSync9(runtimeKnownHosts)) {
+    const sshParts = [
+      "ssh",
+      `-o UserKnownHostsFile="${runtimeKnownHosts}"`,
+      "-o StrictHostKeyChecking=yes",
+      "-F /dev/null"
+    ];
+    if (runtimeKey && existsSync9(runtimeKey)) {
+      sshParts.splice(1, 0, `-i "${runtimeKey}"`, "-o IdentitiesOnly=yes");
+    }
+    env.GIT_SSH_COMMAND = sshParts.join(" ");
+  } else if (process.env.GIT_SSH_COMMAND?.trim()) {
+    env.GIT_SSH_COMMAND = process.env.GIT_SSH_COMMAND;
+  }
+  return Object.keys(env).length > 0 ? env : undefined;
+}
+function loadPersistedRuntimeSecrets(runtimeRoot) {
+  if (!runtimeRoot) {
+    return {};
+  }
+  const path = resolve11(runtimeRoot, "runtime-secrets.json");
+  if (!existsSync9(path)) {
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(readFileSync7(path, "utf-8"));
+    const entries = Object.entries(parsed).filter((entry) => typeof entry[1] === "string");
+    return Object.fromEntries(entries);
+  } catch {
+    return {};
+  }
+}
+function ensureRuntimeOpenSslConfig(runtimeHome) {
+  const sslDir = resolve11(runtimeHome, ".ssl");
+  const sslConfig = resolve11(sslDir, "openssl.cnf");
+  if (!existsSync9(sslDir)) {
+    mkdirSync5(sslDir, { recursive: true });
+  }
+  if (!existsSync9(sslConfig)) {
+    writeFileSync5(sslConfig, `# Rig runtime OpenSSL config placeholder
+`);
+  }
+  return sslConfig;
+}
+function resolveRuntimeMetadata(projectRoot) {
+  const contextFile = process.env.RIG_RUNTIME_CONTEXT_FILE?.trim();
+  const runtimeHome = process.env.RIG_RUNTIME_HOME?.trim();
+  let ctx = loadRuntimeContextFromEnv();
+  if (runtimeHome) {
+    return {
+      ctx,
+      runtimeRoot: runtimeHome
+    };
+  }
+  if (contextFile) {
+    return {
+      ctx,
+      runtimeRoot: dirname7(resolve11(contextFile))
+    };
+  }
+  const inferredContextFile = findRuntimeContextFile2(projectRoot);
+  if (existsSync9(inferredContextFile)) {
+    try {
+      ctx = loadRuntimeContext(inferredContextFile);
+    } catch {}
+    return {
+      ctx,
+      runtimeRoot: dirname7(inferredContextFile)
+    };
+  }
+  return { ctx, runtimeRoot: "" };
+}
+function findRuntimeContextFile2(startPath) {
+  let current = resolve11(startPath);
+  while (true) {
+    const candidate = resolve11(current, "runtime-context.json");
+    if (existsSync9(candidate)) {
+      return candidate;
+    }
+    const parent = dirname7(current);
+    if (parent === current) {
+      return "";
+    }
+    current = parent;
+  }
+}
+var __testOnly = {
+  buildStageAddArgs,
+  refreshChangedFilesManifest,
+  readChangedFilesManifest,
+  resolveChangedTaskArtifactFiles,
+  resolveScopedStageFilesForRepo,
+  resolveScopedFilesForRepo,
+  stageExcludePathspecs
+};
+export {
+  shouldScopeGitCommit,
+  resolveTaskBranchRef,
+  readPrMetadata,
+  gitSyncBranch,
+  gitStatus,
+  gitSnapshot,
+  gitPreflight,
+  gitOpenPr,
+  gitMergePr,
+  gitCommit,
+  gitChanged,
+  __testOnly
+};